@theokit/sdk 4.63.4 → 5.0.0-next.2

package/dist/{chunk-DXGZ2NUG.cjs → chunk-ATT276RD.cjs}

@@ -1,8 +1,7 @@
 'use strict';
 
-var chunk4ZHTIJNE_cjs = require('./chunk-4ZHTIJNE.cjs');
-var chunkXL7Q7HB2_cjs = require('./chunk-XL7Q7HB2.cjs');
-var chunkEG4QM7ZJ_cjs = require('./chunk-EG4QM7ZJ.cjs');
+var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
+var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
 
 // src/internal/runtime/compression/compression-helpers.ts
 function selectCompressionWindow(messages, preserveLast = 6) {
@@ -41,7 +40,7 @@ Anything that MUST NOT be forgotten (preserve verbatim: error messages, exact va
 File paths touched or referenced (verbatim).`;
 function assertMarker(marker) {
   if (marker === "") {
-    throw new chunk4ZHTIJNE_cjs.TheokitAgentError("compaction marker must be non-empty", {
+    throw new chunkJ7J7J2GN_cjs.TheokitAgentError("compaction marker must be non-empty", {
       code: "invalid_argument"
     });
   }
@@ -74,8 +73,8 @@ async function runSummarize(summarize, head, template, failSafe) {
     return await summarize(head, template);
   } catch (err) {
     if (!failSafe) throw err;
-    chunkEG4QM7ZJ_cjs.diag(
-      `[compaction] summarizer failed \u2014 proceeding uncompacted: ${chunkXL7Q7HB2_cjs.redactSecrets(err instanceof Error ? err.message : String(err))}
+    chunk6LHQPOMI_cjs.diag(
+      `[compaction] summarizer failed \u2014 proceeding uncompacted: ${chunk6LHQPOMI_cjs.redactSecrets(err instanceof Error ? err.message : String(err))}
 `
     );
     return FAILSAFE_ABORT;
@@ -118,9 +117,9 @@ function filterFromLatestCheckpoint(messages, options = {}) {
   return [...messages];
 }
 function isContextOverflowError(err) {
-  return err instanceof chunk4ZHTIJNE_cjs.TheokitAgentError && (err.code === "context_too_long" || err.metadata?.code === "context_too_long");
+  return err instanceof chunkJ7J7J2GN_cjs.TheokitAgentError && (err.code === "context_too_long" || err.metadata?.code === "context_too_long");
 }
-var ContextWindowMarginError = class extends chunk4ZHTIJNE_cjs.TheokitAgentError {
+var ContextWindowMarginError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
   constructor(margin) {
     super(
       `context-window margin must be in (0, 1], got ${String(margin)}. A margin above 1 grows the assumed window and delays compaction past the real limit.`,
@@ -148,14 +147,16 @@ function resolveEffectiveContextWindow(input) {
   }
   return { window: withMargin(input.floor ?? 0), source: "fallback", clamped: false };
 }
+var CHARS_PER_TOKEN = 4;
 function estimateTokens(text) {
-  return Math.ceil(text.length / 4);
+  return Math.ceil(text.length / CHARS_PER_TOKEN);
 }
 function shouldCompact(input) {
   return input.estimated >= input.contextWindow - input.buffer - (input.maxOutput ?? 0);
 }
 
 exports.ABSOLUTE_CONTEXT_WINDOW_CAP = ABSOLUTE_CONTEXT_WINDOW_CAP;
+exports.CHARS_PER_TOKEN = CHARS_PER_TOKEN;
 exports.CHECKPOINT_MARKER = CHECKPOINT_MARKER;
 exports.CONTEXT_WINDOW_FLOOR = CONTEXT_WINDOW_FLOOR;
 exports.CONTEXT_WINDOW_MARGIN = CONTEXT_WINDOW_MARGIN;
@@ -168,5 +169,5 @@ exports.filterFromLatestCheckpoint = filterFromLatestCheckpoint;
 exports.isContextOverflowError = isContextOverflowError;
 exports.resolveEffectiveContextWindow = resolveEffectiveContextWindow;
 exports.shouldCompact = shouldCompact;
-//# sourceMappingURL=chunk-DXGZ2NUG.cjs.map
-//# sourceMappingURL=chunk-DXGZ2NUG.cjs.map
+//# sourceMappingURL=chunk-ATT276RD.cjs.map
+//# sourceMappingURL=chunk-ATT276RD.cjs.map

package/dist/chunk-ATT276RD.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/compression/compression-helpers.ts","../src/compaction.ts"],"names":["TheokitAgentError","diag","redactSecrets"],"mappings":";;;;;;AA0BO,SAAS,uBAAA,CACd,QAAA,EACA,YAAA,GAAe,CAAA,EACO;AACtB,EAAA,IAAI,QAAA,CAAS,UAAU,YAAA,EAAc;AACnC,IAAA,OAAO,EAAE,YAAY,EAAC,EAAG,YAAY,CAAC,GAAG,QAAQ,CAAA,EAAE;AAAA,EACrD;AACA,EAAA,OAAO;AAAA,IACL,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,CAAC,YAAY,CAAA;AAAA,IAC3C,UAAA,EAAY,QAAA,CAAS,KAAA,CAAM,CAAC,YAAY;AAAA,GAC1C;AACF;;;ACOO,IAAM,iBAAA,GAAoB;AAQ1B,IAAM,gBAAA,GAAmB,CAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA,4CAAA;AAwBhC,SAAS,aAAa,MAAA,EAAsB;AAC1C,EAAA,IAAI,WAAW,EAAA,EAAI;AACjB,IAAA,MAAM,IAAIA,oCAAkB,qCAAA,EAAuC;AAAA,MACjE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AAGA,SAAS,cAAA,CAAe,SAA8B,MAAA,EAAyB;AAC7E,EAAA,OAAO,QAAQ,IAAA,KAAS,QAAA,IAAY,CAAC,OAAA,CAAQ,OAAA,CAAQ,WAAW,MAAM,CAAA;AACxE;AAcA,SAAS,mBAAA,CACP,UACA,UAAA,EACgE;AAChE,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,IAAI,aAAa,QAAA,CAAS,MAAA;AAC1B,EAAA,KAAA,IAAS,IAAI,QAAA,CAAS,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAChD,IAAA,GAAA,IAAO,cAAA,CAAe,QAAA,CAAS,CAAC,CAAA,EAAG,WAAW,EAAE,CAAA;AAChD,IAAA,IAAI,GAAA,GAAM,UAAA,IAAc,CAAA,GAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AAC/C,MAAA,UAAA,GAAa,CAAA,GAAI,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA,UAAA,GAAa,CAAA;AAAA,EACf;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA,EAAG,MAAA,EAAQ,QAAA,CAAS,KAAA,CAAM,UAAU,CAAA,EAAE;AACnF;AAGA,SAAS,aAAA,CACP,QAAA,EACA,UAAA,EACA,MAAA,EACiB;AACjB,EAAA,MAAM,aAAA,GAAgB,SAAS,MAAA,CAAO,CAAC,MAAM,cAAA,CAAe,CAAA,EAAG,MAAM,CAAC,CAAA;AACtE,EAAA,MAAM,IAAA,GAAO,SAAS,MAAA,CAAO,CAAC,MAAM,CAAC,cAAA,CAAe,CAAA,EAAG,MAAM,CAAC,CAAA;AAC9D,EAAA,MAAM,EAAE,UAAA,EAAY,UAAA,EAAW,GAAI,uBAAA,CAAwB,MAAM,UAAU,CAAA;AAC3E,EAAA,OAAO,EAAE,aAAA,EAAe,IAAA,EAAM,UAAA,EAAY,QAAQ,UAAA,EAAW;AAC/D;AAyBA,IAAM,cAAA,0BAAwB,gBAAgB,CAAA;AAG9C,eAAe,YAAA,CACb,SAAA,EACA,IAAA,EACA,QAAA,EACA,QAAA,EACsD;AACtD,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAA,CAAU,IAAA,EAAM,QAAQ,CAAA;AAAA,EACvC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,CAAC,UAAU,MAAM,GAAA;AAOrB,IAAAC,sBAAA;AAAA,MACE,CAAA,8DAAA,EAA4DC,gCAAc,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAC;AAAA;AAAA,KAC7H;AACA,IAAA,OAAO,cAAA;AAAA,EACT;AACF;AASA,eAAsB,iBAAA,CACpB,QAAA,EACA,OAAA,GAAoC,EAAC,EACL;AAChC,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,iBAAA;AACjC,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,MAAM,KAAA,GACJ,QAAQ,UAAA,IAAc,IAAA,GAClB,EAAE,aAAA,EAAe,IAAI,GAAG,mBAAA,CAAoB,UAAU,OAAA,CAAQ,UAAU,GAAE,GAC1E,aAAA,CAAc,UAAU,OAAA,CAAQ,UAAA,IAAc,GAAG,MAAM,CAAA;AAC7D,EAAA,IAAI,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG;AAC3B,IAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AAAA,EACrB;AACA,EAAA,IAAI,CAAC,QAAQ,SAAA,EAAW;AACtB,IAAA,OAAO,CAAC,GAAG,KAAA,CAAM,aAAA,EAAe,GAAG,MAAM,MAAM,CAAA;AAAA,EACjD;AACA,EAAA,MAAM,QAAA,GAAW,QAAQ,eAAA,IAAmB,gBAAA;AAC5C,EAAA,MAAM,UAAU,MAAM,YAAA;AAAA,IACpB,OAAA,CAAQ,SAAA;AAAA,IACR,KAAA,CAAM,IAAA;AAAA,IACN,QAAA;AAAA,IACA,QAAQ,QAAA,IAAY;AAAA,GACtB;AACA,EAAA,IAAI,YAAY,cAAA,EAAgB;AAC9B,IAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AAAA,EACrB;AACA,EAAA,OAAO,CAAC,GAAG,KAAA,CAAM,eAAe,OAAA,EAAS,GAAG,MAAM,MAAM,CAAA;AAC1D;AAMO,SAAS,eAAA,CACd,KAAA,EACA,MAAA,GAAiB,iBAAA,EACI;AACrB,EAAA,YAAA,CAAa,MAAM,CAAA;AACnB,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,MAAA,IAAU,SAAS,EAAA,CAAA,EAAI;AAC3D;AAkBO,SAAS,0BAAA,CACd,QAAA,EACA,OAAA,GAAmC,EAAC,EACb;AACvB,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,IAAU,iBAAA;AACjC,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,KAAY,MAAA,GAAS,CAAA,GAAI,CAAA;AAChD,EAAA,KAAA,IAAS,IAAI,QAAA,CAAS,MAAA,GAAS,GAAG,CAAA,IAAK,CAAA,EAAG,KAAK,CAAA,EAAG;AAChD,IAAA,IAAI,SAAS,CAAC,CAAA,EAAG,OAAA,CAAQ,UAAA,CAAW,MAAM,CAAA,EAAG;AAC3C,MAAA,OAAO,QAAA,CAAS,KAAA,CAAM,CAAA,GAAI,MAAM,CAAA;AAAA,IAClC;AAAA,EACF;AACA,EAAA,OAAO,CAAC,GAAG,QAAQ,CAAA;AACrB;AAQO,SAAS,uBAAuB,GAAA,EAAuB;AAC5D,EAAA,OACE,eAAeF,mCAAA,KACd,GAAA,CAAI,SAAS,kBAAA,IAAsB,GAAA,CAAI,UAAU,IAAA,KAAS,kBAAA,CAAA;AAE/D;AAOO,IAAM,wBAAA,GAAN,cAAuCA,mCAAA,CAAkB;AAAA,EAC9D,YAAqB,MAAA,EAAgB;AACnC,IAAA,KAAA;AAAA,MACE,CAAA,6CAAA,EAAgD,MAAA,CAAO,MAAM,CAAC,CAAA,sFAAA,CAAA;AAAA,MAE9D,EAAE,MAAM,+BAAA;AAAgC,KAC1C;AALmB,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAAA,EAMrB;AAAA,EANqB,MAAA;AAOvB;AAUO,IAAM,qBAAA,GAAwB;AAgB9B,IAAM,oBAAA,GAAuB;AAuC7B,IAAM,2BAAA,GAA8B;AAwBpC,SAAS,8BACd,KAAA,EACwB;AACxB,EAAA,IAAI,EAAE,KAAA,CAAM,MAAA,GAAS,CAAA,CAAA,IAAM,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3C,IAAA,MAAM,IAAI,wBAAA,CAAyB,KAAA,CAAM,MAAM,CAAA;AAAA,EACjD;AAEA,EAAA,MAAM,aAAa,CAAC,GAAA,KAAwB,KAAK,KAAA,CAAM,GAAA,GAAM,MAAM,MAAM,CAAA;AAEzE,EAAA,IAAI,KAAA,CAAM,aAAa,MAAA,EAAW;AAYhC,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,IAAW,2BAAA;AAC7B,IAAA,MAAM,OAAA,GAAU,MAAM,QAAA,GAAW,GAAA;AACjC,IAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,CAAW,OAAA,GAAU,GAAA,GAAM,MAAM,QAAQ,CAAA,EAAG,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,EAC3F;AAEA,EAAA,IAAI,KAAA,CAAM,YAAY,MAAA,EAAW;AAC/B,IAAA,OAAO,EAAE,QAAQ,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA,EAAG,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,KAAA,EAAM;AAAA,EAChF;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,CAAW,KAAA,CAAM,KAAA,IAAS,CAAC,CAAA,EAAG,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAS,KAAA,EAAM;AACpF;AA4BO,IAAM,eAAA,GAAkB;AAYxB,SAAS,eAAe,IAAA,EAAsB;AACnD,EAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,CAAK,MAAA,GAAS,eAAe,CAAA;AAChD;AAUO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,MAAM,SAAA,IAAa,KAAA,CAAM,gBAAgB,KAAA,CAAM,MAAA,IAAU,MAAM,SAAA,IAAa,CAAA,CAAA;AACrF","file":"chunk-ATT276RD.cjs","sourcesContent":["/**\n * Compression helpers (T2.3, ADR D92).\n *\n * Scaffold for future compression LLM integration:\n *   - `selectCompressionWindow` — splits messages into compress/preserve halves\n *   - `assertCompressionReduced` — 10% reduction floor to detect \"compression placebo\"\n *\n * The compression LLM call itself is out of scope for this plan (requires\n * an auxiliary-model ADR). These helpers are used by `Agent.send` when a\n * future iteration adds compression.\n *\n * @internal\n */\n\nexport interface CompressionWindow<M> {\n  toCompress: M[];\n  toPreserve: M[];\n}\n\n/**\n * Split `messages` into the half to compress (older) and the half to\n * preserve verbatim (recent). When `messages.length <= preserveLast`,\n * everything is preserved.\n *\n * @internal\n */\nexport function selectCompressionWindow<M>(\n  messages: readonly M[],\n  preserveLast = 6,\n): CompressionWindow<M> {\n  if (messages.length <= preserveLast) {\n    return { toCompress: [], toPreserve: [...messages] };\n  }\n  return {\n    toCompress: messages.slice(0, -preserveLast),\n    toPreserve: messages.slice(-preserveLast),\n  };\n}\n\nexport interface CompressionCheck {\n  reduced: boolean;\n  reductionPct: number;\n  reason?: string;\n}\n\n/**\n * Check that compression actually reduced token count by at least `minPct`\n * (default 10%). Returns `{ reduced: false }` for spirals-in-formation\n * (compression LLM outputs that grow or barely shrink).\n *\n * @internal\n */\nexport function assertCompressionReduced(\n  before: number,\n  after: number,\n  minPct = 10,\n): CompressionCheck {\n  if (before <= 0) {\n    return { reduced: false, reductionPct: 0, reason: \"before count was zero\" };\n  }\n  const reductionPct = ((before - after) / before) * 100;\n  if (reductionPct >= minPct) {\n    return { reduced: true, reductionPct };\n  }\n  return {\n    reduced: false,\n    reductionPct,\n    reason: `compression reduced ${reductionPct.toFixed(1)}% (< ${minPct}% min). Spiral likely.`,\n  };\n}\n","/**\n * Public compaction / context-management helpers (M2-1, extended V3-3).\n *\n * Promotes the SDK's compaction capability to a public surface so consumers can\n * compact a transcript, mark/filter conversation checkpoints, and detect\n * context-overflow — without reaching into `internal/`.\n *\n * Two recent-window modes (V3-3):\n *  - `keepRecent` (turn-count, default) — keeps the last N turns verbatim and\n *    always preserves leading system PROMPTS; reuses the internal\n *    `selectCompressionWindow` (no second algorithm).\n *  - `keepTokens` (token-budget) — keeps the trailing turns whose accumulated\n *    `estimateTokens` fits the budget (theocode `splitTranscript` semantics). In\n *    this mode leading system prompts are NOT special-cased (D6).\n *\n * Summarization is delegated to a caller-supplied callback (which receives the\n * older window + the summary template). With `failSafe`, a thrown summarizer\n * returns the ORIGINAL transcript + a structured warn (compaction is an\n * optimization, never a cause of data loss); without it, the error propagates.\n *\n * Public from the `@theokit/sdk/compaction` sub-path.\n */\n\nimport { TheokitAgentError } from \"./errors.js\";\nimport { diag } from \"./internal/diagnostics.js\";\nimport { selectCompressionWindow } from \"./internal/runtime/compression/compression-helpers.js\";\nimport { redactSecrets } from \"./internal/security/redact.js\";\n\n/**\n * Minimal message shape for compaction/compression input. THE canonical public origin (leaf type —\n * rollup-plugin-dts cannot re-export types from internal modules into entry bundles; M42 lesson).\n *\n * @public\n */\nexport interface CompressibleMessage {\n  role: \"user\" | \"assistant\" | \"system\";\n  content: string;\n}\n\n/**\n * Sentinel prefix marking a conversation checkpoint turn. A visible, structured,\n * prose-unlikely token (no invisible/control bytes — safe to persist and to read\n * in source). Only {@link buildCheckpoint} should produce content beginning with it.\n */\nexport const CHECKPOINT_MARKER = \"[[theokit:checkpoint]] \";\n\n/**\n * The 7-section summary template handed to the `summarize` callback (theocode\n * parity shape). Every header is always present so the summarizer cannot silently\n * drop a category; the model is told to preserve file paths, commands, and error\n * text verbatim. Override per-call via {@link CompactTranscriptOptions.summaryTemplate}.\n */\nexport const SUMMARY_TEMPLATE = `Summarize the conversation so far into these sections (keep every header even if empty):\n\n## Goal\nWhat the user is ultimately trying to achieve.\n\n## Constraints\nHard requirements, conventions, and rules stated.\n\n## Progress\nWhat has been done so far.\n\n## Decisions\nChoices made and their rationale.\n\n## Next\nThe immediate next steps.\n\n## Critical\nAnything that MUST NOT be forgotten (preserve verbatim: error messages, exact values).\n\n## Files\nFile paths touched or referenced (verbatim).`;\n\n/** Reject an empty marker — it would match every turn via `startsWith(\"\")` (EC-3). */\nfunction assertMarker(marker: string): void {\n  if (marker === \"\") {\n    throw new TheokitAgentError(\"compaction marker must be non-empty\", {\n      code: \"invalid_argument\",\n    });\n  }\n}\n\n/** True for a real system prompt — a `system` turn that is NOT a checkpoint marker. */\nfunction isSystemPrompt(message: CompressibleMessage, marker: string): boolean {\n  return message.role === \"system\" && !message.content.startsWith(marker);\n}\n\n/** Carried split: leading system prompts (preserved), the older window, the verbatim tail. */\ninterface TranscriptSplit {\n  systemPrompts: CompressibleMessage[];\n  head: CompressibleMessage[];\n  recent: CompressibleMessage[];\n}\n\n/**\n * Token-budget split (theocode `splitTranscript`): walk from the END accumulating\n * `estimateTokens` until `keepTokens` is exceeded; everything older is the head.\n * Always keeps ≥ 1 recent turn. No system-prompt special-casing (D6).\n */\nfunction selectByTokenBudget(\n  messages: CompressibleMessage[],\n  keepTokens: number,\n): { head: CompressibleMessage[]; recent: CompressibleMessage[] } {\n  let acc = 0;\n  let splitIndex = messages.length;\n  for (let i = messages.length - 1; i >= 0; i -= 1) {\n    acc += estimateTokens(messages[i]?.content ?? \"\");\n    if (acc > keepTokens && i < messages.length - 1) {\n      splitIndex = i + 1;\n      break;\n    }\n    splitIndex = i;\n  }\n  return { head: messages.slice(0, splitIndex), recent: messages.slice(splitIndex) };\n}\n\n/** Turn-count split (M2): preserve leading system prompts; window the rest by `keepRecent`. */\nfunction splitByRecent(\n  messages: CompressibleMessage[],\n  keepRecent: number,\n  marker: string,\n): TranscriptSplit {\n  const systemPrompts = messages.filter((m) => isSystemPrompt(m, marker));\n  const rest = messages.filter((m) => !isSystemPrompt(m, marker));\n  const { toCompress, toPreserve } = selectCompressionWindow(rest, keepRecent);\n  return { systemPrompts, head: toCompress, recent: toPreserve };\n}\n\n/** Options for {@link compactTranscript}. */\nexport interface CompactTranscriptOptions {\n  /** Trailing turns preserved verbatim by COUNT (default 6). Ignored when `keepTokens` is set. */\n  keepRecent?: number;\n  /**\n   * Trailing turns preserved verbatim by TOKEN BUDGET (theocode mode). When set,\n   * takes precedence over `keepRecent` and disables system-prompt preservation (D6).\n   */\n  keepTokens?: number;\n  /** Checkpoint marker (default {@link CHECKPOINT_MARKER}). Must be non-empty. */\n  marker?: string;\n  /** Summary template passed to `summarize` (default {@link SUMMARY_TEMPLATE}). */\n  summaryTemplate?: string;\n  /** Summarize the older window into one turn; if omitted, the older window is dropped. */\n  summarize?: (older: CompressibleMessage[], template: string) => Promise<CompressibleMessage>;\n  /**\n   * When true, a thrown `summarize` returns the ORIGINAL transcript + a structured\n   * warn (compaction never loses data). Default false: the error propagates.\n   */\n  failSafe?: boolean;\n}\n\n/** Sentinel returned by {@link runSummarize} when fail-safe swallowed a throw. */\nconst FAILSAFE_ABORT = Symbol(\"failsafe-abort\");\n\n/** Run the summarizer; on throw, either propagate or (fail-safe) warn + signal abort. */\nasync function runSummarize(\n  summarize: NonNullable<CompactTranscriptOptions[\"summarize\"]>,\n  head: CompressibleMessage[],\n  template: string,\n  failSafe: boolean,\n): Promise<CompressibleMessage | typeof FAILSAFE_ABORT> {\n  try {\n    return await summarize(head, template);\n  } catch (err) {\n    if (!failSafe) throw err;\n    // Unbreakable Rule 8 — never fail silently. The breadcrumb points at the root\n    // cause when a summarizer fails every turn and context grows unchecked. The\n    // summarizer is caller-supplied, so its error text is routed through\n    // `redactSecrets` (ADR D68 — no unredacted output sink in src/).\n    // theokit#147 — through the interceptable channel. A summarizer failing every turn is exactly\n    // the breadcrumb a TUI host wants in its own panel, not smeared across its alternate screen.\n    diag(\n      `[compaction] summarizer failed — proceeding uncompacted: ${redactSecrets(err instanceof Error ? err.message : String(err))}\\n`,\n    );\n    return FAILSAFE_ABORT;\n  }\n}\n\n/**\n * Compact a transcript. In `keepRecent` mode (default) the last `keepRecent` turns\n * are kept verbatim and leading system PROMPTS preserved; in `keepTokens` mode the\n * trailing turns within the token budget are kept (no system special-casing, D6).\n * The older window is summarized (via `summarize`, receiving the template) or\n * dropped. Never mutates the input.\n */\nexport async function compactTranscript(\n  messages: CompressibleMessage[],\n  options: CompactTranscriptOptions = {},\n): Promise<CompressibleMessage[]> {\n  const marker = options.marker ?? CHECKPOINT_MARKER;\n  assertMarker(marker);\n  const split =\n    options.keepTokens != null\n      ? { systemPrompts: [], ...selectByTokenBudget(messages, options.keepTokens) }\n      : splitByRecent(messages, options.keepRecent ?? 6, marker);\n  if (split.head.length === 0) {\n    return [...messages];\n  }\n  if (!options.summarize) {\n    return [...split.systemPrompts, ...split.recent];\n  }\n  const template = options.summaryTemplate ?? SUMMARY_TEMPLATE;\n  const summary = await runSummarize(\n    options.summarize,\n    split.head,\n    template,\n    options.failSafe ?? false,\n  );\n  if (summary === FAILSAFE_ABORT) {\n    return [...messages];\n  }\n  return [...split.systemPrompts, summary, ...split.recent];\n}\n\n/**\n * Build a checkpoint marker turn (a `system` turn whose content starts with\n * `marker`, default {@link CHECKPOINT_MARKER}). `marker` must be non-empty.\n */\nexport function buildCheckpoint(\n  label?: string,\n  marker: string = CHECKPOINT_MARKER,\n): CompressibleMessage {\n  assertMarker(marker);\n  return { role: \"system\", content: marker + (label ?? \"\") };\n}\n\n/** Options for {@link filterFromLatestCheckpoint}. */\nexport interface FilterCheckpointOptions {\n  /** Marker to scan for (default {@link CHECKPOINT_MARKER}). */\n  marker?: string;\n  /**\n   * `'after'` (default, M2) returns turns AFTER the latest marker (exclusive);\n   * `'from'` (theocode) returns turns FROM the latest marker (inclusive).\n   */\n  include?: \"after\" | \"from\";\n}\n\n/**\n * Return the turns relative to the most recent checkpoint marker (all turns if\n * none). `include: 'after'` (default) excludes the checkpoint; `'from'` includes\n * it (the summary stands in for the pruned head). Never mutates the input.\n */\nexport function filterFromLatestCheckpoint(\n  messages: CompressibleMessage[],\n  options: FilterCheckpointOptions = {},\n): CompressibleMessage[] {\n  const marker = options.marker ?? CHECKPOINT_MARKER;\n  const offset = options.include === \"from\" ? 0 : 1;\n  for (let i = messages.length - 1; i >= 0; i -= 1) {\n    if (messages[i]?.content.startsWith(marker)) {\n      return messages.slice(i + offset);\n    }\n  }\n  return [...messages];\n}\n\n/**\n * True iff `err` is a {@link TheokitAgentError} (or subclass) reporting a\n * context-window-exceeded condition (the typed `context_too_long` code). Reads\n * both `code` (set by provider mappers) and `metadata.code` (the preferred field)\n * — never a brittle message regex.\n */\nexport function isContextOverflowError(err: unknown): boolean {\n  return (\n    err instanceof TheokitAgentError &&\n    (err.code === \"context_too_long\" || err.metadata?.code === \"context_too_long\")\n  );\n}\n\n/**\n * M77 — the margin is outside `(0, 1]`. Typed, because a margin > 1 would GROW the assumed window,\n * which is the unsafe direction: `shouldCompact` is monotonically decreasing in `contextWindow`, so\n * overestimating it makes the trigger fire too late and the context overflow.\n */\nexport class ContextWindowMarginError extends TheokitAgentError {\n  constructor(readonly margin: number) {\n    super(\n      `context-window margin must be in (0, 1], got ${String(margin)}. ` +\n        `A margin above 1 grows the assumed window and delays compaction past the real limit.`,\n      { code: \"invalid_context_window_margin\" },\n    );\n  }\n}\n\n/**\n * M77 — default safety margin on the context window.\n *\n * `0.95` is not a guess: it is the single reference's value. Codex ships\n * `effective_context_window_percent: 95` (`models-manager/src/model_info.rs:158`) and never budgets\n * against 100% of a window. Being MULTIPLICATIVE, it stays conservative at any window size, which a\n * fixed subtraction would not.\n */\nexport const CONTEXT_WINDOW_MARGIN = 0.95;\n\n/**\n * M77 — the floor used ONLY when neither the catalog nor the caller knows the window.\n *\n * Honest about its own weakness. This number has **one** source (the M77 milestone text); the search\n * for a second one failed, because the reference has no fallback at all — Codex returns `Option` and\n * its callers early-return (`core/src/session/turn_context.rs:213`, `core/src/compact_remote.rs:374`).\n *\n * It is conservative only UPWARD. For a model whose real window is larger, budgeting against 128k\n * compacts early — wasteful but safe. For a model whose real window is SMALLER (an 8k or 32k model\n * absent from the catalog), it compacts too late and the context still overflows. That residual risk\n * is real and is why {@link resolveEffectiveContextWindow} never lets this floor compete with a known\n * catalog value, and why the `compaction_fallback` event exists: a surface can show that the budget is\n * a guess instead of the user finding out when the provider rejects the request.\n */\nexport const CONTEXT_WINDOW_FLOOR = 128_000;\n\n/** Where the effective window came from — carried into the M77 structured event. */\nexport type ContextWindowSource = \"override\" | \"catalog\" | \"fallback\";\n\n/** Input to {@link resolveEffectiveContextWindow}. */\nexport interface EffectiveContextWindowInput {\n  /** Caller-supplied window, in tokens. Clamped by `catalog` when both are present. */\n  readonly override?: number | undefined;\n  /** The model's window from the catalog, in tokens. Absent when the model is unknown. */\n  readonly catalog?: number | undefined;\n  /** Safety margin in `(0, 1]`. Codex uses 0.95 (`model_info.rs:158`). */\n  readonly margin: number;\n  /** Conservative floor used ONLY when neither `override` nor `catalog` is available. */\n  readonly floor?: number | undefined;\n}\n\n/** Result of {@link resolveEffectiveContextWindow}. */\nexport interface EffectiveContextWindow {\n  /** The window to budget against, after clamp and margin. */\n  readonly window: number;\n  /** Which input won — `\"fallback\"` means neither override nor catalog was available. */\n  readonly source: ContextWindowSource;\n  /** `true` when an `override` above the catalog window was clamped down to it. */\n  readonly clamped: boolean;\n}\n\n/**\n * Absolute cap on a declared context window, applied when no catalog entry exists to compare against.\n *\n * **10M**, not 2M. The first version used 2M on the rationale that it sat \"comfortably above the\n * largest published window\" — adversarial review measured the opposite: Llama 4 Scout publishes\n * **10M**, and it arrives precisely via OpenRouter, the provider **without** a catalog, which is the\n * case this cap exists to cover. The user would have silently lost 80% of the declared window.\n *\n * The cap still serves what motivates it — one extra zero on 400k gives 4M, which passes; two zeros\n * give 40M, which does not. A limit that rejects legitimate configuration is worse than no limit,\n * because failing OPEN is visible when it happens and silently losing 80% is not.\n */\nexport const ABSOLUTE_CONTEXT_WINDOW_CAP = 10_000_000;\n\n/**\n * Resolve the window to budget against — the fail-SAFE replacement for reading the catalog directly.\n *\n * Today `post-run-lifecycle.ts` reads `getCatalogModelInfo(model)?.limit?.context` and, when that is\n * `undefined`, auto-compaction simply never fires. That is fail-OPEN: the context grows until the\n * provider rejects the request. (The comment there calls it \"fail-safe\" — M77 corrects it.)\n *\n * Three techniques, two of them borrowed from the single reference:\n *\n *  1. **Override, CLAMPED by the catalog** — Codex `models-manager/src/model_info.rs:26-31` lets\n *     config override the window but limits it with `context_window.min(max_context_window)`.\n *     Without the clamp, declaring 999k on a 200k model reopens the overflow through another door.\n *  2. **Multiplicative margin** — Codex `model_info.rs:158` (`effective_context_window_percent: 95`)\n *     never budgets against 100% of the window. Being multiplicative, it is conservative for ANY\n *     window size.\n *  3. **Floor, only when nothing is known** — deliberately NOT a blanket default. A fixed floor is\n *     conservative only upward: applied to a small model it would inflate the assumed window and\n *     reproduce the very fail-open this function exists to close. Hence the floor never competes\n *     with a known catalog value.\n *\n * Pure — no catalog lookup, no I/O. The caller supplies the numbers, mirroring `shouldCompact`.\n */\nexport function resolveEffectiveContextWindow(\n  input: EffectiveContextWindowInput,\n): EffectiveContextWindow {\n  if (!(input.margin > 0) || input.margin > 1) {\n    throw new ContextWindowMarginError(input.margin);\n  }\n\n  const withMargin = (raw: number): number => Math.floor(raw * input.margin);\n\n  if (input.override !== undefined) {\n    // The catalog is the preferred cap; without it the ABSOLUTE cap applies.\n    //\n    // M95 (adversarial review of M94) — the previous version clamped **only** when a catalog entry\n    // existed, and the whole reason the `contextWindow` key exists is the model that has NO entry\n    // (OpenRouter has zero). So the clamp was missing in exactly the case that justifies the\n    // feature, while the documentation — including an already-published CHANGELOG — stated without\n    // qualification that \"declaring 10M does not blow past the provider\".\n    //\n    // The concrete scenario is one extra zero: `context_window = 4000000`. The only guard was a\n    // `.positive().int()`, which sets no upper bound. The agent would never compact until the\n    // provider refused the turn — the silent fail-OPEN that M77 exists to prevent.\n    const cap = input.catalog ?? ABSOLUTE_CONTEXT_WINDOW_CAP;\n    const clamped = input.override > cap;\n    return { window: withMargin(clamped ? cap : input.override), source: \"override\", clamped };\n  }\n\n  if (input.catalog !== undefined) {\n    return { window: withMargin(input.catalog), source: \"catalog\", clamped: false };\n  }\n\n  return { window: withMargin(input.floor ?? 0), source: \"fallback\", clamped: false };\n}\n\n/** Input to {@link shouldCompact}: an estimate, the model's window, and reserved headroom. */\nexport interface ShouldCompactInput {\n  /** Estimated token count of the next request (e.g. from {@link estimateTokens}). */\n  readonly estimated: number;\n  /** The model's total context window, in tokens. */\n  readonly contextWindow: number;\n  /** Tokens to reserve as headroom (output + safety margin). */\n  readonly buffer: number;\n  /**\n   * Tokens reserved for the model's response generation, SEPARATE from `buffer`.\n   * Default 0 — omitting it preserves the legacy\n   * `estimated >= contextWindow - buffer` result.\n   */\n  readonly maxOutput?: number;\n}\n\n/**\n * Characters per token in the tokenizer-free estimate below.\n *\n * Exported so the ratio has ONE owner. It used to be a named constant in `built-in-processors.ts`\n * and an inlined `4` here, with both `estimateTokens` functions `@public` from two different package\n * entry points — so tuning the ratio, or switching to code points instead of UTF-16 units (the\n * caveat both docblocks already carried), would have silently diverged them.\n *\n * @public\n */\nexport const CHARS_PER_TOKEN = 4;\n\n/**\n * Tokenizer-free token estimate via the conventional ~4-chars-per-token\n * heuristic: `ceil(text.length / CHARS_PER_TOKEN)`. `\"\"` → 0; any non-empty text → ≥ 1.\n * A cheap PRE-CALL gate for {@link shouldCompact} — NOT exact tokenization\n * (a consumer needing exactness supplies their own tokenizer). Uses UTF-16\n * `.length` (code units), so multibyte text is approximate.\n *\n * `built-in-processors.ts` re-exports this under the same name, so both entry points keep working\n * and there is one implementation behind them.\n */\nexport function estimateTokens(text: string): number {\n  return Math.ceil(text.length / CHARS_PER_TOKEN);\n}\n\n/**\n * Decide BEFORE sending whether to compact: `true` when the `estimated` token\n * count leaves less than `buffer` headroom in the `contextWindow`\n * (`estimated >= contextWindow - buffer`). A `buffer >= contextWindow`\n * (non-positive threshold) always returns `true`. Pure — the caller supplies\n * the window (e.g. from `resolveModelCapabilities`), keeping this decoupled\n * from the per-model catalog.\n */\nexport function shouldCompact(input: ShouldCompactInput): boolean {\n  return input.estimated >= input.contextWindow - input.buffer - (input.maxOutput ?? 0);\n}\n"]}

package/dist/{chunk-4FFBAUFS.js → chunk-AWINL3ZC.js}

@@ -1,6 +1,6 @@
-import { sessions, transcriptKey, hydratedKeys } from './chunk-WTMU7J4U.js';
-import { persistTurn, readSessionMessages } from './chunk-N2U4AZGB.js';
-import { diag } from './chunk-XEQ3TM66.js';
+import { sessions, transcriptKey, hydratedKeys } from './chunk-2XC6KDJM.js';
+import { persistTurn, readSessionMessages } from './chunk-2WXHA33T.js';
+import { diag } from './chunk-CZJ6Q7CW.js';
 
 // src/internal/session/agent-session.ts
 var pendingWrites = /* @__PURE__ */ new Map();
@@ -46,7 +46,7 @@ function persistTurnToTranscript(store, loc, sessionId, turn, onCompact) {
       const count = (recordCounts.get(key) ?? 0) + 1;
       recordCounts.set(key, count);
       if (turn.autoCompact !== void 0) {
-        const { autoCompactIfNeeded } = await import('./compact-session-RIGOWC4Y.js');
+        const { autoCompactIfNeeded } = await import('./compact-session-W4WLJTHA.js');
         const fired = await autoCompactIfNeeded({
           store,
           loc,
@@ -105,5 +105,5 @@ function enqueueSessionWrite(cwd, agentId, fn) {
 }
 
 export { appendSessionMessage, clearSession, discardSession, enqueueSessionWrite, flushSessionWrites, getSessionMessages, hydrateSession, persistTurnToTranscript };
-//# sourceMappingURL=chunk-4FFBAUFS.js.map
-//# sourceMappingURL=chunk-4FFBAUFS.js.map
+//# sourceMappingURL=chunk-AWINL3ZC.js.map
+//# sourceMappingURL=chunk-AWINL3ZC.js.map

package/dist/chunk-AWINL3ZC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/session/agent-session.ts"],"names":[],"mappings":";;;;;AAyCA,IAAM,aAAA,uBAAoB,GAAA,EAA2B;AACrD,IAAM,YAAA,uBAAmB,GAAA,EAAoB;AAStC,SAAS,oBAAA,CAAqB,SAAiB,OAAA,EAA+B;AACnF,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,GAAA,CAAI,OAAO,KAAK,EAAC;AAC3C,EAAA,QAAA,CAAS,KAAK,OAAO,CAAA;AAIrB,EAAA,QAAA,CAAS,OAAO,OAAO,CAAA;AACvB,EAAA,QAAA,CAAS,GAAA,CAAI,SAAS,QAAQ,CAAA;AAC9B,EAAA,cAAA,EAAe;AACjB;AAWO,IAAM,mBAAA,GAAsB,EAAA;AAEnC,SAAS,cAAA,GAAuB;AAC9B,EAAA,OAAO,QAAA,CAAS,OAAO,mBAAA,EAAqB;AAC1C,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AACtC,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,QAAA,CAAS,OAAO,MAAM,CAAA;AACtB,IAAA,iBAAA,CAAkB,MAAM,CAAA;AAAA,EAC1B;AACF;AAeA,SAAS,kBAAkB,OAAA,EAAuB;AAChD,EAAA,MAAM,MAAA,GAAS,cAAc,EAAA,EAAI,OAAO,EAAE,KAAA,CAAM,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,CAAC,CAAA;AACtE,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,GAAG,YAAY,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,EAAG,YAAA,CAAa,MAAA,CAAO,CAAC,CAAA;AAChF,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,GAAG,aAAA,CAAc,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,EAAG,aAAA,CAAc,OAAO,CAAC,CAAA;AACzF,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,GAAG,YAAA,CAAa,MAAM,CAAA,EAAG,IAAI,CAAA,CAAE,QAAA,CAAS,MAAM,CAAA,EAAG,YAAA,CAAa,OAAO,CAAC,CAAA;AACzF;AAaO,SAAS,cAAA,CAAe,KAAa,OAAA,EAAyB;AACnE,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,IAAI,OAAA,GAAU,CAAA;AAUd,EAAA,IAAI,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA,EAAG,OAAA,EAAA;AAC9B,EAAA,IAAI,aAAA,CAAc,MAAA,CAAO,GAAG,CAAA,EAAG,OAAA,EAAA;AAC/B,EAAA,IAAI,YAAA,CAAa,MAAA,CAAO,GAAG,CAAA,EAAG,OAAA,EAAA;AAC9B,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,mBAAmB,OAAA,EAAmC;AACpE,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,OAAO,CAAA,IAAK,EAAC;AACnC;AAWO,SAAS,uBAAA,CACd,KAAA,EACA,GAAA,EACA,SAAA,EACA,MACA,SAAA,EACM;AACN,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,GAAA,EAAK,IAAI,OAAO,CAAA;AAM9C,EAAA,MAAM,OAAA,GAAA,CAAW,cAAc,GAAA,CAAI,GAAG,KAAK,OAAA,CAAQ,OAAA,EAAQ,EAAG,IAAA,CAAK,YAAY;AAC7E,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,CAAY,KAAA,EAAO,GAAA,EAAK,SAAA,EAAW,IAAI,CAAA;AAC7C,MAAA,MAAM,KAAA,GAAA,CAAS,YAAA,CAAa,GAAA,CAAI,GAAG,KAAK,CAAA,IAAK,CAAA;AAC7C,MAAA,YAAA,CAAa,GAAA,CAAI,KAAK,KAAK,CAAA;AAI3B,MAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,CAAA,EAAW;AAClC,QAAA,MAAM,EAAE,mBAAA,EAAoB,GAAI,MAAM,OAAO,+BAAsB,CAAA;AACnE,QAAA,MAAM,KAAA,GAAQ,MAAM,mBAAA,CAAoB;AAAA,UACtC,KAAA;AAAA,UACA,GAAA;AAAA,UACA,SAAA;AAAA,UACA,UAAA,EAAY,KAAK,WAAA,CAAY,UAAA;AAAA,UAC7B,aAAA,EAAe,KAAK,WAAA,CAAY,aAAA;AAAA,UAChC,SAAA,EAAW,KAAA;AAAA,UACX,SAAA,EAAW,KAAK,WAAA,CAAY;AAAA,SAC7B,CAAA;AACD,QAAA,IAAI,OAAO,SAAA,IAAY;AAAA,MACzB;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,MAAM,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACjE,MAAA,IAAA,CAAK,CAAA,+CAAA,EAAkD,GAAA,CAAI,OAAO,CAAA,GAAA,EAAM,GAAG;AAAA,CAAI,CAAA;AAAA,IACjF;AAAA,EACF,CAAC,CAAA;AACD,EAAA,aAAA,CAAc,GAAA;AAAA,IACZ,GAAA;AAAA,IACA,OAAA,CAAQ,IAAA;AAAA,MACN,MAAM,MAAA;AAAA,MACN,MAAM;AAAA;AACR,GACF;AACF;AAQA,eAAsB,cAAA,CACpB,SACA,GAAA,EACe;AACf,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAC1C,EAAA,IAAI,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA,EAAG;AAC3B,EAAA,YAAA,CAAa,IAAI,GAAG,CAAA;AAEpB,EAAA,MAAM,SAAA,GAAY,MAAM,mBAAA,CAAoB,GAAA,CAAI,OAAO,OAAO,CAAA;AAC9D,EAAA,IAAI,SAAA,CAAU,WAAW,CAAA,EAAG;AAM5B,EAAA,QAAA,CAAS,GAAA,CAAI,SAAS,SAAS,CAAA;AACjC;AAQA,eAAsB,kBAAA,GAAoC;AACxD,EAAA,OAAO,aAAA,CAAc,OAAO,CAAA,EAAG;AAC7B,IAAA,MAAM,GAAA,GAAM,KAAA,CAAM,IAAA,CAAK,aAAA,CAAc,QAAQ,CAAA;AAC7C,IAAA,aAAA,CAAc,KAAA,EAAM;AACpB,IAAA,MAAM,OAAA,CAAQ,IAAI,GAAG,CAAA;AAAA,EACvB;AACF;AAkBO,SAAS,aAAa,OAAA,EAAuB;AAClD,EAAA,QAAA,CAAS,OAAO,OAAO,CAAA;AACzB;AAOO,SAAS,mBAAA,CACd,GAAA,EACA,OAAA,EACA,EAAA,EACY;AACZ,EAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,EAAK,OAAO,CAAA;AACtC,EAAA,MAAM,QAAQ,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,IAAK,QAAQ,OAAA,EAAQ;AACxD,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA;AAC5B,EAAA,aAAA,CAAc,GAAA;AAAA,IACZ,GAAA;AAAA,IACA,MAAA,CAAO,IAAA;AAAA,MACL,MAAM,MAAA;AAAA,MACN,MAAM;AAAA;AACR,GACF;AACA,EAAA,OAAO,MAAA;AACT","file":"chunk-AWINL3ZC.js","sourcesContent":["import type { SessionStore } from \"../../types/session-store.js\";\nimport {\n  type PersistTurnInput,\n  persistTurn,\n  readSessionMessages,\n  type TranscriptLocation,\n} from \"./agent-session-store.js\";\n\n/**\n * Per-agent conversation history kept across runs (and across `Agent.resume()`\n * within the same process). Lets the fixture responder recall prior facts when\n * the user asks a follow-up question.\n *\n * SE40 — disk persistence IS the native Claude-shaped `.jsonl` transcript. The\n * in-memory cache holds the narrowed `SessionMessage[]` (user/assistant text) so\n * a send can read `priorMessages` synchronously; the whole rich turn (user +\n * assistant + tool blocks) lands on disk once per send via {@link persistTurnToTranscript}\n * (fed by `run.conversation()`). Hydration on resume reconstructs the session by\n * walking the transcript DAG (`readSessionMessages`).\n *\n * @internal\n */\n\n// `SessionMessage` lives in `./session-types.ts` (leaf types file). Re-exported\n// for back-compat with downstream importers that pulled it from here.\nexport type { SessionMessage } from \"./types.js\";\n\nimport type { SessionMessage } from \"./types.js\";\n\n// M75 — the cache lives in a leaf; see session-cache.ts for the reason (cycle broken by extraction).\nexport {\n  hydratedKeys,\n  invalidateSessionCache,\n  sessions,\n  transcriptKey,\n} from \"./session-cache.js\";\n\nimport { diag } from \"../diagnostics.js\";\nimport { globalSingleton } from \"../global-singleton.js\";\nimport { hydratedKeys, sessions, transcriptKey } from \"./session-cache.js\";\n\nconst pendingWrites = new Map<string, Promise<void>>();\nconst recordCounts = new Map<string, number>();\n\n/**\n * Append a session message to the in-memory cache only. Disk persistence for the\n * whole turn happens once per send via {@link persistTurnToTranscript}; the cache\n * feeds `priorMessages` / `onBeforeSend.previousMessageCount` synchronously.\n *\n * @internal\n */\nexport function appendSessionMessage(agentId: string, message: SessionMessage): void {\n  const existing = sessions.get(agentId) ?? [];\n  existing.push(message);\n  // `delete` + `set` reinserts at the END: a JS `Map` preserves insertion order, so the first key\n  // is always the least recently touched. That is the entire LRU, with no new structure (parsimony\n  // rungs 2/5 — the ordering we need is already a language guarantee).\n  sessions.delete(agentId);\n  sessions.set(agentId, existing);\n  enforceCeiling();\n}\n\n/**\n * Ceiling on sessions kept in memory.\n *\n * The runtime only reads the **active** session; the rest is pure cache, rebuildable from the\n * on-disk transcript. 32 is deliberately generous — the primary removal path is the explicit\n * `discardSession()` at the end of the agent's life, and this ceiling is a safety net against a\n * long-lived process running hundreds of sessions (plan risk #2: a tight ceiling could evict a\n * session still referenced by an in-flight async path).\n */\nexport const MAX_CACHED_SESSIONS = 32;\n\nfunction enforceCeiling(): void {\n  while (sessions.size > MAX_CACHED_SESSIONS) {\n    const oldest = sessions.keys().next().value;\n    if (oldest === undefined) return;\n    sessions.delete(oldest);\n    forgetBookkeeping(oldest);\n  }\n}\n\n/**\n * Erases the bookkeeping for an `agentId` across EVERY `cwd` it appears in.\n *\n * The three maps are keyed by `transcriptKey(cwd, agentId)`; `sessions` is the only one keyed by the\n * raw `agentId`. The ceiling's first version deleted from all three using `sessions`' key — that is,\n * deleted nothing — and left `hydratedKeys` **orphaned**. Since `hydrateSession` returns early when\n * the marker is present, an evicted session came back **empty** instead of rehydrating from disk:\n * silent amnesia, and a regression new to M95, because before it nothing evicted.\n *\n * The ceiling only knows the `agentId`, not the `cwd`, so it scans by suffix — which is the format\n * `transcriptKey` produces. A scan rather than an index because these maps hold tens of entries, not\n * thousands: a reverse index here would be new structure for a problem that does not exist.\n */\nfunction forgetBookkeeping(agentId: string): void {\n  const suffix = transcriptKey(\"\", agentId).slice(0 - agentId.length - 2);\n  for (const k of [...hydratedKeys]) if (k.endsWith(suffix)) hydratedKeys.delete(k);\n  for (const k of [...pendingWrites.keys()]) if (k.endsWith(suffix)) pendingWrites.delete(k);\n  for (const k of [...recordCounts.keys()]) if (k.endsWith(suffix)) recordCounts.delete(k);\n}\n\n/**\n * Erases the agent's module bookkeeping and returns how many entries were removed.\n *\n * M95 — `invalidateSessionCache` used to clear **two** of the four maps (`sessions`, `hydratedKeys`);\n * `pendingWrites` and `recordCounts` were never touched by id, so they grew for the life of the\n * process. Neither is large per entry — the leak is in count, not volume — but a cache with no owner\n * for removal is a cache that only grows.\n *\n * Returns the count so the caller can prove the removal; a second discard returns 0, which is what\n * makes the idempotency test possible without exposing the maps.\n */\nexport function discardSession(cwd: string, agentId: string): number {\n  const key = transcriptKey(cwd, agentId);\n  let removed = 0;\n  // `sessions` is NOT erased here — and the distinction is measured, not aesthetic. It holds the\n  // readable conversation, and there is a legitimate reader AFTER dispose: the golden\n  // `two-concurrent-sends-serialize` calls `getSessionMessages(agentId)` after `agent.dispose()`.\n  // Erasing it here returned an empty list and broke two goldens. What bounds it is the LRU ceiling\n  // above; the three below are pure bookkeeping, with no post-dispose reader.\n  //\n  // The key is `transcriptKey(cwd, agentId)` in ALL THREE — not the raw `agentId`. The first version\n  // erased two of them by `agentId` and therefore **never erased anything**; the test did not catch\n  // it because it only asserted that the SECOND call returns 0, which is true either way.\n  if (hydratedKeys.delete(key)) removed++;\n  if (pendingWrites.delete(key)) removed++;\n  if (recordCounts.delete(key)) removed++;\n  return removed;\n}\n\nexport function getSessionMessages(agentId: string): SessionMessage[] {\n  return sessions.get(agentId) ?? [];\n}\n\n/**\n * Persist a full conversation turn (user + assistant + tool blocks) to the native\n * transcript. Chained per-(agent, transcript) so on-disk order matches send order,\n * and fire-and-forget so `send()` is not blocked by disk I/O. Every\n * M50 — when the caller supplies `turn.autoCompact`, size-driven auto-compaction (usage real vs\n * the model's context window) runs in this same chain, surfaced via the optional `onCompact` observer.\n *\n * @internal\n */\nexport function persistTurnToTranscript(\n  store: SessionStore,\n  loc: TranscriptLocation,\n  sessionId: string,\n  turn: PersistTurnInput,\n  onCompact?: () => void,\n): void {\n  const key = transcriptKey(loc.cwd, loc.agentId);\n  // PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n  // sweeping these files (a nested root under refactor/). It is not new code and was not touched\n  // by M75; refactoring SDK internals without review would trade a visible problem for a diff\n  // risky. Tracked in usetheodev/theokit-sdk#151.\n  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\n  const chained = (pendingWrites.get(key) ?? Promise.resolve()).then(async () => {\n    try {\n      await persistTurn(store, loc, sessionId, turn);\n      const count = (recordCounts.get(key) ?? 0) + 1;\n      recordCounts.set(key, count);\n      // M50 — the 50-turn no-summary boundary stub is GONE (it silently amnesia'd the session).\n      // Auto-compaction is now size-driven with a real summary: see `maybeAutoCompact` below,\n      // invoked in this same write chain by the post-run lifecycle when usage is known.\n      if (turn.autoCompact !== undefined) {\n        const { autoCompactIfNeeded } = await import(\"./compact-session.js\");\n        const fired = await autoCompactIfNeeded({\n          store,\n          loc,\n          sessionId,\n          usageTotal: turn.autoCompact.usageTotal,\n          contextWindow: turn.autoCompact.contextWindow,\n          turnCount: count,\n          summarize: turn.autoCompact.summarize,\n        });\n        if (fired) onCompact?.();\n      }\n    } catch (cause) {\n      const msg = cause instanceof Error ? cause.message : String(cause);\n      diag(`[theokit-sdk] session transcript write failed (${loc.agentId}): ${msg}\\n`);\n    }\n  });\n  pendingWrites.set(\n    key,\n    chained.then(\n      () => undefined,\n      () => undefined,\n    ),\n  );\n}\n\n/**\n * Load the persisted transcript into the in-memory cache. Idempotent per\n * (baseDir, cwd, agentId). Call once per agent lifecycle before the first read.\n *\n * @internal\n */\nexport async function hydrateSession(\n  agentId: string,\n  loc: { store: SessionStore; cwd: string },\n): Promise<void> {\n  const key = transcriptKey(loc.cwd, agentId);\n  if (hydratedKeys.has(key)) return;\n  hydratedKeys.add(key);\n\n  const persisted = await readSessionMessages(loc.store, agentId);\n  if (persisted.length === 0) return;\n  // M51 review F4 — the DISK is the source of truth at hydration time: after an invalidation\n  // (compact/inject), an in-flight turn may have repopulated the cache with a SINGLE message before\n  // this hydrate ran; the old \"skip when non-empty\" guard then pinned the parent to a 1-message\n  // context (history + injected pair lost until restart). The persist chain serializes writes, so\n  // the disk already contains that in-flight turn — replacing is always correct.\n  sessions.set(agentId, persisted);\n}\n\n/**\n * Wait for all pending transcript writes to settle. Used by tests and by the\n * agent dispose path so on-disk state matches in-memory before the caller proceeds.\n *\n * @internal\n */\nexport async function flushSessionWrites(): Promise<void> {\n  while (pendingWrites.size > 0) {\n    const all = Array.from(pendingWrites.values());\n    pendingWrites.clear();\n    await Promise.all(all);\n  }\n}\n\n/**\n * Drop the in-memory message cache for `agentId` and NOTHING else — the hydration marker in\n * `hydratedKeys` deliberately stays.\n *\n * That asymmetry is the feature, not an oversight, and it is what separates this from\n * `invalidateSessionCache`, which drops both. The single caller is the personality switch's\n * `reset: true` path (`internal/personality/switch.ts`): leaving the marker set makes\n * `hydrateSession` return early, so the next send starts from an EMPTY context instead of\n * replaying the pre-reset transcript off disk. Clearing the marker here would re-hydrate the\n * conversation the reset was asked to discard.\n *\n * The same shape read as a bug one function up: `forgetBookkeeping` documents an evicted session\n * coming back empty as \"silent amnesia\". The difference is intent — eviction wants the transcript\n * back, a reset does not. Anyone reaching for this to invalidate a cache wants\n * `invalidateSessionCache(cwd, agentId)` instead.\n */\nexport function clearSession(agentId: string): void {\n  sessions.delete(agentId);\n}\n\n/**\n * M50 review F5 — run `fn` serialized on the SAME per-(cwd,agentId) write chain the per-turn\n * persistence uses, so a manual `Agent.compact` can never interleave with an in-flight turn's\n * writes (boundary landing mid-turn would orphan the turn from the replay).\n */\nexport function enqueueSessionWrite<T>(\n  cwd: string,\n  agentId: string,\n  fn: () => Promise<T>,\n): Promise<T> {\n  const key = transcriptKey(cwd, agentId);\n  const prior = pendingWrites.get(key) ?? Promise.resolve();\n  const result = prior.then(fn);\n  pendingWrites.set(\n    key,\n    result.then(\n      () => undefined,\n      () => undefined,\n    ),\n  );\n  return result;\n}\n\n/** Test-only: drop every cached session and hydration marker. @internal */\nexport function clearAllSessions(): void {\n  sessions.clear();\n  hydratedKeys.clear();\n  recordCounts.clear();\n  // M50 review F11 — the auto-compact attempt marks live on globalThis; tests reset them here.\n  // Through the helper, with the SAME key compact-session.ts uses: two files hand-rolling one slot is\n  // how two copies of a mechanism drift apart.\n  globalSingleton(\n    \"theokit-sdk.session.auto-compact-attempts\",\n    () => new Map<string, number>(),\n  ).clear();\n}\n"]}

package/dist/{chunk-UU36SHFY.cjs → chunk-BJUJT5ED.cjs}

@@ -1,7 +1,8 @@
 'use strict';
 
 var chunkZF2LDKQQ_cjs = require('./chunk-ZF2LDKQQ.cjs');
-var chunkEG4QM7ZJ_cjs = require('./chunk-EG4QM7ZJ.cjs');
+var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
+var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
 var fs = require('fs');
 var path = require('path');
 
@@ -32,7 +33,7 @@ async function getProperLockfile() {
     if (!validateLockModule(mod)) {
       if (!warnedStructural) {
         warnedStructural = true;
-        chunkEG4QM7ZJ_cjs.diag(
+        chunk6LHQPOMI_cjs.diag(
           "[theokit-sdk] proper-lockfile: imported module does NOT expose the expected `lock`/`unlock` API surface. This may indicate a supply-chain compromise or an incompatible major version. Falling back to in-process mutex (no cross-process safety). Reinstall with: pnpm add proper-lockfile@^11\n"
         );
       }
@@ -56,7 +57,7 @@ async function withFileLock(path, fn, options) {
   if (lib === null) {
     if (!warnedMissing && !warnedStructural) {
       warnedMissing = true;
-      chunkEG4QM7ZJ_cjs.diag(describeLockLoadFailure(loadFailure));
+      chunk6LHQPOMI_cjs.diag(describeLockLoadFailure(loadFailure));
     }
     return chunkZF2LDKQQ_cjs.withCwdMutex(`file-lock:${path}`, fn);
   }
@@ -80,13 +81,13 @@ async function withFileLock(path, fn, options) {
     }
   });
 }
-var JsonlParseError = class extends Error {
+var JsonlParseError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
   constructor(message, line) {
-    super(message);
+    super(message, { code: "jsonl_parse_failed", isRetryable: false });
     this.line = line;
-    this.name = "JsonlParseError";
   }
   line;
+  name = "JsonlParseError";
 };
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -181,5 +182,5 @@ exports.appendJsonl = appendJsonl;
 exports.loadJsonl = loadJsonl;
 exports.readJsonlIds = readJsonlIds;
 exports.withFileLock = withFileLock;
-//# sourceMappingURL=chunk-UU36SHFY.cjs.map
-//# sourceMappingURL=chunk-UU36SHFY.cjs.map
+//# sourceMappingURL=chunk-BJUJT5ED.cjs.map
+//# sourceMappingURL=chunk-BJUJT5ED.cjs.map

package/dist/chunk-BJUJT5ED.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/persistence/file-lock.ts","../src/internal/persistence/jsonl.ts"],"names":["diag","withCwdMutex","TheokitAgentError","readFileSync","path","mkdirSync","dirname","openSync","writeSync","closeSync","fstatSync","readSync"],"mappings":";;;;;;;;;AAiCA,IAAI,MAAA;AACJ,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAI,gBAAA,GAAmB,KAAA;AAEvB,IAAI,WAAA;AAGJ,SAAS,eAAe,GAAA,EAAuB;AAC7C,EAAA,MAAM,OAAQ,GAAA,EAA+C,IAAA;AAC7D,EAAA,OAAO,IAAA,KAAS,0BAA0B,IAAA,KAAS,kBAAA;AACrD;AAgBA,SAAS,wBAAwB,GAAA,EAAsB;AACrD,EAAA,MAAM,WAAA,GACJ,wGAAA;AACF,EAAA,IAAI,cAAA,CAAe,GAAG,CAAA,EAAG;AACvB,IAAA,OAAO,gDAAgD,WAAW,CAAA;AAAA,CAAA;AAAA,EACpE;AACA,EAAA,MAAM,OAAQ,GAAA,EAA+C,IAAA;AAC7D,EAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,EAAA,OACE,CAAA,iDAAA,EAAoD,IAAA,KAAS,MAAA,GAAY,CAAA,EAAA,EAAK,MAAA,CAAO,IAAI,CAAC,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,EAAA,EAC/F,MAAM,CAAA,EAAA,EAAK,WAAW,CAAA;AAAA,CAAA;AAG7B;AAOA,eAAe,iBAAA,GAA0D;AACvE,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,OAAO,iBAAiB,CAAA;AAM1C,IAAA,IAAI,CAAC,kBAAA,CAAmB,GAAG,CAAA,EAAG;AAC5B,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,gBAAA,GAAmB,IAAA;AACnB,QAAAA,sBAAA;AAAA,UACE;AAAA,SAKF;AAAA,MACF;AACA,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,MAAA,GAAS,GAAA;AAAA,EACX,SAAS,GAAA,EAAK;AAGZ,IAAA,WAAA,GAAc,GAAA;AACd,IAAA,MAAA,GAAS,IAAA;AAAA,EACX;AACA,EAAA,OAAO,MAAA;AACT;AAaA,SAAS,mBAAmB,GAAA,EAAuB;AACjD,EAAA,IAAI,QAAQ,IAAA,IAAQ,GAAA,KAAQ,UAAa,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AACzE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,UAAA,IAAc,OAAO,EAAE,MAAA,KAAW,UAAA;AAC7D;AAkEA,eAAsB,YAAA,CACpB,IAAA,EACA,EAAA,EACA,OAAA,EACY;AACZ,EAAA,MAAM,GAAA,GAAM,MAAM,iBAAA,EAAkB;AAEpC,EAAA,IAAI,QAAQ,IAAA,EAAM;AAIhB,IAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,gBAAA,EAAkB;AACvC,MAAA,aAAA,GAAgB,IAAA;AAChB,MAAAA,sBAAA,CAAK,uBAAA,CAAwB,WAAW,CAAC,CAAA;AAAA,IAC3C;AACA,IAAA,OAAOC,8BAAA,CAAa,CAAA,UAAA,EAAa,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA;AAAA,EAC7C;AAOA,EAAA,OAAOA,8BAAA,CAAa,CAAA,UAAA,EAAa,IAAI,CAAA,CAAA,EAAI,YAAY;AACnD,IAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA;AAAA,MAEnC,YAAA,EAAc,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,MACrB,QAAA,EAAU,KAAA;AAAA,MACV,KAAA,EAAO,SAAS,KAAA,IAAS,GAAA;AAAA,MACzB,OAAA,EAAS;AAAA,QACP,OAAA,EAAS,SAAS,OAAA,IAAW,CAAA;AAAA,QAC7B,MAAA,EAAQ,SAAS,WAAA,IAAe,GAAA;AAAA,QAChC,UAAA,EAAY,GAAA;AAAA,QACZ,UAAA,EAAY;AAAA;AACd,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,EAAA,EAAG;AAAA,IAClB,CAAA,SAAE;AACA,MAAA,MAAM,OAAA,EAAQ;AAAA,IAChB;AAAA,EACF,CAAC,CAAA;AACH;AC/MO,IAAM,eAAA,GAAN,cAA8BC,mCAAA,CAAkB;AAAA,EAErD,WAAA,CACE,SACS,IAAA,EACT;AAEA,IAAA,KAAA,CAAM,SAAS,EAAE,IAAA,EAAM,oBAAA,EAAsB,WAAA,EAAa,OAAO,CAAA;AAHxD,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAIX;AAAA,EAJW,IAAA;AAAA,EAHO,IAAA,GAAO,iBAAA;AAQ3B;AAEA,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGA,SAAS,mBAAmB,IAAA,EAAmD;AAC7E,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,aAAA,CAAc,MAAM,CAAA,GAAI,MAAA,GAAS,MAAA;AAC1C;AAQO,SAAS,SAAA,CACd,IAAA,EACA,IAAA,GASI,EAAC,EACA;AACL,EAAA,MAAM,QAAQC,eAAA,CAAa,IAAA,EAAM,MAAM,CAAA,CAAE,MAAM,IAAI,CAAA;AACnD,EAAA,MAAM,MAAW,EAAC;AAClB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA,EAAG;AACxC,IAAA,MAAM,aAAa,CAAA,GAAI,CAAA;AACvB,IAAA,MAAM,IAAA,GAAA,CAAQ,KAAA,CAAM,CAAC,CAAA,IAAK,IAAI,IAAA,EAAK;AACnC,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AAGvB,IAAA,MAAM,MAAA,GAAS,SAAA;AAAA,MACb,IAAA;AAAA,MACA,UAAA;AAAA,MACA,IAAA,CAAK,2BAAA,KAAgC,IAAA,IAAQ,UAAA,KAAe,KAAA,CAAM;AAAA,KACpE;AACA,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,GAAA,CAAI,IAAA,CAAK,KAAK,GAAA,GAAM,IAAA,CAAK,IAAI,MAAA,EAAQ,UAAU,IAAK,MAAuB,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,GAAA;AACT;AASA,SAAS,SAAA,CACP,IAAA,EACA,UAAA,EACA,QAAA,EACqC;AACrC,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI,UAAU,OAAO,MAAA;AACrB,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,KAAA,EAAQ,UAAU,kBAAkB,UAAU,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI,CAAC,aAAA,CAAc,MAAM,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,KAAA,EAAQ,UAAU,uBAAuB,UAAU,CAAA;AAAA,EAC/E;AACA,EAAA,OAAO,MAAA;AACT;AAUO,SAAS,WAAA,CAAYC,QAAc,MAAA,EAAuB;AAgB/D,EAAAC,YAAA,CAAUC,YAAA,CAAQF,MAAI,CAAA,EAAG,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS,oBAAA,CAAqBA,MAAI,CAAA,GAAI,IAAA,GAAO,EAAA;AASnD,EAAA,MAAM,EAAA,GAAKG,WAAA,CAASH,MAAA,EAAM,GAAA,EAAK,GAAK,CAAA;AACpC,EAAA,IAAI;AACF,IAAAI,YAAA,CAAU,IAAI,CAAA,EAAG,MAAM,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC;AAAA,CAAI,CAAA;AAAA,EACtD,CAAA,SAAE;AACA,IAAAC,YAAA,CAAU,EAAE,CAAA;AAAA,EACd;AACF;AAaA,SAAS,qBAAqB,IAAA,EAAuB;AACnD,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAKF,WAAA,CAAS,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAOG,YAAA,CAAU,EAAE,CAAA,CAAE,IAAA;AAC3B,IAAA,IAAI,IAAA,KAAS,GAAG,OAAO,KAAA;AACvB,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,IAAAC,WAAA,CAAS,EAAA,EAAI,GAAA,EAAK,CAAA,EAAG,CAAA,EAAG,OAAO,CAAC,CAAA;AAChC,IAAA,OAAO,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA;AAAA,EACpB,CAAA,SAAE;AACA,IAAAF,YAAA,CAAU,EAAE,CAAA;AAAA,EACd;AACF;AAYO,SAAS,YAAA,CACd,MACA,KAAA,EACa;AACb,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAON,eAAA,CAAa,MAAM,MAAM,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,KAAA,MAAW,OAAA,IAAW,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG;AAEtC,IAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,OAAA,CAAQ,IAAA,EAAM,CAAA;AAChD,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,MAAM,GAAA,GAAM,MAAM,MAAM,CAAA;AACxB,IAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,EAAG,IAAA,CAAK,IAAI,GAAG,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-BJUJT5ED.cjs","sourcesContent":["/**\n * Cross-process file lock helper (ADR D61).\n *\n * Uses `proper-lockfile` (optional peer dep) for cross-process locks. When\n * the peer dep is absent, falls back to `withCwdMutex` (in-process only)\n * with a one-shot stderr warning.\n *\n * EC-1 fix: uses a companion `<path>.lock` file with `realpath: false` so\n * `withFileLock` works even when the target `path` does not exist yet.\n * Without this, fresh installs that lock-then-create would crash with ENOENT.\n *\n * @internal\n */\n\nimport { diag } from \"../diagnostics.js\";\nimport { withCwdMutex } from \"./cwd-mutex.js\";\n\ninterface ProperLockfileModule {\n  lock: (file: string, options: ProperLockfileOptions) => Promise<() => Promise<void>>;\n}\n\ninterface ProperLockfileOptions {\n  lockfilePath?: string;\n  realpath?: boolean;\n  stale?: number;\n  retries?: {\n    retries: number;\n    factor?: number;\n    minTimeout?: number;\n    maxTimeout?: number;\n  };\n}\n\nlet cached: ProperLockfileModule | null | undefined;\nlet warnedMissing = false;\nlet warnedStructural = false;\n/** Why the import failed, kept so the warning can report the observation instead of a guess (#174). */\nlet loadFailure: unknown;\n\n/** Node reports a missing module as `ERR_MODULE_NOT_FOUND` (ESM loader) or `MODULE_NOT_FOUND` (CJS). */\nfunction isModuleAbsent(err: unknown): boolean {\n  const code = (err as { code?: unknown } | null | undefined)?.code;\n  return code === \"ERR_MODULE_NOT_FOUND\" || code === \"MODULE_NOT_FOUND\";\n}\n\n/**\n * #174 — build the fallback warning from what actually happened.\n *\n * This used to always read \"proper-lockfile not installed\", because the import was wrapped in a\n * bare `catch` that discarded the error (Unbreakable Rule 8: a swallowed error is the dangerous\n * kind). A consumer whose package WAS installed, declared and resolvable spent a debugging session\n * re-verifying the install, because the message named a cause the code had never checked.\n *\n * Absence is now the only case that claims absence. Every other failure — a broken install, an\n * interop problem, a bundler that rewrote the specifier — reports its own code and message, which\n * is what points at the real cause.\n *\n * @internal\n */\nfunction describeLockLoadFailure(err: unknown): string {\n  const consequence =\n    \"cross-process file lock unavailable — concurrent processes over the same file are NOT serialized.\";\n  if (isModuleAbsent(err)) {\n    return `[theokit-sdk] proper-lockfile not installed; ${consequence} Install with: pnpm add proper-lockfile\\n`;\n  }\n  const code = (err as { code?: unknown } | null | undefined)?.code;\n  const detail = err instanceof Error ? err.message : String(err);\n  return (\n    `[theokit-sdk] proper-lockfile could not be loaded${code !== undefined ? ` (${String(code)})` : \"\"}: ` +\n    `${detail}. ${consequence} The package resolves for the SDK but failed to load — check bundling ` +\n    \"and module-format interop before re-checking the install.\\n\"\n  );\n}\n\n/** Test seam for the message builder — NOT in the public barrel. @internal */\nexport function __TESTING__describeLockLoadFailure(err: unknown): string {\n  return describeLockLoadFailure(err);\n}\n\nasync function getProperLockfile(): Promise<ProperLockfileModule | null> {\n  if (cached !== undefined) return cached;\n  try {\n    const mod = await import(\"proper-lockfile\");\n    // T5.9 — supply-chain hardening: validate the imported module\n    // exposes the API surface we depend on BEFORE caching it. A\n    // tampered or incompatible version that lacks `lock`/`unlock`\n    // functions gets treated as \"not installed\" with an advisory\n    // warning — never silently used.\n    if (!validateLockModule(mod)) {\n      if (!warnedStructural) {\n        warnedStructural = true;\n        diag(\n          \"[theokit-sdk] proper-lockfile: imported module does NOT expose \" +\n            \"the expected `lock`/`unlock` API surface. This may indicate a \" +\n            \"supply-chain compromise or an incompatible major version. \" +\n            \"Falling back to in-process mutex (no cross-process safety). \" +\n            \"Reinstall with: pnpm add proper-lockfile@^11\\n\",\n        );\n      }\n      cached = null;\n      return cached;\n    }\n    cached = mod as ProperLockfileModule;\n  } catch (err) {\n    // #174 — keep WHY. Discarding it here is what made the fallback warning assert a cause it had\n    // never observed, and sent a consumer to re-check an install that was already correct.\n    loadFailure = err;\n    cached = null;\n  }\n  return cached;\n}\n\n/**\n * T5.9 — Structural validation of the dynamically-imported\n * `proper-lockfile` module. Verifies the API surface we depend on\n * (`lock` and `unlock` as functions) is present. Pure function —\n * never throws, never mutates, never performs I/O.\n *\n * Exported via `__TESTING__validateLockModule` seam so unit tests\n * can drive the check without spinning up the dynamic import.\n *\n * @internal\n */\nfunction validateLockModule(mod: unknown): boolean {\n  if (mod === null || mod === undefined || typeof mod !== \"object\") return false;\n  const m = mod as Record<string, unknown>;\n  return typeof m.lock === \"function\" && typeof m.unlock === \"function\";\n}\n\n/**\n * T5.9 — Test seam: expose the structural validator for unit tests.\n * NOT included in the public barrel.\n *\n * @internal\n */\nexport function __TESTING__validateLockModule(mod: unknown): boolean {\n  return validateLockModule(mod);\n}\n\n/**\n * T5.9 — Test seam: reset the module cache + warning flags between\n * tests so each test starts fresh. NOT included in the public barrel.\n *\n * @internal\n */\nexport function __TESTING__resetFileLockCache(): void {\n  cached = undefined;\n  warnedMissing = false;\n  warnedStructural = false;\n  loadFailure = undefined;\n}\n\n/**\n * Retry and staleness tuning for `withFileLock`.\n *\n * Every field is optional and the defaults are applied per call, so `undefined` means the default\n * rather than \"no limit\". They are handed to `proper-lockfile` and have NO effect on the fallback\n * path: when that package is absent, `withFileLock` degrades to the in-process mutex, which\n * queues indefinitely and never goes stale.\n *\n * `stale` (default 30000 ms) is how old a lock file must be before it is treated as abandoned by a\n * dead process and broken. Setting it below the longest a legitimate holder can run is what turns\n * a slow operation into two concurrent ones.\n *\n * `retries` (default 5) is the number of acquisition attempts AFTER the first, and `retryFactor`\n * (default 1.5) the backoff multiplier between them. The per-attempt wait is clamped to\n * 100–5000 ms, which the caller cannot change. Exhausting the retries rejects — it does not fall\n * through to running `fn` unlocked.\n *\n * @public — re-exported from the semver-protected `@theokit/sdk/persistence` barrel, and (for\n * back-compat) from the semver-exempt `@theokit/sdk/internal/persistence` alias.\n */\nexport interface FileLockOptions {\n  /** Stale lock timeout in ms. Default 30_000 (30s). */\n  stale?: number;\n  /** Max retries on busy lock. Default 5. */\n  retries?: number;\n  /** Backoff factor between retries. Default 1.5. */\n  retryFactor?: number;\n}\n\n/**\n * Run `fn` while holding an OS-level cross-process lock on `path`.\n *\n * If `proper-lockfile` is installed, uses it with a companion `<path>.lock`\n * file (`realpath: false`, so target file does NOT need to exist yet).\n * Otherwise falls back to in-process `withCwdMutex` and prints a one-shot\n * stderr warning telling the user to install `proper-lockfile` for\n * cross-process safety.\n *\n * The lock is released even when `fn` throws.\n *\n */\nexport async function withFileLock<T>(\n  path: string,\n  fn: () => Promise<T>,\n  options?: FileLockOptions,\n): Promise<T> {\n  const lib = await getProperLockfile();\n\n  if (lib === null) {\n    // #174 — stay silent when the structural check already explained itself. Emitting \"not\n    // installed\" on top of \"does not expose lock/unlock\" would be two contradictory diagnoses of\n    // one failure, and the reader has no way to tell which is true.\n    if (!warnedMissing && !warnedStructural) {\n      warnedMissing = true;\n      diag(describeLockLoadFailure(loadFailure));\n    }\n    return withCwdMutex(`file-lock:${path}`, fn);\n  }\n\n  // proper-lockfile errors immediately on same-process concurrent acquire\n  // (\"Lock file is already being held\"). Wrap with cwd-mutex first so\n  // in-process callers queue and only ONE thread at a time enters the\n  // cross-process acquire path. Combined: full in-process + cross-process\n  // serialization.\n  return withCwdMutex(`file-lock:${path}`, async () => {\n    const release = await lib.lock(path, {\n      // EC-1: companion lockfile, target path may not exist yet.\n      lockfilePath: `${path}.lock`,\n      realpath: false,\n      stale: options?.stale ?? 30_000,\n      retries: {\n        retries: options?.retries ?? 5,\n        factor: options?.retryFactor ?? 1.5,\n        minTimeout: 100,\n        maxTimeout: 5_000,\n      },\n    });\n\n    try {\n      return await fn();\n    } finally {\n      await release();\n    }\n  });\n}\n\n/**\n * Test helper — resets the cached proper-lockfile module + warning flag.\n * Allows tests to simulate \"module absent\" by clearing cache then\n * monkey-patching the dynamic import resolution.\n *\n * @internal\n */\nexport function _resetFileLockCacheForTesting(): void {\n  cached = undefined;\n  warnedMissing = false;\n}\n","/**\n * Durable JSONL primitives shared by the eval harness (M6).\n *\n * - `loadJsonl` — generic dataset reader (split/trim/skip-blank/parse) with a\n *   line-numbered {@link JsonlParseError}. The dataset SCHEMA is the caller's\n *   concern via `map` (M6 ADR D3) — this module owns only the parse.\n * - `appendJsonl` / `readJsonlIds` — crash-durable, resumable batch persistence\n *   (M6 ADR D1): each record is appended as one whole `\\n`-terminated line the\n *   instant it is produced, and a re-run resumes by skipping already-keyed rows.\n *\n * reference: knowledge-base/references/theocode-eval/lib/swebench-dataset.ts:82\n * (parseJsonl + line-N error) and swebench-batch.ts:113,205 (resume + per-line\n * flush).\n *\n * @internal\n */\nimport {\n  closeSync,\n  fstatSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  readSync,\n  writeSync,\n} from \"node:fs\";\nimport { dirname } from \"node:path\";\nimport { TheokitAgentError } from \"../../errors.js\";\n\n/** Raised when a JSONL line is not valid JSON or is not a JSON object. Carries the 1-based line number. */\nexport class JsonlParseError extends TheokitAgentError {\n  override readonly name = \"JsonlParseError\";\n  constructor(\n    message: string,\n    readonly line: number,\n  ) {\n    // Not retryable: the bytes on the line do not change between reads.\n    super(message, { code: \"jsonl_parse_failed\", isRetryable: false });\n  }\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** Parse a single trimmed line to a plain object, or `undefined` if blank / invalid / non-object. */\nfunction tryParseObjectLine(line: string): Record<string, unknown> | undefined {\n  if (line.length === 0) return undefined;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(line);\n  } catch {\n    return undefined;\n  }\n  return isPlainObject(parsed) ? parsed : undefined;\n}\n\n/**\n * Parse a JSONL file into rows. Blank lines are skipped. A malformed or\n * non-object line throws {@link JsonlParseError} naming the 1-based line. When\n * `map` is provided, each raw object is mapped to the typed row (the SWE-bench\n * schema lives in the caller's `map`, per M6 ADR D3).\n */\nexport function loadJsonl<T = Record<string, unknown>>(\n  path: string,\n  opts: {\n    map?: (raw: Record<string, unknown>, lineNumber: number) => T;\n    /**\n     * M81 — tolerate a truncated LAST line (a crash artifact: the process died mid-write).\n     *\n     * Opt-in on purpose. As a default it would also swallow corruption in the MIDDLE of the file,\n     * turning loud data loss into silent data loss — the wrong trade for a session store.\n     */\n    tolerateTrailingPartialLine?: boolean;\n  } = {},\n): T[] {\n  const lines = readFileSync(path, \"utf8\").split(\"\\n\");\n  const out: T[] = [];\n  for (let i = 0; i < lines.length; i += 1) {\n    const lineNumber = i + 1;\n    const line = (lines[i] ?? \"\").trim();\n    if (line.length === 0) continue;\n    // M81 — `undefined` = a tolerated invalid line (the last one, truncated by a crash). Any other\n    // invalid line has already thrown inside `parseLine`.\n    const parsed = parseLine(\n      line,\n      lineNumber,\n      opts.tolerateTrailingPartialLine === true && lineNumber === lines.length,\n    );\n    if (parsed === undefined) break;\n    out.push(opts.map ? opts.map(parsed, lineNumber) : (parsed as unknown as T));\n  }\n  return out;\n}\n\n/**\n * Parses ONE line, returning `undefined` when it is a tolerated truncated last line.\n *\n * Extracted because `loadJsonl` went over the cognitive-complexity ceiling once it gained the\n * tolerance — and because parsing a line and iterating a file are two responsibilities that were\n * only together out of habit.\n */\nfunction parseLine(\n  line: string,\n  lineNumber: number,\n  tolerate: boolean,\n): Record<string, unknown> | undefined {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(line);\n  } catch {\n    if (tolerate) return undefined;\n    throw new JsonlParseError(`line ${lineNumber}: invalid JSON`, lineNumber);\n  }\n  if (!isPlainObject(parsed)) {\n    throw new JsonlParseError(`line ${lineNumber}: not a JSON object`, lineNumber);\n  }\n  return parsed;\n}\n\n/**\n * Append one record as a whole `\\n`-terminated JSON line. Creates the parent dir\n * if missing. `appendFileSync` is synchronous, so within a single Node process\n * the event loop serializes writes and each call writes its line atomically —\n * interleave-safe for the bounded-concurrency batch runner.\n *\n * reference: swebench-batch.ts:192 (mkdir-before-append), :205 (per-line flush).\n */\nexport function appendJsonl(path: string, record: unknown): void {\n  // T2.4 — `0o700` for the same reason the file below is `0o600`, and it is the half M93 missed. A\n  // private file inside a group-writable directory can be replaced wholesale, and the replacement's\n  // mode is whatever the writer chose. Under `umask 002` this directory was born `0775`.\n  //\n  // The directory sits under `~/.theokit`, shared with the credential and trust stores, and the\n  // framework already wrote the diagnosis while fixing a sibling (`@theokit/agents\n  // config/trust-store.ts:157-161`): the mode argument is a no-op on a directory that already\n  // exists, \"and this one is shared with the SDK's transcript root — whoever creates it first sets\n  // the permissions\". Whoever creates it first is usually THIS function, because a session writes a\n  // transcript before it ever touches a credential. So `assertSecureModes` was not wrong to demand a\n  // private directory; this path was wrong to produce one that fails it, depending on run order.\n  //\n  // Creation-time only, deliberately: repairing a pre-existing directory means `stat` + `chmod` on\n  // every append, and this is the hot path of every session. The pre-existing case is what\n  // `assertSecureModes` is for.\n  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });\n  const prefix = needsLineBreakBefore(path) ? \"\\n\" : \"\";\n  // M93 (adversarial review, H1) — `0o600`. `appendFileSync` takes no `mode`, so the permission came\n  // from the umask: under `umask 022` the transcript was born `0664`, world-readable. The previous\n  // path (`replaceFileAtomic`) pinned `0o600` on purpose — \"holds the FULL in-flight content\n  // (credential snapshots, OAuth tokens)\" (`atomic-write.ts:107`) — and switching to append lost\n  // that silently. The same class had already been caught in the consumer (`atomic-sync.ts`, M88\n  // HIGH-1).\n  //\n  // `mode` only applies on CREATION; a pre-existing file keeps whatever permission it already has.\n  const fd = openSync(path, \"a\", 0o600);\n  try {\n    writeSync(fd, `${prefix}${JSON.stringify(record)}\\n`);\n  } finally {\n    closeSync(fd);\n  }\n}\n\n/**\n * Does the file end without a `\\n`? Then the last line is truncated — a crash mid-append.\n *\n * Without this check the next append **glues** itself onto the middle of the broken line, producing\n * an invalid line the reader discards: the NEW record disappears along with the partial one. The\n * previous path (read-modify-write) self-healed from this because it rewrote the whole file.\n * Measured in M93's adversarial review (H2): after an append over a truncated file, the\n * just-written record was no longer readable.\n *\n * Reads **one byte**, not the file.\n */\nfunction needsLineBreakBefore(path: string): boolean {\n  let fd: number;\n  try {\n    fd = openSync(path, \"r\");\n  } catch {\n    return false; // the file does not exist yet: nothing to splice onto\n  }\n  try {\n    const size = fstatSync(fd).size;\n    if (size === 0) return false;\n    const buf = Buffer.alloc(1);\n    readSync(fd, buf, 0, 1, size - 1);\n    return buf[0] !== 0x0a;\n  } finally {\n    closeSync(fd);\n  }\n}\n\n/**\n * Read the set of keys from an existing JSONL file for which `keyFn(parsed)`\n * returns a non-empty string. Used to resume a crashed batch by skipping rows\n * already persisted with a successful result. A trailing partial line from an\n * interrupted append is tolerated (skipped, not thrown), and a missing file\n * yields an empty set.\n *\n * reference: swebench-batch.ts:113 (readDoneIds), :129 (success-only),\n * :131 (tolerate partial line).\n */\nexport function readJsonlIds(\n  path: string,\n  keyFn: (parsed: Record<string, unknown>) => string | undefined,\n): Set<string> {\n  const done = new Set<string>();\n  let text: string;\n  try {\n    text = readFileSync(path, \"utf8\");\n  } catch {\n    return done; // no file yet → nothing done\n  }\n  for (const rawLine of text.split(\"\\n\")) {\n    // A trailing partial line from an interrupted run parses to undefined → skipped.\n    const parsed = tryParseObjectLine(rawLine.trim());\n    if (parsed === undefined) continue;\n    const key = keyFn(parsed);\n    if (typeof key === \"string\" && key.length > 0) done.add(key);\n  }\n  return done;\n}\n"]}

package/dist/{chunk-D4CUGAKZ.js → chunk-CZJ6Q7CW.js}

@@ -1,5 +1,3 @@
-import { diag } from './chunk-XEQ3TM66.js';
-
 // src/internal/env.ts
 var API_KEY_ENV_VAR = "THEOKIT_API_KEY";
 function readEnv(name) {
@@ -16,6 +14,38 @@ function resolveApiKey(explicit) {
   return void 0;
 }
 
+// src/internal/diagnostics.ts
+var SINK_SLOT = /* @__PURE__ */ Symbol.for("theokit.sdk.diagnostics.sink.v1");
+function currentSink() {
+  return globalThis[SINK_SLOT];
+}
+function setDiagnosticsSink(next) {
+  globalThis[SINK_SLOT] = next;
+}
+function diag(message) {
+  const sink = currentSink();
+  if (sink === void 0) return;
+  try {
+    sink(message);
+  } catch {
+  }
+}
+function diagFailure(message) {
+  const sink = currentSink();
+  if (sink !== void 0) {
+    try {
+      sink(message);
+      return;
+    } catch {
+    }
+  }
+  try {
+    globalThis.process?.stderr?.write(`${message}
+`);
+  } catch {
+  }
+}
+
 // src/internal/security/redact.ts
 var REDACT_ENABLED = readEnvOnce();
 function readEnvOnce() {
@@ -105,7 +135,7 @@ var PARAM_PATTERN = /(\b(?:access_token|api_key|api-key|client_secret|credential
 var _extraPatterns = [];
 function addPattern(re) {
   if (!re.global) {
-    throw new Error("Security.addPattern: regex must have /g flag for replace-all semantics");
+    throw new Error("addPattern: regex must have /g flag for replace-all semantics");
   }
   _extraPatterns.push(re);
 }
@@ -148,6 +178,6 @@ function redactSecrets(text, opts) {
   return s;
 }
 
-export { API_KEY_ENV_VAR, addPattern, maskToken, readEnv, redactSecrets, resolveApiKey };
-//# sourceMappingURL=chunk-D4CUGAKZ.js.map
-//# sourceMappingURL=chunk-D4CUGAKZ.js.map
+export { API_KEY_ENV_VAR, addPattern, diag, diagFailure, maskToken, readEnv, redactSecrets, resolveApiKey, setDiagnosticsSink };
+//# sourceMappingURL=chunk-CZJ6Q7CW.js.map
+//# sourceMappingURL=chunk-CZJ6Q7CW.js.map

package/dist/chunk-CZJ6Q7CW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/env.ts","../src/internal/diagnostics.ts","../src/internal/security/redact.ts"],"names":[],"mappings":";AAKO,IAAM,eAAA,GAAkB;AAoBxB,SAAS,QAAQ,IAAA,EAAkC;AACxD,EAAA,OAAO,UAAA,CAAW,OAAA,EAAS,GAAA,GAAM,IAAI,CAAA;AACvC;AAYO,SAAS,cAAc,QAAA,EAAuC;AACnE,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACjD,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,eAAe,CAAA;AACvC,EAAA,IAAI,OAAA,KAAY,MAAA,IAAa,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC/C,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,OAAO,MAAA;AACT;;;ACoBA,IAAM,SAAA,mBAAY,MAAA,CAAO,GAAA,CAAI,iCAAiC,CAAA;AAI9D,SAAS,WAAA,GAA2C;AAClD,EAAA,OAAQ,WAAqC,SAAS,CAAA;AACxD;AASO,SAAS,mBAAmB,IAAA,EAAyC;AAC1E,EAAC,UAAA,CAAqC,SAAS,CAAA,GAAI,IAAA;AACrD;AAQO,SAAS,KAAK,OAAA,EAAuB;AAG1C,EAAA,MAAM,OAAO,WAAA,EAAY;AACzB,EAAA,IAAI,SAAS,MAAA,EAAW;AACxB,EAAA,IAAI;AACF,IAAA,IAAA,CAAK,OAAO,CAAA;AAAA,EACd,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAqBO,SAAS,YAAY,OAAA,EAAuB;AACjD,EAAA,MAAM,OAAO,WAAA,EAAY;AACzB,EAAA,IAAI,SAAS,MAAA,EAAW;AACtB,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,OAAO,CAAA;AACZ,MAAA;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI;AAKF,IAAA,UAAA,CAAW,OAAA,EAAS,MAAA,EAAQ,KAAA,CAAM,CAAA,EAAG,OAAO;AAAA,CAAI,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;;;ACtHA,IAAI,iBAA0B,WAAA,EAAY;AAE1C,SAAS,WAAA,GAAuB;AAG9B,EAAA,MAAM,GAAA,GAAM,QAAQ,wBAAwB,CAAA;AAC5C,EAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,IAAA;AAC9B,EAAA,OAAO,CAAC,KAAK,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA,CAAE,QAAA,CAAS,GAAA,CAAI,WAAA,EAAa,CAAA;AAC9D;AAGA,IAAI,YAAA,GAAe,KAAA;AACnB,IAAI,CAAC,cAAA,IAAkB,CAAC,YAAA,EAAc;AACpC,EAAA,IAAA;AAAA,IACE;AAAA,GAEF;AACA,EAAA,YAAA,GAAe,IAAA;AACjB;AASA,IAAM,gBAAA,GAAsC;AAAA;AAAA;AAAA;AAAA;AAAA,EAK1C,iJAAA;AAAA;AAAA;AAAA,EAGA,gEAAA;AAAA;AAAA,EAEA,mCAAA;AAAA;AAAA,EAEA,oCAAA;AAAA;AAAA,EACA,4BAAA;AAAA;AAAA;AAAA,EAEA,6BAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA;AAAA,EAEA,wBAAA;AAAA;AAAA,EACA,mBAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,8BAAA;AAAA;AAAA,EACA,uBAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,2BAAA;AAAA;AAAA,EACA,2BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,yBAAA;AAAA;AAAA,EACA,+BAAA;AAAA;AAAA;AAAA,EAEA,sBAAA;AAAA;AAAA,EACA,2CAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,uBAAA;AAAA;AAAA,EACA,2DAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAKA,IAAM,cAAA,GAAiB,wCAAA;AAoBvB,IAAM,aAAA,GACJ,4NAAA;AAEF,IAAM,iBAA2B,EAAC;AA0B3B,SAAS,WAAW,EAAA,EAAkB;AAC3C,EAAA,IAAI,CAAC,GAAG,MAAA,EAAQ;AASd,IAAA,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAAA,EACjF;AACA,EAAA,cAAA,CAAe,KAAK,EAAE,CAAA;AACxB;AA4BO,SAAS,UAAU,KAAA,EAAuB;AAC/C,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,EAAA,EAAI,OAAO,KAAA;AAC9B,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,EAAM,KAAA,CAAM,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAClD;AAKA,IAAM,UAAA,GAAa,mBAAA;AAMnB,SAAS,eAAe,KAAA,EAA+B;AACrD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AAClD,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAC9B,MAAA,OAAO,CAAA,KAAM,SAAY,IAAA,GAAO,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,0BAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,OAAO,KAAK,CAAA;AACrB;AAqBO,SAAS,aAAA,CAAc,MAAe,IAAA,EAAuC;AAClF,EAAA,MAAM,OAAA,GAAU,eAAe,IAAI,CAAA;AACnC,EAAA,IAAI,OAAA,KAAY,MAAM,OAAO,EAAA;AAC7B,EAAA,IAAI,CAAC,gBAAgB,OAAO,OAAA;AAE5B,EAAA,IAAI,CAAA,GAAI,OAAA;AACR,EAAA,KAAA,MAAW,MAAM,gBAAA,EAAkB;AACjC,IAAA,CAAA,GAAI,EAAE,OAAA,CAAQ,EAAA,EAAI,CAAC,CAAA,KAAM,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,EACvC;AACA,EAAA,KAAA,MAAW,MAAM,cAAA,EAAgB;AAC/B,IAAA,CAAA,GAAI,EAAE,OAAA,CAAQ,EAAA,EAAI,CAAC,CAAA,KAAM,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,EACvC;AACA,EAAA,IAAI,CAAC,MAAM,QAAA,EAAU;AAInB,IAAA,CAAA,GAAI,CAAA,CAAE,QAAQ,cAAA,EAAgB,CAAC,GAAG,MAAA,KAAmB,CAAA,EAAG,MAAM,CAAA,GAAA,CAAK,CAAA;AAInE,IAAA,CAAA,GAAI,EAAE,OAAA,CAAQ,aAAA,EAAe,CAAC,KAAA,EAAO,QAAgB,KAAA,KAAkB;AAOrE,MAAA,IAAI,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAA;AACnC,MAAA,OAAO,GAAG,MAAM,CAAA,GAAA,CAAA;AAAA,IAClB,CAAC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,CAAA;AACT","file":"chunk-CZJ6Q7CW.js","sourcesContent":["/**\n * Environment variable used to provide the default API key.\n *\n * @internal\n */\nexport const API_KEY_ENV_VAR = \"THEOKIT_API_KEY\";\n\n/**\n * Read an environment variable without assuming `process` exists.\n *\n * Parts of this package legitimately reach a browser: `errors.ts` is imported by the client\n * bindings that framework consumers ship to the front end, and it in turn pulls in the redaction\n * and retry modules. `process` is a Node global — a bare `process.env` in any of them throws\n * `ReferenceError: process is not defined` while the module graph is still evaluating, before a\n * single component renders. The page goes blank with one console error that names no cause.\n *\n * `globalThis.process?.env?.[name]` degrades instead: on the server it reads the variable, and in\n * a browser it yields `undefined`, which every caller here already treats as \"not set\". Bundlers\n * that inline `process.env.X` at build time keep working, because they replace the expression\n * before it ever runs.\n *\n * This is the same pattern the sibling design system uses for `NODE_ENV`, for the same reason.\n *\n * @internal\n */\nexport function readEnv(name: string): string | undefined {\n  return globalThis.process?.env?.[name];\n}\n\n/**\n * Resolve the API key with the documented precedence:\n *\n *   1. Explicit `apiKey` argument.\n *   2. The `THEOKIT_API_KEY` environment variable.\n *\n * Returns `undefined` when neither is set.\n *\n * @internal\n */\nexport function resolveApiKey(explicit?: string): string | undefined {\n  if (explicit !== undefined && explicit.length > 0) {\n    return explicit;\n  }\n  const fromEnv = readEnv(API_KEY_ENV_VAR);\n  if (fromEnv !== undefined && fromEnv.length > 0) {\n    return fromEnv;\n  }\n  return undefined;\n}\n","/**\n * The library's single diagnostics channel — silent by default (#147).\n *\n * ## The problem\n *\n * The SDK wrote diagnostics straight to `process.stderr` from hot paths — 92 sites across 51\n * files under `internal/`. In a TUI host (Ink, alternate screen), those writes interleave with the\n * render and **corrupt the frame**. And the host had no way to intercept them: there was no\n * injectable logger. One consumer went as far as installing `proper-lockfile` just to silence ONE\n * of them.\n *\n * A library cannot assume `stdout`/`stderr` are free sinks. The application owns the terminal, not\n * the dependency.\n *\n * ## The contract\n *\n * - **`setDiagnosticsSink(fn)`** hands the messages to the application, which decides where to put\n *   them (a status line, a file, a panel). It is what was missing for a TUI to coexist with the SDK.\n * - **With no sink, nothing is emitted.** A library does not own the host's terminal.\n *\n * ## Silent by default, and how 36 suites survived the flip\n *\n * The default WAS `stderr`, and 36 test files spy on `process.stderr.write` to assert a given\n * warning is emitted. That contract is real and had to survive; migrating all 36 by hand, across\n * four different spy styles, is how you weaken 36 suites in one commit.\n *\n * So the flip happened at the default, and `vitest.setup.ts` installs a sink that FORWARDS to\n * `stderr` for the duration of every test. Those assertions still test what they always tested —\n * \"this condition emits a diagnostic\" — through the channel a host would use, while production\n * emits nothing unless asked.\n *\n * The cost is stated rather than hidden: no test observes the production default by accident, so\n * `tests/diagnostics-public-entry.test.ts` pins it explicitly by clearing the sink first.\n *\n * ## Coverage is the whole guarantee\n *\n * The first sweep migrated the 92 sites under `internal/` and left `src/`'s own modules —\n * `event-bus.ts`, `batch.ts`, `compaction.ts`, `internal/workflow/step-branch.ts`. A host could\n * therefore install a sink and still have its frame corrupted by a batch run, which is the reported\n * defect with a smaller blast radius. Those are routed here too, and\n * `tests/lint/no-direct-terminal-write.test.ts` is what keeps the next hot path from\n * reintroducing one. \"Mostly interceptable\" is not interceptable.\n *\n * The remaining direct writers are allowlisted there with a reason, and every one of them is a seam\n * whose destination the CALLER already chooses (`opts.warn`, `opts.logger`, the Workflow logger).\n *\n * ## What this is NOT\n *\n * It is not a logger with levels, formatting or multiple destinations. It is the minimum that\n * resolves the reported blocker; a full logger here would be inventing a requirement nobody asked\n * for.\n */\n\n/** Receives each diagnostic message already formatted, with the trailing `\\n`. */\nexport type DiagnosticsSink = (message: string) => void;\n\n/**\n * The registry lives on `globalThis`, not in a module-level `let` (theokit#173).\n *\n * A module-level binding is a per-INSTANCE singleton, and a package manager will install two\n * physical copies of the same version whenever two dependents resolve different peer sets. Measured:\n * `@theokit/sdk@4.39.1` existed under two pnpm store hashes in the theokit workspace, so a sink\n * installed through `@theokit/agents` landed in a different registry than the emitter writes to.\n *\n * The failure mode is the quiet one — the re-export resolves, the function is callable, nothing\n * throws, and no diagnostic ever arrives. `Symbol.for` gives every copy in the process the same\n * slot; the `v1` suffix leaves room to change the shape without colliding with an older copy.\n */\nconst SINK_SLOT = Symbol.for(\"theokit.sdk.diagnostics.sink.v1\");\n\ntype SinkHolder = Record<symbol, DiagnosticsSink | undefined>;\n\nfunction currentSink(): DiagnosticsSink | undefined {\n  return (globalThis as unknown as SinkHolder)[SINK_SLOT];\n}\n\n/**\n * Installs (or removes, by passing `undefined`) the diagnostics destination.\n *\n * When a sink is present it is the ONLY destination — `stderr` gets no copy. Duplicating\n * destinations would hand the problem back to the TUI that installed the sink precisely to get the\n * messages out of the terminal.\n */\nexport function setDiagnosticsSink(next: DiagnosticsSink | undefined): void {\n  (globalThis as unknown as SinkHolder)[SINK_SLOT] = next;\n}\n\n/**\n * Emits a library diagnostic message.\n *\n * Replaces `process.stderr.write` on internal paths. Never throws: a faulty sink must not\n * must not take down the run it merely observes.\n */\nexport function diag(message: string): void {\n  // Silent by default (#147): with no sink installed the message is dropped. A library must not\n  // assume the host's stdout/stderr are free-form log sinks — in a TUI they are the render surface.\n  const sink = currentSink();\n  if (sink === undefined) return;\n  try {\n    sink(message);\n  } catch {\n    // Observability never breaks the run — same principle as `emitRunEvent`.\n  }\n}\n\n/**\n * Emits a diagnostic that reports a USER-VISIBLE FAILURE, and is never silently dropped.\n *\n * `diag` is silent with no sink installed, and that is right for chatter: a library must not assume\n * the host's stderr is a free-form log, because in a TUI it is the render surface. A failure is a\n * different message. `theokit-sdk#189` is the record of the difference — an MCP server failed to\n * start, the only report went to `diag()`, the embedding UI never read it, and the user saw an\n * agent with missing tools and no reason given.\n *\n * The two failure modes are not symmetric, which is the whole decision: a corrupted frame is\n * visible and recoverable, while a silently dropped failure is neither. So this falls back to\n * stderr rather than to silence.\n *\n * A sink still takes precedence — the host installed it precisely to keep these off the terminal —\n * EXCEPT when the sink throws. A broken sink swallowing the one report of a failure is the same\n * defect one layer further in.\n *\n * @internal\n */\nexport function diagFailure(message: string): void {\n  const sink = currentSink();\n  if (sink !== undefined) {\n    try {\n      sink(message);\n      return;\n    } catch {\n      // Fall through: the sink is broken, and this message is too important to drop with it.\n    }\n  }\n  try {\n    // `globalThis.process?.stderr` rather than a bare `process`: in a browser the bare form is a\n    // ReferenceError that the catch below would swallow — working by accident, on an exception used\n    // as ordinary control flow. Optional chaining states the intent: write to stderr where one\n    // exists, stay silent where none does.\n    globalThis.process?.stderr?.write(`${message}\\n`);\n  } catch {\n    // Nothing left to try. Observability never breaks the run.\n  }\n}\n","import { diag } from \"../diagnostics.js\";\nimport { readEnv } from \"../env.js\";\n\n/**\n * Canonical secret redaction module (ADRs D68-D73).\n *\n * Single source of truth for credential pattern masking across the SDK.\n * Wired at output boundaries: `ErrorMetadata.raw` (mappers/shared.ts),\n * telemetry span attributes (telemetry/tracer.ts), transcript JSONL\n * appends (agent-session-store.ts), migration logger output\n * (memory/migrate-sqlite-to-lance.ts).\n *\n * - D68: central module, single source of truth (replaces 2 duplicates)\n * - D69: env snapshot at module init (prompt-injection defense)\n * - D70: ON by default, warn on opt-out\n * - D71: two-bucket masking — short fully masked, long preserves prefix+suffix\n * - D72: `codeFile` opt-out for legitimate prefix-shaped content\n * - D73: redact at OUTPUT boundaries, not at storage\n *\n * @internal\n */\n\n// D69: env snapshot captured at module load. Subsequent mutations of\n// process.env.THEOKIT_REDACT_SECRETS are ignored — defends against\n// prompt injection that tries to disable redaction mid-run.\nlet REDACT_ENABLED: boolean = readEnvOnce();\n\nfunction readEnvOnce(): boolean {\n  // `readEnv` rather than `process.env`: this module reaches the browser through `errors.ts`, and\n  // a bare `process` there is a ReferenceError at module scope — a blank page, not a warning.\n  const raw = readEnv(\"THEOKIT_REDACT_SECRETS\");\n  if (raw === undefined) return true; // D70: default ON\n  return [\"1\", \"true\", \"yes\", \"on\"].includes(raw.toLowerCase());\n}\n\n// D70: warn once on opt-out so the user knows they're vulnerable.\nlet warnedOptOut = false;\nif (!REDACT_ENABLED && !warnedOptOut) {\n  diag(\n    \"[theokit-sdk] Secret redaction is DISABLED via THEOKIT_REDACT_SECRETS. \" +\n      \"Credentials may leak into errors, telemetry, logs, transcripts.\\n\",\n  );\n  warnedOptOut = true;\n}\n\n/**\n * Built-in credential patterns. Order matters — more specific prefixes\n * must come before generic ones (e.g., `sk-ant-` before `sk-`). Quantifiers\n * are all bounded `{n,m}` or applied to char classes — linear time, no ReDoS.\n *\n * @internal\n */\nconst BUILTIN_PATTERNS: readonly RegExp[] = [\n  // T5.4: 30+ vendor prefixes (was 12 pre-T5.4). Order matters — more\n  // specific prefixes precede generic ones (e.g., sk-ant-admin01 before\n  // sk-ant-, sk-proj- before sk-). PEM block deliberately first so its\n  // multi-line span runs before any per-line patterns can fire.\n  /-----BEGIN[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----[\\s\\S]+?-----END[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----/g,\n  // JWT — exact 3-segment base64url. Dotted; the body floor of 4 chars per\n  // segment matches the minimum legal payload while skipping `a.b.c` noise.\n  /eyJ[A-Za-z0-9_-]{4,}\\.eyJ[A-Za-z0-9_-]{4,}\\.[A-Za-z0-9_-]{4,}/g,\n  // Azure Storage SAS — match the sig= component (URL-encoded base64).\n  /(?<=[?&]sig=)[A-Za-z0-9%+/]{20,}/g,\n  // Anthropic\n  /sk-ant-admin01-[A-Za-z0-9_-]{10,}/g, //   Anthropic admin keys (must precede sk-ant-)\n  /sk-ant-[A-Za-z0-9_-]{10,}/g, //           Anthropic regular\n  // OpenAI family + clones (sk- generic must come AFTER all sk-foo- variants)\n  /sk-proj-[A-Za-z0-9_-]{10,}/g, //  OpenAI project key (must precede sk- generic)\n  /sk-[A-Za-z0-9_-]{10,}/g, //       OpenAI / OpenRouter / DeepInfra / Together / DeepSeek\n  // Provider prefixes (alphabetized for maintainability)\n  /AIza[A-Za-z0-9_-]{35}/g, //       Google API key\n  /AKIA[A-Z0-9]{16}/g, //            AWS access key\n  /fw_[A-Za-z0-9]{20,}/g, //         Fireworks\n  /glpat-[A-Za-z0-9_-]{20}/g, //     GitLab PAT\n  /ghp_[A-Za-z0-9]{36}/g, //         GitHub PAT classic\n  /github_pat_[A-Za-z0-9_]{82}/g, // GitHub PAT fine-grained\n  /gsk_[A-Za-z0-9]{20,}/g, //        Groq\n  /hf_[A-Za-z0-9]{20,}/g, //         HuggingFace\n  /\\bpa-[A-Za-z0-9_-]{20,}/g, //     Voyage AI (word-boundary to skip CSS / kebab IDs)\n  /pcsk_[A-Za-z0-9_-]{20,}/g, //     Pinecone\n  /pplx-[A-Za-z0-9_-]{20,}/g, //     Perplexity\n  /r8_[A-Za-z0-9_-]{20,}/g, //       Replicate\n  /rk_live_[A-Za-z0-9]{20,}/g, //    Stripe restricted\n  /sk_live_[A-Za-z0-9]{20,}/g, //    Stripe secret\n  /sntrys_[A-Za-z0-9]{40,}/g, //     Sentry user auth\n  /xai-[A-Za-z0-9_-]{20,}/g, //      xAI (Grok)\n  /xox[bpasr]-[A-Za-z0-9-]{10,}/g, //Slack tokens\n  // Additional unique-prefix tokens with low false-positive risk\n  /npm_[A-Za-z0-9]{36}/g, //         npm access token\n  /SG\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]{43}/g, // SendGrid\n  /\\bSK[A-Za-z0-9]{32}\\b/g, //       Twilio API SID (word-boundary to skip CSS class noise)\n  /\\bkey-[a-f0-9]{32}\\b/g, //        Mailgun (hex-only narrows false positives)\n  /MT[A-Za-z0-9_-]{23}\\.[A-Za-z0-9_-]{6}\\.[A-Za-z0-9_-]{27}/g, // Discord bot\n  /\\b(?:sdk|mob)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\\b/g, // LaunchDarkly\n];\n\n// `Bearer <token>` matched as its own first-class pattern so PARAM_PATTERN\n// doesn't have to handle the unusual `Authorization: Bearer xxx` shape\n// (no `:` or `=` between \"Bearer\" and the value — bare whitespace).\nconst BEARER_PATTERN = /\\b(Bearer\\s+)([A-Za-z0-9_\\-.+/=]{8,})/g;\n\n// Parametric: matches `key=value` and `key: value` (with optional quote\n// between the key and the separator, to handle JSON: `\"api_key\": \"...\"`)\n// in URLs, query strings, JSON-like bodies, HTTP headers. Captures the\n// prefix so we keep it visible while masking the value.\n//\n// `authorization` deliberately excluded — BEARER_PATTERN handles the\n// common `Authorization: Bearer xxx` shape. Including it here causes\n// double-masking (\"Authorization: *** ***\") after Bearer fires.\n// T5.4: keyword set expanded from 6 → 16 to cover the OAuth / JWT / generic\n// credential vocabulary surfaced by DR6 finding #4. `authorization`,\n// `auth`, `bearer` stay excluded — BEARER_PATTERN handles the\n// `Authorization: Bearer xxx` shape and including these here would\n// re-catch the post-BUILTIN-masked form (D71 prefix-preservation\n// contract) and double-mask to `***`.\n//\n// Value class includes `.` so JWT / `.env` / dotted base64url values\n// match; the callback skips already-masked values (containing the\n// `...` D71 separator) to preserve the BUILTIN prefix-mask result.\nconst PARAM_PATTERN =\n  /(\\b(?:access_token|api_key|api-key|client_secret|credential|credentials|id_token|jwt|password|private_key|refresh_token|secret|service_account|session_token|token|x-api-key)\\b[\"']?\\s*[:=]\\s*[\"']?)([A-Za-z0-9_\\-.+/]+)/gi;\n\nconst _extraPatterns: RegExp[] = [];\n\n/**\n * Register an extra pattern for `redactSecrets` to mask, on top of the built-in vendor set.\n *\n * Additive and irreversible for the life of the process: patterns accumulate in module scope,\n * builtins are never replaced or reordered, and there is no way to remove one. Registering the\n * same regex twice registers it twice.\n *\n * Throws immediately when the regex has no `/g` flag. That is not pedantry — `String.replace`\n * with a non-global regex substitutes only the FIRST match, so a pattern registered without it\n * would mask the first credential in a payload and let every later one through, which reads as\n * working.\n *\n * Extras run after the builtins and before the parametric `key=value` sweep, and each whole match\n * is replaced by `maskToken` of that match. Anchor and bound the pattern with care: a regex that\n * matches more than the secret masks more than the secret, and one that backtracks badly runs on\n * every string crossing an output boundary.\n *\n * Registering a pattern does not enable redaction. When `THEOKIT_REDACT_SECRETS` was off at\n * module load, `redactSecrets` returns its input untouched and extras never run.\n *\n * Also exposed publicly, and under semver, as `Security.addPattern` in `src/security.ts`; the\n * direct export here additionally reaches the semver-exempt `@theokit/sdk/internal/security`\n * sub-path.\n */\nexport function addPattern(re: RegExp): void {\n  if (!re.global) {\n    // A BARE Error here, deliberately, and this is the one place in the package where that is the\n    // right answer. `errors.ts` imports `redactSecrets` from this module for the anti-leak invariant\n    // on `providerError`, so this module must stay below it — importing ConfigurationError closes a\n    // cycle (measured: `madge --circular` reports `errors.ts > internal/security/redact.ts`).\n    //\n    // The typed error lives at the surface a consumer touches: `Security.addPattern` in\n    // `src/security.ts` validates first and throws ConfigurationError with a code. This throw is the\n    // backstop for the semver-exempt `@theokit/sdk/internal/security` sub-path.\n    throw new Error(\"addPattern: regex must have /g flag for replace-all semantics\");\n  }\n  _extraPatterns.push(re);\n}\n\n/**\n * Mask one string, keeping enough of it to be recognizable in a log.\n *\n * Under 18 characters the whole string becomes the literal `***`; the length is not preserved and\n * nothing of the input survives. From 18 characters up, the result is the first 6 characters, the\n * literal `...`, and the last 4 — so exactly 10 characters of the input are RETAINED IN CLEAR and\n * the middle is dropped. That is the trade the threshold encodes: short strings could be brute\n * forced from a partial, long ones cannot, and the surviving prefix is usually the vendor tag\n * (`sk-ant`, `ghp_de`) that tells an operator which credential misbehaved.\n *\n * Be clear about what this is and is not. It is a readability aid for logs, not an anonymizer and\n * not a security boundary. The retained prefix and suffix identify the credential's issuer and\n * often the credential itself to anyone who has seen it before, so a masked value still belongs in\n * a trusted log and not in a bug report or a support ticket.\n *\n * It masks whatever it is handed. There is no check that the argument is a secret, so calling it\n * on ordinary text mangles the text, and calling it on something the caller merely hopes is a\n * secret proves nothing about what leaked.\n *\n * `redactSecrets` applies it to the ENTIRE match of a pattern, not to a captured group. For a\n * match like `Bearer sk-ant-...` the first 6 characters retained are `Bearer`, not the key's\n * prefix.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/security` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function maskToken(token: string): string {\n  if (token.length < 18) return \"***\";\n  return `${token.slice(0, 6)}...${token.slice(-4)}`;\n}\n\n// issue #117 — the EXACT shape of a `maskToken` output (`slice(0,6)+\"...\"+slice(-4)`\n// = 6 chars, literal `...`, 4 chars). Used to detect a value PARAM_PATTERN would\n// otherwise re-mask, WITHOUT skipping a raw secret that merely contains `...`.\nconst MASK_SHAPE = /^.{6}\\.\\.\\..{4}$/s;\n\n// Coerce arbitrary input to a string for redaction. Returns `null`\n// sentinel when the value is null/undefined/non-stringifiable, so the\n// caller can short-circuit with `\"\"`. EC-7 fix: circular refs go through\n// the try/catch and produce the sentinel marker, never throwing.\nfunction coerceToString(value: unknown): string | null {\n  if (typeof value === \"string\") return value;\n  if (value === null || value === undefined) return null;\n  if (typeof value === \"object\") {\n    try {\n      const s = JSON.stringify(value);\n      return s === undefined ? null : s;\n    } catch {\n      return \"[unredactable: circular]\";\n    }\n  }\n  return String(value);\n}\n\n/**\n * Redact known credential patterns from `text`. Default behavior masks\n * builtins + extras + parametric `key=value` sinks.\n *\n * With `{ codeFile: true }` (D72), skips PARAM_PATTERN to avoid mangling\n * `.env.example`, schema JSON, or test fixtures that legitimately contain\n * prefix-like strings.\n *\n * Returns the redacted string. Coerces non-strings via JSON.stringify;\n * EC-7 fix (edge-case review): wraps in try/catch so circular references\n * never propagate — returns sentinel `\"[unredactable: circular]\"`.\n *\n * `null` and `undefined` return `\"\"`. When redaction was switched off at module load via\n * `THEOKIT_REDACT_SECRETS`, the coerced input is returned with no masking at all — the value is\n * still stringified, but nothing is removed from it.\n *\n * Masking is best-effort against a list of known shapes. A credential in a format no pattern\n * covers passes through unchanged, so a redacted string is not a string proven free of secrets.\n */\nexport function redactSecrets(text: unknown, opts?: { codeFile?: boolean }): string {\n  const coerced = coerceToString(text);\n  if (coerced === null) return \"\";\n  if (!REDACT_ENABLED) return coerced;\n\n  let s = coerced;\n  for (const re of BUILTIN_PATTERNS) {\n    s = s.replace(re, (m) => maskToken(m));\n  }\n  for (const re of _extraPatterns) {\n    s = s.replace(re, (m) => maskToken(m));\n  }\n  if (!opts?.codeFile) {\n    // Bearer first (preserves \"Bearer \" prefix, masks the token after).\n    // Must run before PARAM_PATTERN so the bare-whitespace shape doesn't\n    // get mis-handled as a value.\n    s = s.replace(BEARER_PATTERN, (_, prefix: string) => `${prefix}***`);\n    // T5.4: skip if value already contains the D71 bucket-mask separator\n    // (`...`) — BUILTIN ran first and produced a prefix-preserved mask;\n    // re-masking would lose the prefix and degrade debuggability.\n    s = s.replace(PARAM_PATTERN, (whole, prefix: string, value: string) => {\n      // issue #117 — skip ONLY when the value is already a mask that a BUILTIN\n      // pattern produced (maskToken's exact `6chars...4chars` shape), so we don't\n      // re-mask and lose the prefix. The old `value.includes(\"...\")` was too broad:\n      // a REAL secret that happens to contain `...` (e.g. `L_-cxw-.2UI_..._`) was\n      // skipped and LEAKED. The mask shape is exact (maskToken: slice(0,6)+\"...\"+\n      // slice(-4)), so a raw secret with `...` elsewhere is now masked.\n      if (MASK_SHAPE.test(value)) return whole;\n      return `${prefix}***`;\n    });\n  }\n  return s;\n}\n\n/**\n * Test-only helper exported for `_test-reset.ts`. NOT included in the\n * `index.ts` barrel — vitest setup imports the dedicated module via\n * explicit path to discourage production callers.\n *\n * @internal\n */\nexport function _resetForTests(opts: { enabled?: boolean; clearExtras?: boolean }): void {\n  if (opts.enabled !== undefined) REDACT_ENABLED = opts.enabled;\n  if (opts.clearExtras === true) _extraPatterns.length = 0;\n}\n\n/**\n * T5.4 — Test-only count of BUILTIN_PATTERNS. Exposed so the count-floor\n * assertion can run without re-deriving the array shape in test land.\n * NOT included in the public barrel.\n *\n * @internal\n */\nexport function __TESTING__BUILTIN_PATTERN_COUNT(): number {\n  return BUILTIN_PATTERNS.length;\n}\n"]}

package/dist/{chunk-KQ7TS7WW.cjs → chunk-D6POWE7E.cjs}

@@ -1,18 +1,21 @@
 'use strict';
 
 var chunkGHX4P3V2_cjs = require('./chunk-GHX4P3V2.cjs');
-var chunkUGT7GK7I_cjs = require('./chunk-UGT7GK7I.cjs');
-var chunkZSWPZ23K_cjs = require('./chunk-ZSWPZ23K.cjs');
-var chunk4ZHTIJNE_cjs = require('./chunk-4ZHTIJNE.cjs');
+var chunk24SYBZPL_cjs = require('./chunk-24SYBZPL.cjs');
+var chunkQOGNZMHD_cjs = require('./chunk-QOGNZMHD.cjs');
+var chunkI2PWY7VM_cjs = require('./chunk-I2PWY7VM.cjs');
+var chunkJ7J7J2GN_cjs = require('./chunk-J7J7J2GN.cjs');
 var crypto = require('crypto');
 
 var MAX_BATCH = 100;
 var MAX_RETRIES = 2;
+var EMBED_BACKOFF_BASE_MS = 250;
+var EMBED_BACKOFF_CAP_MS = 4e3;
 async function createOpenAiCompatibleRuntime(cfg, options) {
   const model = options.model ?? cfg.defaultModel;
   const apiKey = options.apiKey ?? process.env[cfg.apiKeyEnv];
   if (apiKey === void 0 || apiKey.length === 0) {
-    throw new chunk4ZHTIJNE_cjs.AuthenticationError(`${cfg.apiKeyEnv} missing`, {
+    throw new chunkJ7J7J2GN_cjs.AuthenticationError(`${cfg.apiKeyEnv} missing`, {
       code: "embedding_missing_api_key"
     });
   }
@@ -22,7 +25,7 @@ async function createOpenAiCompatibleRuntime(cfg, options) {
   const cache = options.cache ?? chunkGHX4P3V2_cjs.globalEmbeddingCache;
   const dimension = cfg.dimensionByModel[model];
   if (dimension === void 0) {
-    throw new chunk4ZHTIJNE_cjs.ConfigurationError(
+    throw new chunkJ7J7J2GN_cjs.ConfigurationError(
       `${cfg.id} adapter: model "${model}" is not in the dimension table. Use one of: ${Object.keys(cfg.dimensionByModel).join(", ")}. To add it, update dimensionByModel in the adapter source.`,
       { code: "embedding_unknown_model" }
     );
@@ -97,7 +100,7 @@ async function embedInBoundedBatches(input, pending, results) {
   for (let offset = 0; offset < pending.length; offset += MAX_BATCH) {
     batches.push(pending.slice(offset, offset + MAX_BATCH));
   }
-  await chunkZSWPZ23K_cjs.mapWithConcurrency(
+  await chunkI2PWY7VM_cjs.mapWithConcurrency(
     batches,
     MAX_CONCURRENT_BATCHES,
     (batch) => processBatch(input, batch, results)
@@ -134,23 +137,34 @@ async function embedBatch(opts) {
     if (isRetryable(response.status) && attempt < MAX_RETRIES) {
       attempt += 1;
       opts.stats.retries += 1;
-      await sleep(linearBackoffMs(attempt));
+      const retryAfterSec = chunk24SYBZPL_cjs.parseRetryAfter(response.headers);
+      await sleep(
+        chunkQOGNZMHD_cjs.computeBackoffMs({
+          attempt,
+          baseMs: EMBED_BACKOFF_BASE_MS,
+          capMs: EMBED_BACKOFF_CAP_MS,
+          ...retryAfterSec !== void 0 ? { retryAfterMs: retryAfterSec * 1e3 } : {}
+        })
+      );
       continue;
     }
-    const text = await response.text().catch(() => "");
-    let body = text;
-    try {
-      body = JSON.parse(text);
-    } catch {
-    }
-    throw chunkUGT7GK7I_cjs.mapOpenAICompatibleError({
-      providerId: opts.providerId,
-      status: response.status,
-      body,
-      headers: response.headers,
-      endpoint: opts.embeddingsPath
-    });
+    throw await mappedEmbedError(opts, response);
+  }
+}
+async function mappedEmbedError(opts, response) {
+  const text = await response.text().catch(() => "");
+  let body = text;
+  try {
+    body = JSON.parse(text);
+  } catch {
   }
+  return chunk24SYBZPL_cjs.mapOpenAICompatibleError({
+    providerId: opts.providerId,
+    status: response.status,
+    body,
+    headers: response.headers,
+    endpoint: opts.embeddingsPath
+  });
 }
 async function postEmbedRequest(opts, url) {
   return opts.fetchImpl(url, {
@@ -169,7 +183,7 @@ async function parseEmbedResponse(response, providerId, endpoint, dialect) {
   const viaDialect = dialect?.vectors?.(json);
   if (viaDialect !== void 0) return viaDialect;
   if (!Array.isArray(json.data)) {
-    throw new chunk4ZHTIJNE_cjs.NetworkError(`${providerId} ${endpoint} returned no data`, {
+    throw new chunkJ7J7J2GN_cjs.NetworkError(`${providerId} ${endpoint} returned no data`, {
       code: "embedding_invalid_response",
       metadata: {
         provider: providerId,
@@ -187,13 +201,10 @@ function isRetryable(status) {
 function hashKey(model, text) {
   return crypto.createHash("sha256").update(`${model} ${text}`).digest("hex");
 }
-function linearBackoffMs(attempt) {
-  return 50 * attempt;
-}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
 exports.createOpenAiCompatibleRuntime = createOpenAiCompatibleRuntime;
-//# sourceMappingURL=chunk-KQ7TS7WW.cjs.map
-//# sourceMappingURL=chunk-KQ7TS7WW.cjs.map
+//# sourceMappingURL=chunk-D6POWE7E.cjs.map
+//# sourceMappingURL=chunk-D6POWE7E.cjs.map