@theokit/sdk 4.63.3 → 5.0.0-next.1

package/dist/{chunk-6JSIEDKL.cjs → chunk-YSTXFWQE.cjs}

@@ -7,7 +7,7 @@ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentS
 var cachedJsonrepair;
 function loadJsonrepair() {
   if (cachedJsonrepair === void 0) {
-    const req = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-6JSIEDKL.cjs', document.baseURI).href)));
+    const req = module$1.createRequire((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('chunk-YSTXFWQE.cjs', document.baseURI).href)));
     cachedJsonrepair = req("jsonrepair").jsonrepair;
   }
   return cachedJsonrepair;
@@ -89,13 +89,19 @@ function sanitizeString(key, value, ctx) {
   if (ctx.repairJson && !ctx.coerce && typeof out === "string") out = applyRepair(key, out, ctx);
   return out;
 }
+function walkValue(key, value, ctx, depth) {
+  if (typeof value === "string") return sanitizeString(key, value, ctx);
+  if (Array.isArray(value)) {
+    if (depth >= ctx.maxDepth) return value;
+    return value.map((element) => walkValue(key, element, ctx, depth + 1));
+  }
+  if (ctx.deep && depth < ctx.maxDepth && isPlainObject(value)) return walk(value, ctx, depth + 1);
+  return value;
+}
 function walk(input, ctx, depth) {
   const out = {};
   for (const [key, value] of Object.entries(input)) {
-    if (typeof value === "string") out[key] = sanitizeString(key, value, ctx);
-    else if (ctx.deep && depth < ctx.maxDepth && isPlainObject(value))
-      out[key] = walk(value, ctx, depth + 1);
-    else out[key] = value;
+    out[key] = walkValue(key, value, ctx, depth);
   }
   return out;
 }
@@ -117,5 +123,5 @@ function sanitizeToolInput(input, options) {
 exports.isPlainObject = isPlainObject;
 exports.sanitizeToolInput = sanitizeToolInput;
 exports.tryJson = tryJson;
-//# sourceMappingURL=chunk-6JSIEDKL.cjs.map
-//# sourceMappingURL=chunk-6JSIEDKL.cjs.map
+//# sourceMappingURL=chunk-YSTXFWQE.cjs.map
+//# sourceMappingURL=chunk-YSTXFWQE.cjs.map

package/dist/chunk-YSTXFWQE.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sanitize/coerce.ts","../src/sanitize/sanitize-tool-input.ts"],"names":["createRequire"],"mappings":";;;;;;AAQA,IAAI,gBAAA;AACJ,SAAS,cAAA,GAA2C;AAClD,EAAA,IAAI,qBAAqB,MAAA,EAAW;AAClC,IAAA,MAAM,GAAA,GAAMA,sBAAA,CAAc,oQAAe,CAAA;AACzC,IAAA,gBAAA,GAAoB,GAAA,CAAI,YAAY,CAAA,CAA4C,UAAA;AAAA,EAClF;AACA,EAAA,OAAO,gBAAA;AACT;AAGO,SAAS,cAAc,CAAA,EAA0C;AACtE,EAAA,OAAO,CAAA,KAAM,QAAQ,OAAO,CAAA,KAAM,YAAY,CAAC,KAAA,CAAM,QAAQ,CAAC,CAAA;AAChE;AAIA,SAAS,eAAe,GAAA,EAAiC;AACvD,EAAA,IAAI,GAAA,KAAQ,IAAI,OAAO,MAAA;AACvB,EAAA,MAAM,CAAA,GAAI,OAAO,GAAG,CAAA;AACpB,EAAA,OAAO,MAAA,CAAO,SAAS,CAAC,CAAA,IAAK,OAAO,CAAC,CAAA,KAAM,MAAM,CAAA,GAAI,MAAA;AACvD;AAMO,SAAS,OAAA,CAAQ,KAAa,MAAA,EAA0B;AAC7D,EAAA,MAAM,CAAA,GAAI,IAAI,SAAA,EAAU;AACxB,EAAA,IAAI,EAAE,EAAE,UAAA,CAAW,GAAG,KAAK,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,CAAA,EAAI,OAAO,MAAA;AACtD,EAAA,IAAI;AACF,IAAA,OAAO,KAAK,KAAA,CAAM,MAAA,GAAS,gBAAe,CAAE,CAAC,IAAI,CAAC,CAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAKO,SAAS,eAAA,CAAgB,KAAa,UAAA,EAA8B;AACzE,EAAA,IAAI,GAAA,KAAQ,QAAQ,OAAO,IAAA;AAC3B,EAAA,IAAI,GAAA,KAAQ,SAAS,OAAO,KAAA;AAC5B,EAAA,IAAI,GAAA,KAAQ,QAAQ,OAAO,IAAA;AAC3B,EAAA,MAAM,CAAA,GAAI,eAAe,GAAG,CAAA;AAC5B,EAAA,IAAI,CAAA,KAAM,QAAW,OAAO,CAAA;AAC5B,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,EAAK,KAAK,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA,GAAI,MAAA,CAAA;AACvE,EAAA,OAAO,IAAA,KAAS,SAAY,GAAA,GAAM,IAAA;AACpC;AAKO,SAAS,gBAAA,CAAiB,KAAa,UAAA,EAAgC;AAC5E,EAAA,MAAM,MAAiB,EAAC;AACxB,EAAA,IAAI,GAAA,KAAQ,MAAA,EAAQ,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,OAAA,IACxB,GAAA,KAAQ,OAAA,EAAS,GAAA,CAAI,IAAA,CAAK,KAAK,CAAA;AAAA,OAAA,IAC/B,GAAA,KAAQ,MAAA,EAAQ,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AACtC,EAAA,MAAM,CAAA,GAAI,eAAe,GAAG,CAAA;AAC5B,EAAA,IAAI,CAAA,KAAM,MAAA,EAAW,GAAA,CAAI,IAAA,CAAK,CAAC,CAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAA,EAAK,KAAK,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA,GAAI,MAAA,CAAA;AACvE,EAAA,IAAI,IAAA,KAAS,MAAA,EAAW,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AACrC,EAAA,GAAA,CAAI,KAAK,GAAG,CAAA;AACZ,EAAA,OAAO,GAAA;AACT;AAMO,SAAS,YAAY,MAAA,EAAkE;AAC5F,EAAA,MAAM,QAAS,MAAA,EAAuD,KAAA;AACtE,EAAA,OAAO,KAAA,KAAU,IAAA,IAAQ,OAAO,KAAA,KAAU,WACrC,KAAA,GACD,MAAA;AACN;;;AC5DA,SAAS,SAAA,CAAU,GAAA,EAAa,KAAA,EAAe,GAAA,EAAkB;AAC/D,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,IAAI,YAAY,KAAA,EAAO,GAAA,CAAI,MAAM,IAAA,CAAK,CAAA,SAAA,EAAY,GAAG,CAAA,CAAA,CAAG,CAAA;AACxD,EAAA,OAAO,OAAA;AACT;AAIA,SAAS,WAAA,CAAY,GAAA,EAAa,GAAA,EAAa,GAAA,EAAmB;AAChE,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,GAAQ,GAAG,CAAA;AAC7B,EAAA,IAAI,OAAA,GAAmB,GAAA;AACvB,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,KAAA,MAAW,SAAA,IAAa,gBAAA,CAAiB,GAAA,EAAK,GAAA,CAAI,UAAU,CAAA,EAAG;AAC7D,MAAA,IAAI,KAAA,CAAM,SAAA,CAAU,SAAS,CAAA,CAAE,OAAA,EAAS;AACtC,QAAA,OAAA,GAAU,SAAA;AACV,QAAA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,MAAO;AACL,IAAA,OAAA,GAAU,eAAA,CAAgB,GAAA,EAAK,GAAA,CAAI,UAAU,CAAA;AAAA,EAC/C;AACA,EAAA,IAAI,YAAY,GAAA,EAAK,GAAA,CAAI,MAAM,IAAA,CAAK,CAAA,SAAA,EAAY,GAAG,CAAA,CAAA,CAAG,CAAA;AACtD,EAAA,OAAO,OAAA;AACT;AAGA,SAAS,WAAA,CAAY,GAAA,EAAa,KAAA,EAAe,GAAA,EAAmB;AAClE,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA;AACpC,EAAA,IAAI,QAAA,KAAa,QAAW,OAAO,KAAA;AACnC,EAAA,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,CAAA,eAAA,EAAkB,GAAG,CAAA,CAAA,CAAG,CAAA;AACvC,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,cAAA,CAAe,GAAA,EAAa,KAAA,EAAe,GAAA,EAAmB;AACrE,EAAA,IAAI,MAAe,GAAA,CAAI,IAAA,GAAO,UAAU,GAAA,EAAK,KAAA,EAAO,GAAG,CAAA,GAAI,KAAA;AAC3D,EAAA,IAAI,GAAA,CAAI,UAAU,OAAO,GAAA,KAAQ,UAAU,GAAA,GAAM,WAAA,CAAY,GAAA,EAAK,GAAA,EAAK,GAAG,CAAA;AAI1E,EAAA,IAAI,GAAA,CAAI,UAAA,IAAc,CAAC,GAAA,CAAI,MAAA,IAAU,OAAO,GAAA,KAAQ,QAAA,EAAU,GAAA,GAAM,WAAA,CAAY,GAAA,EAAK,GAAA,EAAK,GAAG,CAAA;AAC7F,EAAA,OAAO,GAAA;AACT;AAeA,SAAS,SAAA,CAAU,GAAA,EAAa,KAAA,EAAgB,GAAA,EAAU,KAAA,EAAwB;AAChF,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,SAAiB,cAAA,CAAe,GAAA,EAAK,OAAO,GAAG,CAAA;AACpE,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACxB,IAAA,IAAI,KAAA,IAAS,GAAA,CAAI,QAAA,EAAU,OAAO,KAAA;AAClC,IAAA,OAAO,KAAA,CAAM,GAAA,CAAI,CAAC,OAAA,KAAY,SAAA,CAAU,KAAK,OAAA,EAAS,GAAA,EAAK,KAAA,GAAQ,CAAC,CAAC,CAAA;AAAA,EACvE;AACA,EAAA,IAAI,GAAA,CAAI,IAAA,IAAQ,KAAA,GAAQ,GAAA,CAAI,QAAA,IAAY,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,QAAQ,CAAC,CAAA;AAC/F,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,IAAA,CAAK,KAAA,EAAgC,GAAA,EAAU,KAAA,EAAwC;AAC9F,EAAA,MAAM,MAA+B,EAAC;AACtC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAChD,IAAA,GAAA,CAAI,GAAG,CAAA,GAAI,SAAA,CAAU,GAAA,EAAK,KAAA,EAAO,KAAK,KAAK,CAAA;AAAA,EAC7C;AACA,EAAA,OAAO,GAAA;AACT;AAWO,SAAS,iBAAA,CACd,OACA,OAAA,EACgB;AAEhB,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,EAAC,EAAE;AAC5E,EAAA,MAAM,GAAA,GAAW;AAAA,IACf,IAAA,EAAM,SAAS,IAAA,IAAQ,IAAA;AAAA,IACvB,MAAA,EAAQ,SAAS,MAAA,IAAU,KAAA;AAAA,IAC3B,UAAA,EAAY,SAAS,UAAA,IAAc,KAAA;AAAA,IACnC,IAAA,EAAM,SAAS,IAAA,IAAQ,KAAA;AAAA,IACvB,QAAA,EAAU,SAAS,QAAA,IAAY,CAAA;AAAA,IAC/B,KAAA,EAAO,WAAA,CAAY,OAAA,EAAS,MAAM,CAAA;AAAA,IAClC,OAAO;AAAC,GACV;AACA,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,EAAO,GAAA,EAAK,CAAC,CAAA;AAChC,EAAA,OAAO,EAAE,OAAO,OAAA,EAAS,GAAA,CAAI,MAAM,MAAA,GAAS,CAAA,EAAG,KAAA,EAAO,GAAA,CAAI,KAAA,EAAM;AAClE","file":"chunk-YSTXFWQE.cjs","sourcesContent":["import { createRequire } from \"node:module\";\n\nimport type { ZodType } from \"zod\";\n\n// `jsonrepair` is loaded lazily — consumers who never set `repairJson: true` never pay its\n// module-parse cost. Unlike `zod` (an optional peer dep), `jsonrepair` is a direct dependency and\n// is always installed; the lazy load is a startup-cost optimization, not an optional-install story.\n// Cached after the first repair.\nlet cachedJsonrepair: ((text: string) => string) | undefined;\nfunction loadJsonrepair(): (text: string) => string {\n  if (cachedJsonrepair === undefined) {\n    const req = createRequire(import.meta.url);\n    cachedJsonrepair = (req(\"jsonrepair\") as { jsonrepair: (t: string) => string }).jsonrepair;\n  }\n  return cachedJsonrepair;\n}\n\n/** @internal */\nexport function isPlainObject(v: unknown): v is Record<string, unknown> {\n  return v !== null && typeof v === \"object\" && !Array.isArray(v);\n}\n\n/** Number coercion with a round-trip + finite guard: rejects big-ints, leading-zeros, `NaN`,\n *  `Infinity`, and non-canonical forms (`\"1e3\"`), preventing silent ID/precision corruption (EC-2). */\nfunction toFiniteNumber(raw: string): number | undefined {\n  if (raw === \"\") return undefined;\n  const n = Number(raw);\n  return Number.isFinite(n) && String(n) === raw ? n : undefined;\n}\n\n/** Parse a value ONLY when it looks like a JSON object/array (EC-3 guard; leading whitespace\n *  ignored so `trim:false` inputs are still gated correctly). `repair` routes it through\n *  `jsonrepair` first. Returns `undefined` when not JSON-looking or on parse failure.\n *  @internal */\nexport function tryJson(raw: string, repair: boolean): unknown {\n  const t = raw.trimStart();\n  if (!(t.startsWith(\"{\") || t.startsWith(\"[\"))) return undefined;\n  try {\n    return JSON.parse(repair ? loadJsonrepair()(t) : t);\n  } catch {\n    return undefined;\n  }\n}\n\n/** Heuristic scalar/JSON coercion (agentfw `coerceParameter` shape) used when there is no\n *  per-field schema. Returns the coerced value, or the raw string when nothing applies.\n *  @internal */\nexport function heuristicCoerce(raw: string, repairJson: boolean): unknown {\n  if (raw === \"true\") return true;\n  if (raw === \"false\") return false;\n  if (raw === \"null\") return null;\n  const n = toFiniteNumber(raw);\n  if (n !== undefined) return n;\n  const json = tryJson(raw, false) ?? (repairJson ? tryJson(raw, true) : undefined);\n  return json === undefined ? raw : json;\n}\n\n/** Candidates a raw string could coerce to, most-specific first. Used for schema-aware coercion:\n *  the field schema selects the first candidate it accepts (so a string field keeps `\"5\"`).\n *  @internal */\nexport function coerceCandidates(raw: string, repairJson: boolean): unknown[] {\n  const out: unknown[] = [];\n  if (raw === \"true\") out.push(true);\n  else if (raw === \"false\") out.push(false);\n  else if (raw === \"null\") out.push(null);\n  const n = toFiniteNumber(raw);\n  if (n !== undefined) out.push(n);\n  const json = tryJson(raw, false) ?? (repairJson ? tryJson(raw, true) : undefined);\n  if (json !== undefined) out.push(json);\n  out.push(raw); // raw string is always the last-resort candidate\n  return out;\n}\n\n/** True for a Zod schema that exposes a per-key `.shape` (a `z.object`, incl. Zod-v4\n *  `.refine()`/`.default()` which keep `.shape`); non-object schemas (union/record) return\n *  `undefined` so callers fall back to heuristic coercion (EC-4).\n *  @internal */\nexport function objectShape(schema: ZodType | undefined): Record<string, ZodType> | undefined {\n  const shape = (schema as unknown as { shape?: unknown } | undefined)?.shape;\n  return shape !== null && typeof shape === \"object\"\n    ? (shape as Record<string, ZodType>)\n    : undefined;\n}\n","import type { ZodType } from \"zod\";\n\nimport {\n  coerceCandidates,\n  heuristicCoerce,\n  isPlainObject,\n  objectShape,\n  tryJson,\n} from \"./coerce.js\";\nimport type { SanitizeOptions, SanitizeResult } from \"./types.js\";\n\ninterface Ctx {\n  trim: boolean;\n  coerce: boolean;\n  repairJson: boolean;\n  deep: boolean;\n  maxDepth: number;\n  shape: Record<string, ZodType> | undefined;\n  notes: string[];\n}\n\n/** Trim rung — returns the trimmed string, noting the change. */\nfunction applyTrim(key: string, value: string, ctx: Ctx): string {\n  const trimmed = value.trim();\n  if (trimmed !== value) ctx.notes.push(`trimmed \"${key}\"`);\n  return trimmed;\n}\n\n/** Coerce rung — schema-aware when a field schema exists (pick the first accepted candidate),\n *  else heuristic. Returns the coerced value (or the raw string), noting the change. */\nfunction applyCoerce(key: string, raw: string, ctx: Ctx): unknown {\n  const field = ctx.shape?.[key];\n  let coerced: unknown = raw;\n  if (field) {\n    for (const candidate of coerceCandidates(raw, ctx.repairJson)) {\n      if (field.safeParse(candidate).success) {\n        coerced = candidate;\n        break;\n      }\n    }\n  } else {\n    coerced = heuristicCoerce(raw, ctx.repairJson);\n  }\n  if (coerced !== raw) ctx.notes.push(`coerced \"${key}\"`);\n  return coerced;\n}\n\n/** Repair rung — repair-then-parse a JSON-looking string, noting the change. */\nfunction applyRepair(key: string, value: string, ctx: Ctx): unknown {\n  const repaired = tryJson(value, true);\n  if (repaired === undefined) return value;\n  ctx.notes.push(`repaired json \"${key}\"`);\n  return repaired;\n}\n\n/** Sanitize one string value through the enabled rungs (trim → coerce → repair). */\nfunction sanitizeString(key: string, value: string, ctx: Ctx): unknown {\n  let out: unknown = ctx.trim ? applyTrim(key, value, ctx) : value;\n  if (ctx.coerce && typeof out === \"string\") out = applyCoerce(key, out, ctx);\n  // Standalone repair runs ONLY when coerce is off. When coerce is on it already embedded the\n  // repair candidate (via coerceCandidates / heuristicCoerce), and a schema-confirmed raw string\n  // (e.g. a JSON string a `z.string()` field accepted) must not be clobbered back into an object.\n  if (ctx.repairJson && !ctx.coerce && typeof out === \"string\") out = applyRepair(key, out, ctx);\n  return out;\n}\n\n/**\n * Sanitize one value, whatever shape it has.\n *\n * Arrays used to fall through to \"assign as-is\", so `{ tags: [\"  a  \" ] }` came back untouched while\n * `{ tag: \"  a  \" }` was trimmed — even though trim is on by default and the `@public` docblock on\n * `deep` promised recursion into \"objects/arrays\". Nothing in the type distinguished the two cases.\n *\n * The element rules are the SAME rules, deliberately: a string element is sanitized like a string\n * field, and an object element is descended only under `deep`, so a caller does not have to learn a\n * second set of semantics for values that happen to sit in a list. `map` rather than the object\n * walker, because reusing that would return `{ \"0\": … }` and a handler doing `Array.isArray` would\n * reject it.\n */\nfunction walkValue(key: string, value: unknown, ctx: Ctx, depth: number): unknown {\n  if (typeof value === \"string\") return sanitizeString(key, value, ctx);\n  if (Array.isArray(value)) {\n    if (depth >= ctx.maxDepth) return value;\n    return value.map((element) => walkValue(key, element, ctx, depth + 1));\n  }\n  if (ctx.deep && depth < ctx.maxDepth && isPlainObject(value)) return walk(value, ctx, depth + 1);\n  return value;\n}\n\nfunction walk(input: Record<string, unknown>, ctx: Ctx, depth: number): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(input)) {\n    out[key] = walkValue(key, value, ctx, depth);\n  }\n  return out;\n}\n\n/**\n * Sanitize the raw arguments a model emitted for a tool call — trim (default), optionally coerce\n * string values toward their expected type, optionally repair malformed JSON. Pure, synchronous,\n * and TOTAL: it never throws (non-object input is returned unchanged) and never changes a value's\n * meaning — only its hygiene/representation. Reused internally by the leaked-dialect recovery so\n * the public primitive and the internal path never diverge.\n *\n * @public\n */\nexport function sanitizeToolInput(\n  input: Record<string, unknown>,\n  options?: SanitizeOptions,\n): SanitizeResult {\n  // EC-1 — total contract: a non-object (null / array / primitive) is returned as-is, never thrown on.\n  if (!isPlainObject(input)) return { value: input, changed: false, notes: [] };\n  const ctx: Ctx = {\n    trim: options?.trim ?? true,\n    coerce: options?.coerce ?? false,\n    repairJson: options?.repairJson ?? false,\n    deep: options?.deep ?? false,\n    maxDepth: options?.maxDepth ?? 8,\n    shape: objectShape(options?.schema),\n    notes: [],\n  };\n  const value = walk(input, ctx, 0);\n  return { value, changed: ctx.notes.length > 0, notes: ctx.notes };\n}\n"]}

package/dist/{chunk-I6HGWHPU.cjs → chunk-Z3NTRKIC.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
-var chunk4ZHTIJNE_cjs = require('./chunk-4ZHTIJNE.cjs');
+var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
 var fs = require('fs');
 var os = require('os');
 
-var SessionBusyError = class extends chunk4ZHTIJNE_cjs.TheokitAgentError {
+var SessionBusyError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
   constructor(sessionPath) {
     super(
       `another process is already writing this session: ${sessionPath}. Fork it to a new id instead of appending \u2014 two writers interleave lines into a sequence that parses but is not what either process wrote.`,
@@ -107,5 +107,5 @@ function createLease(sessionPath, lockPath) {
 exports.SessionBusyError = SessionBusyError;
 exports.acquireSessionWriter = acquireSessionWriter;
 exports.sessionHasWriter = sessionHasWriter;
-//# sourceMappingURL=chunk-I6HGWHPU.cjs.map
-//# sourceMappingURL=chunk-I6HGWHPU.cjs.map
+//# sourceMappingURL=chunk-Z3NTRKIC.cjs.map
+//# sourceMappingURL=chunk-Z3NTRKIC.cjs.map

package/dist/{chunk-I6HGWHPU.cjs.map → chunk-Z3NTRKIC.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/persistence/session-writer.ts"],"names":["TheokitAgentError","hostname","openSync","writeSync","fchmodSync","closeSync","readFileSync","existsSync","rmSync"],"mappings":";;;;;;AAmDO,IAAM,gBAAA,GAAN,cAA+BA,mCAAA,CAAkB;AAAA,EAGtD,YAAqB,WAAA,EAAqB;AACxC,IAAA,KAAA;AAAA,MACE,oDAAoD,WAAW,CAAA,gJAAA,CAAA;AAAA,MAG/D,EAAE,IAAA,EAAM,cAAA,EAAgB,WAAA,EAAa,KAAA;AAAM,KAC7C;AANmB,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA,EAOrB;AAAA,EAPqB,WAAA;AAAA,EAFH,IAAA,GAAO,kBAAA;AAU3B;AA0CO,IAAM,mBAAA,GAAsB,GAAA;AAUnC,SAAS,QAAA,GAAsB;AAC7B,EAAA,OAAO,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,QAAA,EAAUC,aAAS,EAAG,KAAA,EAAO,IAAA,CAAK,GAAA,EAAI,EAAE;AACrE;AAWA,SAAS,UAAA,CAAW,UAAkB,KAAA,EAAwB;AAC5D,EAAA,MAAM,EAAA,GAAKC,WAAA,CAAS,QAAA,EAAU,GAAA,EAAK,GAAK,CAAA;AACxC,EAAA,IAAI;AACF,IAAAC,YAAA,CAAU,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAInC,IAAAC,aAAA,CAAW,IAAI,GAAK,CAAA;AAAA,EACtB,CAAA,SAAE;AACA,IAAAC,YAAA,CAAU,EAAE,CAAA;AAAA,EACd;AACF;AAGA,SAAS,UAAU,QAAA,EAAyC;AAC1D,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAMC,eAAA,CAAa,UAAU,MAAM,CAAA;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,OAAQ,GAAA,CAA8B,IAAA;AAE5C,IAAA,IAAI,IAAA,KAAS,UAAU,OAAO,MAAA;AAO9B,IAAA,IAAI,IAAA,KAAS,UAAU,OAAO,MAAA;AAQ9B,IAAA,MAAM,IAAI,gBAAA,CAAiB,QAAA,CAAS,OAAA,CAAQ,iBAAA,EAAmB,EAAE,CAAC,CAAA;AAAA,EACpE;AACA,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACxB,IAAA,IACE,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,IACjB,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,IACtB,OAAO,CAAA,CAAE,KAAA,KAAU,QAAA,EACnB;AACA,MAAA,OAAO,KAAA,CAAA;AAAA,IACT;AACA,IAAA,OAAO,EAAE,KAAK,CAAA,CAAE,GAAA,EAAK,UAAU,CAAA,CAAE,QAAA,EAAU,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM;AAAA,EAC5D,CAAA,CAAA,MAAQ;AAGN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGA,SAAS,aAAa,GAAA,EAAsB;AAC1C,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAC,CAAA;AACnB,IAAA,OAAO,IAAA;AAAA,EACT,SAAS,GAAA,EAAK;AAEZ,IAAA,OAAQ,IAA8B,IAAA,KAAS,OAAA;AAAA,EACjD;AACF;AAwBA,SAAS,YAAY,KAAA,EAAuC;AAC1D,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,IAAA;AAChC,EAAA,IAAI,KAAA,CAAM,QAAA,KAAaL,WAAA,EAAS,EAAG;AACjC,IAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA,CAAM,KAAA,GAAQ,mBAAA;AAAA,EACpC;AACA,EAAA,OAAO,CAAC,YAAA,CAAa,KAAA,CAAM,GAAG,CAAA;AAChC;AAcO,SAAS,iBAAiB,WAAA,EAA8B;AAC7D,EAAA,MAAM,QAAA,GAAW,GAAG,WAAW,CAAA,YAAA,CAAA;AAC/B,EAAA,IAAI,CAACM,aAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,KAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAO,CAAC,WAAA,CAAY,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,EACzC,CAAA,CAAA,MAAQ;AAGN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASA,eAAsB,qBAAqB,WAAA,EAAkD;AAU3F,EAAA,MAAM,QAAA,GAAW,GAAG,WAAW,CAAA,YAAA,CAAA;AAC/B,EAAA,MAAM,OAAkB,QAAA,EAAS;AACjC,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AAEF,IAAA,EAAA,GAAKL,WAAA,CAAS,QAAA,EAAU,IAAA,EAAM,GAAK,CAAA;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,MAAM,GAAA;AAI5D,IAAA,IAAI,CAAC,YAAY,SAAA,CAAU,QAAQ,CAAC,CAAA,EAAG,MAAM,IAAI,gBAAA,CAAiB,WAAW,CAAA;AAC7E,IAAA,UAAA,CAAW,UAAU,IAAI,CAAA;AACzB,IAAA,OAAO,WAAA,CAAY,aAAa,QAAQ,CAAA;AAAA,EAC1C;AACA,EAAAG,YAAA,CAAU,EAAE,CAAA;AACZ,EAAA,UAAA,CAAW,UAAU,IAAI,CAAA;AAEzB,EAAA,OAAO,WAAA,CAAY,aAAa,QAAQ,CAAA;AAC1C;AAGA,SAAS,WAAA,CAAY,aAAqB,QAAA,EAAsC;AAC9E,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,SAAS,YAA2B;AAClC,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,QAAA,GAAW,IAAA;AACX,MAAAG,SAAA,CAAO,QAAA,EAAU,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAClC,CAAA;AAAA,IACA,OAAO,MAAY;AAIjB,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,UAAA,CAAW,QAAA,EAAU,UAAU,CAAA;AAAA,IACjC;AAAA,GACF;AACF","file":"chunk-I6HGWHPU.cjs","sourcesContent":["/**\n * M81 — single-writer lease for a session transcript.\n *\n * ## The problem\n *\n * Nothing stops two processes appending to the same JSONL transcript. The concrete case: `exec\n * resume --last` can write into the TUI's live session. Two interleaved appends to an append-only\n * file produce lines that are each individually valid and whose SEQUENCE is fiction — and nothing\n * reports it, because every line parses.\n *\n * ## Why an exclusive lockfile rather than `withFileLock`\n *\n * The plan's ADR D2 said to compose `withFileLock`, and that was the right instinct — do not build a\n * second lock mechanism. It turned out not to fit the SHAPE: `withFileLock(path, fn)` is\n * scope-based — it holds the lock for the duration of a callback. A session lease is **held across\n * turns**, for as long as the process owns the session, with an explicit `release()`. Wrapping the\n * whole session lifetime in a callback would invert control of the entire agent loop.\n *\n * So this uses the same underlying primitive `withFileLock` uses (an exclusive-create lockfile,\n * `wx`) with lease semantics on top. That keeps the mechanism single — the file-existence lock —\n * while giving it the lifetime the caller needs. The deviation from D2 is recorded here because the\n * plan's rationale (no second mechanism) still holds; only its shape assumption did not.\n *\n * ## Fail fast, never wait\n *\n * A second writer that WAITED would block `exec` behind a TUI session that can last hours. The typed\n * error lets the caller choose: fork to a new id, or give up with a real diagnosis.\n *\n * @internal\n */\n\nimport {\n  closeSync,\n  existsSync,\n  fchmodSync,\n  openSync,\n  readFileSync,\n  rmSync,\n  writeSync,\n} from \"node:fs\";\nimport { hostname } from \"node:os\";\n\nimport { TheokitAgentError } from \"../../errors.js\";\n\n/**\n * M81 — another process already holds the writer lease for this session.\n *\n * Carries `sessionPath` because knowing WHICH session is busy is what lets the caller decide between\n * forking and waiting for the user to close the TUI (`rules/error-handling.md § 2` — context enough\n * to act on).\n */\nexport class SessionBusyError extends TheokitAgentError {\n  override readonly name = \"SessionBusyError\";\n\n  constructor(readonly sessionPath: string) {\n    super(\n      `another process is already writing this session: ${sessionPath}. ` +\n        \"Fork it to a new id instead of appending — two writers interleave lines into a sequence \" +\n        \"that parses but is not what either process wrote.\",\n      { code: \"session_busy\", isRetryable: false },\n    );\n  }\n}\n\n/** A held writer lease. `release()` is idempotent. */\nexport interface SessionWriterLease {\n  readonly sessionPath: string;\n  release(): Promise<void>;\n  /**\n   * Re-stamp the ownership record, so a **live** owner never crosses the staleness window.\n   *\n   * Idempotent and cheap: one `write` of a ~80-byte JSON. Call it on the path that already writes to\n   * the session — appending a turn — and the cross-host window stops being a lie about liveness.\n   *\n   * A no-op after `release()`: renewing a lease you no longer hold would re-create the lock file and\n   * hand this process ownership it gave up. That is the one direction of this API that could\n   * *create* the double-writer it exists to prevent.\n   */\n  renew(): void;\n}\n\n/**\n * Staleness window **between machines** — and only between them.\n *\n * 30 s from ACQUISITION. Calling it a \"heartbeat\" would be a lie: the record is written once, when\n * the lease is taken, and is **not** renewed on every write. An earlier version of this comment\n * claimed \"the owner touches the file on every acquisition, so a live process never crosses the\n * window\" — false twice over, and adversarial review measured both.\n *\n * On the **same host** this does not matter: `reclaimable` decides by `pid`, which is exact, and age\n * never enters the calculation. Across hosts it does matter, and it is a real limit: a **live**\n * remote owner loses the lease after 30 s, because there is no way to ask another machine whether\n * its process still exists.\n *\n * **The residue is now closable by the caller** (`agent-builder#118`). `SessionWriterLease.renew()`\n * re-stamps the record; calling it on the path that already writes to the session — appending a turn\n * — keeps a live owner from ever crossing the window. It costs one `write` of ~80 bytes on a file\n * that was previously written once per session.\n *\n * It is `renew()` and not an internal timer on purpose. A timer inside the lease would keep the event\n * loop alive (or need `unref` plus its own teardown), and it would renew a lease belonging to a\n * process that is hung rather than working — which is precisely the state the window exists to\n * detect. Tying the renewal to a real write means the record tracks **progress**, not mere existence.\n */\nexport const HEARTBEAT_WINDOW_MS = 30_000;\n\n/** Who holds the lock. Written as JSON into `.writer.lock`. */\ninterface LockOwner {\n  pid: number;\n  hostname: string;\n  mtime: number;\n}\n\n/** The ownership record for THIS process, stamped now. One place, so acquire and renew cannot drift. */\nfunction ownerNow(): LockOwner {\n  return { pid: process.pid, hostname: hostname(), mtime: Date.now() };\n}\n\n/**\n * Writes the owner with user-only permissions.\n *\n * `0600` because the lock is an assertion of OWNERSHIP: with the `0664` the usual umask produces,\n * another user in the same group can overwrite the file and forge ownership of the session — and\n * from then on it is the legitimate owner who starts receiving `SessionBusyError`. The content\n * (`pid`, `hostname`) is low-sensitivity; what the permission protects is the signal's\n * **integrity**, not its secrecy.\n */\nfunction writeOwner(lockPath: string, owner: LockOwner): void {\n  const fd = openSync(lockPath, \"w\", 0o600);\n  try {\n    writeSync(fd, JSON.stringify(owner));\n    // `open`'s `mode` only applies on CREATION. A `.writer.lock` inherited from an earlier version —\n    // or left behind by a process with a different umask — would stay `0664` after being reclaimed,\n    // and the forgery window the mode closes for new locks would remain open for old ones.\n    fchmodSync(fd, 0o600);\n  } finally {\n    closeSync(fd);\n  }\n}\n\n/** Reads the lock's owner. `undefined` when the file vanished or the content is unreadable. */\nfunction readOwner(lockPath: string): LockOwner | undefined {\n  let raw: string;\n  try {\n    raw = readFileSync(lockPath, \"utf8\");\n  } catch (err) {\n    const code = (err as NodeJS.ErrnoException).code;\n    // `ENOENT` — vanished between the `EEXIST` and the read. Benign race: the lock is gone.\n    if (code === \"ENOENT\") return undefined;\n    // `EISDIR` — the lock path is a DIRECTORY. No process in this library creates one; it is debris\n    // from something else, and it will never become a readable lock. Failing closed here would lock\n    // the session out forever. Treated as owner-less: acquisition proceeds and fails with the real\n    // FS error, which says what is wrong — instead of a permanent SessionBusyError that says\n    // nothing. It is NOT \"reclaimable\": the lock is not removed, and the caller proceeds without a\n    // lease.\n    if (code === \"EISDIR\") return undefined;\n    // Any other read failure (`EACCES` in a shared directory, `EIO`) differs in kind: the lock\n    // **exists** and it is we who cannot read the owner. Treating it as free would let two writers\n    // coexist — precisely what the lease exists to prevent — and the `0600` that protects the lock\n    // against forgery WIDENS that surface: in a shared directory, another user's lock is unreadable\n    // by design.\n    //\n    // Not knowing who the owner is differs from there being no owner. Fail closed.\n    throw new SessionBusyError(lockPath.replace(/\\.writer\\.lock$/, \"\"));\n  }\n  try {\n    const d = JSON.parse(raw) as Partial<LockOwner>;\n    if (\n      typeof d.pid !== \"number\" ||\n      typeof d.hostname !== \"string\" ||\n      typeof d.mtime !== \"number\"\n    ) {\n      return undefined;\n    }\n    return { pid: d.pid, hostname: d.hostname, mtime: d.mtime };\n  } catch {\n    // Unreadable JSON: a lock nobody can interpret must not lock the session out forever. Treating\n    // it as stale is the recoverable choice; the cost is the same as that of an old lock.\n    return undefined;\n  }\n}\n\n/** Does the process exist? `signal 0` sends nothing — it only queries permission/existence. */\nfunction processAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (err) {\n    // EPERM means it EXISTS and belongs to another user.\n    return (err as NodeJS.ErrnoException).code === \"EPERM\";\n  }\n}\n\n/**\n * Can the lock be taken from whoever holds it?\n *\n * ADR-2 of the plan: reclaiming by `pid` alone has a false positive across machines — the same\n * number exists on another host, pointing at an unrelated process. So:\n *\n * - **same host:** the `pid` is authoritative, and it **alone**. Dead process => reclaimable at\n *   once; live process => never, however old the lock is.\n * - **other host:** the `pid` says nothing here. Only the heartbeat window counts, because it is\n *   the one signal that does not lie across machines.\n *\n * ## Why age does NOT count on the same host\n *\n * The first version did `stale || !processAlive(pid)`, and that was a serious defect: `mtime` is\n * written at **acquisition** and is not touched on each append, so any session lasting longer than\n * the window — that is, **every real session** — became stealable by another process. Two writers\n * on the same transcript is exactly what the lease exists to prevent.\n *\n * On the same host the question \"does the owner still exist?\" has an exact answer, and age adds no\n * information to it — only a way to be wrong. Keeping the window there would be heuristic layered\n * on top of a fact.\n */\nfunction reclaimable(owner: LockOwner | undefined): boolean {\n  if (owner === undefined) return true; // unreadable or vanished\n  if (owner.hostname !== hostname()) {\n    return Date.now() - owner.mtime > HEARTBEAT_WINDOW_MS;\n  }\n  return !processAlive(owner.pid);\n}\n\n/**\n * Does the session have a writer **right now**? A query that does NOT take the lease.\n *\n * M95 — it exists because asking by taking creates the very contention it meant to detect: two\n * processes querying a **free** session at the same time made one of them lose, and the consumer\n * forked for no reason. Measured in adversarial review: `RACE: spurious forks = 1`.\n *\n * It is a snapshot, not a guarantee: between the query and the real acquisition someone may take\n * the session. Callers needing the guarantee use {@link acquireSessionWriter}; callers needing to\n * **decide an id before opening anything** use this, and handle the race where it shows up.\n *\n */\nexport function sessionHasWriter(sessionPath: string): boolean {\n  const lockPath = `${sessionPath}.writer.lock`;\n  if (!existsSync(lockPath)) return false;\n  try {\n    return !reclaimable(readOwner(lockPath));\n  } catch {\n    // `readOwner` throws when the lock exists and cannot be read — fail closed, for the same reason\n    // as there: not knowing who the owner is differs from there being no owner.\n    return true;\n  }\n}\n\n/**\n * Take the exclusive writer lease for `sessionPath`, or reject with {@link SessionBusyError}.\n *\n * The lock is a sibling `.lock` file created with `wx` — the same file-existence primitive the\n * SDK's `withFileLock` builds on. Exclusivity comes from the filesystem, so it holds across\n * processes, not just across async tasks in one process.\n */\nexport async function acquireSessionWriter(sessionPath: string): Promise<SessionWriterLease> {\n  // M95 — `.writer.lock`, NOT `.lock`.\n  //\n  // `withFileLock(path, fn)` already uses `<path>.lock` as its companion. While the lease was called\n  // from nowhere (the defect this milestone fixes) the collision was theoretical; wiring it to the\n  // same file would make the long-lived lease block every short critical section on the same path.\n  //\n  // Two files because they are two things: `withFileLock` protects a section with a start and an\n  // end; the lease is OWNERSHIP, held across turns, with an explicit `release()` — the distinction\n  // the M81 docstring above already explains.\n  const lockPath = `${sessionPath}.writer.lock`;\n  const mine: LockOwner = ownerNow();\n  let fd: number;\n  try {\n    // The mode applies on CREATION — the `w` in `writeOwner` does not alter an existing file.\n    fd = openSync(lockPath, \"wx\", 0o600);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"EEXIST\") throw err;\n    // M95 — the lock exists. Until now that alone was enough to refuse, and that was the defect: a\n    // TUI killed by SIGKILL locked the user out of their own session PERMANENTLY, with no documented\n    // recovery path. Now the lock says who the owner is, and a dead owner yields its place.\n    if (!reclaimable(readOwner(lockPath))) throw new SessionBusyError(sessionPath);\n    writeOwner(lockPath, mine);\n    return createLease(sessionPath, lockPath);\n  }\n  closeSync(fd);\n  writeOwner(lockPath, mine);\n\n  return createLease(sessionPath, lockPath);\n}\n\n/** The lease itself — idempotent `release()`. Extracted because acquisition has two exit paths. */\nfunction createLease(sessionPath: string, lockPath: string): SessionWriterLease {\n  let released = false;\n  return {\n    sessionPath,\n    release: async (): Promise<void> => {\n      if (released) return;\n      released = true;\n      rmSync(lockPath, { force: true });\n    },\n    renew: (): void => {\n      // A released lease does not own the lock. Re-stamping here would RE-CREATE the file and give\n      // this process ownership it explicitly gave up — the one way this method could manufacture the\n      // double-writer the lease exists to prevent.\n      if (released) return;\n      writeOwner(lockPath, ownerNow());\n    },\n  };\n}\n"]}
+{"version":3,"sources":["../src/internal/persistence/session-writer.ts"],"names":["TheokitAgentError","hostname","openSync","writeSync","fchmodSync","closeSync","readFileSync","existsSync","rmSync"],"mappings":";;;;;;AAmDO,IAAM,gBAAA,GAAN,cAA+BA,mCAAA,CAAkB;AAAA,EAGtD,YAAqB,WAAA,EAAqB;AACxC,IAAA,KAAA;AAAA,MACE,oDAAoD,WAAW,CAAA,gJAAA,CAAA;AAAA,MAG/D,EAAE,IAAA,EAAM,cAAA,EAAgB,WAAA,EAAa,KAAA;AAAM,KAC7C;AANmB,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA,EAOrB;AAAA,EAPqB,WAAA;AAAA,EAFH,IAAA,GAAO,kBAAA;AAU3B;AA0CO,IAAM,mBAAA,GAAsB,GAAA;AAUnC,SAAS,QAAA,GAAsB;AAC7B,EAAA,OAAO,EAAE,GAAA,EAAK,OAAA,CAAQ,GAAA,EAAK,QAAA,EAAUC,aAAS,EAAG,KAAA,EAAO,IAAA,CAAK,GAAA,EAAI,EAAE;AACrE;AAWA,SAAS,UAAA,CAAW,UAAkB,KAAA,EAAwB;AAC5D,EAAA,MAAM,EAAA,GAAKC,WAAA,CAAS,QAAA,EAAU,GAAA,EAAK,GAAK,CAAA;AACxC,EAAA,IAAI;AACF,IAAAC,YAAA,CAAU,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAInC,IAAAC,aAAA,CAAW,IAAI,GAAK,CAAA;AAAA,EACtB,CAAA,SAAE;AACA,IAAAC,YAAA,CAAU,EAAE,CAAA;AAAA,EACd;AACF;AAGA,SAAS,UAAU,QAAA,EAAyC;AAC1D,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAMC,eAAA,CAAa,UAAU,MAAM,CAAA;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,OAAQ,GAAA,CAA8B,IAAA;AAE5C,IAAA,IAAI,IAAA,KAAS,UAAU,OAAO,MAAA;AAO9B,IAAA,IAAI,IAAA,KAAS,UAAU,OAAO,MAAA;AAQ9B,IAAA,MAAM,IAAI,gBAAA,CAAiB,QAAA,CAAS,OAAA,CAAQ,iBAAA,EAAmB,EAAE,CAAC,CAAA;AAAA,EACpE;AACA,EAAA,IAAI;AACF,IAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACxB,IAAA,IACE,OAAO,CAAA,CAAE,GAAA,KAAQ,QAAA,IACjB,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,IACtB,OAAO,CAAA,CAAE,KAAA,KAAU,QAAA,EACnB;AACA,MAAA,OAAO,KAAA,CAAA;AAAA,IACT;AACA,IAAA,OAAO,EAAE,KAAK,CAAA,CAAE,GAAA,EAAK,UAAU,CAAA,CAAE,QAAA,EAAU,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM;AAAA,EAC5D,CAAA,CAAA,MAAQ;AAGN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGA,SAAS,aAAa,GAAA,EAAsB;AAC1C,EAAA,IAAI;AACF,IAAA,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAC,CAAA;AACnB,IAAA,OAAO,IAAA;AAAA,EACT,SAAS,GAAA,EAAK;AAEZ,IAAA,OAAQ,IAA8B,IAAA,KAAS,OAAA;AAAA,EACjD;AACF;AAwBA,SAAS,YAAY,KAAA,EAAuC;AAC1D,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,IAAA;AAChC,EAAA,IAAI,KAAA,CAAM,QAAA,KAAaL,WAAA,EAAS,EAAG;AACjC,IAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA,CAAM,KAAA,GAAQ,mBAAA;AAAA,EACpC;AACA,EAAA,OAAO,CAAC,YAAA,CAAa,KAAA,CAAM,GAAG,CAAA;AAChC;AAcO,SAAS,iBAAiB,WAAA,EAA8B;AAC7D,EAAA,MAAM,QAAA,GAAW,GAAG,WAAW,CAAA,YAAA,CAAA;AAC/B,EAAA,IAAI,CAACM,aAAA,CAAW,QAAQ,CAAA,EAAG,OAAO,KAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAO,CAAC,WAAA,CAAY,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,EACzC,CAAA,CAAA,MAAQ;AAGN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASA,eAAsB,qBAAqB,WAAA,EAAkD;AAU3F,EAAA,MAAM,QAAA,GAAW,GAAG,WAAW,CAAA,YAAA,CAAA;AAC/B,EAAA,MAAM,OAAkB,QAAA,EAAS;AACjC,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AAEF,IAAA,EAAA,GAAKL,WAAA,CAAS,QAAA,EAAU,IAAA,EAAM,GAAK,CAAA;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,MAAM,GAAA;AAI5D,IAAA,IAAI,CAAC,YAAY,SAAA,CAAU,QAAQ,CAAC,CAAA,EAAG,MAAM,IAAI,gBAAA,CAAiB,WAAW,CAAA;AAC7E,IAAA,UAAA,CAAW,UAAU,IAAI,CAAA;AACzB,IAAA,OAAO,WAAA,CAAY,aAAa,QAAQ,CAAA;AAAA,EAC1C;AACA,EAAAG,YAAA,CAAU,EAAE,CAAA;AACZ,EAAA,UAAA,CAAW,UAAU,IAAI,CAAA;AAEzB,EAAA,OAAO,WAAA,CAAY,aAAa,QAAQ,CAAA;AAC1C;AAGA,SAAS,WAAA,CAAY,aAAqB,QAAA,EAAsC;AAC9E,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,OAAO;AAAA,IACL,WAAA;AAAA,IACA,SAAS,YAA2B;AAClC,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,QAAA,GAAW,IAAA;AACX,MAAAG,SAAA,CAAO,QAAA,EAAU,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAAA,IAClC,CAAA;AAAA,IACA,OAAO,MAAY;AAIjB,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,UAAA,CAAW,QAAA,EAAU,UAAU,CAAA;AAAA,IACjC;AAAA,GACF;AACF","file":"chunk-Z3NTRKIC.cjs","sourcesContent":["/**\n * M81 — single-writer lease for a session transcript.\n *\n * ## The problem\n *\n * Nothing stops two processes appending to the same JSONL transcript. The concrete case: `exec\n * resume --last` can write into the TUI's live session. Two interleaved appends to an append-only\n * file produce lines that are each individually valid and whose SEQUENCE is fiction — and nothing\n * reports it, because every line parses.\n *\n * ## Why an exclusive lockfile rather than `withFileLock`\n *\n * The plan's ADR D2 said to compose `withFileLock`, and that was the right instinct — do not build a\n * second lock mechanism. It turned out not to fit the SHAPE: `withFileLock(path, fn)` is\n * scope-based — it holds the lock for the duration of a callback. A session lease is **held across\n * turns**, for as long as the process owns the session, with an explicit `release()`. Wrapping the\n * whole session lifetime in a callback would invert control of the entire agent loop.\n *\n * So this uses the same underlying primitive `withFileLock` uses (an exclusive-create lockfile,\n * `wx`) with lease semantics on top. That keeps the mechanism single — the file-existence lock —\n * while giving it the lifetime the caller needs. The deviation from D2 is recorded here because the\n * plan's rationale (no second mechanism) still holds; only its shape assumption did not.\n *\n * ## Fail fast, never wait\n *\n * A second writer that WAITED would block `exec` behind a TUI session that can last hours. The typed\n * error lets the caller choose: fork to a new id, or give up with a real diagnosis.\n *\n * @internal\n */\n\nimport {\n  closeSync,\n  existsSync,\n  fchmodSync,\n  openSync,\n  readFileSync,\n  rmSync,\n  writeSync,\n} from \"node:fs\";\nimport { hostname } from \"node:os\";\n\nimport { TheokitAgentError } from \"../../errors.js\";\n\n/**\n * M81 — another process already holds the writer lease for this session.\n *\n * Carries `sessionPath` because knowing WHICH session is busy is what lets the caller decide between\n * forking and waiting for the user to close the TUI (`rules/error-handling.md § 2` — context enough\n * to act on).\n */\nexport class SessionBusyError extends TheokitAgentError {\n  override readonly name = \"SessionBusyError\";\n\n  constructor(readonly sessionPath: string) {\n    super(\n      `another process is already writing this session: ${sessionPath}. ` +\n        \"Fork it to a new id instead of appending — two writers interleave lines into a sequence \" +\n        \"that parses but is not what either process wrote.\",\n      { code: \"session_busy\", isRetryable: false },\n    );\n  }\n}\n\n/** A held writer lease. `release()` is idempotent. */\nexport interface SessionWriterLease {\n  readonly sessionPath: string;\n  release(): Promise<void>;\n  /**\n   * Re-stamp the ownership record, so a **live** owner never crosses the staleness window.\n   *\n   * Idempotent and cheap: one `write` of a ~80-byte JSON. Call it on the path that already writes to\n   * the session — appending a turn — and the cross-host window stops being a lie about liveness.\n   *\n   * A no-op after `release()`: renewing a lease you no longer hold would re-create the lock file and\n   * hand this process ownership it gave up. That is the one direction of this API that could\n   * *create* the double-writer it exists to prevent.\n   */\n  renew(): void;\n}\n\n/**\n * Staleness window **between machines** — and only between them.\n *\n * 30 s from ACQUISITION. Calling it a \"heartbeat\" would be a lie: the record is written once, when\n * the lease is taken, and is **not** renewed on every write. An earlier version of this comment\n * claimed \"the owner touches the file on every acquisition, so a live process never crosses the\n * window\" — false twice over, and adversarial review measured both.\n *\n * On the **same host** this does not matter: `reclaimable` decides by `pid`, which is exact, and age\n * never enters the calculation. Across hosts it does matter, and it is a real limit: a **live**\n * remote owner loses the lease after 30 s, because there is no way to ask another machine whether\n * its process still exists.\n *\n * **The residue is now closable by the caller** (`agent-builder#118`). `SessionWriterLease.renew()`\n * re-stamps the record; calling it on the path that already writes to the session — appending a turn\n * — keeps a live owner from ever crossing the window. It costs one `write` of ~80 bytes on a file\n * that was previously written once per session.\n *\n * It is `renew()` and not an internal timer on purpose. A timer inside the lease would keep the event\n * loop alive (or need `unref` plus its own teardown), and it would renew a lease belonging to a\n * process that is hung rather than working — which is precisely the state the window exists to\n * detect. Tying the renewal to a real write means the record tracks **progress**, not mere existence.\n */\nexport const HEARTBEAT_WINDOW_MS = 30_000;\n\n/** Who holds the lock. Written as JSON into `.writer.lock`. */\ninterface LockOwner {\n  pid: number;\n  hostname: string;\n  mtime: number;\n}\n\n/** The ownership record for THIS process, stamped now. One place, so acquire and renew cannot drift. */\nfunction ownerNow(): LockOwner {\n  return { pid: process.pid, hostname: hostname(), mtime: Date.now() };\n}\n\n/**\n * Writes the owner with user-only permissions.\n *\n * `0600` because the lock is an assertion of OWNERSHIP: with the `0664` the usual umask produces,\n * another user in the same group can overwrite the file and forge ownership of the session — and\n * from then on it is the legitimate owner who starts receiving `SessionBusyError`. The content\n * (`pid`, `hostname`) is low-sensitivity; what the permission protects is the signal's\n * **integrity**, not its secrecy.\n */\nfunction writeOwner(lockPath: string, owner: LockOwner): void {\n  const fd = openSync(lockPath, \"w\", 0o600);\n  try {\n    writeSync(fd, JSON.stringify(owner));\n    // `open`'s `mode` only applies on CREATION. A `.writer.lock` inherited from an earlier version —\n    // or left behind by a process with a different umask — would stay `0664` after being reclaimed,\n    // and the forgery window the mode closes for new locks would remain open for old ones.\n    fchmodSync(fd, 0o600);\n  } finally {\n    closeSync(fd);\n  }\n}\n\n/** Reads the lock's owner. `undefined` when the file vanished or the content is unreadable. */\nfunction readOwner(lockPath: string): LockOwner | undefined {\n  let raw: string;\n  try {\n    raw = readFileSync(lockPath, \"utf8\");\n  } catch (err) {\n    const code = (err as NodeJS.ErrnoException).code;\n    // `ENOENT` — vanished between the `EEXIST` and the read. Benign race: the lock is gone.\n    if (code === \"ENOENT\") return undefined;\n    // `EISDIR` — the lock path is a DIRECTORY. No process in this library creates one; it is debris\n    // from something else, and it will never become a readable lock. Failing closed here would lock\n    // the session out forever. Treated as owner-less: acquisition proceeds and fails with the real\n    // FS error, which says what is wrong — instead of a permanent SessionBusyError that says\n    // nothing. It is NOT \"reclaimable\": the lock is not removed, and the caller proceeds without a\n    // lease.\n    if (code === \"EISDIR\") return undefined;\n    // Any other read failure (`EACCES` in a shared directory, `EIO`) differs in kind: the lock\n    // **exists** and it is we who cannot read the owner. Treating it as free would let two writers\n    // coexist — precisely what the lease exists to prevent — and the `0600` that protects the lock\n    // against forgery WIDENS that surface: in a shared directory, another user's lock is unreadable\n    // by design.\n    //\n    // Not knowing who the owner is differs from there being no owner. Fail closed.\n    throw new SessionBusyError(lockPath.replace(/\\.writer\\.lock$/, \"\"));\n  }\n  try {\n    const d = JSON.parse(raw) as Partial<LockOwner>;\n    if (\n      typeof d.pid !== \"number\" ||\n      typeof d.hostname !== \"string\" ||\n      typeof d.mtime !== \"number\"\n    ) {\n      return undefined;\n    }\n    return { pid: d.pid, hostname: d.hostname, mtime: d.mtime };\n  } catch {\n    // Unreadable JSON: a lock nobody can interpret must not lock the session out forever. Treating\n    // it as stale is the recoverable choice; the cost is the same as that of an old lock.\n    return undefined;\n  }\n}\n\n/** Does the process exist? `signal 0` sends nothing — it only queries permission/existence. */\nfunction processAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (err) {\n    // EPERM means it EXISTS and belongs to another user.\n    return (err as NodeJS.ErrnoException).code === \"EPERM\";\n  }\n}\n\n/**\n * Can the lock be taken from whoever holds it?\n *\n * ADR-2 of the plan: reclaiming by `pid` alone has a false positive across machines — the same\n * number exists on another host, pointing at an unrelated process. So:\n *\n * - **same host:** the `pid` is authoritative, and it **alone**. Dead process => reclaimable at\n *   once; live process => never, however old the lock is.\n * - **other host:** the `pid` says nothing here. Only the heartbeat window counts, because it is\n *   the one signal that does not lie across machines.\n *\n * ## Why age does NOT count on the same host\n *\n * The first version did `stale || !processAlive(pid)`, and that was a serious defect: `mtime` is\n * written at **acquisition** and is not touched on each append, so any session lasting longer than\n * the window — that is, **every real session** — became stealable by another process. Two writers\n * on the same transcript is exactly what the lease exists to prevent.\n *\n * On the same host the question \"does the owner still exist?\" has an exact answer, and age adds no\n * information to it — only a way to be wrong. Keeping the window there would be heuristic layered\n * on top of a fact.\n */\nfunction reclaimable(owner: LockOwner | undefined): boolean {\n  if (owner === undefined) return true; // unreadable or vanished\n  if (owner.hostname !== hostname()) {\n    return Date.now() - owner.mtime > HEARTBEAT_WINDOW_MS;\n  }\n  return !processAlive(owner.pid);\n}\n\n/**\n * Does the session have a writer **right now**? A query that does NOT take the lease.\n *\n * M95 — it exists because asking by taking creates the very contention it meant to detect: two\n * processes querying a **free** session at the same time made one of them lose, and the consumer\n * forked for no reason. Measured in adversarial review: `RACE: spurious forks = 1`.\n *\n * It is a snapshot, not a guarantee: between the query and the real acquisition someone may take\n * the session. Callers needing the guarantee use {@link acquireSessionWriter}; callers needing to\n * **decide an id before opening anything** use this, and handle the race where it shows up.\n *\n */\nexport function sessionHasWriter(sessionPath: string): boolean {\n  const lockPath = `${sessionPath}.writer.lock`;\n  if (!existsSync(lockPath)) return false;\n  try {\n    return !reclaimable(readOwner(lockPath));\n  } catch {\n    // `readOwner` throws when the lock exists and cannot be read — fail closed, for the same reason\n    // as there: not knowing who the owner is differs from there being no owner.\n    return true;\n  }\n}\n\n/**\n * Take the exclusive writer lease for `sessionPath`, or reject with {@link SessionBusyError}.\n *\n * The lock is a sibling `.lock` file created with `wx` — the same file-existence primitive the\n * SDK's `withFileLock` builds on. Exclusivity comes from the filesystem, so it holds across\n * processes, not just across async tasks in one process.\n */\nexport async function acquireSessionWriter(sessionPath: string): Promise<SessionWriterLease> {\n  // M95 — `.writer.lock`, NOT `.lock`.\n  //\n  // `withFileLock(path, fn)` already uses `<path>.lock` as its companion. While the lease was called\n  // from nowhere (the defect this milestone fixes) the collision was theoretical; wiring it to the\n  // same file would make the long-lived lease block every short critical section on the same path.\n  //\n  // Two files because they are two things: `withFileLock` protects a section with a start and an\n  // end; the lease is OWNERSHIP, held across turns, with an explicit `release()` — the distinction\n  // the M81 docstring above already explains.\n  const lockPath = `${sessionPath}.writer.lock`;\n  const mine: LockOwner = ownerNow();\n  let fd: number;\n  try {\n    // The mode applies on CREATION — the `w` in `writeOwner` does not alter an existing file.\n    fd = openSync(lockPath, \"wx\", 0o600);\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"EEXIST\") throw err;\n    // M95 — the lock exists. Until now that alone was enough to refuse, and that was the defect: a\n    // TUI killed by SIGKILL locked the user out of their own session PERMANENTLY, with no documented\n    // recovery path. Now the lock says who the owner is, and a dead owner yields its place.\n    if (!reclaimable(readOwner(lockPath))) throw new SessionBusyError(sessionPath);\n    writeOwner(lockPath, mine);\n    return createLease(sessionPath, lockPath);\n  }\n  closeSync(fd);\n  writeOwner(lockPath, mine);\n\n  return createLease(sessionPath, lockPath);\n}\n\n/** The lease itself — idempotent `release()`. Extracted because acquisition has two exit paths. */\nfunction createLease(sessionPath: string, lockPath: string): SessionWriterLease {\n  let released = false;\n  return {\n    sessionPath,\n    release: async (): Promise<void> => {\n      if (released) return;\n      released = true;\n      rmSync(lockPath, { force: true });\n    },\n    renew: (): void => {\n      // A released lease does not own the lock. Re-stamping here would RE-CREATE the file and give\n      // this process ownership it explicitly gave up — the one way this method could manufacture the\n      // double-writer the lease exists to prevent.\n      if (released) return;\n      writeOwner(lockPath, ownerNow());\n    },\n  };\n}\n"]}

package/dist/compact-session-BHTPCIHA.cjs

@@ -0,0 +1,61 @@
+'use strict';
+
+var chunk2HPNT6HH_cjs = require('./chunk-2HPNT6HH.cjs');
+require('./chunk-FUSDYC2B.cjs');
+require('./chunk-YJNYDJ2T.cjs');
+require('./chunk-24SYBZPL.cjs');
+require('./chunk-QOGNZMHD.cjs');
+require('./chunk-MUUQ2WFJ.cjs');
+require('./chunk-YSTXFWQE.cjs');
+require('./chunk-FRITRLZQ.cjs');
+require('./chunk-7A6535RA.cjs');
+require('./chunk-SA6K24NB.cjs');
+require('./chunk-GZV6AVRL.cjs');
+require('./chunk-ZF2LDKQQ.cjs');
+require('./chunk-JLRLCBJ4.cjs');
+require('./chunk-ATT276RD.cjs');
+require('./chunk-3EE6LVWT.cjs');
+require('./chunk-QC55H6RJ.cjs');
+require('./chunk-NVXXWAU7.cjs');
+require('./chunk-4NLCWGH7.cjs');
+require('./chunk-EXTRW7GW.cjs');
+require('./chunk-HUFSABUZ.cjs');
+require('./chunk-J7J7J2GN.cjs');
+require('./chunk-6LHQPOMI.cjs');
+
+
+
+Object.defineProperty(exports, "COMPACT_SUMMARY_MARKER", {
+  enumerable: true,
+  get: function () { return chunk2HPNT6HH_cjs.COMPACT_SUMMARY_MARKER; }
+});
+Object.defineProperty(exports, "COMPACT_USER_MESSAGE_MAX_TOKENS", {
+  enumerable: true,
+  get: function () { return chunk2HPNT6HH_cjs.COMPACT_USER_MESSAGE_MAX_TOKENS; }
+});
+Object.defineProperty(exports, "autoCompactIfNeeded", {
+  enumerable: true,
+  get: function () { return chunk2HPNT6HH_cjs.autoCompactIfNeeded; }
+});
+Object.defineProperty(exports, "buildDefaultSummarizer", {
+  enumerable: true,
+  get: function () { return chunk2HPNT6HH_cjs.buildDefaultSummarizer; }
+});
+Object.defineProperty(exports, "compactSessionTranscript", {
+  enumerable: true,
+  get: function () { return chunk2HPNT6HH_cjs.compactSessionTranscript; }
+});
+Object.defineProperty(exports, "isCompactSummary", {
+  enumerable: true,
+  get: function () { return chunk2HPNT6HH_cjs.isCompactSummary; }
+});
+Object.defineProperty(exports, "resolveSummarizerRoute", {
+  enumerable: true,
+  get: function () { return chunk2HPNT6HH_cjs.resolveSummarizerRoute; }
+});
+Object.defineProperty(exports, "shouldAutoCompact", {
+  enumerable: true,
+  get: function () { return chunk2HPNT6HH_cjs.shouldAutoCompact; }
+});
+//# sourceMappingURL=compact-session-BHTPCIHA.cjs.map
+//# sourceMappingURL=compact-session-BHTPCIHA.cjs.map

package/dist/{compact-session-QV57KR66.cjs.map → compact-session-BHTPCIHA.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"compact-session-QV57KR66.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"compact-session-BHTPCIHA.cjs"}

package/dist/compact-session-W4WLJTHA.js

@@ -0,0 +1,24 @@
+export { COMPACT_SUMMARY_MARKER, COMPACT_USER_MESSAGE_MAX_TOKENS, autoCompactIfNeeded, buildDefaultSummarizer, compactSessionTranscript, isCompactSummary, resolveSummarizerRoute, shouldAutoCompact } from './chunk-K3NH62DG.js';
+import './chunk-UBR5PWD7.js';
+import './chunk-2XC6KDJM.js';
+import './chunk-XB4GI5RZ.js';
+import './chunk-24MGQDK3.js';
+import './chunk-FD2UT76F.js';
+import './chunk-FJWQP6EE.js';
+import './chunk-NAF4L3T6.js';
+import './chunk-EH6XD3FY.js';
+import './chunk-UKMBRMGT.js';
+import './chunk-JOFVLOFY.js';
+import './chunk-Q5EWJPRY.js';
+import './chunk-3JHIFQ4I.js';
+import './chunk-6M2OIS4Y.js';
+import './chunk-R7WIIPUR.js';
+import './chunk-VWUXIVEI.js';
+import './chunk-AGACYRJ2.js';
+import './chunk-JMDDYA22.js';
+import './chunk-V22DZIXO.js';
+import './chunk-NJWYQWDL.js';
+import './chunk-ALUN2B4W.js';
+import './chunk-CZJ6Q7CW.js';
+//# sourceMappingURL=compact-session-W4WLJTHA.js.map
+//# sourceMappingURL=compact-session-W4WLJTHA.js.map

package/dist/{compact-session-RIGOWC4Y.js.map → compact-session-W4WLJTHA.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"compact-session-RIGOWC4Y.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"compact-session-W4WLJTHA.js"}

package/dist/compaction.cjs

@@ -1,63 +1,66 @@
 'use strict';
 
-var chunkDXGZ2NUG_cjs = require('./chunk-DXGZ2NUG.cjs');
-require('./chunk-4ZHTIJNE.cjs');
-require('./chunk-XL7Q7HB2.cjs');
-require('./chunk-EG4QM7ZJ.cjs');
+var chunkATT276RD_cjs = require('./chunk-ATT276RD.cjs');
+require('./chunk-J7J7J2GN.cjs');
+require('./chunk-6LHQPOMI.cjs');
 
 
 
 Object.defineProperty(exports, "ABSOLUTE_CONTEXT_WINDOW_CAP", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.ABSOLUTE_CONTEXT_WINDOW_CAP; }
+  get: function () { return chunkATT276RD_cjs.ABSOLUTE_CONTEXT_WINDOW_CAP; }
+});
+Object.defineProperty(exports, "CHARS_PER_TOKEN", {
+  enumerable: true,
+  get: function () { return chunkATT276RD_cjs.CHARS_PER_TOKEN; }
 });
 Object.defineProperty(exports, "CHECKPOINT_MARKER", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.CHECKPOINT_MARKER; }
+  get: function () { return chunkATT276RD_cjs.CHECKPOINT_MARKER; }
 });
 Object.defineProperty(exports, "CONTEXT_WINDOW_FLOOR", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.CONTEXT_WINDOW_FLOOR; }
+  get: function () { return chunkATT276RD_cjs.CONTEXT_WINDOW_FLOOR; }
 });
 Object.defineProperty(exports, "CONTEXT_WINDOW_MARGIN", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.CONTEXT_WINDOW_MARGIN; }
+  get: function () { return chunkATT276RD_cjs.CONTEXT_WINDOW_MARGIN; }
 });
 Object.defineProperty(exports, "ContextWindowMarginError", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.ContextWindowMarginError; }
+  get: function () { return chunkATT276RD_cjs.ContextWindowMarginError; }
 });
 Object.defineProperty(exports, "SUMMARY_TEMPLATE", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.SUMMARY_TEMPLATE; }
+  get: function () { return chunkATT276RD_cjs.SUMMARY_TEMPLATE; }
 });
 Object.defineProperty(exports, "buildCheckpoint", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.buildCheckpoint; }
+  get: function () { return chunkATT276RD_cjs.buildCheckpoint; }
 });
 Object.defineProperty(exports, "compactTranscript", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.compactTranscript; }
+  get: function () { return chunkATT276RD_cjs.compactTranscript; }
 });
 Object.defineProperty(exports, "estimateTokens", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.estimateTokens; }
+  get: function () { return chunkATT276RD_cjs.estimateTokens; }
 });
 Object.defineProperty(exports, "filterFromLatestCheckpoint", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.filterFromLatestCheckpoint; }
+  get: function () { return chunkATT276RD_cjs.filterFromLatestCheckpoint; }
 });
 Object.defineProperty(exports, "isContextOverflowError", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.isContextOverflowError; }
+  get: function () { return chunkATT276RD_cjs.isContextOverflowError; }
 });
 Object.defineProperty(exports, "resolveEffectiveContextWindow", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.resolveEffectiveContextWindow; }
+  get: function () { return chunkATT276RD_cjs.resolveEffectiveContextWindow; }
 });
 Object.defineProperty(exports, "shouldCompact", {
   enumerable: true,
-  get: function () { return chunkDXGZ2NUG_cjs.shouldCompact; }
+  get: function () { return chunkATT276RD_cjs.shouldCompact; }
 });
 //# sourceMappingURL=compaction.cjs.map
 //# sourceMappingURL=compaction.cjs.map

package/dist/compaction.d.cts

@@ -207,12 +207,26 @@ export interface ShouldCompactInput {
      */
     readonly maxOutput?: number;
 }
+/**
+ * Characters per token in the tokenizer-free estimate below.
+ *
+ * Exported so the ratio has ONE owner. It used to be a named constant in `built-in-processors.ts`
+ * and an inlined `4` here, with both `estimateTokens` functions `@public` from two different package
+ * entry points — so tuning the ratio, or switching to code points instead of UTF-16 units (the
+ * caveat both docblocks already carried), would have silently diverged them.
+ *
+ * @public
+ */
+export declare const CHARS_PER_TOKEN = 4;
 /**
  * Tokenizer-free token estimate via the conventional ~4-chars-per-token
- * heuristic: `ceil(text.length / 4)`. `""` → 0; any non-empty text → ≥ 1.
+ * heuristic: `ceil(text.length / CHARS_PER_TOKEN)`. `""` → 0; any non-empty text → ≥ 1.
  * A cheap PRE-CALL gate for {@link shouldCompact} — NOT exact tokenization
  * (a consumer needing exactness supplies their own tokenizer). Uses UTF-16
  * `.length` (code units), so multibyte text is approximate.
+ *
+ * `built-in-processors.ts` re-exports this under the same name, so both entry points keep working
+ * and there is one implementation behind them.
  */
 export declare function estimateTokens(text: string): number;
 /**

package/dist/compaction.d.ts

@@ -207,12 +207,26 @@ export interface ShouldCompactInput {
      */
     readonly maxOutput?: number;
 }
+/**
+ * Characters per token in the tokenizer-free estimate below.
+ *
+ * Exported so the ratio has ONE owner. It used to be a named constant in `built-in-processors.ts`
+ * and an inlined `4` here, with both `estimateTokens` functions `@public` from two different package
+ * entry points — so tuning the ratio, or switching to code points instead of UTF-16 units (the
+ * caveat both docblocks already carried), would have silently diverged them.
+ *
+ * @public
+ */
+export declare const CHARS_PER_TOKEN = 4;
 /**
  * Tokenizer-free token estimate via the conventional ~4-chars-per-token
- * heuristic: `ceil(text.length / 4)`. `""` → 0; any non-empty text → ≥ 1.
+ * heuristic: `ceil(text.length / CHARS_PER_TOKEN)`. `""` → 0; any non-empty text → ≥ 1.
  * A cheap PRE-CALL gate for {@link shouldCompact} — NOT exact tokenization
  * (a consumer needing exactness supplies their own tokenizer). Uses UTF-16
  * `.length` (code units), so multibyte text is approximate.
+ *
+ * `built-in-processors.ts` re-exports this under the same name, so both entry points keep working
+ * and there is one implementation behind them.
  */
 export declare function estimateTokens(text: string): number;
 /**

package/dist/compaction.js

@@ -1,6 +1,5 @@
-export { ABSOLUTE_CONTEXT_WINDOW_CAP, CHECKPOINT_MARKER, CONTEXT_WINDOW_FLOOR, CONTEXT_WINDOW_MARGIN, ContextWindowMarginError, SUMMARY_TEMPLATE, buildCheckpoint, compactTranscript, estimateTokens, filterFromLatestCheckpoint, isContextOverflowError, resolveEffectiveContextWindow, shouldCompact } from './chunk-A4JVILQU.js';
-import './chunk-ZZMZWBR6.js';
-import './chunk-D4CUGAKZ.js';
-import './chunk-XEQ3TM66.js';
+export { ABSOLUTE_CONTEXT_WINDOW_CAP, CHARS_PER_TOKEN, CHECKPOINT_MARKER, CONTEXT_WINDOW_FLOOR, CONTEXT_WINDOW_MARGIN, ContextWindowMarginError, SUMMARY_TEMPLATE, buildCheckpoint, compactTranscript, estimateTokens, filterFromLatestCheckpoint, isContextOverflowError, resolveEffectiveContextWindow, shouldCompact } from './chunk-6M2OIS4Y.js';
+import './chunk-ALUN2B4W.js';
+import './chunk-CZJ6Q7CW.js';
 //# sourceMappingURL=compaction.js.map
 //# sourceMappingURL=compaction.js.map

package/dist/concurrency.cjs

@@ -1,23 +1,22 @@
 'use strict';
 
-var chunkZSWPZ23K_cjs = require('./chunk-ZSWPZ23K.cjs');
-var chunkXWTLIGO3_cjs = require('./chunk-XWTLIGO3.cjs');
-require('./chunk-4ZHTIJNE.cjs');
-require('./chunk-XL7Q7HB2.cjs');
-require('./chunk-EG4QM7ZJ.cjs');
+var chunkI2PWY7VM_cjs = require('./chunk-I2PWY7VM.cjs');
+var chunkKTTHHYEW_cjs = require('./chunk-KTTHHYEW.cjs');
+require('./chunk-J7J7J2GN.cjs');
+require('./chunk-6LHQPOMI.cjs');
 
 // src/concurrency.ts
 var Semaphore = class {
   constructor() {
   }
   static create(permits) {
-    return chunkXWTLIGO3_cjs.createSemaphore(permits);
+    return chunkKTTHHYEW_cjs.createSemaphore(permits);
   }
 };
 
 Object.defineProperty(exports, "mapWithConcurrency", {
   enumerable: true,
-  get: function () { return chunkZSWPZ23K_cjs.mapWithConcurrency; }
+  get: function () { return chunkI2PWY7VM_cjs.mapWithConcurrency; }
 });
 exports.Semaphore = Semaphore;
 //# sourceMappingURL=concurrency.cjs.map

package/dist/concurrency.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/concurrency.ts"],"names":["createSemaphore"],"mappings":";;;;;;;;;AAoBO,IAAM,YAAN,MAAgB;AAAA,EACb,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,OAAO,OAAA,EAAiC;AAC7C,IAAA,OAAOA,kCAAgB,OAAO,CAAA;AAAA,EAChC;AACF","file":"concurrency.cjs","sourcesContent":["/**\n * Public concurrency primitives (plan m0-foundation-expose-primitives, M0-2).\n *\n * Thin re-export of the in-house concurrency helpers (ADR D135 — no\n * `p-limit`/`p-map` dependency). Split into its own top-level module so\n * `tsup` builds a dedicated `@theokit/sdk/concurrency` sub-path entry,\n * mirroring the `path-safety` pattern.\n *\n *   - `createSemaphore(permits)` — N-permit async-aware counting semaphore.\n *   - `mapWithConcurrency(items, concurrency, fn, opts?)` — ordered bounded map.\n */\n\nimport {\n  type AsyncSemaphore,\n  createSemaphore,\n} from \"./internal/runtime/concurrency/async-semaphore.js\";\n\nexport type { AsyncSemaphore };\n\n/** SE36 — `Semaphore.create` replaces `createSemaphore` (ADR 0015). @public */\nexport class Semaphore {\n  private constructor() {}\n  static create(permits: number): AsyncSemaphore {\n    return createSemaphore(permits);\n  }\n}\nexport { mapWithConcurrency } from \"./internal/runtime/concurrency/map-with-concurrency.js\";\n"]}
+{"version":3,"sources":["../src/concurrency.ts"],"names":["createSemaphore"],"mappings":";;;;;;;;AAoBO,IAAM,YAAN,MAAgB;AAAA,EACb,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,OAAO,OAAA,EAAiC;AAC7C,IAAA,OAAOA,kCAAgB,OAAO,CAAA;AAAA,EAChC;AACF","file":"concurrency.cjs","sourcesContent":["/**\n * Public concurrency primitives (plan m0-foundation-expose-primitives, M0-2).\n *\n * Thin re-export of the in-house concurrency helpers (ADR D135 — no\n * `p-limit`/`p-map` dependency). Split into its own top-level module so\n * `tsup` builds a dedicated `@theokit/sdk/concurrency` sub-path entry,\n * mirroring the `path-safety` pattern.\n *\n *   - `createSemaphore(permits)` — N-permit async-aware counting semaphore.\n *   - `mapWithConcurrency(items, concurrency, fn, opts?)` — ordered bounded map.\n */\n\nimport { type AsyncSemaphore, createSemaphore } from \"./internal/concurrency/async-semaphore.js\";\n\nexport type { AsyncSemaphore };\n\n/** SE36 — `Semaphore.create` replaces `createSemaphore` (ADR 0015). @public  *\n * `Semaphore.create` returns an **`AsyncSemaphore`** — the class is the namespace and\n * `AsyncSemaphore` is the type callers hold.\n */\nexport class Semaphore {\n  private constructor() {}\n  static create(permits: number): AsyncSemaphore {\n    return createSemaphore(permits);\n  }\n}\nexport { mapWithConcurrency } from \"./internal/concurrency/map-with-concurrency.js\";\n"]}

package/dist/concurrency.d.cts

@@ -9,11 +9,14 @@
  *   - `createSemaphore(permits)` — N-permit async-aware counting semaphore.
  *   - `mapWithConcurrency(items, concurrency, fn, opts?)` — ordered bounded map.
  */
-import { type AsyncSemaphore } from "./internal/runtime/concurrency/async-semaphore.js";
+import { type AsyncSemaphore } from "./internal/concurrency/async-semaphore.js";
 export type { AsyncSemaphore };
-/** SE36 — `Semaphore.create` replaces `createSemaphore` (ADR 0015). @public */
+/** SE36 — `Semaphore.create` replaces `createSemaphore` (ADR 0015). @public  *
+ * `Semaphore.create` returns an **`AsyncSemaphore`** — the class is the namespace and
+ * `AsyncSemaphore` is the type callers hold.
+ */
 export declare class Semaphore {
     private constructor();
     static create(permits: number): AsyncSemaphore;
 }
-export { mapWithConcurrency } from "./internal/runtime/concurrency/map-with-concurrency.js";
+export { mapWithConcurrency } from "./internal/concurrency/map-with-concurrency.js";

package/dist/concurrency.d.ts

@@ -9,11 +9,14 @@
  *   - `createSemaphore(permits)` — N-permit async-aware counting semaphore.
  *   - `mapWithConcurrency(items, concurrency, fn, opts?)` — ordered bounded map.
  */
-import { type AsyncSemaphore } from "./internal/runtime/concurrency/async-semaphore.js";
+import { type AsyncSemaphore } from "./internal/concurrency/async-semaphore.js";
 export type { AsyncSemaphore };
-/** SE36 — `Semaphore.create` replaces `createSemaphore` (ADR 0015). @public */
+/** SE36 — `Semaphore.create` replaces `createSemaphore` (ADR 0015). @public  *
+ * `Semaphore.create` returns an **`AsyncSemaphore`** — the class is the namespace and
+ * `AsyncSemaphore` is the type callers hold.
+ */
 export declare class Semaphore {
     private constructor();
     static create(permits: number): AsyncSemaphore;
 }
-export { mapWithConcurrency } from "./internal/runtime/concurrency/map-with-concurrency.js";
+export { mapWithConcurrency } from "./internal/concurrency/map-with-concurrency.js";

package/dist/concurrency.js

@@ -1,8 +1,7 @@
-export { mapWithConcurrency } from './chunk-C72AZW7J.js';
-import { createSemaphore } from './chunk-4QZSA2HJ.js';
-import './chunk-ZZMZWBR6.js';
-import './chunk-D4CUGAKZ.js';
-import './chunk-XEQ3TM66.js';
+export { mapWithConcurrency } from './chunk-4MMWFSCD.js';
+import { createSemaphore } from './chunk-G7BLGBRN.js';
+import './chunk-ALUN2B4W.js';
+import './chunk-CZJ6Q7CW.js';
 
 // src/concurrency.ts
 var Semaphore = class {

package/dist/concurrency.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/concurrency.ts"],"names":[],"mappings":";;;;;;;AAoBO,IAAM,YAAN,MAAgB;AAAA,EACb,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,OAAO,OAAA,EAAiC;AAC7C,IAAA,OAAO,gBAAgB,OAAO,CAAA;AAAA,EAChC;AACF","file":"concurrency.js","sourcesContent":["/**\n * Public concurrency primitives (plan m0-foundation-expose-primitives, M0-2).\n *\n * Thin re-export of the in-house concurrency helpers (ADR D135 — no\n * `p-limit`/`p-map` dependency). Split into its own top-level module so\n * `tsup` builds a dedicated `@theokit/sdk/concurrency` sub-path entry,\n * mirroring the `path-safety` pattern.\n *\n *   - `createSemaphore(permits)` — N-permit async-aware counting semaphore.\n *   - `mapWithConcurrency(items, concurrency, fn, opts?)` — ordered bounded map.\n */\n\nimport {\n  type AsyncSemaphore,\n  createSemaphore,\n} from \"./internal/runtime/concurrency/async-semaphore.js\";\n\nexport type { AsyncSemaphore };\n\n/** SE36 — `Semaphore.create` replaces `createSemaphore` (ADR 0015). @public */\nexport class Semaphore {\n  private constructor() {}\n  static create(permits: number): AsyncSemaphore {\n    return createSemaphore(permits);\n  }\n}\nexport { mapWithConcurrency } from \"./internal/runtime/concurrency/map-with-concurrency.js\";\n"]}
+{"version":3,"sources":["../src/concurrency.ts"],"names":[],"mappings":";;;;;;AAoBO,IAAM,YAAN,MAAgB;AAAA,EACb,WAAA,GAAc;AAAA,EAAC;AAAA,EACvB,OAAO,OAAO,OAAA,EAAiC;AAC7C,IAAA,OAAO,gBAAgB,OAAO,CAAA;AAAA,EAChC;AACF","file":"concurrency.js","sourcesContent":["/**\n * Public concurrency primitives (plan m0-foundation-expose-primitives, M0-2).\n *\n * Thin re-export of the in-house concurrency helpers (ADR D135 — no\n * `p-limit`/`p-map` dependency). Split into its own top-level module so\n * `tsup` builds a dedicated `@theokit/sdk/concurrency` sub-path entry,\n * mirroring the `path-safety` pattern.\n *\n *   - `createSemaphore(permits)` — N-permit async-aware counting semaphore.\n *   - `mapWithConcurrency(items, concurrency, fn, opts?)` — ordered bounded map.\n */\n\nimport { type AsyncSemaphore, createSemaphore } from \"./internal/concurrency/async-semaphore.js\";\n\nexport type { AsyncSemaphore };\n\n/** SE36 — `Semaphore.create` replaces `createSemaphore` (ADR 0015). @public  *\n * `Semaphore.create` returns an **`AsyncSemaphore`** — the class is the namespace and\n * `AsyncSemaphore` is the type callers hold.\n */\nexport class Semaphore {\n  private constructor() {}\n  static create(permits: number): AsyncSemaphore {\n    return createSemaphore(permits);\n  }\n}\nexport { mapWithConcurrency } from \"./internal/concurrency/map-with-concurrency.js\";\n"]}

package/dist/context/index.cjs

@@ -1,9 +1,9 @@
 'use strict';
 
-var chunk7BG5UH3T_cjs = require('../chunk-7BG5UH3T.cjs');
+var chunkRHZ6HP23_cjs = require('../chunk-RHZ6HP23.cjs');
 require('../chunk-KRD3GQAA.cjs');
 var chunkLKFET5A3_cjs = require('../chunk-LKFET5A3.cjs');
-require('../chunk-VKJ7V7EB.cjs');
+require('../chunk-SA6K24NB.cjs');
 
 // src/context/index.ts
 function resolveContextImports(content, basePath, options) {
@@ -13,20 +13,20 @@ function resolveContextImports(content, basePath, options) {
     maxBytesPerFile: options.maxBytesPerFile,
     projectRoot: options.projectRoot
   };
-  return chunk7BG5UH3T_cjs.resolveImports(content, basePath, internalOptions);
+  return chunkRHZ6HP23_cjs.resolveImports(content, basePath, internalOptions);
 }
 
 Object.defineProperty(exports, "parseRules", {
   enumerable: true,
-  get: function () { return chunk7BG5UH3T_cjs.parseRules; }
+  get: function () { return chunkRHZ6HP23_cjs.parseRules; }
 });
 Object.defineProperty(exports, "runDiscovery", {
   enumerable: true,
-  get: function () { return chunk7BG5UH3T_cjs.runDiscovery; }
+  get: function () { return chunkRHZ6HP23_cjs.runDiscovery; }
 });
 Object.defineProperty(exports, "shouldActivateRule", {
   enumerable: true,
-  get: function () { return chunk7BG5UH3T_cjs.shouldActivateRule; }
+  get: function () { return chunkRHZ6HP23_cjs.shouldActivateRule; }
 });
 Object.defineProperty(exports, "DEFAULT_DISCOVERY_SPECS", {
   enumerable: true,

package/dist/context/index.js

@@ -1,8 +1,8 @@
-import { resolveImports } from '../chunk-SAVIWMZB.js';
-export { parseRules, runDiscovery, shouldActivateRule } from '../chunk-SAVIWMZB.js';
+import { resolveImports } from '../chunk-ILGZ2ZZV.js';
+export { parseRules, runDiscovery, shouldActivateRule } from '../chunk-ILGZ2ZZV.js';
 import '../chunk-KVNWIAO4.js';
 export { DEFAULT_DISCOVERY_SPECS } from '../chunk-WFC26L6Y.js';
-import '../chunk-RIAM53CP.js';
+import '../chunk-UKMBRMGT.js';
 
 // src/context/index.ts
 function resolveContextImports(content, basePath, options) {

package/dist/context-74SBFD27.cjs

@@ -0,0 +1,23 @@
+'use strict';
+
+var chunkHWSALKOR_cjs = require('./chunk-HWSALKOR.cjs');
+require('./chunk-CEILSTWB.cjs');
+require('./chunk-J7J7J2GN.cjs');
+require('./chunk-6LHQPOMI.cjs');
+
+
+
+Object.defineProperty(exports, "currentPersonalityContext", {
+  enumerable: true,
+  get: function () { return chunkHWSALKOR_cjs.currentPersonalityContext; }
+});
+Object.defineProperty(exports, "warnPersonalitySwitchInsideFork", {
+  enumerable: true,
+  get: function () { return chunkHWSALKOR_cjs.warnPersonalitySwitchInsideFork; }
+});
+Object.defineProperty(exports, "withPersonalityContext", {
+  enumerable: true,
+  get: function () { return chunkHWSALKOR_cjs.withPersonalityContext; }
+});
+//# sourceMappingURL=context-74SBFD27.cjs.map
+//# sourceMappingURL=context-74SBFD27.cjs.map

package/dist/{context-AGQ3DIZU.cjs.map → context-74SBFD27.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"context-AGQ3DIZU.cjs"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"context-74SBFD27.cjs"}

package/dist/context-NZ2AC6S7.js

@@ -0,0 +1,6 @@
+export { currentPersonalityContext, warnPersonalitySwitchInsideFork, withPersonalityContext } from './chunk-IJM7UGS5.js';
+import './chunk-JTZ74HFD.js';
+import './chunk-ALUN2B4W.js';
+import './chunk-CZJ6Q7CW.js';
+//# sourceMappingURL=context-NZ2AC6S7.js.map
+//# sourceMappingURL=context-NZ2AC6S7.js.map