@theokit/sdk 4.23.0 → 4.25.0

package/dist/chunk-6M4ODB2V.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/generate-object.ts"],"names":["disposeAndDeleteTransient","setupStructuredOutput","makeOutputTool","buildTransientAgentOptions","buildToolPrompt","extractUsage"],"mappings":";;;;;AAyFO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC3B,IAAA,GAAO,qBAAA;AAAA,EAChB,IAAA;AAAA,EACS,KAAA;AAAA,EAClB,WAAA,CAAY,IAAA,EAAuC,OAAA,EAAiB,KAAA,EAAiB;AACnF,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AACZ,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACxC;AACF;AAaA,SAAS,cAAA,CAAkC,QAAW,GAAA,EAAuB;AAC3E,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,MAAM,OAAO,GAAA;AACpD,EAAA,MAAM,QAAS,MAAA,CAA+C,KAAA;AAC9D,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,OAAO,KAAA,KAAU,UAAU,OAAO,GAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,GAAA;AACf,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,WAAW,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AACtD,IAAA,IAAI,OAAO,WAAA,EAAa,SAAA,KAAc,UAAA,EAAY;AAClD,IAAA,MAAM,MAAA,GAAS,WAAA,CAAY,SAAA,CAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAChD,IAAA,IAAI,MAAA,CAAO,OAAA,EAAS,GAAA,CAAI,GAAG,IAAI,MAAA,CAAO,IAAA;AAAA,EACxC;AACA,EAAA,OAAO,GAAA;AACT;AA6BA,eAAe,iBAAA,CACb,SACA,IAAA,EACiB;AACjB,EAAA,MAAM,gBAAA,GAAiC;AAAA,IACrC,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,GAAI,QAAQ,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,OAAA,CAAQ,YAAA,EAAa,GAAI,EAAC;AAAA,IACnF,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO,GAAI,EAAC;AAAA,IACjE,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI;AAAC,GAC5E;AACA,EAAA,MAAM,cAAA,GAAiB,MAAM,IAAA,CAAK,MAAA,CAAO,gBAAgB,CAAA;AACzD,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,cAAA,CAAe,IAAA,CAAK,QAAQ,MAAM,CAAA;AACpD,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,IAAA,MAAM,OAAQ,MAAA,CAAgC,MAAA;AAC9C,IAAA,OAAO,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,OAAA,CAAQ,MAAA;AAAA,EACnD,CAAA,SAAE;AACA,IAAA,MAAMA,2CAAA,CAA0B,cAAA,EAAgB,IAAA,CAAK,MAAM,CAAA;AAAA,EAC7D;AACF;AAGA,eAAsB,kBAAA,CACpB,SACA,IAAA,EACsD;AACtD,EAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAY,YAAA,EAAa,GAAIC,uCAAA;AAAA,IAC/C,OAAA,CAAQ,MAAA;AAAA,IACR,OAAA,CAAQ;AAAA,GACV;AACA,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI,SAAA,GAAY,YAAA;AAChB,EAAA,MAAM,QAAA,0BAAkB,0BAA0B,CAAA;AAAA,EAClD,MAAM,wBAAwB,KAAA,CAAM;AAAA,IAElC,YAA4B,QAAA,EAAmB;AAC7C,MAAA,KAAA,CAAM,yBAAyB,CAAA;AADL,MAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,IAE5B;AAAA,IAF4B,QAAA;AAAA,IAD5B,CAAU,QAAQ,IAAI,IAAA;AAAA;AAMxB,EAAA,MAAM,UAAA,GAAaC,gCAAA,CAAe,UAAA,EAAY,CAAC,KAAA,KAAU;AAGvD,IAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,MAAA,WAAA,GAAc,KAAA;AAAA,IAChB;AACA,IAAA,MAAM,IAAI,gBAAgB,KAAK,CAAA;AAAA,EACjC,CAAC,CAAA;AAID,EAAA,MAAM,aAAA,GACJ,QAAQ,gBAAA,KAAqB,MAAA,GAAY,MAAM,iBAAA,CAAkB,OAAA,EAAS,IAAI,CAAA,GAAI,MAAA;AACpF,EAAA,MAAM,gBAAA,GAAmB,OAAA,CAAQ,gBAAA,IAAoB,OAAA,CAAQ,KAAA;AAC7D,EAAA,MAAM,iBAAA,GAAoB,iBAAiB,OAAA,CAAQ,MAAA;AAEnD,EAAA,MAAM,eAA6BC,4CAAA,CAA2B;AAAA,IAC5D,KAAA,EAAO,gBAAA;AAAA,IACP,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,UAAA;AAAA,IACA,GAAI,QAAQ,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,OAAA,CAAQ,YAAA,EAAa,GAAI,EAAC;AAAA,IACnF,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO,GAAI,EAAC;AAAA,IACjE,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU,GAAI;AAAC,GAC3E,CAAA;AACD,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA;AAE5C,EAAA,IAAI;AACF,IAAA,MAAM,WAAA,GAAcC,kCAAgB,iBAAiB,CAAA;AACrD,IAAA,IAAI,cAAA;AAEJ,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,UAAA,EAAY,WAAW,CAAA,EAAG;AACzD,MAAA,WAAA,GAAc,KAAA,CAAA;AACd,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,CAAK,WAAW,CAAA;AACxC,MAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,MAAA,SAAA,GAAYC,+BAAa,MAAM,CAAA;AAE/B,MAAA,IAAI,gBAAgB,KAAA,CAAA,EAAW;AAI7B,QAAA,IAAI,MAAA,CAAO,MAAA,KAAW,OAAA,IAAW,MAAA,CAAO,UAAU,KAAA,CAAA,EAAW;AAC3D,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR,cAAA;AAAA,YACA,CAAA,+CAAA,EAAkD,OAAO,KAAA,CAAM,OAAA,IAAW,eAAe,CAAA,EAAA,EAAK,MAAA,CAAO,KAAA,CAAM,IAAA,IAAQ,GAAG,CAAA,CAAA,CAAA;AAAA,YACtH,MAAA,CAAO;AAAA,WACT;AAAA,QACF;AAEA,QAAA,IAAI,YAAY,UAAA,EAAY;AAC1B,UAAA,MAAM,IAAI,mBAAA;AAAA,YACR,cAAA;AAAA,YACA;AAAA,WACF;AAAA,QACF;AACA,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,CAAO,SAAA,CAAU,WAAW,CAAA;AACnD,MAAA,IAAI,OAAO,OAAA,EAAS;AAClB,QAAA,OAAO;AAAA,UACL,QAAQ,MAAA,CAAO,IAAA;AAAA,UACf,GAAA,EAAK,WAAA;AAAA,UACL,KAAA,EAAO,SAAA;AAAA,UACP,YAAA,EAAc;AAAA,SAChB;AAAA,MACF;AACA,MAAA,cAAA,GAAiB,MAAA,CAAO,KAAA;AAAA,IAC1B;AAIA,IAAA,IAAI,OAAA,CAAQ,kBAAkB,YAAA,EAAc;AAC1C,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,WAAA;AAAA,QACR,GAAA,EAAK,WAAA;AAAA,QACL,KAAA,EAAO,SAAA;AAAA,QACP,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,kBAAkB,gBAAA,EAAkB;AAC9C,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,cAAA,CAAe,OAAA,CAAQ,MAAA,EAAQ,WAAW,CAAA;AAAA,QAClD,GAAA,EAAK,WAAA;AAAA,QACL,KAAA,EAAO,SAAA;AAAA,QACP,YAAA,EAAc;AAAA,OAChB;AAAA,IACF;AACA,IAAA,MAAM,IAAI,mBAAA;AAAA,MACR,cAAA;AAAA,MACA,wCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,CAAA,SAAE;AAGA,IAAA,MAAML,2CAAA,CAA0B,KAAA,EAAO,IAAA,CAAK,MAAM,CAAA;AAAA,EACpD;AACF","file":"chunk-6M4ODB2V.cjs","sourcesContent":["import type { z as ZodNamespace, ZodType } from \"zod\";\n\nimport {\n  buildToolPrompt,\n  buildTransientAgentOptions,\n  disposeAndDeleteTransient,\n  extractUsage,\n  makeOutputTool,\n  setupStructuredOutput,\n} from \"./internal/structured-output-helpers.js\";\nimport type { AgentOptions, LocalOptions, ModelSelection, SDKAgent } from \"./types/agent.js\";\nimport type { ProviderRoutingSettings } from \"./types/providers.js\";\n\n/**\n * Options accepted by {@link Agent.generateObject}. Returns a typed object\n * matching the supplied Zod schema. See ADR D33.\n *\n * @public\n */\nexport interface GenerateObjectOptions<T extends ZodType> {\n  /** Zod schema describing the expected object shape. */\n  schema: T;\n  /** User prompt — the model is asked to fill the schema given this prompt. */\n  prompt: string;\n  /** Optional system prompt steering the model. */\n  systemPrompt?: string;\n  /** Model selection. Required (transient agents need a model). SE8 — accepts a\n   *  bare-string id shorthand (`\"openai/gpt-4o-mini\"`) or a {@link ModelSelection}. */\n  model: string | ModelSelection;\n  /**\n   * M21 — optional separate model for the STRUCTURING step. When set, `model` first produces a\n   * free-text reasoned answer to the prompt (phase 1), then `structuringModel` extracts the\n   * schema-matched object by calling the `output` tool over that answer (phase 2). Lets a large\n   * model reason while a cheap fast model does the extraction. Absent ⇒ today's single-model flow.\n   */\n  structuringModel?: string | ModelSelection;\n  /** API key. Falls back to env (THEOKIT_API_KEY etc). */\n  apiKey?: string;\n  /** Local runtime config (cwd, sandbox). Required to keep the transient agent local-only. */\n  local: LocalOptions;\n  /**\n   * Retry budget on parse failures. Default 1 (initial attempt + 1 retry).\n   * The transient agent is REUSED across retries so the registry sees a\n   * single entry (EC-3).\n   */\n  maxRetries?: number;\n  /**\n   * Optional provider routing forwarded to the transient agent. Required when\n   * `model.id` uses a prefix (e.g. `openai/gpt-4o-mini`) but the credential is\n   * for a unified gateway (e.g. OpenRouter). Without this, the SDK infers\n   * provider from the prefix and may fail with `provider_unresolved` even\n   * when the right env key is set under a different provider name.\n   */\n  providers?: ProviderRoutingSettings;\n  /**\n   * What to do when the model's output fails schema validation after all\n   * retries are exhausted (M14):\n   * - `'throw'` (default) — throw {@link GenerateObjectError} `parse_failed`.\n   * - `'return-raw'` — resolve with the raw, UNVALIDATED input the model sent\n   *   (`object` may not match the schema; inspect `raw` too).\n   * - `'return-partial'` — for object schemas, resolve with only the fields that\n   *   individually validate (best-effort salvage); non-object schemas fall back\n   *   to raw.\n   */\n  errorStrategy?: \"throw\" | \"return-partial\" | \"return-raw\";\n}\n\n/**\n * Successful return from {@link Agent.generateObject}.\n *\n * @public\n */\nexport interface GenerateObjectResult<T> {\n  /** Typed object parsed via the Zod schema. */\n  object: T;\n  /** Raw input the model passed to the synthetic tool, before Zod parse. */\n  raw: unknown;\n  /** Token usage of the LLM call(s) that produced the result. */\n  usage: { inputTokens: number; outputTokens: number };\n  /** Stop reason of the underlying agent run. */\n  finishReason: \"tool_use\" | \"error\";\n}\n\n/**\n * Typed error thrown by {@link Agent.generateObject} when the model refuses\n * to call the synthetic `output` tool or when retries are exhausted.\n *\n * @public\n */\nexport class GenerateObjectError extends Error {\n  override readonly name = \"GenerateObjectError\";\n  readonly code: \"no_tool_call\" | \"parse_failed\";\n  override readonly cause?: unknown;\n  constructor(code: \"no_tool_call\" | \"parse_failed\", message: string, cause?: unknown) {\n    super(message);\n    this.code = code;\n    if (cause !== undefined) this.cause = cause;\n  }\n}\n\ninterface GenerateObjectDeps {\n  create: (options: AgentOptions) => Promise<SDKAgent>;\n  /** Hard-delete the transient agent from the registry after dispose. */\n  delete: (agentId: string) => Promise<void>;\n}\n\n/**\n * M14 — best-effort partial salvage for `errorStrategy: 'return-partial'`. For an object schema,\n * keep only the fields that individually validate; anything else (non-object schema or non-object\n * raw) falls back to the raw value. Works across Zod v3/v4 via the `.shape` record both expose.\n */\nfunction salvagePartial<T extends ZodType>(schema: T, raw: unknown): unknown {\n  if (typeof raw !== \"object\" || raw === null) return raw;\n  const shape = (schema as { shape?: Record<string, ZodType> }).shape;\n  if (shape === undefined || typeof shape !== \"object\") return raw;\n  const rawObj = raw as Record<string, unknown>;\n  const out: Record<string, unknown> = {};\n  for (const [key, fieldSchema] of Object.entries(shape)) {\n    if (typeof fieldSchema?.safeParse !== \"function\") continue;\n    const parsed = fieldSchema.safeParse(rawObj[key]);\n    if (parsed.success) out[key] = parsed.data;\n  }\n  return out;\n}\n\n/**\n * Implementation of `Agent.generateObject`. Receives the `Agent.create`\n * factory as a callback to keep the dependency graph acyclic (mirrors the\n * AgentBuilder pattern in D25 / agent.ts injection).\n *\n * Algorithm:\n *   1. Convert the consumer's Zod schema to JSON Schema.\n *   2. Build a single synthetic `output` CustomTool whose handler captures\n *      the raw input and short-circuits the agent loop. The handler\n *      THROWS a sentinel so the loop terminates immediately without a\n *      second LLM round-trip.\n *   3. Create ONE transient agent (per the entire generateObject call,\n *      not per retry — EC-3). Each retry re-sends through the same agent,\n *      driving fresh LLM rounds.\n *   4. On each attempt, send a wrapper prompt instructing the model to\n *      call the `output` tool. Capture the raw input via the sentinel.\n *   5. Parse the raw input via schema.parse. On success, return typed.\n *      On failure, retry until the budget is exhausted.\n *   6. Always dispose the transient agent in `finally`.\n *\n * @internal\n */\n/**\n * M21 — phase 1: run `options.model` as a plain reasoning agent (no output tool) and return its\n * free-text answer, which phase 2's structuring model then extracts. The transient reasoning agent\n * is disposed + hard-deleted so the registry count stays stable (EC-3, mirrors the phase-2 finally).\n */\nasync function runReasoningPhase<T extends ZodType>(\n  options: GenerateObjectOptions<T>,\n  deps: GenerateObjectDeps,\n): Promise<string> {\n  const reasoningOptions: AgentOptions = {\n    model: options.model,\n    local: options.local,\n    ...(options.systemPrompt !== undefined ? { systemPrompt: options.systemPrompt } : {}),\n    ...(options.apiKey !== undefined ? { apiKey: options.apiKey } : {}),\n    ...(options.providers !== undefined ? { providers: options.providers } : {}),\n  };\n  const reasoningAgent = await deps.create(reasoningOptions);\n  try {\n    const run = await reasoningAgent.send(options.prompt);\n    const result = await run.wait();\n    const text = (result as { result?: unknown }).result;\n    return typeof text === \"string\" ? text : options.prompt;\n  } finally {\n    await disposeAndDeleteTransient(reasoningAgent, deps.delete);\n  }\n}\n\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: retry loop + capture sentinel + dispose-and-delete is a single transaction; splitting harms locality and the finally block.\nexport async function generateObjectImpl<T extends ZodType>(\n  options: GenerateObjectOptions<T>,\n  deps: GenerateObjectDeps,\n): Promise<GenerateObjectResult<ZodNamespace.infer<T>>> {\n  const { jsonSchema, maxRetries, initialUsage } = setupStructuredOutput(\n    options.schema,\n    options.maxRetries,\n  );\n  let capturedRaw: unknown;\n  let lastUsage = initialUsage;\n  const sentinel = Symbol(\"generate-object-sentinel\");\n  class CaptureSentinel extends Error {\n    readonly [sentinel] = true;\n    constructor(public readonly captured: unknown) {\n      super(\"generate-object-capture\");\n    }\n  }\n\n  const outputTool = makeOutputTool(jsonSchema, (input) => {\n    // EC-D10 (parallel tool use): first capture wins. Subsequent calls\n    // in the same response are ignored.\n    if (capturedRaw === undefined) {\n      capturedRaw = input;\n    }\n    throw new CaptureSentinel(input);\n  });\n\n  // M21 — when a separate structuring model is set, `model` first reasons in free text (phase 1),\n  // and `structuringModel` extracts the object over that text (phase 2). Absent ⇒ single-model flow.\n  const reasoningText =\n    options.structuringModel !== undefined ? await runReasoningPhase(options, deps) : undefined;\n  const structuringModel = options.structuringModel ?? options.model;\n  const structuringPrompt = reasoningText ?? options.prompt;\n\n  const agentOptions: AgentOptions = buildTransientAgentOptions({\n    model: structuringModel,\n    local: options.local,\n    outputTool,\n    ...(options.systemPrompt !== undefined ? { systemPrompt: options.systemPrompt } : {}),\n    ...(options.apiKey !== undefined ? { apiKey: options.apiKey } : {}),\n    ...(options.providers !== undefined ? { providers: options.providers } : {}),\n  });\n  const agent = await deps.create(agentOptions);\n\n  try {\n    const userMessage = buildToolPrompt(structuringPrompt);\n    let lastParseError: unknown;\n\n    for (let attempt = 0; attempt <= maxRetries; attempt += 1) {\n      capturedRaw = undefined;\n      const run = await agent.send(userMessage);\n      const result = await run.wait();\n      lastUsage = extractUsage(result);\n\n      if (capturedRaw === undefined) {\n        // EC: when the underlying run errored (e.g. provider_unresolved),\n        // surface the original cause instead of the misleading \"model\n        // returned text\" message — there was no model call at all.\n        if (result.status === \"error\" && result.error !== undefined) {\n          throw new GenerateObjectError(\n            \"no_tool_call\",\n            `Agent run failed before the model could reply: ${result.error.message ?? \"unknown error\"} [${result.error.code ?? \"?\"}]`,\n            result.error,\n          );\n        }\n        // Model didn't call the output tool.\n        if (attempt === maxRetries) {\n          throw new GenerateObjectError(\n            \"no_tool_call\",\n            \"The model returned text instead of calling the `output` tool.\",\n          );\n        }\n        continue;\n      }\n\n      const parsed = options.schema.safeParse(capturedRaw);\n      if (parsed.success) {\n        return {\n          object: parsed.data,\n          raw: capturedRaw,\n          usage: lastUsage,\n          finishReason: \"tool_use\",\n        };\n      }\n      lastParseError = parsed.error;\n    }\n\n    // M14 — all retries exhausted with a parse failure. `errorStrategy` decides the outcome; the\n    // tool WAS called (capturedRaw is set), so `finishReason` stays `tool_use`.\n    if (options.errorStrategy === \"return-raw\") {\n      return {\n        object: capturedRaw as ZodNamespace.infer<T>,\n        raw: capturedRaw,\n        usage: lastUsage,\n        finishReason: \"tool_use\",\n      };\n    }\n    if (options.errorStrategy === \"return-partial\") {\n      return {\n        object: salvagePartial(options.schema, capturedRaw) as ZodNamespace.infer<T>,\n        raw: capturedRaw,\n        usage: lastUsage,\n        finishReason: \"tool_use\",\n      };\n    }\n    throw new GenerateObjectError(\n      \"parse_failed\",\n      \"Schema parse failed after all retries.\",\n      lastParseError,\n    );\n  } finally {\n    // EC-3: dispose AND hard-delete the transient agent so registry count\n    // stays stable across retries.\n    await disposeAndDeleteTransient(agent, deps.delete);\n  }\n}\n"]}

package/dist/chunk-6X6ID4MO.js

@@ -0,0 +1,20 @@
+// src/internal/runtime/registry/agent-factory-registry.ts
+var FACADE_KEY = /* @__PURE__ */ Symbol.for(
+  "theokit.internal.runtime.agentFacade"
+);
+function setAgentFacade(facade) {
+  globalThis[FACADE_KEY] = facade;
+}
+function getAgentFacade() {
+  const registered = globalThis[FACADE_KEY];
+  if (registered === void 0) {
+    throw new Error(
+      "internal: Agent facade not registered. The `agent.ts` module must be loaded before internal subsystems (LocalAgent.runUntil/fork, eval, scorers, cron) invoke it."
+    );
+  }
+  return registered;
+}
+
+export { getAgentFacade, setAgentFacade };
+//# sourceMappingURL=chunk-6X6ID4MO.js.map
+//# sourceMappingURL=chunk-6X6ID4MO.js.map

package/dist/chunk-6X6ID4MO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/registry/agent-factory-registry.ts"],"names":[],"mappings":";AAmDA,IAAM,6BAA4B,MAAA,CAAO,GAAA;AAAA,EACvC;AACF,CAAA;AAUO,SAAS,eAAe,MAAA,EAA+B;AAC5D,EAAC,UAAA,CAAqC,UAAU,CAAA,GAAI,MAAA;AACtD;AAOO,SAAS,cAAA,GAAkC;AAChD,EAAA,MAAM,UAAA,GAAc,WAAqC,UAAU,CAAA;AACnE,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,UAAA;AACT","file":"chunk-6X6ID4MO.js","sourcesContent":["/**\n * Internal DI seam for the public `Agent` facade.\n *\n * Several internal subsystems (`LocalAgent.runUntil`/`fork`, eval, scorers,\n * cron) need to invoke `Agent.create`/`prompt`/`get`/`resume`/`batch`. A direct\n * `import { Agent }` would invert the public-api -> internal dependency\n * direction (and `agent.ts` already imports much of `internal/`). This module\n * is the inversion seam: `agent.ts` registers the facade at module-init time;\n * internal consumers read it on-demand via `getAgentFacade()`. The\n * `internal-must-not-import-facade` dependency-cruiser rule enforces that no\n * `internal/*` module bypasses this seam with a direct facade import.\n *\n * Throws if accessed before registration — should never happen because\n * `agent.ts` evaluation always precedes any internal call (the consumer must\n * obtain a handle from the `Agent` facade first).\n *\n * @internal\n */\n\nimport type { AgentOptions, SDKAgent, SDKAgentInfo } from \"../../../types/agent.js\";\nimport type { BatchItem, BatchOptions, BatchResult } from \"../../../types/batch.js\";\nimport type { RunResult } from \"../../../types/run.js\";\n\n/**\n * The subset of the public `Agent` static surface that internal subsystems\n * consume through the inversion seam. Each member mirrors the matching\n * `Agent.*` signature so registration is a thin pass-through.\n *\n * @internal\n */\nexport interface AgentFacadePort {\n  create: (options: AgentOptions) => Promise<SDKAgent>;\n  delete: (agentId: string) => Promise<void>;\n  prompt: (message: string, options: AgentOptions) => Promise<RunResult>;\n  get: (agentId: string) => Promise<SDKAgentInfo>;\n  resume: (agentId: string, options?: Partial<AgentOptions>) => Promise<SDKAgent>;\n  batch: (\n    prompts: ReadonlyArray<string | BatchItem>,\n    options: BatchOptions,\n  ) => Promise<BatchResult[]>;\n}\n\n/**\n * The registration slot lives on `globalThis` under a `Symbol.for` key — NOT a module-level `let` —\n * so it is a **process-wide singleton** shared by every copy of this module. `tsup` builds each public\n * entry (`.`, `./a2a`, `./cron`, `./eval`, …) with `splitting: false`, which INLINES this module once\n * per entry; a module-level `let` would give each bundled copy its own `registered` slot, and a\n * subagent invoked through `./a2a` would read a copy that `agent.ts` (in the `.` entry) never set —\n * the classic duplicated-singleton hazard (see issue: a2a \"Agent facade not registered\"). `Symbol.for`\n * (global symbol registry) + the one `globalThis` object guarantees all copies read/write ONE slot.\n */\nconst FACADE_KEY: unique symbol = Symbol.for(\n  \"theokit.internal.runtime.agentFacade\",\n) as typeof FACADE_KEY;\n\ntype FacadeHost = { [FACADE_KEY]?: AgentFacadePort };\n\n/**\n * Registered by `agent.ts` at module-init time. Idempotent: re-registration\n * replaces the previous reference (useful for tests that swap implementations).\n *\n * @internal\n */\nexport function setAgentFacade(facade: AgentFacadePort): void {\n  (globalThis as unknown as FacadeHost)[FACADE_KEY] = facade;\n}\n\n/**\n * Resolve the registered `Agent` facade for internal subsystems.\n *\n * @internal\n */\nexport function getAgentFacade(): AgentFacadePort {\n  const registered = (globalThis as unknown as FacadeHost)[FACADE_KEY];\n  if (registered === undefined) {\n    throw new Error(\n      \"internal: Agent facade not registered. The `agent.ts` module must be loaded before internal subsystems (LocalAgent.runUntil/fork, eval, scorers, cron) invoke it.\",\n    );\n  }\n  return registered;\n}\n"]}

package/dist/chunk-77FOZCOT.js

@@ -0,0 +1,165 @@
+import { ConfigurationError } from './chunk-WLKFWQSJ.js';
+import { mkdir, rename } from 'fs/promises';
+import { dirname } from 'path';
+
+// src/internal/persistence/fts5-sanitize.ts
+var PHRASE_OPEN = "
";
+var PHRASE_CLOSE = "";
+function sanitizeFts5Query(query) {
+  if (query.length === 0) return query;
+  const phrases = [];
+  let text = query.replace(/"[^"]+"/g, (match) => {
+    phrases.push(match);
+    return `${PHRASE_OPEN}${phrases.length - 1}${PHRASE_CLOSE}`;
+  });
+  text = text.replace(/[[\]{}()"^]/g, " ");
+  text = text.replace(/\*+/g, "*");
+  text = text.replace(/^\s*(AND|OR|NOT)\s+/i, "");
+  text = text.replace(/\s+(AND|OR|NOT)\s*$/i, "");
+  text = text.replace(/\b\w+[-._]\w[\w\-._]*\b/g, (match) => `"${match}"`);
+  for (let i = 0; i < phrases.length; i += 1) {
+    text = text.replace(`${PHRASE_OPEN}${i}${PHRASE_CLOSE}`, phrases[i] ?? "");
+  }
+  return text.trim();
+}
+var CJK_RANGES = [
+  [12288, 12351],
+  // CJK Symbols and Punctuation
+  [12352, 12447],
+  // Hiragana
+  [12448, 12543],
+  // Katakana
+  [13312, 19903],
+  // CJK Unified Ideographs Extension A
+  [19968, 40959],
+  // CJK Unified Ideographs
+  [44032, 55215]
+  // Hangul Syllables
+];
+function containsCjk(text) {
+  for (const char of text) {
+    const cp = char.codePointAt(0);
+    if (cp === void 0) continue;
+    for (const [lo, hi] of CJK_RANGES) {
+      if (cp >= lo && cp <= hi) return true;
+    }
+  }
+  return false;
+}
+
+// src/internal/persistence/sqlite-wal.ts
+var warnedLabels = /* @__PURE__ */ new Set();
+function applyWalWithFallback(db, label) {
+  try {
+    const result = db.pragma("journal_mode = WAL", { simple: true });
+    if (typeof result === "string" && result.toLowerCase() === "wal") {
+      return { mode: "wal", fellBack: false };
+    }
+    logFallback(label, `got "${String(result)}" instead of "wal"`);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    logFallback(label, msg);
+  }
+  db.pragma("journal_mode = DELETE");
+  return { mode: "delete", fellBack: true };
+}
+function logFallback(label, reason) {
+  if (warnedLabels.has(label)) return;
+  warnedLabels.add(label);
+  process.stderr.write(
+    `[theokit-sdk] ${label}: WAL unavailable (${reason}); using DELETE journal mode. This is normal on NFS/SMB/FUSE; expect slightly slower concurrent access.
+`
+  );
+}
+async function openSqliteResilient(options) {
+  await mkdir(dirname(options.filePath), { recursive: true });
+  try {
+    return await openConcrete(options);
+  } catch (cause) {
+    if (options.recoverCorrupt !== false && isCorruptionError(cause)) {
+      await renameAside(options.filePath, options.label ?? "sqlite");
+      return await openConcrete(options);
+    }
+    throw cause;
+  }
+}
+async function openConcrete(options) {
+  const db = await loadDriver(options.filePath);
+  applyWalWithFallback(db, options.label ?? "sqlite");
+  await options.onOpen?.(db);
+  return db;
+}
+var driverLoaderOverrides;
+function adaptNodeSqlite(db) {
+  const pragma = (statement, options) => {
+    const stmt = db.prepare(`PRAGMA ${statement}`);
+    const row = stmt.get();
+    if (options?.simple === true) {
+      return row === void 0 ? void 0 : Object.values(row)[0];
+    }
+    return row === void 0 ? [] : [row];
+  };
+  return new Proxy(db, {
+    get(target, prop, receiver) {
+      if (prop === "pragma") return pragma;
+      if (prop === "loadExtension" && typeof db.loadExtension !== "function") {
+        return () => {
+          throw new Error(
+            "SQLite extension loading is unavailable on the node:sqlite fallback \u2014 install better-sqlite3 for sqlite-vec"
+          );
+        };
+      }
+      const value = Reflect.get(target, prop, receiver);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+async function loadDriver(filePath) {
+  let betterSqliteCause;
+  try {
+    const mod = await (driverLoaderOverrides?.betterSqlite3?.() ?? import('better-sqlite3'));
+    const Ctor = mod.default ?? mod;
+    if (typeof Ctor !== "function") {
+      throw new Error(`better-sqlite3 export is not a constructor (got ${typeof Ctor})`);
+    }
+    return new Ctor(filePath);
+  } catch (cause) {
+    betterSqliteCause = cause;
+  }
+  try {
+    const mod = await (driverLoaderOverrides?.nodeSqlite?.() ?? Promise.resolve(
+      process.getBuiltinModule?.(
+        "node:sqlite"
+      ) ?? (() => {
+        throw new Error("node:sqlite built-in unavailable (Node < 22.3)");
+      })()
+    ));
+    return adaptNodeSqlite(new mod.DatabaseSync(filePath));
+  } catch (nodeSqliteCause) {
+    const b = betterSqliteCause instanceof Error ? betterSqliteCause.message : String(betterSqliteCause);
+    const n = nodeSqliteCause instanceof Error ? nodeSqliteCause.message : String(nodeSqliteCause);
+    throw new ConfigurationError(
+      `Failed to load SQLite driver. Install \`better-sqlite3\` or run on Node 22.5+ for built-in \`node:sqlite\`. better-sqlite3: ${b}; node:sqlite: ${n}`,
+      { code: "sqlite_driver_unavailable", cause: nodeSqliteCause }
+    );
+  }
+}
+function isCorruptionError(cause) {
+  if (!(cause instanceof Error)) return false;
+  const msg = cause.message.toLowerCase();
+  return msg.includes("malformed") || msg.includes("not a database") || msg.includes("encrypted") || msg.includes("disk image is malformed");
+}
+async function renameAside(filePath, label) {
+  const asidePath = `${filePath}.corrupt-${Date.now()}`;
+  await rename(filePath, asidePath).catch(() => void 0);
+  await rename(`${filePath}-wal`, `${asidePath}-wal`).catch(() => void 0);
+  await rename(`${filePath}-shm`, `${asidePath}-shm`).catch(() => void 0);
+  process.stderr.write(
+    `[theokit-sdk] ${label} database corrupt; renamed aside to ${asidePath} and rebuilt schema
+`
+  );
+}
+
+export { applyWalWithFallback, containsCjk, isCorruptionError, openSqliteResilient, sanitizeFts5Query };
+//# sourceMappingURL=chunk-77FOZCOT.js.map
+//# sourceMappingURL=chunk-77FOZCOT.js.map

package/dist/chunk-77FOZCOT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/persistence/fts5-sanitize.ts","../src/internal/persistence/sqlite-wal.ts","../src/internal/persistence/sqlite-open.ts"],"names":[],"mappings":";;;;;AAsBA,IAAM,WAAA,GAAc,GAAA;AACpB,IAAM,YAAA,GAAe,GAAA;AAWd,SAAS,kBAAkB,KAAA,EAAuB;AACvD,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAG/B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,IAAI,IAAA,GAAO,KAAA,CAAM,OAAA,CAAQ,UAAA,EAAY,CAAC,KAAA,KAAU;AAC9C,IAAA,OAAA,CAAQ,KAAK,KAAK,CAAA;AAClB,IAAA,OAAO,GAAG,WAAW,CAAA,EAAG,QAAQ,MAAA,GAAS,CAAC,GAAG,YAAY,CAAA,CAAA;AAAA,EAC3D,CAAC,CAAA;AAGD,EAAA,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,cAAA,EAAgB,GAAG,CAAA;AAGvC,EAAA,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAA;AAG/B,EAAA,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,sBAAA,EAAwB,EAAE,CAAA;AAC9C,EAAA,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,sBAAA,EAAwB,EAAE,CAAA;AAI9C,EAAA,IAAA,GAAO,KAAK,OAAA,CAAQ,0BAAA,EAA4B,CAAC,KAAA,KAAU,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,CAAG,CAAA;AAGvE,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,EAAG;AAC1C,IAAA,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,CAAA,EAAG,WAAW,CAAA,EAAG,CAAC,CAAA,EAAG,YAAY,CAAA,CAAA,EAAI,OAAA,CAAQ,CAAC,CAAA,IAAK,EAAE,CAAA;AAAA,EAC3E;AAEA,EAAA,OAAO,KAAK,IAAA,EAAK;AACnB;AAIA,IAAM,UAAA,GAAuD;AAAA,EAC3D,CAAC,OAAQ,KAAM,CAAA;AAAA;AAAA,EACf,CAAC,OAAQ,KAAM,CAAA;AAAA;AAAA,EACf,CAAC,OAAQ,KAAM,CAAA;AAAA;AAAA,EACf,CAAC,OAAQ,KAAM,CAAA;AAAA;AAAA,EACf,CAAC,OAAQ,KAAM,CAAA;AAAA;AAAA,EACf,CAAC,OAAQ,KAAM;AAAA;AACjB,CAAA;AAQO,SAAS,YAAY,IAAA,EAAuB;AACjD,EAAA,KAAA,MAAW,QAAQ,IAAA,EAAM;AACvB,IAAA,MAAM,EAAA,GAAK,IAAA,CAAK,WAAA,CAAY,CAAC,CAAA;AAC7B,IAAA,IAAI,OAAO,MAAA,EAAW;AACtB,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,EAAE,CAAA,IAAK,UAAA,EAAY;AACjC,MAAA,IAAI,EAAA,IAAM,EAAA,IAAM,EAAA,IAAM,EAAA,EAAI,OAAO,IAAA;AAAA,IACnC;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;;AClEA,IAAM,YAAA,uBAAmB,GAAA,EAAY;AAW9B,SAAS,oBAAA,CAAqB,IAAmB,KAAA,EAA+B;AACrF,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,EAAA,CAAG,MAAA,CAAO,sBAAsB,EAAE,MAAA,EAAQ,MAAM,CAAA;AAC/D,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,WAAA,OAAkB,KAAA,EAAO;AAChE,MAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,QAAA,EAAU,KAAA,EAAM;AAAA,IACxC;AACA,IAAA,WAAA,CAAY,KAAA,EAAO,CAAA,KAAA,EAAQ,MAAA,CAAO,MAAM,CAAC,CAAA,kBAAA,CAAoB,CAAA;AAAA,EAC/D,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC3D,IAAA,WAAA,CAAY,OAAO,GAAG,CAAA;AAAA,EACxB;AAEA,EAAA,EAAA,CAAG,OAAO,uBAAuB,CAAA;AACjC,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,QAAA,EAAU,IAAA,EAAK;AAC1C;AAEA,SAAS,WAAA,CAAY,OAAe,MAAA,EAAsB;AACxD,EAAA,IAAI,YAAA,CAAa,GAAA,CAAI,KAAK,CAAA,EAAG;AAC7B,EAAA,YAAA,CAAa,IAAI,KAAK,CAAA;AACtB,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb,CAAA,cAAA,EAAiB,KAAK,CAAA,mBAAA,EAAsB,MAAM,CAAA;AAAA;AAAA,GAEpD;AACF;ACTA,eAAsB,oBACpB,OAAA,EACY;AACZ,EAAA,MAAM,KAAA,CAAM,QAAQ,OAAA,CAAQ,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC1D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,aAAa,OAAO,CAAA;AAAA,EACnC,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,OAAA,CAAQ,cAAA,KAAmB,KAAA,IAAS,iBAAA,CAAkB,KAAK,CAAA,EAAG;AAChE,MAAA,MAAM,WAAA,CAAY,OAAA,CAAQ,QAAA,EAAU,OAAA,CAAQ,SAAS,QAAQ,CAAA;AAC7D,MAAA,OAAO,MAAM,aAAa,OAAO,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,eAAe,aACb,OAAA,EACY;AACZ,EAAA,MAAM,EAAA,GAAK,MAAM,UAAA,CAAc,OAAA,CAAQ,QAAQ,CAAA;AAG/C,EAAA,oBAAA,CAAqB,EAAA,EAAI,OAAA,CAAQ,KAAA,IAAS,QAAQ,CAAA;AAClD,EAAA,MAAM,OAAA,CAAQ,SAAS,EAAE,CAAA;AACzB,EAAA,OAAO,EAAA;AACT;AAOA,IAAI,qBAAA;AAcJ,SAAS,gBAAgB,EAAA,EAKH;AACpB,EAAA,MAAM,MAAA,GAAS,CAAC,SAAA,EAAmB,OAAA,KAA4C;AAC7E,IAAA,MAAM,IAAA,GAAO,EAAA,CAAG,OAAA,CAAQ,CAAA,OAAA,EAAU,SAAS,CAAA,CAAE,CAAA;AAG7C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,OAAA,EAAS,WAAW,IAAA,EAAM;AAC5B,MAAA,OAAO,QAAQ,MAAA,GAAY,MAAA,GAAY,OAAO,MAAA,CAAO,GAAG,EAAE,CAAC,CAAA;AAAA,IAC7D;AACA,IAAA,OAAO,GAAA,KAAQ,MAAA,GAAY,EAAC,GAAI,CAAC,GAAG,CAAA;AAAA,EACtC,CAAA;AACA,EAAA,OAAO,IAAI,MAAM,EAAA,EAAoC;AAAA,IACnD,GAAA,CAAI,MAAA,EAAQ,IAAA,EAAM,QAAA,EAAU;AAC1B,MAAA,IAAI,IAAA,KAAS,UAAU,OAAO,MAAA;AAC9B,MAAA,IAAI,IAAA,KAAS,eAAA,IAAmB,OAAO,EAAA,CAAG,kBAAkB,UAAA,EAAY;AACtE,QAAA,OAAO,MAAM;AACX,UAAA,MAAM,IAAI,KAAA;AAAA,YACR;AAAA,WACF;AAAA,QACF,CAAA;AAAA,MACF;AACA,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,MAAA,EAAQ,MAAM,QAAQ,CAAA;AAChD,MAAA,OAAO,OAAO,KAAA,KAAU,UAAA,GACnB,KAAA,CAAuC,IAAA,CAAK,MAAM,CAAA,GACnD,KAAA;AAAA,IACN;AAAA,GACD,CAAA;AACH;AAOA,eAAe,WAAwC,QAAA,EAA8B;AACnF,EAAA,IAAI,iBAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAO,OAAO,qBAAA,EAAuB,aAAA,IAAgB,IAAK,OAAO,gBAAgB,CAAA,CAAA;AAGvF,IAAA,MAAM,IAAA,GAAO,IAAI,OAAA,IAAW,GAAA;AAC5B,IAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gDAAA,EAAmD,OAAO,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IACnF;AACA,IAAA,OAAO,IAAK,KAAuC,QAAQ,CAAA;AAAA,EAC7D,SAAS,KAAA,EAAO;AACd,IAAA,iBAAA,GAAoB,KAAA;AAAA,EACtB;AAKA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAO,OAAO,qBAAA,EAAuB,UAAA,QACzC,OAAA,CAAQ,OAAA;AAAA,MACL,OAAA,CAA2D,gBAAA;AAAA,QAC1D;AAAA,YAEC,MAAM;AACL,QAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAAA,MAClE,CAAA;AAAG,KACP,CAAA;AASF,IAAA,OAAO,eAAA,CAAgB,IAAI,GAAA,CAAI,YAAA,CAAa,QAAQ,CAAC,CAAA;AAAA,EACvD,SAAS,eAAA,EAAiB;AACxB,IAAA,MAAM,IACJ,iBAAA,YAA6B,KAAA,GAAQ,iBAAA,CAAkB,OAAA,GAAU,OAAO,iBAAiB,CAAA;AAC3F,IAAA,MAAM,IAAI,eAAA,YAA2B,KAAA,GAAQ,eAAA,CAAgB,OAAA,GAAU,OAAO,eAAe,CAAA;AAC7F,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,CAAA,4HAAA,EAA+H,CAAC,CAAA,eAAA,EAAkB,CAAC,CAAA,CAAA;AAAA,MACnJ,EAAE,IAAA,EAAM,2BAAA,EAA6B,KAAA,EAAO,eAAA;AAAgB,KAC9D;AAAA,EACF;AACF;AAGO,SAAS,kBAAkB,KAAA,EAAyB;AACzD,EAAA,IAAI,EAAE,KAAA,YAAiB,KAAA,CAAA,EAAQ,OAAO,KAAA;AACtC,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,OAAA,CAAQ,WAAA,EAAY;AACtC,EAAA,OACE,GAAA,CAAI,QAAA,CAAS,WAAW,CAAA,IACxB,IAAI,QAAA,CAAS,gBAAgB,CAAA,IAC7B,GAAA,CAAI,QAAA,CAAS,WAAW,CAAA,IACxB,GAAA,CAAI,SAAS,yBAAyB,CAAA;AAE1C;AAEA,eAAe,WAAA,CAAY,UAAkB,KAAA,EAA8B;AACzE,EAAA,MAAM,YAAY,CAAA,EAAG,QAAQ,CAAA,SAAA,EAAY,IAAA,CAAK,KAAK,CAAA,CAAA;AACnD,EAAA,MAAM,OAAO,QAAA,EAAU,SAAS,CAAA,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AACvD,EAAA,MAAM,MAAA,CAAO,CAAA,EAAG,QAAQ,CAAA,IAAA,CAAA,EAAQ,CAAA,EAAG,SAAS,CAAA,IAAA,CAAM,CAAA,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AACzE,EAAA,MAAM,MAAA,CAAO,CAAA,EAAG,QAAQ,CAAA,IAAA,CAAA,EAAQ,CAAA,EAAG,SAAS,CAAA,IAAA,CAAM,CAAA,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AACzE,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,IACb,CAAA,cAAA,EAAiB,KAAK,CAAA,oCAAA,EAAuC,SAAS,CAAA;AAAA;AAAA,GACxE;AACF","file":"chunk-77FOZCOT.js","sourcesContent":["/**\n * FTS5 query sanitization + CJK detection (ADR D64).\n *\n * Port of Hermes' 6-step sanitizer (`hermes_state.py:1797-1847`). Prevents\n * crashes on user inputs with hyphens, dots, underscores, and unmatched\n * specials. Auto-quotes identifier-shaped tokens so `error-code` finds\n * literal `error-code` instead of `error AND code`.\n *\n * CJK detection returns true for inputs containing characters in the main\n * CJK Unicode ranges (Chinese, Japanese, Korean). CJK trigram routing is\n * deferred to v1.4 — callers receiving `containsCjk === true` should\n * short-circuit to an empty result or LIKE fallback for v1.3.\n *\n * @internal\n */\n\n// Control-char sentinels for the phrase-preservation placeholder. U+0001\n// and U+0002 are essentially never present in real user queries, and\n// crucially do NOT form word boundaries / `\\w` characters, so Step 5's\n// auto-quote regex (`\\b\\w+[-._]\\w[\\w\\-._]*\\b`) cannot match them.\n// Choosing `__PHRASE_N__` instead would re-trigger Step 5 on the second\n// sanitize pass and break idempotence.\nconst PHRASE_OPEN = \"\u0001\";\nconst PHRASE_CLOSE = \"\u0002\";\n\n/**\n * Six-step FTS5 query sanitizer. Returns a query string safe for passing\n * to `WHERE <fts5_table> MATCH ?` as a parameter.\n *\n * Returns empty string when the input contains only specials (caller MUST\n * short-circuit to avoid runtime SQL error — EC-3).\n *\n * @internal\n */\nexport function sanitizeFts5Query(query: string): string {\n  if (query.length === 0) return query;\n\n  // Step 1: preserve \"quoted phrases\" via control-char placeholders.\n  const phrases: string[] = [];\n  let text = query.replace(/\"[^\"]+\"/g, (match) => {\n    phrases.push(match);\n    return `${PHRASE_OPEN}${phrases.length - 1}${PHRASE_CLOSE}`;\n  });\n\n  // Step 2: strip unmatched specials (brackets, braces, parens, double quotes, caret).\n  text = text.replace(/[[\\]{}()\"^]/g, \" \");\n\n  // Step 3: collapse repeated asterisks (FTS5 prefix operator is single `*`).\n  text = text.replace(/\\*+/g, \"*\");\n\n  // Step 4: strip dangling boolean operators (AND/OR/NOT) at start/end.\n  text = text.replace(/^\\s*(AND|OR|NOT)\\s+/i, \"\");\n  text = text.replace(/\\s+(AND|OR|NOT)\\s*$/i, \"\");\n\n  // Step 5: auto-quote identifier-shaped tokens that contain `-`, `.`, or `_`.\n  // FTS5 tokenizer would otherwise split them as boolean conjunctions.\n  text = text.replace(/\\b\\w+[-._]\\w[\\w\\-._]*\\b/g, (match) => `\"${match}\"`);\n\n  // Step 6: restore preserved phrases.\n  for (let i = 0; i < phrases.length; i += 1) {\n    text = text.replace(`${PHRASE_OPEN}${i}${PHRASE_CLOSE}`, phrases[i] ?? \"\");\n  }\n\n  return text.trim();\n}\n\n// CJK code-point ranges. Coverage matches Hermes' coarse detection for v1.3;\n// fine-grained trigram routing comes in v1.4.\nconst CJK_RANGES: ReadonlyArray<readonly [number, number]> = [\n  [0x3000, 0x303f], // CJK Symbols and Punctuation\n  [0x3040, 0x309f], // Hiragana\n  [0x30a0, 0x30ff], // Katakana\n  [0x3400, 0x4dbf], // CJK Unified Ideographs Extension A\n  [0x4e00, 0x9fff], // CJK Unified Ideographs\n  [0xac00, 0xd7af], // Hangul Syllables\n];\n\n/**\n * Returns true if `text` contains at least one character in the main CJK\n * Unicode ranges.\n *\n * @internal\n */\nexport function containsCjk(text: string): boolean {\n  for (const char of text) {\n    const cp = char.codePointAt(0);\n    if (cp === undefined) continue;\n    for (const [lo, hi] of CJK_RANGES) {\n      if (cp >= lo && cp <= hi) return true;\n    }\n  }\n  return false;\n}\n","/**\n * SQLite WAL mode helper with NFS/SMB/FUSE fallback to DELETE (ADR D63).\n *\n * WAL is faster (concurrent readers + one writer) but unsupported on some\n * network/FUSE filesystems. Try WAL; if the pragma returns something else\n * or throws, fall back to DELETE journal mode. Warn one time per label.\n *\n * @internal\n */\n\ninterface PragmaCapable {\n  pragma: (statement: string, options?: { simple?: boolean }) => unknown;\n}\n\n/**\n * Result of `applyWalWithFallback`.\n *\n * @internal\n */\nexport interface WalApplyResult {\n  /** Final journal_mode actually in effect. */\n  mode: \"wal\" | \"delete\";\n  /** True if we wanted WAL but the filesystem refused. */\n  fellBack: boolean;\n}\n\nconst warnedLabels = new Set<string>();\n\n/**\n * Apply WAL mode with DELETE fallback. Idempotent — safe to call multiple\n * times on the same connection.\n *\n * @param db   any `pragma()`-capable SQLite handle (e.g., `better-sqlite3`)\n * @param label short identifier used in the warning (e.g., \"memory-index\")\n *\n * @internal\n */\nexport function applyWalWithFallback(db: PragmaCapable, label: string): WalApplyResult {\n  try {\n    const result = db.pragma(\"journal_mode = WAL\", { simple: true });\n    if (typeof result === \"string\" && result.toLowerCase() === \"wal\") {\n      return { mode: \"wal\", fellBack: false };\n    }\n    logFallback(label, `got \"${String(result)}\" instead of \"wal\"`);\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    logFallback(label, msg);\n  }\n\n  db.pragma(\"journal_mode = DELETE\");\n  return { mode: \"delete\", fellBack: true };\n}\n\nfunction logFallback(label: string, reason: string): void {\n  if (warnedLabels.has(label)) return;\n  warnedLabels.add(label);\n  process.stderr.write(\n    `[theokit-sdk] ${label}: WAL unavailable (${reason}); using DELETE journal mode. ` +\n      \"This is normal on NFS/SMB/FUSE; expect slightly slower concurrent access.\\n\",\n  );\n}\n\n/**\n * Test helper — clears the warn-once registry.\n *\n * @internal\n */\nexport function _resetWalWarnings(): void {\n  warnedLabels.clear();\n}\n","/**\n * Resilient SQLite open (plan m0-foundation-expose-primitives, M0-5).\n *\n * Generalizes the driver-load + WAL-apply + corruption-recovery logic that was\n * duplicated (byte-identical) across `sdk/internal/memory/index-db.ts` and\n * `sdk-memory/internal/index/index-db.ts`. Schema-agnostic: the caller applies\n * its own PRAGMA/SCHEMA via the `onOpen` callback.\n *\n * Corruption recovery (EC-7): when opening fails with a \"malformed\" / \"not a\n * database\" / \"encrypted\" error and `recoverCorrupt` is not false, the file is\n * renamed aside to `<path>.corrupt-<ts>` (plus its WAL/SHM siblings) and a fresh\n * DB is opened. The corrupt file is renamed, NOT backed up — the timestamped\n * `.corrupt-*` file is kept for manual recovery.\n *\n * @internal — public via `@theokit/sdk/internal/persistence` (semver-exempt)\n */\n\nimport { mkdir, rename } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\n\nimport { ConfigurationError } from \"../../errors.js\";\nimport { applyWalWithFallback } from \"./sqlite-wal.js\";\n\n/** Minimal SQLite handle surface every driver (`better-sqlite3`) exposes. */\nexport interface ResilientSqliteDb {\n  /** SQLite `pragma()` access (used by `applyWalWithFallback`). */\n  pragma(statement: string, options?: { simple?: boolean }): unknown;\n  exec(sql: string): void;\n  close(): void;\n}\n\nexport interface OpenSqliteResilientOptions<T extends ResilientSqliteDb> {\n  /** Absolute path to the SQLite file. Parent directories are created. */\n  filePath: string;\n  /**\n   * Called after the driver is open and WAL is applied, before the handle is\n   * returned. Apply PRAGMA/SCHEMA statements here. Errors propagate.\n   */\n  onOpen?: (db: T) => void | Promise<void>;\n  /** Label used in the WAL-fallback warning and corruption-recovery log. Default \"sqlite\". */\n  label?: string;\n  /** When true (default) a corruption error renames the file aside and rebuilds. */\n  recoverCorrupt?: boolean;\n}\n\n/**\n * Open a SQLite file with WAL (+ DELETE fallback) and corruption recovery.\n *\n * @typeParam T - the concrete DB handle type the driver returns (defaults to the\n *   minimal {@link ResilientSqliteDb} surface)\n */\nexport async function openSqliteResilient<T extends ResilientSqliteDb = ResilientSqliteDb>(\n  options: OpenSqliteResilientOptions<T>,\n): Promise<T> {\n  await mkdir(dirname(options.filePath), { recursive: true });\n  try {\n    return await openConcrete(options);\n  } catch (cause) {\n    if (options.recoverCorrupt !== false && isCorruptionError(cause)) {\n      await renameAside(options.filePath, options.label ?? \"sqlite\");\n      return await openConcrete(options);\n    }\n    throw cause;\n  }\n}\n\nasync function openConcrete<T extends ResilientSqliteDb>(\n  options: OpenSqliteResilientOptions<T>,\n): Promise<T> {\n  const db = await loadDriver<T>(options.filePath);\n  // Apply WAL with NFS/SMB/FUSE fallback BEFORE schema so the journal mode is\n  // set for the whole session.\n  applyWalWithFallback(db, options.label ?? \"sqlite\");\n  await options.onOpen?.(db);\n  return db;\n}\n\n/** Injectable driver loaders (tests simulate a consumer env without better-sqlite3). */\ninterface DriverLoaders {\n  betterSqlite3?: () => Promise<unknown>;\n  nodeSqlite?: () => Promise<unknown>;\n}\nlet driverLoaderOverrides: DriverLoaders | undefined;\n\n/** Test-only. @internal */\nexport function _setDriverLoadersForTests(overrides: DriverLoaders | undefined): void {\n  driverLoaderOverrides = overrides;\n}\n\n/**\n * Adapt `node:sqlite`'s `DatabaseSync` to the better-sqlite3 surface this module's callers use\n * (`prepare/get/all/run`, `exec`, `close`, `pragma`, `loadExtension`). The error message below has\n * ALWAYS promised this fallback (\"or run on Node 22.5+ for built-in node:sqlite\") — before the\n * flicker-bug fix the promise was fabricated: only better-sqlite3 was ever tried, so every consumer\n * without the optional native dep lost memory tools AND got a per-turn stderr WARN.\n */\nfunction adaptNodeSqlite(db: {\n  prepare(sql: string): unknown;\n  exec(sql: string): void;\n  close(): void;\n  loadExtension?: (path: string) => void;\n}): ResilientSqliteDb {\n  const pragma = (statement: string, options?: { simple?: boolean }): unknown => {\n    const stmt = db.prepare(`PRAGMA ${statement}`) as {\n      get(): Record<string, unknown> | undefined;\n    };\n    const row = stmt.get();\n    if (options?.simple === true) {\n      return row === undefined ? undefined : Object.values(row)[0];\n    }\n    return row === undefined ? [] : [row];\n  };\n  return new Proxy(db as unknown as ResilientSqliteDb, {\n    get(target, prop, receiver) {\n      if (prop === \"pragma\") return pragma;\n      if (prop === \"loadExtension\" && typeof db.loadExtension !== \"function\") {\n        return () => {\n          throw new Error(\n            \"SQLite extension loading is unavailable on the node:sqlite fallback — install better-sqlite3 for sqlite-vec\",\n          );\n        };\n      }\n      const value = Reflect.get(target, prop, receiver) as unknown;\n      return typeof value === \"function\"\n        ? (value as (...a: unknown[]) => unknown).bind(target)\n        : value;\n    },\n  });\n}\n\n// Divida PRE-EXISTENTE, exposta quando o M75 consertou a config Biome que abortava antes\n// de varrer estes arquivos (raiz aninhada em refactor/). Nao e codigo novo e nao foi tocado\n// pelo M75; refatorar internals do SDK sem revisao trocaria um problema visivel por um diff\n// arriscado. Rastreado em usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: ver a razao logo acima\nasync function loadDriver<T extends ResilientSqliteDb>(filePath: string): Promise<T> {\n  let betterSqliteCause: unknown;\n  try {\n    const mod = (await (driverLoaderOverrides?.betterSqlite3?.() ?? import(\"better-sqlite3\"))) as {\n      default?: unknown;\n    };\n    const Ctor = mod.default ?? mod;\n    if (typeof Ctor !== \"function\") {\n      throw new Error(`better-sqlite3 export is not a constructor (got ${typeof Ctor})`);\n    }\n    return new (Ctor as new (path: string) => unknown)(filePath) as T;\n  } catch (cause) {\n    betterSqliteCause = cause;\n  }\n  // Fallback: the Node 22.5+ built-in driver (the path the error message documents).\n  // `process.getBuiltinModule` (Node 22.3+) instead of `import(\"node:sqlite\")` — bundlers that\n  // predate the sqlite builtin rewrite the import specifier to a bare \"sqlite\" package (proven in\n  // the published dist: \"Cannot find package 'sqlite'\"), while getBuiltinModule is opaque to them.\n  try {\n    const mod = (await (driverLoaderOverrides?.nodeSqlite?.() ??\n      Promise.resolve(\n        (process as { getBuiltinModule?: (id: string) => unknown }).getBuiltinModule?.(\n          \"node:sqlite\",\n        ) ??\n          (() => {\n            throw new Error(\"node:sqlite built-in unavailable (Node < 22.3)\");\n          })(),\n      ))) as {\n      DatabaseSync: new (\n        path: string,\n      ) => {\n        prepare(sql: string): unknown;\n        exec(sql: string): void;\n        close(): void;\n      };\n    };\n    return adaptNodeSqlite(new mod.DatabaseSync(filePath)) as T;\n  } catch (nodeSqliteCause) {\n    const b =\n      betterSqliteCause instanceof Error ? betterSqliteCause.message : String(betterSqliteCause);\n    const n = nodeSqliteCause instanceof Error ? nodeSqliteCause.message : String(nodeSqliteCause);\n    throw new ConfigurationError(\n      `Failed to load SQLite driver. Install \\`better-sqlite3\\` or run on Node 22.5+ for built-in \\`node:sqlite\\`. better-sqlite3: ${b}; node:sqlite: ${n}`,\n      { code: \"sqlite_driver_unavailable\", cause: nodeSqliteCause },\n    );\n  }\n}\n\n/** True when an open error indicates an unreadable / corrupt database file. */\nexport function isCorruptionError(cause: unknown): boolean {\n  if (!(cause instanceof Error)) return false;\n  const msg = cause.message.toLowerCase();\n  return (\n    msg.includes(\"malformed\") ||\n    msg.includes(\"not a database\") ||\n    msg.includes(\"encrypted\") ||\n    msg.includes(\"disk image is malformed\")\n  );\n}\n\nasync function renameAside(filePath: string, label: string): Promise<void> {\n  const asidePath = `${filePath}.corrupt-${Date.now()}`;\n  await rename(filePath, asidePath).catch(() => undefined);\n  await rename(`${filePath}-wal`, `${asidePath}-wal`).catch(() => undefined);\n  await rename(`${filePath}-shm`, `${asidePath}-shm`).catch(() => undefined);\n  process.stderr.write(\n    `[theokit-sdk] ${label} database corrupt; renamed aside to ${asidePath} and rebuilt schema\\n`,\n  );\n}\n"]}

package/dist/chunk-7AD3ZTZL.js

@@ -0,0 +1,25 @@
+import { AsyncLocalStorage } from 'async_hooks';
+
+// src/internal/runtime/concurrency/async-local-storage.ts
+var toolWhitelistStore = new AsyncLocalStorage();
+async function withToolWhitelist(whitelist, fn) {
+  return toolWhitelistStore.run(whitelist, fn);
+}
+function currentToolWhitelist() {
+  return toolWhitelistStore.getStore();
+}
+function checkToolWhitelist(toolName) {
+  const whitelist = currentToolWhitelist();
+  if (whitelist === void 0) return { allowed: true };
+  if (!whitelist.has(toolName)) {
+    return {
+      allowed: false,
+      reason: `Tool "${toolName}" not available in this fork context`
+    };
+  }
+  return { allowed: true };
+}
+
+export { checkToolWhitelist, withToolWhitelist };
+//# sourceMappingURL=chunk-7AD3ZTZL.js.map
+//# sourceMappingURL=chunk-7AD3ZTZL.js.map

package/dist/chunk-7AD3ZTZL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/concurrency/async-local-storage.ts"],"names":[],"mappings":";;;AAsBA,IAAM,kBAAA,GAAqB,IAAI,iBAAA,EAA+B;AAQ9D,eAAsB,iBAAA,CACpB,WACA,EAAA,EACY;AACZ,EAAA,OAAO,kBAAA,CAAmB,GAAA,CAAI,SAAA,EAAW,EAAE,CAAA;AAC7C;AAQO,SAAS,oBAAA,GAAgD;AAC9D,EAAA,OAAO,mBAAmB,QAAA,EAAS;AACrC;AAoBO,SAAS,mBAAmB,QAAA,EAAyC;AAC1E,EAAA,MAAM,YAAY,oBAAA,EAAqB;AACvC,EAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAO,EAAE,SAAS,IAAA,EAAK;AACpD,EAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA,EAAG;AAC5B,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,SAAS,QAAQ,CAAA,oCAAA;AAAA,KAC3B;AAAA,EACF;AACA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB","file":"chunk-7AD3ZTZL.js","sourcesContent":["/**\n * Per-fork tool whitelist via `AsyncLocalStorage` (ADR D111).\n *\n * Forked agents (background review, curator, judge) need a tool subset\n * distinct from the parent's. A global mutable `let _whitelist` would\n * corrupt state when two forks run in parallel. `AsyncLocalStorage`\n * propagates the whitelist through the async chain so each fork sees its\n * own — no cross-fork bleed.\n *\n * Outside a `withToolWhitelist(...)` scope, `currentToolWhitelist()`\n * returns `undefined` and `checkToolWhitelist` allows every tool — the\n * parent agent is unaffected.\n *\n * Wire site: `internal/agent-loop/tool-dispatch.ts:dispatchSingleCall`\n * calls `checkToolWhitelist` after the repair middleware and before\n * `tools.find`.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nconst toolWhitelistStore = new AsyncLocalStorage<Set<string>>();\n\n/**\n * Run `fn` with `whitelist` as the active tool filter. Nested calls\n * shadow the outer set; the outer is restored on return (EC-F).\n *\n * @internal\n */\nexport async function withToolWhitelist<T>(\n  whitelist: Set<string>,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return toolWhitelistStore.run(whitelist, fn);\n}\n\n/**\n * Active tool whitelist for the current async context, or `undefined`\n * when not inside a `withToolWhitelist(...)` scope.\n *\n * @internal\n */\nexport function currentToolWhitelist(): Set<string> | undefined {\n  return toolWhitelistStore.getStore();\n}\n\n/**\n * Decision returned by {@link checkToolWhitelist}.\n *\n * @internal\n */\nexport interface ToolWhitelistDecision {\n  allowed: boolean;\n  /** Populated only when `allowed === false`. */\n  reason?: string;\n}\n\n/**\n * Check whether `toolName` is allowed in the current fork context.\n * Returns `{ allowed: true }` when no fork is active — preserves the\n * parent agent's full tool surface.\n *\n * @internal\n */\nexport function checkToolWhitelist(toolName: string): ToolWhitelistDecision {\n  const whitelist = currentToolWhitelist();\n  if (whitelist === undefined) return { allowed: true };\n  if (!whitelist.has(toolName)) {\n    return {\n      allowed: false,\n      reason: `Tool \"${toolName}\" not available in this fork context`,\n    };\n  }\n  return { allowed: true };\n}\n"]}

package/dist/chunk-7GFX45DD.js

@@ -0,0 +1,57 @@
+// src/internal/runtime/lifecycle/env-policy.ts
+var SECRET_PATTERNS = [
+  /KEY/i,
+  /SECRET/i,
+  /TOKEN/i,
+  /PASSWORD/i,
+  /PASSWD/i,
+  /PASSPHRASE/i,
+  /[_-]PWD/i,
+  /CREDENTIAL/i,
+  /PRIVATE/i,
+  /_AUTH/i,
+  // #54-a — value-embedded-secret conventions (no generic `*_URL` — see keep-list test).
+  /DSN/i,
+  /WEBHOOK/i,
+  /COOKIE/i,
+  /CONNECTION[_-]?STRING/i,
+  // Known DB / message-broker connection-string vars (carry `user:pass@`).
+  /(?:^|[_-])(?:DATABASE|DB|REDIS|MONGO(?:DB)?|POSTGRES(?:QL)?|MYSQL|MARIADB|AMQP|RABBITMQ|CLICKHOUSE|ELASTIC(?:SEARCH)?|CASSANDRA|COUCHDB|MEMCACHED|NATS|KAFKA)[_-]?(?:URL|URI|DSN|CONNECTION)/i
+];
+var CORE_VARS = [
+  "PATH",
+  "HOME",
+  "SHELL",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "USER",
+  "LOGNAME"
+];
+function isSecretName(name) {
+  return SECRET_PATTERNS.some((re) => re.test(name));
+}
+function inheritsUnderPolicy(name, policy) {
+  if (policy === "all") return true;
+  if (policy === "core") return CORE_VARS.includes(name);
+  return !isSecretName(name);
+}
+function resolveChildEnv(options = {}) {
+  const parent = options.parent ?? process.env;
+  const policy = options.policy ?? "inherit-scrubbed";
+  const base = {};
+  for (const [name, value] of Object.entries(parent)) {
+    if (value !== void 0 && inheritsUnderPolicy(name, policy)) base[name] = value;
+  }
+  for (const [name, value] of Object.entries(options.overrides ?? {})) {
+    base[name] = value;
+  }
+  return base;
+}
+
+export { resolveChildEnv };
+//# sourceMappingURL=chunk-7GFX45DD.js.map
+//# sourceMappingURL=chunk-7GFX45DD.js.map

package/dist/chunk-7GFX45DD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/lifecycle/env-policy.ts"],"names":[],"mappings":";AAmDA,IAAM,eAAA,GAAqC;AAAA,EACzC,MAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,aAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA;AAAA,EAEA,MAAA;AAAA,EACA,UAAA;AAAA,EACA,SAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EAEA;AACF,CAAA;AAMA,IAAM,SAAA,GAA+B;AAAA,EACnC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,KAAA;AAAA,EACA,MAAA;AAAA,EACA,MAAA;AAAA,EACA;AACF,CAAA;AAEA,SAAS,aAAa,IAAA,EAAuB;AAC3C,EAAA,OAAO,gBAAgB,IAAA,CAAK,CAAC,OAAO,EAAA,CAAG,IAAA,CAAK,IAAI,CAAC,CAAA;AACnD;AAGA,SAAS,mBAAA,CAAoB,MAAc,MAAA,EAA4B;AACrE,EAAA,IAAI,MAAA,KAAW,OAAO,OAAO,IAAA;AAC7B,EAAA,IAAI,MAAA,KAAW,MAAA,EAAQ,OAAO,SAAA,CAAU,SAAS,IAAI,CAAA;AACrD,EAAA,OAAO,CAAC,aAAa,IAAI,CAAA;AAC3B;AAEO,SAAS,eAAA,CAAgB,OAAA,GAAkC,EAAC,EAA2B;AAC5F,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,GAAA;AACzC,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,kBAAA;AAEjC,EAAA,MAAM,OAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClD,IAAA,IAAI,KAAA,KAAU,UAAa,mBAAA,CAAoB,IAAA,EAAM,MAAM,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA;AAAA,EAC7E;AAGA,EAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,MAAA,CAAO,QAAQ,OAAA,CAAQ,SAAA,IAAa,EAAE,CAAA,EAAG;AACnE,IAAA,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA;AAAA,EACf;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-7GFX45DD.js","sourcesContent":["/**\n * Child-process environment policy (#54).\n *\n * Every subprocess the SDK spawns previously inherited the FULL `process.env`,\n * so API keys, tokens and passwords leaked into hook scripts and shell tools.\n * `resolveChildEnv` computes the env a child receives under an explicit policy,\n * modeled on codex's `ShellEnvironmentPolicy`\n * (referencia: codex/codex-rs/protocol/src/shell_environment.rs).\n *\n * Modes:\n *  - `inherit-scrubbed` (DEFAULT) — inherit all parent vars EXCEPT secret-like\n *    names (`*KEY*`, `*SECRET*`, `*TOKEN*`, `*PASSWORD*`, `*_AUTH*`). Non-breaking:\n *    existing spawns keep every non-secret var; only secrets stop leaking.\n *  - `core` — inherit ONLY a safe base allowlist (PATH/HOME/…); strongest scrub.\n *  - `all` — explicit opt-out: inherit everything, secrets included.\n *\n * Explicit `overrides` ALWAYS win (merged last), so a tool can re-inject a var\n * it genuinely needs even under a scrubbing policy.\n *\n * @internal\n */\n\nimport type { EnvPolicy } from \"../../../types/env-policy.js\";\n\n// The `EnvPolicy` contract now lives in the domain `types/` layer (SE46 DIP\n// direction). Re-exported here so existing importers of this module keep\n// resolving the same name.\nexport type { EnvPolicy } from \"../../../types/env-policy.js\";\n\nexport interface ResolveChildEnvOptions {\n  /** Source env to derive from. Defaults to `process.env`. */\n  parent?: Record<string, string | undefined>;\n  /** Inherit/scrub policy. Defaults to `inherit-scrubbed`. */\n  policy?: EnvPolicy;\n  /** Explicit vars merged AFTER the policy — always win. */\n  overrides?: Record<string, string>;\n}\n\n/**\n * Secret-like variable-name patterns (case-insensitive). A parent var whose\n * name matches any of these is dropped under `inherit-scrubbed`. Conservative\n * by design — see the EC-4 false-positive test. `[_-]PWD` (not bare `PWD`)\n * catches `DB_PWD` without dropping the shell's working-directory `PWD`.\n * `CREDENTIAL` catches `GOOGLE_APPLICATION_CREDENTIALS`. #54-a extends the list to\n * the highest-signal VALUE-embedded-secret conventions — connection strings that\n * carry `user:password@` (`DATABASE_URL`, `REDIS_URL`, `MONGODB_URI`, `DB_URL`, …),\n * `DSN`, `WEBHOOK`, `COOKIE`, and `CONNECTION_STRING` — while deliberately NOT\n * dropping generic non-secret URLs (`PUBLIC_BASE_URL`, `API_URL`, `PGHOST`). A\n * denylist still cannot catch EVERY value-embedded secret — for untrusted children\n * use policy `\"core\"` (allowlist), the only fail-closed mode.\n */\nconst SECRET_PATTERNS: readonly RegExp[] = [\n  /KEY/i,\n  /SECRET/i,\n  /TOKEN/i,\n  /PASSWORD/i,\n  /PASSWD/i,\n  /PASSPHRASE/i,\n  /[_-]PWD/i,\n  /CREDENTIAL/i,\n  /PRIVATE/i,\n  /_AUTH/i,\n  // #54-a — value-embedded-secret conventions (no generic `*_URL` — see keep-list test).\n  /DSN/i,\n  /WEBHOOK/i,\n  /COOKIE/i,\n  /CONNECTION[_-]?STRING/i,\n  // Known DB / message-broker connection-string vars (carry `user:pass@`).\n  /(?:^|[_-])(?:DATABASE|DB|REDIS|MONGO(?:DB)?|POSTGRES(?:QL)?|MYSQL|MARIADB|AMQP|RABBITMQ|CLICKHOUSE|ELASTIC(?:SEARCH)?|CASSANDRA|COUCHDB|MEMCACHED|NATS|KAFKA)[_-]?(?:URL|URI|DSN|CONNECTION)/i,\n];\n\n/**\n * Safe base variables kept under the `core` policy. Process-hygiene vars a\n * child almost always needs; none are secret-bearing.\n */\nconst CORE_VARS: readonly string[] = [\n  \"PATH\",\n  \"HOME\",\n  \"SHELL\",\n  \"LANG\",\n  \"LC_ALL\",\n  \"LC_CTYPE\",\n  \"TMPDIR\",\n  \"TMP\",\n  \"TEMP\",\n  \"USER\",\n  \"LOGNAME\",\n];\n\nfunction isSecretName(name: string): boolean {\n  return SECRET_PATTERNS.some((re) => re.test(name));\n}\n\n/** Whether a parent var of the given name is inherited under `policy`. */\nfunction inheritsUnderPolicy(name: string, policy: EnvPolicy): boolean {\n  if (policy === \"all\") return true;\n  if (policy === \"core\") return CORE_VARS.includes(name);\n  return !isSecretName(name); // inherit-scrubbed\n}\n\nexport function resolveChildEnv(options: ResolveChildEnvOptions = {}): Record<string, string> {\n  const parent = options.parent ?? process.env;\n  const policy = options.policy ?? \"inherit-scrubbed\";\n\n  const base: Record<string, string> = {};\n  for (const [name, value] of Object.entries(parent)) {\n    if (value !== undefined && inheritsUnderPolicy(name, policy)) base[name] = value;\n  }\n\n  // Explicit overrides always win — even over a scrub.\n  for (const [name, value] of Object.entries(options.overrides ?? {})) {\n    base[name] = value;\n  }\n  return base;\n}\n"]}