@theokit/cli 0.1.1

package/dist/index.cjs

@@ -0,0 +1,1552 @@
+'use strict';
+
+var commander = require('commander');
+var url = require('url');
+var fs = require('fs');
+var path = require('path');
+var child_process = require('child_process');
+var pc5 = require('picocolors');
+var module$1 = require('module');
+var pathSafety = require('@theokit/sdk/path-safety');
+var crypto = require('crypto');
+var _eval = require('@theokit/sdk/eval');
+var p = require('@clack/prompts');
+var sdk = require('@theokit/sdk');
+var os = require('os');
+var taskStore = require('@theokit/sdk/task-store');
+
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var pc5__default = /*#__PURE__*/_interopDefault(pc5);
+var p__namespace = /*#__PURE__*/_interopNamespace(p);
+
+// src/main.ts
+var FALLBACK_CANDIDATES = [
+  "src/index.ts",
+  "src/index.tsx",
+  "src/index.mjs",
+  "src/index.js",
+  "index.ts",
+  "index.mjs",
+  "index.js"
+];
+function entryNotFoundError(message) {
+  const err = new Error(message);
+  err.code = "entry_not_found";
+  return err;
+}
+function resolveFromExplicit(cwd, explicit) {
+  const abs = path.isAbsolute(explicit) ? explicit : path.resolve(cwd, explicit);
+  if (!fs.existsSync(abs)) throw entryNotFoundError(`Entry file not found: ${explicit}`);
+  return abs;
+}
+function resolveFromPackageJson(cwd) {
+  const pkgPath = path.join(cwd, "package.json");
+  if (!fs.existsSync(pkgPath)) return void 0;
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+    if (typeof pkg.main === "string" && pkg.main.length > 0) {
+      const abs = path.resolve(cwd, pkg.main);
+      if (fs.existsSync(abs)) return abs;
+    }
+  } catch {
+  }
+  return void 0;
+}
+function resolveFromCandidates(cwd) {
+  for (const candidate of FALLBACK_CANDIDATES) {
+    const abs = path.join(cwd, candidate);
+    if (fs.existsSync(abs)) return abs;
+  }
+  return void 0;
+}
+function resolveEntry(cwd, explicit) {
+  if (explicit !== void 0 && explicit.length > 0) return resolveFromExplicit(cwd, explicit);
+  const fromPkg = resolveFromPackageJson(cwd);
+  if (fromPkg !== void 0) return fromPkg;
+  const fromCandidate = resolveFromCandidates(cwd);
+  if (fromCandidate !== void 0) return fromCandidate;
+  throw entryNotFoundError(
+    `No entry file found. Pass --entry <path> or create one of: ${FALLBACK_CANDIDATES.join(", ")}`
+  );
+}
+
+// src/commands/acp.ts
+function resolveDefaultExport(mod) {
+  if (mod === null || mod === void 0) return void 0;
+  const asObj = mod;
+  return asObj.default ?? mod;
+}
+function isValidAgentShape(value) {
+  if (typeof value === "function") return true;
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value;
+  return typeof obj.agentId === "string" && typeof obj.send === "function";
+}
+function fail(msg, code = 1) {
+  process.stderr.write(`theokit acp: ${msg}
+`);
+  return code;
+}
+async function loadAgentFromEntry(entryArg) {
+  let entryPath;
+  try {
+    entryPath = resolveEntry(process.cwd(), entryArg);
+  } catch (err) {
+    return { ok: false, exitCode: fail(err instanceof Error ? err.message : String(err), 2) };
+  }
+  let mod;
+  try {
+    mod = await import(url.pathToFileURL(entryPath).href);
+  } catch (err) {
+    return {
+      ok: false,
+      exitCode: fail(`failed to import entry: ${err instanceof Error ? err.message : err}`, 1)
+    };
+  }
+  const agent = resolveDefaultExport(mod);
+  if (!isValidAgentShape(agent)) {
+    return {
+      ok: false,
+      exitCode: fail(
+        `entry ${entryPath} must export an SDKAgent or a factory (sessionId) => SDKAgent. Got: ${typeof agent}`,
+        2
+      )
+    };
+  }
+  return { ok: true, agent };
+}
+function parseTrustedTools(raw) {
+  if (typeof raw !== "string" || raw.length === 0) return void 0;
+  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+function parseTimeout(raw) {
+  if (typeof raw !== "string") return { ok: true };
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n <= 0) return { ok: false };
+  return { ok: true, value: n };
+}
+function parseFlags(opts) {
+  const permission = opts.permission ?? "ask";
+  if (permission !== "ask" && permission !== "auto" && permission !== "deny") {
+    return { ok: false, exitCode: fail(`invalid --permission: ${permission}`, 2) };
+  }
+  const timeout = parseTimeout(opts.permissionTimeoutMs);
+  if (!timeout.ok) {
+    return {
+      ok: false,
+      exitCode: fail(`invalid --permission-timeout-ms: ${opts.permissionTimeoutMs}`, 2)
+    };
+  }
+  const trustedTools = parseTrustedTools(opts.trustedTools);
+  const flags = { permission };
+  if (trustedTools !== void 0) flags.trustedTools = trustedTools;
+  if (timeout.value !== void 0) flags.permissionTimeoutMs = timeout.value;
+  return { ok: true, flags };
+}
+async function importServeAcp() {
+  try {
+    const mod = await import('@theokit/acp');
+    return { ok: true, serveAcp: mod.serveAcp };
+  } catch (err) {
+    return {
+      ok: false,
+      exitCode: fail(
+        `@theokit/acp not installed. Run: npm i @theokit/acp. (${err instanceof Error ? err.message : err})`,
+        1
+      )
+    };
+  }
+}
+async function runAcp(opts) {
+  const agentRes = await loadAgentFromEntry(opts.entry);
+  if (!agentRes.ok) return agentRes.exitCode;
+  const flagsRes = parseFlags(opts);
+  if (!flagsRes.ok) return flagsRes.exitCode;
+  const serveRes = await importServeAcp();
+  if (!serveRes.ok) return serveRes.exitCode;
+  try {
+    await serveRes.serveAcp({
+      agent: agentRes.agent,
+      permissionDefault: flagsRes.flags.permission,
+      ...flagsRes.flags.trustedTools !== void 0 ? { trustedTools: flagsRes.flags.trustedTools } : {},
+      ...flagsRes.flags.permissionTimeoutMs !== void 0 ? { permissionTimeoutMs: flagsRes.flags.permissionTimeoutMs } : {}
+    });
+  } catch (err) {
+    return fail(err instanceof Error ? err.message : String(err), 1);
+  }
+  return 0;
+}
+function findDrizzleKit(cwd) {
+  const candidates = [
+    path.join(cwd, "node_modules", ".bin", "drizzle-kit"),
+    path.join(cwd, "node_modules", "drizzle-kit", "bin.cjs")
+  ];
+  for (const c of candidates) {
+    if (fs.existsSync(c)) return c;
+  }
+  return null;
+}
+function runDrizzleKit(verb, cwd, extraArgs = []) {
+  const bin = findDrizzleKit(cwd);
+  if (!bin) {
+    process.stderr.write(
+      "theokit db: drizzle-kit not found in node_modules. Install it: pnpm add -D drizzle-kit\n"
+    );
+    return 2;
+  }
+  const r = child_process.spawnSync(bin, [verb, ...extraArgs], { cwd, stdio: "inherit" });
+  if (r.status === null) return 1;
+  return r.status;
+}
+function runDbGenerate(opts = {}) {
+  return runDrizzleKit("generate", opts.cwd ?? process.cwd());
+}
+function runDbMigrate(opts = {}) {
+  return runDrizzleKit("migrate", opts.cwd ?? process.cwd());
+}
+function runDbStudio(opts = {}) {
+  return runDrizzleKit("studio", opts.cwd ?? process.cwd());
+}
+function runDbPush(opts = {}) {
+  return runDrizzleKit("push", opts.cwd ?? process.cwd());
+}
+async function loadOrmConfig(configPath) {
+  if (!fs.existsSync(configPath)) {
+    throw new Error(
+      `theokit db: orm.config not found at ${configPath}. Create one that default-exports { schema } (the Drizzle schema object).`
+    );
+  }
+  const bust = `${Date.now()}-${Math.random().toString(36).slice(2)}`;
+  const url$1 = `${url.pathToFileURL(configPath).href}?v=${bust}`;
+  const mod = await import(url$1);
+  if (!mod.default || typeof mod.default !== "object" || !mod.default.schema) {
+    throw new Error(
+      `theokit db: orm.config at ${configPath} must default-export { schema }. Got: ${typeof mod.default}`
+    );
+  }
+  return mod.default;
+}
+async function loadSchemaExporter(cwd) {
+  const candidates = [
+    path.join(cwd, "node_modules", "@theokit", "orm", "dist", "schema-export.js"),
+    path.join(cwd, "node_modules", "@theokit", "orm", "schema-export.js")
+  ];
+  for (const c of candidates) {
+    if (fs.existsSync(c)) {
+      return await import(url.pathToFileURL(c).href);
+    }
+  }
+  throw new Error("theokit db: @theokit/orm is not installed. Install it: pnpm add @theokit/orm");
+}
+function atomicWrite(filePath, content) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const tmp = `${filePath}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, content, { mode: 420 });
+  fs.renameSync(tmp, filePath);
+}
+async function loadConfigOrError(configPath) {
+  try {
+    return { ok: true, value: await loadOrmConfig(configPath) };
+  } catch (err) {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+`);
+    return { ok: false, code: 2 };
+  }
+}
+async function loadExporterOrError(cwd) {
+  try {
+    return { ok: true, value: await loadSchemaExporter(cwd) };
+  } catch (err) {
+    process.stderr.write(`${err instanceof Error ? err.message : String(err)}
+`);
+    return { ok: false, code: 2 };
+  }
+}
+function exportSchemasOrError(exporter, schema) {
+  try {
+    return { ok: true, value: exporter.exportSchemas(schema) };
+  } catch (err) {
+    process.stderr.write(
+      `theokit db: schema export failed: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return { ok: false, code: 1 };
+  }
+}
+function writeSchemasToOutDir(schemas, outDir) {
+  fs.mkdirSync(outDir, { recursive: true });
+  for (const f of fs.readdirSync(outDir).filter((n) => n.endsWith(".schema.json"))) {
+    fs.unlinkSync(path.join(outDir, f));
+  }
+  for (const [name, schema] of Object.entries(schemas)) {
+    const target = path.join(outDir, `${name}.schema.json`);
+    atomicWrite(target, `${JSON.stringify(schema, null, 2)}
+`);
+  }
+}
+async function runDbExportSchema(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const configPath = path.resolve(cwd, opts.config ?? "orm.config.ts");
+  const outDir = path.resolve(cwd, opts.out ?? ".theokit/schema");
+  const configResult = await loadConfigOrError(configPath);
+  if (!configResult.ok) return configResult.code;
+  const exporterResult = await loadExporterOrError(cwd);
+  if (!exporterResult.ok) return exporterResult.code;
+  const schemasResult = exportSchemasOrError(exporterResult.value, configResult.value.schema);
+  if (!schemasResult.ok) return schemasResult.code;
+  writeSchemasToOutDir(schemasResult.value, outDir);
+  process.stdout.write(
+    `theokit db: wrote ${Object.keys(schemasResult.value).length} schema(s) to ${outDir}
+`
+  );
+  return 0;
+}
+function readCommittedSchemas(outDir) {
+  if (!fs.existsSync(outDir)) return {};
+  const out = {};
+  for (const f of fs.readdirSync(outDir).filter((n) => n.endsWith(".schema.json"))) {
+    const name = f.replace(/\.schema\.json$/, "");
+    out[name] = JSON.parse(fs.readFileSync(path.join(outDir, f), "utf-8"));
+  }
+  return out;
+}
+function computeSchemaDrift(fresh, committed) {
+  const freshKeys = new Set(Object.keys(fresh));
+  const committedKeys = new Set(Object.keys(committed));
+  const added = [...freshKeys].filter((k) => !committedKeys.has(k));
+  const removed = [...committedKeys].filter((k) => !freshKeys.has(k));
+  const changed = [...freshKeys].filter(
+    (k) => committedKeys.has(k) && JSON.stringify(fresh[k]) !== JSON.stringify(committed[k])
+  );
+  return { added, removed, changed };
+}
+function reportSchemaDrift(drift) {
+  const { added, removed, changed } = drift;
+  if (added.length === 0 && removed.length === 0 && changed.length === 0) {
+    process.stdout.write("theokit db: schema in sync (no drift)\n");
+    return 0;
+  }
+  process.stderr.write("theokit db: schema drift detected\n");
+  if (added.length > 0) process.stderr.write(`  added:   ${added.join(", ")}
+`);
+  if (removed.length > 0) process.stderr.write(`  removed: ${removed.join(", ")}
+`);
+  if (changed.length > 0) process.stderr.write(`  changed: ${changed.join(", ")}
+`);
+  process.stderr.write("Run `theokit db export-schema` to refresh.\n");
+  return 1;
+}
+async function runDbCheckSchemaDrift(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const configPath = path.resolve(cwd, opts.config ?? "orm.config.ts");
+  const outDir = path.resolve(cwd, opts.out ?? ".theokit/schema");
+  const configResult = await loadConfigOrError(configPath);
+  if (!configResult.ok) return configResult.code;
+  const exporterResult = await loadExporterOrError(cwd);
+  if (!exporterResult.ok) return exporterResult.code;
+  const fresh = exporterResult.value.exportSchemas(configResult.value.schema);
+  const committed = readCommittedSchemas(outDir);
+  return reportSchemaDrift(computeSchemaDrift(fresh, committed));
+}
+function resolveTsxBin() {
+  const require2 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
+  return require2.resolve("tsx/cli");
+}
+function startRunner(opts) {
+  const tsxBin = resolveTsxBin();
+  const args = [];
+  if (opts.watch !== false) args.push("--watch");
+  const envFile = opts.envFile ?? ".env";
+  const envFileAbs = path.join(opts.cwd, envFile);
+  if (fs.existsSync(envFileAbs)) {
+    args.push("--env-file", envFile);
+  }
+  args.push(opts.entry);
+  const child = child_process.spawn(process.execPath, [tsxBin, ...args], {
+    cwd: opts.cwd,
+    stdio: "inherit",
+    env: process.env
+  });
+  const exited = new Promise((resolve6) => {
+    child.on("exit", (code, signal) => {
+      resolve6(code ?? (signal !== null ? 130 : 0));
+    });
+  });
+  let killTimer;
+  const forward = (sig) => {
+    if (child.killed) return;
+    child.kill(sig);
+    killTimer = setTimeout(() => {
+      if (!child.killed) child.kill("SIGKILL");
+    }, 5e3);
+    killTimer.unref();
+  };
+  process.on("SIGINT", () => forward("SIGTERM"));
+  process.on("SIGTERM", () => forward("SIGTERM"));
+  child.on("exit", () => {
+    if (killTimer !== void 0) clearTimeout(killTimer);
+  });
+  return { child, exited };
+}
+
+// src/commands/dev.ts
+async function runDev(opts) {
+  let entry;
+  try {
+    entry = resolveEntry(process.cwd(), opts.entry);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const code = err.code ?? "unknown";
+    process.stderr.write(`${pc5__default.default.red("error:")} ${message}
+  ${pc5__default.default.gray(`(code: ${code})`)}
+`);
+    return code === "entry_not_found" ? 2 : 1;
+  }
+  process.stdout.write(`${pc5__default.default.cyan("[dev]")} watching ${pc5__default.default.bold(entry)} \u2014 Ctrl+C to stop.
+`);
+  let handle;
+  try {
+    handle = startRunner({
+      entry,
+      cwd: process.cwd(),
+      ...opts.env !== void 0 ? { envFile: opts.env } : {}
+    });
+  } catch (err) {
+    process.stderr.write(
+      `${pc5__default.default.red("error:")} could not spawn tsx \u2014 ${err instanceof Error ? err.message : String(err)}
+  ${pc5__default.default.gray("Hint: try `pnpm install` to repair @theokit/cli.")}
+`
+    );
+    return 1;
+  }
+  const exitCode = await handle.exited;
+  return exitCode;
+}
+function configError(code, message) {
+  const err = new Error(message);
+  err.code = code;
+  return err;
+}
+async function importConfig(abs) {
+  try {
+    return await import(url.pathToFileURL(abs).href);
+  } catch (cause) {
+    throw configError(
+      "config_load_failed",
+      `Failed to load eval config (${abs}): ${cause instanceof Error ? cause.message : String(cause)}`
+    );
+  }
+}
+function validateShape(cfg, abs) {
+  if (!Array.isArray(cfg.dataset)) throwShapeError(abs, "dataset", "must be an array");
+  if (!Array.isArray(cfg.scorers)) throwShapeError(abs, "scorers", "must be an array");
+  if (cfg.agent === void 0 || typeof cfg.agent !== "object") {
+    throwShapeError(abs, "agent", "must be an Agent.create() options object");
+  }
+  return cfg;
+}
+async function loadEvalConfig(cwd, configPath) {
+  const relPath = configPath ?? "./eval.config.ts";
+  const abs = path.isAbsolute(relPath) ? relPath : path.resolve(cwd, relPath);
+  if (!fs.existsSync(abs)) throw configError("config_not_found", `Eval config not found: ${abs}`);
+  const mod = await importConfig(abs);
+  if (mod.default === void 0) {
+    throw configError(
+      "config_no_default_export",
+      `Eval config (${abs}) must have a default export. Example: \`export default { dataset, scorers, agent } satisfies EvalConfig;\``
+    );
+  }
+  return validateShape(mod.default, abs);
+}
+function throwShapeError(abs, field, why) {
+  const err = new Error(`Eval config (${abs}) is invalid: field "${field}" ${why}.`);
+  err.code = "config_invalid_shape";
+  throw err;
+}
+
+// src/eval/report.ts
+function formatReport(result) {
+  const lines = [];
+  lines.push("# Eval Report");
+  lines.push("");
+  lines.push(`- **Total rows:** ${result.aggregate.totalRows}`);
+  lines.push(`- **Mean score:** ${result.aggregate.meanScore.toFixed(3)}`);
+  lines.push(`- **Pass ratio (\u22650.5):** ${(result.aggregate.passRatio * 100).toFixed(1)}%`);
+  lines.push(`- **Error rows:** ${result.aggregate.errorRows}`);
+  lines.push("");
+  lines.push("## Per-row results");
+  lines.push("");
+  lines.push("| # | Input | Output | Mean | Scores | Notes |");
+  lines.push("|---|---|---|---:|---|---|");
+  for (let i = 0; i < result.rows.length; i += 1) {
+    const row = result.rows[i];
+    if (row === void 0) continue;
+    const input = escapeMd(truncate(row.input, 60));
+    const output = row.error !== void 0 ? `*error*` : escapeMd(truncate(row.output, 80));
+    const mean = row.meanScore.toFixed(3);
+    const scores = row.scores.length > 0 ? row.scores.map(
+      (s) => `${s.name}=${s.score.toFixed(2)}${s.reason !== void 0 ? ` (${escapeMd(s.reason)})` : ""}`
+    ).join("; ") : "\u2014";
+    const notes = row.error !== void 0 ? escapeMd(row.error) : "";
+    lines.push(`| ${i + 1} | ${input} | ${output} | ${mean} | ${scores} | ${notes} |`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+function truncate(s, max) {
+  if (s.length <= max) return s;
+  return `${s.slice(0, max - 1)}\u2026`;
+}
+function escapeMd(s) {
+  return s.replaceAll("|", "\\|").replaceAll("\n", " ");
+}
+async function runEvalSuite(config) {
+  if (config.dataset.length === 0) {
+    return {
+      rows: [],
+      aggregate: { meanScore: 0, passRatio: 0, totalRows: 0, errorRows: 0 }
+    };
+  }
+  const sdkScorers = config.scorers.map((s) => ({
+    name: s.name,
+    score: s.score
+  }));
+  const run = await _eval.Eval.create({
+    // Unique per-process name for telemetry correlation (D213). Use UUID
+    // so concurrent CLI invocations on different terminals don't collide.
+    name: `theokit-eval-${crypto.randomUUID().slice(0, 8)}`,
+    dataset: config.dataset,
+    scorers: sdkScorers,
+    agent: config.agent,
+    ...config.concurrency !== void 0 ? { concurrency: config.concurrency } : {}
+  }).run();
+  const rows = run.rows.map((r) => ({
+    input: r.input,
+    output: r.output,
+    ...r.expected !== void 0 ? { expected: r.expected } : {},
+    scores: r.scores.map((s) => ({
+      name: s.name,
+      score: s.score,
+      ...s.reason !== void 0 ? { reason: s.reason } : {}
+    })),
+    meanScore: r.meanScore,
+    ...r.error !== void 0 ? { error: r.error } : {}
+  }));
+  return {
+    rows,
+    aggregate: {
+      meanScore: run.aggregate.meanScore,
+      passRatio: run.aggregate.passRatio,
+      totalRows: run.aggregate.totalRows,
+      errorRows: run.aggregate.errorRows
+    }
+  };
+}
+
+// src/commands/eval.ts
+function resolveOutputPath(cwd, output) {
+  const target = output ?? "eval-report.md";
+  try {
+    return pathSafety.safePathJoin(cwd, target);
+  } catch (err) {
+    if (err instanceof pathSafety.PathTraversalError) {
+      const e = new Error(
+        `--output path must be inside the current working directory. Got: ${target}`
+      );
+      e.code = "invalid_output_path";
+      throw e;
+    }
+    throw err;
+  }
+}
+function reportError(err, prefix = "error:") {
+  const message = err instanceof Error ? err.message : String(err);
+  const code = err.code ?? "unknown";
+  process.stderr.write(`${pc5__default.default.red(prefix)} ${message}
+  ${pc5__default.default.gray(`(code: ${code})`)}
+`);
+  return { message, code };
+}
+async function loadAndValidateConfig(cwd, configPath) {
+  try {
+    return await loadEvalConfig(cwd, configPath);
+  } catch (err) {
+    const { code } = reportError(err);
+    return { failureExit: code.startsWith("config_") ? 2 : 1 };
+  }
+}
+function writeReport(outputAbs, report) {
+  try {
+    void path.dirname;
+    fs.writeFileSync(outputAbs, report, "utf8");
+    return true;
+  } catch (err) {
+    process.stderr.write(
+      `${pc5__default.default.red("error:")} could not write report to ${outputAbs} \u2014 ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return false;
+  }
+}
+async function runEval(opts) {
+  const cwd = process.cwd();
+  let outputAbs;
+  try {
+    outputAbs = resolveOutputPath(cwd, opts.output);
+  } catch (err) {
+    reportError(err);
+    return 2;
+  }
+  const configOrErr = await loadAndValidateConfig(cwd, opts.config);
+  if ("failureExit" in configOrErr) return configOrErr.failureExit;
+  const config = configOrErr;
+  process.stdout.write(
+    `${pc5__default.default.cyan("[eval]")} running ${config.dataset.length} prompt(s) with ${config.scorers.length} scorer(s)...
+`
+  );
+  let result;
+  try {
+    result = await runEvalSuite(config);
+  } catch (err) {
+    process.stderr.write(
+      `${pc5__default.default.red("error:")} eval run failed \u2014 ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return 1;
+  }
+  if (!writeReport(outputAbs, formatReport(result))) return 1;
+  process.stdout.write(
+    `
+${pc5__default.default.green("\u2713")} ${result.aggregate.totalRows} rows \xB7 mean score ${result.aggregate.meanScore.toFixed(3)} \xB7 ${(result.aggregate.passRatio * 100).toFixed(1)}% pass \xB7 ${result.aggregate.errorRows} error(s)
+  report: ${outputAbs}
+`
+  );
+  return 0;
+}
+
+// src/version.ts
+var SDK_VERSION = "1.5.0";
+var CLI_VERSION = "0.1.1";
+
+// src/init/templates.ts
+var TEMPLATES = [
+  {
+    name: "minimal",
+    description: "Smallest possible agent \u2014 one Agent.create + send + stream.",
+    hint: "Set ANTHROPIC_API_KEY / OPENAI_API_KEY / OPENROUTER_API_KEY in .env."
+  },
+  {
+    name: "ollama-local",
+    description: "100% local agent via Ollama (no remote API key required).",
+    hint: "Requires `ollama serve` + `ollama pull llama3.2:3b`."
+  },
+  {
+    name: "telegram-bot",
+    description: "Telegram bot via @theokit/gateway + grammy.",
+    hint: "Get a bot token from @BotFather, set TELEGRAM_BOT_TOKEN in .env."
+  }
+];
+function findTemplate(name) {
+  return TEMPLATES.find((t) => t.name === name);
+}
+var DEFAULT_TEMPLATE = "minimal";
+
+// src/init/validate-name.ts
+var NPM_NAME_RE = /^(?:@[a-z0-9-][a-z0-9._-]{0,213}\/)?[a-z0-9][a-z0-9._-]{0,213}$/;
+var RESERVED_NAMES = /* @__PURE__ */ new Set(["node_modules", "favicon.ico", "..", "."]);
+function validateProjectName(name) {
+  if (typeof name !== "string" || name.length === 0) {
+    return { ok: false, reason: "Project name is required." };
+  }
+  if (RESERVED_NAMES.has(name)) {
+    return { ok: false, reason: `Name "${name}" is reserved.` };
+  }
+  if (name.length > 214) {
+    return { ok: false, reason: "Project name must be \u2264 214 characters." };
+  }
+  if (!NPM_NAME_RE.test(name)) {
+    return {
+      ok: false,
+      reason: "Invalid project name. Use lowercase letters, numbers, dashes, dots, or underscores. Examples: `my-bot`, `@scope/my-bot`, `chat.bot`."
+    };
+  }
+  return { ok: true };
+}
+
+// src/init/scaffold.ts
+var SUBSTITUTE_EXTS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".mjs",
+  ".json",
+  ".md",
+  ".env",
+  ".example",
+  ".gitignore",
+  ".yml",
+  ".yaml"
+]);
+function resolveTemplatesRoot() {
+  const here = url.fileURLToPath(new URL(".", (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href))));
+  let dir = here;
+  for (let i = 0; i < 5; i += 1) {
+    const candidate = path.join(dir, "templates");
+    if (fs.existsSync(candidate) && fs.lstatSync(candidate).isDirectory()) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error(
+    `Could not locate bundled templates/ directory (searched up from ${here}). This usually means the published tarball was built without "files": ["templates"] (EC-C regression).`
+  );
+}
+function scaffoldError(code, message) {
+  const err = new Error(message);
+  err.code = code;
+  return err;
+}
+function validateNameAndTemplate(opts) {
+  const nameCheck = validateProjectName(opts.projectName);
+  if (!nameCheck.ok) {
+    throw scaffoldError("invalid_project_name", nameCheck.reason ?? "Invalid project name.");
+  }
+  if (findTemplate(opts.template) === void 0) {
+    throw scaffoldError("unknown_template", `Unknown template "${opts.template}".`);
+  }
+}
+function validateDest(cwdAbs, destAbs, projectName, force) {
+  const rel = path.relative(cwdAbs, destAbs);
+  if (rel.startsWith("..") || path.isAbsolute(rel)) {
+    throw scaffoldError(
+      "invalid_dest",
+      `Project name "${projectName}" escapes the working directory.`
+    );
+  }
+  if (!fs.existsSync(destAbs)) return;
+  if (fs.lstatSync(destAbs).isSymbolicLink()) {
+    throw scaffoldError(
+      "dest_is_symlink",
+      `Destination "${destAbs}" is a symlink. Refuse to follow (EC-G safety).`
+    );
+  }
+  if (fs.readdirSync(destAbs).length > 0 && !force) {
+    throw scaffoldError(
+      "dest_not_empty",
+      `Destination "${destAbs}" already exists and is not empty. Pass --force to overwrite.`
+    );
+  }
+}
+function atomicCopy(sourceAbs, tmpAbs, destAbs, projectName) {
+  try {
+    fs.mkdirSync(tmpAbs, { recursive: true });
+    const filesWritten = copyTreeWithSubstitution(sourceAbs, tmpAbs, {
+      projectName,
+      sdkVersion: SDK_VERSION
+    });
+    if (fs.existsSync(destAbs)) fs.rmSync(destAbs, { recursive: true, force: true });
+    fs.renameSync(tmpAbs, destAbs);
+    return filesWritten;
+  } catch (err) {
+    try {
+      fs.rmSync(tmpAbs, { recursive: true, force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
+async function scaffold(opts) {
+  validateNameAndTemplate(opts);
+  const cwdAbs = path.resolve(opts.cwd);
+  const destAbs = path.resolve(cwdAbs, opts.projectName);
+  validateDest(cwdAbs, destAbs, opts.projectName, opts.force === true);
+  const tmpAbs = `${destAbs}.tmp-${crypto.randomBytes(4).toString("hex")}`;
+  const sourceAbs = path.join(resolveTemplatesRoot(), opts.template);
+  if (!fs.existsSync(sourceAbs)) {
+    throw new Error(
+      `Template directory not found: ${sourceAbs}. Ensure the published package included templates/ (EC-C).`
+    );
+  }
+  const filesWritten = atomicCopy(sourceAbs, tmpAbs, destAbs, opts.projectName);
+  return { destAbs, filesWritten };
+}
+function copyTreeWithSubstitution(srcDir, destDir, vars) {
+  const counter = { count: 0 };
+  walk(srcDir, destDir, vars, counter);
+  return counter.count;
+}
+function walk(src, dst, vars, counter) {
+  fs.mkdirSync(dst, { recursive: true });
+  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path.join(src, entry.name);
+    const dstPath = path.join(dst, entry.name);
+    if (entry.isDirectory()) {
+      walk(srcPath, dstPath, vars, counter);
+    } else if (entry.isFile()) {
+      copyFile(srcPath, dstPath, entry.name, vars);
+      counter.count += 1;
+    }
+  }
+}
+function copyFile(srcPath, dstPath, name, vars) {
+  const content = fs.readFileSync(srcPath, "utf8");
+  const ext = name.includes(".") ? `.${name.split(".").pop() ?? ""}` : "";
+  const shouldSubstitute = SUBSTITUTE_EXTS.has(ext) || name === ".gitignore" || name === ".env.example";
+  const out = shouldSubstitute ? content.replaceAll("{{projectName}}", vars.projectName).replaceAll("{{sdkVersion}}", vars.sdkVersion) : content;
+  fs.writeFileSync(dstPath, out, "utf8");
+}
+
+// src/commands/init.ts
+async function resolveProjectName(projectName, skipPrompts) {
+  if (projectName !== void 0 && projectName.length > 0) return projectName;
+  if (skipPrompts) {
+    process.stderr.write(
+      `${pc5__default.default.red("error: ")}project name is required in non-interactive mode. Pass it as the positional argument: ${pc5__default.default.cyan(
+        "theokit init <project-name>"
+      )}
+`
+    );
+    return { exitCode: 2 };
+  }
+  const answer = await p__namespace.text({
+    message: "Project name?",
+    placeholder: "my-bot",
+    validate: (v) => v.length === 0 ? "Required." : void 0
+  });
+  if (p__namespace.isCancel(answer)) return { exitCode: 0 };
+  return answer;
+}
+async function resolveTemplate(optsTemplate, skipPrompts) {
+  let template = optsTemplate ?? DEFAULT_TEMPLATE;
+  if (optsTemplate === void 0 && !skipPrompts) {
+    const answer = await p__namespace.select({
+      message: "Pick a template:",
+      options: TEMPLATES.map((t) => ({ value: t.name, label: t.name, hint: t.description })),
+      initialValue: DEFAULT_TEMPLATE
+    });
+    if (p__namespace.isCancel(answer)) return { exitCode: 0 };
+    template = answer;
+  }
+  if (findTemplate(template) === void 0) {
+    process.stderr.write(
+      `${pc5__default.default.red("error: ")}unknown template "${template}". Available: ${TEMPLATES.map((t) => t.name).join(", ")}
+`
+    );
+    return { exitCode: 2 };
+  }
+  return template;
+}
+var USER_ERROR_CODES = /* @__PURE__ */ new Set([
+  "invalid_project_name",
+  "dest_not_empty",
+  "invalid_dest",
+  "unknown_template"
+]);
+async function runScaffold(name, template, force) {
+  try {
+    const result = await scaffold({
+      projectName: name,
+      template,
+      cwd: process.cwd(),
+      ...force ? { force: true } : {}
+    });
+    process.stdout.write(
+      `
+${pc5__default.default.green("\u2713")} Scaffolded ${pc5__default.default.bold(name)} (${template}) \u2014 ${result.filesWritten} files written.
+
+Next steps:
+  ${pc5__default.default.cyan(`cd ${name}`)}
+  ${pc5__default.default.cyan("pnpm install")}
+  ${pc5__default.default.cyan("cp .env.example .env")}  ${pc5__default.default.gray("# edit your keys")}
+  ${pc5__default.default.cyan("pnpm dev")}
+
+Template hint: ${findTemplate(template)?.hint ?? ""}
+`
+    );
+    return 0;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    const code = err.code ?? "unknown";
+    process.stderr.write(`${pc5__default.default.red("error:")} ${message}
+  ${pc5__default.default.gray(`(code: ${code})`)}
+`);
+    return USER_ERROR_CODES.has(code) ? 2 : 1;
+  }
+}
+async function runInit(projectName, opts) {
+  const isTty = process.stdin.isTTY === true && process.stdout.isTTY === true;
+  const skipPrompts = opts.yes === true || !isTty;
+  const name = await resolveProjectName(projectName, skipPrompts);
+  if (typeof name !== "string") return name.exitCode;
+  const template = await resolveTemplate(opts.template, skipPrompts);
+  if (typeof template !== "string") return template.exitCode;
+  return runScaffold(name, template, opts.force === true);
+}
+var KNOWN_GATEWAYS = [
+  { name: "telegram", packageName: "@theokit/gateway-telegram" },
+  { name: "discord", packageName: "@theokit/gateway-discord" }
+];
+function listGatewayAdapters() {
+  const require2 = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));
+  return KNOWN_GATEWAYS.map((g) => {
+    let installed = false;
+    try {
+      require2.resolve(g.packageName);
+      installed = true;
+    } catch {
+      installed = false;
+    }
+    return { name: g.name, packageName: g.packageName, installed };
+  });
+}
+function parseFrontmatter(content) {
+  const match = content.match(/^---\n([\s\S]*?)\n---/);
+  if (match === null) return {};
+  const out = {};
+  for (const line of (match[1] ?? "").split("\n")) {
+    const [k, ...rest] = line.split(":");
+    if (k === void 0 || rest.length === 0) continue;
+    const key = k.trim();
+    const val = rest.join(":").trim();
+    if (key === "name") out.name = val;
+    else if (key === "description") out.description = val;
+  }
+  return out;
+}
+function loadPluginManifest(root, name, source) {
+  const manifestPath = path.join(root, name, "PLUGIN.md");
+  if (!fs.existsSync(manifestPath)) return void 0;
+  try {
+    const fm = parseFrontmatter(fs.readFileSync(manifestPath, "utf8"));
+    return {
+      name: fm.name ?? name,
+      source,
+      ...fm.description !== void 0 ? { description: fm.description } : {},
+      path: manifestPath
+    };
+  } catch {
+    return void 0;
+  }
+}
+function walkPluginDir(root, source) {
+  if (!fs.existsSync(root) || !fs.lstatSync(root).isDirectory()) return [];
+  const out = [];
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const info = loadPluginManifest(root, entry.name, source);
+    if (info !== void 0) out.push(info);
+  }
+  return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+function listPlugins(cwd) {
+  const userPlugins = walkPluginDir(path.join(os.homedir(), ".theokit", "plugins"), "user-global");
+  const projectPlugins = walkPluginDir(path.join(cwd, ".theokit", "plugins"), "project");
+  const byName = /* @__PURE__ */ new Map();
+  for (const p2 of userPlugins) byName.set(p2.name, p2);
+  for (const p2 of projectPlugins) byName.set(p2.name, p2);
+  return Array.from(byName.values()).sort((a, b) => a.name.localeCompare(b.name));
+}
+
+// src/commands/inspect.ts
+function collect(filter, cwd) {
+  const all = filter === void 0 || filter === "all";
+  const empty = { providers: [], embeddingAdapters: [], gateways: [], plugins: [] };
+  const result = empty;
+  if (all || filter === "providers") {
+    result.providers = sdk.Theokit.inspect.builtinProviders();
+  }
+  if (all || filter === "adapters") {
+    result.embeddingAdapters = sdk.Theokit.inspect.embeddingAdapters();
+  }
+  if (all || filter === "gateway") {
+    result.gateways = listGatewayAdapters();
+  }
+  if (all || filter === "plugins") {
+    result.plugins = listPlugins(cwd);
+  }
+  return result;
+}
+function formatProviders(providers) {
+  if (providers.length === 0) return [];
+  const lines = [pc5__default.default.bold(pc5__default.default.cyan("Builtin LLM providers"))];
+  for (const p2 of providers) {
+    const aliases = p2.aliases !== void 0 && p2.aliases.length > 0 ? ` (aliases: ${p2.aliases.join(", ")})` : "";
+    lines.push(
+      `  \u2022 ${pc5__default.default.green(p2.name)}${aliases} \u2014 ${p2.apiMode} \xB7 auth: ${p2.authType} \xB7 ${p2.baseUrl}`
+    );
+  }
+  lines.push("");
+  return lines;
+}
+function formatEmbeddings(adapters) {
+  if (adapters.length === 0) return [];
+  const lines = [pc5__default.default.bold(pc5__default.default.cyan("Memory embedding adapters"))];
+  for (const a of adapters) {
+    lines.push(`  \u2022 ${pc5__default.default.green(a.id)} \u2014 ${a.transport} \xB7 default model: ${a.defaultModel}`);
+  }
+  lines.push("");
+  return lines;
+}
+function formatGateways(gateways) {
+  if (gateways.length === 0) return [];
+  const lines = [pc5__default.default.bold(pc5__default.default.cyan("Gateway adapters"))];
+  for (const g of gateways) {
+    const status = g.installed ? pc5__default.default.green("installed") : pc5__default.default.gray("not installed");
+    lines.push(`  \u2022 ${pc5__default.default.green(g.name)} (${g.packageName}) \u2014 ${status}`);
+  }
+  lines.push("");
+  return lines;
+}
+function formatPlugins(r) {
+  if (r.plugins.length > 0) {
+    const lines = [pc5__default.default.bold(pc5__default.default.cyan("User plugins"))];
+    for (const pl of r.plugins) {
+      const desc = pl.description !== void 0 ? ` \u2014 ${pl.description}` : "";
+      lines.push(`  \u2022 ${pc5__default.default.green(pl.name)} [${pl.source}]${desc}`);
+    }
+    return lines;
+  }
+  if (r.providers.length > 0 || r.embeddingAdapters.length > 0) {
+    return [pc5__default.default.gray("(no user plugins found in ~/.theokit/plugins/ or ./.theokit/plugins/)")];
+  }
+  return [];
+}
+function formatHuman(r) {
+  const lines = [
+    ...formatProviders(r.providers),
+    ...formatEmbeddings(r.embeddingAdapters),
+    ...formatGateways(r.gateways),
+    ...formatPlugins(r)
+  ];
+  return `${lines.join("\n")}
+`;
+}
+async function runInspect(opts) {
+  const VALID_FILTERS = /* @__PURE__ */ new Set(["all", "providers", "adapters", "gateway", "plugins"]);
+  if (opts.filter !== void 0 && !VALID_FILTERS.has(opts.filter)) {
+    process.stderr.write(
+      `${pc5__default.default.red("error:")} invalid --filter "${opts.filter}". Valid: ${Array.from(VALID_FILTERS).join(", ")}
+`
+    );
+    return 2;
+  }
+  const result = collect(opts.filter, process.cwd());
+  if (opts.json === true) {
+    process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+  } else {
+    process.stdout.write(formatHuman(result));
+  }
+  return 0;
+}
+var UPSTREAM_PACKAGE = "google-workspace-mcp@^2.3.0";
+var DEFAULT_CONFIG_DIR = path.join(os.homedir(), ".google-mcp");
+var DEFAULT_CREDS_FILENAME = "credentials.json";
+var PROBE_TIMEOUT_MS = 1e4;
+function isPathTraversal(p2) {
+  return p2.includes("../") || p2.includes("..\\") || p2 === ".." || p2.startsWith("../") || p2.startsWith("..\\");
+}
+function readAndParseJson(resolved) {
+  let raw;
+  try {
+    raw = fs.readFileSync(resolved, "utf8");
+  } catch (err) {
+    return { kind: "malformed", reason: err instanceof Error ? err.message : String(err) };
+  }
+  try {
+    return { kind: "ok", parsed: JSON.parse(raw) };
+  } catch (err) {
+    return { kind: "malformed", reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+function validateOAuthShape(parsed, resolved) {
+  if (parsed === null || typeof parsed !== "object") {
+    return { kind: "malformed", path: resolved, reason: "expected JSON object" };
+  }
+  const obj = parsed;
+  if (obj.installed === void 0 && obj.web !== void 0) {
+    return { kind: "wrong_type", path: resolved };
+  }
+  if (typeof obj.installed !== "object" || obj.installed === null) {
+    return {
+      kind: "malformed",
+      path: resolved,
+      reason: "missing `installed` block (expected Desktop OAuth client shape)"
+    };
+  }
+  return { kind: "ok", path: resolved };
+}
+function checkCredentialsFile(credentialsPath) {
+  if (isPathTraversal(credentialsPath)) {
+    return { kind: "rejected_path", path: credentialsPath, reason: "path traversal" };
+  }
+  const resolved = path.resolve(credentialsPath);
+  if (!fs.existsSync(resolved)) return { kind: "missing", path: resolved };
+  const parseResult = readAndParseJson(resolved);
+  if (parseResult.kind === "malformed") {
+    return { kind: "malformed", path: resolved, reason: parseResult.reason };
+  }
+  return validateOAuthShape(parseResult.parsed, resolved);
+}
+function describeOutcome(o) {
+  switch (o.kind) {
+    case "missing":
+      return `${pc5__default.default.red("error: ")}credentials.json not found at ${o.path}.
+
+To create it:
+  1. Go to https://console.cloud.google.com/apis/credentials
+  2. Create OAuth 2.0 Client ID \u2014 Application type: ${pc5__default.default.bold("Desktop application")}
+  3. Download the JSON and save it as ${o.path}
+`;
+    case "malformed":
+      return `${pc5__default.default.red("error: ")}credentials.json could not be parsed: ${o.reason}
+  path: ${o.path}
+`;
+    case "wrong_type":
+      return `${pc5__default.default.red("error: ")}This looks like a ${pc5__default.default.bold('"Web application"')} OAuth client.
+
+Re-create as ${pc5__default.default.bold('"Desktop application"')} in Google Cloud Console:
+  https://console.cloud.google.com/apis/credentials
+(Click "+ Create credentials" \u2192 "OAuth client ID" \u2192 Application type: ${pc5__default.default.bold("Desktop app")}.)
+
+Then re-download and save to: ${o.path}
+`;
+    case "rejected_path":
+      return `${pc5__default.default.red("error: ")}credentials path rejected: ${o.reason}
+  path: ${o.path}
+`;
+    case "ok":
+      return "";
+  }
+}
+function resolveCredentialsPath(opts) {
+  if (opts.credentialsPath !== void 0 && opts.credentialsPath.length > 0) {
+    return path.isAbsolute(opts.credentialsPath) ? opts.credentialsPath : path.resolve(opts.credentialsPath);
+  }
+  return path.join(DEFAULT_CONFIG_DIR, DEFAULT_CREDS_FILENAME);
+}
+async function runProbeMode() {
+  process.stdout.write(`
+${pc5__default.default.cyan("[probe]")} running upstream connectivity check...
+`);
+  const code = await spawnUpstream(["status"], PROBE_TIMEOUT_MS);
+  if (code !== 0) {
+    process.stderr.write(
+      `${pc5__default.default.yellow("warn: ")}upstream status reported a non-zero exit (${code}). Run \`npx ${UPSTREAM_PACKAGE} accounts list\` to inspect.
+`
+    );
+    return code;
+  }
+  return 0;
+}
+async function runInteractiveSetup() {
+  process.stdout.write(
+    `
+${pc5__default.default.cyan("\u2192")} delegating to upstream installer (${UPSTREAM_PACKAGE})...
+`
+  );
+  const setupCode = await spawnUpstream(["setup"]);
+  if (setupCode !== 0) {
+    process.stderr.write(`${pc5__default.default.red("error: ")}upstream setup exited with code ${setupCode}.
+`);
+    return setupCode;
+  }
+  process.stdout.write(`
+${pc5__default.default.cyan("\u2192")} adding default account...
+`);
+  const addCode = await spawnUpstream(["accounts", "add", "default"]);
+  if (addCode !== 0) {
+    process.stderr.write(
+      `${pc5__default.default.red("error: ")}upstream \`accounts add\` exited with code ${addCode}.
+`
+    );
+    return addCode;
+  }
+  return 0;
+}
+async function runGworkspaceSetup(opts) {
+  const credentialsPath = resolveCredentialsPath(opts);
+  try {
+    fs.mkdirSync(DEFAULT_CONFIG_DIR, { recursive: true, mode: 448 });
+  } catch {
+  }
+  const outcome = checkCredentialsFile(credentialsPath);
+  if (outcome.kind !== "ok") {
+    process.stderr.write(describeOutcome(outcome));
+    return 2;
+  }
+  try {
+    fs.chmodSync(outcome.path, 384);
+  } catch {
+  }
+  process.stdout.write(
+    `${pc5__default.default.green("\u2713")} credentials validated: ${outcome.path}
+${pc5__default.default.dim("  shape: Desktop OAuth client (installed block present)")}
+`
+  );
+  if (opts.probe === true) return runProbeMode();
+  if (opts.nonInteractive === true) {
+    process.stdout.write(
+      `${pc5__default.default.dim("non-interactive mode: credentials staged. Next step (manual):")}
+  ${pc5__default.default.cyan(`npx ${UPSTREAM_PACKAGE} accounts add default`)}
+`
+    );
+    return 0;
+  }
+  const interactiveCode = await runInteractiveSetup();
+  if (interactiveCode !== 0) return interactiveCode;
+  if (typeof opts.writable === "string" && opts.writable.length > 0) {
+    process.stdout.write(
+      `
+${pc5__default.default.yellow("note:")} you passed --writable=${opts.writable}. The upstream MCP server does not narrow scopes \u2014 all scopes are granted at consent.
+Write tools are gated at runtime by ${pc5__default.default.bold("googleWorkspace({ writable: true })")} in your code.
+`
+    );
+  }
+  process.stdout.write(
+    `
+${pc5__default.default.green("\u2713")} gworkspace setup complete.
+${pc5__default.default.dim('  Next: import { googleWorkspace } from "@theokit/skills-google-workspace".')}
+`
+  );
+  return 0;
+}
+function spawnUpstream(args, timeoutMs) {
+  return new Promise((resolveExit) => {
+    const child = child_process.spawn("npx", ["-y", UPSTREAM_PACKAGE, ...args], {
+      stdio: "inherit",
+      env: process.env
+    });
+    let timer;
+    if (timeoutMs !== void 0) {
+      timer = setTimeout(() => {
+        process.stderr.write(
+          `${pc5__default.default.yellow("warn: ")}upstream did not finish within ${timeoutMs}ms \u2014 killing.
+`
+        );
+        try {
+          child.kill("SIGTERM");
+        } catch {
+        }
+      }, timeoutMs);
+    }
+    child.on("error", (err) => {
+      if (timer !== void 0) clearTimeout(timer);
+      process.stderr.write(
+        `${pc5__default.default.red("error: ")}failed to spawn npx: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      resolveExit(1);
+    });
+    child.on("exit", (code) => {
+      if (timer !== void 0) clearTimeout(timer);
+      resolveExit(code ?? 1);
+    });
+  });
+}
+
+// src/commands/setup.ts
+async function runSetup(domain, opts) {
+  if (domain === "gworkspace") {
+    const gworkspaceOpts = {
+      writable: opts.writable,
+      probe: opts.probe === true,
+      nonInteractive: opts.nonInteractive === true,
+      ...opts.credentialsPath !== void 0 ? { credentialsPath: opts.credentialsPath } : {}
+    };
+    return await runGworkspaceSetup(gworkspaceOpts);
+  }
+  process.stderr.write(
+    `${pc5__default.default.red("error: ")}unknown setup domain '${domain}'. Supported domains: gworkspace.
+`
+  );
+  return 2;
+}
+var TASK_ID_GRAMMAR = /^[a-z0-9][a-z0-9_-]*$/;
+function isValidTaskId(id) {
+  return TASK_ID_GRAMMAR.test(id);
+}
+function resolveStoreDir() {
+  const fromEnv = process.env.THEOKIT_HOME;
+  if (typeof fromEnv === "string" && fromEnv.length > 0) return path.join(fromEnv, "tasks");
+  return path.join(process.cwd(), ".theokit", "tasks");
+}
+function openStore() {
+  const dir = resolveStoreDir();
+  try {
+    return new taskStore.JsonFileTaskStore(dir);
+  } catch (err) {
+    if (err.code === "EACCES") {
+      process.stderr.write(`tasks: cannot access store dir ${dir}: permission denied
+`);
+      throw new Error("permission_denied");
+    }
+    throw err;
+  }
+}
+function formatTable(handles) {
+  if (handles.length === 0) return "No tasks found.";
+  const rows = handles.map((h) => ({
+    id: h.id.slice(0, 24).padEnd(24),
+    kind: h.kind.padEnd(8),
+    state: h.state.padEnd(9),
+    age: `${Math.floor((Date.now() - h.submittedAt) / 1e3)}s`.padStart(6)
+  }));
+  const header = "ID                       KIND     STATE     AGE";
+  const lines = rows.map((r) => `${r.id} ${r.kind} ${r.state} ${r.age}`);
+  return [header, ...lines].join("\n");
+}
+async function listHandles(store, opts) {
+  const filter = {
+    ...opts.state !== void 0 ? { state: opts.state } : {},
+    ...opts.kind !== void 0 ? { kind: opts.kind } : {}
+  };
+  return store.list(filter);
+}
+async function runTasksList(opts) {
+  let store;
+  try {
+    store = openStore();
+  } catch {
+    return 2;
+  }
+  const handles = await listHandles(store, opts);
+  if (opts.json === true) {
+    process.stdout.write(`${JSON.stringify(handles, null, 2)}
+`);
+  } else {
+    process.stdout.write(`${formatTable(handles)}
+`);
+  }
+  return 0;
+}
+function printHandleDetails(handle) {
+  process.stdout.write(`id:           ${handle.id}
+`);
+  process.stdout.write(`kind:         ${handle.kind}
+`);
+  process.stdout.write(`state:        ${handle.state}
+`);
+  process.stdout.write(`submittedAt:  ${new Date(handle.submittedAt).toISOString()}
+`);
+  if (handle.startedAt !== void 0) {
+    process.stdout.write(`startedAt:    ${new Date(handle.startedAt).toISOString()}
+`);
+  }
+  if (handle.finishedAt !== void 0) {
+    process.stdout.write(`finishedAt:   ${new Date(handle.finishedAt).toISOString()}
+`);
+    process.stdout.write(`result:       ${JSON.stringify(handle.result)}
+`);
+  }
+  if (handle.erroredAt !== void 0) {
+    process.stdout.write(`erroredAt:    ${new Date(handle.erroredAt).toISOString()}
+`);
+    process.stdout.write(`error:        ${JSON.stringify(handle.error)}
+`);
+  }
+  if (handle.cancelledAt !== void 0) {
+    process.stdout.write(`cancelledAt:  ${new Date(handle.cancelledAt).toISOString()}
+`);
+  }
+  if (handle.cancelRequested === true) {
+    process.stdout.write(`cancelRequested: true (awaiting owning process)
+`);
+  }
+}
+async function runTasksInspect(id, opts) {
+  if (!isValidTaskId(id)) {
+    process.stderr.write(`tasks: invalid id grammar: ${id}
+`);
+    return 3;
+  }
+  let store;
+  try {
+    store = openStore();
+  } catch {
+    return 2;
+  }
+  const handle = await store.get(id);
+  if (handle === void 0) {
+    process.stderr.write(`tasks: not found: ${id}
+`);
+    return 4;
+  }
+  if (opts.json === true) {
+    process.stdout.write(`${JSON.stringify(handle, null, 2)}
+`);
+  } else {
+    printHandleDetails(handle);
+  }
+  return 0;
+}
+async function runTasksCancel(id, _opts) {
+  if (!isValidTaskId(id)) {
+    process.stderr.write(`tasks: invalid id grammar: ${id}
+`);
+    return 3;
+  }
+  let store;
+  try {
+    store = openStore();
+  } catch {
+    return 2;
+  }
+  const handle = await store.get(id);
+  if (handle === void 0) {
+    process.stderr.write(`tasks: not found: ${id}
+`);
+    return 4;
+  }
+  if (handle.state === "finished" || handle.state === "error" || handle.state === "cancelled") {
+    process.stdout.write(`task already terminal (state=${handle.state})
+`);
+    return 0;
+  }
+  if (handle.state === "queued") {
+    const cancelledAt = Date.now();
+    await store.update(id, (h) => ({ ...h, state: "cancelled", cancelledAt }));
+    process.stdout.write(`task ${id} cancelled (was queued)
+`);
+    return 0;
+  }
+  await store.update(id, (h) => ({ ...h, cancelRequested: true }));
+  process.stdout.write(
+    `cancel requested for task ${id}; the owning process will honor it at the next checkpoint
+`
+  );
+  return 0;
+}
+
+// src/main.ts
+function registerSubcommands(program, setExit) {
+  program.command("init [project-name]").description("Scaffold a new agent project from a bundled template.").option("-t, --template <name>", "Template name: minimal | ollama-local | telegram-bot").option("-f, --force", "Overwrite a non-empty destination directory").option("--here", "Scaffold into the current directory").option("-y, --yes", "Skip interactive prompts (CI mode)").action(async (projectName, opts) => {
+    setExit(await runInit(projectName, opts));
+  });
+  program.command("dev").description("Run the agent entry point under tsx --watch (hot-reload).").option("--entry <path>", "Entry file (default: src/index.ts or package.main)").option("--env <path>", "Env file to load (default: .env)").action(async (opts) => {
+    setExit(await runDev(opts));
+  });
+  program.command("inspect").description("List builtin providers, embedding adapters, gateways, and plugins.").option("--json", "Emit machine-readable JSON instead of the human tree view").option(
+    "--filter <kind>",
+    "Narrow output to one kind: providers | adapters | gateway | plugins"
+  ).action(async (opts) => {
+    setExit(await runInspect(opts));
+  });
+  program.command("eval").description("Run an eval suite against a real LLM and emit a markdown report.").option("-c, --config <path>", "Eval config file (default: ./eval.config.ts)").option("-o, --output <path>", "Report output path (default: ./eval-report.md)").action(async (opts) => {
+    setExit(await runEval(opts));
+  });
+  program.command("acp").description(
+    "Launch a stdio Agent Client Protocol (ACP) server pointing at the entry file's default-exported agent. Used by Zed/Cursor/Claude Desktop. ADRs D349-D360."
+  ).option("--entry <path>", "Entry file (default: src/index.ts or package.main)").option("--permission <mode>", "Tool permission mode: ask | auto | deny (default: ask)").option("--trusted-tools <list>", "Comma-separated tool names that bypass ask").option("--permission-timeout-ms <ms>", "Permission request timeout in ms (default: 60000)").action(async (opts) => {
+    setExit(await runAcp(opts));
+  });
+  program.command("setup <domain>").description(
+    "Stage credentials + connectivity probe for a third-party integration. Domains: gworkspace (Google Workspace)."
+  ).option(
+    "--writable <products>",
+    "Comma-separated products to grant write access (e.g., 'drive,calendar')"
+  ).option("--probe", "Run upstream connectivity check after staging credentials").option(
+    "--credentials-path <path>",
+    "Override path to credentials.json (default: ~/.google-mcp/credentials.json)"
+  ).option("--non-interactive", "Refuse interactive prompts; suitable for CI").action(async (domain, opts) => {
+    setExit(await runSetup(domain, opts));
+  });
+  const db = program.command("db").description(
+    "Database tooling \u2014 wraps drizzle-kit (generate/migrate/studio/push) and emits polyglot JSON Schema 7 (export-schema/check-schema-drift). Consumes orm.config.ts that default-exports { schema }."
+  );
+  db.command("generate").description("drizzle-kit generate \u2014 generate SQL migrations from your schema diff").action(() => {
+    setExit(runDbGenerate());
+  });
+  db.command("migrate").description("drizzle-kit migrate \u2014 apply pending migrations to the database").action(() => {
+    setExit(runDbMigrate());
+  });
+  db.command("studio").description("drizzle-kit studio \u2014 launch the embedded data browser UI").action(() => {
+    setExit(runDbStudio());
+  });
+  db.command("push").description("drizzle-kit push \u2014 direct schema sync (dangerous in prod; prototypes only)").action(() => {
+    setExit(runDbPush());
+  });
+  db.command("export-schema").description(
+    "Emit JSON Schema 7 per entity to .theokit/schema/{entity}.schema.json (polyglot consumers)."
+  ).option("-o, --out <dir>", "Output directory (default: .theokit/schema)").option("-c, --config <path>", "Path to orm.config (default: orm.config.ts)").action(async (opts) => {
+    setExit(await runDbExportSchema(opts));
+  });
+  db.command("check-schema-drift").description("Re-emit schemas and diff against committed copies. Exit 1 on drift.").option("-o, --out <dir>", "Output directory (default: .theokit/schema)").option("-c, --config <path>", "Path to orm.config (default: orm.config.ts)").action(async (opts) => {
+    setExit(await runDbCheckSchemaDrift(opts));
+  });
+  const tasks = program.command("tasks").description("Observe SDK Task registry (list / inspect / cancel)");
+  tasks.command("list").description("List tasks in the local JsonFileTaskStore").option("--state <state>", "Filter by state (queued|running|finished|error|cancelled)").option("--kind <kind>", "Filter by kind (run|batch|workflow|cron|custom)").option("--json", "Emit machine-readable JSON instead of the table view").action(async (opts) => {
+    setExit(await runTasksList(opts));
+  });
+  tasks.command("inspect <id>").description("Inspect a single task by id").option("--json", "Emit machine-readable JSON").action(async (id, opts) => {
+    setExit(await runTasksInspect(id, opts));
+  });
+  tasks.command("cancel <id>").description("Cancel a task (best-effort cross-process via cancelRequested flag)").option("--reason <reason>", "Cancellation reason recorded in the registry").action(async (id, opts) => {
+    setExit(await runTasksCancel(id));
+  });
+}
+function mapCommanderExitCode(code, fallback) {
+  if (code === "commander.help" || code === "commander.helpDisplayed") return 0;
+  if (code === "commander.version") return 0;
+  if (code === "commander.unknownCommand" || code === "commander.unknownOption") return 2;
+  return fallback > 0 ? fallback : 2;
+}
+async function main(argv) {
+  const program = new commander.Command();
+  program.name("theokit").description("Developer CLI for @theokit/sdk \u2014 init, dev, inspect, eval.").version(CLI_VERSION, "-v, --version", "Print the CLI version and exit.").addHelpText(
+    "after",
+    `
+Bundled SDK version: ${SDK_VERSION}
+Adoption Roadmap #1. See https://github.com/usetheo/theokit-sdk for docs.
+
+Exit codes: 0=success \xB7 1=unknown error \xB7 2=user error.
+`
+  );
+  let exitCode = 0;
+  const setExit = (code) => {
+    exitCode = code;
+  };
+  registerSubcommands(program, setExit);
+  let commanderHandledIt = false;
+  program.exitOverride((err) => {
+    commanderHandledIt = true;
+    exitCode = mapCommanderExitCode(err.code, err.exitCode);
+  });
+  try {
+    await program.parseAsync(argv);
+  } catch (err) {
+    if (commanderHandledIt) {
+      return exitCode;
+    }
+    process.stderr.write(`theokit: ${err instanceof Error ? err.message : String(err)}
+`);
+    return 1;
+  }
+  return exitCode;
+}
+
+exports.CLI_VERSION = CLI_VERSION;
+exports.SDK_VERSION = SDK_VERSION;
+exports.main = main;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map