@theokit/sdk 4.39.1 → 4.39.3

package/dist/{chunk-LGILIGV3.js → chunk-XKGOIGTJ.js}

@@ -1,4 +1,4 @@
-import { createSemaphore } from './chunk-PI4RO4GR.js';
+import { createSemaphore } from './chunk-F4SQTWVR.js';
 
 // src/internal/runtime/concurrency/map-with-concurrency.ts
 var NEVER_ABORT = new AbortController().signal;
@@ -21,5 +21,5 @@ async function mapWithConcurrency(items, concurrency, fn, options) {
 }
 
 export { mapWithConcurrency };
-//# sourceMappingURL=chunk-LGILIGV3.js.map
-//# sourceMappingURL=chunk-LGILIGV3.js.map
+//# sourceMappingURL=chunk-XKGOIGTJ.js.map
+//# sourceMappingURL=chunk-XKGOIGTJ.js.map

package/dist/{chunk-LGILIGV3.js.map → chunk-XKGOIGTJ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/runtime/concurrency/map-with-concurrency.ts"],"names":[],"mappings":";;;AAcA,IAAM,WAAA,GAA2B,IAAI,eAAA,EAAgB,CAAE,MAAA;AAgBvD,eAAsB,kBAAA,CACpB,KAAA,EACA,WAAA,EACA,EAAA,EACA,OAAA,EACc;AACd,EAAA,MAAM,SAAA,GAAY,gBAAgB,WAAW,CAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,WAAA;AAClC,EAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,IACb,KAAA,CAAM,GAAA,CAAI,OAAO,IAAA,EAAM,KAAA,KAAU;AAC/B,MAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,OAAA,EAAQ;AACxC,MAAA,IAAI;AACF,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,MAAM,OAAO,MAAA,YAAkB,KAAA,GAC3B,OAAO,MAAA,GACP,IAAI,MAAM,6BAA6B,CAAA;AAAA,QAC7C;AACA,QAAA,OAAO,MAAM,EAAA,CAAG,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,MACrC,CAAA,SAAE;AACA,QAAA,OAAA,EAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,GACH;AACF","file":"chunk-LGILIGV3.js","sourcesContent":["/**\n * Ordered, bounded-concurrency parallel map (plan m0-foundation-expose-primitives, M0-2).\n *\n * Runs `fn` over `items` with at most `concurrency` invocations in flight at\n * once, preserving input order in the result array. Fail-fast: rejects with the\n * first error a task throws (matching the in-house `boundedParallel`/`runBatches`\n * clones this consolidates). Backed by the in-house {@link createSemaphore}\n * (ADR D135 — no `p-limit`/`p-map` dependency).\n *\n * @internal — public via `@theokit/sdk/concurrency`\n */\n\nimport { createSemaphore } from \"./async-semaphore.js\";\n\nconst NEVER_ABORT: AbortSignal = new AbortController().signal;\n\n/**\n * Map `fn` over `items` with bounded concurrency, preserving order.\n *\n * @param items - inputs to process\n * @param concurrency - max in-flight invocations (positive integer; validated)\n * @param fn - async mapper; receives the item, its index, and an abort signal\n * @param options.signal - optional abort signal; once aborted, no new `fn`\n *   invocation is started (in-flight ones are not force-cancelled)\n * @returns results in the same order as `items`\n * @throws ConfigurationError when `concurrency` is not a positive integer\n *\n * @example\n *   await mapWithConcurrency([1, 2, 3], 2, async (n) => n * 2); // [2, 4, 6]\n */\nexport async function mapWithConcurrency<T, R>(\n  items: ReadonlyArray<T>,\n  concurrency: number,\n  fn: (item: T, index: number, signal: AbortSignal) => Promise<R>,\n  options?: { signal?: AbortSignal },\n): Promise<R[]> {\n  const semaphore = createSemaphore(concurrency);\n  const signal = options?.signal ?? NEVER_ABORT;\n  return Promise.all(\n    items.map(async (item, index) => {\n      const release = await semaphore.acquire();\n      try {\n        if (signal.aborted) {\n          throw signal.reason instanceof Error\n            ? signal.reason\n            : new Error(\"mapWithConcurrency: aborted\");\n        }\n        return await fn(item, index, signal);\n      } finally {\n        release();\n      }\n    }),\n  );\n}\n"]}
+{"version":3,"sources":["../src/internal/runtime/concurrency/map-with-concurrency.ts"],"names":[],"mappings":";;;AAcA,IAAM,WAAA,GAA2B,IAAI,eAAA,EAAgB,CAAE,MAAA;AAgBvD,eAAsB,kBAAA,CACpB,KAAA,EACA,WAAA,EACA,EAAA,EACA,OAAA,EACc;AACd,EAAA,MAAM,SAAA,GAAY,gBAAgB,WAAW,CAAA;AAC7C,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,WAAA;AAClC,EAAA,OAAO,OAAA,CAAQ,GAAA;AAAA,IACb,KAAA,CAAM,GAAA,CAAI,OAAO,IAAA,EAAM,KAAA,KAAU;AAC/B,MAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,OAAA,EAAQ;AACxC,MAAA,IAAI;AACF,QAAA,IAAI,OAAO,OAAA,EAAS;AAClB,UAAA,MAAM,OAAO,MAAA,YAAkB,KAAA,GAC3B,OAAO,MAAA,GACP,IAAI,MAAM,6BAA6B,CAAA;AAAA,QAC7C;AACA,QAAA,OAAO,MAAM,EAAA,CAAG,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AAAA,MACrC,CAAA,SAAE;AACA,QAAA,OAAA,EAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,GACH;AACF","file":"chunk-XKGOIGTJ.js","sourcesContent":["/**\n * Ordered, bounded-concurrency parallel map (plan m0-foundation-expose-primitives, M0-2).\n *\n * Runs `fn` over `items` with at most `concurrency` invocations in flight at\n * once, preserving input order in the result array. Fail-fast: rejects with the\n * first error a task throws (matching the in-house `boundedParallel`/`runBatches`\n * clones this consolidates). Backed by the in-house {@link createSemaphore}\n * (ADR D135 — no `p-limit`/`p-map` dependency).\n *\n * @internal — public via `@theokit/sdk/concurrency`\n */\n\nimport { createSemaphore } from \"./async-semaphore.js\";\n\nconst NEVER_ABORT: AbortSignal = new AbortController().signal;\n\n/**\n * Map `fn` over `items` with bounded concurrency, preserving order.\n *\n * @param items - inputs to process\n * @param concurrency - max in-flight invocations (positive integer; validated)\n * @param fn - async mapper; receives the item, its index, and an abort signal\n * @param options.signal - optional abort signal; once aborted, no new `fn`\n *   invocation is started (in-flight ones are not force-cancelled)\n * @returns results in the same order as `items`\n * @throws ConfigurationError when `concurrency` is not a positive integer\n *\n * @example\n *   await mapWithConcurrency([1, 2, 3], 2, async (n) => n * 2); // [2, 4, 6]\n */\nexport async function mapWithConcurrency<T, R>(\n  items: ReadonlyArray<T>,\n  concurrency: number,\n  fn: (item: T, index: number, signal: AbortSignal) => Promise<R>,\n  options?: { signal?: AbortSignal },\n): Promise<R[]> {\n  const semaphore = createSemaphore(concurrency);\n  const signal = options?.signal ?? NEVER_ABORT;\n  return Promise.all(\n    items.map(async (item, index) => {\n      const release = await semaphore.acquire();\n      try {\n        if (signal.aborted) {\n          throw signal.reason instanceof Error\n            ? signal.reason\n            : new Error(\"mapWithConcurrency: aborted\");\n        }\n        return await fn(item, index, signal);\n      } finally {\n        release();\n      }\n    }),\n  );\n}\n"]}

package/dist/{chunk-65ONFZWM.js → chunk-XZ7PO2FM.js}

@@ -1,5 +1,5 @@
-import { TheokitAgentError } from './chunk-SG5ZWT6C.js';
-import { diag, redactSecrets } from './chunk-IVSD7L22.js';
+import { TheokitAgentError } from './chunk-VQ33XLC6.js';
+import { diag, redactSecrets } from './chunk-RNCN2TTP.js';
 
 // src/internal/runtime/compression/compression-helpers.ts
 function selectCompressionWindow(messages, preserveLast = 6) {
@@ -153,5 +153,5 @@ function shouldCompact(input) {
 }
 
 export { ABSOLUTE_CONTEXT_WINDOW_CAP, CHECKPOINT_MARKER, CONTEXT_WINDOW_FLOOR, CONTEXT_WINDOW_MARGIN, ContextWindowMarginError, SUMMARY_TEMPLATE, buildCheckpoint, compactTranscript, estimateTokens, filterFromLatestCheckpoint, isContextOverflowError, resolveEffectiveContextWindow, shouldCompact };
-//# sourceMappingURL=chunk-65ONFZWM.js.map
-//# sourceMappingURL=chunk-65ONFZWM.js.map
+//# sourceMappingURL=chunk-XZ7PO2FM.js.map
+//# sourceMappingURL=chunk-XZ7PO2FM.js.map

package/dist/{chunk-65ONFZWM.js.map → chunk-XZ7PO2FM.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/runtime/compression/compression-helpers.ts","../src/compaction.ts"],"names":[],"mappings":";;;;AA0BO,SAAS,uBAAA,CACd,QAAA,EACA,YAAA,GAAe,CAAA,EACO;AACtB,EAAA,IAAI,QAAA,CAAS,UAAU,YAAA,EAAc;AACnC,IAAA,OAAO,EAAE,YAAY,EAAC,EAAG,YAAY,CAAC,GAAG,QAAQ,CAAA,EAAE;AAAA,EACrD;AACA,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,CAAC,YAAY,CAAA;AAAA,IAC3C,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,CAAC,YAAY;AAAA,GAC1C;AACF;;;ACOO,IAAM,iBAAA,GAAoB;AAQ1B,IAAM,gBAAA,GAAmB,CAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA,4CAAA;AAwBhC,SAAS,aAAa,MAAA,EAAsB;AAC1C,EAAA,IAAI,WAAW,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,kBAAkB,qCAAA,EAAuC;AAAA,MACjE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AAGA,SAAS,cAAA,CAAe,SAA8B,MAAA,EAAyB;AAC7E,EAAA,OAAO,QAAQ,IAAA,KAAS,QAAA,IAAY,CAAC,OAAA,CAAQ,OAAA,CAAQ,WAAW,MAAM,CAAA;AACxE;AAcA,SAAS,mBAAA,CACP,UACA,UAAA,EACgE;AAChE,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,aAAa,QAAA,CAAS,MAAA;AAC1B,EAAA,KAAA,IAAS,IAAI,QAAA,CAAS,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAChD,IAAA,GAAA,IAAO,cAAA,CAAe,QAAA,CAAS,CAAC,CAAA,EAAG,WAAW,EAAE,CAAA;AAChD,IAAA,IAAI,GAAA,GAAM,UAAA,IAAc,CAAA,GAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/C,MAAA,UAAA,GAAa,CAAA,GAAI,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA,UAAA,GAAa,CAAA;AAAA,EACf;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,EAAG,MAAA,EAAQ,QAAA,CAAS,KAAA,CAAM,UAAU,CAAA,EAAE;AACnF;AAGA,SAAS,aAAA,CACP,QAAA,EACA,UAAA,EACA,MAAA,EACiB;AACjB,EAAA,MAAM,aAAA,GAAgB,SAAS,MAAA,CAAO,CAAC,MAAM,cAAA,CAAe,CAAA,EAAG,MAAM,CAAC,CAAA;AACtE,EAAA,MAAM,IAAA,GAAO,SAAS,MAAA,CAAO,CAAC,MAAM,CAAC,cAAA,CAAe,CAAA,EAAG,MAAM,CAAC,CAAA;AAC9D,EAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAW,GAAI,uBAAA,CAAwB,MAAM,UAAU,CAAA;AAC3E,EAAA,OAAO,EAAE,aAAA,EAAe,IAAA,EAAM,UAAA,EAAY,QAAQ,UAAA,EAAW;AAC/D;AAyBA,IAAM,cAAA,0BAAwB,gBAAgB,CAAA;AAG9C,eAAe,YAAA,CACb,SAAA,EACA,IAAA,EACA,QAAA,EACA,QAAA,EACsD;AACtD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAA,CAAU,IAAA,EAAM,QAAQ,CAAA;AAAA,EACvC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,CAAC,UAAU,MAAM,GAAA;AAOrB,IAAA,IAAA;AAAA,MACE,CAAA,8DAAA,EAA4D,cAAc,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAC;AAAA;AAAA,KAC7H;AACA,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AASA,eAAsB,iBAAA,CACpB,QAAA,EACA,OAAA,GAAoC,EAAC,EACL;AAChC,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,iBAAA;AACjC,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,MAAM,KAAA,GACJ,QAAQ,UAAA,IAAc,IAAA,GAClB,EAAE,aAAA,EAAe,IAAI,GAAG,mBAAA,CAAoB,UAAU,OAAA,CAAQ,UAAU,GAAE,GAC1E,aAAA,CAAc,UAAU,OAAA,CAAQ,UAAA,IAAc,GAAG,MAAM,CAAA;AAC7D,EAAA,IAAI,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG;AAC3B,IAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AAAA,EACrB;AACA,EAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,IAAA,OAAO,CAAC,GAAG,KAAA,CAAM,aAAA,EAAe,GAAG,MAAM,MAAM,CAAA;AAAA,EACjD;AACA,EAAA,MAAM,QAAA,GAAW,QAAQ,eAAA,IAAmB,gBAAA;AAC5C,EAAA,MAAM,UAAU,MAAM,YAAA;AAAA,IACpB,OAAA,CAAQ,SAAA;AAAA,IACR,KAAA,CAAM,IAAA;AAAA,IACN,QAAA;AAAA,IACA,QAAQ,QAAA,IAAY;AAAA,GACtB;AACA,EAAA,IAAI,YAAY,cAAA,EAAgB;AAC9B,IAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AAAA,EACrB;AACA,EAAA,OAAO,CAAC,GAAG,KAAA,CAAM,eAAe,OAAA,EAAS,GAAG,MAAM,MAAM,CAAA;AAC1D;AAMO,SAAS,eAAA,CACd,KAAA,EACA,MAAA,GAAiB,iBAAA,EACI;AACrB,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,MAAA,IAAU,SAAS,EAAA,CAAA,EAAI;AAC3D;AAkBO,SAAS,0BAAA,CACd,QAAA,EACA,OAAA,GAAmC,EAAC,EACb;AACvB,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,iBAAA;AACjC,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,KAAY,MAAA,GAAS,CAAA,GAAI,CAAA;AAChD,EAAA,KAAA,IAAS,IAAI,QAAA,CAAS,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAChD,IAAA,IAAI,SAAS,CAAC,CAAA,EAAG,OAAA,CAAQ,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3C,MAAA,OAAO,QAAA,CAAS,KAAA,CAAM,CAAA,GAAI,MAAM,CAAA;AAAA,IAClC;AAAA,EACF;AACA,EAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AACrB;AAQO,SAAS,uBAAuB,GAAA,EAAuB;AAC5D,EAAA,OACE,eAAe,iBAAA,KACd,GAAA,CAAI,SAAS,kBAAA,IAAsB,GAAA,CAAI,UAAU,IAAA,KAAS,kBAAA,CAAA;AAE/D;AAOO,IAAM,wBAAA,GAAN,cAAuC,iBAAA,CAAkB;AAAA,EAC9D,YAAqB,MAAA,EAAgB;AACnC,IAAA,KAAA;AAAA,MACE,CAAA,6CAAA,EAAgD,MAAA,CAAO,MAAM,CAAC,CAAA,sFAAA,CAAA;AAAA,MAE9D,EAAE,MAAM,+BAAA;AAAgC,KAC1C;AALmB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAMrB;AAAA,EANqB,MAAA;AAOvB;AAUO,IAAM,qBAAA,GAAwB;AAgB9B,IAAM,oBAAA,GAAuB;AA6D7B,IAAM,2BAAA,GAA8B;AAEpC,SAAS,8BACd,KAAA,EACwB;AACxB,EAAA,IAAI,EAAE,KAAA,CAAM,MAAA,GAAS,CAAA,CAAA,IAAM,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3C,IAAA,MAAM,IAAI,wBAAA,CAAyB,KAAA,CAAM,MAAM,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,aAAa,CAAC,GAAA,KAAwB,KAAK,KAAA,CAAM,GAAA,GAAM,MAAM,MAAM,CAAA;AAEzE,EAAA,IAAI,KAAA,CAAM,aAAa,MAAA,EAAW;AAYhC,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,IAAW,2BAAA;AAC7B,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,GAAW,GAAA;AACjC,IAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,CAAW,OAAA,GAAU,GAAA,GAAM,MAAM,QAAQ,CAAA,EAAG,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,EAC3F;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,MAAA,EAAW;AAC/B,IAAA,OAAO,EAAE,QAAQ,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA,EAAG,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,KAAA,EAAM;AAAA,EAChF;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,CAAW,KAAA,CAAM,KAAA,IAAS,CAAC,CAAA,EAAG,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAS,KAAA,EAAM;AACpF;AAyBO,SAAS,eAAe,IAAA,EAAsB;AACnD,EAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,MAAA,GAAS,CAAC,CAAA;AAClC;AAUO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,MAAM,SAAA,IAAa,KAAA,CAAM,gBAAgB,KAAA,CAAM,MAAA,IAAU,MAAM,SAAA,IAAa,CAAA,CAAA;AACrF","file":"chunk-65ONFZWM.js","sourcesContent":["/**\n * Compression helpers (T2.3, ADR D92).\n *\n * Scaffold for future compression LLM integration:\n *   - `selectCompressionWindow` — splits messages into compress/preserve halves\n *   - `assertCompressionReduced` — 10% reduction floor to detect \"compression placebo\"\n *\n * The compression LLM call itself is out of scope for this plan (requires\n * an auxiliary-model ADR). These helpers are used by `Agent.send` when a\n * future iteration adds compression.\n *\n * @internal\n */\n\nexport interface CompressionWindow<M> {\n  toCompress: M[];\n  toPreserve: M[];\n}\n\n/**\n * Split `messages` into the half to compress (older) and the half to\n * preserve verbatim (recent). When `messages.length <= preserveLast`,\n * everything is preserved.\n *\n * @internal\n */\nexport function selectCompressionWindow<M>(\n  messages: readonly M[],\n  preserveLast = 6,\n): CompressionWindow<M> {\n  if (messages.length <= preserveLast) {\n    return { toCompress: [], toPreserve: [...messages] };\n  }\n  return {\n    toCompress: messages.slice(0, -preserveLast),\n    toPreserve: messages.slice(-preserveLast),\n  };\n}\n\nexport interface CompressionCheck {\n  reduced: boolean;\n  reductionPct: number;\n  reason?: string;\n}\n\n/**\n * Check that compression actually reduced token count by at least `minPct`\n * (default 10%). Returns `{ reduced: false }` for spirals-in-formation\n * (compression LLM outputs that grow or barely shrink).\n *\n * @internal\n */\nexport function assertCompressionReduced(\n  before: number,\n  after: number,\n  minPct = 10,\n): CompressionCheck {\n  if (before <= 0) {\n    return { reduced: false, reductionPct: 0, reason: \"before count was zero\" };\n  }\n  const reductionPct = ((before - after) / before) * 100;\n  if (reductionPct >= minPct) {\n    return { reduced: true, reductionPct };\n  }\n  return {\n    reduced: false,\n    reductionPct,\n    reason: `compression reduced ${reductionPct.toFixed(1)}% (< ${minPct}% min). Spiral likely.`,\n  };\n}\n","/**\n * Public compaction / context-management helpers (M2-1, extended V3-3).\n *\n * Promotes the SDK's compaction capability to a public surface so consumers can\n * compact a transcript, mark/filter conversation checkpoints, and detect\n * context-overflow — without reaching into `internal/`.\n *\n * Two recent-window modes (V3-3):\n *  - `keepRecent` (turn-count, default) — keeps the last N turns verbatim and\n *    always preserves leading system PROMPTS; reuses the internal\n *    `selectCompressionWindow` (no second algorithm).\n *  - `keepTokens` (token-budget) — keeps the trailing turns whose accumulated\n *    `estimateTokens` fits the budget (theocode `splitTranscript` semantics). In\n *    this mode leading system prompts are NOT special-cased (D6).\n *\n * Summarization is delegated to a caller-supplied callback (which receives the\n * older window + the summary template). With `failSafe`, a thrown summarizer\n * returns the ORIGINAL transcript + a structured warn (compaction is an\n * optimization, never a cause of data loss); without it, the error propagates.\n *\n * Public from the `@theokit/sdk/compaction` sub-path.\n */\n\nimport { TheokitAgentError } from \"./errors.js\";\nimport { diag } from \"./internal/diagnostics.js\";\nimport { selectCompressionWindow } from \"./internal/runtime/compression/compression-helpers.js\";\nimport { redactSecrets } from \"./internal/security/redact.js\";\n\n/**\n * Minimal message shape for compaction/compression input. THE canonical public origin (leaf type —\n * rollup-plugin-dts cannot re-export types from internal modules into entry bundles; M42 lesson).\n *\n * @public\n */\nexport interface CompressibleMessage {\n  role: \"user\" | \"assistant\" | \"system\";\n  content: string;\n}\n\n/**\n * Sentinel prefix marking a conversation checkpoint turn. A visible, structured,\n * prose-unlikely token (no invisible/control bytes — safe to persist and to read\n * in source). Only {@link buildCheckpoint} should produce content beginning with it.\n */\nexport const CHECKPOINT_MARKER = \"[[theokit:checkpoint]] \";\n\n/**\n * The 7-section summary template handed to the `summarize` callback (theocode\n * parity shape). Every header is always present so the summarizer cannot silently\n * drop a category; the model is told to preserve file paths, commands, and error\n * text verbatim. Override per-call via {@link CompactTranscriptOptions.summaryTemplate}.\n */\nexport const SUMMARY_TEMPLATE = `Summarize the conversation so far into these sections (keep every header even if empty):\n\n## Goal\nWhat the user is ultimately trying to achieve.\n\n## Constraints\nHard requirements, conventions, and rules stated.\n\n## Progress\nWhat has been done so far.\n\n## Decisions\nChoices made and their rationale.\n\n## Next\nThe immediate next steps.\n\n## Critical\nAnything that MUST NOT be forgotten (preserve verbatim: error messages, exact values).\n\n## Files\nFile paths touched or referenced (verbatim).`;\n\n/** Reject an empty marker — it would match every turn via `startsWith(\"\")` (EC-3). */\nfunction assertMarker(marker: string): void {\n  if (marker === \"\") {\n    throw new TheokitAgentError(\"compaction marker must be non-empty\", {\n      code: \"invalid_argument\",\n    });\n  }\n}\n\n/** True for a real system prompt — a `system` turn that is NOT a checkpoint marker. */\nfunction isSystemPrompt(message: CompressibleMessage, marker: string): boolean {\n  return message.role === \"system\" && !message.content.startsWith(marker);\n}\n\n/** Carried split: leading system prompts (preserved), the older window, the verbatim tail. */\ninterface TranscriptSplit {\n  systemPrompts: CompressibleMessage[];\n  head: CompressibleMessage[];\n  recent: CompressibleMessage[];\n}\n\n/**\n * Token-budget split (theocode `splitTranscript`): walk from the END accumulating\n * `estimateTokens` until `keepTokens` is exceeded; everything older is the head.\n * Always keeps ≥ 1 recent turn. No system-prompt special-casing (D6).\n */\nfunction selectByTokenBudget(\n  messages: CompressibleMessage[],\n  keepTokens: number,\n): { head: CompressibleMessage[]; recent: CompressibleMessage[] } {\n  let acc = 0;\n  let splitIndex = messages.length;\n  for (let i = messages.length - 1; i >= 0; i -= 1) {\n    acc += estimateTokens(messages[i]?.content ?? \"\");\n    if (acc > keepTokens && i < messages.length - 1) {\n      splitIndex = i + 1;\n      break;\n    }\n    splitIndex = i;\n  }\n  return { head: messages.slice(0, splitIndex), recent: messages.slice(splitIndex) };\n}\n\n/** Turn-count split (M2): preserve leading system prompts; window the rest by `keepRecent`. */\nfunction splitByRecent(\n  messages: CompressibleMessage[],\n  keepRecent: number,\n  marker: string,\n): TranscriptSplit {\n  const systemPrompts = messages.filter((m) => isSystemPrompt(m, marker));\n  const rest = messages.filter((m) => !isSystemPrompt(m, marker));\n  const { toCompress, toPreserve } = selectCompressionWindow(rest, keepRecent);\n  return { systemPrompts, head: toCompress, recent: toPreserve };\n}\n\n/** Options for {@link compactTranscript}. */\nexport interface CompactTranscriptOptions {\n  /** Trailing turns preserved verbatim by COUNT (default 6). Ignored when `keepTokens` is set. */\n  keepRecent?: number;\n  /**\n   * Trailing turns preserved verbatim by TOKEN BUDGET (theocode mode). When set,\n   * takes precedence over `keepRecent` and disables system-prompt preservation (D6).\n   */\n  keepTokens?: number;\n  /** Checkpoint marker (default {@link CHECKPOINT_MARKER}). Must be non-empty. */\n  marker?: string;\n  /** Summary template passed to `summarize` (default {@link SUMMARY_TEMPLATE}). */\n  summaryTemplate?: string;\n  /** Summarize the older window into one turn; if omitted, the older window is dropped. */\n  summarize?: (older: CompressibleMessage[], template: string) => Promise<CompressibleMessage>;\n  /**\n   * When true, a thrown `summarize` returns the ORIGINAL transcript + a structured\n   * warn (compaction never loses data). Default false: the error propagates.\n   */\n  failSafe?: boolean;\n}\n\n/** Sentinel returned by {@link runSummarize} when fail-safe swallowed a throw. */\nconst FAILSAFE_ABORT = Symbol(\"failsafe-abort\");\n\n/** Run the summarizer; on throw, either propagate or (fail-safe) warn + signal abort. */\nasync function runSummarize(\n  summarize: NonNullable<CompactTranscriptOptions[\"summarize\"]>,\n  head: CompressibleMessage[],\n  template: string,\n  failSafe: boolean,\n): Promise<CompressibleMessage | typeof FAILSAFE_ABORT> {\n  try {\n    return await summarize(head, template);\n  } catch (err) {\n    if (!failSafe) throw err;\n    // Unbreakable Rule 8 — never fail silently. The breadcrumb points at the root\n    // cause when a summarizer fails every turn and context grows unchecked. The\n    // summarizer is caller-supplied, so its error text is routed through\n    // `redactSecrets` (ADR D68 — no unredacted output sink in src/).\n    // theokit#147 — through the interceptable channel. A summarizer failing every turn is exactly\n    // the breadcrumb a TUI host wants in its own panel, not smeared across its alternate screen.\n    diag(\n      `[compaction] summarizer failed — proceeding uncompacted: ${redactSecrets(err instanceof Error ? err.message : String(err))}\\n`,\n    );\n    return FAILSAFE_ABORT;\n  }\n}\n\n/**\n * Compact a transcript. In `keepRecent` mode (default) the last `keepRecent` turns\n * are kept verbatim and leading system PROMPTS preserved; in `keepTokens` mode the\n * trailing turns within the token budget are kept (no system special-casing, D6).\n * The older window is summarized (via `summarize`, receiving the template) or\n * dropped. Never mutates the input.\n */\nexport async function compactTranscript(\n  messages: CompressibleMessage[],\n  options: CompactTranscriptOptions = {},\n): Promise<CompressibleMessage[]> {\n  const marker = options.marker ?? CHECKPOINT_MARKER;\n  assertMarker(marker);\n  const split =\n    options.keepTokens != null\n      ? { systemPrompts: [], ...selectByTokenBudget(messages, options.keepTokens) }\n      : splitByRecent(messages, options.keepRecent ?? 6, marker);\n  if (split.head.length === 0) {\n    return [...messages];\n  }\n  if (!options.summarize) {\n    return [...split.systemPrompts, ...split.recent];\n  }\n  const template = options.summaryTemplate ?? SUMMARY_TEMPLATE;\n  const summary = await runSummarize(\n    options.summarize,\n    split.head,\n    template,\n    options.failSafe ?? false,\n  );\n  if (summary === FAILSAFE_ABORT) {\n    return [...messages];\n  }\n  return [...split.systemPrompts, summary, ...split.recent];\n}\n\n/**\n * Build a checkpoint marker turn (a `system` turn whose content starts with\n * `marker`, default {@link CHECKPOINT_MARKER}). `marker` must be non-empty.\n */\nexport function buildCheckpoint(\n  label?: string,\n  marker: string = CHECKPOINT_MARKER,\n): CompressibleMessage {\n  assertMarker(marker);\n  return { role: \"system\", content: marker + (label ?? \"\") };\n}\n\n/** Options for {@link filterFromLatestCheckpoint}. */\nexport interface FilterCheckpointOptions {\n  /** Marker to scan for (default {@link CHECKPOINT_MARKER}). */\n  marker?: string;\n  /**\n   * `'after'` (default, M2) returns turns AFTER the latest marker (exclusive);\n   * `'from'` (theocode) returns turns FROM the latest marker (inclusive).\n   */\n  include?: \"after\" | \"from\";\n}\n\n/**\n * Return the turns relative to the most recent checkpoint marker (all turns if\n * none). `include: 'after'` (default) excludes the checkpoint; `'from'` includes\n * it (the summary stands in for the pruned head). Never mutates the input.\n */\nexport function filterFromLatestCheckpoint(\n  messages: CompressibleMessage[],\n  options: FilterCheckpointOptions = {},\n): CompressibleMessage[] {\n  const marker = options.marker ?? CHECKPOINT_MARKER;\n  const offset = options.include === \"from\" ? 0 : 1;\n  for (let i = messages.length - 1; i >= 0; i -= 1) {\n    if (messages[i]?.content.startsWith(marker)) {\n      return messages.slice(i + offset);\n    }\n  }\n  return [...messages];\n}\n\n/**\n * True iff `err` is a {@link TheokitAgentError} (or subclass) reporting a\n * context-window-exceeded condition (the typed `context_too_long` code). Reads\n * both `code` (set by provider mappers) and `metadata.code` (the preferred field)\n * — never a brittle message regex.\n */\nexport function isContextOverflowError(err: unknown): boolean {\n  return (\n    err instanceof TheokitAgentError &&\n    (err.code === \"context_too_long\" || err.metadata?.code === \"context_too_long\")\n  );\n}\n\n/**\n * M77 — the margin is outside `(0, 1]`. Typed, because a margin > 1 would GROW the assumed window,\n * which is the unsafe direction: `shouldCompact` is monotonically decreasing in `contextWindow`, so\n * overestimating it makes the trigger fire too late and the context overflow.\n */\nexport class ContextWindowMarginError extends TheokitAgentError {\n  constructor(readonly margin: number) {\n    super(\n      `context-window margin must be in (0, 1], got ${String(margin)}. ` +\n        `A margin above 1 grows the assumed window and delays compaction past the real limit.`,\n      { code: \"invalid_context_window_margin\" },\n    );\n  }\n}\n\n/**\n * M77 — default safety margin on the context window.\n *\n * `0.95` is not a guess: it is the single reference's value. Codex ships\n * `effective_context_window_percent: 95` (`models-manager/src/model_info.rs:158`) and never budgets\n * against 100% of a window. Being MULTIPLICATIVE, it stays conservative at any window size, which a\n * fixed subtraction would not.\n */\nexport const CONTEXT_WINDOW_MARGIN = 0.95;\n\n/**\n * M77 — the floor used ONLY when neither the catalog nor the caller knows the window.\n *\n * Honest about its own weakness. This number has **one** source (the M77 milestone text); the search\n * for a second one failed, because the reference has no fallback at all — Codex returns `Option` and\n * its callers early-return (`core/src/session/turn_context.rs:213`, `core/src/compact_remote.rs:374`).\n *\n * It is conservative only UPWARD. For a model whose real window is larger, budgeting against 128k\n * compacts early — wasteful but safe. For a model whose real window is SMALLER (an 8k or 32k model\n * absent from the catalog), it compacts too late and the context still overflows. That residual risk\n * is real and is why {@link resolveEffectiveContextWindow} never lets this floor compete with a known\n * catalog value, and why the `compaction_fallback` event exists: a surface can show that the budget is\n * a guess instead of the user finding out when the provider rejects the request.\n */\nexport const CONTEXT_WINDOW_FLOOR = 128_000;\n\n/** Where the effective window came from — carried into the M77 structured event. */\nexport type ContextWindowSource = \"override\" | \"catalog\" | \"fallback\";\n\n/** Input to {@link resolveEffectiveContextWindow}. */\nexport interface EffectiveContextWindowInput {\n  /** Caller-supplied window, in tokens. Clamped by `catalog` when both are present. */\n  readonly override?: number | undefined;\n  /** The model's window from the catalog, in tokens. Absent when the model is unknown. */\n  readonly catalog?: number | undefined;\n  /** Safety margin in `(0, 1]`. Codex uses 0.95 (`model_info.rs:158`). */\n  readonly margin: number;\n  /** Conservative floor used ONLY when neither `override` nor `catalog` is available. */\n  readonly floor?: number | undefined;\n}\n\n/** Result of {@link resolveEffectiveContextWindow}. */\nexport interface EffectiveContextWindow {\n  /** The window to budget against, after clamp and margin. */\n  readonly window: number;\n  /** Which input won — `\"fallback\"` means neither override nor catalog was available. */\n  readonly source: ContextWindowSource;\n  /** `true` when an `override` above the catalog window was clamped down to it. */\n  readonly clamped: boolean;\n}\n\n/**\n * Resolve the window to budget against — the fail-SAFE replacement for reading the catalog directly.\n *\n * Today `post-run-lifecycle.ts` reads `getCatalogModelInfo(model)?.limit?.context` and, when that is\n * `undefined`, auto-compaction simply never fires. That is fail-OPEN: the context grows until the\n * provider rejects the request. (The comment there calls it \"fail-safe\" — M77 corrects it.)\n *\n * Three techniques, two of them borrowed from the single reference:\n *\n *  1. **Override, CLAMPED by the catalog** — Codex `models-manager/src/model_info.rs:26-31` lets\n *     config override the window but limits it with `context_window.min(max_context_window)`.\n *     Without the clamp, declaring 999k on a 200k model reopens the overflow through another door.\n *  2. **Multiplicative margin** — Codex `model_info.rs:158` (`effective_context_window_percent: 95`)\n *     never budgets against 100% of the window. Being multiplicative, it is conservative for ANY\n *     window size.\n *  3. **Floor, only when nothing is known** — deliberately NOT a blanket default. A fixed floor is\n *     conservative only upward: applied to a small model it would inflate the assumed window and\n *     reproduce the very fail-open this function exists to close. Hence the floor never competes\n *     with a known catalog value.\n *\n * Pure — no catalog lookup, no I/O. The caller supplies the numbers, mirroring `shouldCompact`.\n */\n/**\n * Absolute cap on a declared context window, applied when no catalog entry exists to compare against.\n *\n * **10M**, not 2M. The first version used 2M on the rationale that it sat \"comfortably above the\n * largest published window\" — adversarial review measured the opposite: Llama 4 Scout publishes\n * **10M**, and it arrives precisely via OpenRouter, the provider **without** a catalog, which is the\n * case this cap exists to cover. The user would have silently lost 80% of the declared window.\n *\n * The cap still serves what motivates it — one extra zero on 400k gives 4M, which passes; two zeros\n * give 40M, which does not. A limit that rejects legitimate configuration is worse than no limit,\n * because failing OPEN is visible when it happens and silently losing 80% is not.\n */\nexport const ABSOLUTE_CONTEXT_WINDOW_CAP = 10_000_000;\n\nexport function resolveEffectiveContextWindow(\n  input: EffectiveContextWindowInput,\n): EffectiveContextWindow {\n  if (!(input.margin > 0) || input.margin > 1) {\n    throw new ContextWindowMarginError(input.margin);\n  }\n\n  const withMargin = (raw: number): number => Math.floor(raw * input.margin);\n\n  if (input.override !== undefined) {\n    // The catalog is the preferred cap; without it the ABSOLUTE cap applies.\n    //\n    // M95 (adversarial review of M94) — the previous version clamped **only** when a catalog entry\n    // existed, and the whole reason the `contextWindow` key exists is the model that has NO entry\n    // (OpenRouter has zero). So the clamp was missing in exactly the case that justifies the\n    // feature, while the documentation — including an already-published CHANGELOG — stated without\n    // qualification that \"declaring 10M does not blow past the provider\".\n    //\n    // The concrete scenario is one extra zero: `context_window = 4000000`. The only guard was a\n    // `.positive().int()`, which sets no upper bound. The agent would never compact until the\n    // provider refused the turn — the silent fail-OPEN that M77 exists to prevent.\n    const cap = input.catalog ?? ABSOLUTE_CONTEXT_WINDOW_CAP;\n    const clamped = input.override > cap;\n    return { window: withMargin(clamped ? cap : input.override), source: \"override\", clamped };\n  }\n\n  if (input.catalog !== undefined) {\n    return { window: withMargin(input.catalog), source: \"catalog\", clamped: false };\n  }\n\n  return { window: withMargin(input.floor ?? 0), source: \"fallback\", clamped: false };\n}\n\n/** Input to {@link shouldCompact}: an estimate, the model's window, and reserved headroom. */\nexport interface ShouldCompactInput {\n  /** Estimated token count of the next request (e.g. from {@link estimateTokens}). */\n  readonly estimated: number;\n  /** The model's total context window, in tokens. */\n  readonly contextWindow: number;\n  /** Tokens to reserve as headroom (output + safety margin). */\n  readonly buffer: number;\n  /**\n   * Tokens reserved for the model's response generation, SEPARATE from `buffer`.\n   * Default 0 — omitting it preserves the legacy\n   * `estimated >= contextWindow - buffer` result.\n   */\n  readonly maxOutput?: number;\n}\n\n/**\n * Tokenizer-free token estimate via the conventional ~4-chars-per-token\n * heuristic: `ceil(text.length / 4)`. `\"\"` → 0; any non-empty text → ≥ 1.\n * A cheap PRE-CALL gate for {@link shouldCompact} — NOT exact tokenization\n * (a consumer needing exactness supplies their own tokenizer). Uses UTF-16\n * `.length` (code units), so multibyte text is approximate.\n */\nexport function estimateTokens(text: string): number {\n  return Math.ceil(text.length / 4);\n}\n\n/**\n * Decide BEFORE sending whether to compact: `true` when the `estimated` token\n * count leaves less than `buffer` headroom in the `contextWindow`\n * (`estimated >= contextWindow - buffer`). A `buffer >= contextWindow`\n * (non-positive threshold) always returns `true`. Pure — the caller supplies\n * the window (e.g. from `resolveModelCapabilities`), keeping this decoupled\n * from the per-model catalog.\n */\nexport function shouldCompact(input: ShouldCompactInput): boolean {\n  return input.estimated >= input.contextWindow - input.buffer - (input.maxOutput ?? 0);\n}\n"]}
+{"version":3,"sources":["../src/internal/runtime/compression/compression-helpers.ts","../src/compaction.ts"],"names":[],"mappings":";;;;AA0BO,SAAS,uBAAA,CACd,QAAA,EACA,YAAA,GAAe,CAAA,EACO;AACtB,EAAA,IAAI,QAAA,CAAS,UAAU,YAAA,EAAc;AACnC,IAAA,OAAO,EAAE,YAAY,EAAC,EAAG,YAAY,CAAC,GAAG,QAAQ,CAAA,EAAE;AAAA,EACrD;AACA,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,CAAC,YAAY,CAAA;AAAA,IAC3C,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,CAAC,YAAY;AAAA,GAC1C;AACF;;;ACOO,IAAM,iBAAA,GAAoB;AAQ1B,IAAM,gBAAA,GAAmB,CAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA,4CAAA;AAwBhC,SAAS,aAAa,MAAA,EAAsB;AAC1C,EAAA,IAAI,WAAW,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,kBAAkB,qCAAA,EAAuC;AAAA,MACjE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AAGA,SAAS,cAAA,CAAe,SAA8B,MAAA,EAAyB;AAC7E,EAAA,OAAO,QAAQ,IAAA,KAAS,QAAA,IAAY,CAAC,OAAA,CAAQ,OAAA,CAAQ,WAAW,MAAM,CAAA;AACxE;AAcA,SAAS,mBAAA,CACP,UACA,UAAA,EACgE;AAChE,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,aAAa,QAAA,CAAS,MAAA;AAC1B,EAAA,KAAA,IAAS,IAAI,QAAA,CAAS,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAChD,IAAA,GAAA,IAAO,cAAA,CAAe,QAAA,CAAS,CAAC,CAAA,EAAG,WAAW,EAAE,CAAA;AAChD,IAAA,IAAI,GAAA,GAAM,UAAA,IAAc,CAAA,GAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/C,MAAA,UAAA,GAAa,CAAA,GAAI,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA,UAAA,GAAa,CAAA;AAAA,EACf;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,EAAG,MAAA,EAAQ,QAAA,CAAS,KAAA,CAAM,UAAU,CAAA,EAAE;AACnF;AAGA,SAAS,aAAA,CACP,QAAA,EACA,UAAA,EACA,MAAA,EACiB;AACjB,EAAA,MAAM,aAAA,GAAgB,SAAS,MAAA,CAAO,CAAC,MAAM,cAAA,CAAe,CAAA,EAAG,MAAM,CAAC,CAAA;AACtE,EAAA,MAAM,IAAA,GAAO,SAAS,MAAA,CAAO,CAAC,MAAM,CAAC,cAAA,CAAe,CAAA,EAAG,MAAM,CAAC,CAAA;AAC9D,EAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAW,GAAI,uBAAA,CAAwB,MAAM,UAAU,CAAA;AAC3E,EAAA,OAAO,EAAE,aAAA,EAAe,IAAA,EAAM,UAAA,EAAY,QAAQ,UAAA,EAAW;AAC/D;AAyBA,IAAM,cAAA,0BAAwB,gBAAgB,CAAA;AAG9C,eAAe,YAAA,CACb,SAAA,EACA,IAAA,EACA,QAAA,EACA,QAAA,EACsD;AACtD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAA,CAAU,IAAA,EAAM,QAAQ,CAAA;AAAA,EACvC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,CAAC,UAAU,MAAM,GAAA;AAOrB,IAAA,IAAA;AAAA,MACE,CAAA,8DAAA,EAA4D,cAAc,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAC;AAAA;AAAA,KAC7H;AACA,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AASA,eAAsB,iBAAA,CACpB,QAAA,EACA,OAAA,GAAoC,EAAC,EACL;AAChC,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,iBAAA;AACjC,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,MAAM,KAAA,GACJ,QAAQ,UAAA,IAAc,IAAA,GAClB,EAAE,aAAA,EAAe,IAAI,GAAG,mBAAA,CAAoB,UAAU,OAAA,CAAQ,UAAU,GAAE,GAC1E,aAAA,CAAc,UAAU,OAAA,CAAQ,UAAA,IAAc,GAAG,MAAM,CAAA;AAC7D,EAAA,IAAI,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG;AAC3B,IAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AAAA,EACrB;AACA,EAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,IAAA,OAAO,CAAC,GAAG,KAAA,CAAM,aAAA,EAAe,GAAG,MAAM,MAAM,CAAA;AAAA,EACjD;AACA,EAAA,MAAM,QAAA,GAAW,QAAQ,eAAA,IAAmB,gBAAA;AAC5C,EAAA,MAAM,UAAU,MAAM,YAAA;AAAA,IACpB,OAAA,CAAQ,SAAA;AAAA,IACR,KAAA,CAAM,IAAA;AAAA,IACN,QAAA;AAAA,IACA,QAAQ,QAAA,IAAY;AAAA,GACtB;AACA,EAAA,IAAI,YAAY,cAAA,EAAgB;AAC9B,IAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AAAA,EACrB;AACA,EAAA,OAAO,CAAC,GAAG,KAAA,CAAM,eAAe,OAAA,EAAS,GAAG,MAAM,MAAM,CAAA;AAC1D;AAMO,SAAS,eAAA,CACd,KAAA,EACA,MAAA,GAAiB,iBAAA,EACI;AACrB,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,MAAA,IAAU,SAAS,EAAA,CAAA,EAAI;AAC3D;AAkBO,SAAS,0BAAA,CACd,QAAA,EACA,OAAA,GAAmC,EAAC,EACb;AACvB,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,iBAAA;AACjC,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,KAAY,MAAA,GAAS,CAAA,GAAI,CAAA;AAChD,EAAA,KAAA,IAAS,IAAI,QAAA,CAAS,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAChD,IAAA,IAAI,SAAS,CAAC,CAAA,EAAG,OAAA,CAAQ,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3C,MAAA,OAAO,QAAA,CAAS,KAAA,CAAM,CAAA,GAAI,MAAM,CAAA;AAAA,IAClC;AAAA,EACF;AACA,EAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AACrB;AAQO,SAAS,uBAAuB,GAAA,EAAuB;AAC5D,EAAA,OACE,eAAe,iBAAA,KACd,GAAA,CAAI,SAAS,kBAAA,IAAsB,GAAA,CAAI,UAAU,IAAA,KAAS,kBAAA,CAAA;AAE/D;AAOO,IAAM,wBAAA,GAAN,cAAuC,iBAAA,CAAkB;AAAA,EAC9D,YAAqB,MAAA,EAAgB;AACnC,IAAA,KAAA;AAAA,MACE,CAAA,6CAAA,EAAgD,MAAA,CAAO,MAAM,CAAC,CAAA,sFAAA,CAAA;AAAA,MAE9D,EAAE,MAAM,+BAAA;AAAgC,KAC1C;AALmB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAMrB;AAAA,EANqB,MAAA;AAOvB;AAUO,IAAM,qBAAA,GAAwB;AAgB9B,IAAM,oBAAA,GAAuB;AA6D7B,IAAM,2BAAA,GAA8B;AAEpC,SAAS,8BACd,KAAA,EACwB;AACxB,EAAA,IAAI,EAAE,KAAA,CAAM,MAAA,GAAS,CAAA,CAAA,IAAM,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3C,IAAA,MAAM,IAAI,wBAAA,CAAyB,KAAA,CAAM,MAAM,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,aAAa,CAAC,GAAA,KAAwB,KAAK,KAAA,CAAM,GAAA,GAAM,MAAM,MAAM,CAAA;AAEzE,EAAA,IAAI,KAAA,CAAM,aAAa,MAAA,EAAW;AAYhC,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,IAAW,2BAAA;AAC7B,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,GAAW,GAAA;AACjC,IAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,CAAW,OAAA,GAAU,GAAA,GAAM,MAAM,QAAQ,CAAA,EAAG,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,EAC3F;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,MAAA,EAAW;AAC/B,IAAA,OAAO,EAAE,QAAQ,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA,EAAG,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,KAAA,EAAM;AAAA,EAChF;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,CAAW,KAAA,CAAM,KAAA,IAAS,CAAC,CAAA,EAAG,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAS,KAAA,EAAM;AACpF;AAyBO,SAAS,eAAe,IAAA,EAAsB;AACnD,EAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,MAAA,GAAS,CAAC,CAAA;AAClC;AAUO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,MAAM,SAAA,IAAa,KAAA,CAAM,gBAAgB,KAAA,CAAM,MAAA,IAAU,MAAM,SAAA,IAAa,CAAA,CAAA;AACrF","file":"chunk-XZ7PO2FM.js","sourcesContent":["/**\n * Compression helpers (T2.3, ADR D92).\n *\n * Scaffold for future compression LLM integration:\n *   - `selectCompressionWindow` — splits messages into compress/preserve halves\n *   - `assertCompressionReduced` — 10% reduction floor to detect \"compression placebo\"\n *\n * The compression LLM call itself is out of scope for this plan (requires\n * an auxiliary-model ADR). These helpers are used by `Agent.send` when a\n * future iteration adds compression.\n *\n * @internal\n */\n\nexport interface CompressionWindow<M> {\n  toCompress: M[];\n  toPreserve: M[];\n}\n\n/**\n * Split `messages` into the half to compress (older) and the half to\n * preserve verbatim (recent). When `messages.length <= preserveLast`,\n * everything is preserved.\n *\n * @internal\n */\nexport function selectCompressionWindow<M>(\n  messages: readonly M[],\n  preserveLast = 6,\n): CompressionWindow<M> {\n  if (messages.length <= preserveLast) {\n    return { toCompress: [], toPreserve: [...messages] };\n  }\n  return {\n    toCompress: messages.slice(0, -preserveLast),\n    toPreserve: messages.slice(-preserveLast),\n  };\n}\n\nexport interface CompressionCheck {\n  reduced: boolean;\n  reductionPct: number;\n  reason?: string;\n}\n\n/**\n * Check that compression actually reduced token count by at least `minPct`\n * (default 10%). Returns `{ reduced: false }` for spirals-in-formation\n * (compression LLM outputs that grow or barely shrink).\n *\n * @internal\n */\nexport function assertCompressionReduced(\n  before: number,\n  after: number,\n  minPct = 10,\n): CompressionCheck {\n  if (before <= 0) {\n    return { reduced: false, reductionPct: 0, reason: \"before count was zero\" };\n  }\n  const reductionPct = ((before - after) / before) * 100;\n  if (reductionPct >= minPct) {\n    return { reduced: true, reductionPct };\n  }\n  return {\n    reduced: false,\n    reductionPct,\n    reason: `compression reduced ${reductionPct.toFixed(1)}% (< ${minPct}% min). Spiral likely.`,\n  };\n}\n","/**\n * Public compaction / context-management helpers (M2-1, extended V3-3).\n *\n * Promotes the SDK's compaction capability to a public surface so consumers can\n * compact a transcript, mark/filter conversation checkpoints, and detect\n * context-overflow — without reaching into `internal/`.\n *\n * Two recent-window modes (V3-3):\n *  - `keepRecent` (turn-count, default) — keeps the last N turns verbatim and\n *    always preserves leading system PROMPTS; reuses the internal\n *    `selectCompressionWindow` (no second algorithm).\n *  - `keepTokens` (token-budget) — keeps the trailing turns whose accumulated\n *    `estimateTokens` fits the budget (theocode `splitTranscript` semantics). In\n *    this mode leading system prompts are NOT special-cased (D6).\n *\n * Summarization is delegated to a caller-supplied callback (which receives the\n * older window + the summary template). With `failSafe`, a thrown summarizer\n * returns the ORIGINAL transcript + a structured warn (compaction is an\n * optimization, never a cause of data loss); without it, the error propagates.\n *\n * Public from the `@theokit/sdk/compaction` sub-path.\n */\n\nimport { TheokitAgentError } from \"./errors.js\";\nimport { diag } from \"./internal/diagnostics.js\";\nimport { selectCompressionWindow } from \"./internal/runtime/compression/compression-helpers.js\";\nimport { redactSecrets } from \"./internal/security/redact.js\";\n\n/**\n * Minimal message shape for compaction/compression input. THE canonical public origin (leaf type —\n * rollup-plugin-dts cannot re-export types from internal modules into entry bundles; M42 lesson).\n *\n * @public\n */\nexport interface CompressibleMessage {\n  role: \"user\" | \"assistant\" | \"system\";\n  content: string;\n}\n\n/**\n * Sentinel prefix marking a conversation checkpoint turn. A visible, structured,\n * prose-unlikely token (no invisible/control bytes — safe to persist and to read\n * in source). Only {@link buildCheckpoint} should produce content beginning with it.\n */\nexport const CHECKPOINT_MARKER = \"[[theokit:checkpoint]] \";\n\n/**\n * The 7-section summary template handed to the `summarize` callback (theocode\n * parity shape). Every header is always present so the summarizer cannot silently\n * drop a category; the model is told to preserve file paths, commands, and error\n * text verbatim. Override per-call via {@link CompactTranscriptOptions.summaryTemplate}.\n */\nexport const SUMMARY_TEMPLATE = `Summarize the conversation so far into these sections (keep every header even if empty):\n\n## Goal\nWhat the user is ultimately trying to achieve.\n\n## Constraints\nHard requirements, conventions, and rules stated.\n\n## Progress\nWhat has been done so far.\n\n## Decisions\nChoices made and their rationale.\n\n## Next\nThe immediate next steps.\n\n## Critical\nAnything that MUST NOT be forgotten (preserve verbatim: error messages, exact values).\n\n## Files\nFile paths touched or referenced (verbatim).`;\n\n/** Reject an empty marker — it would match every turn via `startsWith(\"\")` (EC-3). */\nfunction assertMarker(marker: string): void {\n  if (marker === \"\") {\n    throw new TheokitAgentError(\"compaction marker must be non-empty\", {\n      code: \"invalid_argument\",\n    });\n  }\n}\n\n/** True for a real system prompt — a `system` turn that is NOT a checkpoint marker. */\nfunction isSystemPrompt(message: CompressibleMessage, marker: string): boolean {\n  return message.role === \"system\" && !message.content.startsWith(marker);\n}\n\n/** Carried split: leading system prompts (preserved), the older window, the verbatim tail. */\ninterface TranscriptSplit {\n  systemPrompts: CompressibleMessage[];\n  head: CompressibleMessage[];\n  recent: CompressibleMessage[];\n}\n\n/**\n * Token-budget split (theocode `splitTranscript`): walk from the END accumulating\n * `estimateTokens` until `keepTokens` is exceeded; everything older is the head.\n * Always keeps ≥ 1 recent turn. No system-prompt special-casing (D6).\n */\nfunction selectByTokenBudget(\n  messages: CompressibleMessage[],\n  keepTokens: number,\n): { head: CompressibleMessage[]; recent: CompressibleMessage[] } {\n  let acc = 0;\n  let splitIndex = messages.length;\n  for (let i = messages.length - 1; i >= 0; i -= 1) {\n    acc += estimateTokens(messages[i]?.content ?? \"\");\n    if (acc > keepTokens && i < messages.length - 1) {\n      splitIndex = i + 1;\n      break;\n    }\n    splitIndex = i;\n  }\n  return { head: messages.slice(0, splitIndex), recent: messages.slice(splitIndex) };\n}\n\n/** Turn-count split (M2): preserve leading system prompts; window the rest by `keepRecent`. */\nfunction splitByRecent(\n  messages: CompressibleMessage[],\n  keepRecent: number,\n  marker: string,\n): TranscriptSplit {\n  const systemPrompts = messages.filter((m) => isSystemPrompt(m, marker));\n  const rest = messages.filter((m) => !isSystemPrompt(m, marker));\n  const { toCompress, toPreserve } = selectCompressionWindow(rest, keepRecent);\n  return { systemPrompts, head: toCompress, recent: toPreserve };\n}\n\n/** Options for {@link compactTranscript}. */\nexport interface CompactTranscriptOptions {\n  /** Trailing turns preserved verbatim by COUNT (default 6). Ignored when `keepTokens` is set. */\n  keepRecent?: number;\n  /**\n   * Trailing turns preserved verbatim by TOKEN BUDGET (theocode mode). When set,\n   * takes precedence over `keepRecent` and disables system-prompt preservation (D6).\n   */\n  keepTokens?: number;\n  /** Checkpoint marker (default {@link CHECKPOINT_MARKER}). Must be non-empty. */\n  marker?: string;\n  /** Summary template passed to `summarize` (default {@link SUMMARY_TEMPLATE}). */\n  summaryTemplate?: string;\n  /** Summarize the older window into one turn; if omitted, the older window is dropped. */\n  summarize?: (older: CompressibleMessage[], template: string) => Promise<CompressibleMessage>;\n  /**\n   * When true, a thrown `summarize` returns the ORIGINAL transcript + a structured\n   * warn (compaction never loses data). Default false: the error propagates.\n   */\n  failSafe?: boolean;\n}\n\n/** Sentinel returned by {@link runSummarize} when fail-safe swallowed a throw. */\nconst FAILSAFE_ABORT = Symbol(\"failsafe-abort\");\n\n/** Run the summarizer; on throw, either propagate or (fail-safe) warn + signal abort. */\nasync function runSummarize(\n  summarize: NonNullable<CompactTranscriptOptions[\"summarize\"]>,\n  head: CompressibleMessage[],\n  template: string,\n  failSafe: boolean,\n): Promise<CompressibleMessage | typeof FAILSAFE_ABORT> {\n  try {\n    return await summarize(head, template);\n  } catch (err) {\n    if (!failSafe) throw err;\n    // Unbreakable Rule 8 — never fail silently. The breadcrumb points at the root\n    // cause when a summarizer fails every turn and context grows unchecked. The\n    // summarizer is caller-supplied, so its error text is routed through\n    // `redactSecrets` (ADR D68 — no unredacted output sink in src/).\n    // theokit#147 — through the interceptable channel. A summarizer failing every turn is exactly\n    // the breadcrumb a TUI host wants in its own panel, not smeared across its alternate screen.\n    diag(\n      `[compaction] summarizer failed — proceeding uncompacted: ${redactSecrets(err instanceof Error ? err.message : String(err))}\\n`,\n    );\n    return FAILSAFE_ABORT;\n  }\n}\n\n/**\n * Compact a transcript. In `keepRecent` mode (default) the last `keepRecent` turns\n * are kept verbatim and leading system PROMPTS preserved; in `keepTokens` mode the\n * trailing turns within the token budget are kept (no system special-casing, D6).\n * The older window is summarized (via `summarize`, receiving the template) or\n * dropped. Never mutates the input.\n */\nexport async function compactTranscript(\n  messages: CompressibleMessage[],\n  options: CompactTranscriptOptions = {},\n): Promise<CompressibleMessage[]> {\n  const marker = options.marker ?? CHECKPOINT_MARKER;\n  assertMarker(marker);\n  const split =\n    options.keepTokens != null\n      ? { systemPrompts: [], ...selectByTokenBudget(messages, options.keepTokens) }\n      : splitByRecent(messages, options.keepRecent ?? 6, marker);\n  if (split.head.length === 0) {\n    return [...messages];\n  }\n  if (!options.summarize) {\n    return [...split.systemPrompts, ...split.recent];\n  }\n  const template = options.summaryTemplate ?? SUMMARY_TEMPLATE;\n  const summary = await runSummarize(\n    options.summarize,\n    split.head,\n    template,\n    options.failSafe ?? false,\n  );\n  if (summary === FAILSAFE_ABORT) {\n    return [...messages];\n  }\n  return [...split.systemPrompts, summary, ...split.recent];\n}\n\n/**\n * Build a checkpoint marker turn (a `system` turn whose content starts with\n * `marker`, default {@link CHECKPOINT_MARKER}). `marker` must be non-empty.\n */\nexport function buildCheckpoint(\n  label?: string,\n  marker: string = CHECKPOINT_MARKER,\n): CompressibleMessage {\n  assertMarker(marker);\n  return { role: \"system\", content: marker + (label ?? \"\") };\n}\n\n/** Options for {@link filterFromLatestCheckpoint}. */\nexport interface FilterCheckpointOptions {\n  /** Marker to scan for (default {@link CHECKPOINT_MARKER}). */\n  marker?: string;\n  /**\n   * `'after'` (default, M2) returns turns AFTER the latest marker (exclusive);\n   * `'from'` (theocode) returns turns FROM the latest marker (inclusive).\n   */\n  include?: \"after\" | \"from\";\n}\n\n/**\n * Return the turns relative to the most recent checkpoint marker (all turns if\n * none). `include: 'after'` (default) excludes the checkpoint; `'from'` includes\n * it (the summary stands in for the pruned head). Never mutates the input.\n */\nexport function filterFromLatestCheckpoint(\n  messages: CompressibleMessage[],\n  options: FilterCheckpointOptions = {},\n): CompressibleMessage[] {\n  const marker = options.marker ?? CHECKPOINT_MARKER;\n  const offset = options.include === \"from\" ? 0 : 1;\n  for (let i = messages.length - 1; i >= 0; i -= 1) {\n    if (messages[i]?.content.startsWith(marker)) {\n      return messages.slice(i + offset);\n    }\n  }\n  return [...messages];\n}\n\n/**\n * True iff `err` is a {@link TheokitAgentError} (or subclass) reporting a\n * context-window-exceeded condition (the typed `context_too_long` code). Reads\n * both `code` (set by provider mappers) and `metadata.code` (the preferred field)\n * — never a brittle message regex.\n */\nexport function isContextOverflowError(err: unknown): boolean {\n  return (\n    err instanceof TheokitAgentError &&\n    (err.code === \"context_too_long\" || err.metadata?.code === \"context_too_long\")\n  );\n}\n\n/**\n * M77 — the margin is outside `(0, 1]`. Typed, because a margin > 1 would GROW the assumed window,\n * which is the unsafe direction: `shouldCompact` is monotonically decreasing in `contextWindow`, so\n * overestimating it makes the trigger fire too late and the context overflow.\n */\nexport class ContextWindowMarginError extends TheokitAgentError {\n  constructor(readonly margin: number) {\n    super(\n      `context-window margin must be in (0, 1], got ${String(margin)}. ` +\n        `A margin above 1 grows the assumed window and delays compaction past the real limit.`,\n      { code: \"invalid_context_window_margin\" },\n    );\n  }\n}\n\n/**\n * M77 — default safety margin on the context window.\n *\n * `0.95` is not a guess: it is the single reference's value. Codex ships\n * `effective_context_window_percent: 95` (`models-manager/src/model_info.rs:158`) and never budgets\n * against 100% of a window. Being MULTIPLICATIVE, it stays conservative at any window size, which a\n * fixed subtraction would not.\n */\nexport const CONTEXT_WINDOW_MARGIN = 0.95;\n\n/**\n * M77 — the floor used ONLY when neither the catalog nor the caller knows the window.\n *\n * Honest about its own weakness. This number has **one** source (the M77 milestone text); the search\n * for a second one failed, because the reference has no fallback at all — Codex returns `Option` and\n * its callers early-return (`core/src/session/turn_context.rs:213`, `core/src/compact_remote.rs:374`).\n *\n * It is conservative only UPWARD. For a model whose real window is larger, budgeting against 128k\n * compacts early — wasteful but safe. For a model whose real window is SMALLER (an 8k or 32k model\n * absent from the catalog), it compacts too late and the context still overflows. That residual risk\n * is real and is why {@link resolveEffectiveContextWindow} never lets this floor compete with a known\n * catalog value, and why the `compaction_fallback` event exists: a surface can show that the budget is\n * a guess instead of the user finding out when the provider rejects the request.\n */\nexport const CONTEXT_WINDOW_FLOOR = 128_000;\n\n/** Where the effective window came from — carried into the M77 structured event. */\nexport type ContextWindowSource = \"override\" | \"catalog\" | \"fallback\";\n\n/** Input to {@link resolveEffectiveContextWindow}. */\nexport interface EffectiveContextWindowInput {\n  /** Caller-supplied window, in tokens. Clamped by `catalog` when both are present. */\n  readonly override?: number | undefined;\n  /** The model's window from the catalog, in tokens. Absent when the model is unknown. */\n  readonly catalog?: number | undefined;\n  /** Safety margin in `(0, 1]`. Codex uses 0.95 (`model_info.rs:158`). */\n  readonly margin: number;\n  /** Conservative floor used ONLY when neither `override` nor `catalog` is available. */\n  readonly floor?: number | undefined;\n}\n\n/** Result of {@link resolveEffectiveContextWindow}. */\nexport interface EffectiveContextWindow {\n  /** The window to budget against, after clamp and margin. */\n  readonly window: number;\n  /** Which input won — `\"fallback\"` means neither override nor catalog was available. */\n  readonly source: ContextWindowSource;\n  /** `true` when an `override` above the catalog window was clamped down to it. */\n  readonly clamped: boolean;\n}\n\n/**\n * Resolve the window to budget against — the fail-SAFE replacement for reading the catalog directly.\n *\n * Today `post-run-lifecycle.ts` reads `getCatalogModelInfo(model)?.limit?.context` and, when that is\n * `undefined`, auto-compaction simply never fires. That is fail-OPEN: the context grows until the\n * provider rejects the request. (The comment there calls it \"fail-safe\" — M77 corrects it.)\n *\n * Three techniques, two of them borrowed from the single reference:\n *\n *  1. **Override, CLAMPED by the catalog** — Codex `models-manager/src/model_info.rs:26-31` lets\n *     config override the window but limits it with `context_window.min(max_context_window)`.\n *     Without the clamp, declaring 999k on a 200k model reopens the overflow through another door.\n *  2. **Multiplicative margin** — Codex `model_info.rs:158` (`effective_context_window_percent: 95`)\n *     never budgets against 100% of the window. Being multiplicative, it is conservative for ANY\n *     window size.\n *  3. **Floor, only when nothing is known** — deliberately NOT a blanket default. A fixed floor is\n *     conservative only upward: applied to a small model it would inflate the assumed window and\n *     reproduce the very fail-open this function exists to close. Hence the floor never competes\n *     with a known catalog value.\n *\n * Pure — no catalog lookup, no I/O. The caller supplies the numbers, mirroring `shouldCompact`.\n */\n/**\n * Absolute cap on a declared context window, applied when no catalog entry exists to compare against.\n *\n * **10M**, not 2M. The first version used 2M on the rationale that it sat \"comfortably above the\n * largest published window\" — adversarial review measured the opposite: Llama 4 Scout publishes\n * **10M**, and it arrives precisely via OpenRouter, the provider **without** a catalog, which is the\n * case this cap exists to cover. The user would have silently lost 80% of the declared window.\n *\n * The cap still serves what motivates it — one extra zero on 400k gives 4M, which passes; two zeros\n * give 40M, which does not. A limit that rejects legitimate configuration is worse than no limit,\n * because failing OPEN is visible when it happens and silently losing 80% is not.\n */\nexport const ABSOLUTE_CONTEXT_WINDOW_CAP = 10_000_000;\n\nexport function resolveEffectiveContextWindow(\n  input: EffectiveContextWindowInput,\n): EffectiveContextWindow {\n  if (!(input.margin > 0) || input.margin > 1) {\n    throw new ContextWindowMarginError(input.margin);\n  }\n\n  const withMargin = (raw: number): number => Math.floor(raw * input.margin);\n\n  if (input.override !== undefined) {\n    // The catalog is the preferred cap; without it the ABSOLUTE cap applies.\n    //\n    // M95 (adversarial review of M94) — the previous version clamped **only** when a catalog entry\n    // existed, and the whole reason the `contextWindow` key exists is the model that has NO entry\n    // (OpenRouter has zero). So the clamp was missing in exactly the case that justifies the\n    // feature, while the documentation — including an already-published CHANGELOG — stated without\n    // qualification that \"declaring 10M does not blow past the provider\".\n    //\n    // The concrete scenario is one extra zero: `context_window = 4000000`. The only guard was a\n    // `.positive().int()`, which sets no upper bound. The agent would never compact until the\n    // provider refused the turn — the silent fail-OPEN that M77 exists to prevent.\n    const cap = input.catalog ?? ABSOLUTE_CONTEXT_WINDOW_CAP;\n    const clamped = input.override > cap;\n    return { window: withMargin(clamped ? cap : input.override), source: \"override\", clamped };\n  }\n\n  if (input.catalog !== undefined) {\n    return { window: withMargin(input.catalog), source: \"catalog\", clamped: false };\n  }\n\n  return { window: withMargin(input.floor ?? 0), source: \"fallback\", clamped: false };\n}\n\n/** Input to {@link shouldCompact}: an estimate, the model's window, and reserved headroom. */\nexport interface ShouldCompactInput {\n  /** Estimated token count of the next request (e.g. from {@link estimateTokens}). */\n  readonly estimated: number;\n  /** The model's total context window, in tokens. */\n  readonly contextWindow: number;\n  /** Tokens to reserve as headroom (output + safety margin). */\n  readonly buffer: number;\n  /**\n   * Tokens reserved for the model's response generation, SEPARATE from `buffer`.\n   * Default 0 — omitting it preserves the legacy\n   * `estimated >= contextWindow - buffer` result.\n   */\n  readonly maxOutput?: number;\n}\n\n/**\n * Tokenizer-free token estimate via the conventional ~4-chars-per-token\n * heuristic: `ceil(text.length / 4)`. `\"\"` → 0; any non-empty text → ≥ 1.\n * A cheap PRE-CALL gate for {@link shouldCompact} — NOT exact tokenization\n * (a consumer needing exactness supplies their own tokenizer). Uses UTF-16\n * `.length` (code units), so multibyte text is approximate.\n */\nexport function estimateTokens(text: string): number {\n  return Math.ceil(text.length / 4);\n}\n\n/**\n * Decide BEFORE sending whether to compact: `true` when the `estimated` token\n * count leaves less than `buffer` headroom in the `contextWindow`\n * (`estimated >= contextWindow - buffer`). A `buffer >= contextWindow`\n * (non-positive threshold) always returns `true`. Pure — the caller supplies\n * the window (e.g. from `resolveModelCapabilities`), keeping this decoupled\n * from the per-model catalog.\n */\nexport function shouldCompact(input: ShouldCompactInput): boolean {\n  return input.estimated >= input.contextWindow - input.buffer - (input.maxOutput ?? 0);\n}\n"]}

package/dist/{chunk-7YBJZS5P.cjs → chunk-ZAKTZ5B4.cjs}

@@ -1,11 +1,11 @@
 'use strict';
 
-var chunkIHFNRNTJ_cjs = require('./chunk-IHFNRNTJ.cjs');
+var chunkE7WWIX34_cjs = require('./chunk-E7WWIX34.cjs');
 var crypto = require('crypto');
 var fs = require('fs');
 var path = require('path');
 
-var PathTraversalError = class extends chunkIHFNRNTJ_cjs.ConfigurationError {
+var PathTraversalError = class extends chunkE7WWIX34_cjs.ConfigurationError {
   name = "PathTraversalError";
   constructor(input, resolvedPath) {
     super(`Path traversal attempt: ${input} \u2192 ${resolvedPath}`, {
@@ -13,7 +13,7 @@ var PathTraversalError = class extends chunkIHFNRNTJ_cjs.ConfigurationError {
     });
   }
 };
-var ForbiddenPathError = class extends chunkIHFNRNTJ_cjs.ConfigurationError {
+var ForbiddenPathError = class extends chunkE7WWIX34_cjs.ConfigurationError {
   name = "ForbiddenPathError";
   constructor(path) {
     super(
@@ -185,13 +185,13 @@ function rejectParentTraversal(input, normalized) {
 function sanitizeIdentifier(input, options) {
   const maxLen = options?.maxLen ?? 64;
   if (input.length === 0 || input.length > maxLen) {
-    throw new chunkIHFNRNTJ_cjs.ConfigurationError(`Identifier length out of range (1-${maxLen}): "${input}"`, {
+    throw new chunkE7WWIX34_cjs.ConfigurationError(`Identifier length out of range (1-${maxLen}): "${input}"`, {
       code: "invalid_identifier"
     });
   }
   rejectNulAndControlChars(input, "identifier");
   if (!IDENTIFIER_PATTERN.test(input)) {
-    throw new chunkIHFNRNTJ_cjs.ConfigurationError(`Identifier contains invalid characters: "${input}"`, {
+    throw new chunkE7WWIX34_cjs.ConfigurationError(`Identifier contains invalid characters: "${input}"`, {
       code: "invalid_identifier"
     });
   }
@@ -199,7 +199,7 @@ function sanitizeIdentifier(input, options) {
 }
 function safeFilenameForId(id, options) {
   if (id.length === 0) {
-    throw new chunkIHFNRNTJ_cjs.ConfigurationError("Filename id must be a non-empty string", {
+    throw new chunkE7WWIX34_cjs.ConfigurationError("Filename id must be a non-empty string", {
       code: "invalid_filename_id"
     });
   }
@@ -219,5 +219,5 @@ exports.safeFilenameForId = safeFilenameForId;
 exports.safePathJoin = safePathJoin;
 exports.sanitizeIdentifier = sanitizeIdentifier;
 exports.validateArtifactPath = validateArtifactPath;
-//# sourceMappingURL=chunk-7YBJZS5P.cjs.map
-//# sourceMappingURL=chunk-7YBJZS5P.cjs.map
+//# sourceMappingURL=chunk-ZAKTZ5B4.cjs.map
+//# sourceMappingURL=chunk-ZAKTZ5B4.cjs.map

package/dist/{chunk-7YBJZS5P.cjs.map → chunk-ZAKTZ5B4.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/security/path-guard.ts"],"names":["ConfigurationError","sep","resolve","path","realpathSync","lstatSync","readlinkSync","dirname","createHash"],"mappings":";;;;;;;AAgCO,IAAM,kBAAA,GAAN,cAAiCA,oCAAA,CAAmB;AAAA,EACvC,IAAA,GAAe,oBAAA;AAAA,EAEjC,WAAA,CAAY,OAAe,YAAA,EAAsB;AAC/C,IAAA,KAAA,CAAM,CAAA,wBAAA,EAA2B,KAAK,CAAA,QAAA,EAAM,YAAY,CAAA,CAAA,EAAI;AAAA,MAC1D,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AAYO,IAAM,kBAAA,GAAN,cAAiCA,oCAAA,CAAmB;AAAA,EACvC,IAAA,GAAe,oBAAA;AAAA,EAEjC,YAAY,IAAA,EAAc;AACxB,IAAA,KAAA;AAAA,MACE,SAAS,IAAI,CAAA,qFAAA,CAAA;AAAA,MACb;AAAA,QACE,IAAA,EAAM;AAAA;AACR,KACF;AAAA,EACF;AACF;AAeA,SAAS,QAAA,CAAS,QAAgB,IAAA,EAAuB;AACvD,EAAA,IAAI,MAAA,KAAW,MAAM,OAAO,IAAA;AAC5B,EAAA,MAAM,SAAS,IAAA,CAAK,QAAA,CAASC,QAAG,CAAA,GAAI,OAAO,IAAA,GAAOA,QAAA;AAClD,EAAA,OAAO,MAAA,CAAO,WAAW,MAAM,CAAA;AACjC;AAWO,SAAS,YAAA,CAAa,SAAiB,KAAA,EAAyB;AACrE,EAAA,IAAI,SAAS,EAAA,EAAI;AACf,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACxD;AAKA,EAAA,wBAAA,CAAyB,MAAM,MAAM,CAAA;AACrC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,wBAAA,CAAyB,MAAM,cAAc,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,YAAA,GAAeC,aAAQ,IAAI,CAAA;AACjC,EAAA,MAAM,MAAA,GAASA,YAAA,CAAQ,IAAA,EAAM,GAAG,KAAK,CAAA;AACrC,EAAA,IAAI,CAAC,QAAA,CAAS,MAAA,EAAQ,YAAY,CAAA,EAAG;AACnC,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,CAAM,IAAA,CAAK,GAAG,GAAG,MAAM,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,MAAA;AACT;AAaA,SAAS,wBAAA,CAAyB,OAAe,IAAA,EAAoB;AACnE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,UAAA,CAAW,CAAC,CAAA;AAC/B,IAAA,IAAI,SAAS,CAAA,IAAS,IAAA,IAAQ,KAAQ,IAAA,IAAQ,EAAA,IAAS,SAAS,GAAA,EAAM;AACpE,MAAA,MAAM,KAAA,GAAQ,SAAS,CAAA,GAAO,YAAA,GAAe,mBAAmB,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA,CAAA;AACjF,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,KAAK,IAAI,KAAK,CAAA;AAAA,IACzD;AAAA,EACF;AACF;AAoBO,SAAS,qBAAA,CAAsBC,QAAc,IAAA,EAAoB;AAItE,EAAA,wBAAA,CAAyBA,QAAM,MAAM,CAAA;AACrC,EAAA,wBAAA,CAAyB,MAAM,MAAM,CAAA;AAErC,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAeC,gBAAa,IAAI,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AAEN,IAAA,YAAA,GAAeF,aAAQ,IAAI,CAAA;AAAA,EAC7B;AAQA,EAAA,MAAM,QAAA,GAAW,0BAA0BC,MAAI,CAAA;AAC/C,EAAA,IAAI,aAAa,MAAA,EAAW;AAE5B,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,YAAY,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,QAAA,EAAWA,MAAI,IAAI,QAAQ,CAAA;AAAA,EAC1D;AACF;AAUA,SAAS,0BAA0BA,MAAA,EAAkC;AAEnE,EAAA,IAAI;AACF,IAAA,OAAOC,gBAAaD,MAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AAAA,EAER;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAcE,aAAUF,MAAI,CAAA;AAClC,IAAA,IAAI,IAAA,CAAK,gBAAe,EAAG;AACzB,MAAA,MAAM,MAAA,GAASG,gBAAaH,MAAI,CAAA;AAGhC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0BI,YAAA,CAAQJ,MAAI,CAAC,CAAA;AAC1D,MAAA,MAAM,UAAA,GAAa,UAAA,IAAcI,YAAA,CAAQJ,MAAI,CAAA;AAC7C,MAAA,OAAOD,YAAA,CAAQ,YAAY,MAAM,CAAA;AAAA,IACnC;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAIA,EAAA,IAAI,MAAA,GAASK,aAAQJ,MAAI,CAAA;AACzB,EAAA,IAAI,MAAA,GAASA,MAAA,CAAK,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AACrC,EAAA,OAAO,MAAA,KAAWI,YAAA,CAAQ,MAAM,CAAA,EAAG;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAOH,gBAAa,MAAM,CAAA;AAEhC,MAAA,OAAOF,YAAA,CAAQ,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IACnC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAA,GAASC,MAAA,CAAK,KAAA,CAAMI,YAAA,CAAQ,MAAM,EAAE,MAAM,CAAA;AAC1C,MAAA,MAAA,GAASA,aAAQ,MAAM,CAAA;AAAA,IACzB;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,IAAM,UAAA,uBAAiB,GAAA,CAAI,CAAC,kBAAkB,mBAAA,EAAqB,WAAA,EAAa,WAAW,CAAC,CAAA;AAM5F,IAAM,wBAAA,uBAA+B,GAAA,CAAI;AAAA,EACvC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAID,IAAM,mBAAA,uBAA0B,GAAA,CAAI;AAAA,EAClC,QAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,aAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAID,IAAM,kBAAA,GAAqB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAuBnD,SAAS,gBAAgB,KAAA,EAAwB;AAKtD,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,GAAG,EAAE,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA,CAAE,WAAA,EAAY;AAC9E,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAEpC,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AACjE,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAElC,EAAA,IAAI,uBAAA,CAAwB,QAAA,CAAS,CAAC,CAAE,GAAG,OAAO,IAAA;AAClD,EAAA,IAAI,oBAAoB,QAAA,CAAS,QAAA,CAAS,SAAS,CAAC,CAAE,GAAG,OAAO,IAAA;AAChE,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,wBAAwB,KAAA,EAAwB;AAEvD,EAAA,IAAI,KAAA,KAAU,gBAAgB,OAAO,KAAA;AACrC,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,IAAA;AAC7B,EAAA,IAAI,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AACnC,EAAA,IAAI,UAAU,MAAA,IAAU,KAAA,KAAU,cAAA,IAAkB,KAAA,KAAU,SAAS,OAAO,IAAA;AAC9E,EAAA,OAAO,wBAAA,CAAyB,IAAI,KAAK,CAAA;AAC3C;AAEA,SAAS,oBAAoB,QAAA,EAA2B;AACtD,EAAA,IAAI,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA,EAAG,OAAO,IAAA;AACrC,EAAA,IAAI,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,KAAA,MAAW,UAAU,kBAAA,EAAoB;AACvC,IAAA,IAAI,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,IAAA;AAAA,EACxC;AACA,EAAA,OAAO,KAAA;AACT;AAEA,IAAM,kBAAA,GAAqB,yBAAA;AAsCpB,SAAS,qBAAqB,KAAA,EAAqB;AACxD,EAAA,wBAAA,CAAyB,KAAK,CAAA;AAC9B,EAAA,MAAM,UAAA,GAAa,mBAAmB,KAAK,CAAA;AAC3C,EAAA,qBAAA,CAAsB,OAAO,UAAU,CAAA;AACzC;AAEA,SAAS,yBAAyB,KAAA,EAAqB;AACrD,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,IAAM,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,YAAY,CAAA;AAAA,EAClD;AACA,EAAA,IAAI,MAAM,UAAA,CAAW,GAAG,KAAK,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,EAC3C;AACA,EAAA,IAAI,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,EAC3C;AACF;AAEA,SAAS,mBAAmB,KAAA,EAAuB;AAGjD,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,KAAK,CAAA,EAAG;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,mBAAmB,OAAO,CAAA;AACvC,MAAA,IAAI,SAAS,OAAA,EAAS;AACtB,MAAA,OAAA,GAAU,IAAA;AAAA,IACZ,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,0BAA0B,CAAA;AAAA,IAChE;AAAA,EACF;AAEA,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AACnC;AAEA,SAAS,qBAAA,CAAsB,OAAe,UAAA,EAA0B;AACtE,EAAA,KAAA,MAAW,OAAA,IAAW,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,EAAG;AAC3C,IAAA,IAAI,OAAA,KAAY,IAAA,IAAQ,OAAA,KAAY,OAAA,EAAS;AAC3C,MAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,UAAU,CAAA;AAAA,IAChD;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,QAAA,CAAS,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,UAAU,CAAA;AAAA,EAChD;AACF;AAEO,SAAS,kBAAA,CAAmB,OAAe,OAAA,EAAuC;AACvF,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,EAAA;AAClC,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,SAAS,MAAA,EAAQ;AAC/C,IAAA,MAAM,IAAIP,oCAAA,CAAmB,CAAA,kCAAA,EAAqC,MAAM,CAAA,IAAA,EAAO,KAAK,CAAA,CAAA,CAAA,EAAK;AAAA,MACvF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAQA,EAAA,wBAAA,CAAyB,OAAO,YAAY,CAAA;AAC5C,EAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AACnC,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,yCAAA,EAA4C,KAAK,CAAA,CAAA,CAAA,EAAK;AAAA,MACjF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,MAAM,WAAA,EAAY;AAC3B;AAyBO,SAAS,iBAAA,CAAkB,IAAY,OAAA,EAAuC;AACnF,EAAA,IAAI,EAAA,CAAG,WAAW,CAAA,EAAG;AACnB,IAAA,MAAM,IAAIA,qCAAmB,wCAAA,EAA0C;AAAA,MACrE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,GAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,GAAG,WAAA,EAAY;AAC7B,EAAA,IAAI,MAAM,MAAA,IAAU,MAAA,IAAU,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5D,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,CAAA,EAAA,EAAKQ,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,EAAE,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AACxE","file":"chunk-7YBJZS5P.cjs","sourcesContent":["/**\n * Canonical path-guard module (ADRs D79-D81).\n *\n * Three primitives + one typed error:\n *   - `safePathJoin(base, ...parts)` — resolve THEN prefix-check (ADR D80).\n *   - `assertNoSymlinkEscape(path, base)` — `realpathSync` resolves entire\n *     symlink chain (EC-1 fix; Hermes v0.2 #386, #61).\n *   - `sanitizeIdentifier(input, { maxLen })` — strict grammar\n *     `^[a-z0-9][a-z0-9-_]*$` (ADR D81; case-insensitive on input,\n *     lowercase on output).\n *   - `PathTraversalError` — extends ConfigurationError with code\n *     `path_traversal` (ADR D65: no new hierarchy).\n *\n * Wire at all sites where user input becomes a path. CI lint gate\n * `tests/lint/no-unguarded-path-input.test.ts` prevents regression\n * (ADR D85).\n *\n * @internal\n */\n\nimport { createHash } from \"node:crypto\";\nimport { lstatSync, readlinkSync, realpathSync, type Stats } from \"node:fs\";\nimport { dirname, resolve, sep } from \"node:path\";\n\nimport { ConfigurationError } from \"../../errors.js\";\n\n/**\n * Thrown when a path operation would escape its allowed base directory.\n * Extends `ConfigurationError` (no new error hierarchy per ADR D65).\n *\n * @internal\n */\nexport class PathTraversalError extends ConfigurationError {\n  override readonly name: string = \"PathTraversalError\";\n\n  constructor(input: string, resolvedPath: string) {\n    super(`Path traversal attempt: ${input} → ${resolvedPath}`, {\n      code: \"path_traversal\",\n    });\n  }\n}\n\n/**\n * Thrown when an agent tool is asked to read or write a sensitive path\n * that the blocklist forbids (`.env`, `.git/`, `node_modules/`, `.theo/`,\n * lock files). Distinct from `PathTraversalError` because the path is\n * lexically inside the project — it is just sensitive.\n *\n * Extends `ConfigurationError` (no new error hierarchy per ADR D65).\n *\n * @public\n */\nexport class ForbiddenPathError extends ConfigurationError {\n  override readonly name: string = \"ForbiddenPathError\";\n\n  constructor(path: string) {\n    super(\n      `Path '${path}' is in the sensitive-file blocklist (.env, .git/, node_modules/, .theo/, lock files)`,\n      {\n        code: \"forbidden_path\",\n      },\n    );\n  }\n}\n\n/**\n * Is `target` the same as `base`, or strictly under it?\n *\n * The prefix must not double the separator. `resolve` strips a trailing `sep` from every base\n * EXCEPT the filesystem root, where `resolve(sep) === sep`; there `base + sep` would be `//`, which\n * no absolute path starts with, so a root base rejected EVERY path (#149). Only the root takes that\n * branch — for any other base the prefix is unchanged, so containment is not weakened.\n *\n * Both containment checks in this module go through here: they had the same defect and were fixed\n * one at a time, which is exactly how the two drifted apart in the first place.\n *\n * Both arguments MUST already be resolved absolute paths.\n */\nfunction isInside(target: string, base: string): boolean {\n  if (target === base) return true;\n  const prefix = base.endsWith(sep) ? base : base + sep;\n  return target.startsWith(prefix);\n}\n\n/**\n * Join `base` with `...parts` and ensure the resolved absolute path stays\n * under `base`. Resolves FIRST, then prefix-checks (ADR D80) — prevents\n * normalized-escape bypasses like `subdir/.\\\\./bar`.\n *\n * Returns the safe absolute path. Throws `PathTraversalError` if escape.\n *\n * @internal\n */\nexport function safePathJoin(base: string, ...parts: string[]): string {\n  if (base === \"\") {\n    throw new Error(\"safePathJoin: base must be non-empty\");\n  }\n  // T5.5 — NUL byte + C0/DEL control char rejection at the boundary.\n  // Apply before path resolution so a malicious input never reaches\n  // `resolve` (which on some platforms behaved unexpectedly with NUL\n  // and in N-API callers historically silently truncated).\n  rejectNulAndControlChars(base, \"base\");\n  for (const part of parts) {\n    rejectNulAndControlChars(part, \"path segment\");\n  }\n  const baseResolved = resolve(base);\n  const target = resolve(base, ...parts);\n  if (!isInside(target, baseResolved)) {\n    throw new PathTraversalError(parts.join(\"/\"), target);\n  }\n  return target;\n}\n\n/**\n * T5.5 — Reject NUL (`\\x00`) and C0/DEL control characters\n * (`\\x01-\\x1F`, `\\x7F`) in any path-shaped or identifier-shaped input.\n * Centralizes the check so every public path-guard / sanitize entrypoint\n * shares the same defense.\n *\n * Throws `PathTraversalError` (the same shape as other path-shape\n * rejections) so callers don't need to learn a new error class.\n *\n * @internal\n */\nfunction rejectNulAndControlChars(input: string, role: string): void {\n  for (let i = 0; i < input.length; i++) {\n    const code = input.charCodeAt(i);\n    if (code === 0x00 || (code >= 0x01 && code <= 0x1f) || code === 0x7f) {\n      const label = code === 0x00 ? \"<nul-byte>\" : `<control-char-0x${code.toString(16)}>`;\n      throw new PathTraversalError(`${role}: ${input}`, label);\n    }\n  }\n}\n\n/**\n * Assert that `path` — including every directory component in the chain —\n * stays under `base` after symlink resolution. No-op when nothing on the\n * path exists yet.\n *\n * Two-bug history:\n *   1. **EC-1** (original fix, kept): a multi-level symlink chain A → B → C\n *      must be resolved end-to-end. `realpathSync` does this in 1 syscall.\n *   2. **Defence-in-depth** (added v1.x): the previous implementation only\n *      called `lstatSync(path)` on the terminal component. If an INTERMEDIATE\n *      directory was a symlink (`base/inner-symlink → /outside`), `lstat` on\n *      `base/inner-symlink/file.txt` followed the symlink and reported the\n *      regular file — escape went undetected. Fix: walk up to the nearest\n *      existing ancestor and `realpath` THAT, then re-attach the suffix and\n *      check the result against the canonical base.\n *\n * @internal\n */\nexport function assertNoSymlinkEscape(path: string, base: string): void {\n  // T5.5 — reject NUL / control chars before any FS call (a NUL byte\n  // in the path used to silently truncate at the C boundary on legacy\n  // libc — defense in depth even on modern Node).\n  rejectNulAndControlChars(path, \"path\");\n  rejectNulAndControlChars(base, \"base\");\n  // Canonical base — symlinks in the base path itself are absorbed once here.\n  let baseResolved: string;\n  try {\n    baseResolved = realpathSync(base);\n  } catch {\n    // base doesn't exist as a real directory yet — fall back to lexical resolve.\n    baseResolved = resolve(base);\n  }\n\n  // Find the deepest ancestor of `path` that exists, then realpath it.\n  // Anything from there onward is \"not yet on disk\" and contributes only\n  // its lexical suffix. This covers three cases:\n  //   - path exists (regular file or symlink at any depth) → realpath the full path\n  //   - path doesn't exist but intermediate dir is a symlink → realpath the ancestor\n  //   - nothing on the path exists → no escape risk (return)\n  const resolved = realpathOfDeepestExisting(path);\n  if (resolved === undefined) return; // path has no existing prefix — nothing to attack\n\n  if (!isInside(resolved, baseResolved)) {\n    throw new PathTraversalError(`symlink ${path}`, resolved);\n  }\n}\n\n/**\n * Find the deepest ancestor of `path` that exists on disk, resolve all\n * symlinks in that ancestor via `realpathSync`, and re-attach the\n * lexical suffix. Returns `undefined` when no ancestor exists.\n *\n * Handles dangling symlinks: if the terminal IS a symlink but its target\n * is missing, we still detect escape via `readlinkSync` + parent resolve.\n */\nfunction realpathOfDeepestExisting(path: string): string | undefined {\n  // First try the full path — the common case.\n  try {\n    return realpathSync(path);\n  } catch {\n    // Not resolvable. Two sub-cases.\n  }\n\n  // Sub-case A: terminal is a dangling symlink.\n  try {\n    const stat: Stats = lstatSync(path);\n    if (stat.isSymbolicLink()) {\n      const target = readlinkSync(path);\n      // Resolve target relative to the REAL parent dir, so intermediate\n      // symlinks in the parent chain are absorbed.\n      const parentReal = realpathOfDeepestExisting(dirname(path));\n      const parentBase = parentReal ?? dirname(path);\n      return resolve(parentBase, target);\n    }\n  } catch {\n    // lstat failed too — terminal doesn't exist at all.\n  }\n\n  // Sub-case B: walk up to the nearest existing ancestor, then re-attach\n  // the suffix lexically.\n  let cursor = dirname(path);\n  let suffix = path.slice(cursor.length);\n  while (cursor !== dirname(cursor)) {\n    try {\n      const real = realpathSync(cursor);\n      // Reconstruct: ancestor's realpath + remaining (still-lexical) suffix\n      return resolve(real, `.${suffix}`);\n    } catch {\n      suffix = path.slice(dirname(cursor).length);\n      cursor = dirname(cursor);\n    }\n  }\n  // Reached filesystem root without finding any existing ancestor.\n  return undefined;\n}\n\nconst LOCK_FILES = new Set([\"pnpm-lock.yaml\", \"package-lock.json\", \"yarn.lock\", \"bun.lockb\"]);\n\n// T5.6 — top-level credential dot-dirs / dot-files. Matching against\n// the FIRST path segment (lowercase). Adding any entry here costs a\n// CHANGELOG note + an explicit case-fold test (entries are lowercased\n// at module load).\nconst SENSITIVE_FIRST_SEGMENTS = new Set([\n  \".ssh\",\n  \".aws\",\n  \".docker\",\n  \".kube\",\n  \".npmrc\",\n  \".netrc\",\n  \".pgpass\",\n]);\n\n// T5.6 — credential basenames blocked at ANY depth (lowercase). Catches\n// the developer-laptop case where an agent recurses into a subdir.\nconst SENSITIVE_BASENAMES = new Set([\n  \"id_rsa\",\n  \"id_ed25519\",\n  \"id_ecdsa\",\n  \"id_dsa\",\n  \"authorized_keys\",\n  \"known_hosts\",\n  \".npmrc\",\n  \".netrc\",\n  \".pgpass\",\n]);\n\n// T5.6 — extension suffixes blocked at ANY depth (lowercase). Covers\n// the entire `*.pem` / `*.key` private-material family.\nconst SENSITIVE_SUFFIXES = [\".pem\", \".key\", \".p12\", \".pfx\"];\n\n/**\n * Decide whether a project-relative path points to a known-sensitive file\n * that a coding agent must not read or write.\n *\n * Universal blocklist (works for any agent operating on a project tree):\n *\n *   - `.env`, `.env.<anything>` — except `.env.example` (template safe to read)\n *   - `.git/` — version control internals\n *   - `node_modules/` — dependency cache (changes don't belong to the user)\n *   - `.theo/` — TheoKit build artefacts / state\n *   - Lock files at any depth: `pnpm-lock.yaml`, `package-lock.json`,\n *     `yarn.lock`, `bun.lockb`\n *\n * Operates on path segments (forward-slash normalized). Cross-platform safe.\n *\n * Use together with `safePathJoin` + `assertNoSymlinkEscape`: the former two\n * defeat traversal, this one defeats reading a file that is lexically inside\n * the project but should not be agent-visible.\n *\n * @public\n */\nexport function isForbiddenPath(input: string): boolean {\n  // T5.6 — lowercase normalization defeats case-only bypass on\n  // case-insensitive filesystems (Windows/macOS-default) where `.ENV`\n  // and `.env` map to the same inode but a case-sensitive string\n  // check passes the former.\n  const normalized = input.replace(/\\\\/g, \"/\").replace(/^\\.\\//, \"\").toLowerCase();\n  if (normalized.length === 0) return false;\n\n  const segments = normalized.split(\"/\").filter((s) => s.length > 0);\n  if (segments.length === 0) return false;\n\n  if (isForbiddenFirstSegment(segments[0]!)) return true;\n  if (isForbiddenBasename(segments[segments.length - 1]!)) return true;\n  return false;\n}\n\nfunction isForbiddenFirstSegment(first: string): boolean {\n  // .env.example is explicitly allowlisted (template safe to read)\n  if (first === \".env.example\") return false;\n  if (first === \".env\") return true;\n  if (/^\\.env\\./.test(first)) return true;\n  if (first === \".git\" || first === \"node_modules\" || first === \".theo\") return true;\n  return SENSITIVE_FIRST_SEGMENTS.has(first);\n}\n\nfunction isForbiddenBasename(basename: string): boolean {\n  if (LOCK_FILES.has(basename)) return true;\n  if (SENSITIVE_BASENAMES.has(basename)) return true;\n  for (const suffix of SENSITIVE_SUFFIXES) {\n    if (basename.endsWith(suffix)) return true;\n  }\n  return false;\n}\n\nconst IDENTIFIER_PATTERN = /^[a-z0-9][a-z0-9\\-_]*$/i;\n\n/**\n * Validate that `input` is a safe path component (skill name, agent ID,\n * namespace, etc.) and return its lowercase form. Strict grammar\n * `^[a-z0-9][a-z0-9-_]*$` rejects path separators, dots, null bytes,\n * whitespace, unicode invisible chars, and any leading `-`/`_`.\n *\n * @param input - User-supplied identifier candidate.\n * @param options.maxLen - Maximum allowed length (default 64).\n * @returns Lowercase form of `input`.\n * @throws `ConfigurationError` with code `invalid_identifier` on rejection.\n *\n * @internal\n */\n/**\n * T1.4 — validate a relative artifact path string BEFORE it is used to look\n * up a fixture or to fetch from PaaS. Rejects every well-known traversal\n * vector at the boundary, throwing `PathTraversalError`.\n *\n * Vectors rejected:\n *  - classic `..` parent-directory traversal (any segment).\n *  - backslash separators (Windows-style `..\\\\windows`).\n *  - URL-encoded `%2e%2e` / `%2E%2E` (double-decoded traversal).\n *  - NUL byte injection (`\\x00`).\n *  - Windows drive letter prefix (`C:`, `D:\\\\...`).\n *  - Home-tilde expansion (`~/`, `~root/...`).\n *  - Absolute paths starting with `/`.\n *\n * Does NOT touch the filesystem — the call is shape-only. Live symlink\n * traversal protection happens via `assertNoSymlinkEscape` at the FS-resolve\n * boundary.\n *\n * @param input - Caller-supplied artifact path.\n * @throws `PathTraversalError` on any rejection.\n *\n * @internal\n */\nexport function validateArtifactPath(input: string): void {\n  rejectKnownPrefixVectors(input);\n  const normalized = decodeAndNormalize(input);\n  rejectParentTraversal(input, normalized);\n}\n\nfunction rejectKnownPrefixVectors(input: string): void {\n  if (input.includes(\"\\x00\")) {\n    throw new PathTraversalError(input, \"<nul-byte>\");\n  }\n  if (input.startsWith(\"/\") || input.startsWith(\"~\")) {\n    throw new PathTraversalError(input, input);\n  }\n  if (/^[A-Za-z]:[\\\\/]?/.test(input)) {\n    throw new PathTraversalError(input, input);\n  }\n}\n\nfunction decodeAndNormalize(input: string): string {\n  // URL-encoded traversal — 2 passes catches `%252e%252e`.\n  // Malformed sequences (decodeURIComponent throws) are themselves a rejection.\n  let decoded = input;\n  for (let i = 0; i < 2; i += 1) {\n    try {\n      const next = decodeURIComponent(decoded);\n      if (next === decoded) break;\n      decoded = next;\n    } catch {\n      throw new PathTraversalError(input, \"<malformed-url-encoding>\");\n    }\n  }\n  // Normalize backslash to forward slash before segment-walking.\n  return decoded.replace(/\\\\/g, \"/\");\n}\n\nfunction rejectParentTraversal(input: string, normalized: string): void {\n  for (const segment of normalized.split(\"/\")) {\n    if (segment === \"..\" || segment === \"..%00\") {\n      throw new PathTraversalError(input, normalized);\n    }\n  }\n  // Defense in depth: literal `..` anywhere in the normalized string.\n  if (normalized.includes(\"..\")) {\n    throw new PathTraversalError(input, normalized);\n  }\n}\n\nexport function sanitizeIdentifier(input: string, options?: { maxLen?: number }): string {\n  const maxLen = options?.maxLen ?? 64;\n  if (input.length === 0 || input.length > maxLen) {\n    throw new ConfigurationError(`Identifier length out of range (1-${maxLen}): \"${input}\"`, {\n      code: \"invalid_identifier\",\n    });\n  }\n  // T5.5 — explicit NUL / control char rejection ahead of the generic\n  // pattern check. The IDENTIFIER_PATTERN regex already excludes these\n  // (they are not in `[a-z0-9\\-_]`), but routing them through the same\n  // helper used by safePathJoin gives operators a precise diagnostic\n  // (\"nul-byte\" / \"control-char-0x..\") instead of the generic\n  // \"invalid characters\" message — making prompt-injection traces\n  // legible per Unbreakable Rule 3.\n  rejectNulAndControlChars(input, \"identifier\");\n  if (!IDENTIFIER_PATTERN.test(input)) {\n    throw new ConfigurationError(`Identifier contains invalid characters: \"${input}\"`, {\n      code: \"invalid_identifier\",\n    });\n  }\n  return input.toLowerCase();\n}\n\n/**\n * Convert ANY opaque id (agent id, run id, conversation id, namespace, email,\n * arbitrary string) into a deterministic, filesystem-safe filename component.\n *\n * Unlike {@link sanitizeIdentifier} (which THROWS on non-conforming input),\n * this is a total function: it NEVER throws on a non-empty string. It returns\n * the lowercased id verbatim when it already matches the safe grammar\n * `^[a-z0-9][a-z0-9-_]*$` and fits `maxLen` (so UUIDs, hashes, and slugs stay\n * human-readable), otherwise a deterministic `h-<16 hex>` sha256 token\n * (collision-resistant and always a valid filename). The output charset is\n * always `[a-z0-9_-]`, safe as a literal path segment on every filesystem.\n *\n * @param id - any opaque identifier (must be a non-empty string)\n * @param options.maxLen - max length for the passthrough branch (default 128).\n *   Ids longer than this are hashed; the hash token itself is always short.\n * @throws ConfigurationError (code `invalid_filename_id`) only on empty input.\n *\n * @example\n *   safeFilenameForId(\"550e8400-e29b-41d4-a716-446655440000\") // passthrough\n *   safeFilenameForId(\"user@example.com\")                      // \"h-<16hex>\"\n *\n * @internal — public via `@theokit/sdk/path-safety`\n */\nexport function safeFilenameForId(id: string, options?: { maxLen?: number }): string {\n  if (id.length === 0) {\n    throw new ConfigurationError(\"Filename id must be a non-empty string\", {\n      code: \"invalid_filename_id\",\n    });\n  }\n  const maxLen = options?.maxLen ?? 128;\n  const lower = id.toLowerCase();\n  if (lower.length <= maxLen && IDENTIFIER_PATTERN.test(lower)) {\n    return lower;\n  }\n  return `h-${createHash(\"sha256\").update(id).digest(\"hex\").slice(0, 16)}`;\n}\n"]}
+{"version":3,"sources":["../src/internal/security/path-guard.ts"],"names":["ConfigurationError","sep","resolve","path","realpathSync","lstatSync","readlinkSync","dirname","createHash"],"mappings":";;;;;;;AAgCO,IAAM,kBAAA,GAAN,cAAiCA,oCAAA,CAAmB;AAAA,EACvC,IAAA,GAAe,oBAAA;AAAA,EAEjC,WAAA,CAAY,OAAe,YAAA,EAAsB;AAC/C,IAAA,KAAA,CAAM,CAAA,wBAAA,EAA2B,KAAK,CAAA,QAAA,EAAM,YAAY,CAAA,CAAA,EAAI;AAAA,MAC1D,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AAYO,IAAM,kBAAA,GAAN,cAAiCA,oCAAA,CAAmB;AAAA,EACvC,IAAA,GAAe,oBAAA;AAAA,EAEjC,YAAY,IAAA,EAAc;AACxB,IAAA,KAAA;AAAA,MACE,SAAS,IAAI,CAAA,qFAAA,CAAA;AAAA,MACb;AAAA,QACE,IAAA,EAAM;AAAA;AACR,KACF;AAAA,EACF;AACF;AAeA,SAAS,QAAA,CAAS,QAAgB,IAAA,EAAuB;AACvD,EAAA,IAAI,MAAA,KAAW,MAAM,OAAO,IAAA;AAC5B,EAAA,MAAM,SAAS,IAAA,CAAK,QAAA,CAASC,QAAG,CAAA,GAAI,OAAO,IAAA,GAAOA,QAAA;AAClD,EAAA,OAAO,MAAA,CAAO,WAAW,MAAM,CAAA;AACjC;AAWO,SAAS,YAAA,CAAa,SAAiB,KAAA,EAAyB;AACrE,EAAA,IAAI,SAAS,EAAA,EAAI;AACf,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACxD;AAKA,EAAA,wBAAA,CAAyB,MAAM,MAAM,CAAA;AACrC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,wBAAA,CAAyB,MAAM,cAAc,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,YAAA,GAAeC,aAAQ,IAAI,CAAA;AACjC,EAAA,MAAM,MAAA,GAASA,YAAA,CAAQ,IAAA,EAAM,GAAG,KAAK,CAAA;AACrC,EAAA,IAAI,CAAC,QAAA,CAAS,MAAA,EAAQ,YAAY,CAAA,EAAG;AACnC,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,CAAM,IAAA,CAAK,GAAG,GAAG,MAAM,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,MAAA;AACT;AAaA,SAAS,wBAAA,CAAyB,OAAe,IAAA,EAAoB;AACnE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,UAAA,CAAW,CAAC,CAAA;AAC/B,IAAA,IAAI,SAAS,CAAA,IAAS,IAAA,IAAQ,KAAQ,IAAA,IAAQ,EAAA,IAAS,SAAS,GAAA,EAAM;AACpE,MAAA,MAAM,KAAA,GAAQ,SAAS,CAAA,GAAO,YAAA,GAAe,mBAAmB,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA,CAAA;AACjF,MAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,EAAG,IAAI,CAAA,EAAA,EAAK,KAAK,IAAI,KAAK,CAAA;AAAA,IACzD;AAAA,EACF;AACF;AAoBO,SAAS,qBAAA,CAAsBC,QAAc,IAAA,EAAoB;AAItE,EAAA,wBAAA,CAAyBA,QAAM,MAAM,CAAA;AACrC,EAAA,wBAAA,CAAyB,MAAM,MAAM,CAAA;AAErC,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAeC,gBAAa,IAAI,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AAEN,IAAA,YAAA,GAAeF,aAAQ,IAAI,CAAA;AAAA,EAC7B;AAQA,EAAA,MAAM,QAAA,GAAW,0BAA0BC,MAAI,CAAA;AAC/C,EAAA,IAAI,aAAa,MAAA,EAAW;AAE5B,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,YAAY,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,QAAA,EAAWA,MAAI,IAAI,QAAQ,CAAA;AAAA,EAC1D;AACF;AAUA,SAAS,0BAA0BA,MAAA,EAAkC;AAEnE,EAAA,IAAI;AACF,IAAA,OAAOC,gBAAaD,MAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AAAA,EAER;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAcE,aAAUF,MAAI,CAAA;AAClC,IAAA,IAAI,IAAA,CAAK,gBAAe,EAAG;AACzB,MAAA,MAAM,MAAA,GAASG,gBAAaH,MAAI,CAAA;AAGhC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0BI,YAAA,CAAQJ,MAAI,CAAC,CAAA;AAC1D,MAAA,MAAM,UAAA,GAAa,UAAA,IAAcI,YAAA,CAAQJ,MAAI,CAAA;AAC7C,MAAA,OAAOD,YAAA,CAAQ,YAAY,MAAM,CAAA;AAAA,IACnC;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAIA,EAAA,IAAI,MAAA,GAASK,aAAQJ,MAAI,CAAA;AACzB,EAAA,IAAI,MAAA,GAASA,MAAA,CAAK,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AACrC,EAAA,OAAO,MAAA,KAAWI,YAAA,CAAQ,MAAM,CAAA,EAAG;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAOH,gBAAa,MAAM,CAAA;AAEhC,MAAA,OAAOF,YAAA,CAAQ,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IACnC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAA,GAASC,MAAA,CAAK,KAAA,CAAMI,YAAA,CAAQ,MAAM,EAAE,MAAM,CAAA;AAC1C,MAAA,MAAA,GAASA,aAAQ,MAAM,CAAA;AAAA,IACzB;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,IAAM,UAAA,uBAAiB,GAAA,CAAI,CAAC,kBAAkB,mBAAA,EAAqB,WAAA,EAAa,WAAW,CAAC,CAAA;AAM5F,IAAM,wBAAA,uBAA+B,GAAA,CAAI;AAAA,EACvC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAID,IAAM,mBAAA,uBAA0B,GAAA,CAAI;AAAA,EAClC,QAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,aAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAID,IAAM,kBAAA,GAAqB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAuBnD,SAAS,gBAAgB,KAAA,EAAwB;AAKtD,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,GAAG,EAAE,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA,CAAE,WAAA,EAAY;AAC9E,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAEpC,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AACjE,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAElC,EAAA,IAAI,uBAAA,CAAwB,QAAA,CAAS,CAAC,CAAE,GAAG,OAAO,IAAA;AAClD,EAAA,IAAI,oBAAoB,QAAA,CAAS,QAAA,CAAS,SAAS,CAAC,CAAE,GAAG,OAAO,IAAA;AAChE,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,wBAAwB,KAAA,EAAwB;AAEvD,EAAA,IAAI,KAAA,KAAU,gBAAgB,OAAO,KAAA;AACrC,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,IAAA;AAC7B,EAAA,IAAI,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AACnC,EAAA,IAAI,UAAU,MAAA,IAAU,KAAA,KAAU,cAAA,IAAkB,KAAA,KAAU,SAAS,OAAO,IAAA;AAC9E,EAAA,OAAO,wBAAA,CAAyB,IAAI,KAAK,CAAA;AAC3C;AAEA,SAAS,oBAAoB,QAAA,EAA2B;AACtD,EAAA,IAAI,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA,EAAG,OAAO,IAAA;AACrC,EAAA,IAAI,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,KAAA,MAAW,UAAU,kBAAA,EAAoB;AACvC,IAAA,IAAI,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,IAAA;AAAA,EACxC;AACA,EAAA,OAAO,KAAA;AACT;AAEA,IAAM,kBAAA,GAAqB,yBAAA;AAsCpB,SAAS,qBAAqB,KAAA,EAAqB;AACxD,EAAA,wBAAA,CAAyB,KAAK,CAAA;AAC9B,EAAA,MAAM,UAAA,GAAa,mBAAmB,KAAK,CAAA;AAC3C,EAAA,qBAAA,CAAsB,OAAO,UAAU,CAAA;AACzC;AAEA,SAAS,yBAAyB,KAAA,EAAqB;AACrD,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,IAAM,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,YAAY,CAAA;AAAA,EAClD;AACA,EAAA,IAAI,MAAM,UAAA,CAAW,GAAG,KAAK,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,EAC3C;AACA,EAAA,IAAI,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,EAC3C;AACF;AAEA,SAAS,mBAAmB,KAAA,EAAuB;AAGjD,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,KAAK,CAAA,EAAG;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,mBAAmB,OAAO,CAAA;AACvC,MAAA,IAAI,SAAS,OAAA,EAAS;AACtB,MAAA,OAAA,GAAU,IAAA;AAAA,IACZ,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,0BAA0B,CAAA;AAAA,IAChE;AAAA,EACF;AAEA,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AACnC;AAEA,SAAS,qBAAA,CAAsB,OAAe,UAAA,EAA0B;AACtE,EAAA,KAAA,MAAW,OAAA,IAAW,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,EAAG;AAC3C,IAAA,IAAI,OAAA,KAAY,IAAA,IAAQ,OAAA,KAAY,OAAA,EAAS;AAC3C,MAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,UAAU,CAAA;AAAA,IAChD;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,QAAA,CAAS,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,UAAU,CAAA;AAAA,EAChD;AACF;AAEO,SAAS,kBAAA,CAAmB,OAAe,OAAA,EAAuC;AACvF,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,EAAA;AAClC,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,SAAS,MAAA,EAAQ;AAC/C,IAAA,MAAM,IAAIP,oCAAA,CAAmB,CAAA,kCAAA,EAAqC,MAAM,CAAA,IAAA,EAAO,KAAK,CAAA,CAAA,CAAA,EAAK;AAAA,MACvF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAQA,EAAA,wBAAA,CAAyB,OAAO,YAAY,CAAA;AAC5C,EAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AACnC,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,yCAAA,EAA4C,KAAK,CAAA,CAAA,CAAA,EAAK;AAAA,MACjF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,MAAM,WAAA,EAAY;AAC3B;AAyBO,SAAS,iBAAA,CAAkB,IAAY,OAAA,EAAuC;AACnF,EAAA,IAAI,EAAA,CAAG,WAAW,CAAA,EAAG;AACnB,IAAA,MAAM,IAAIA,qCAAmB,wCAAA,EAA0C;AAAA,MACrE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,GAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,GAAG,WAAA,EAAY;AAC7B,EAAA,IAAI,MAAM,MAAA,IAAU,MAAA,IAAU,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5D,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,CAAA,EAAA,EAAKQ,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,EAAE,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AACxE","file":"chunk-ZAKTZ5B4.cjs","sourcesContent":["/**\n * Canonical path-guard module (ADRs D79-D81).\n *\n * Three primitives + one typed error:\n *   - `safePathJoin(base, ...parts)` — resolve THEN prefix-check (ADR D80).\n *   - `assertNoSymlinkEscape(path, base)` — `realpathSync` resolves entire\n *     symlink chain (EC-1 fix; Hermes v0.2 #386, #61).\n *   - `sanitizeIdentifier(input, { maxLen })` — strict grammar\n *     `^[a-z0-9][a-z0-9-_]*$` (ADR D81; case-insensitive on input,\n *     lowercase on output).\n *   - `PathTraversalError` — extends ConfigurationError with code\n *     `path_traversal` (ADR D65: no new hierarchy).\n *\n * Wire at all sites where user input becomes a path. CI lint gate\n * `tests/lint/no-unguarded-path-input.test.ts` prevents regression\n * (ADR D85).\n *\n * @internal\n */\n\nimport { createHash } from \"node:crypto\";\nimport { lstatSync, readlinkSync, realpathSync, type Stats } from \"node:fs\";\nimport { dirname, resolve, sep } from \"node:path\";\n\nimport { ConfigurationError } from \"../../errors.js\";\n\n/**\n * Thrown when a path operation would escape its allowed base directory.\n * Extends `ConfigurationError` (no new error hierarchy per ADR D65).\n *\n * @internal\n */\nexport class PathTraversalError extends ConfigurationError {\n  override readonly name: string = \"PathTraversalError\";\n\n  constructor(input: string, resolvedPath: string) {\n    super(`Path traversal attempt: ${input} → ${resolvedPath}`, {\n      code: \"path_traversal\",\n    });\n  }\n}\n\n/**\n * Thrown when an agent tool is asked to read or write a sensitive path\n * that the blocklist forbids (`.env`, `.git/`, `node_modules/`, `.theo/`,\n * lock files). Distinct from `PathTraversalError` because the path is\n * lexically inside the project — it is just sensitive.\n *\n * Extends `ConfigurationError` (no new error hierarchy per ADR D65).\n *\n * @public\n */\nexport class ForbiddenPathError extends ConfigurationError {\n  override readonly name: string = \"ForbiddenPathError\";\n\n  constructor(path: string) {\n    super(\n      `Path '${path}' is in the sensitive-file blocklist (.env, .git/, node_modules/, .theo/, lock files)`,\n      {\n        code: \"forbidden_path\",\n      },\n    );\n  }\n}\n\n/**\n * Is `target` the same as `base`, or strictly under it?\n *\n * The prefix must not double the separator. `resolve` strips a trailing `sep` from every base\n * EXCEPT the filesystem root, where `resolve(sep) === sep`; there `base + sep` would be `//`, which\n * no absolute path starts with, so a root base rejected EVERY path (#149). Only the root takes that\n * branch — for any other base the prefix is unchanged, so containment is not weakened.\n *\n * Both containment checks in this module go through here: they had the same defect and were fixed\n * one at a time, which is exactly how the two drifted apart in the first place.\n *\n * Both arguments MUST already be resolved absolute paths.\n */\nfunction isInside(target: string, base: string): boolean {\n  if (target === base) return true;\n  const prefix = base.endsWith(sep) ? base : base + sep;\n  return target.startsWith(prefix);\n}\n\n/**\n * Join `base` with `...parts` and ensure the resolved absolute path stays\n * under `base`. Resolves FIRST, then prefix-checks (ADR D80) — prevents\n * normalized-escape bypasses like `subdir/.\\\\./bar`.\n *\n * Returns the safe absolute path. Throws `PathTraversalError` if escape.\n *\n * @internal\n */\nexport function safePathJoin(base: string, ...parts: string[]): string {\n  if (base === \"\") {\n    throw new Error(\"safePathJoin: base must be non-empty\");\n  }\n  // T5.5 — NUL byte + C0/DEL control char rejection at the boundary.\n  // Apply before path resolution so a malicious input never reaches\n  // `resolve` (which on some platforms behaved unexpectedly with NUL\n  // and in N-API callers historically silently truncated).\n  rejectNulAndControlChars(base, \"base\");\n  for (const part of parts) {\n    rejectNulAndControlChars(part, \"path segment\");\n  }\n  const baseResolved = resolve(base);\n  const target = resolve(base, ...parts);\n  if (!isInside(target, baseResolved)) {\n    throw new PathTraversalError(parts.join(\"/\"), target);\n  }\n  return target;\n}\n\n/**\n * T5.5 — Reject NUL (`\\x00`) and C0/DEL control characters\n * (`\\x01-\\x1F`, `\\x7F`) in any path-shaped or identifier-shaped input.\n * Centralizes the check so every public path-guard / sanitize entrypoint\n * shares the same defense.\n *\n * Throws `PathTraversalError` (the same shape as other path-shape\n * rejections) so callers don't need to learn a new error class.\n *\n * @internal\n */\nfunction rejectNulAndControlChars(input: string, role: string): void {\n  for (let i = 0; i < input.length; i++) {\n    const code = input.charCodeAt(i);\n    if (code === 0x00 || (code >= 0x01 && code <= 0x1f) || code === 0x7f) {\n      const label = code === 0x00 ? \"<nul-byte>\" : `<control-char-0x${code.toString(16)}>`;\n      throw new PathTraversalError(`${role}: ${input}`, label);\n    }\n  }\n}\n\n/**\n * Assert that `path` — including every directory component in the chain —\n * stays under `base` after symlink resolution. No-op when nothing on the\n * path exists yet.\n *\n * Two-bug history:\n *   1. **EC-1** (original fix, kept): a multi-level symlink chain A → B → C\n *      must be resolved end-to-end. `realpathSync` does this in 1 syscall.\n *   2. **Defence-in-depth** (added v1.x): the previous implementation only\n *      called `lstatSync(path)` on the terminal component. If an INTERMEDIATE\n *      directory was a symlink (`base/inner-symlink → /outside`), `lstat` on\n *      `base/inner-symlink/file.txt` followed the symlink and reported the\n *      regular file — escape went undetected. Fix: walk up to the nearest\n *      existing ancestor and `realpath` THAT, then re-attach the suffix and\n *      check the result against the canonical base.\n *\n * @internal\n */\nexport function assertNoSymlinkEscape(path: string, base: string): void {\n  // T5.5 — reject NUL / control chars before any FS call (a NUL byte\n  // in the path used to silently truncate at the C boundary on legacy\n  // libc — defense in depth even on modern Node).\n  rejectNulAndControlChars(path, \"path\");\n  rejectNulAndControlChars(base, \"base\");\n  // Canonical base — symlinks in the base path itself are absorbed once here.\n  let baseResolved: string;\n  try {\n    baseResolved = realpathSync(base);\n  } catch {\n    // base doesn't exist as a real directory yet — fall back to lexical resolve.\n    baseResolved = resolve(base);\n  }\n\n  // Find the deepest ancestor of `path` that exists, then realpath it.\n  // Anything from there onward is \"not yet on disk\" and contributes only\n  // its lexical suffix. This covers three cases:\n  //   - path exists (regular file or symlink at any depth) → realpath the full path\n  //   - path doesn't exist but intermediate dir is a symlink → realpath the ancestor\n  //   - nothing on the path exists → no escape risk (return)\n  const resolved = realpathOfDeepestExisting(path);\n  if (resolved === undefined) return; // path has no existing prefix — nothing to attack\n\n  if (!isInside(resolved, baseResolved)) {\n    throw new PathTraversalError(`symlink ${path}`, resolved);\n  }\n}\n\n/**\n * Find the deepest ancestor of `path` that exists on disk, resolve all\n * symlinks in that ancestor via `realpathSync`, and re-attach the\n * lexical suffix. Returns `undefined` when no ancestor exists.\n *\n * Handles dangling symlinks: if the terminal IS a symlink but its target\n * is missing, we still detect escape via `readlinkSync` + parent resolve.\n */\nfunction realpathOfDeepestExisting(path: string): string | undefined {\n  // First try the full path — the common case.\n  try {\n    return realpathSync(path);\n  } catch {\n    // Not resolvable. Two sub-cases.\n  }\n\n  // Sub-case A: terminal is a dangling symlink.\n  try {\n    const stat: Stats = lstatSync(path);\n    if (stat.isSymbolicLink()) {\n      const target = readlinkSync(path);\n      // Resolve target relative to the REAL parent dir, so intermediate\n      // symlinks in the parent chain are absorbed.\n      const parentReal = realpathOfDeepestExisting(dirname(path));\n      const parentBase = parentReal ?? dirname(path);\n      return resolve(parentBase, target);\n    }\n  } catch {\n    // lstat failed too — terminal doesn't exist at all.\n  }\n\n  // Sub-case B: walk up to the nearest existing ancestor, then re-attach\n  // the suffix lexically.\n  let cursor = dirname(path);\n  let suffix = path.slice(cursor.length);\n  while (cursor !== dirname(cursor)) {\n    try {\n      const real = realpathSync(cursor);\n      // Reconstruct: ancestor's realpath + remaining (still-lexical) suffix\n      return resolve(real, `.${suffix}`);\n    } catch {\n      suffix = path.slice(dirname(cursor).length);\n      cursor = dirname(cursor);\n    }\n  }\n  // Reached filesystem root without finding any existing ancestor.\n  return undefined;\n}\n\nconst LOCK_FILES = new Set([\"pnpm-lock.yaml\", \"package-lock.json\", \"yarn.lock\", \"bun.lockb\"]);\n\n// T5.6 — top-level credential dot-dirs / dot-files. Matching against\n// the FIRST path segment (lowercase). Adding any entry here costs a\n// CHANGELOG note + an explicit case-fold test (entries are lowercased\n// at module load).\nconst SENSITIVE_FIRST_SEGMENTS = new Set([\n  \".ssh\",\n  \".aws\",\n  \".docker\",\n  \".kube\",\n  \".npmrc\",\n  \".netrc\",\n  \".pgpass\",\n]);\n\n// T5.6 — credential basenames blocked at ANY depth (lowercase). Catches\n// the developer-laptop case where an agent recurses into a subdir.\nconst SENSITIVE_BASENAMES = new Set([\n  \"id_rsa\",\n  \"id_ed25519\",\n  \"id_ecdsa\",\n  \"id_dsa\",\n  \"authorized_keys\",\n  \"known_hosts\",\n  \".npmrc\",\n  \".netrc\",\n  \".pgpass\",\n]);\n\n// T5.6 — extension suffixes blocked at ANY depth (lowercase). Covers\n// the entire `*.pem` / `*.key` private-material family.\nconst SENSITIVE_SUFFIXES = [\".pem\", \".key\", \".p12\", \".pfx\"];\n\n/**\n * Decide whether a project-relative path points to a known-sensitive file\n * that a coding agent must not read or write.\n *\n * Universal blocklist (works for any agent operating on a project tree):\n *\n *   - `.env`, `.env.<anything>` — except `.env.example` (template safe to read)\n *   - `.git/` — version control internals\n *   - `node_modules/` — dependency cache (changes don't belong to the user)\n *   - `.theo/` — TheoKit build artefacts / state\n *   - Lock files at any depth: `pnpm-lock.yaml`, `package-lock.json`,\n *     `yarn.lock`, `bun.lockb`\n *\n * Operates on path segments (forward-slash normalized). Cross-platform safe.\n *\n * Use together with `safePathJoin` + `assertNoSymlinkEscape`: the former two\n * defeat traversal, this one defeats reading a file that is lexically inside\n * the project but should not be agent-visible.\n *\n * @public\n */\nexport function isForbiddenPath(input: string): boolean {\n  // T5.6 — lowercase normalization defeats case-only bypass on\n  // case-insensitive filesystems (Windows/macOS-default) where `.ENV`\n  // and `.env` map to the same inode but a case-sensitive string\n  // check passes the former.\n  const normalized = input.replace(/\\\\/g, \"/\").replace(/^\\.\\//, \"\").toLowerCase();\n  if (normalized.length === 0) return false;\n\n  const segments = normalized.split(\"/\").filter((s) => s.length > 0);\n  if (segments.length === 0) return false;\n\n  if (isForbiddenFirstSegment(segments[0]!)) return true;\n  if (isForbiddenBasename(segments[segments.length - 1]!)) return true;\n  return false;\n}\n\nfunction isForbiddenFirstSegment(first: string): boolean {\n  // .env.example is explicitly allowlisted (template safe to read)\n  if (first === \".env.example\") return false;\n  if (first === \".env\") return true;\n  if (/^\\.env\\./.test(first)) return true;\n  if (first === \".git\" || first === \"node_modules\" || first === \".theo\") return true;\n  return SENSITIVE_FIRST_SEGMENTS.has(first);\n}\n\nfunction isForbiddenBasename(basename: string): boolean {\n  if (LOCK_FILES.has(basename)) return true;\n  if (SENSITIVE_BASENAMES.has(basename)) return true;\n  for (const suffix of SENSITIVE_SUFFIXES) {\n    if (basename.endsWith(suffix)) return true;\n  }\n  return false;\n}\n\nconst IDENTIFIER_PATTERN = /^[a-z0-9][a-z0-9\\-_]*$/i;\n\n/**\n * Validate that `input` is a safe path component (skill name, agent ID,\n * namespace, etc.) and return its lowercase form. Strict grammar\n * `^[a-z0-9][a-z0-9-_]*$` rejects path separators, dots, null bytes,\n * whitespace, unicode invisible chars, and any leading `-`/`_`.\n *\n * @param input - User-supplied identifier candidate.\n * @param options.maxLen - Maximum allowed length (default 64).\n * @returns Lowercase form of `input`.\n * @throws `ConfigurationError` with code `invalid_identifier` on rejection.\n *\n * @internal\n */\n/**\n * T1.4 — validate a relative artifact path string BEFORE it is used to look\n * up a fixture or to fetch from PaaS. Rejects every well-known traversal\n * vector at the boundary, throwing `PathTraversalError`.\n *\n * Vectors rejected:\n *  - classic `..` parent-directory traversal (any segment).\n *  - backslash separators (Windows-style `..\\\\windows`).\n *  - URL-encoded `%2e%2e` / `%2E%2E` (double-decoded traversal).\n *  - NUL byte injection (`\\x00`).\n *  - Windows drive letter prefix (`C:`, `D:\\\\...`).\n *  - Home-tilde expansion (`~/`, `~root/...`).\n *  - Absolute paths starting with `/`.\n *\n * Does NOT touch the filesystem — the call is shape-only. Live symlink\n * traversal protection happens via `assertNoSymlinkEscape` at the FS-resolve\n * boundary.\n *\n * @param input - Caller-supplied artifact path.\n * @throws `PathTraversalError` on any rejection.\n *\n * @internal\n */\nexport function validateArtifactPath(input: string): void {\n  rejectKnownPrefixVectors(input);\n  const normalized = decodeAndNormalize(input);\n  rejectParentTraversal(input, normalized);\n}\n\nfunction rejectKnownPrefixVectors(input: string): void {\n  if (input.includes(\"\\x00\")) {\n    throw new PathTraversalError(input, \"<nul-byte>\");\n  }\n  if (input.startsWith(\"/\") || input.startsWith(\"~\")) {\n    throw new PathTraversalError(input, input);\n  }\n  if (/^[A-Za-z]:[\\\\/]?/.test(input)) {\n    throw new PathTraversalError(input, input);\n  }\n}\n\nfunction decodeAndNormalize(input: string): string {\n  // URL-encoded traversal — 2 passes catches `%252e%252e`.\n  // Malformed sequences (decodeURIComponent throws) are themselves a rejection.\n  let decoded = input;\n  for (let i = 0; i < 2; i += 1) {\n    try {\n      const next = decodeURIComponent(decoded);\n      if (next === decoded) break;\n      decoded = next;\n    } catch {\n      throw new PathTraversalError(input, \"<malformed-url-encoding>\");\n    }\n  }\n  // Normalize backslash to forward slash before segment-walking.\n  return decoded.replace(/\\\\/g, \"/\");\n}\n\nfunction rejectParentTraversal(input: string, normalized: string): void {\n  for (const segment of normalized.split(\"/\")) {\n    if (segment === \"..\" || segment === \"..%00\") {\n      throw new PathTraversalError(input, normalized);\n    }\n  }\n  // Defense in depth: literal `..` anywhere in the normalized string.\n  if (normalized.includes(\"..\")) {\n    throw new PathTraversalError(input, normalized);\n  }\n}\n\nexport function sanitizeIdentifier(input: string, options?: { maxLen?: number }): string {\n  const maxLen = options?.maxLen ?? 64;\n  if (input.length === 0 || input.length > maxLen) {\n    throw new ConfigurationError(`Identifier length out of range (1-${maxLen}): \"${input}\"`, {\n      code: \"invalid_identifier\",\n    });\n  }\n  // T5.5 — explicit NUL / control char rejection ahead of the generic\n  // pattern check. The IDENTIFIER_PATTERN regex already excludes these\n  // (they are not in `[a-z0-9\\-_]`), but routing them through the same\n  // helper used by safePathJoin gives operators a precise diagnostic\n  // (\"nul-byte\" / \"control-char-0x..\") instead of the generic\n  // \"invalid characters\" message — making prompt-injection traces\n  // legible per Unbreakable Rule 3.\n  rejectNulAndControlChars(input, \"identifier\");\n  if (!IDENTIFIER_PATTERN.test(input)) {\n    throw new ConfigurationError(`Identifier contains invalid characters: \"${input}\"`, {\n      code: \"invalid_identifier\",\n    });\n  }\n  return input.toLowerCase();\n}\n\n/**\n * Convert ANY opaque id (agent id, run id, conversation id, namespace, email,\n * arbitrary string) into a deterministic, filesystem-safe filename component.\n *\n * Unlike {@link sanitizeIdentifier} (which THROWS on non-conforming input),\n * this is a total function: it NEVER throws on a non-empty string. It returns\n * the lowercased id verbatim when it already matches the safe grammar\n * `^[a-z0-9][a-z0-9-_]*$` and fits `maxLen` (so UUIDs, hashes, and slugs stay\n * human-readable), otherwise a deterministic `h-<16 hex>` sha256 token\n * (collision-resistant and always a valid filename). The output charset is\n * always `[a-z0-9_-]`, safe as a literal path segment on every filesystem.\n *\n * @param id - any opaque identifier (must be a non-empty string)\n * @param options.maxLen - max length for the passthrough branch (default 128).\n *   Ids longer than this are hashed; the hash token itself is always short.\n * @throws ConfigurationError (code `invalid_filename_id`) only on empty input.\n *\n * @example\n *   safeFilenameForId(\"550e8400-e29b-41d4-a716-446655440000\") // passthrough\n *   safeFilenameForId(\"user@example.com\")                      // \"h-<16hex>\"\n *\n * @internal — public via `@theokit/sdk/path-safety`\n */\nexport function safeFilenameForId(id: string, options?: { maxLen?: number }): string {\n  if (id.length === 0) {\n    throw new ConfigurationError(\"Filename id must be a non-empty string\", {\n      code: \"invalid_filename_id\",\n    });\n  }\n  const maxLen = options?.maxLen ?? 128;\n  const lower = id.toLowerCase();\n  if (lower.length <= maxLen && IDENTIFIER_PATTERN.test(lower)) {\n    return lower;\n  }\n  return `h-${createHash(\"sha256\").update(id).digest(\"hex\").slice(0, 16)}`;\n}\n"]}

package/dist/compact-session-AZU2LEAE.js

@@ -0,0 +1,18 @@
+export { COMPACT_SUMMARY_MARKER, COMPACT_USER_MESSAGE_MAX_TOKENS, autoCompactIfNeeded, buildDefaultSummarizer, compactSessionTranscript, isCompactSummary, resolveSummarizerRoute, shouldAutoCompact } from './chunk-X627TO3A.js';
+import './chunk-MI3OKONE.js';
+import './chunk-5KOW3GLE.js';
+import './chunk-FUP3ZA5T.js';
+import './chunk-FD2UT76F.js';
+import './chunk-U54XCYG3.js';
+import './chunk-EYUZZXHZ.js';
+import './chunk-2XLKLVVR.js';
+import './chunk-5XPKYDK7.js';
+import './chunk-XZ7PO2FM.js';
+import './chunk-23HI77BZ.js';
+import './chunk-AKMPQJPX.js';
+import './chunk-5NBUH3NO.js';
+import './chunk-IEKSEAIV.js';
+import './chunk-VQ33XLC6.js';
+import './chunk-RNCN2TTP.js';
+//# sourceMappingURL=compact-session-AZU2LEAE.js.map
+//# sourceMappingURL=compact-session-AZU2LEAE.js.map

package/dist/{compact-session-GKA7GFVT.js.map → compact-session-AZU2LEAE.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"compact-session-GKA7GFVT.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"compact-session-AZU2LEAE.js"}

package/dist/compact-session-TRCEYCPG.cjs

@@ -0,0 +1,55 @@
+'use strict';
+
+var chunkSEWAPWAF_cjs = require('./chunk-SEWAPWAF.cjs');
+require('./chunk-ELYGL52R.cjs');
+require('./chunk-BURYFNOM.cjs');
+require('./chunk-U53AYSHS.cjs');
+require('./chunk-MUUQ2WFJ.cjs');
+require('./chunk-6JSIEDKL.cjs');
+require('./chunk-NJVV5OAV.cjs');
+require('./chunk-YLQQX5W2.cjs');
+require('./chunk-33B2BSME.cjs');
+require('./chunk-OVGNXGCK.cjs');
+require('./chunk-T6KFGMNY.cjs');
+require('./chunk-V7CA3CX5.cjs');
+require('./chunk-C6Y6CWYD.cjs');
+require('./chunk-ZAKTZ5B4.cjs');
+require('./chunk-E7WWIX34.cjs');
+require('./chunk-A76OFN2B.cjs');
+
+
+
+Object.defineProperty(exports, "COMPACT_SUMMARY_MARKER", {
+  enumerable: true,
+  get: function () { return chunkSEWAPWAF_cjs.COMPACT_SUMMARY_MARKER; }
+});
+Object.defineProperty(exports, "COMPACT_USER_MESSAGE_MAX_TOKENS", {
+  enumerable: true,
+  get: function () { return chunkSEWAPWAF_cjs.COMPACT_USER_MESSAGE_MAX_TOKENS; }
+});
+Object.defineProperty(exports, "autoCompactIfNeeded", {
+  enumerable: true,
+  get: function () { return chunkSEWAPWAF_cjs.autoCompactIfNeeded; }
+});
+Object.defineProperty(exports, "buildDefaultSummarizer", {
+  enumerable: true,
+  get: function () { return chunkSEWAPWAF_cjs.buildDefaultSummarizer; }
+});
+Object.defineProperty(exports, "compactSessionTranscript", {
+  enumerable: true,
+  get: function () { return chunkSEWAPWAF_cjs.compactSessionTranscript; }
+});
+Object.defineProperty(exports, "isCompactSummary", {
+  enumerable: true,
+  get: function () { return chunkSEWAPWAF_cjs.isCompactSummary; }
+});
+Object.defineProperty(exports, "resolveSummarizerRoute", {
+  enumerable: true,
+  get: function () { return chunkSEWAPWAF_cjs.resolveSummarizerRoute; }
+});
+Object.defineProperty(exports, "shouldAutoCompact", {
+  enumerable: true,
+  get: function () { return chunkSEWAPWAF_cjs.shouldAutoCompact; }
+});
+//# sourceMappingURL=compact-session-TRCEYCPG.cjs.map
+//# sourceMappingURL=compact-session-TRCEYCPG.cjs.map

package/dist/{compact-session-XMP6OGY3.cjs.map → compact-session-TRCEYCPG.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"compact-session-XMP6OGY3.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"compact-session-TRCEYCPG.cjs"}

package/dist/compaction.cjs

@@ -1,62 +1,62 @@
 'use strict';
 
-var chunkJ6T5LWJ4_cjs = require('./chunk-J6T5LWJ4.cjs');
-require('./chunk-IHFNRNTJ.cjs');
-require('./chunk-BCQ3E2ZG.cjs');
+var chunkOVGNXGCK_cjs = require('./chunk-OVGNXGCK.cjs');
+require('./chunk-E7WWIX34.cjs');
+require('./chunk-A76OFN2B.cjs');
 
 
 
 Object.defineProperty(exports, "ABSOLUTE_CONTEXT_WINDOW_CAP", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.ABSOLUTE_CONTEXT_WINDOW_CAP; }
+  get: function () { return chunkOVGNXGCK_cjs.ABSOLUTE_CONTEXT_WINDOW_CAP; }
 });
 Object.defineProperty(exports, "CHECKPOINT_MARKER", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.CHECKPOINT_MARKER; }
+  get: function () { return chunkOVGNXGCK_cjs.CHECKPOINT_MARKER; }
 });
 Object.defineProperty(exports, "CONTEXT_WINDOW_FLOOR", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.CONTEXT_WINDOW_FLOOR; }
+  get: function () { return chunkOVGNXGCK_cjs.CONTEXT_WINDOW_FLOOR; }
 });
 Object.defineProperty(exports, "CONTEXT_WINDOW_MARGIN", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.CONTEXT_WINDOW_MARGIN; }
+  get: function () { return chunkOVGNXGCK_cjs.CONTEXT_WINDOW_MARGIN; }
 });
 Object.defineProperty(exports, "ContextWindowMarginError", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.ContextWindowMarginError; }
+  get: function () { return chunkOVGNXGCK_cjs.ContextWindowMarginError; }
 });
 Object.defineProperty(exports, "SUMMARY_TEMPLATE", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.SUMMARY_TEMPLATE; }
+  get: function () { return chunkOVGNXGCK_cjs.SUMMARY_TEMPLATE; }
 });
 Object.defineProperty(exports, "buildCheckpoint", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.buildCheckpoint; }
+  get: function () { return chunkOVGNXGCK_cjs.buildCheckpoint; }
 });
 Object.defineProperty(exports, "compactTranscript", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.compactTranscript; }
+  get: function () { return chunkOVGNXGCK_cjs.compactTranscript; }
 });
 Object.defineProperty(exports, "estimateTokens", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.estimateTokens; }
+  get: function () { return chunkOVGNXGCK_cjs.estimateTokens; }
 });
 Object.defineProperty(exports, "filterFromLatestCheckpoint", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.filterFromLatestCheckpoint; }
+  get: function () { return chunkOVGNXGCK_cjs.filterFromLatestCheckpoint; }
 });
 Object.defineProperty(exports, "isContextOverflowError", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.isContextOverflowError; }
+  get: function () { return chunkOVGNXGCK_cjs.isContextOverflowError; }
 });
 Object.defineProperty(exports, "resolveEffectiveContextWindow", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.resolveEffectiveContextWindow; }
+  get: function () { return chunkOVGNXGCK_cjs.resolveEffectiveContextWindow; }
 });
 Object.defineProperty(exports, "shouldCompact", {
   enumerable: true,
-  get: function () { return chunkJ6T5LWJ4_cjs.shouldCompact; }
+  get: function () { return chunkOVGNXGCK_cjs.shouldCompact; }
 });
 //# sourceMappingURL=compaction.cjs.map
 //# sourceMappingURL=compaction.cjs.map

package/dist/compaction.js

@@ -1,5 +1,5 @@
-export { ABSOLUTE_CONTEXT_WINDOW_CAP, CHECKPOINT_MARKER, CONTEXT_WINDOW_FLOOR, CONTEXT_WINDOW_MARGIN, ContextWindowMarginError, SUMMARY_TEMPLATE, buildCheckpoint, compactTranscript, estimateTokens, filterFromLatestCheckpoint, isContextOverflowError, resolveEffectiveContextWindow, shouldCompact } from './chunk-65ONFZWM.js';
-import './chunk-SG5ZWT6C.js';
-import './chunk-IVSD7L22.js';
+export { ABSOLUTE_CONTEXT_WINDOW_CAP, CHECKPOINT_MARKER, CONTEXT_WINDOW_FLOOR, CONTEXT_WINDOW_MARGIN, ContextWindowMarginError, SUMMARY_TEMPLATE, buildCheckpoint, compactTranscript, estimateTokens, filterFromLatestCheckpoint, isContextOverflowError, resolveEffectiveContextWindow, shouldCompact } from './chunk-XZ7PO2FM.js';
+import './chunk-VQ33XLC6.js';
+import './chunk-RNCN2TTP.js';
 //# sourceMappingURL=compaction.js.map
 //# sourceMappingURL=compaction.js.map

package/dist/concurrency.cjs

@@ -1,22 +1,22 @@
 'use strict';
 
-var chunk7OLG7VI4_cjs = require('./chunk-7OLG7VI4.cjs');
-var chunkTIMPJL5V_cjs = require('./chunk-TIMPJL5V.cjs');
-require('./chunk-IHFNRNTJ.cjs');
-require('./chunk-BCQ3E2ZG.cjs');
+var chunkRHQJX3EI_cjs = require('./chunk-RHQJX3EI.cjs');
+var chunkPDOLUFGY_cjs = require('./chunk-PDOLUFGY.cjs');
+require('./chunk-E7WWIX34.cjs');
+require('./chunk-A76OFN2B.cjs');
 
 // src/concurrency.ts
 var Semaphore = class {
   constructor() {
   }
   static create(permits) {
-    return chunkTIMPJL5V_cjs.createSemaphore(permits);
+    return chunkPDOLUFGY_cjs.createSemaphore(permits);
   }
 };
 
 Object.defineProperty(exports, "mapWithConcurrency", {
   enumerable: true,
-  get: function () { return chunk7OLG7VI4_cjs.mapWithConcurrency; }
+  get: function () { return chunkRHQJX3EI_cjs.mapWithConcurrency; }
 });
 exports.Semaphore = Semaphore;
 //# sourceMappingURL=concurrency.cjs.map

package/dist/concurrency.js

@@ -1,7 +1,7 @@
-export { mapWithConcurrency } from './chunk-LGILIGV3.js';
-import { createSemaphore } from './chunk-PI4RO4GR.js';
-import './chunk-SG5ZWT6C.js';
-import './chunk-IVSD7L22.js';
+export { mapWithConcurrency } from './chunk-XKGOIGTJ.js';
+import { createSemaphore } from './chunk-F4SQTWVR.js';
+import './chunk-VQ33XLC6.js';
+import './chunk-RNCN2TTP.js';
 
 // src/concurrency.ts
 var Semaphore = class {

package/dist/context-DNFT4B5D.cjs

@@ -0,0 +1,22 @@
+'use strict';
+
+var chunkK6TWHNT4_cjs = require('./chunk-K6TWHNT4.cjs');
+require('./chunk-E7WWIX34.cjs');
+require('./chunk-A76OFN2B.cjs');
+
+
+
+Object.defineProperty(exports, "currentPersonalityContext", {
+  enumerable: true,
+  get: function () { return chunkK6TWHNT4_cjs.currentPersonalityContext; }
+});
+Object.defineProperty(exports, "warnPersonalitySwitchInsideFork", {
+  enumerable: true,
+  get: function () { return chunkK6TWHNT4_cjs.warnPersonalitySwitchInsideFork; }
+});
+Object.defineProperty(exports, "withPersonalityContext", {
+  enumerable: true,
+  get: function () { return chunkK6TWHNT4_cjs.withPersonalityContext; }
+});
+//# sourceMappingURL=context-DNFT4B5D.cjs.map
+//# sourceMappingURL=context-DNFT4B5D.cjs.map

package/dist/{context-2FZSC6VQ.cjs.map → context-DNFT4B5D.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"context-2FZSC6VQ.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"context-DNFT4B5D.cjs"}

package/dist/context-LYE6TJL5.js

@@ -0,0 +1,5 @@
+export { currentPersonalityContext, warnPersonalitySwitchInsideFork, withPersonalityContext } from './chunk-C64E2EJS.js';
+import './chunk-VQ33XLC6.js';
+import './chunk-RNCN2TTP.js';
+//# sourceMappingURL=context-LYE6TJL5.js.map
+//# sourceMappingURL=context-LYE6TJL5.js.map