@theokit/sdk 4.53.1 → 4.55.0

package/dist/internal/security/path-guard.d.cts

@@ -90,6 +90,52 @@ export declare function assertNoSymlinkEscape(path: string, base: string): void;
  * @public
  */
 export declare function isForbiddenPath(input: string): boolean;
+/**
+ * T1.4 — validate a relative artifact path string BEFORE it is used to look
+ * up a fixture or to fetch from PaaS. Rejects every well-known traversal
+ * vector at the boundary, throwing `PathTraversalError`.
+ *
+ * Vectors rejected:
+ *  - classic `..` parent-directory traversal (any segment).
+ *  - backslash separators (Windows-style `..\\windows`).
+ *  - URL-encoded `%2e%2e` / `%2E%2E` (double-decoded traversal).
+ *  - NUL byte injection (`\x00`).
+ *  - Windows drive letter prefix (`C:`, `D:\\...`).
+ *  - Home-tilde expansion (`~/`, `~root/...`).
+ *  - Absolute paths starting with `/`.
+ *
+ * Does NOT touch the filesystem — the call is shape-only. Live symlink
+ * traversal protection happens via `assertNoSymlinkEscape` at the FS-resolve
+ * boundary.
+ *
+ * @param input - Caller-supplied artifact path.
+ * @throws `PathTraversalError` on any rejection.
+ *
+ * Semver-exempt: reachable via the `@theokit/sdk/internal/security` sub-path, which the package
+ * declares in `exports` but does NOT cover with its semver contract.
+ */
+export declare function validateArtifactPath(input: string): void;
+/**
+ * Validate that `input` is a safe path component (skill name, agent ID,
+ * namespace, etc.) and return its lowercase form. Strict grammar
+ * `^[a-z0-9][a-z0-9-_]*$` rejects path separators, dots, null bytes,
+ * whitespace, unicode invisible chars, and any leading `-`/`_`.
+ *
+ * ONE error class leaves this function: `ConfigurationError` with code
+ * `invalid_identifier`, for every rejection — length out of range, a path
+ * separator, `..`, a space, a leading `-`, and a NUL / C0 control char / DEL
+ * alike. A caller can branch on that code and know it has covered the whole
+ * rejection surface.
+ *
+ * Before #368 the control-char branch threw `PathTraversalError` instead, which
+ * made the error CLASS a function of the attacker's bytes; the message still names
+ * the offending byte, which is the part that was worth keeping.
+ *
+ * @param input - User-supplied identifier candidate.
+ * @param options.maxLen - Maximum allowed length (default 64).
+ * @returns Lowercase form of `input`.
+ * @throws `ConfigurationError` with code `invalid_identifier` on every rejection.
+ */
 export declare function sanitizeIdentifier(input: string, options?: {
     maxLen?: number;
 }): string;

package/dist/internal/security/path-guard.d.ts

@@ -90,6 +90,52 @@ export declare function assertNoSymlinkEscape(path: string, base: string): void;
  * @public
  */
 export declare function isForbiddenPath(input: string): boolean;
+/**
+ * T1.4 — validate a relative artifact path string BEFORE it is used to look
+ * up a fixture or to fetch from PaaS. Rejects every well-known traversal
+ * vector at the boundary, throwing `PathTraversalError`.
+ *
+ * Vectors rejected:
+ *  - classic `..` parent-directory traversal (any segment).
+ *  - backslash separators (Windows-style `..\\windows`).
+ *  - URL-encoded `%2e%2e` / `%2E%2E` (double-decoded traversal).
+ *  - NUL byte injection (`\x00`).
+ *  - Windows drive letter prefix (`C:`, `D:\\...`).
+ *  - Home-tilde expansion (`~/`, `~root/...`).
+ *  - Absolute paths starting with `/`.
+ *
+ * Does NOT touch the filesystem — the call is shape-only. Live symlink
+ * traversal protection happens via `assertNoSymlinkEscape` at the FS-resolve
+ * boundary.
+ *
+ * @param input - Caller-supplied artifact path.
+ * @throws `PathTraversalError` on any rejection.
+ *
+ * Semver-exempt: reachable via the `@theokit/sdk/internal/security` sub-path, which the package
+ * declares in `exports` but does NOT cover with its semver contract.
+ */
+export declare function validateArtifactPath(input: string): void;
+/**
+ * Validate that `input` is a safe path component (skill name, agent ID,
+ * namespace, etc.) and return its lowercase form. Strict grammar
+ * `^[a-z0-9][a-z0-9-_]*$` rejects path separators, dots, null bytes,
+ * whitespace, unicode invisible chars, and any leading `-`/`_`.
+ *
+ * ONE error class leaves this function: `ConfigurationError` with code
+ * `invalid_identifier`, for every rejection — length out of range, a path
+ * separator, `..`, a space, a leading `-`, and a NUL / C0 control char / DEL
+ * alike. A caller can branch on that code and know it has covered the whole
+ * rejection surface.
+ *
+ * Before #368 the control-char branch threw `PathTraversalError` instead, which
+ * made the error CLASS a function of the attacker's bytes; the message still names
+ * the offending byte, which is the part that was worth keeping.
+ *
+ * @param input - User-supplied identifier candidate.
+ * @param options.maxLen - Maximum allowed length (default 64).
+ * @returns Lowercase form of `input`.
+ * @throws `ConfigurationError` with code `invalid_identifier` on every rejection.
+ */
 export declare function sanitizeIdentifier(input: string, options?: {
     maxLen?: number;
 }): string;

package/dist/internal/security/redact.d.cts

@@ -1,3 +1,74 @@
+/**
+ * Register an extra pattern for `redactSecrets` to mask, on top of the built-in vendor set.
+ *
+ * Additive and irreversible for the life of the process: patterns accumulate in module scope,
+ * builtins are never replaced or reordered, and there is no way to remove one. Registering the
+ * same regex twice registers it twice.
+ *
+ * Throws immediately when the regex has no `/g` flag. That is not pedantry — `String.replace`
+ * with a non-global regex substitutes only the FIRST match, so a pattern registered without it
+ * would mask the first credential in a payload and let every later one through, which reads as
+ * working.
+ *
+ * Extras run after the builtins and before the parametric `key=value` sweep, and each whole match
+ * is replaced by `maskToken` of that match. Anchor and bound the pattern with care: a regex that
+ * matches more than the secret masks more than the secret, and one that backtracks badly runs on
+ * every string crossing an output boundary.
+ *
+ * Registering a pattern does not enable redaction. When `THEOKIT_REDACT_SECRETS` was off at
+ * module load, `redactSecrets` returns its input untouched and extras never run.
+ *
+ * Also exposed publicly, and under semver, as `Security.addPattern` in `src/security.ts`; the
+ * direct export here additionally reaches the semver-exempt `@theokit/sdk/internal/security`
+ * sub-path.
+ */
+export declare function addPattern(re: RegExp): void;
+/**
+ * Mask one string, keeping enough of it to be recognizable in a log.
+ *
+ * Under 18 characters the whole string becomes the literal `***`; the length is not preserved and
+ * nothing of the input survives. From 18 characters up, the result is the first 6 characters, the
+ * literal `...`, and the last 4 — so exactly 10 characters of the input are RETAINED IN CLEAR and
+ * the middle is dropped. That is the trade the threshold encodes: short strings could be brute
+ * forced from a partial, long ones cannot, and the surviving prefix is usually the vendor tag
+ * (`sk-ant`, `ghp_de`) that tells an operator which credential misbehaved.
+ *
+ * Be clear about what this is and is not. It is a readability aid for logs, not an anonymizer and
+ * not a security boundary. The retained prefix and suffix identify the credential's issuer and
+ * often the credential itself to anyone who has seen it before, so a masked value still belongs in
+ * a trusted log and not in a bug report or a support ticket.
+ *
+ * It masks whatever it is handed. There is no check that the argument is a secret, so calling it
+ * on ordinary text mangles the text, and calling it on something the caller merely hopes is a
+ * secret proves nothing about what leaked.
+ *
+ * `redactSecrets` applies it to the ENTIRE match of a pattern, not to a captured group. For a
+ * match like `Bearer sk-ant-...` the first 6 characters retained are `Bearer`, not the key's
+ * prefix.
+ *
+ * Semver-exempt: reachable via the `@theokit/sdk/internal/security` sub-path, which the package
+ * declares in `exports` but does NOT cover with its semver contract.
+ */
+export declare function maskToken(token: string): string;
+/**
+ * Redact known credential patterns from `text`. Default behavior masks
+ * builtins + extras + parametric `key=value` sinks.
+ *
+ * With `{ codeFile: true }` (D72), skips PARAM_PATTERN to avoid mangling
+ * `.env.example`, schema JSON, or test fixtures that legitimately contain
+ * prefix-like strings.
+ *
+ * Returns the redacted string. Coerces non-strings via JSON.stringify;
+ * EC-7 fix (edge-case review): wraps in try/catch so circular references
+ * never propagate — returns sentinel `"[unredactable: circular]"`.
+ *
+ * `null` and `undefined` return `""`. When redaction was switched off at module load via
+ * `THEOKIT_REDACT_SECRETS`, the coerced input is returned with no masking at all — the value is
+ * still stringified, but nothing is removed from it.
+ *
+ * Masking is best-effort against a list of known shapes. A credential in a format no pattern
+ * covers passes through unchanged, so a redacted string is not a string proven free of secrets.
+ */
 export declare function redactSecrets(text: unknown, opts?: {
     codeFile?: boolean;
 }): string;

package/dist/internal/security/redact.d.ts

@@ -1,3 +1,74 @@
+/**
+ * Register an extra pattern for `redactSecrets` to mask, on top of the built-in vendor set.
+ *
+ * Additive and irreversible for the life of the process: patterns accumulate in module scope,
+ * builtins are never replaced or reordered, and there is no way to remove one. Registering the
+ * same regex twice registers it twice.
+ *
+ * Throws immediately when the regex has no `/g` flag. That is not pedantry — `String.replace`
+ * with a non-global regex substitutes only the FIRST match, so a pattern registered without it
+ * would mask the first credential in a payload and let every later one through, which reads as
+ * working.
+ *
+ * Extras run after the builtins and before the parametric `key=value` sweep, and each whole match
+ * is replaced by `maskToken` of that match. Anchor and bound the pattern with care: a regex that
+ * matches more than the secret masks more than the secret, and one that backtracks badly runs on
+ * every string crossing an output boundary.
+ *
+ * Registering a pattern does not enable redaction. When `THEOKIT_REDACT_SECRETS` was off at
+ * module load, `redactSecrets` returns its input untouched and extras never run.
+ *
+ * Also exposed publicly, and under semver, as `Security.addPattern` in `src/security.ts`; the
+ * direct export here additionally reaches the semver-exempt `@theokit/sdk/internal/security`
+ * sub-path.
+ */
+export declare function addPattern(re: RegExp): void;
+/**
+ * Mask one string, keeping enough of it to be recognizable in a log.
+ *
+ * Under 18 characters the whole string becomes the literal `***`; the length is not preserved and
+ * nothing of the input survives. From 18 characters up, the result is the first 6 characters, the
+ * literal `...`, and the last 4 — so exactly 10 characters of the input are RETAINED IN CLEAR and
+ * the middle is dropped. That is the trade the threshold encodes: short strings could be brute
+ * forced from a partial, long ones cannot, and the surviving prefix is usually the vendor tag
+ * (`sk-ant`, `ghp_de`) that tells an operator which credential misbehaved.
+ *
+ * Be clear about what this is and is not. It is a readability aid for logs, not an anonymizer and
+ * not a security boundary. The retained prefix and suffix identify the credential's issuer and
+ * often the credential itself to anyone who has seen it before, so a masked value still belongs in
+ * a trusted log and not in a bug report or a support ticket.
+ *
+ * It masks whatever it is handed. There is no check that the argument is a secret, so calling it
+ * on ordinary text mangles the text, and calling it on something the caller merely hopes is a
+ * secret proves nothing about what leaked.
+ *
+ * `redactSecrets` applies it to the ENTIRE match of a pattern, not to a captured group. For a
+ * match like `Bearer sk-ant-...` the first 6 characters retained are `Bearer`, not the key's
+ * prefix.
+ *
+ * Semver-exempt: reachable via the `@theokit/sdk/internal/security` sub-path, which the package
+ * declares in `exports` but does NOT cover with its semver contract.
+ */
+export declare function maskToken(token: string): string;
+/**
+ * Redact known credential patterns from `text`. Default behavior masks
+ * builtins + extras + parametric `key=value` sinks.
+ *
+ * With `{ codeFile: true }` (D72), skips PARAM_PATTERN to avoid mangling
+ * `.env.example`, schema JSON, or test fixtures that legitimately contain
+ * prefix-like strings.
+ *
+ * Returns the redacted string. Coerces non-strings via JSON.stringify;
+ * EC-7 fix (edge-case review): wraps in try/catch so circular references
+ * never propagate — returns sentinel `"[unredactable: circular]"`.
+ *
+ * `null` and `undefined` return `""`. When redaction was switched off at module load via
+ * `THEOKIT_REDACT_SECRETS`, the coerced input is returned with no masking at all — the value is
+ * still stringified, but nothing is removed from it.
+ *
+ * Masking is best-effort against a list of known shapes. A credential in a format no pattern
+ * covers passes through unchanged, so a redacted string is not a string proven free of secrets.
+ */
 export declare function redactSecrets(text: unknown, opts?: {
     codeFile?: boolean;
 }): string;

package/dist/internal/session/agent-session.d.ts

@@ -23,12 +23,23 @@ export declare const MAX_CACHED_SESSIONS = 32;
  */
 export declare function discardSession(cwd: string, agentId: string): number;
 export declare function getSessionMessages(agentId: string): SessionMessage[];
-export declare function clearSession(agentId: string): void;
 /**
- * M50 review F1 — drop BOTH the message cache and the hydration marker so the NEXT send re-hydrates
- * from disk. Without this, a compaction only helps after a process restart: the live process keeps
- * sending the full pre-compact history (the cache is read synchronously by every send).
+ * Drop the in-memory message cache for `agentId` and NOTHING else — the hydration marker in
+ * `hydratedKeys` deliberately stays.
+ *
+ * That asymmetry is the feature, not an oversight, and it is what separates this from
+ * `invalidateSessionCache`, which drops both. The single caller is the personality switch's
+ * `reset: true` path (`internal/personality/switch.ts`): leaving the marker set makes
+ * `hydrateSession` return early, so the next send starts from an EMPTY context instead of
+ * replaying the pre-reset transcript off disk. Clearing the marker here would re-hydrate the
+ * conversation the reset was asked to discard.
+ *
+ * The same shape read as a bug one function up: `forgetBookkeeping` documents an evicted session
+ * coming back empty as "silent amnesia". The difference is intent — eviction wants the transcript
+ * back, a reset does not. Anyone reaching for this to invalidate a cache wants
+ * `invalidateSessionCache(cwd, agentId)` instead.
  */
+export declare function clearSession(agentId: string): void;
 /**
  * M50 review F5 — run `fn` serialized on the SAME per-(cwd,agentId) write chain the per-turn
  * persistence uses, so a manual `Agent.compact` can never interleave with an in-flight turn's

package/dist/internal/session/session-cache.d.ts

@@ -17,4 +17,9 @@ export declare const sessions: Map<string, SessionMessage[]>;
 export declare const hydratedKeys: Set<string>;
 /** The per-(cwd, agentId) transcript key for cache/hydration bookkeeping. */
 export declare function transcriptKey(cwd: string, agentId: string): string;
+/**
+ * M50 review F1 — drop BOTH the message cache and the hydration marker so the NEXT send re-hydrates
+ * from disk. Without this, a compaction only helps after a process restart: the live process keeps
+ * sending the full pre-compact history (the cache is read synchronously by every send).
+ */
 export declare function invalidateSessionCache(cwd: string, agentId: string): void;

package/dist/internal/task/store.d.ts

@@ -12,8 +12,10 @@
  *   - EC-6: `list()` returns `[]` on ENOENT (fresh install path).
  *   - EC-8: `list()` skips `.tmp.*` orphan files left by interrupted
  *     atomic writes.
- *   - EC-14 (DOCUMENT): `list()` JSDoc documents the 256-row hard cap
- *     and the `submittedBefore` paging idiom.
+ *   - EC-14 (DOCUMENT): `list()` JSDoc documents the 256-row hard cap.
+ *     It no longer advertises `submittedBefore` as a way to page past it:
+ *     the cap is applied to the raw directory listing before any filter, so
+ *     paging beyond 256 files is not reachable through this interface.
  *   - EC-15 (DOCUMENT): `JsonFileTaskStore` JSDoc documents the
  *     single-process invariant; v0.2 SQLite covers cross-process.
  *
@@ -26,15 +28,42 @@ export interface TaskStore {
     update(id: string, mutate: (h: TaskHandle) => TaskHandle): Promise<TaskHandle | undefined>;
     get(id: string): Promise<TaskHandle | undefined>;
     /**
-     * Returns at most `filter.limit ?? 100` matching handles. JsonFile
-     * backend hard-caps loaded entries at 256 — callers needing larger
-     * pages must use `submittedBefore` to walk the timeline.
+     * Returns at most `filter.limit ?? 100` matching handles.
+     *
+     * `JsonFileTaskStore` returns them newest-first and considers every task in its
+     * directory, reading at most 256 files concurrently (#362 — that number bounds
+     * I/O, not which tasks are visible). Walk past `limit` by passing the oldest
+     * `submittedAt` of a page as the next call's `submittedBefore`; the ordering is
+     * what makes that a cursor rather than a re-roll of an arbitrary subset.
+     * `InMemoryTaskStore` applies the same filters but does not order its result.
      */
     list(filter: TaskFilter): Promise<TaskHandle[]>;
     delete(id: string): Promise<boolean>;
     /** Removes terminal handles whose terminal-timestamp is older than `epochMs`. */
     evictTerminalOlderThan(epochMs: number): Promise<number>;
 }
+/**
+ * Default `TaskStore` — a plain `Map` living in the current process.
+ *
+ * Nothing reaches disk and nothing survives the process, so a task recorded here
+ * is invisible to a reader in another process (`theokit tasks`). Select it with
+ * `getTaskStoreFor({ backend: "memory" })`.
+ *
+ * How it fails: every id-taking method validates against the task-id grammar
+ * (`^[a-z0-9][a-z0-9_-]*$`; reserved `wf-`/`b-`/`cron-` prefixes are permitted
+ * here) and throws `InvalidTaskIdError` before touching the map. A missing id is
+ * reported by returning `undefined` (`get`, `update`) or `false` (`delete`), never
+ * by throwing.
+ *
+ * Traps:
+ *  - `insert()` is a `Map.set`: an existing id is overwritten silently, not
+ *    rejected.
+ *  - `list()` walks in INSERTION order and stops as soon as `filter.limit ?? 100`
+ *    matches are collected. It never sorts, so the limit truncates an
+ *    oldest-first scan rather than returning the most recent tasks.
+ *  - Nothing evicts on its own; terminal handles accumulate until a caller invokes
+ *    `evictTerminalOlderThan`.
+ */
 export declare class InMemoryTaskStore implements TaskStore {
     private readonly map;
     insert(handle: TaskHandle): Promise<void>;
@@ -44,6 +73,44 @@ export declare class InMemoryTaskStore implements TaskStore {
     delete(id: string): Promise<boolean>;
     evictTerminalOlderThan(epochMs: number): Promise<number>;
 }
+/**
+ * Opt-in `TaskStore` that keeps one JSON file per task under `dir`, so another
+ * process can read the registry off disk.
+ *
+ *   const store = new JsonFileTaskStore("/var/lib/theokit/tasks");
+ *
+ * Two calls are synchronous, and both are deliberate: the constructor creates `dir`
+ * recursively (`mkdirSync`), and `list()` scans it with `readdirSync` before awaiting
+ * anything. Every other operation is async — `get` uses `readFile`, `delete` uses
+ * `unlink`, and every write goes through an atomic temp-file-plus-rename.
+ *
+ * SINGLE-PROCESS ONLY — see the note above. Per-file atomicity does not make
+ * `update()` safe: it is a read-modify-write, so two writers that both `get`
+ * before either writes lose one of the two mutations. That is true within one
+ * process as well as across processes.
+ *
+ * How it fails:
+ *  - An invalid id throws `InvalidTaskIdError` BEFORE any path is constructed.
+ *    That ordering is the path-traversal defence, and it is why ids are validated
+ *    rather than escaped.
+ *  - A missing task is `undefined` from `get` and `false` from `delete`.
+ *  - A file that exists but does not parse is NOT surfaced as an error: `get`
+ *    writes to the diagnostics channel and returns `undefined`, so a corrupted
+ *    task also silently vanishes from `list()`.
+ *  - `list()` returns `[]` when `dir` does not exist; any other `readdir` failure
+ *    (for example a permission error) throws.
+ *
+ * Traps:
+ *  - `list()` reads every task file in the directory (256 at a time) to apply the
+ *    filter, because `state`, `kind` and `submittedAt` live inside the files. On a
+ *    large directory that is a lot of I/O for one call; the memory it holds is
+ *    bounded by `limit`, the time is not.
+ *  - `list()` is `async`, but its directory scan is not: `readdirSync` blocks the event
+ *    loop for the whole listing before the first `await`. Only the per-file reads that
+ *    follow it are concurrent.
+ *  - Files whose name contains `.tmp` are skipped as orphans of an interrupted
+ *    write, and nothing ever removes them.
+ */
 export declare class JsonFileTaskStore implements TaskStore {
     private readonly dir;
     constructor(dir: string);
@@ -51,6 +118,25 @@ export declare class JsonFileTaskStore implements TaskStore {
     insert(handle: TaskHandle): Promise<void>;
     update(id: string, mutate: (h: TaskHandle) => TaskHandle): Promise<TaskHandle | undefined>;
     get(id: string): Promise<TaskHandle | undefined>;
+    /**
+     * Task ids backed by a file in `dir`, in readdir order.
+     *
+     * EC-8: orphan `.tmp` files left by an interrupted atomic write are skipped, as is any name
+     * outside the id grammar. EC-6: a missing directory lists as empty; any other `readdir` failure
+     * (a permission error, say) throws rather than being reported as "no tasks".
+     */
+    private candidateIds;
+    /**
+     * Read every task in `ids`, handing each loaded handle to `visit`, at most `JSON_LOAD_CAP` file
+     * reads in flight.
+     *
+     * #362 — the cap used to be applied to the directory listing, which made it a bound on WHICH
+     * tasks were visible rather than on how much I/O ran at once. Every filter then ran on that
+     * arbitrary readdir-ordered prefix. As a concurrency bound it does the job it was named for
+     * without deciding what the caller gets to see; the caller's own bound on memory is whatever
+     * `visit` chooses to retain.
+     */
+    private forEachHandle;
     list(filter: TaskFilter): Promise<TaskHandle[]>;
     delete(id: string): Promise<boolean>;
     evictTerminalOlderThan(epochMs: number): Promise<number>;

package/dist/internal/telemetry/span-names.d.ts

@@ -1,4 +1,3 @@
-export type SpanName = (typeof SPAN_NAMES)[keyof typeof SPAN_NAMES];
 /** Histogram names emitted by the SDK. M3 #64 closes the wiring-triad pillar-c
  * gap: tool/LLM durations + LLM token throughput were measured but never emitted. */
 export declare const HISTOGRAM_NAMES: {

package/dist/internal/telemetry/tracer.d.ts

@@ -1,3 +1,17 @@
+/**
+ * The subset of the OpenTelemetry `Span` API this SDK calls.
+ *
+ * Structural, not nominal: a real `@opentelemetry/api` span satisfies it, and so does a test double
+ * or a no-op. That is why it is exported — `@theokit/sdk-memory` previously kept a hand-written
+ * mirror of this shape, and the two had already drifted (the mirror rejected `undefined` attribute
+ * values this one accepts, and declared `end()` without its `endTime` parameter). Import this
+ * instead of re-declaring it.
+ *
+ * Erased at build time, so importing it adds nothing to a bundle and does not require
+ * `@opentelemetry/api` to be installed.
+ *
+ * @public
+ */
 export interface OTelSpan {
     setAttribute(key: string, value: string | number | boolean): void;
     setAttributes(attrs: Record<string, string | number | boolean | undefined>): void;

package/dist/job-queue.d.ts

@@ -24,6 +24,24 @@ export interface JobQueueOptions {
      */
     maxConcurrency?: number;
 }
+/**
+ * An in-process queue of background jobs with status tracking, cancellation, and an optional
+ * concurrency bound.
+ *
+ * `enqueue` returns a job id immediately and never throws for the job's own failure: a synchronous
+ * throw inside the function becomes a rejection, and a rejection becomes `status: "failed"` with
+ * the message on `job.error`. Poll `getJob(id)` or `list()` for outcomes — there is no completion
+ * event and no promise to await.
+ *
+ * Cancellation is COOPERATIVE. `cancel` aborts the `AbortSignal` handed to the job function and
+ * flips the status, but a function that ignores the signal keeps running to completion; its result
+ * is then discarded, because a cancelled job never leaves the cancelled state. The concurrency slot
+ * of a running job is freed at cancel time rather than when it eventually settles, so a job that
+ * never settles cannot deadlock a bounded queue.
+ *
+ * State lives entirely in memory and grows without bound — nothing evicts finished jobs. This is a
+ * queue for one process, not a durable one.
+ */
 export declare class JobQueue {
     #private;
     private jobs;

package/dist/judge-call-DWHAJATE.js

@@ -0,0 +1,6 @@
+export { JudgeCredentialError, composeJudgePrompt, judgeCallImpl } from './chunk-T73NA43R.js';
+import './chunk-IDCKSLYH.js';
+import './chunk-T7XEKOVW.js';
+import './chunk-T7O6K6PX.js';
+//# sourceMappingURL=judge-call-DWHAJATE.js.map
+//# sourceMappingURL=judge-call-DWHAJATE.js.map

package/dist/{judge-call-MDIPTBJI.js.map → judge-call-DWHAJATE.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"judge-call-MDIPTBJI.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"judge-call-DWHAJATE.js"}

package/dist/judge-call-EGYRC2RE.cjs

@@ -0,0 +1,23 @@
+'use strict';
+
+var chunkGWC3HADL_cjs = require('./chunk-GWC3HADL.cjs');
+require('./chunk-K3FW2XZD.cjs');
+require('./chunk-JTB5Q42C.cjs');
+require('./chunk-NUKRL3I6.cjs');
+
+
+
+Object.defineProperty(exports, "JudgeCredentialError", {
+  enumerable: true,
+  get: function () { return chunkGWC3HADL_cjs.JudgeCredentialError; }
+});
+Object.defineProperty(exports, "composeJudgePrompt", {
+  enumerable: true,
+  get: function () { return chunkGWC3HADL_cjs.composeJudgePrompt; }
+});
+Object.defineProperty(exports, "judgeCallImpl", {
+  enumerable: true,
+  get: function () { return chunkGWC3HADL_cjs.judgeCallImpl; }
+});
+//# sourceMappingURL=judge-call-EGYRC2RE.cjs.map
+//# sourceMappingURL=judge-call-EGYRC2RE.cjs.map

package/dist/{judge-call-G5SGV2M2.cjs.map → judge-call-EGYRC2RE.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"judge-call-G5SGV2M2.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"judge-call-EGYRC2RE.cjs"}