@theokit/sdk 4.63.3 → 5.0.0-next.1

package/dist/{chunk-UU36SHFY.cjs → chunk-BJUJT5ED.cjs}

@@ -1,7 +1,8 @@
 'use strict';
 
 var chunkZF2LDKQQ_cjs = require('./chunk-ZF2LDKQQ.cjs');
-var chunkEG4QM7ZJ_cjs = require('./chunk-EG4QM7ZJ.cjs');
+var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
+var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
 var fs = require('fs');
 var path = require('path');
 
@@ -32,7 +33,7 @@ async function getProperLockfile() {
     if (!validateLockModule(mod)) {
       if (!warnedStructural) {
         warnedStructural = true;
-        chunkEG4QM7ZJ_cjs.diag(
+        chunk6LHQPOMI_cjs.diag(
           "[theokit-sdk] proper-lockfile: imported module does NOT expose the expected `lock`/`unlock` API surface. This may indicate a supply-chain compromise or an incompatible major version. Falling back to in-process mutex (no cross-process safety). Reinstall with: pnpm add proper-lockfile@^11\n"
         );
       }
@@ -56,7 +57,7 @@ async function withFileLock(path, fn, options) {
   if (lib === null) {
     if (!warnedMissing && !warnedStructural) {
       warnedMissing = true;
-      chunkEG4QM7ZJ_cjs.diag(describeLockLoadFailure(loadFailure));
+      chunk6LHQPOMI_cjs.diag(describeLockLoadFailure(loadFailure));
     }
     return chunkZF2LDKQQ_cjs.withCwdMutex(`file-lock:${path}`, fn);
   }
@@ -80,13 +81,13 @@ async function withFileLock(path, fn, options) {
     }
   });
 }
-var JsonlParseError = class extends Error {
+var JsonlParseError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
   constructor(message, line) {
-    super(message);
+    super(message, { code: "jsonl_parse_failed", isRetryable: false });
     this.line = line;
-    this.name = "JsonlParseError";
   }
   line;
+  name = "JsonlParseError";
 };
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -181,5 +182,5 @@ exports.appendJsonl = appendJsonl;
 exports.loadJsonl = loadJsonl;
 exports.readJsonlIds = readJsonlIds;
 exports.withFileLock = withFileLock;
-//# sourceMappingURL=chunk-UU36SHFY.cjs.map
-//# sourceMappingURL=chunk-UU36SHFY.cjs.map
+//# sourceMappingURL=chunk-BJUJT5ED.cjs.map
+//# sourceMappingURL=chunk-BJUJT5ED.cjs.map

package/dist/chunk-BJUJT5ED.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/persistence/file-lock.ts","../src/internal/persistence/jsonl.ts"],"names":["diag","withCwdMutex","TheokitAgentError","readFileSync","path","mkdirSync","dirname","openSync","writeSync","closeSync","fstatSync","readSync"],"mappings":";;;;;;;;;AAiCA,IAAI,MAAA;AACJ,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAI,gBAAA,GAAmB,KAAA;AAEvB,IAAI,WAAA;AAGJ,SAAS,eAAe,GAAA,EAAuB;AAC7C,EAAA,MAAM,OAAQ,GAAA,EAA+C,IAAA;AAC7D,EAAA,OAAO,IAAA,KAAS,0BAA0B,IAAA,KAAS,kBAAA;AACrD;AAgBA,SAAS,wBAAwB,GAAA,EAAsB;AACrD,EAAA,MAAM,WAAA,GACJ,wGAAA;AACF,EAAA,IAAI,cAAA,CAAe,GAAG,CAAA,EAAG;AACvB,IAAA,OAAO,gDAAgD,WAAW,CAAA;AAAA,CAAA;AAAA,EACpE;AACA,EAAA,MAAM,OAAQ,GAAA,EAA+C,IAAA;AAC7D,EAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,EAAA,OACE,CAAA,iDAAA,EAAoD,IAAA,KAAS,MAAA,GAAY,CAAA,EAAA,EAAK,MAAA,CAAO,IAAI,CAAC,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,EAAA,EAC/F,MAAM,CAAA,EAAA,EAAK,WAAW,CAAA;AAAA,CAAA;AAG7B;AAOA,eAAe,iBAAA,GAA0D;AACvE,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,OAAO,iBAAiB,CAAA;AAM1C,IAAA,IAAI,CAAC,kBAAA,CAAmB,GAAG,CAAA,EAAG;AAC5B,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,gBAAA,GAAmB,IAAA;AACnB,QAAAA,sBAAA;AAAA,UACE;AAAA,SAKF;AAAA,MACF;AACA,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,MAAA,GAAS,GAAA;AAAA,EACX,SAAS,GAAA,EAAK;AAGZ,IAAA,WAAA,GAAc,GAAA;AACd,IAAA,MAAA,GAAS,IAAA;AAAA,EACX;AACA,EAAA,OAAO,MAAA;AACT;AAaA,SAAS,mBAAmB,GAAA,EAAuB;AACjD,EAAA,IAAI,QAAQ,IAAA,IAAQ,GAAA,KAAQ,UAAa,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AACzE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,UAAA,IAAc,OAAO,EAAE,MAAA,KAAW,UAAA;AAC7D;AAkEA,eAAsB,YAAA,CACpB,IAAA,EACA,EAAA,EACA,OAAA,EACY;AACZ,EAAA,MAAM,GAAA,GAAM,MAAM,iBAAA,EAAkB;AAEpC,EAAA,IAAI,QAAQ,IAAA,EAAM;AAIhB,IAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,gBAAA,EAAkB;AACvC,MAAA,aAAA,GAAgB,IAAA;AAChB,MAAAA,sBAAA,CAAK,uBAAA,CAAwB,WAAW,CAAC,CAAA;AAAA,IAC3C;AACA,IAAA,OAAOC,8BAAA,CAAa,CAAA,UAAA,EAAa,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA;AAAA,EAC7C;AAOA,EAAA,OAAOA,8BAAA,CAAa,CAAA,UAAA,EAAa,IAAI,CAAA,CAAA,EAAI,YAAY;AACnD,IAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA;AAAA,MAEnC,YAAA,EAAc,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,MACrB,QAAA,EAAU,KAAA;AAAA,MACV,KAAA,EAAO,SAAS,KAAA,IAAS,GAAA;AAAA,MACzB,OAAA,EAAS;AAAA,QACP,OAAA,EAAS,SAAS,OAAA,IAAW,CAAA;AAAA,QAC7B,MAAA,EAAQ,SAAS,WAAA,IAAe,GAAA;AAAA,QAChC,UAAA,EAAY,GAAA;AAAA,QACZ,UAAA,EAAY;AAAA;AACd,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,EAAA,EAAG;AAAA,IAClB,CAAA,SAAE;AACA,MAAA,MAAM,OAAA,EAAQ;AAAA,IAChB;AAAA,EACF,CAAC,CAAA;AACH;AC/MO,IAAM,eAAA,GAAN,cAA8BC,mCAAA,CAAkB;AAAA,EAErD,WAAA,CACE,SACS,IAAA,EACT;AAEA,IAAA,KAAA,CAAM,SAAS,EAAE,IAAA,EAAM,oBAAA,EAAsB,WAAA,EAAa,OAAO,CAAA;AAHxD,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAIX;AAAA,EAJW,IAAA;AAAA,EAHO,IAAA,GAAO,iBAAA;AAQ3B;AAEA,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGA,SAAS,mBAAmB,IAAA,EAAmD;AAC7E,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,aAAA,CAAc,MAAM,CAAA,GAAI,MAAA,GAAS,MAAA;AAC1C;AAQO,SAAS,SAAA,CACd,IAAA,EACA,IAAA,GASI,EAAC,EACA;AACL,EAAA,MAAM,QAAQC,eAAA,CAAa,IAAA,EAAM,MAAM,CAAA,CAAE,MAAM,IAAI,CAAA;AACnD,EAAA,MAAM,MAAW,EAAC;AAClB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA,EAAG;AACxC,IAAA,MAAM,aAAa,CAAA,GAAI,CAAA;AACvB,IAAA,MAAM,IAAA,GAAA,CAAQ,KAAA,CAAM,CAAC,CAAA,IAAK,IAAI,IAAA,EAAK;AACnC,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AAGvB,IAAA,MAAM,MAAA,GAAS,SAAA;AAAA,MACb,IAAA;AAAA,MACA,UAAA;AAAA,MACA,IAAA,CAAK,2BAAA,KAAgC,IAAA,IAAQ,UAAA,KAAe,KAAA,CAAM;AAAA,KACpE;AACA,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,GAAA,CAAI,IAAA,CAAK,KAAK,GAAA,GAAM,IAAA,CAAK,IAAI,MAAA,EAAQ,UAAU,IAAK,MAAuB,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,GAAA;AACT;AASA,SAAS,SAAA,CACP,IAAA,EACA,UAAA,EACA,QAAA,EACqC;AACrC,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI,UAAU,OAAO,MAAA;AACrB,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,KAAA,EAAQ,UAAU,kBAAkB,UAAU,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI,CAAC,aAAA,CAAc,MAAM,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,KAAA,EAAQ,UAAU,uBAAuB,UAAU,CAAA;AAAA,EAC/E;AACA,EAAA,OAAO,MAAA;AACT;AAUO,SAAS,WAAA,CAAYC,QAAc,MAAA,EAAuB;AAgB/D,EAAAC,YAAA,CAAUC,YAAA,CAAQF,MAAI,CAAA,EAAG,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS,oBAAA,CAAqBA,MAAI,CAAA,GAAI,IAAA,GAAO,EAAA;AASnD,EAAA,MAAM,EAAA,GAAKG,WAAA,CAASH,MAAA,EAAM,GAAA,EAAK,GAAK,CAAA;AACpC,EAAA,IAAI;AACF,IAAAI,YAAA,CAAU,IAAI,CAAA,EAAG,MAAM,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC;AAAA,CAAI,CAAA;AAAA,EACtD,CAAA,SAAE;AACA,IAAAC,YAAA,CAAU,EAAE,CAAA;AAAA,EACd;AACF;AAaA,SAAS,qBAAqB,IAAA,EAAuB;AACnD,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAKF,WAAA,CAAS,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAOG,YAAA,CAAU,EAAE,CAAA,CAAE,IAAA;AAC3B,IAAA,IAAI,IAAA,KAAS,GAAG,OAAO,KAAA;AACvB,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,IAAAC,WAAA,CAAS,EAAA,EAAI,GAAA,EAAK,CAAA,EAAG,CAAA,EAAG,OAAO,CAAC,CAAA;AAChC,IAAA,OAAO,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA;AAAA,EACpB,CAAA,SAAE;AACA,IAAAF,YAAA,CAAU,EAAE,CAAA;AAAA,EACd;AACF;AAYO,SAAS,YAAA,CACd,MACA,KAAA,EACa;AACb,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAON,eAAA,CAAa,MAAM,MAAM,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,KAAA,MAAW,OAAA,IAAW,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG;AAEtC,IAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,OAAA,CAAQ,IAAA,EAAM,CAAA;AAChD,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,MAAM,GAAA,GAAM,MAAM,MAAM,CAAA;AACxB,IAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,EAAG,IAAA,CAAK,IAAI,GAAG,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-BJUJT5ED.cjs","sourcesContent":["/**\n * Cross-process file lock helper (ADR D61).\n *\n * Uses `proper-lockfile` (optional peer dep) for cross-process locks. When\n * the peer dep is absent, falls back to `withCwdMutex` (in-process only)\n * with a one-shot stderr warning.\n *\n * EC-1 fix: uses a companion `<path>.lock` file with `realpath: false` so\n * `withFileLock` works even when the target `path` does not exist yet.\n * Without this, fresh installs that lock-then-create would crash with ENOENT.\n *\n * @internal\n */\n\nimport { diag } from \"../diagnostics.js\";\nimport { withCwdMutex } from \"./cwd-mutex.js\";\n\ninterface ProperLockfileModule {\n  lock: (file: string, options: ProperLockfileOptions) => Promise<() => Promise<void>>;\n}\n\ninterface ProperLockfileOptions {\n  lockfilePath?: string;\n  realpath?: boolean;\n  stale?: number;\n  retries?: {\n    retries: number;\n    factor?: number;\n    minTimeout?: number;\n    maxTimeout?: number;\n  };\n}\n\nlet cached: ProperLockfileModule | null | undefined;\nlet warnedMissing = false;\nlet warnedStructural = false;\n/** Why the import failed, kept so the warning can report the observation instead of a guess (#174). */\nlet loadFailure: unknown;\n\n/** Node reports a missing module as `ERR_MODULE_NOT_FOUND` (ESM loader) or `MODULE_NOT_FOUND` (CJS). */\nfunction isModuleAbsent(err: unknown): boolean {\n  const code = (err as { code?: unknown } | null | undefined)?.code;\n  return code === \"ERR_MODULE_NOT_FOUND\" || code === \"MODULE_NOT_FOUND\";\n}\n\n/**\n * #174 — build the fallback warning from what actually happened.\n *\n * This used to always read \"proper-lockfile not installed\", because the import was wrapped in a\n * bare `catch` that discarded the error (Unbreakable Rule 8: a swallowed error is the dangerous\n * kind). A consumer whose package WAS installed, declared and resolvable spent a debugging session\n * re-verifying the install, because the message named a cause the code had never checked.\n *\n * Absence is now the only case that claims absence. Every other failure — a broken install, an\n * interop problem, a bundler that rewrote the specifier — reports its own code and message, which\n * is what points at the real cause.\n *\n * @internal\n */\nfunction describeLockLoadFailure(err: unknown): string {\n  const consequence =\n    \"cross-process file lock unavailable — concurrent processes over the same file are NOT serialized.\";\n  if (isModuleAbsent(err)) {\n    return `[theokit-sdk] proper-lockfile not installed; ${consequence} Install with: pnpm add proper-lockfile\\n`;\n  }\n  const code = (err as { code?: unknown } | null | undefined)?.code;\n  const detail = err instanceof Error ? err.message : String(err);\n  return (\n    `[theokit-sdk] proper-lockfile could not be loaded${code !== undefined ? ` (${String(code)})` : \"\"}: ` +\n    `${detail}. ${consequence} The package resolves for the SDK but failed to load — check bundling ` +\n    \"and module-format interop before re-checking the install.\\n\"\n  );\n}\n\n/** Test seam for the message builder — NOT in the public barrel. @internal */\nexport function __TESTING__describeLockLoadFailure(err: unknown): string {\n  return describeLockLoadFailure(err);\n}\n\nasync function getProperLockfile(): Promise<ProperLockfileModule | null> {\n  if (cached !== undefined) return cached;\n  try {\n    const mod = await import(\"proper-lockfile\");\n    // T5.9 — supply-chain hardening: validate the imported module\n    // exposes the API surface we depend on BEFORE caching it. A\n    // tampered or incompatible version that lacks `lock`/`unlock`\n    // functions gets treated as \"not installed\" with an advisory\n    // warning — never silently used.\n    if (!validateLockModule(mod)) {\n      if (!warnedStructural) {\n        warnedStructural = true;\n        diag(\n          \"[theokit-sdk] proper-lockfile: imported module does NOT expose \" +\n            \"the expected `lock`/`unlock` API surface. This may indicate a \" +\n            \"supply-chain compromise or an incompatible major version. \" +\n            \"Falling back to in-process mutex (no cross-process safety). \" +\n            \"Reinstall with: pnpm add proper-lockfile@^11\\n\",\n        );\n      }\n      cached = null;\n      return cached;\n    }\n    cached = mod as ProperLockfileModule;\n  } catch (err) {\n    // #174 — keep WHY. Discarding it here is what made the fallback warning assert a cause it had\n    // never observed, and sent a consumer to re-check an install that was already correct.\n    loadFailure = err;\n    cached = null;\n  }\n  return cached;\n}\n\n/**\n * T5.9 — Structural validation of the dynamically-imported\n * `proper-lockfile` module. Verifies the API surface we depend on\n * (`lock` and `unlock` as functions) is present. Pure function —\n * never throws, never mutates, never performs I/O.\n *\n * Exported via `__TESTING__validateLockModule` seam so unit tests\n * can drive the check without spinning up the dynamic import.\n *\n * @internal\n */\nfunction validateLockModule(mod: unknown): boolean {\n  if (mod === null || mod === undefined || typeof mod !== \"object\") return false;\n  const m = mod as Record<string, unknown>;\n  return typeof m.lock === \"function\" && typeof m.unlock === \"function\";\n}\n\n/**\n * T5.9 — Test seam: expose the structural validator for unit tests.\n * NOT included in the public barrel.\n *\n * @internal\n */\nexport function __TESTING__validateLockModule(mod: unknown): boolean {\n  return validateLockModule(mod);\n}\n\n/**\n * T5.9 — Test seam: reset the module cache + warning flags between\n * tests so each test starts fresh. NOT included in the public barrel.\n *\n * @internal\n */\nexport function __TESTING__resetFileLockCache(): void {\n  cached = undefined;\n  warnedMissing = false;\n  warnedStructural = false;\n  loadFailure = undefined;\n}\n\n/**\n * Retry and staleness tuning for `withFileLock`.\n *\n * Every field is optional and the defaults are applied per call, so `undefined` means the default\n * rather than \"no limit\". They are handed to `proper-lockfile` and have NO effect on the fallback\n * path: when that package is absent, `withFileLock` degrades to the in-process mutex, which\n * queues indefinitely and never goes stale.\n *\n * `stale` (default 30000 ms) is how old a lock file must be before it is treated as abandoned by a\n * dead process and broken. Setting it below the longest a legitimate holder can run is what turns\n * a slow operation into two concurrent ones.\n *\n * `retries` (default 5) is the number of acquisition attempts AFTER the first, and `retryFactor`\n * (default 1.5) the backoff multiplier between them. The per-attempt wait is clamped to\n * 100–5000 ms, which the caller cannot change. Exhausting the retries rejects — it does not fall\n * through to running `fn` unlocked.\n *\n * @public — re-exported from the semver-protected `@theokit/sdk/persistence` barrel, and (for\n * back-compat) from the semver-exempt `@theokit/sdk/internal/persistence` alias.\n */\nexport interface FileLockOptions {\n  /** Stale lock timeout in ms. Default 30_000 (30s). */\n  stale?: number;\n  /** Max retries on busy lock. Default 5. */\n  retries?: number;\n  /** Backoff factor between retries. Default 1.5. */\n  retryFactor?: number;\n}\n\n/**\n * Run `fn` while holding an OS-level cross-process lock on `path`.\n *\n * If `proper-lockfile` is installed, uses it with a companion `<path>.lock`\n * file (`realpath: false`, so target file does NOT need to exist yet).\n * Otherwise falls back to in-process `withCwdMutex` and prints a one-shot\n * stderr warning telling the user to install `proper-lockfile` for\n * cross-process safety.\n *\n * The lock is released even when `fn` throws.\n *\n */\nexport async function withFileLock<T>(\n  path: string,\n  fn: () => Promise<T>,\n  options?: FileLockOptions,\n): Promise<T> {\n  const lib = await getProperLockfile();\n\n  if (lib === null) {\n    // #174 — stay silent when the structural check already explained itself. Emitting \"not\n    // installed\" on top of \"does not expose lock/unlock\" would be two contradictory diagnoses of\n    // one failure, and the reader has no way to tell which is true.\n    if (!warnedMissing && !warnedStructural) {\n      warnedMissing = true;\n      diag(describeLockLoadFailure(loadFailure));\n    }\n    return withCwdMutex(`file-lock:${path}`, fn);\n  }\n\n  // proper-lockfile errors immediately on same-process concurrent acquire\n  // (\"Lock file is already being held\"). Wrap with cwd-mutex first so\n  // in-process callers queue and only ONE thread at a time enters the\n  // cross-process acquire path. Combined: full in-process + cross-process\n  // serialization.\n  return withCwdMutex(`file-lock:${path}`, async () => {\n    const release = await lib.lock(path, {\n      // EC-1: companion lockfile, target path may not exist yet.\n      lockfilePath: `${path}.lock`,\n      realpath: false,\n      stale: options?.stale ?? 30_000,\n      retries: {\n        retries: options?.retries ?? 5,\n        factor: options?.retryFactor ?? 1.5,\n        minTimeout: 100,\n        maxTimeout: 5_000,\n      },\n    });\n\n    try {\n      return await fn();\n    } finally {\n      await release();\n    }\n  });\n}\n\n/**\n * Test helper — resets the cached proper-lockfile module + warning flag.\n * Allows tests to simulate \"module absent\" by clearing cache then\n * monkey-patching the dynamic import resolution.\n *\n * @internal\n */\nexport function _resetFileLockCacheForTesting(): void {\n  cached = undefined;\n  warnedMissing = false;\n}\n","/**\n * Durable JSONL primitives shared by the eval harness (M6).\n *\n * - `loadJsonl` — generic dataset reader (split/trim/skip-blank/parse) with a\n *   line-numbered {@link JsonlParseError}. The dataset SCHEMA is the caller's\n *   concern via `map` (M6 ADR D3) — this module owns only the parse.\n * - `appendJsonl` / `readJsonlIds` — crash-durable, resumable batch persistence\n *   (M6 ADR D1): each record is appended as one whole `\\n`-terminated line the\n *   instant it is produced, and a re-run resumes by skipping already-keyed rows.\n *\n * reference: knowledge-base/references/theocode-eval/lib/swebench-dataset.ts:82\n * (parseJsonl + line-N error) and swebench-batch.ts:113,205 (resume + per-line\n * flush).\n *\n * @internal\n */\nimport {\n  closeSync,\n  fstatSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  readSync,\n  writeSync,\n} from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport { TheokitAgentError } from \"../../errors.js\";\n\n/** Raised when a JSONL line is not valid JSON or is not a JSON object. Carries the 1-based line number. */\nexport class JsonlParseError extends TheokitAgentError {\n  override readonly name = \"JsonlParseError\";\n  constructor(\n    message: string,\n    readonly line: number,\n  ) {\n    // Not retryable: the bytes on the line do not change between reads.\n    super(message, { code: \"jsonl_parse_failed\", isRetryable: false });\n  }\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** Parse a single trimmed line to a plain object, or `undefined` if blank / invalid / non-object. */\nfunction tryParseObjectLine(line: string): Record<string, unknown> | undefined {\n  if (line.length === 0) return undefined;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(line);\n  } catch {\n    return undefined;\n  }\n  return isPlainObject(parsed) ? parsed : undefined;\n}\n\n/**\n * Parse a JSONL file into rows. Blank lines are skipped. A malformed or\n * non-object line throws {@link JsonlParseError} naming the 1-based line. When\n * `map` is provided, each raw object is mapped to the typed row (the SWE-bench\n * schema lives in the caller's `map`, per M6 ADR D3).\n */\nexport function loadJsonl<T = Record<string, unknown>>(\n  path: string,\n  opts: {\n    map?: (raw: Record<string, unknown>, lineNumber: number) => T;\n    /**\n     * M81 — tolerate a truncated LAST line (a crash artifact: the process died mid-write).\n     *\n     * Opt-in on purpose. As a default it would also swallow corruption in the MIDDLE of the file,\n     * turning loud data loss into silent data loss — the wrong trade for a session store.\n     */\n    tolerateTrailingPartialLine?: boolean;\n  } = {},\n): T[] {\n  const lines = readFileSync(path, \"utf8\").split(\"\\n\");\n  const out: T[] = [];\n  for (let i = 0; i < lines.length; i += 1) {\n    const lineNumber = i + 1;\n    const line = (lines[i] ?? \"\").trim();\n    if (line.length === 0) continue;\n    // M81 — `undefined` = a tolerated invalid line (the last one, truncated by a crash). Any other\n    // invalid line has already thrown inside `parseLine`.\n    const parsed = parseLine(\n      line,\n      lineNumber,\n      opts.tolerateTrailingPartialLine === true && lineNumber === lines.length,\n    );\n    if (parsed === undefined) break;\n    out.push(opts.map ? opts.map(parsed, lineNumber) : (parsed as unknown as T));\n  }\n  return out;\n}\n\n/**\n * Parses ONE line, returning `undefined` when it is a tolerated truncated last line.\n *\n * Extracted because `loadJsonl` went over the cognitive-complexity ceiling once it gained the\n * tolerance — and because parsing a line and iterating a file are two responsibilities that were\n * only together out of habit.\n */\nfunction parseLine(\n  line: string,\n  lineNumber: number,\n  tolerate: boolean,\n): Record<string, unknown> | undefined {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(line);\n  } catch {\n    if (tolerate) return undefined;\n    throw new JsonlParseError(`line ${lineNumber}: invalid JSON`, lineNumber);\n  }\n  if (!isPlainObject(parsed)) {\n    throw new JsonlParseError(`line ${lineNumber}: not a JSON object`, lineNumber);\n  }\n  return parsed;\n}\n\n/**\n * Append one record as a whole `\\n`-terminated JSON line. Creates the parent dir\n * if missing. `appendFileSync` is synchronous, so within a single Node process\n * the event loop serializes writes and each call writes its line atomically —\n * interleave-safe for the bounded-concurrency batch runner.\n *\n * reference: swebench-batch.ts:192 (mkdir-before-append), :205 (per-line flush).\n */\nexport function appendJsonl(path: string, record: unknown): void {\n  // T2.4 — `0o700` for the same reason the file below is `0o600`, and it is the half M93 missed. A\n  // private file inside a group-writable directory can be replaced wholesale, and the replacement's\n  // mode is whatever the writer chose. Under `umask 002` this directory was born `0775`.\n  //\n  // The directory sits under `~/.theokit`, shared with the credential and trust stores, and the\n  // framework already wrote the diagnosis while fixing a sibling (`@theokit/agents\n  // config/trust-store.ts:157-161`): the mode argument is a no-op on a directory that already\n  // exists, \"and this one is shared with the SDK's transcript root — whoever creates it first sets\n  // the permissions\". Whoever creates it first is usually THIS function, because a session writes a\n  // transcript before it ever touches a credential. So `assertSecureModes` was not wrong to demand a\n  // private directory; this path was wrong to produce one that fails it, depending on run order.\n  //\n  // Creation-time only, deliberately: repairing a pre-existing directory means `stat` + `chmod` on\n  // every append, and this is the hot path of every session. The pre-existing case is what\n  // `assertSecureModes` is for.\n  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });\n  const prefix = needsLineBreakBefore(path) ? \"\\n\" : \"\";\n  // M93 (adversarial review, H1) — `0o600`. `appendFileSync` takes no `mode`, so the permission came\n  // from the umask: under `umask 022` the transcript was born `0664`, world-readable. The previous\n  // path (`replaceFileAtomic`) pinned `0o600` on purpose — \"holds the FULL in-flight content\n  // (credential snapshots, OAuth tokens)\" (`atomic-write.ts:107`) — and switching to append lost\n  // that silently. The same class had already been caught in the consumer (`atomic-sync.ts`, M88\n  // HIGH-1).\n  //\n  // `mode` only applies on CREATION; a pre-existing file keeps whatever permission it already has.\n  const fd = openSync(path, \"a\", 0o600);\n  try {\n    writeSync(fd, `${prefix}${JSON.stringify(record)}\\n`);\n  } finally {\n    closeSync(fd);\n  }\n}\n\n/**\n * Does the file end without a `\\n`? Then the last line is truncated — a crash mid-append.\n *\n * Without this check the next append **glues** itself onto the middle of the broken line, producing\n * an invalid line the reader discards: the NEW record disappears along with the partial one. The\n * previous path (read-modify-write) self-healed from this because it rewrote the whole file.\n * Measured in M93's adversarial review (H2): after an append over a truncated file, the\n * just-written record was no longer readable.\n *\n * Reads **one byte**, not the file.\n */\nfunction needsLineBreakBefore(path: string): boolean {\n  let fd: number;\n  try {\n    fd = openSync(path, \"r\");\n  } catch {\n    return false; // the file does not exist yet: nothing to splice onto\n  }\n  try {\n    const size = fstatSync(fd).size;\n    if (size === 0) return false;\n    const buf = Buffer.alloc(1);\n    readSync(fd, buf, 0, 1, size - 1);\n    return buf[0] !== 0x0a;\n  } finally {\n    closeSync(fd);\n  }\n}\n\n/**\n * Read the set of keys from an existing JSONL file for which `keyFn(parsed)`\n * returns a non-empty string. Used to resume a crashed batch by skipping rows\n * already persisted with a successful result. A trailing partial line from an\n * interrupted append is tolerated (skipped, not thrown), and a missing file\n * yields an empty set.\n *\n * reference: swebench-batch.ts:113 (readDoneIds), :129 (success-only),\n * :131 (tolerate partial line).\n */\nexport function readJsonlIds(\n  path: string,\n  keyFn: (parsed: Record<string, unknown>) => string | undefined,\n): Set<string> {\n  const done = new Set<string>();\n  let text: string;\n  try {\n    text = readFileSync(path, \"utf8\");\n  } catch {\n    return done; // no file yet → nothing done\n  }\n  for (const rawLine of text.split(\"\\n\")) {\n    // A trailing partial line from an interrupted run parses to undefined → skipped.\n    const parsed = tryParseObjectLine(rawLine.trim());\n    if (parsed === undefined) continue;\n    const key = keyFn(parsed);\n    if (typeof key === \"string\" && key.length > 0) done.add(key);\n  }\n  return done;\n}\n"]}

package/dist/chunk-CEILSTWB.cjs

@@ -0,0 +1,109 @@
+'use strict';
+
+var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
+var os = require('os');
+var path = require('path');
+var fs = require('fs');
+
+var THEOKIT_DIR_LITERAL = ".theokit";
+var CLAUDE_DIR_NAME = ".claude";
+var NATIVE_SOURCE = {
+  kind: "theokit",
+  dirName: THEOKIT_DIR_LITERAL,
+  runtimeEnv: () => ({})
+};
+var CLAUDE_CODE_SOURCE = {
+  kind: "claude-code",
+  dirName: CLAUDE_DIR_NAME,
+  runtimeEnv: (cwd) => ({ CLAUDE_PROJECT_DIR: cwd })
+};
+var FOREIGN_SOURCES = [CLAUDE_CODE_SOURCE];
+var BY_DIR_NAME = new Map(
+  [NATIVE_SOURCE, ...FOREIGN_SOURCES].map((a) => [a.dirName, a])
+);
+function adaptersFor(kinds) {
+  const byKind = new Map(FOREIGN_SOURCES.map((a) => [a.kind, a]));
+  const out = [];
+  for (const kind of kinds) {
+    const adapter = byKind.get(kind);
+    if (adapter !== void 0 && !out.includes(adapter)) out.push(adapter);
+  }
+  return out;
+}
+function adapterForConfigPath(path) {
+  for (const segment of path.split(/[\\/]/)) {
+    const adapter = BY_DIR_NAME.get(segment);
+    if (adapter !== void 0) return adapter;
+  }
+  return void 0;
+}
+function undefinedVariablesIn(command, supplied, env = process.env) {
+  const unquoted = command.replace(/'[^']*'/g, " ");
+  const names = /* @__PURE__ */ new Set();
+  for (const match of unquoted.matchAll(
+    /\$\{([A-Za-z_][A-Za-z0-9_]*)\}|\$([A-Za-z_][A-Za-z0-9_]*)/g
+  )) {
+    const name = match[1] ?? match[2];
+    if (name === void 0) continue;
+    if (name in supplied) continue;
+    if (env[name] !== void 0) continue;
+    names.add(name);
+  }
+  return [...names];
+}
+var reported = /* @__PURE__ */ new Set();
+function reportUndeclaredSources(cwd, declared) {
+  const declaredKinds = new Set(adaptersFor(declared).map((a) => a.kind));
+  for (const adapter of FOREIGN_SOURCES) {
+    if (declaredKinds.has(adapter.kind)) continue;
+    const dir = path.join(cwd, adapter.dirName);
+    if (!fs.existsSync(dir)) continue;
+    if (reported.has(dir)) continue;
+    reported.add(dir);
+    chunk6LHQPOMI_cjs.diag(
+      `[theokit] ${adapter.dirName}/ is present but not declared, so its hooks, skills, subagents and plugins are ignored. To read it, pass local: { compatSources: ["${adapter.kind}"] } (usetheokit/theokit-sdk#524).
+`
+    );
+  }
+}
+
+// src/internal/persistence/paths.ts
+function getTheokitHome(cwd) {
+  const override = process.env.THEOKIT_HOME?.trim();
+  if (override !== void 0 && override.length > 0) {
+    return override;
+  }
+  return path.join(cwd, THEOKIT_DIR_LITERAL);
+}
+function projectConfigRoots(cwd, sources = []) {
+  return [
+    path.join(cwd, THEOKIT_DIR_LITERAL),
+    ...adaptersFor(sources).map((adapter) => path.join(cwd, adapter.dirName))
+  ];
+}
+function pluginBundleRoots(cwd, sources = []) {
+  return projectConfigRoots(cwd, sources).map((root) => path.join(root, "plugins"));
+}
+function getProfilesRoot() {
+  return path.join(os.homedir(), THEOKIT_DIR_LITERAL, "profiles");
+}
+function displayTheokitHome(cwd) {
+  const resolved = getTheokitHome(cwd);
+  const home = os.homedir();
+  if (resolved === home) return "~";
+  if (resolved.startsWith(`${home}/`)) {
+    return `~${resolved.slice(home.length)}`;
+  }
+  return resolved;
+}
+
+exports.adapterForConfigPath = adapterForConfigPath;
+exports.displayTheokitHome = displayTheokitHome;
+exports.getProfilesRoot = getProfilesRoot;
+exports.getTheokitHome = getTheokitHome;
+exports.pluginBundleRoots = pluginBundleRoots;
+exports.projectConfigRoots = projectConfigRoots;
+exports.reportUndeclaredSources = reportUndeclaredSources;
+exports.undefinedVariablesIn = undefinedVariablesIn;
+//# sourceMappingURL=chunk-CEILSTWB.cjs.map
+//# sourceMappingURL=chunk-CEILSTWB.cjs.map

package/dist/chunk-CEILSTWB.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/compat/foreign-config-sources.ts","../src/internal/persistence/paths.ts"],"names":["join","existsSync","diag","homedir"],"mappings":";;;;;;;AAmDO,IAAM,mBAAA,GAAsB,UAAA;AAG5B,IAAM,eAAA,GAAkB,SAAA;AAkBxB,IAAM,aAAA,GAAqC;AAAA,EAChD,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS,mBAAA;AAAA,EACT,UAAA,EAAY,OAAO,EAAC;AACtB,CAAA;AAWO,IAAM,kBAAA,GAA0C;AAAA,EACrD,IAAA,EAAM,aAAA;AAAA,EACN,OAAA,EAAS,eAAA;AAAA,EACT,UAAA,EAAY,CAAC,GAAA,MAAS,EAAE,oBAAoB,GAAA,EAAI;AAClD,CAAA;AAEA,IAAM,eAAA,GAAkD,CAAC,kBAAkB,CAAA;AAE3E,IAAM,cAAwD,IAAI,GAAA;AAAA,EAChE,CAAC,aAAA,EAAe,GAAG,eAAe,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,OAAA,EAAS,CAAC,CAAC;AAC/D,CAAA;AASO,SAAS,YAAY,KAAA,EAAiD;AAC3E,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,eAAA,CAAgB,GAAA,CAAI,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAC,CAAC,CAAA;AAC9D,EAAA,MAAM,MAA6B,EAAC;AACpC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,IAAI,CAAA;AAC/B,IAAA,IAAI,OAAA,KAAY,UAAa,CAAC,GAAA,CAAI,SAAS,OAAO,CAAA,EAAG,GAAA,CAAI,IAAA,CAAK,OAAO,CAAA;AAAA,EACvE;AACA,EAAA,OAAO,GAAA;AACT;AASO,SAAS,qBAAqB,IAAA,EAA+C;AAClF,EAAA,KAAA,MAAW,OAAA,IAAW,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA,EAAG;AACzC,IAAA,MAAM,OAAA,GAAU,WAAA,CAAY,GAAA,CAAI,OAAO,CAAA;AACvC,IAAA,IAAI,OAAA,KAAY,QAAW,OAAO,OAAA;AAAA,EACpC;AACA,EAAA,OAAO,MAAA;AACT;AAuBO,SAAS,oBAAA,CACd,OAAA,EACA,QAAA,EACA,GAAA,GAAoD,QAAQ,GAAA,EAClD;AAEV,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA;AAChD,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,EAAA,KAAA,MAAW,SAAS,QAAA,CAAS,QAAA;AAAA,IAC3B;AAAA,GACF,EAAG;AACD,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,MAAM,CAAC,CAAA;AAChC,IAAA,IAAI,SAAS,MAAA,EAAW;AACxB,IAAA,IAAI,QAAQ,QAAA,EAAU;AACtB,IAAA,IAAI,GAAA,CAAI,IAAI,CAAA,KAAM,MAAA,EAAW;AAC7B,IAAA,KAAA,CAAM,IAAI,IAAI,CAAA;AAAA,EAChB;AACA,EAAA,OAAO,CAAC,GAAG,KAAK,CAAA;AAClB;AAQA,IAAM,QAAA,uBAAe,GAAA,EAAY;AAqB1B,SAAS,uBAAA,CAAwB,KAAa,QAAA,EAAmC;AACtF,EAAA,MAAM,aAAA,GAAgB,IAAI,GAAA,CAAI,WAAA,CAAY,QAAQ,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AACtE,EAAA,KAAA,MAAW,WAAW,eAAA,EAAiB;AACrC,IAAA,IAAI,aAAA,CAAc,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AACrC,IAAA,MAAM,GAAA,GAAMA,SAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,OAAO,CAAA;AACrC,IAAA,IAAI,CAACC,aAAA,CAAW,GAAG,CAAA,EAAG;AACtB,IAAA,IAAI,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,IAAA,QAAA,CAAS,IAAI,GAAG,CAAA;AAChB,IAAAC,sBAAA;AAAA,MACE,CAAA,UAAA,EAAa,OAAA,CAAQ,OAAO,CAAA,mIAAA,EAEG,QAAQ,IAAI,CAAA;AAAA;AAAA,KAC7C;AAAA,EACF;AACF;;;AC1JO,SAAS,eAAe,GAAA,EAAqB;AAClD,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,YAAA,EAAc,IAAA,EAAK;AAChD,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACjD,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,OAAOF,SAAAA,CAAK,KAAK,mBAAmB,CAAA;AACtC;AA6BO,SAAS,kBAAA,CAAmB,GAAA,EAAa,OAAA,GAA6B,EAAC,EAAa;AACzF,EAAA,OAAO;AAAA,IACLA,SAAAA,CAAK,KAAK,mBAAmB,CAAA;AAAA,IAC7B,GAAG,WAAA,CAAY,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,OAAA,KAAYA,SAAAA,CAAK,GAAA,EAAK,OAAA,CAAQ,OAAO,CAAC;AAAA,GACrE;AACF;AAeO,SAAS,iBAAA,CAAkB,GAAA,EAAa,OAAA,GAA6B,EAAC,EAAa;AACxF,EAAA,OAAO,kBAAA,CAAmB,GAAA,EAAK,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAASA,SAAAA,CAAK,IAAA,EAAM,SAAS,CAAC,CAAA;AAC7E;AAeO,SAAS,eAAA,GAA0B;AACxC,EAAA,OAAOA,SAAAA,CAAKG,UAAA,EAAQ,EAAG,mBAAA,EAAqB,UAAU,CAAA;AACxD;AAmBO,SAAS,mBAAmB,GAAA,EAAqB;AACtD,EAAA,MAAM,QAAA,GAAW,eAAe,GAAG,CAAA;AACnC,EAAA,MAAM,OAAOA,UAAA,EAAQ;AACrB,EAAA,IAAI,QAAA,KAAa,MAAM,OAAO,GAAA;AAC9B,EAAA,IAAI,QAAA,CAAS,UAAA,CAAW,CAAA,EAAG,IAAI,GAAG,CAAA,EAAG;AACnC,IAAA,OAAO,CAAA,CAAA,EAAI,QAAA,CAAS,KAAA,CAAM,IAAA,CAAK,MAAM,CAAC,CAAA,CAAA;AAAA,EACxC;AACA,EAAA,OAAO,QAAA;AACT","file":"chunk-CEILSTWB.cjs","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nimport { diag } from \"../../diagnostics.js\";\n\n/*\n * The foreign configuration dialects this SDK can read, and what each one PRESUMES.\n *\n * ## Why a registry and not a list of directory names\n *\n * `projectConfigRoots` returned `[\".theokit\", \".claude\"]` — two paths — and that shape is what\n * usetheokit/theokit-sdk#522 fell through. A path says WHERE a file lives. It does not say how the\n * file is parsed, and it does not say what runtime the commands inside it were written against.\n *\n * Claude Code defines `$CLAUDE_PROJECT_DIR` for the hook commands in its `settings.json`, and its\n * documentation tells authors to reach project files through it — an absolute path would break for\n * every other person on the team, so the shape that failed here is the shape upstream recommends.\n * This SDK read the file and ran the command without the variable. `sh` expands an unset variable to\n * the empty string, so\n *\n *     bash \"$CLAUDE_PROJECT_DIR/.claude/hooks/guard.sh\"   became   bash \"/.claude/hooks/guard.sh\"\n *\n * which does not exist, which a hook runner correctly reads as a refusal. Every turn denied, in any\n * repository that also had Claude Code set up, with a message naming a file that was present and\n * executable all along.\n *\n * Importing a format means accepting the contract that format presumes. An adapter is where that\n * contract is written down, so the next dialect (`.codex/` is the obvious one) declares its own\n * instead of inheriting a hole.\n *\n * ## What an adapter deliberately does NOT do\n *\n * It does not make the foreign source trusted, and it does not make its hooks permissive: a script\n * that exits non-zero is still a refusal. It supplies the variables the format's authors were\n * entitled to assume, and nothing else — `env` here is merged over the scrubbed inherit policy by\n * `spawnAndCollect`, so it adds names rather than widening what a child can see.\n *\n * @internal\n */\n\n/**\n * The project config directory literal.\n *\n * Renamed from `THEOKIT_DIR_NAME` in #410. Sharing a name with the (now removed) sovereign env var\n * was the MECHANISM of that defect, not scenery: every grep for the variable landed on that const\n * and looked answered, so \"is it read?\" returned five hits and nobody checked what they were.\n *\n * Lives here rather than in `persistence/paths.ts` because a directory name is one third of what a\n * dialect is — the other two being how it parses and what it presumes — and splitting the three\n * across two modules is what let the third go unwritten.\n */\nexport const THEOKIT_DIR_LITERAL = \".theokit\";\n\n/** The Claude Code CLI's project configuration directory. */\nexport const CLAUDE_DIR_NAME = \".claude\";\n\n/** A configuration dialect this SDK understands. `theokit` is native; the rest are foreign. */\nexport interface ConfigSourceAdapter {\n  /** Stable identifier, and what a consumer names to opt in. */\n  readonly kind: string;\n  /** The project-relative directory the dialect keeps its configuration in. */\n  readonly dirName: string;\n  /**\n   * Variables the dialect's own runtime defines for commands it executes.\n   *\n   * Empty for the native source: a `.theokit/` hook is written against THIS runtime and inherits it\n   * already. Non-empty is what makes a foreign command runnable rather than silently broken.\n   */\n  runtimeEnv(cwd: string): Record<string, string>;\n}\n\n/** The native source. Always read, never opted into, always first for precedence. */\nexport const NATIVE_SOURCE: ConfigSourceAdapter = {\n  kind: \"theokit\",\n  dirName: THEOKIT_DIR_LITERAL,\n  runtimeEnv: () => ({}),\n};\n\n/**\n * Claude Code.\n *\n * `CLAUDE_PROJECT_DIR` is the documented way for a hook command in `settings.json` to reach a file\n * in the project. Only that one variable is supplied: `$CLAUDE_PLUGIN_ROOT` and the rest of that\n * runtime's surface are NOT defined here, because supplying a name whose value this SDK would have\n * to invent is worse than leaving it unset — an invented root sends a script somewhere real and\n * wrong, where an unset one fails loudly.\n */\nexport const CLAUDE_CODE_SOURCE: ConfigSourceAdapter = {\n  kind: \"claude-code\",\n  dirName: CLAUDE_DIR_NAME,\n  runtimeEnv: (cwd) => ({ CLAUDE_PROJECT_DIR: cwd }),\n};\n\nconst FOREIGN_SOURCES: readonly ConfigSourceAdapter[] = [CLAUDE_CODE_SOURCE];\n\nconst BY_DIR_NAME: ReadonlyMap<string, ConfigSourceAdapter> = new Map(\n  [NATIVE_SOURCE, ...FOREIGN_SOURCES].map((a) => [a.dirName, a]),\n);\n\n/**\n * The adapters a caller declared, in declaration order, skipping any name that names no adapter.\n *\n * An unknown name is DROPPED rather than turned into `<cwd>/<name>`: a typo must fail closed. Making\n * a directory out of an unrecognised string would import a dialect nothing knows how to parse — and\n * the whole reason this exists is that a directory name was never enough to describe a dialect.\n */\nexport function adaptersFor(kinds: readonly string[]): ConfigSourceAdapter[] {\n  const byKind = new Map(FOREIGN_SOURCES.map((a) => [a.kind, a]));\n  const out: ConfigSourceAdapter[] = [];\n  for (const kind of kinds) {\n    const adapter = byKind.get(kind);\n    if (adapter !== undefined && !out.includes(adapter)) out.push(adapter);\n  }\n  return out;\n}\n\n/**\n * The adapter whose directory an absolute config path sits under, or `undefined` for a path that\n * belongs to no registered dialect.\n *\n * Matched on the path SEGMENT rather than with `includes`, so a workspace that happens to live under\n * `/home/me/.claude-backups/repo` does not read as a Claude Code source.\n */\nexport function adapterForConfigPath(path: string): ConfigSourceAdapter | undefined {\n  for (const segment of path.split(/[\\\\/]/)) {\n    const adapter = BY_DIR_NAME.get(segment);\n    if (adapter !== undefined) return adapter;\n  }\n  return undefined;\n}\n\n/**\n * Variable references in a shell command that nothing will define.\n *\n * The second half of #522, and the half that cost the debugging session. `sh` expands an unset\n * variable to the empty string and says nothing, so the failure surfaces ten characters later as a\n * path: `bash: /.claude/hooks/guard.sh: No such file or directory` — which reads as \"your script is\n * missing\" while the script is present and executable. Nothing in that message contains the name of\n * the variable that was actually missing, so the reader looks in the wrong place.\n *\n * Checked against BOTH the process environment and the variables the dialect supplies, because\n * either is a legitimate source: a hook may reasonably use `$HOME`.\n *\n * ## What it deliberately does not try to be\n *\n * This is not a shell parser. It finds `$NAME` and `${NAME}` outside single quotes, which is the\n * shape a config file's hook commands take. It does NOT understand `${NAME:-default}` (a default\n * makes the variable optional, so it is not reported), assignments earlier in the same command, or\n * variables a sourced script exports. A false NEGATIVE there costs the old behaviour — the confusing\n * path error — and a false positive would deny a hook that would have worked, so the parse errs\n * toward silence and the check only ever ADDS a name to a failure that already happened.\n */\nexport function undefinedVariablesIn(\n  command: string,\n  supplied: Readonly<Record<string, string>>,\n  env: Readonly<Record<string, string | undefined>> = process.env,\n): string[] {\n  // Single-quoted spans are literal in `sh`: `echo '$FOO'` prints the dollar sign.\n  const unquoted = command.replace(/'[^']*'/g, \" \");\n  const names = new Set<string>();\n  for (const match of unquoted.matchAll(\n    /\\$\\{([A-Za-z_][A-Za-z0-9_]*)\\}|\\$([A-Za-z_][A-Za-z0-9_]*)/g,\n  )) {\n    const name = match[1] ?? match[2];\n    if (name === undefined) continue;\n    if (name in supplied) continue;\n    if (env[name] !== undefined) continue;\n    names.add(name);\n  }\n  return [...names];\n}\n\n/**\n * Workspaces already reported, so repeated agent construction in one process says it once.\n *\n * Keyed by the resolved directory rather than by dialect kind, so a long-lived host that drives\n * several workspaces still reports each of them.\n */\nconst reported = new Set<string>();\n\n/**\n * Reports a foreign configuration directory that exists in the workspace and was not declared.\n *\n * ## Why the flip needs a voice\n *\n * Before #524 a `.claude/` was read with no opt-in; after it, the same directory is ignored. From\n * inside the repository the two states are indistinguishable — the hook file is there, it is\n * executable, and it does not run. The only remaining way to learn why is a CHANGELOG entry for a\n * version the reader may not know they crossed.\n *\n * ## Why `diag` rather than `diagFailure`\n *\n * `diagFailure` falls back to stderr, and this is not a failure: ignoring an undeclared foreign\n * directory is precisely what #524 asked for. Every repository that has Claude Code set up and does\n * NOT want it imported would pay a stderr line at every agent start — on a TUI host's render\n * surface — for behaving as instructed. That is the corruption `diagnostics.ts` exists to prevent.\n *\n * So it goes on the interceptable channel, for the reader holding the question it answers.\n */\nexport function reportUndeclaredSources(cwd: string, declared: readonly string[]): void {\n  const declaredKinds = new Set(adaptersFor(declared).map((a) => a.kind));\n  for (const adapter of FOREIGN_SOURCES) {\n    if (declaredKinds.has(adapter.kind)) continue;\n    const dir = join(cwd, adapter.dirName);\n    if (!existsSync(dir)) continue;\n    if (reported.has(dir)) continue;\n    reported.add(dir);\n    diag(\n      `[theokit] ${adapter.dirName}/ is present but not declared, so its hooks, skills, subagents ` +\n        `and plugins are ignored. To read it, pass ` +\n        `local: { compatSources: [\"${adapter.kind}\"] } (usetheokit/theokit-sdk#524).\\n`,\n    );\n  }\n}\n","/**\n * Path resolution for SDK state files (ADR D60).\n *\n * Theokit anchors state at `<cwd>/.theokit/` by default (per-cwd). An\n * optional `THEOKIT_HOME` environment variable overrides this, enabling\n * test isolation, profile switching, and multi-tenant deployments.\n *\n * Rules:\n *   - `getTheokitHome(cwd)` is the canonical resolver **for cwd-anchored state**. Never hardcode\n *     `path.join(cwd, \".theokit\")` in callers — use this function so tests\n *     and overrides stay consistent.\n *\n *     M94 — this comment said \"the ONLY canonical resolver\", and stopped being true: the\n *     transcript gained `transcriptRoot()`, which is **home-anchored** (`~/.theokit`) with the same\n *     `THEOKIT_HOME` override. The two defaults differ on purpose — unifying would move the\n *     transcript of everyone who does NOT set the variable, which is a data migration and not a\n *     re-export.\n *\n *     A consequence worth writing down: **without `THEOKIT_HOME` the state stays split in two**\n *     — registry in `<cwd>/.theokit`, transcript in `~/.theokit`. M94 unifies only for those who set\n *     the variable. Unifying both defaults is another milestone's work.\n *   - `getProfilesRoot()` is intentionally home-anchored (not affected by\n *     `THEOKIT_HOME`) so `theokit profile list` discovers all profiles\n *     regardless of which is active.\n *   - `displayTheokitHome(cwd)` returns a human-readable path for logs.\n *\n * @internal\n */\n\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nimport { adaptersFor, THEOKIT_DIR_LITERAL } from \"../runtime/compat/foreign-config-sources.js\";\n\n// The directory names live with the dialect registry that owns them — a name is one third of what a\n// configuration dialect is, and keeping the three together is what stops the next one shipping\n// without its runtime contract (#522).\n\n/**\n * Resolve the directory cwd-anchored SDK state lives in.\n *\n * `THEOKIT_HOME` wins when it is set and not blank after trimming; the trimmed value is used, and\n * it is used VERBATIM — it is not resolved against `cwd`, so a relative value stays relative and\n * `.theokit` is not appended to it. Otherwise the answer is `<cwd>/.theokit`.\n *\n * The environment is read on every call, so a change to the variable takes effect immediately\n * rather than being frozen at import.\n *\n * This creates nothing and checks nothing: the returned path may not exist, and the caller owns\n * the `mkdir`. Call it instead of writing `join(cwd, \".theokit\")` by hand, or the override stops\n * working for that one call site and tests silently touch the real home.\n *\n * Not the whole story about where state lives — the transcript is home-anchored via\n * `transcriptRoot()`, honoring the same variable but defaulting to `~/.theokit`. With\n * `THEOKIT_HOME` unset, state is genuinely split between two roots.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function getTheokitHome(cwd: string): string {\n  const override = process.env.THEOKIT_HOME?.trim();\n  if (override !== undefined && override.length > 0) {\n    return override;\n  }\n  return join(cwd, THEOKIT_DIR_LITERAL);\n}\n\n/**\n * Every directory a project's configuration may be read from, in precedence order.\n *\n * `.theokit` first, then `.claude`. The order is the whole contract: a project that declares a\n * skill, agent or rule in both means the explicit namespace to win, and a caller merging these\n * roots must therefore keep the FIRST occurrence of a name rather than the last.\n *\n * `.claude` is read because the formats already agree and only the location did not. Measured\n * 2026-08-26: the SKILL.md frontmatter this SDK requires (`name` + `description`) is exactly what\n * the CLI writes, its hook config is the same JSON shape, and 59 of the CLI's agent declarations\n * parse here unchanged. A repository set up for the CLI was failing on the directory name alone.\n *\n * NOT a rename of `.theokit`, and not a migration. Both are read, so nothing that works today stops\n * working — which is why this returns a LIST and not a single resolved answer.\n *\n * Deliberately NOT affected by `THEOKIT_HOME`, and this is the one thing to remember about it.\n * That variable relocates cwd-anchored SDK *state* — sessions, the credential store. A project's\n * *configuration* is a property of the repository, not of where this SDK keeps its state, and the\n * loaders that read these directories have always anchored on `cwd` directly. Honouring the\n * override here would silently move where a project's agents and skills come from, which is a\n * behaviour change wearing the costume of a refactor.\n *\n * Creates nothing and checks nothing; either path may not exist, and the caller owns that.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function projectConfigRoots(cwd: string, sources: readonly string[] = []): string[] {\n  return [\n    join(cwd, THEOKIT_DIR_LITERAL),\n    ...adaptersFor(sources).map((adapter) => join(cwd, adapter.dirName)),\n  ];\n}\n\n/**\n * Every directory that may hold a plugin BUNDLE contributed by the Claude Code CLI.\n *\n * A CLI plugin is not a JS entry point — it is a folder whose `skills/` and `agents/` are what it\n * exists to provide. Measured 2026-08-26 on an installed one: seven agents and three skills beside\n * a manifest in `.claude-plugin/plugin.json`. Parsing that manifest and stopping there produced a\n * plugin that loaded and did nothing.\n *\n * Project-scoped deliberately. The CLI also keeps plugins under `~/.claude/plugins/cache`, behind\n * its own installer and enable/disable state — reproducing that is an installation system, not\n * reading a project's configuration, and guessing at someone's enablement would run code they\n * turned off.\n */\nexport function pluginBundleRoots(cwd: string, sources: readonly string[] = []): string[] {\n  return projectConfigRoots(cwd, sources).map((root) => join(root, \"plugins\"));\n}\n\n/**\n * The directory holding every profile: always `~/.theokit/profiles`, from `os.homedir()`.\n *\n * Deliberately NOT affected by `THEOKIT_HOME`, which is the one thing to remember about it. If it\n * followed the override, a session pointed at one profile would only be able to see that profile,\n * and `theokit profile list` could never enumerate the rest. Profiles are the thing the override\n * switches between, so their index cannot live behind it.\n *\n * Takes no `cwd` for the same reason. Creates nothing; the path may not exist.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function getProfilesRoot(): string {\n  return join(homedir(), THEOKIT_DIR_LITERAL, \"profiles\");\n}\n\n/**\n * The same path `getTheokitHome(cwd)` returns, shortened for display: the home directory prefix\n * collapses to `~`, so `/home/ada/.theokit` prints as `~/.theokit`.\n *\n * For humans only — log lines, CLI output, error messages. The result is NOT a usable path: `~`\n * is a shell convention that `fs` does not expand, so passing this to a filesystem call resolves\n * a literal directory named `~` relative to the process cwd. Use `getTheokitHome` for anything\n * that touches disk.\n *\n * Collapsing is a prefix match on the home directory followed by a literal `/`, so a sibling like\n * `/home/adalovelace` is left alone even though `/home/ada` is a string prefix of it. A path\n * outside the home directory comes back unchanged — and so does a Windows path, where the\n * separator is a backslash and the prefix test therefore never matches.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/persistence` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function displayTheokitHome(cwd: string): string {\n  const resolved = getTheokitHome(cwd);\n  const home = homedir();\n  if (resolved === home) return \"~\";\n  if (resolved.startsWith(`${home}/`)) {\n    return `~${resolved.slice(home.length)}`;\n  }\n  return resolved;\n}\n"]}

package/dist/{chunk-D4CUGAKZ.js → chunk-CZJ6Q7CW.js}

@@ -1,5 +1,3 @@
-import { diag } from './chunk-XEQ3TM66.js';
-
 // src/internal/env.ts
 var API_KEY_ENV_VAR = "THEOKIT_API_KEY";
 function readEnv(name) {
@@ -16,6 +14,38 @@ function resolveApiKey(explicit) {
   return void 0;
 }
 
+// src/internal/diagnostics.ts
+var SINK_SLOT = /* @__PURE__ */ Symbol.for("theokit.sdk.diagnostics.sink.v1");
+function currentSink() {
+  return globalThis[SINK_SLOT];
+}
+function setDiagnosticsSink(next) {
+  globalThis[SINK_SLOT] = next;
+}
+function diag(message) {
+  const sink = currentSink();
+  if (sink === void 0) return;
+  try {
+    sink(message);
+  } catch {
+  }
+}
+function diagFailure(message) {
+  const sink = currentSink();
+  if (sink !== void 0) {
+    try {
+      sink(message);
+      return;
+    } catch {
+    }
+  }
+  try {
+    globalThis.process?.stderr?.write(`${message}
+`);
+  } catch {
+  }
+}
+
 // src/internal/security/redact.ts
 var REDACT_ENABLED = readEnvOnce();
 function readEnvOnce() {
@@ -105,7 +135,7 @@ var PARAM_PATTERN = /(\b(?:access_token|api_key|api-key|client_secret|credential
 var _extraPatterns = [];
 function addPattern(re) {
   if (!re.global) {
-    throw new Error("Security.addPattern: regex must have /g flag for replace-all semantics");
+    throw new Error("addPattern: regex must have /g flag for replace-all semantics");
   }
   _extraPatterns.push(re);
 }
@@ -148,6 +178,6 @@ function redactSecrets(text, opts) {
   return s;
 }
 
-export { API_KEY_ENV_VAR, addPattern, maskToken, readEnv, redactSecrets, resolveApiKey };
-//# sourceMappingURL=chunk-D4CUGAKZ.js.map
-//# sourceMappingURL=chunk-D4CUGAKZ.js.map
+export { API_KEY_ENV_VAR, addPattern, diag, diagFailure, maskToken, readEnv, redactSecrets, resolveApiKey, setDiagnosticsSink };
+//# sourceMappingURL=chunk-CZJ6Q7CW.js.map
+//# sourceMappingURL=chunk-CZJ6Q7CW.js.map

package/dist/chunk-CZJ6Q7CW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/env.ts","../src/internal/diagnostics.ts","../src/internal/security/redact.ts"],"names":[],"mappings":";AAKO,IAAM,eAAA,GAAkB;AAoBxB,SAAS,QAAQ,IAAA,EAAkC;AACxD,EAAA,OAAO,UAAA,CAAW,OAAA,EAAS,GAAA,GAAM,IAAI,CAAA;AACvC;AAYO,SAAS,cAAc,QAAA,EAAuC;AACnE,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACjD,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,eAAe,CAAA;AACvC,EAAA,IAAI,OAAA,KAAY,MAAA,IAAa,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC/C,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,OAAO,MAAA;AACT;;;ACoBA,IAAM,SAAA,mBAAY,MAAA,CAAO,GAAA,CAAI,iCAAiC,CAAA;AAI9D,SAAS,WAAA,GAA2C;AAClD,EAAA,OAAQ,WAAqC,SAAS,CAAA;AACxD;AASO,SAAS,mBAAmB,IAAA,EAAyC;AAC1E,EAAC,UAAA,CAAqC,SAAS,CAAA,GAAI,IAAA;AACrD;AAQO,SAAS,KAAK,OAAA,EAAuB;AAG1C,EAAA,MAAM,OAAO,WAAA,EAAY;AACzB,EAAA,IAAI,SAAS,MAAA,EAAW;AACxB,EAAA,IAAI;AACF,IAAA,IAAA,CAAK,OAAO,CAAA;AAAA,EACd,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAqBO,SAAS,YAAY,OAAA,EAAuB;AACjD,EAAA,MAAM,OAAO,WAAA,EAAY;AACzB,EAAA,IAAI,SAAS,MAAA,EAAW;AACtB,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,OAAO,CAAA;AACZ,MAAA;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI;AAKF,IAAA,UAAA,CAAW,OAAA,EAAS,MAAA,EAAQ,KAAA,CAAM,CAAA,EAAG,OAAO;AAAA,CAAI,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;;;ACtHA,IAAI,iBAA0B,WAAA,EAAY;AAE1C,SAAS,WAAA,GAAuB;AAG9B,EAAA,MAAM,GAAA,GAAM,QAAQ,wBAAwB,CAAA;AAC5C,EAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,IAAA;AAC9B,EAAA,OAAO,CAAC,KAAK,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA,CAAE,QAAA,CAAS,GAAA,CAAI,WAAA,EAAa,CAAA;AAC9D;AAGA,IAAI,YAAA,GAAe,KAAA;AACnB,IAAI,CAAC,cAAA,IAAkB,CAAC,YAAA,EAAc;AACpC,EAAA,IAAA;AAAA,IACE;AAAA,GAEF;AACA,EAAA,YAAA,GAAe,IAAA;AACjB;AASA,IAAM,gBAAA,GAAsC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1C,iJAAA;AAAA;AAAA;AAAA,EAGA,gEAAA;AAAA;AAAA,EAEA,mCAAA;AAAA;AAAA,EAEA,oCAAA;AAAA;AAAA,EACA,4BAAA;AAAA;AAAA;AAAA,EAEA,6BAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA;AAAA,EAEA,wBAAA;AAAA;AAAA,EACA,mBAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,8BAAA;AAAA;AAAA,EACA,uBAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,2BAAA;AAAA;AAAA,EACA,2BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,yBAAA;AAAA;AAAA,EACA,+BAAA;AAAA;AAAA;AAAA,EAEA,sBAAA;AAAA;AAAA,EACA,2CAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,uBAAA;AAAA;AAAA,EACA,2DAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAKA,IAAM,cAAA,GAAiB,wCAAA;AAoBvB,IAAM,aAAA,GACJ,4NAAA;AAEF,IAAM,iBAA2B,EAAC;AA0B3B,SAAS,WAAW,EAAA,EAAkB;AAC3C,EAAA,IAAI,CAAC,GAAG,MAAA,EAAQ;AASd,IAAA,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAAA,EACjF;AACA,EAAA,cAAA,CAAe,KAAK,EAAE,CAAA;AACxB;AA4BO,SAAS,UAAU,KAAA,EAAuB;AAC/C,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,EAAA,EAAI,OAAO,KAAA;AAC9B,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,EAAM,KAAA,CAAM,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAClD;AAKA,IAAM,UAAA,GAAa,mBAAA;AAMnB,SAAS,eAAe,KAAA,EAA+B;AACrD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AAClD,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAC9B,MAAA,OAAO,CAAA,KAAM,SAAY,IAAA,GAAO,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,0BAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,OAAO,KAAK,CAAA;AACrB;AAqBO,SAAS,aAAA,CAAc,MAAe,IAAA,EAAuC;AAClF,EAAA,MAAM,OAAA,GAAU,eAAe,IAAI,CAAA;AACnC,EAAA,IAAI,OAAA,KAAY,MAAM,OAAO,EAAA;AAC7B,EAAA,IAAI,CAAC,gBAAgB,OAAO,OAAA;AAE5B,EAAA,IAAI,CAAA,GAAI,OAAA;AACR,EAAA,KAAA,MAAW,MAAM,gBAAA,EAAkB;AACjC,IAAA,CAAA,GAAI,EAAE,OAAA,CAAQ,EAAA,EAAI,CAAC,CAAA,KAAM,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,EACvC;AACA,EAAA,KAAA,MAAW,MAAM,cAAA,EAAgB;AAC/B,IAAA,CAAA,GAAI,EAAE,OAAA,CAAQ,EAAA,EAAI,CAAC,CAAA,KAAM,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,EACvC;AACA,EAAA,IAAI,CAAC,MAAM,QAAA,EAAU;AAInB,IAAA,CAAA,GAAI,CAAA,CAAE,QAAQ,cAAA,EAAgB,CAAC,GAAG,MAAA,KAAmB,CAAA,EAAG,MAAM,CAAA,GAAA,CAAK,CAAA;AAInE,IAAA,CAAA,GAAI,EAAE,OAAA,CAAQ,aAAA,EAAe,CAAC,KAAA,EAAO,QAAgB,KAAA,KAAkB;AAOrE,MAAA,IAAI,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAA;AACnC,MAAA,OAAO,GAAG,MAAM,CAAA,GAAA,CAAA;AAAA,IAClB,CAAC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,CAAA;AACT","file":"chunk-CZJ6Q7CW.js","sourcesContent":["/**\n * Environment variable used to provide the default API key.\n *\n * @internal\n */\nexport const API_KEY_ENV_VAR = \"THEOKIT_API_KEY\";\n\n/**\n * Read an environment variable without assuming `process` exists.\n *\n * Parts of this package legitimately reach a browser: `errors.ts` is imported by the client\n * bindings that framework consumers ship to the front end, and it in turn pulls in the redaction\n * and retry modules. `process` is a Node global — a bare `process.env` in any of them throws\n * `ReferenceError: process is not defined` while the module graph is still evaluating, before a\n * single component renders. The page goes blank with one console error that names no cause.\n *\n * `globalThis.process?.env?.[name]` degrades instead: on the server it reads the variable, and in\n * a browser it yields `undefined`, which every caller here already treats as \"not set\". Bundlers\n * that inline `process.env.X` at build time keep working, because they replace the expression\n * before it ever runs.\n *\n * This is the same pattern the sibling design system uses for `NODE_ENV`, for the same reason.\n *\n * @internal\n */\nexport function readEnv(name: string): string | undefined {\n  return globalThis.process?.env?.[name];\n}\n\n/**\n * Resolve the API key with the documented precedence:\n *\n *   1. Explicit `apiKey` argument.\n *   2. The `THEOKIT_API_KEY` environment variable.\n *\n * Returns `undefined` when neither is set.\n *\n * @internal\n */\nexport function resolveApiKey(explicit?: string): string | undefined {\n  if (explicit !== undefined && explicit.length > 0) {\n    return explicit;\n  }\n  const fromEnv = readEnv(API_KEY_ENV_VAR);\n  if (fromEnv !== undefined && fromEnv.length > 0) {\n    return fromEnv;\n  }\n  return undefined;\n}\n","/**\n * The library's single diagnostics channel — silent by default (#147).\n *\n * ## The problem\n *\n * The SDK wrote diagnostics straight to `process.stderr` from hot paths — 92 sites across 51\n * files under `internal/`. In a TUI host (Ink, alternate screen), those writes interleave with the\n * render and **corrupt the frame**. And the host had no way to intercept them: there was no\n * injectable logger. One consumer went as far as installing `proper-lockfile` just to silence ONE\n * of them.\n *\n * A library cannot assume `stdout`/`stderr` are free sinks. The application owns the terminal, not\n * the dependency.\n *\n * ## The contract\n *\n * - **`setDiagnosticsSink(fn)`** hands the messages to the application, which decides where to put\n *   them (a status line, a file, a panel). It is what was missing for a TUI to coexist with the SDK.\n * - **With no sink, nothing is emitted.** A library does not own the host's terminal.\n *\n * ## Silent by default, and how 36 suites survived the flip\n *\n * The default WAS `stderr`, and 36 test files spy on `process.stderr.write` to assert a given\n * warning is emitted. That contract is real and had to survive; migrating all 36 by hand, across\n * four different spy styles, is how you weaken 36 suites in one commit.\n *\n * So the flip happened at the default, and `vitest.setup.ts` installs a sink that FORWARDS to\n * `stderr` for the duration of every test. Those assertions still test what they always tested —\n * \"this condition emits a diagnostic\" — through the channel a host would use, while production\n * emits nothing unless asked.\n *\n * The cost is stated rather than hidden: no test observes the production default by accident, so\n * `tests/diagnostics-public-entry.test.ts` pins it explicitly by clearing the sink first.\n *\n * ## Coverage is the whole guarantee\n *\n * The first sweep migrated the 92 sites under `internal/` and left `src/`'s own modules —\n * `event-bus.ts`, `batch.ts`, `compaction.ts`, `internal/workflow/step-branch.ts`. A host could\n * therefore install a sink and still have its frame corrupted by a batch run, which is the reported\n * defect with a smaller blast radius. Those are routed here too, and\n * `tests/lint/no-direct-terminal-write.test.ts` is what keeps the next hot path from\n * reintroducing one. \"Mostly interceptable\" is not interceptable.\n *\n * The remaining direct writers are allowlisted there with a reason, and every one of them is a seam\n * whose destination the CALLER already chooses (`opts.warn`, `opts.logger`, the Workflow logger).\n *\n * ## What this is NOT\n *\n * It is not a logger with levels, formatting or multiple destinations. It is the minimum that\n * resolves the reported blocker; a full logger here would be inventing a requirement nobody asked\n * for.\n */\n\n/** Receives each diagnostic message already formatted, with the trailing `\\n`. */\nexport type DiagnosticsSink = (message: string) => void;\n\n/**\n * The registry lives on `globalThis`, not in a module-level `let` (theokit#173).\n *\n * A module-level binding is a per-INSTANCE singleton, and a package manager will install two\n * physical copies of the same version whenever two dependents resolve different peer sets. Measured:\n * `@theokit/sdk@4.39.1` existed under two pnpm store hashes in the theokit workspace, so a sink\n * installed through `@theokit/agents` landed in a different registry than the emitter writes to.\n *\n * The failure mode is the quiet one — the re-export resolves, the function is callable, nothing\n * throws, and no diagnostic ever arrives. `Symbol.for` gives every copy in the process the same\n * slot; the `v1` suffix leaves room to change the shape without colliding with an older copy.\n */\nconst SINK_SLOT = Symbol.for(\"theokit.sdk.diagnostics.sink.v1\");\n\ntype SinkHolder = Record<symbol, DiagnosticsSink | undefined>;\n\nfunction currentSink(): DiagnosticsSink | undefined {\n  return (globalThis as unknown as SinkHolder)[SINK_SLOT];\n}\n\n/**\n * Installs (or removes, by passing `undefined`) the diagnostics destination.\n *\n * When a sink is present it is the ONLY destination — `stderr` gets no copy. Duplicating\n * destinations would hand the problem back to the TUI that installed the sink precisely to get the\n * messages out of the terminal.\n */\nexport function setDiagnosticsSink(next: DiagnosticsSink | undefined): void {\n  (globalThis as unknown as SinkHolder)[SINK_SLOT] = next;\n}\n\n/**\n * Emits a library diagnostic message.\n *\n * Replaces `process.stderr.write` on internal paths. Never throws: a faulty sink must not\n * must not take down the run it merely observes.\n */\nexport function diag(message: string): void {\n  // Silent by default (#147): with no sink installed the message is dropped. A library must not\n  // assume the host's stdout/stderr are free-form log sinks — in a TUI they are the render surface.\n  const sink = currentSink();\n  if (sink === undefined) return;\n  try {\n    sink(message);\n  } catch {\n    // Observability never breaks the run — same principle as `emitRunEvent`.\n  }\n}\n\n/**\n * Emits a diagnostic that reports a USER-VISIBLE FAILURE, and is never silently dropped.\n *\n * `diag` is silent with no sink installed, and that is right for chatter: a library must not assume\n * the host's stderr is a free-form log, because in a TUI it is the render surface. A failure is a\n * different message. `theokit-sdk#189` is the record of the difference — an MCP server failed to\n * start, the only report went to `diag()`, the embedding UI never read it, and the user saw an\n * agent with missing tools and no reason given.\n *\n * The two failure modes are not symmetric, which is the whole decision: a corrupted frame is\n * visible and recoverable, while a silently dropped failure is neither. So this falls back to\n * stderr rather than to silence.\n *\n * A sink still takes precedence — the host installed it precisely to keep these off the terminal —\n * EXCEPT when the sink throws. A broken sink swallowing the one report of a failure is the same\n * defect one layer further in.\n *\n * @internal\n */\nexport function diagFailure(message: string): void {\n  const sink = currentSink();\n  if (sink !== undefined) {\n    try {\n      sink(message);\n      return;\n    } catch {\n      // Fall through: the sink is broken, and this message is too important to drop with it.\n    }\n  }\n  try {\n    // `globalThis.process?.stderr` rather than a bare `process`: in a browser the bare form is a\n    // ReferenceError that the catch below would swallow — working by accident, on an exception used\n    // as ordinary control flow. Optional chaining states the intent: write to stderr where one\n    // exists, stay silent where none does.\n    globalThis.process?.stderr?.write(`${message}\\n`);\n  } catch {\n    // Nothing left to try. Observability never breaks the run.\n  }\n}\n","import { diag } from \"../diagnostics.js\";\nimport { readEnv } from \"../env.js\";\n\n/**\n * Canonical secret redaction module (ADRs D68-D73).\n *\n * Single source of truth for credential pattern masking across the SDK.\n * Wired at output boundaries: `ErrorMetadata.raw` (mappers/shared.ts),\n * telemetry span attributes (telemetry/tracer.ts), transcript JSONL\n * appends (agent-session-store.ts), migration logger output\n * (memory/migrate-sqlite-to-lance.ts).\n *\n * - D68: central module, single source of truth (replaces 2 duplicates)\n * - D69: env snapshot at module init (prompt-injection defense)\n * - D70: ON by default, warn on opt-out\n * - D71: two-bucket masking — short fully masked, long preserves prefix+suffix\n * - D72: `codeFile` opt-out for legitimate prefix-shaped content\n * - D73: redact at OUTPUT boundaries, not at storage\n *\n * @internal\n */\n\n// D69: env snapshot captured at module load. Subsequent mutations of\n// process.env.THEOKIT_REDACT_SECRETS are ignored — defends against\n// prompt injection that tries to disable redaction mid-run.\nlet REDACT_ENABLED: boolean = readEnvOnce();\n\nfunction readEnvOnce(): boolean {\n  // `readEnv` rather than `process.env`: this module reaches the browser through `errors.ts`, and\n  // a bare `process` there is a ReferenceError at module scope — a blank page, not a warning.\n  const raw = readEnv(\"THEOKIT_REDACT_SECRETS\");\n  if (raw === undefined) return true; // D70: default ON\n  return [\"1\", \"true\", \"yes\", \"on\"].includes(raw.toLowerCase());\n}\n\n// D70: warn once on opt-out so the user knows they're vulnerable.\nlet warnedOptOut = false;\nif (!REDACT_ENABLED && !warnedOptOut) {\n  diag(\n    \"[theokit-sdk] Secret redaction is DISABLED via THEOKIT_REDACT_SECRETS. \" +\n      \"Credentials may leak into errors, telemetry, logs, transcripts.\\n\",\n  );\n  warnedOptOut = true;\n}\n\n/**\n * Built-in credential patterns. Order matters — more specific prefixes\n * must come before generic ones (e.g., `sk-ant-` before `sk-`). Quantifiers\n * are all bounded `{n,m}` or applied to char classes — linear time, no ReDoS.\n *\n * @internal\n */\nconst BUILTIN_PATTERNS: readonly RegExp[] = [\n  // T5.4: 30+ vendor prefixes (was 12 pre-T5.4). Order matters — more\n  // specific prefixes precede generic ones (e.g., sk-ant-admin01 before\n  // sk-ant-, sk-proj- before sk-). PEM block deliberately first so its\n  // multi-line span runs before any per-line patterns can fire.\n  /-----BEGIN[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----[\\s\\S]+?-----END[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----/g,\n  // JWT — exact 3-segment base64url. Dotted; the body floor of 4 chars per\n  // segment matches the minimum legal payload while skipping `a.b.c` noise.\n  /eyJ[A-Za-z0-9_-]{4,}\\.eyJ[A-Za-z0-9_-]{4,}\\.[A-Za-z0-9_-]{4,}/g,\n  // Azure Storage SAS — match the sig= component (URL-encoded base64).\n  /(?<=[?&]sig=)[A-Za-z0-9%+/]{20,}/g,\n  // Anthropic\n  /sk-ant-admin01-[A-Za-z0-9_-]{10,}/g, //   Anthropic admin keys (must precede sk-ant-)\n  /sk-ant-[A-Za-z0-9_-]{10,}/g, //           Anthropic regular\n  // OpenAI family + clones (sk- generic must come AFTER all sk-foo- variants)\n  /sk-proj-[A-Za-z0-9_-]{10,}/g, //  OpenAI project key (must precede sk- generic)\n  /sk-[A-Za-z0-9_-]{10,}/g, //       OpenAI / OpenRouter / DeepInfra / Together / DeepSeek\n  // Provider prefixes (alphabetized for maintainability)\n  /AIza[A-Za-z0-9_-]{35}/g, //       Google API key\n  /AKIA[A-Z0-9]{16}/g, //            AWS access key\n  /fw_[A-Za-z0-9]{20,}/g, //         Fireworks\n  /glpat-[A-Za-z0-9_-]{20}/g, //     GitLab PAT\n  /ghp_[A-Za-z0-9]{36}/g, //         GitHub PAT classic\n  /github_pat_[A-Za-z0-9_]{82}/g, // GitHub PAT fine-grained\n  /gsk_[A-Za-z0-9]{20,}/g, //        Groq\n  /hf_[A-Za-z0-9]{20,}/g, //         HuggingFace\n  /\\bpa-[A-Za-z0-9_-]{20,}/g, //     Voyage AI (word-boundary to skip CSS / kebab IDs)\n  /pcsk_[A-Za-z0-9_-]{20,}/g, //     Pinecone\n  /pplx-[A-Za-z0-9_-]{20,}/g, //     Perplexity\n  /r8_[A-Za-z0-9_-]{20,}/g, //       Replicate\n  /rk_live_[A-Za-z0-9]{20,}/g, //    Stripe restricted\n  /sk_live_[A-Za-z0-9]{20,}/g, //    Stripe secret\n  /sntrys_[A-Za-z0-9]{40,}/g, //     Sentry user auth\n  /xai-[A-Za-z0-9_-]{20,}/g, //      xAI (Grok)\n  /xox[bpasr]-[A-Za-z0-9-]{10,}/g, //Slack tokens\n  // Additional unique-prefix tokens with low false-positive risk\n  /npm_[A-Za-z0-9]{36}/g, //         npm access token\n  /SG\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]{43}/g, // SendGrid\n  /\\bSK[A-Za-z0-9]{32}\\b/g, //       Twilio API SID (word-boundary to skip CSS class noise)\n  /\\bkey-[a-f0-9]{32}\\b/g, //        Mailgun (hex-only narrows false positives)\n  /MT[A-Za-z0-9_-]{23}\\.[A-Za-z0-9_-]{6}\\.[A-Za-z0-9_-]{27}/g, // Discord bot\n  /\\b(?:sdk|mob)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\\b/g, // LaunchDarkly\n];\n\n// `Bearer <token>` matched as its own first-class pattern so PARAM_PATTERN\n// doesn't have to handle the unusual `Authorization: Bearer xxx` shape\n// (no `:` or `=` between \"Bearer\" and the value — bare whitespace).\nconst BEARER_PATTERN = /\\b(Bearer\\s+)([A-Za-z0-9_\\-.+/=]{8,})/g;\n\n// Parametric: matches `key=value` and `key: value` (with optional quote\n// between the key and the separator, to handle JSON: `\"api_key\": \"...\"`)\n// in URLs, query strings, JSON-like bodies, HTTP headers. Captures the\n// prefix so we keep it visible while masking the value.\n//\n// `authorization` deliberately excluded — BEARER_PATTERN handles the\n// common `Authorization: Bearer xxx` shape. Including it here causes\n// double-masking (\"Authorization: *** ***\") after Bearer fires.\n// T5.4: keyword set expanded from 6 → 16 to cover the OAuth / JWT / generic\n// credential vocabulary surfaced by DR6 finding #4. `authorization`,\n// `auth`, `bearer` stay excluded — BEARER_PATTERN handles the\n// `Authorization: Bearer xxx` shape and including these here would\n// re-catch the post-BUILTIN-masked form (D71 prefix-preservation\n// contract) and double-mask to `***`.\n//\n// Value class includes `.` so JWT / `.env` / dotted base64url values\n// match; the callback skips already-masked values (containing the\n// `...` D71 separator) to preserve the BUILTIN prefix-mask result.\nconst PARAM_PATTERN =\n  /(\\b(?:access_token|api_key|api-key|client_secret|credential|credentials|id_token|jwt|password|private_key|refresh_token|secret|service_account|session_token|token|x-api-key)\\b[\"']?\\s*[:=]\\s*[\"']?)([A-Za-z0-9_\\-.+/]+)/gi;\n\nconst _extraPatterns: RegExp[] = [];\n\n/**\n * Register an extra pattern for `redactSecrets` to mask, on top of the built-in vendor set.\n *\n * Additive and irreversible for the life of the process: patterns accumulate in module scope,\n * builtins are never replaced or reordered, and there is no way to remove one. Registering the\n * same regex twice registers it twice.\n *\n * Throws immediately when the regex has no `/g` flag. That is not pedantry — `String.replace`\n * with a non-global regex substitutes only the FIRST match, so a pattern registered without it\n * would mask the first credential in a payload and let every later one through, which reads as\n * working.\n *\n * Extras run after the builtins and before the parametric `key=value` sweep, and each whole match\n * is replaced by `maskToken` of that match. Anchor and bound the pattern with care: a regex that\n * matches more than the secret masks more than the secret, and one that backtracks badly runs on\n * every string crossing an output boundary.\n *\n * Registering a pattern does not enable redaction. When `THEOKIT_REDACT_SECRETS` was off at\n * module load, `redactSecrets` returns its input untouched and extras never run.\n *\n * Also exposed publicly, and under semver, as `Security.addPattern` in `src/security.ts`; the\n * direct export here additionally reaches the semver-exempt `@theokit/sdk/internal/security`\n * sub-path.\n */\nexport function addPattern(re: RegExp): void {\n  if (!re.global) {\n    // A BARE Error here, deliberately, and this is the one place in the package where that is the\n    // right answer. `errors.ts` imports `redactSecrets` from this module for the anti-leak invariant\n    // on `providerError`, so this module must stay below it — importing ConfigurationError closes a\n    // cycle (measured: `madge --circular` reports `errors.ts > internal/security/redact.ts`).\n    //\n    // The typed error lives at the surface a consumer touches: `Security.addPattern` in\n    // `src/security.ts` validates first and throws ConfigurationError with a code. This throw is the\n    // backstop for the semver-exempt `@theokit/sdk/internal/security` sub-path.\n    throw new Error(\"addPattern: regex must have /g flag for replace-all semantics\");\n  }\n  _extraPatterns.push(re);\n}\n\n/**\n * Mask one string, keeping enough of it to be recognizable in a log.\n *\n * Under 18 characters the whole string becomes the literal `***`; the length is not preserved and\n * nothing of the input survives. From 18 characters up, the result is the first 6 characters, the\n * literal `...`, and the last 4 — so exactly 10 characters of the input are RETAINED IN CLEAR and\n * the middle is dropped. That is the trade the threshold encodes: short strings could be brute\n * forced from a partial, long ones cannot, and the surviving prefix is usually the vendor tag\n * (`sk-ant`, `ghp_de`) that tells an operator which credential misbehaved.\n *\n * Be clear about what this is and is not. It is a readability aid for logs, not an anonymizer and\n * not a security boundary. The retained prefix and suffix identify the credential's issuer and\n * often the credential itself to anyone who has seen it before, so a masked value still belongs in\n * a trusted log and not in a bug report or a support ticket.\n *\n * It masks whatever it is handed. There is no check that the argument is a secret, so calling it\n * on ordinary text mangles the text, and calling it on something the caller merely hopes is a\n * secret proves nothing about what leaked.\n *\n * `redactSecrets` applies it to the ENTIRE match of a pattern, not to a captured group. For a\n * match like `Bearer sk-ant-...` the first 6 characters retained are `Bearer`, not the key's\n * prefix.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/security` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function maskToken(token: string): string {\n  if (token.length < 18) return \"***\";\n  return `${token.slice(0, 6)}...${token.slice(-4)}`;\n}\n\n// issue #117 — the EXACT shape of a `maskToken` output (`slice(0,6)+\"...\"+slice(-4)`\n// = 6 chars, literal `...`, 4 chars). Used to detect a value PARAM_PATTERN would\n// otherwise re-mask, WITHOUT skipping a raw secret that merely contains `...`.\nconst MASK_SHAPE = /^.{6}\\.\\.\\..{4}$/s;\n\n// Coerce arbitrary input to a string for redaction. Returns `null`\n// sentinel when the value is null/undefined/non-stringifiable, so the\n// caller can short-circuit with `\"\"`. EC-7 fix: circular refs go through\n// the try/catch and produce the sentinel marker, never throwing.\nfunction coerceToString(value: unknown): string | null {\n  if (typeof value === \"string\") return value;\n  if (value === null || value === undefined) return null;\n  if (typeof value === \"object\") {\n    try {\n      const s = JSON.stringify(value);\n      return s === undefined ? null : s;\n    } catch {\n      return \"[unredactable: circular]\";\n    }\n  }\n  return String(value);\n}\n\n/**\n * Redact known credential patterns from `text`. Default behavior masks\n * builtins + extras + parametric `key=value` sinks.\n *\n * With `{ codeFile: true }` (D72), skips PARAM_PATTERN to avoid mangling\n * `.env.example`, schema JSON, or test fixtures that legitimately contain\n * prefix-like strings.\n *\n * Returns the redacted string. Coerces non-strings via JSON.stringify;\n * EC-7 fix (edge-case review): wraps in try/catch so circular references\n * never propagate — returns sentinel `\"[unredactable: circular]\"`.\n *\n * `null` and `undefined` return `\"\"`. When redaction was switched off at module load via\n * `THEOKIT_REDACT_SECRETS`, the coerced input is returned with no masking at all — the value is\n * still stringified, but nothing is removed from it.\n *\n * Masking is best-effort against a list of known shapes. A credential in a format no pattern\n * covers passes through unchanged, so a redacted string is not a string proven free of secrets.\n */\nexport function redactSecrets(text: unknown, opts?: { codeFile?: boolean }): string {\n  const coerced = coerceToString(text);\n  if (coerced === null) return \"\";\n  if (!REDACT_ENABLED) return coerced;\n\n  let s = coerced;\n  for (const re of BUILTIN_PATTERNS) {\n    s = s.replace(re, (m) => maskToken(m));\n  }\n  for (const re of _extraPatterns) {\n    s = s.replace(re, (m) => maskToken(m));\n  }\n  if (!opts?.codeFile) {\n    // Bearer first (preserves \"Bearer \" prefix, masks the token after).\n    // Must run before PARAM_PATTERN so the bare-whitespace shape doesn't\n    // get mis-handled as a value.\n    s = s.replace(BEARER_PATTERN, (_, prefix: string) => `${prefix}***`);\n    // T5.4: skip if value already contains the D71 bucket-mask separator\n    // (`...`) — BUILTIN ran first and produced a prefix-preserved mask;\n    // re-masking would lose the prefix and degrade debuggability.\n    s = s.replace(PARAM_PATTERN, (whole, prefix: string, value: string) => {\n      // issue #117 — skip ONLY when the value is already a mask that a BUILTIN\n      // pattern produced (maskToken's exact `6chars...4chars` shape), so we don't\n      // re-mask and lose the prefix. The old `value.includes(\"...\")` was too broad:\n      // a REAL secret that happens to contain `...` (e.g. `L_-cxw-.2UI_..._`) was\n      // skipped and LEAKED. The mask shape is exact (maskToken: slice(0,6)+\"...\"+\n      // slice(-4)), so a raw secret with `...` elsewhere is now masked.\n      if (MASK_SHAPE.test(value)) return whole;\n      return `${prefix}***`;\n    });\n  }\n  return s;\n}\n\n/**\n * Test-only helper exported for `_test-reset.ts`. NOT included in the\n * `index.ts` barrel — vitest setup imports the dedicated module via\n * explicit path to discourage production callers.\n *\n * @internal\n */\nexport function _resetForTests(opts: { enabled?: boolean; clearExtras?: boolean }): void {\n  if (opts.enabled !== undefined) REDACT_ENABLED = opts.enabled;\n  if (opts.clearExtras === true) _extraPatterns.length = 0;\n}\n\n/**\n * T5.4 — Test-only count of BUILTIN_PATTERNS. Exposed so the count-floor\n * assertion can run without re-deriving the array shape in test land.\n * NOT included in the public barrel.\n *\n * @internal\n */\nexport function __TESTING__BUILTIN_PATTERN_COUNT(): number {\n  return BUILTIN_PATTERNS.length;\n}\n"]}

package/dist/{chunk-KQ7TS7WW.cjs → chunk-D6POWE7E.cjs}

@@ -1,18 +1,21 @@
 'use strict';
 
 var chunkGHX4P3V2_cjs = require('./chunk-GHX4P3V2.cjs');
-var chunkUGT7GK7I_cjs = require('./chunk-UGT7GK7I.cjs');
-var chunkZSWPZ23K_cjs = require('./chunk-ZSWPZ23K.cjs');
-var chunk4ZHTIJNE_cjs = require('./chunk-4ZHTIJNE.cjs');
+var chunk24SYBZPL_cjs = require('./chunk-24SYBZPL.cjs');
+var chunkQOGNZMHD_cjs = require('./chunk-QOGNZMHD.cjs');
+var chunkI2PWY7VM_cjs = require('./chunk-I2PWY7VM.cjs');
+var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
 var crypto = require('crypto');
 
 var MAX_BATCH = 100;
 var MAX_RETRIES = 2;
+var EMBED_BACKOFF_BASE_MS = 250;
+var EMBED_BACKOFF_CAP_MS = 4e3;
 async function createOpenAiCompatibleRuntime(cfg, options) {
   const model = options.model ?? cfg.defaultModel;
   const apiKey = options.apiKey ?? process.env[cfg.apiKeyEnv];
   if (apiKey === void 0 || apiKey.length === 0) {
-    throw new chunk4ZHTIJNE_cjs.AuthenticationError(`${cfg.apiKeyEnv} missing`, {
+    throw new chunkJ7J7J2GN_cjs.AuthenticationError(`${cfg.apiKeyEnv} missing`, {
       code: "embedding_missing_api_key"
     });
   }
@@ -22,7 +25,7 @@ async function createOpenAiCompatibleRuntime(cfg, options) {
   const cache = options.cache ?? chunkGHX4P3V2_cjs.globalEmbeddingCache;
   const dimension = cfg.dimensionByModel[model];
   if (dimension === void 0) {
-    throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
       `${cfg.id} adapter: model "${model}" is not in the dimension table. Use one of: ${Object.keys(cfg.dimensionByModel).join(", ")}. To add it, update dimensionByModel in the adapter source.`,
       { code: "embedding_unknown_model" }
     );
@@ -97,7 +100,7 @@ async function embedInBoundedBatches(input, pending, results) {
   for (let offset = 0; offset < pending.length; offset += MAX_BATCH) {
     batches.push(pending.slice(offset, offset + MAX_BATCH));
   }
-  await chunkZSWPZ23K_cjs.mapWithConcurrency(
+  await chunkI2PWY7VM_cjs.mapWithConcurrency(
     batches,
     MAX_CONCURRENT_BATCHES,
     (batch) => processBatch(input, batch, results)
@@ -134,23 +137,34 @@ async function embedBatch(opts) {
     if (isRetryable(response.status) && attempt < MAX_RETRIES) {
       attempt += 1;
       opts.stats.retries += 1;
-      await sleep(linearBackoffMs(attempt));
+      const retryAfterSec = chunk24SYBZPL_cjs.parseRetryAfter(response.headers);
+      await sleep(
+        chunkQOGNZMHD_cjs.computeBackoffMs({
+          attempt,
+          baseMs: EMBED_BACKOFF_BASE_MS,
+          capMs: EMBED_BACKOFF_CAP_MS,
+          ...retryAfterSec !== void 0 ? { retryAfterMs: retryAfterSec * 1e3 } : {}
+        })
+      );
       continue;
     }
-    const text = await response.text().catch(() => "");
-    let body = text;
-    try {
-      body = JSON.parse(text);
-    } catch {
-    }
-    throw chunkUGT7GK7I_cjs.mapOpenAICompatibleError({
-      providerId: opts.providerId,
-      status: response.status,
-      body,
-      headers: response.headers,
-      endpoint: opts.embeddingsPath
-    });
+    throw await mappedEmbedError(opts, response);
+  }
+}
+async function mappedEmbedError(opts, response) {
+  const text = await response.text().catch(() => "");
+  let body = text;
+  try {
+    body = JSON.parse(text);
+  } catch {
   }
+  return chunk24SYBZPL_cjs.mapOpenAICompatibleError({
+    providerId: opts.providerId,
+    status: response.status,
+    body,
+    headers: response.headers,
+    endpoint: opts.embeddingsPath
+  });
 }
 async function postEmbedRequest(opts, url) {
   return opts.fetchImpl(url, {
@@ -169,7 +183,7 @@ async function parseEmbedResponse(response, providerId, endpoint, dialect) {
   const viaDialect = dialect?.vectors?.(json);
   if (viaDialect !== void 0) return viaDialect;
   if (!Array.isArray(json.data)) {
-    throw new chunk4ZHTIJNE_cjs.NetworkError(`${providerId} ${endpoint} returned no data`, {
+    throw new chunkJ7J7J2GN_cjs.NetworkError(`${providerId} ${endpoint} returned no data`, {
       code: "embedding_invalid_response",
       metadata: {
         provider: providerId,
@@ -187,13 +201,10 @@ function isRetryable(status) {
 function hashKey(model, text) {
   return crypto.createHash("sha256").update(`${model} ${text}`).digest("hex");
 }
-function linearBackoffMs(attempt) {
-  return 50 * attempt;
-}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
 exports.createOpenAiCompatibleRuntime = createOpenAiCompatibleRuntime;
-//# sourceMappingURL=chunk-KQ7TS7WW.cjs.map
-//# sourceMappingURL=chunk-KQ7TS7WW.cjs.map
+//# sourceMappingURL=chunk-D6POWE7E.cjs.map
+//# sourceMappingURL=chunk-D6POWE7E.cjs.map

package/dist/chunk-D6POWE7E.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/memory/adapters/openai-compatible.ts"],"names":["AuthenticationError","globalEmbeddingCache","ConfigurationError","mapWithConcurrency","parseRetryAfter","computeBackoffMs","mapOpenAICompatibleError","NetworkError","createHash"],"mappings":";;;;;;;;;AAwBA,IAAM,SAAA,GAAY,GAAA;AAClB,IAAM,WAAA,GAAc,CAAA;AASpB,IAAM,qBAAA,GAAwB,GAAA;AAC9B,IAAM,oBAAA,GAAuB,GAAA;AAkG7B,eAAsB,6BAAA,CACpB,KACA,OAAA,EAC2B;AAC3B,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,IAAS,GAAA,CAAI,YAAA;AACnC,EAAA,MAAM,SAAS,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,IAAI,SAAS,CAAA;AAC1D,EAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG;AAC/C,IAAA,MAAM,IAAIA,qCAAA,CAAoB,CAAA,EAAG,GAAA,CAAI,SAAS,CAAA,QAAA,CAAA,EAAY;AAAA,MACxD,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,UAAA,GAAa,IAAI,UAAA,KAAe,MAAA,GAAY,QAAQ,GAAA,CAAI,GAAA,CAAI,UAAU,CAAA,GAAI,MAAA;AAChF,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,IAAW,UAAA,IAAc,GAAA,CAAI,cAAA;AACrD,EAAA,MAAM,SAAA,GAAY,QAAQ,KAAA,IAAS,KAAA;AAEnC,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAASC,sCAAA;AAE/B,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,gBAAA,CAAiB,KAAK,CAAA;AAC5C,EAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,IAAA,MAAM,IAAIC,oCAAA;AAAA,MACR,CAAA,EAAG,GAAA,CAAI,EAAE,CAAA,iBAAA,EAAoB,KAAK,CAAA,6CAAA,EAAgD,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,gBAAgB,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,2DAAA,CAAA;AAAA,MAC9H,EAAE,MAAM,yBAAA;AAA0B,KACpC;AAAA,EACF;AAKA,EAAA,MAAM,cAAA,GAAA,CAAkB,GAAA,CAAI,cAAA,IAAkB,gBAAA,EAAkB,OAAA;AAAA,IAC9D,SAAA;AAAA,IACA,mBAAmB,KAAK;AAAA,GAC1B;AAEA,EAAA,MAAM,KAAA,GAA+B;AAAA,IACnC,SAAA,EAAW,CAAA;AAAA,IACX,WAAA,EAAa,CAAA;AAAA,IACb,SAAA,EAAW,CAAA;AAAA,IACX,OAAA,EAAS;AAAA,GACX;AAEA,EAAA,OAAO;AAAA,IACL,IAAI,GAAA,CAAI,EAAA;AAAA,IACR,KAAA;AAAA,IACA,SAAA;AAAA,IACA,KAAA,EAAO,OAAO,EAAE,GAAG,KAAA,EAAM,CAAA;AAAA,IACzB,KAAA,EAAO,CAAC,KAAA,KACN,UAAA,CAAW;AAAA,MACT,KAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA,MACA,OAAA;AAAA,MACA,cAAA;AAAA,MACA,SAAA;AAAA,MACA,YAAY,GAAA,CAAI,EAAA;AAAA,MAChB,OAAA,EAAS,GAAA,CAAI,OAAA,IAAW;AAAC,KAC1B;AAAA,GACL;AACF;AAgBA,eAAe,WAAW,KAAA,EAA6C;AACrE,EAAA,MAAM,EAAE,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,KAAA,EAAO,WAAU,GAAI,KAAA;AAClD,EAAA,MAAM,OAAA,GAAU,IAAI,KAAA,CAA4B,KAAA,CAAM,MAAM,CAAA;AAC5D,EAAA,MAAM,UAA+D,EAAC;AACtE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,aAAA,CAAc;AAAA,MACZ,KAAA,EAAO,CAAA;AAAA,MACP,IAAA,EAAM,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AAAA,MAClB,KAAA;AAAA,MACA,SAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,MAAM,qBAAA,CAAsB,KAAA,EAAO,OAAA,EAAS,OAAO,CAAA;AACnD,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAK,IAAI,KAAA,CAAM,SAAS,CAAA,CAAE,IAAA,CAAK,CAAC,CAAC,CAAA;AAC7D;AAaA,SAAS,cAAc,IAAA,EAA+B;AACpD,EAAA,IAAI,IAAA,CAAK,IAAA,CAAK,IAAA,EAAK,CAAE,WAAW,CAAA,EAAG;AACjC,IAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,GAAI,IAAI,MAAM,IAAA,CAAK,SAAS,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA;AAC3D,IAAA;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,IAAA,CAAK,KAAA,EAAO,KAAK,IAAI,CAAA;AACzC,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AACjC,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,IAAA,CAAK,MAAM,SAAA,IAAa,CAAA;AACxB,IAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,GAAI,MAAA;AAC3B,IAAA;AAAA,EACF;AACA,EAAA,IAAA,CAAK,MAAM,WAAA,IAAe,CAAA;AAC1B,EAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,IAAA,CAAK,OAAO,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,GAAA,EAAK,CAAA;AAC/D;AAKA,IAAM,sBAAA,GAAyB,CAAA;AAY/B,eAAe,qBAAA,CACb,KAAA,EACA,OAAA,EACA,OAAA,EACe;AACf,EAAA,MAAM,UAA8E,EAAC;AACrF,EAAA,KAAA,IAAS,SAAS,CAAA,EAAG,MAAA,GAAS,OAAA,CAAQ,MAAA,EAAQ,UAAU,SAAA,EAAW;AACjE,IAAA,OAAA,CAAQ,KAAK,OAAA,CAAQ,KAAA,CAAM,MAAA,EAAQ,MAAA,GAAS,SAAS,CAAC,CAAA;AAAA,EACxD;AAGA,EAAA,MAAMC,oCAAA;AAAA,IAAmB,OAAA;AAAA,IAAS,sBAAA;AAAA,IAAwB,CAAC,KAAA,KACzD,YAAA,CAAa,KAAA,EAAO,OAAO,OAAO;AAAA,GACpC;AACF;AAEA,eAAe,YAAA,CACb,KAAA,EACA,KAAA,EACA,OAAA,EACe;AACf,EAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW;AAAA,IAC/B,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,gBAAgB,KAAA,CAAM,cAAA;AAAA,IACtB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,QAAQ,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAAA,IAC/B,WAAW,KAAA,CAAM,SAAA;AAAA,IACjB,OAAO,KAAA,CAAM,KAAA;AAAA,IACb,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,SAAS,KAAA,CAAM;AAAA,GAChB,CAAA;AACD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,IAAA,GAAO,MAAM,CAAC,CAAA;AACpB,IAAA,MAAM,MAAA,GAAS,QAAQ,CAAC,CAAA;AACxB,IAAA,IAAI,IAAA,KAAS,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW;AAChD,IAAA,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,GAAI,MAAA;AACtB,IAAA,KAAA,CAAM,KAAA,CAAM,GAAA,CAAI,IAAA,CAAK,GAAA,EAAK,MAAM,CAAA;AAAA,EAClC;AACF;AAcA,eAAe,WAAW,IAAA,EAAyC;AAEjE,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,OAAA,CAAQ,OAAA,CAAQ,OAAO,EAAE,CAAC,CAAA,EAAG,IAAA,CAAK,cAAc,CAAA,CAAA;AACpE,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,OAAO,IAAA,EAAM;AACX,IAAA,IAAA,CAAK,MAAM,SAAA,IAAa,CAAA;AACxB,IAAA,MAAM,QAAA,GAAW,MAAM,gBAAA,CAAiB,IAAA,EAAM,GAAG,CAAA;AACjD,IAAA,IAAI,QAAA,CAAS,EAAA;AACX,MAAA,OAAO,MAAM,mBAAmB,QAAA,EAAU,IAAA,CAAK,YAAY,IAAA,CAAK,cAAA,EAAgB,KAAK,OAAO,CAAA;AAC9F,IAAA,IAAI,WAAA,CAAY,QAAA,CAAS,MAAM,CAAA,IAAK,UAAU,WAAA,EAAa;AACzD,MAAA,OAAA,IAAW,CAAA;AACX,MAAA,IAAA,CAAK,MAAM,OAAA,IAAW,CAAA;AACtB,MAAA,MAAM,aAAA,GAAgBC,iCAAA,CAAgB,QAAA,CAAS,OAAO,CAAA;AACtD,MAAA,MAAM,KAAA;AAAA,QACJC,kCAAA,CAAiB;AAAA,UACf,OAAA;AAAA,UACA,MAAA,EAAQ,qBAAA;AAAA,UACR,KAAA,EAAO,oBAAA;AAAA,UACP,GAAI,kBAAkB,MAAA,GAAY,EAAE,cAAc,aAAA,GAAgB,GAAA,KAAS;AAAC,SAC7E;AAAA,OACH;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAM,gBAAA,CAAiB,IAAA,EAAM,QAAQ,CAAA;AAAA,EAC7C;AACF;AAQA,eAAe,gBAAA,CAAiB,MAAoB,QAAA,EAAsC;AACxF,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AACjD,EAAA,IAAI,IAAA,GAAgB,IAAA;AACpB,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAOC,0CAAA,CAAyB;AAAA,IAC9B,YAAY,IAAA,CAAK,UAAA;AAAA,IACjB,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,IAAA;AAAA,IACA,SAAS,QAAA,CAAS,OAAA;AAAA,IAClB,UAAU,IAAA,CAAK;AAAA,GAChB,CAAA;AACH;AAEA,eAAe,gBAAA,CAAiB,MAAoB,GAAA,EAAgC;AAClF,EAAA,OAAO,IAAA,CAAK,UAAU,GAAA,EAAK;AAAA,IACzB,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,cAAA,EAAgB,kBAAA;AAAA,MAChB,GAAI,IAAA,CAAK,OAAA,CAAQ,WAAA,GAAc,IAAA,CAAK,MAAM,CAAA,IAAK,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,IAAA,CAAK,MAAM,CAAA,CAAA;AAAG,KAC1F;AAAA,IACA,MAAM,IAAA,CAAK,SAAA;AAAA,MACT,IAAA,CAAK,OAAA,CAAQ,IAAA,GAAO,IAAA,CAAK,OAAO,IAAA,CAAK,MAAM,CAAA,IAAK,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,KAAA,EAAO,KAAK,MAAA;AAAO;AAC1F,GACD,CAAA;AACH;AAEA,eAAe,kBAAA,CACb,QAAA,EACA,UAAA,EACA,QAAA,EACA,OAAA,EACqB;AACrB,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAElC,EAAA,MAAM,UAAA,GAAa,OAAA,EAAS,OAAA,GAAU,IAAI,CAAA;AAC1C,EAAA,IAAI,UAAA,KAAe,QAAW,OAAO,UAAA;AACrC,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAIC,8BAAA,CAAa,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,QAAQ,CAAA,iBAAA,CAAA,EAAqB;AAAA,MACnE,IAAA,EAAM,4BAAA;AAAA,MACN,QAAA,EAAU;AAAA,QACR,QAAA,EAAU,UAAA;AAAA,QACV,QAAA;AAAA,QACA,IAAA,EAAM,iBAAA;AAAA,QACN,GAAA,EAAK;AAAA;AACP,KACD,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAK,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,SAAS,CAAA;AACzC;AAEA,SAAS,YAAY,MAAA,EAAyB;AAC5C,EAAA,OAAO,MAAA,KAAW,GAAA,IAAQ,MAAA,IAAU,GAAA,IAAO,MAAA,GAAS,GAAA;AACtD;AAEA,SAAS,OAAA,CAAQ,OAAe,IAAA,EAAsB;AACpD,EAAA,OAAOC,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,CAAA,EAAG,KAAK,CAAA,CAAA,EAAI,IAAI,CAAA,CAAE,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACrE;AAWA,SAAS,MAAM,EAAA,EAA2B;AACxC,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD","file":"chunk-D6POWE7E.cjs","sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport { AuthenticationError, ConfigurationError, NetworkError } from \"../../../errors.js\";\nimport { mapWithConcurrency } from \"../../concurrency/map-with-concurrency.js\";\nimport { mapOpenAICompatibleError } from \"../../error-mappers/openai-compatible.js\";\nimport { parseRetryAfter } from \"../../error-mappers/shared.js\";\nimport { computeBackoffMs } from \"../../llm/retry.js\";\nimport type {\n  CreateAdapterOptions,\n  EmbeddingRuntime,\n  EmbeddingRuntimeStats,\n} from \"../embedding-adapter.js\";\nimport { globalEmbeddingCache } from \"../embedding-cache.js\";\n\n/**\n * Shared factory for OpenAI-compatible embedding providers (OpenAI, Mistral,\n * DeepInfra, and anything else exposing `POST /v1/embeddings` with the\n * `{ model, input }` request shape and `{ data: [{ embedding }] }` response).\n *\n * Mirrors the inner mechanics of peer-project's batch embedding runtime.\n *\n * @internal\n */\n\nconst MAX_BATCH = 100;\nconst MAX_RETRIES = 2;\n/**\n * Deliberately tighter than the transport's 500ms/32s.\n *\n * An embedding retry sits inside a memory write on the agent's critical path and cannot be\n * cancelled (see `sleep` below), so the worst case has to be small enough to wait out: 2 retries\n * capped at 4s is at most ~8s. The transport can afford 32s because a streaming turn is already\n * long-running and IS abortable.\n */\nconst EMBED_BACKOFF_BASE_MS = 250;\nconst EMBED_BACKOFF_CAP_MS = 4_000;\n\n/**\n * What one provider adapter tells {@link createOpenAiCompatibleRuntime} about\n * its wire: where to POST, which environment variables carry the key and the\n * base URL, which model to use by default, and how wide each model's vectors\n * are.\n *\n * `id` is the provider id that ends up on errors and on\n * `EmbeddingRuntime.id`, and is also the identity the SQLite vector index stores\n * — changing it invalidates the vectors already on disk.\n *\n * `apiKeyEnv` is required, `baseUrlEnv` is not: a provider that declares no\n * base-URL variable can only be redirected by passing `baseUrl` explicitly.\n * Leave `dialect` unset for anything that speaks the OpenAI embedding wire.\n */\nexport interface OpenAiCompatibleConfig {\n  id: string;\n  defaultBaseUrl: string;\n  apiKeyEnv: string;\n  baseUrlEnv?: string;\n  defaultModel: string;\n  /**\n   * Dimension hint by model id. The chosen model MUST be in this table —\n   * unknown models throw `ConfigurationError(code: \"embedding_unknown_model\")`\n   * (EC-4 fix). This prevents vec0 virtual-table dimension mismatches that\n   * surface as cryptic errors downstream.\n   */\n  dimensionByModel: Record<string, number>;\n  /**\n   * Path component appended to `baseUrl` for the embeddings endpoint.\n   * Default `\"/v1/embeddings\"` (OpenAI canonical). REPLACES the default —\n   * does NOT concatenate. Used by DeepInfra (`\"/v1/openai/embeddings\"`),\n   * etc. (EC-2 fix).\n   */\n  embeddingsPath?: string;\n  /**\n   * theokit#159 — per-provider deviations from the OpenAI wire.\n   *\n   * The runtime was rigidly OpenAI-shaped: one auth header, one body, one response shape. Three of\n   * the ten catalog providers do not speak it, so every call they made was rejected — Azure\n   * authenticates with an `api-key` header and puts the deployment in the path, Cohere's `/v2/embed`\n   * takes `texts` and answers `{embeddings:{float}}`. Advertising a provider that cannot work is\n   * worse than not advertising it.\n   *\n   * Every hook is optional and its default is exactly the previous behaviour, so the seven\n   * providers that DO speak OpenAI are untouched.\n   */\n  dialect?: EmbeddingDialect;\n}\n\n/**\n * theokit#159 — the three points where a provider may deviate from the OpenAI embedding wire.\n *\n * Deliberately three narrow hooks rather than a general \"transform the request\" seam: these are the\n * only axes on which the supported providers actually differ, and a wider seam would invite\n * per-provider logic that belongs in the adapter.\n */\nexport interface EmbeddingDialect {\n  /** Replaces `authorization: Bearer <key>`. */\n  authHeaders?: (apiKey: string) => Record<string, string>;\n  /** Replaces the `{ model, input }` request body. */\n  body?: (model: string, inputs: ReadonlyArray<string>) => Record<string, unknown>;\n  /** Replaces reading vectors from `json.data[].embedding`. Return `undefined` when unparseable. */\n  vectors?: (json: unknown) => number[][] | undefined;\n}\n\n/**\n * Build an {@link EmbeddingRuntime} for a provider that speaks the OpenAI\n * embedding wire — or, through `cfg.dialect`, one that deviates from it in a\n * known way. Every adapter in the memory catalog is a thin call to this.\n *\n * Resolution order for each setting is explicit option, then environment\n * variable, then the config default. Two things are checked before any request\n * is sent, so a misconfiguration fails at creation rather than at first search:\n * a missing or empty key rejects with an `AuthenticationError` carrying\n * `embedding_missing_api_key`, and a model absent from `dimensionByModel`\n * rejects with a `ConfigurationError` carrying `embedding_unknown_model`. The\n * second check exists because the vector index is created at a fixed width — an\n * unknown dimension would surface much later as a vec0 mismatch.\n *\n * `{model}` in `embeddingsPath` is replaced with the URL-encoded model, which is\n * how Azure addresses a deployment in the path. `embeddingsPath` replaces the\n * default `/v1/embeddings` rather than being appended to it.\n *\n * The returned `embed` batches at 100 texts per request and runs at most 3\n * requests concurrently, preserving input order. Whitespace-only inputs never\n * reach the network and come back as an all-zero vector. Results are cached by\n * model and text; the cache defaults to a process-wide LRU of 5000 entries, so\n * pass `options.cache` when runtimes must not share entries.\n *\n * Failed requests retry up to twice on 429 and 5xx with a 50ms-per-attempt\n * linear backoff. Anything else, and a retry budget that runs out, throws the\n * typed error the OpenAI-compatible mapper builds from the status and body. A\n * response that parses but carries no vectors throws a `NetworkError` with\n * `embedding_invalid_response`. There is no request timeout here — cancellation\n * is the caller's to impose.\n */\nexport async function createOpenAiCompatibleRuntime(\n  cfg: OpenAiCompatibleConfig,\n  options: CreateAdapterOptions,\n): Promise<EmbeddingRuntime> {\n  const model = options.model ?? cfg.defaultModel;\n  const apiKey = options.apiKey ?? process.env[cfg.apiKeyEnv];\n  if (apiKey === undefined || apiKey.length === 0) {\n    throw new AuthenticationError(`${cfg.apiKeyEnv} missing`, {\n      code: \"embedding_missing_api_key\",\n    });\n  }\n  const envBaseUrl = cfg.baseUrlEnv !== undefined ? process.env[cfg.baseUrlEnv] : undefined;\n  const baseUrl = options.baseUrl ?? envBaseUrl ?? cfg.defaultBaseUrl;\n  const fetchImpl = options.fetch ?? fetch;\n  // T4.4 — default to process-wide singleton (was per-adapter instance).\n  const cache = options.cache ?? globalEmbeddingCache;\n  // EC-4: refuse unknown models to prevent vec0 dimension mismatches downstream.\n  const dimension = cfg.dimensionByModel[model];\n  if (dimension === undefined) {\n    throw new ConfigurationError(\n      `${cfg.id} adapter: model \"${model}\" is not in the dimension table. Use one of: ${Object.keys(cfg.dimensionByModel).join(\", \")}. To add it, update dimensionByModel in the adapter source.`,\n      { code: \"embedding_unknown_model\" },\n    );\n  }\n  // theokit#128: `{model}` is substituted, because Azure OpenAI addresses the deployment IN THE\n  // PATH (`/openai/deployments/{model}/embeddings`) rather than in the body. Without this the URL\n  // carried the literal placeholder and every Azure request 404'd. A path with no placeholder —\n  // every other provider — is passed through untouched.\n  const embeddingsPath = (cfg.embeddingsPath ?? \"/v1/embeddings\").replace(\n    \"{model}\",\n    encodeURIComponent(model),\n  );\n\n  const stats: EmbeddingRuntimeStats = {\n    cacheHits: 0,\n    cacheMisses: 0,\n    httpCalls: 0,\n    retries: 0,\n  };\n\n  return {\n    id: cfg.id,\n    model,\n    dimension,\n    stats: () => ({ ...stats }),\n    embed: (texts) =>\n      embedTexts({\n        texts,\n        cache,\n        stats,\n        model,\n        dimension,\n        apiKey,\n        baseUrl,\n        embeddingsPath,\n        fetchImpl,\n        providerId: cfg.id,\n        dialect: cfg.dialect ?? {},\n      }),\n  };\n}\n\ninterface EmbedTextsInput {\n  texts: ReadonlyArray<string>;\n  cache: NonNullable<CreateAdapterOptions[\"cache\"]>;\n  stats: EmbeddingRuntimeStats;\n  model: string;\n  dimension: number;\n  apiKey: string;\n  baseUrl: string;\n  embeddingsPath: string;\n  fetchImpl: typeof fetch;\n  providerId: string;\n  dialect: EmbeddingDialect;\n}\n\nasync function embedTexts(input: EmbedTextsInput): Promise<number[][]> {\n  const { texts, cache, stats, model, dimension } = input;\n  const results = new Array<number[] | undefined>(texts.length);\n  const pending: Array<{ index: number; text: string; key: string }> = [];\n  for (let i = 0; i < texts.length; i++) {\n    classifyEntry({\n      index: i,\n      text: texts[i] ?? \"\",\n      model,\n      dimension,\n      cache,\n      stats,\n      results,\n      pending,\n    });\n  }\n  await embedInBoundedBatches(input, pending, results);\n  return results.map((v) => v ?? new Array(dimension).fill(0));\n}\n\ninterface ClassifyEntryArgs {\n  index: number;\n  text: string;\n  model: string;\n  dimension: number;\n  cache: NonNullable<CreateAdapterOptions[\"cache\"]>;\n  stats: EmbeddingRuntimeStats;\n  results: Array<number[] | undefined>;\n  pending: Array<{ index: number; text: string; key: string }>;\n}\n\nfunction classifyEntry(args: ClassifyEntryArgs): void {\n  if (args.text.trim().length === 0) {\n    args.results[args.index] = new Array(args.dimension).fill(0);\n    return;\n  }\n  const key = hashKey(args.model, args.text);\n  const cached = args.cache.get(key);\n  if (cached !== undefined) {\n    args.stats.cacheHits += 1;\n    args.results[args.index] = cached;\n    return;\n  }\n  args.stats.cacheMisses += 1;\n  args.pending.push({ index: args.index, text: args.text, key });\n}\n\n// T4.3 — max concurrent embedding API requests per embed() call.\n// 3 is enough to saturate most embedding APIs without triggering\n// rate limits (each batch is already up to MAX_BATCH=100 texts).\nconst MAX_CONCURRENT_BATCHES = 3;\n\n/**\n * T4.3 — parallel embed batches (DR4 finding #3).\n *\n * Pre-T4.3 this was a serial `for` loop — each batch of 100 texts\n * awaited before the next HTTP request started. With 500 texts the\n * serial path took 5 × RTT; parallel takes max(RTT) × ceil(5/3).\n *\n * Uses bounded-concurrency `Promise.all` capped at 3 concurrent\n * HTTP requests to avoid overwhelming the embedding API.\n */\nasync function embedInBoundedBatches(\n  input: EmbedTextsInput,\n  pending: ReadonlyArray<{ index: number; text: string; key: string }>,\n  results: Array<number[] | undefined>,\n): Promise<void> {\n  const batches: Array<ReadonlyArray<{ index: number; text: string; key: string }>> = [];\n  for (let offset = 0; offset < pending.length; offset += MAX_BATCH) {\n    batches.push(pending.slice(offset, offset + MAX_BATCH));\n  }\n  // M0-2: bounded parallel via the shared ordered pool (was an inline\n  // acquire/release clone — see plan m0-foundation-expose-primitives).\n  await mapWithConcurrency(batches, MAX_CONCURRENT_BATCHES, (batch) =>\n    processBatch(input, batch, results),\n  );\n}\n\nasync function processBatch(\n  input: EmbedTextsInput,\n  batch: ReadonlyArray<{ index: number; text: string; key: string }>,\n  results: Array<number[] | undefined>,\n): Promise<void> {\n  const vectors = await embedBatch({\n    apiKey: input.apiKey,\n    baseUrl: input.baseUrl,\n    embeddingsPath: input.embeddingsPath,\n    model: input.model,\n    inputs: batch.map((b) => b.text),\n    fetchImpl: input.fetchImpl,\n    stats: input.stats,\n    providerId: input.providerId,\n    dialect: input.dialect,\n  });\n  for (let j = 0; j < batch.length; j++) {\n    const slot = batch[j];\n    const vector = vectors[j];\n    if (slot === undefined || vector === undefined) continue;\n    results[slot.index] = vector;\n    input.cache.set(slot.key, vector);\n  }\n}\n\ninterface BatchOptions {\n  apiKey: string;\n  baseUrl: string;\n  embeddingsPath: string;\n  model: string;\n  inputs: ReadonlyArray<string>;\n  fetchImpl: typeof fetch;\n  stats: EmbeddingRuntimeStats;\n  providerId: string;\n  dialect: EmbeddingDialect;\n}\n\nasync function embedBatch(opts: BatchOptions): Promise<number[][]> {\n  // EC-2: embeddingsPath REPLACES the suffix; never concatenates.\n  const url = `${opts.baseUrl.replace(/\\/$/, \"\")}${opts.embeddingsPath}`;\n  let attempt = 0;\n  while (true) {\n    opts.stats.httpCalls += 1;\n    const response = await postEmbedRequest(opts, url);\n    if (response.ok)\n      return await parseEmbedResponse(response, opts.providerId, opts.embeddingsPath, opts.dialect);\n    if (isRetryable(response.status) && attempt < MAX_RETRIES) {\n      attempt += 1;\n      opts.stats.retries += 1;\n      const retryAfterSec = parseRetryAfter(response.headers);\n      await sleep(\n        computeBackoffMs({\n          attempt,\n          baseMs: EMBED_BACKOFF_BASE_MS,\n          capMs: EMBED_BACKOFF_CAP_MS,\n          ...(retryAfterSec !== undefined ? { retryAfterMs: retryAfterSec * 1000 } : {}),\n        }),\n      );\n      continue;\n    }\n    throw await mappedEmbedError(opts, response);\n  }\n}\n\n/**\n * The terminal failure: read the body best-effort so the mapper sees the provider's error code, then\n * map it. Its own function because folding it back into the retry loop puts `embedBatch` at\n * cognitive complexity 11 against the repo max of 10 — and the sibling budget for those suppressions\n * is ratcheting DOWN, so adding one here to keep this loop whole would undo that.\n */\nasync function mappedEmbedError(opts: BatchOptions, response: Response): Promise<unknown> {\n  const text = await response.text().catch(() => \"\");\n  let body: unknown = text;\n  try {\n    body = JSON.parse(text);\n  } catch {\n    // not JSON — keep as string\n  }\n  return mapOpenAICompatibleError({\n    providerId: opts.providerId,\n    status: response.status,\n    body,\n    headers: response.headers,\n    endpoint: opts.embeddingsPath,\n  });\n}\n\nasync function postEmbedRequest(opts: BatchOptions, url: string): Promise<Response> {\n  return opts.fetchImpl(url, {\n    method: \"POST\",\n    headers: {\n      \"content-type\": \"application/json\",\n      ...(opts.dialect.authHeaders?.(opts.apiKey) ?? { authorization: `Bearer ${opts.apiKey}` }),\n    },\n    body: JSON.stringify(\n      opts.dialect.body?.(opts.model, opts.inputs) ?? { model: opts.model, input: opts.inputs },\n    ),\n  });\n}\n\nasync function parseEmbedResponse(\n  response: Response,\n  providerId: string,\n  endpoint: string,\n  dialect?: EmbeddingDialect,\n): Promise<number[][]> {\n  const json = (await response.json()) as { data?: Array<{ embedding: number[] }> };\n  // theokit#159 — a provider whose response is not OpenAI-shaped supplies its own reader.\n  const viaDialect = dialect?.vectors?.(json);\n  if (viaDialect !== undefined) return viaDialect;\n  if (!Array.isArray(json.data)) {\n    throw new NetworkError(`${providerId} ${endpoint} returned no data`, {\n      code: \"embedding_invalid_response\",\n      metadata: {\n        provider: providerId,\n        endpoint,\n        code: \"invalid_request\",\n        raw: json,\n      },\n    });\n  }\n  return json.data.map((d) => d.embedding);\n}\n\nfunction isRetryable(status: number): boolean {\n  return status === 429 || (status >= 500 && status < 600);\n}\n\nfunction hashKey(model: string, text: string): string {\n  return createHash(\"sha256\").update(`${model} ${text}`).digest(\"hex\");\n}\n\n/**\n * Not `sleepWithAbort`, and the reason is the parsimony ladder rather than an oversight.\n *\n * `EmbeddingRuntime.embed(texts)` takes no signal, and NONE of its seven callers — lance-index,\n * index-manager, vec-index, the two dreaming phases, scorers — holds one to pass. Adding the\n * parameter would add a seam nobody supplies, so cancellation is bounded instead of plumbed: at most\n * MAX_RETRIES sleeps of at most EMBED_BACKOFF_CAP_MS each. Give `embed()` a signal on the day a\n * caller has one, and this becomes `sleepWithAbort` in the same edit.\n */\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n"]}

package/dist/{chunk-AWO27VRZ.js → chunk-DMRT67Y6.js}

@@ -1,7 +1,7 @@
+import { TheokitAgentError } from './chunk-ALUN2B4W.js';
 import { Buffer } from 'buffer';
 import { webcrypto } from 'crypto';
 
-// src/server/auth/oauth-transaction-store.ts
 var COOKIE_NAME = "__Host-theo_oauth_tx";
 var TX_LIFETIME_MS = 10 * 60 * 1e3;
 var HKDF_INFO = "theokit:oauth-tx-v1";
@@ -23,11 +23,12 @@ async function deriveKey(secret) {
     "decrypt"
   ]);
 }
-var AuthSecretTooShortError = class extends Error {
+var AuthSecretTooShortError = class extends TheokitAgentError {
   name = "AuthSecretTooShortError";
   constructor(actualBytes) {
     super(
-      `OAuth transaction secret must be at least 32 bytes (got ${actualBytes}). Generate a fresh value with: openssl rand -base64 33`
+      `OAuth transaction secret must be at least 32 bytes (got ${actualBytes}). Generate a fresh value with: openssl rand -base64 33`,
+      { code: "auth_secret_too_short", isRetryable: false }
     );
   }
 };
@@ -95,5 +96,5 @@ function newTransaction(opts) {
 }
 
 export { AuthSecretTooShortError, COOKIE_NAME, __TESTING__deriveKey, clearTransaction, encodeTransaction, getTransaction, newTransaction };
-//# sourceMappingURL=chunk-AWO27VRZ.js.map
-//# sourceMappingURL=chunk-AWO27VRZ.js.map
+//# sourceMappingURL=chunk-DMRT67Y6.js.map
+//# sourceMappingURL=chunk-DMRT67Y6.js.map