@theokit/sdk 4.63.4 → 5.0.0-next.2

package/dist/chunk-UU36SHFY.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/persistence/file-lock.ts","../src/internal/persistence/jsonl.ts"],"names":["diag","withCwdMutex","readFileSync","path","mkdirSync","dirname","openSync","writeSync","closeSync","fstatSync","readSync"],"mappings":";;;;;;;;AAiCA,IAAI,MAAA;AACJ,IAAI,aAAA,GAAgB,KAAA;AACpB,IAAI,gBAAA,GAAmB,KAAA;AAEvB,IAAI,WAAA;AAGJ,SAAS,eAAe,GAAA,EAAuB;AAC7C,EAAA,MAAM,OAAQ,GAAA,EAA+C,IAAA;AAC7D,EAAA,OAAO,IAAA,KAAS,0BAA0B,IAAA,KAAS,kBAAA;AACrD;AAgBA,SAAS,wBAAwB,GAAA,EAAsB;AACrD,EAAA,MAAM,WAAA,GACJ,wGAAA;AACF,EAAA,IAAI,cAAA,CAAe,GAAG,CAAA,EAAG;AACvB,IAAA,OAAO,gDAAgD,WAAW,CAAA;AAAA,CAAA;AAAA,EACpE;AACA,EAAA,MAAM,OAAQ,GAAA,EAA+C,IAAA;AAC7D,EAAA,MAAM,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC9D,EAAA,OACE,CAAA,iDAAA,EAAoD,IAAA,KAAS,MAAA,GAAY,CAAA,EAAA,EAAK,MAAA,CAAO,IAAI,CAAC,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,EAAA,EAC/F,MAAM,CAAA,EAAA,EAAK,WAAW,CAAA;AAAA,CAAA;AAG7B;AAOA,eAAe,iBAAA,GAA0D;AACvE,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,OAAO,iBAAiB,CAAA;AAM1C,IAAA,IAAI,CAAC,kBAAA,CAAmB,GAAG,CAAA,EAAG;AAC5B,MAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,QAAA,gBAAA,GAAmB,IAAA;AACnB,QAAAA,sBAAA;AAAA,UACE;AAAA,SAKF;AAAA,MACF;AACA,MAAA,MAAA,GAAS,IAAA;AACT,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,MAAA,GAAS,GAAA;AAAA,EACX,SAAS,GAAA,EAAK;AAGZ,IAAA,WAAA,GAAc,GAAA;AACd,IAAA,MAAA,GAAS,IAAA;AAAA,EACX;AACA,EAAA,OAAO,MAAA;AACT;AAaA,SAAS,mBAAmB,GAAA,EAAuB;AACjD,EAAA,IAAI,QAAQ,IAAA,IAAQ,GAAA,KAAQ,UAAa,OAAO,GAAA,KAAQ,UAAU,OAAO,KAAA;AACzE,EAAA,MAAM,CAAA,GAAI,GAAA;AACV,EAAA,OAAO,OAAO,CAAA,CAAE,IAAA,KAAS,UAAA,IAAc,OAAO,EAAE,MAAA,KAAW,UAAA;AAC7D;AAkEA,eAAsB,YAAA,CACpB,IAAA,EACA,EAAA,EACA,OAAA,EACY;AACZ,EAAA,MAAM,GAAA,GAAM,MAAM,iBAAA,EAAkB;AAEpC,EAAA,IAAI,QAAQ,IAAA,EAAM;AAIhB,IAAA,IAAI,CAAC,aAAA,IAAiB,CAAC,gBAAA,EAAkB;AACvC,MAAA,aAAA,GAAgB,IAAA;AAChB,MAAAA,sBAAA,CAAK,uBAAA,CAAwB,WAAW,CAAC,CAAA;AAAA,IAC3C;AACA,IAAA,OAAOC,8BAAA,CAAa,CAAA,UAAA,EAAa,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA;AAAA,EAC7C;AAOA,EAAA,OAAOA,8BAAA,CAAa,CAAA,UAAA,EAAa,IAAI,CAAA,CAAA,EAAI,YAAY;AACnD,IAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM;AAAA;AAAA,MAEnC,YAAA,EAAc,GAAG,IAAI,CAAA,KAAA,CAAA;AAAA,MACrB,QAAA,EAAU,KAAA;AAAA,MACV,KAAA,EAAO,SAAS,KAAA,IAAS,GAAA;AAAA,MACzB,OAAA,EAAS;AAAA,QACP,OAAA,EAAS,SAAS,OAAA,IAAW,CAAA;AAAA,QAC7B,MAAA,EAAQ,SAAS,WAAA,IAAe,GAAA;AAAA,QAChC,UAAA,EAAY,GAAA;AAAA,QACZ,UAAA,EAAY;AAAA;AACd,KACD,CAAA;AAED,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,EAAA,EAAG;AAAA,IAClB,CAAA,SAAE;AACA,MAAA,MAAM,OAAA,EAAQ;AAAA,IAChB;AAAA,EACF,CAAC,CAAA;AACH;AChNO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EACzC,WAAA,CACE,SACS,IAAA,EACT;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAFJ,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAGT,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AAAA,EAJW,IAAA;AAKb;AAEA,SAAS,cAAc,KAAA,EAAkD;AACvE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGA,SAAS,mBAAmB,IAAA,EAAmD;AAC7E,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,aAAA,CAAc,MAAM,CAAA,GAAI,MAAA,GAAS,MAAA;AAC1C;AAQO,SAAS,SAAA,CACd,IAAA,EACA,IAAA,GASI,EAAC,EACA;AACL,EAAA,MAAM,QAAQC,eAAA,CAAa,IAAA,EAAM,MAAM,CAAA,CAAE,MAAM,IAAI,CAAA;AACnD,EAAA,MAAM,MAAW,EAAC;AAClB,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA,EAAG;AACxC,IAAA,MAAM,aAAa,CAAA,GAAI,CAAA;AACvB,IAAA,MAAM,IAAA,GAAA,CAAQ,KAAA,CAAM,CAAC,CAAA,IAAK,IAAI,IAAA,EAAK;AACnC,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AAGvB,IAAA,MAAM,MAAA,GAAS,SAAA;AAAA,MACb,IAAA;AAAA,MACA,UAAA;AAAA,MACA,IAAA,CAAK,2BAAA,KAAgC,IAAA,IAAQ,UAAA,KAAe,KAAA,CAAM;AAAA,KACpE;AACA,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,GAAA,CAAI,IAAA,CAAK,KAAK,GAAA,GAAM,IAAA,CAAK,IAAI,MAAA,EAAQ,UAAU,IAAK,MAAuB,CAAA;AAAA,EAC7E;AACA,EAAA,OAAO,GAAA;AACT;AASA,SAAS,SAAA,CACP,IAAA,EACA,UAAA,EACA,QAAA,EACqC;AACrC,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,IAAI,UAAU,OAAO,MAAA;AACrB,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,KAAA,EAAQ,UAAU,kBAAkB,UAAU,CAAA;AAAA,EAC1E;AACA,EAAA,IAAI,CAAC,aAAA,CAAc,MAAM,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,eAAA,CAAgB,CAAA,KAAA,EAAQ,UAAU,uBAAuB,UAAU,CAAA;AAAA,EAC/E;AACA,EAAA,OAAO,MAAA;AACT;AAUO,SAAS,WAAA,CAAYC,QAAc,MAAA,EAAuB;AAgB/D,EAAAC,YAAA,CAAUC,YAAA,CAAQF,MAAI,CAAA,EAAG,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AACzD,EAAA,MAAM,MAAA,GAAS,oBAAA,CAAqBA,MAAI,CAAA,GAAI,IAAA,GAAO,EAAA;AASnD,EAAA,MAAM,EAAA,GAAKG,WAAA,CAASH,MAAA,EAAM,GAAA,EAAK,GAAK,CAAA;AACpC,EAAA,IAAI;AACF,IAAAI,YAAA,CAAU,IAAI,CAAA,EAAG,MAAM,GAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC;AAAA,CAAI,CAAA;AAAA,EACtD,CAAA,SAAE;AACA,IAAAC,YAAA,CAAU,EAAE,CAAA;AAAA,EACd;AACF;AAaA,SAAS,qBAAqB,IAAA,EAAuB;AACnD,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,EAAA,GAAKF,WAAA,CAAS,MAAM,GAAG,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAOG,YAAA,CAAU,EAAE,CAAA,CAAE,IAAA;AAC3B,IAAA,IAAI,IAAA,KAAS,GAAG,OAAO,KAAA;AACvB,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC1B,IAAAC,WAAA,CAAS,EAAA,EAAI,GAAA,EAAK,CAAA,EAAG,CAAA,EAAG,OAAO,CAAC,CAAA;AAChC,IAAA,OAAO,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA;AAAA,EACpB,CAAA,SAAE;AACA,IAAAF,YAAA,CAAU,EAAE,CAAA;AAAA,EACd;AACF;AAYO,SAAS,YAAA,CACd,MACA,KAAA,EACa;AACb,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAON,eAAA,CAAa,MAAM,MAAM,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,KAAA,MAAW,OAAA,IAAW,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG;AAEtC,IAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,OAAA,CAAQ,IAAA,EAAM,CAAA;AAChD,IAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,IAAA,MAAM,GAAA,GAAM,MAAM,MAAM,CAAA;AACxB,IAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,EAAG,IAAA,CAAK,IAAI,GAAG,CAAA;AAAA,EAC7D;AACA,EAAA,OAAO,IAAA;AACT","file":"chunk-UU36SHFY.cjs","sourcesContent":["/**\n * Cross-process file lock helper (ADR D61).\n *\n * Uses `proper-lockfile` (optional peer dep) for cross-process locks. When\n * the peer dep is absent, falls back to `withCwdMutex` (in-process only)\n * with a one-shot stderr warning.\n *\n * EC-1 fix: uses a companion `<path>.lock` file with `realpath: false` so\n * `withFileLock` works even when the target `path` does not exist yet.\n * Without this, fresh installs that lock-then-create would crash with ENOENT.\n *\n * @internal\n */\n\nimport { diag } from \"../diagnostics.js\";\nimport { withCwdMutex } from \"./cwd-mutex.js\";\n\ninterface ProperLockfileModule {\n  lock: (file: string, options: ProperLockfileOptions) => Promise<() => Promise<void>>;\n}\n\ninterface ProperLockfileOptions {\n  lockfilePath?: string;\n  realpath?: boolean;\n  stale?: number;\n  retries?: {\n    retries: number;\n    factor?: number;\n    minTimeout?: number;\n    maxTimeout?: number;\n  };\n}\n\nlet cached: ProperLockfileModule | null | undefined;\nlet warnedMissing = false;\nlet warnedStructural = false;\n/** Why the import failed, kept so the warning can report the observation instead of a guess (#174). */\nlet loadFailure: unknown;\n\n/** Node reports a missing module as `ERR_MODULE_NOT_FOUND` (ESM loader) or `MODULE_NOT_FOUND` (CJS). */\nfunction isModuleAbsent(err: unknown): boolean {\n  const code = (err as { code?: unknown } | null | undefined)?.code;\n  return code === \"ERR_MODULE_NOT_FOUND\" || code === \"MODULE_NOT_FOUND\";\n}\n\n/**\n * #174 — build the fallback warning from what actually happened.\n *\n * This used to always read \"proper-lockfile not installed\", because the import was wrapped in a\n * bare `catch` that discarded the error (Unbreakable Rule 8: a swallowed error is the dangerous\n * kind). A consumer whose package WAS installed, declared and resolvable spent a debugging session\n * re-verifying the install, because the message named a cause the code had never checked.\n *\n * Absence is now the only case that claims absence. Every other failure — a broken install, an\n * interop problem, a bundler that rewrote the specifier — reports its own code and message, which\n * is what points at the real cause.\n *\n * @internal\n */\nfunction describeLockLoadFailure(err: unknown): string {\n  const consequence =\n    \"cross-process file lock unavailable — concurrent processes over the same file are NOT serialized.\";\n  if (isModuleAbsent(err)) {\n    return `[theokit-sdk] proper-lockfile not installed; ${consequence} Install with: pnpm add proper-lockfile\\n`;\n  }\n  const code = (err as { code?: unknown } | null | undefined)?.code;\n  const detail = err instanceof Error ? err.message : String(err);\n  return (\n    `[theokit-sdk] proper-lockfile could not be loaded${code !== undefined ? ` (${String(code)})` : \"\"}: ` +\n    `${detail}. ${consequence} The package resolves for the SDK but failed to load — check bundling ` +\n    \"and module-format interop before re-checking the install.\\n\"\n  );\n}\n\n/** Test seam for the message builder — NOT in the public barrel. @internal */\nexport function __TESTING__describeLockLoadFailure(err: unknown): string {\n  return describeLockLoadFailure(err);\n}\n\nasync function getProperLockfile(): Promise<ProperLockfileModule | null> {\n  if (cached !== undefined) return cached;\n  try {\n    const mod = await import(\"proper-lockfile\");\n    // T5.9 — supply-chain hardening: validate the imported module\n    // exposes the API surface we depend on BEFORE caching it. A\n    // tampered or incompatible version that lacks `lock`/`unlock`\n    // functions gets treated as \"not installed\" with an advisory\n    // warning — never silently used.\n    if (!validateLockModule(mod)) {\n      if (!warnedStructural) {\n        warnedStructural = true;\n        diag(\n          \"[theokit-sdk] proper-lockfile: imported module does NOT expose \" +\n            \"the expected `lock`/`unlock` API surface. This may indicate a \" +\n            \"supply-chain compromise or an incompatible major version. \" +\n            \"Falling back to in-process mutex (no cross-process safety). \" +\n            \"Reinstall with: pnpm add proper-lockfile@^11\\n\",\n        );\n      }\n      cached = null;\n      return cached;\n    }\n    cached = mod as ProperLockfileModule;\n  } catch (err) {\n    // #174 — keep WHY. Discarding it here is what made the fallback warning assert a cause it had\n    // never observed, and sent a consumer to re-check an install that was already correct.\n    loadFailure = err;\n    cached = null;\n  }\n  return cached;\n}\n\n/**\n * T5.9 — Structural validation of the dynamically-imported\n * `proper-lockfile` module. Verifies the API surface we depend on\n * (`lock` and `unlock` as functions) is present. Pure function —\n * never throws, never mutates, never performs I/O.\n *\n * Exported via `__TESTING__validateLockModule` seam so unit tests\n * can drive the check without spinning up the dynamic import.\n *\n * @internal\n */\nfunction validateLockModule(mod: unknown): boolean {\n  if (mod === null || mod === undefined || typeof mod !== \"object\") return false;\n  const m = mod as Record<string, unknown>;\n  return typeof m.lock === \"function\" && typeof m.unlock === \"function\";\n}\n\n/**\n * T5.9 — Test seam: expose the structural validator for unit tests.\n * NOT included in the public barrel.\n *\n * @internal\n */\nexport function __TESTING__validateLockModule(mod: unknown): boolean {\n  return validateLockModule(mod);\n}\n\n/**\n * T5.9 — Test seam: reset the module cache + warning flags between\n * tests so each test starts fresh. NOT included in the public barrel.\n *\n * @internal\n */\nexport function __TESTING__resetFileLockCache(): void {\n  cached = undefined;\n  warnedMissing = false;\n  warnedStructural = false;\n  loadFailure = undefined;\n}\n\n/**\n * Retry and staleness tuning for `withFileLock`.\n *\n * Every field is optional and the defaults are applied per call, so `undefined` means the default\n * rather than \"no limit\". They are handed to `proper-lockfile` and have NO effect on the fallback\n * path: when that package is absent, `withFileLock` degrades to the in-process mutex, which\n * queues indefinitely and never goes stale.\n *\n * `stale` (default 30000 ms) is how old a lock file must be before it is treated as abandoned by a\n * dead process and broken. Setting it below the longest a legitimate holder can run is what turns\n * a slow operation into two concurrent ones.\n *\n * `retries` (default 5) is the number of acquisition attempts AFTER the first, and `retryFactor`\n * (default 1.5) the backoff multiplier between them. The per-attempt wait is clamped to\n * 100–5000 ms, which the caller cannot change. Exhausting the retries rejects — it does not fall\n * through to running `fn` unlocked.\n *\n * @public — re-exported from the semver-protected `@theokit/sdk/persistence` barrel, and (for\n * back-compat) from the semver-exempt `@theokit/sdk/internal/persistence` alias.\n */\nexport interface FileLockOptions {\n  /** Stale lock timeout in ms. Default 30_000 (30s). */\n  stale?: number;\n  /** Max retries on busy lock. Default 5. */\n  retries?: number;\n  /** Backoff factor between retries. Default 1.5. */\n  retryFactor?: number;\n}\n\n/**\n * Run `fn` while holding an OS-level cross-process lock on `path`.\n *\n * If `proper-lockfile` is installed, uses it with a companion `<path>.lock`\n * file (`realpath: false`, so target file does NOT need to exist yet).\n * Otherwise falls back to in-process `withCwdMutex` and prints a one-shot\n * stderr warning telling the user to install `proper-lockfile` for\n * cross-process safety.\n *\n * The lock is released even when `fn` throws.\n *\n */\nexport async function withFileLock<T>(\n  path: string,\n  fn: () => Promise<T>,\n  options?: FileLockOptions,\n): Promise<T> {\n  const lib = await getProperLockfile();\n\n  if (lib === null) {\n    // #174 — stay silent when the structural check already explained itself. Emitting \"not\n    // installed\" on top of \"does not expose lock/unlock\" would be two contradictory diagnoses of\n    // one failure, and the reader has no way to tell which is true.\n    if (!warnedMissing && !warnedStructural) {\n      warnedMissing = true;\n      diag(describeLockLoadFailure(loadFailure));\n    }\n    return withCwdMutex(`file-lock:${path}`, fn);\n  }\n\n  // proper-lockfile errors immediately on same-process concurrent acquire\n  // (\"Lock file is already being held\"). Wrap with cwd-mutex first so\n  // in-process callers queue and only ONE thread at a time enters the\n  // cross-process acquire path. Combined: full in-process + cross-process\n  // serialization.\n  return withCwdMutex(`file-lock:${path}`, async () => {\n    const release = await lib.lock(path, {\n      // EC-1: companion lockfile, target path may not exist yet.\n      lockfilePath: `${path}.lock`,\n      realpath: false,\n      stale: options?.stale ?? 30_000,\n      retries: {\n        retries: options?.retries ?? 5,\n        factor: options?.retryFactor ?? 1.5,\n        minTimeout: 100,\n        maxTimeout: 5_000,\n      },\n    });\n\n    try {\n      return await fn();\n    } finally {\n      await release();\n    }\n  });\n}\n\n/**\n * Test helper — resets the cached proper-lockfile module + warning flag.\n * Allows tests to simulate \"module absent\" by clearing cache then\n * monkey-patching the dynamic import resolution.\n *\n * @internal\n */\nexport function _resetFileLockCacheForTesting(): void {\n  cached = undefined;\n  warnedMissing = false;\n}\n","/**\n * Durable JSONL primitives shared by the eval harness (M6).\n *\n * - `loadJsonl` — generic dataset reader (split/trim/skip-blank/parse) with a\n *   line-numbered {@link JsonlParseError}. The dataset SCHEMA is the caller's\n *   concern via `map` (M6 ADR D3) — this module owns only the parse.\n * - `appendJsonl` / `readJsonlIds` — crash-durable, resumable batch persistence\n *   (M6 ADR D1): each record is appended as one whole `\\n`-terminated line the\n *   instant it is produced, and a re-run resumes by skipping already-keyed rows.\n *\n * reference: knowledge-base/references/theocode-eval/lib/swebench-dataset.ts:82\n * (parseJsonl + line-N error) and swebench-batch.ts:113,205 (resume + per-line\n * flush).\n *\n * @internal\n */\nimport {\n  closeSync,\n  fstatSync,\n  mkdirSync,\n  openSync,\n  readFileSync,\n  readSync,\n  writeSync,\n} from \"node:fs\";\nimport { dirname } from \"node:path\";\n\n/** Raised when a JSONL line is not valid JSON or is not a JSON object. Carries the 1-based line number. */\nexport class JsonlParseError extends Error {\n  constructor(\n    message: string,\n    readonly line: number,\n  ) {\n    super(message);\n    this.name = \"JsonlParseError\";\n  }\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** Parse a single trimmed line to a plain object, or `undefined` if blank / invalid / non-object. */\nfunction tryParseObjectLine(line: string): Record<string, unknown> | undefined {\n  if (line.length === 0) return undefined;\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(line);\n  } catch {\n    return undefined;\n  }\n  return isPlainObject(parsed) ? parsed : undefined;\n}\n\n/**\n * Parse a JSONL file into rows. Blank lines are skipped. A malformed or\n * non-object line throws {@link JsonlParseError} naming the 1-based line. When\n * `map` is provided, each raw object is mapped to the typed row (the SWE-bench\n * schema lives in the caller's `map`, per M6 ADR D3).\n */\nexport function loadJsonl<T = Record<string, unknown>>(\n  path: string,\n  opts: {\n    map?: (raw: Record<string, unknown>, lineNumber: number) => T;\n    /**\n     * M81 — tolerate a truncated LAST line (a crash artifact: the process died mid-write).\n     *\n     * Opt-in on purpose. As a default it would also swallow corruption in the MIDDLE of the file,\n     * turning loud data loss into silent data loss — the wrong trade for a session store.\n     */\n    tolerateTrailingPartialLine?: boolean;\n  } = {},\n): T[] {\n  const lines = readFileSync(path, \"utf8\").split(\"\\n\");\n  const out: T[] = [];\n  for (let i = 0; i < lines.length; i += 1) {\n    const lineNumber = i + 1;\n    const line = (lines[i] ?? \"\").trim();\n    if (line.length === 0) continue;\n    // M81 — `undefined` = a tolerated invalid line (the last one, truncated by a crash). Any other\n    // invalid line has already thrown inside `parseLine`.\n    const parsed = parseLine(\n      line,\n      lineNumber,\n      opts.tolerateTrailingPartialLine === true && lineNumber === lines.length,\n    );\n    if (parsed === undefined) break;\n    out.push(opts.map ? opts.map(parsed, lineNumber) : (parsed as unknown as T));\n  }\n  return out;\n}\n\n/**\n * Parses ONE line, returning `undefined` when it is a tolerated truncated last line.\n *\n * Extracted because `loadJsonl` went over the cognitive-complexity ceiling once it gained the\n * tolerance — and because parsing a line and iterating a file are two responsibilities that were\n * only together out of habit.\n */\nfunction parseLine(\n  line: string,\n  lineNumber: number,\n  tolerate: boolean,\n): Record<string, unknown> | undefined {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(line);\n  } catch {\n    if (tolerate) return undefined;\n    throw new JsonlParseError(`line ${lineNumber}: invalid JSON`, lineNumber);\n  }\n  if (!isPlainObject(parsed)) {\n    throw new JsonlParseError(`line ${lineNumber}: not a JSON object`, lineNumber);\n  }\n  return parsed;\n}\n\n/**\n * Append one record as a whole `\\n`-terminated JSON line. Creates the parent dir\n * if missing. `appendFileSync` is synchronous, so within a single Node process\n * the event loop serializes writes and each call writes its line atomically —\n * interleave-safe for the bounded-concurrency batch runner.\n *\n * reference: swebench-batch.ts:192 (mkdir-before-append), :205 (per-line flush).\n */\nexport function appendJsonl(path: string, record: unknown): void {\n  // T2.4 — `0o700` for the same reason the file below is `0o600`, and it is the half M93 missed. A\n  // private file inside a group-writable directory can be replaced wholesale, and the replacement's\n  // mode is whatever the writer chose. Under `umask 002` this directory was born `0775`.\n  //\n  // The directory sits under `~/.theokit`, shared with the credential and trust stores, and the\n  // framework already wrote the diagnosis while fixing a sibling (`@theokit/agents\n  // config/trust-store.ts:157-161`): the mode argument is a no-op on a directory that already\n  // exists, \"and this one is shared with the SDK's transcript root — whoever creates it first sets\n  // the permissions\". Whoever creates it first is usually THIS function, because a session writes a\n  // transcript before it ever touches a credential. So `assertSecureModes` was not wrong to demand a\n  // private directory; this path was wrong to produce one that fails it, depending on run order.\n  //\n  // Creation-time only, deliberately: repairing a pre-existing directory means `stat` + `chmod` on\n  // every append, and this is the hot path of every session. The pre-existing case is what\n  // `assertSecureModes` is for.\n  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });\n  const prefix = needsLineBreakBefore(path) ? \"\\n\" : \"\";\n  // M93 (adversarial review, H1) — `0o600`. `appendFileSync` takes no `mode`, so the permission came\n  // from the umask: under `umask 022` the transcript was born `0664`, world-readable. The previous\n  // path (`replaceFileAtomic`) pinned `0o600` on purpose — \"holds the FULL in-flight content\n  // (credential snapshots, OAuth tokens)\" (`atomic-write.ts:107`) — and switching to append lost\n  // that silently. The same class had already been caught in the consumer (`atomic-sync.ts`, M88\n  // HIGH-1).\n  //\n  // `mode` only applies on CREATION; a pre-existing file keeps whatever permission it already has.\n  const fd = openSync(path, \"a\", 0o600);\n  try {\n    writeSync(fd, `${prefix}${JSON.stringify(record)}\\n`);\n  } finally {\n    closeSync(fd);\n  }\n}\n\n/**\n * Does the file end without a `\\n`? Then the last line is truncated — a crash mid-append.\n *\n * Without this check the next append **glues** itself onto the middle of the broken line, producing\n * an invalid line the reader discards: the NEW record disappears along with the partial one. The\n * previous path (read-modify-write) self-healed from this because it rewrote the whole file.\n * Measured in M93's adversarial review (H2): after an append over a truncated file, the\n * just-written record was no longer readable.\n *\n * Reads **one byte**, not the file.\n */\nfunction needsLineBreakBefore(path: string): boolean {\n  let fd: number;\n  try {\n    fd = openSync(path, \"r\");\n  } catch {\n    return false; // the file does not exist yet: nothing to splice onto\n  }\n  try {\n    const size = fstatSync(fd).size;\n    if (size === 0) return false;\n    const buf = Buffer.alloc(1);\n    readSync(fd, buf, 0, 1, size - 1);\n    return buf[0] !== 0x0a;\n  } finally {\n    closeSync(fd);\n  }\n}\n\n/**\n * Read the set of keys from an existing JSONL file for which `keyFn(parsed)`\n * returns a non-empty string. Used to resume a crashed batch by skipping rows\n * already persisted with a successful result. A trailing partial line from an\n * interrupted append is tolerated (skipped, not thrown), and a missing file\n * yields an empty set.\n *\n * reference: swebench-batch.ts:113 (readDoneIds), :129 (success-only),\n * :131 (tolerate partial line).\n */\nexport function readJsonlIds(\n  path: string,\n  keyFn: (parsed: Record<string, unknown>) => string | undefined,\n): Set<string> {\n  const done = new Set<string>();\n  let text: string;\n  try {\n    text = readFileSync(path, \"utf8\");\n  } catch {\n    return done; // no file yet → nothing done\n  }\n  for (const rawLine of text.split(\"\\n\")) {\n    // A trailing partial line from an interrupted run parses to undefined → skipped.\n    const parsed = tryParseObjectLine(rawLine.trim());\n    if (parsed === undefined) continue;\n    const key = keyFn(parsed);\n    if (typeof key === \"string\" && key.length > 0) done.add(key);\n  }\n  return done;\n}\n"]}

package/dist/chunk-V2BOS4WF.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/security/path-guard.ts"],"names":["ConfigurationError","atOrInsideRoot","resolve","path","realpathSync","lstatSync","readlinkSync","dirname","createHash"],"mappings":";;;;;;;;AAgCO,IAAM,kBAAA,GAAN,cAAiCA,oCAAA,CAAmB;AAAA,EACvC,IAAA,GAAe,oBAAA;AAAA,EAEjC,WAAA,CAAY,OAAe,YAAA,EAAsB;AAC/C,IAAA,KAAA,CAAM,CAAA,wBAAA,EAA2B,KAAK,CAAA,QAAA,EAAM,YAAY,CAAA,CAAA,EAAI;AAAA,MAC1D,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACF;AAYO,IAAM,kBAAA,GAAN,cAAiCA,oCAAA,CAAmB;AAAA,EACvC,IAAA,GAAe,oBAAA;AAAA,EAEjC,YAAY,IAAA,EAAc;AACxB,IAAA,KAAA;AAAA,MACE,SAAS,IAAI,CAAA,qFAAA,CAAA;AAAA,MACb;AAAA,QACE,IAAA,EAAM;AAAA;AACR,KACF;AAAA,EACF;AACF;AAeA,SAAS,QAAA,CAAS,QAAgB,IAAA,EAAuB;AASvD,EAAA,OAAOC,gCAAA,CAAe,QAAQ,IAAI,CAAA;AACpC;AAUO,SAAS,YAAA,CAAa,SAAiB,KAAA,EAAyB;AACrE,EAAA,IAAI,SAAS,EAAA,EAAI;AACf,IAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,EACxD;AAKA,EAAA,wBAAA,CAAyB,MAAM,MAAM,CAAA;AACrC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,wBAAA,CAAyB,MAAM,cAAc,CAAA;AAAA,EAC/C;AACA,EAAA,MAAM,YAAA,GAAeC,aAAQ,IAAI,CAAA;AACjC,EAAA,MAAM,MAAA,GAASA,YAAA,CAAQ,IAAA,EAAM,GAAG,KAAK,CAAA;AACrC,EAAA,IAAI,CAAC,QAAA,CAAS,MAAA,EAAQ,YAAY,CAAA,EAAG;AACnC,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,CAAM,IAAA,CAAK,GAAG,GAAG,MAAM,CAAA;AAAA,EACtD;AACA,EAAA,OAAO,MAAA;AACT;AAeA,SAAS,sBAAsB,KAAA,EAAmC;AAChE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,UAAA,CAAW,CAAC,CAAA;AAC/B,IAAA,IAAI,SAAS,CAAA,IAAS,IAAA,IAAQ,KAAQ,IAAA,IAAQ,EAAA,IAAS,SAAS,GAAA,EAAM;AACpE,MAAA,OAAO,SAAS,CAAA,GAAO,YAAA,GAAe,mBAAmB,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA,CAAA,CAAA;AAAA,IAC5E;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAQA,SAAS,wBAAA,CAAyB,OAAe,IAAA,EAAoB;AACnE,EAAA,MAAM,KAAA,GAAQ,sBAAsB,KAAK,CAAA;AACzC,EAAA,IAAI,KAAA,KAAU,MAAA,EAAW,MAAM,IAAI,kBAAA,CAAmB,GAAG,IAAI,CAAA,EAAA,EAAK,KAAK,CAAA,CAAA,EAAI,KAAK,CAAA;AAClF;AAmBO,SAAS,qBAAA,CAAsBC,QAAc,IAAA,EAAoB;AAItE,EAAA,wBAAA,CAAyBA,QAAM,MAAM,CAAA;AACrC,EAAA,wBAAA,CAAyB,MAAM,MAAM,CAAA;AAErC,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAeC,gBAAa,IAAI,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AAEN,IAAA,YAAA,GAAeF,aAAQ,IAAI,CAAA;AAAA,EAC7B;AAQA,EAAA,MAAM,QAAA,GAAW,0BAA0BC,MAAI,CAAA;AAC/C,EAAA,IAAI,aAAa,MAAA,EAAW;AAE5B,EAAA,IAAI,CAAC,QAAA,CAAS,QAAA,EAAU,YAAY,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,QAAA,EAAWA,MAAI,IAAI,QAAQ,CAAA;AAAA,EAC1D;AACF;AAUA,SAAS,0BAA0BA,MAAA,EAAkC;AAEnE,EAAA,IAAI;AACF,IAAA,OAAOC,gBAAaD,MAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AAAA,EAER;AAGA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAcE,aAAUF,MAAI,CAAA;AAClC,IAAA,IAAI,IAAA,CAAK,gBAAe,EAAG;AACzB,MAAA,MAAM,MAAA,GAASG,gBAAaH,MAAI,CAAA;AAGhC,MAAA,MAAM,UAAA,GAAa,yBAAA,CAA0BI,YAAA,CAAQJ,MAAI,CAAC,CAAA;AAC1D,MAAA,MAAM,UAAA,GAAa,UAAA,IAAcI,YAAA,CAAQJ,MAAI,CAAA;AAC7C,MAAA,OAAOD,YAAA,CAAQ,YAAY,MAAM,CAAA;AAAA,IACnC;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAIA,EAAA,IAAI,MAAA,GAASK,aAAQJ,MAAI,CAAA;AACzB,EAAA,IAAI,MAAA,GAASA,MAAA,CAAK,KAAA,CAAM,MAAA,CAAO,MAAM,CAAA;AACrC,EAAA,OAAO,MAAA,KAAWI,YAAA,CAAQ,MAAM,CAAA,EAAG;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAOH,gBAAa,MAAM,CAAA;AAEhC,MAAA,OAAOF,YAAA,CAAQ,IAAA,EAAM,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IACnC,CAAA,CAAA,MAAQ;AACN,MAAA,MAAA,GAASC,MAAA,CAAK,KAAA,CAAMI,YAAA,CAAQ,MAAM,EAAE,MAAM,CAAA;AAC1C,MAAA,MAAA,GAASA,aAAQ,MAAM,CAAA;AAAA,IACzB;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,IAAM,UAAA,uBAAiB,GAAA,CAAI,CAAC,kBAAkB,mBAAA,EAAqB,WAAA,EAAa,WAAW,CAAC,CAAA;AAM5F,IAAM,wBAAA,uBAA+B,GAAA,CAAI;AAAA,EACvC,MAAA;AAAA,EACA,MAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAID,IAAM,mBAAA,uBAA0B,GAAA,CAAI;AAAA,EAClC,QAAA;AAAA,EACA,YAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,aAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAID,IAAM,kBAAA,GAAqB,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,MAAM,CAAA;AAuBnD,SAAS,gBAAgB,KAAA,EAAwB;AAKtD,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,GAAG,EAAE,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA,CAAE,WAAA,EAAY;AAC9E,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAEpC,EAAA,MAAM,QAAA,GAAW,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,CAAE,OAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AACjE,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAElC,EAAA,IAAI,uBAAA,CAAwB,QAAA,CAAS,CAAC,CAAE,GAAG,OAAO,IAAA;AAClD,EAAA,IAAI,oBAAoB,QAAA,CAAS,QAAA,CAAS,SAAS,CAAC,CAAE,GAAG,OAAO,IAAA;AAChE,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,wBAAwB,KAAA,EAAwB;AAEvD,EAAA,IAAI,KAAA,KAAU,gBAAgB,OAAO,KAAA;AACrC,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,IAAA;AAC7B,EAAA,IAAI,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,IAAA;AACnC,EAAA,IAAI,UAAU,MAAA,IAAU,KAAA,KAAU,cAAA,IAAkB,KAAA,KAAU,SAAS,OAAO,IAAA;AAC9E,EAAA,OAAO,wBAAA,CAAyB,IAAI,KAAK,CAAA;AAC3C;AAEA,SAAS,oBAAoB,QAAA,EAA2B;AACtD,EAAA,IAAI,UAAA,CAAW,GAAA,CAAI,QAAQ,CAAA,EAAG,OAAO,IAAA;AACrC,EAAA,IAAI,mBAAA,CAAoB,GAAA,CAAI,QAAQ,CAAA,EAAG,OAAO,IAAA;AAC9C,EAAA,KAAA,MAAW,UAAU,kBAAA,EAAoB;AACvC,IAAA,IAAI,QAAA,CAAS,QAAA,CAAS,MAAM,CAAA,EAAG,OAAO,IAAA;AAAA,EACxC;AACA,EAAA,OAAO,KAAA;AACT;AAEA,IAAM,kBAAA,GAAqB,yBAAA;AA0BpB,SAAS,qBAAqB,KAAA,EAAqB;AACxD,EAAA,wBAAA,CAAyB,KAAK,CAAA;AAC9B,EAAA,MAAM,UAAA,GAAa,mBAAmB,KAAK,CAAA;AAC3C,EAAA,qBAAA,CAAsB,OAAO,UAAU,CAAA;AACzC;AAEA,SAAS,yBAAyB,KAAA,EAAqB;AACrD,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,IAAM,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,YAAY,CAAA;AAAA,EAClD;AACA,EAAA,IAAI,MAAM,UAAA,CAAW,GAAG,KAAK,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,EAAG;AAClD,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,EAC3C;AACA,EAAA,IAAI,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,EAC3C;AACF;AAEA,SAAS,mBAAmB,KAAA,EAAuB;AAGjD,EAAA,IAAI,OAAA,GAAU,KAAA;AACd,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,KAAK,CAAA,EAAG;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,GAAO,mBAAmB,OAAO,CAAA;AACvC,MAAA,IAAI,SAAS,OAAA,EAAS;AACtB,MAAA,OAAA,GAAU,IAAA;AAAA,IACZ,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,0BAA0B,CAAA;AAAA,IAChE;AAAA,EACF;AAEA,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AACnC;AAEA,SAAS,qBAAA,CAAsB,OAAe,UAAA,EAA0B;AACtE,EAAA,KAAA,MAAW,OAAA,IAAW,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA,EAAG;AAC3C,IAAA,IAAI,OAAA,KAAY,IAAA,IAAQ,OAAA,KAAY,OAAA,EAAS;AAC3C,MAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,UAAU,CAAA;AAAA,IAChD;AAAA,EACF;AAEA,EAAA,IAAI,UAAA,CAAW,QAAA,CAAS,IAAI,CAAA,EAAG;AAC7B,IAAA,MAAM,IAAI,kBAAA,CAAmB,KAAA,EAAO,UAAU,CAAA;AAAA,EAChD;AACF;AAuBO,SAAS,kBAAA,CAAmB,OAAe,OAAA,EAAuC;AACvF,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,EAAA;AAClC,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,SAAS,MAAA,EAAQ;AAC/C,IAAA,MAAM,IAAIP,oCAAA,CAAmB,CAAA,kCAAA,EAAqC,MAAM,CAAA,IAAA,EAAO,KAAK,CAAA,CAAA,CAAA,EAAK;AAAA,MACvF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAWA,EAAA,MAAM,WAAA,GAAc,sBAAsB,KAAK,CAAA;AAC/C,EAAA,IAAI,gBAAgB,MAAA,EAAW;AAC7B,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,oBAAA,EAAuB,WAAW,CAAA,GAAA,EAAM,KAAK,CAAA,CAAA,CAAA,EAAK;AAAA,MAC7E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,IAAI,CAAC,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AACnC,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,yCAAA,EAA4C,KAAK,CAAA,CAAA,CAAA,EAAK;AAAA,MACjF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,MAAM,WAAA,EAAY;AAC3B;AAwBO,SAAS,iBAAA,CAAkB,IAAY,OAAA,EAAuC;AACnF,EAAA,IAAI,EAAA,CAAG,WAAW,CAAA,EAAG;AACnB,IAAA,MAAM,IAAIA,qCAAmB,wCAAA,EAA0C;AAAA,MACrE,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,MAAA,GAAS,SAAS,MAAA,IAAU,GAAA;AAClC,EAAA,MAAM,KAAA,GAAQ,GAAG,WAAA,EAAY;AAC7B,EAAA,IAAI,MAAM,MAAA,IAAU,MAAA,IAAU,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5D,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,CAAA,EAAA,EAAKQ,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,EAAE,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AACxE","file":"chunk-V2BOS4WF.cjs","sourcesContent":["/**\n * Canonical path-guard module (ADRs D79-D81).\n *\n * Three primitives + one typed error:\n *   - `safePathJoin(base, ...parts)` — resolve THEN prefix-check (ADR D80).\n *   - `assertNoSymlinkEscape(path, base)` — `realpathSync` resolves entire\n *     symlink chain (EC-1 fix; Hermes v0.2 #386, #61).\n *   - `sanitizeIdentifier(input, { maxLen })` — strict grammar\n *     `^[a-z0-9][a-z0-9-_]*$` (ADR D81; case-insensitive on input,\n *     lowercase on output).\n *   - `PathTraversalError` — extends ConfigurationError with code\n *     `path_traversal` (ADR D65: no new hierarchy).\n *\n * Wire at all sites where user input becomes a path. CI lint gate\n * `tests/lint/no-unguarded-path-input.test.ts` prevents regression\n * (ADR D85).\n *\n * @internal\n */\n\nimport { createHash } from \"node:crypto\";\nimport { lstatSync, readlinkSync, realpathSync, type Stats } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\n\nimport { ConfigurationError } from \"../../errors.js\";\nimport { atOrInsideRoot } from \"../runtime/context/path-containment.js\";\n\n/**\n * Thrown when a path operation would escape its allowed base directory.\n * Extends `ConfigurationError` (no new error hierarchy per ADR D65).\n *\n */\nexport class PathTraversalError extends ConfigurationError {\n  override readonly name: string = \"PathTraversalError\";\n\n  constructor(input: string, resolvedPath: string) {\n    super(`Path traversal attempt: ${input} → ${resolvedPath}`, {\n      code: \"path_traversal\",\n    });\n  }\n}\n\n/**\n * Thrown when an agent tool is asked to read or write a sensitive path\n * that the blocklist forbids (`.env`, `.git/`, `node_modules/`, `.theo/`,\n * lock files). Distinct from `PathTraversalError` because the path is\n * lexically inside the project — it is just sensitive.\n *\n * Extends `ConfigurationError` (no new error hierarchy per ADR D65).\n *\n * @public\n */\nexport class ForbiddenPathError extends ConfigurationError {\n  override readonly name: string = \"ForbiddenPathError\";\n\n  constructor(path: string) {\n    super(\n      `Path '${path}' is in the sensitive-file blocklist (.env, .git/, node_modules/, .theo/, lock files)`,\n      {\n        code: \"forbidden_path\",\n      },\n    );\n  }\n}\n\n/**\n * Is `target` the same as `base`, or strictly under it?\n *\n * The prefix must not double the separator. `resolve` strips a trailing `sep` from every base\n * EXCEPT the filesystem root, where `resolve(sep) === sep`; there `base + sep` would be `//`, which\n * no absolute path starts with, so a root base rejected EVERY path (#149). Only the root takes that\n * branch — for any other base the prefix is unchanged, so containment is not weakened.\n *\n * Both containment checks in this module go through here: they had the same defect and were fixed\n * one at a time, which is exactly how the two drifted apart in the first place.\n *\n * Both arguments MUST already be resolved absolute paths.\n */\nfunction isInside(target: string, base: string): boolean {\n  // B-117 — compared after symlink resolution, via the shared rule. A prefix test judges a link by\n  // its NAME: `<base>/link/x` where `link` points outside is lexically inside and physically not.\n  // Measured reachable from the plugin manager and the MCP client before this was changed.\n  //\n  // The root itself stays allowed, which `insideRoot` alone does not answer: it returns false for\n  // `target === base` (correct for its own caller, wrong here, where `safePathJoin(base)` with no\n  // parts must return `base`). Kept as an explicit second clause rather than by weakening the\n  // shared rule for everyone.\n  return atOrInsideRoot(target, base);\n}\n\n/**\n * Join `base` with `...parts` and ensure the resolved absolute path stays\n * under `base`. Resolves FIRST, then prefix-checks (ADR D80) — prevents\n * normalized-escape bypasses like `subdir/.\\\\./bar`.\n *\n * Returns the safe absolute path. Throws `PathTraversalError` if escape.\n *\n */\nexport function safePathJoin(base: string, ...parts: string[]): string {\n  if (base === \"\") {\n    throw new Error(\"safePathJoin: base must be non-empty\");\n  }\n  // T5.5 — NUL byte + C0/DEL control char rejection at the boundary.\n  // Apply before path resolution so a malicious input never reaches\n  // `resolve` (which on some platforms behaved unexpectedly with NUL\n  // and in N-API callers historically silently truncated).\n  rejectNulAndControlChars(base, \"base\");\n  for (const part of parts) {\n    rejectNulAndControlChars(part, \"path segment\");\n  }\n  const baseResolved = resolve(base);\n  const target = resolve(base, ...parts);\n  if (!isInside(target, baseResolved)) {\n    throw new PathTraversalError(parts.join(\"/\"), target);\n  }\n  return target;\n}\n\n/**\n * T5.5 — the operator-legible label for the first NUL (`\\x00`), C0 control char (`\\x01-\\x1F`) or\n * DEL (`\\x7F`) in `input`, or `undefined` when it carries none. Centralizes the scan so every\n * public path-guard / sanitize entrypoint shares one definition of \"control character\".\n *\n * Detection is separated from the throw so the two callers can share the scan and the precise\n * diagnostic while each raising the error ITS OWN contract documents (#368) — a path guard reports\n * a traversal, an identifier validator reports an invalid identifier. Before that split both threw\n * `PathTraversalError`, which made an identifier validator's error class depend on the bytes of the\n * input it was handed.\n *\n * @internal\n */\nfunction firstControlCharLabel(input: string): string | undefined {\n  for (let i = 0; i < input.length; i++) {\n    const code = input.charCodeAt(i);\n    if (code === 0x00 || (code >= 0x01 && code <= 0x1f) || code === 0x7f) {\n      return code === 0x00 ? \"<nul-byte>\" : `<control-char-0x${code.toString(16)}>`;\n    }\n  }\n  return undefined;\n}\n\n/**\n * Reject any path-shaped input carrying a NUL or control character, as `PathTraversalError` — the\n * same shape as every other path-shape rejection, so callers do not learn a second error class.\n *\n * @internal\n */\nfunction rejectNulAndControlChars(input: string, role: string): void {\n  const label = firstControlCharLabel(input);\n  if (label !== undefined) throw new PathTraversalError(`${role}: ${input}`, label);\n}\n\n/**\n * Assert that `path` — including every directory component in the chain —\n * stays under `base` after symlink resolution. No-op when nothing on the\n * path exists yet.\n *\n * Two-bug history:\n *   1. **EC-1** (original fix, kept): a multi-level symlink chain A → B → C\n *      must be resolved end-to-end. `realpathSync` does this in 1 syscall.\n *   2. **Defence-in-depth** (added v1.x): the previous implementation only\n *      called `lstatSync(path)` on the terminal component. If an INTERMEDIATE\n *      directory was a symlink (`base/inner-symlink → /outside`), `lstat` on\n *      `base/inner-symlink/file.txt` followed the symlink and reported the\n *      regular file — escape went undetected. Fix: walk up to the nearest\n *      existing ancestor and `realpath` THAT, then re-attach the suffix and\n *      check the result against the canonical base.\n *\n */\nexport function assertNoSymlinkEscape(path: string, base: string): void {\n  // T5.5 — reject NUL / control chars before any FS call (a NUL byte\n  // in the path used to silently truncate at the C boundary on legacy\n  // libc — defense in depth even on modern Node).\n  rejectNulAndControlChars(path, \"path\");\n  rejectNulAndControlChars(base, \"base\");\n  // Canonical base — symlinks in the base path itself are absorbed once here.\n  let baseResolved: string;\n  try {\n    baseResolved = realpathSync(base);\n  } catch {\n    // base doesn't exist as a real directory yet — fall back to lexical resolve.\n    baseResolved = resolve(base);\n  }\n\n  // Find the deepest ancestor of `path` that exists, then realpath it.\n  // Anything from there onward is \"not yet on disk\" and contributes only\n  // its lexical suffix. This covers three cases:\n  //   - path exists (regular file or symlink at any depth) → realpath the full path\n  //   - path doesn't exist but intermediate dir is a symlink → realpath the ancestor\n  //   - nothing on the path exists → no escape risk (return)\n  const resolved = realpathOfDeepestExisting(path);\n  if (resolved === undefined) return; // path has no existing prefix — nothing to attack\n\n  if (!isInside(resolved, baseResolved)) {\n    throw new PathTraversalError(`symlink ${path}`, resolved);\n  }\n}\n\n/**\n * Find the deepest ancestor of `path` that exists on disk, resolve all\n * symlinks in that ancestor via `realpathSync`, and re-attach the\n * lexical suffix. Returns `undefined` when no ancestor exists.\n *\n * Handles dangling symlinks: if the terminal IS a symlink but its target\n * is missing, we still detect escape via `readlinkSync` + parent resolve.\n */\nfunction realpathOfDeepestExisting(path: string): string | undefined {\n  // First try the full path — the common case.\n  try {\n    return realpathSync(path);\n  } catch {\n    // Not resolvable. Two sub-cases.\n  }\n\n  // Sub-case A: terminal is a dangling symlink.\n  try {\n    const stat: Stats = lstatSync(path);\n    if (stat.isSymbolicLink()) {\n      const target = readlinkSync(path);\n      // Resolve target relative to the REAL parent dir, so intermediate\n      // symlinks in the parent chain are absorbed.\n      const parentReal = realpathOfDeepestExisting(dirname(path));\n      const parentBase = parentReal ?? dirname(path);\n      return resolve(parentBase, target);\n    }\n  } catch {\n    // lstat failed too — terminal doesn't exist at all.\n  }\n\n  // Sub-case B: walk up to the nearest existing ancestor, then re-attach\n  // the suffix lexically.\n  let cursor = dirname(path);\n  let suffix = path.slice(cursor.length);\n  while (cursor !== dirname(cursor)) {\n    try {\n      const real = realpathSync(cursor);\n      // Reconstruct: ancestor's realpath + remaining (still-lexical) suffix\n      return resolve(real, `.${suffix}`);\n    } catch {\n      suffix = path.slice(dirname(cursor).length);\n      cursor = dirname(cursor);\n    }\n  }\n  // Reached filesystem root without finding any existing ancestor.\n  return undefined;\n}\n\nconst LOCK_FILES = new Set([\"pnpm-lock.yaml\", \"package-lock.json\", \"yarn.lock\", \"bun.lockb\"]);\n\n// T5.6 — top-level credential dot-dirs / dot-files. Matching against\n// the FIRST path segment (lowercase). Adding any entry here costs a\n// CHANGELOG note + an explicit case-fold test (entries are lowercased\n// at module load).\nconst SENSITIVE_FIRST_SEGMENTS = new Set([\n  \".ssh\",\n  \".aws\",\n  \".docker\",\n  \".kube\",\n  \".npmrc\",\n  \".netrc\",\n  \".pgpass\",\n]);\n\n// T5.6 — credential basenames blocked at ANY depth (lowercase). Catches\n// the developer-laptop case where an agent recurses into a subdir.\nconst SENSITIVE_BASENAMES = new Set([\n  \"id_rsa\",\n  \"id_ed25519\",\n  \"id_ecdsa\",\n  \"id_dsa\",\n  \"authorized_keys\",\n  \"known_hosts\",\n  \".npmrc\",\n  \".netrc\",\n  \".pgpass\",\n]);\n\n// T5.6 — extension suffixes blocked at ANY depth (lowercase). Covers\n// the entire `*.pem` / `*.key` private-material family.\nconst SENSITIVE_SUFFIXES = [\".pem\", \".key\", \".p12\", \".pfx\"];\n\n/**\n * Decide whether a project-relative path points to a known-sensitive file\n * that a coding agent must not read or write.\n *\n * Universal blocklist (works for any agent operating on a project tree):\n *\n *   - `.env`, `.env.<anything>` — except `.env.example` (template safe to read)\n *   - `.git/` — version control internals\n *   - `node_modules/` — dependency cache (changes don't belong to the user)\n *   - `.theo/` — TheoKit build artefacts / state\n *   - Lock files at any depth: `pnpm-lock.yaml`, `package-lock.json`,\n *     `yarn.lock`, `bun.lockb`\n *\n * Operates on path segments (forward-slash normalized). Cross-platform safe.\n *\n * Use together with `safePathJoin` + `assertNoSymlinkEscape`: the former two\n * defeat traversal, this one defeats reading a file that is lexically inside\n * the project but should not be agent-visible.\n *\n * @public\n */\nexport function isForbiddenPath(input: string): boolean {\n  // T5.6 — lowercase normalization defeats case-only bypass on\n  // case-insensitive filesystems (Windows/macOS-default) where `.ENV`\n  // and `.env` map to the same inode but a case-sensitive string\n  // check passes the former.\n  const normalized = input.replace(/\\\\/g, \"/\").replace(/^\\.\\//, \"\").toLowerCase();\n  if (normalized.length === 0) return false;\n\n  const segments = normalized.split(\"/\").filter((s) => s.length > 0);\n  if (segments.length === 0) return false;\n\n  if (isForbiddenFirstSegment(segments[0]!)) return true;\n  if (isForbiddenBasename(segments[segments.length - 1]!)) return true;\n  return false;\n}\n\nfunction isForbiddenFirstSegment(first: string): boolean {\n  // .env.example is explicitly allowlisted (template safe to read)\n  if (first === \".env.example\") return false;\n  if (first === \".env\") return true;\n  if (/^\\.env\\./.test(first)) return true;\n  if (first === \".git\" || first === \"node_modules\" || first === \".theo\") return true;\n  return SENSITIVE_FIRST_SEGMENTS.has(first);\n}\n\nfunction isForbiddenBasename(basename: string): boolean {\n  if (LOCK_FILES.has(basename)) return true;\n  if (SENSITIVE_BASENAMES.has(basename)) return true;\n  for (const suffix of SENSITIVE_SUFFIXES) {\n    if (basename.endsWith(suffix)) return true;\n  }\n  return false;\n}\n\nconst IDENTIFIER_PATTERN = /^[a-z0-9][a-z0-9\\-_]*$/i;\n\n/**\n * T1.4 — validate a relative artifact path string BEFORE it is used to look\n * up a fixture or to fetch from PaaS. Rejects every well-known traversal\n * vector at the boundary, throwing `PathTraversalError`.\n *\n * Vectors rejected:\n *  - classic `..` parent-directory traversal (any segment).\n *  - backslash separators (Windows-style `..\\\\windows`).\n *  - URL-encoded `%2e%2e` / `%2E%2E` (double-decoded traversal).\n *  - NUL byte injection (`\\x00`).\n *  - Windows drive letter prefix (`C:`, `D:\\\\...`).\n *  - Home-tilde expansion (`~/`, `~root/...`).\n *  - Absolute paths starting with `/`.\n *\n * Does NOT touch the filesystem — the call is shape-only. Live symlink\n * traversal protection happens via `assertNoSymlinkEscape` at the FS-resolve\n * boundary.\n *\n * @param input - Caller-supplied artifact path.\n * @throws `PathTraversalError` on any rejection.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/security` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function validateArtifactPath(input: string): void {\n  rejectKnownPrefixVectors(input);\n  const normalized = decodeAndNormalize(input);\n  rejectParentTraversal(input, normalized);\n}\n\nfunction rejectKnownPrefixVectors(input: string): void {\n  if (input.includes(\"\\x00\")) {\n    throw new PathTraversalError(input, \"<nul-byte>\");\n  }\n  if (input.startsWith(\"/\") || input.startsWith(\"~\")) {\n    throw new PathTraversalError(input, input);\n  }\n  if (/^[A-Za-z]:[\\\\/]?/.test(input)) {\n    throw new PathTraversalError(input, input);\n  }\n}\n\nfunction decodeAndNormalize(input: string): string {\n  // URL-encoded traversal — 2 passes catches `%252e%252e`.\n  // Malformed sequences (decodeURIComponent throws) are themselves a rejection.\n  let decoded = input;\n  for (let i = 0; i < 2; i += 1) {\n    try {\n      const next = decodeURIComponent(decoded);\n      if (next === decoded) break;\n      decoded = next;\n    } catch {\n      throw new PathTraversalError(input, \"<malformed-url-encoding>\");\n    }\n  }\n  // Normalize backslash to forward slash before segment-walking.\n  return decoded.replace(/\\\\/g, \"/\");\n}\n\nfunction rejectParentTraversal(input: string, normalized: string): void {\n  for (const segment of normalized.split(\"/\")) {\n    if (segment === \"..\" || segment === \"..%00\") {\n      throw new PathTraversalError(input, normalized);\n    }\n  }\n  // Defense in depth: literal `..` anywhere in the normalized string.\n  if (normalized.includes(\"..\")) {\n    throw new PathTraversalError(input, normalized);\n  }\n}\n\n/**\n * Validate that `input` is a safe path component (skill name, agent ID,\n * namespace, etc.) and return its lowercase form. Strict grammar\n * `^[a-z0-9][a-z0-9-_]*$` rejects path separators, dots, null bytes,\n * whitespace, unicode invisible chars, and any leading `-`/`_`.\n *\n * ONE error class leaves this function: `ConfigurationError` with code\n * `invalid_identifier`, for every rejection — length out of range, a path\n * separator, `..`, a space, a leading `-`, and a NUL / C0 control char / DEL\n * alike. A caller can branch on that code and know it has covered the whole\n * rejection surface.\n *\n * Before #368 the control-char branch threw `PathTraversalError` instead, which\n * made the error CLASS a function of the attacker's bytes; the message still names\n * the offending byte, which is the part that was worth keeping.\n *\n * @param input - User-supplied identifier candidate.\n * @param options.maxLen - Maximum allowed length (default 64).\n * @returns Lowercase form of `input`.\n * @throws `ConfigurationError` with code `invalid_identifier` on every rejection.\n */\nexport function sanitizeIdentifier(input: string, options?: { maxLen?: number }): string {\n  const maxLen = options?.maxLen ?? 64;\n  if (input.length === 0 || input.length > maxLen) {\n    throw new ConfigurationError(`Identifier length out of range (1-${maxLen}): \"${input}\"`, {\n      code: \"invalid_identifier\",\n    });\n  }\n  // T5.5 — explicit NUL / control char rejection ahead of the generic pattern check. The\n  // IDENTIFIER_PATTERN regex already excludes these (they are not in `[a-z0-9\\-_]`); naming the\n  // offending byte gives operators a precise diagnostic instead of the generic \"invalid characters\"\n  // message, which is what makes a prompt-injection trace legible (Rule 3).\n  //\n  // #368 — the diagnostic used to arrive as a `PathTraversalError`, because the branch reused\n  // `safePathJoin`'s thrower. That made the error CLASS a function of the attacker's bytes: a\n  // caller branching on the documented `invalid_identifier` rethrew for any input carrying a\n  // control char, so a rejection surfaced as a 500 and the 400/500 split became an oracle. The\n  // detection is shared; the error each contract documents is not.\n  const controlChar = firstControlCharLabel(input);\n  if (controlChar !== undefined) {\n    throw new ConfigurationError(`Identifier contains ${controlChar}: \"${input}\"`, {\n      code: \"invalid_identifier\",\n    });\n  }\n  if (!IDENTIFIER_PATTERN.test(input)) {\n    throw new ConfigurationError(`Identifier contains invalid characters: \"${input}\"`, {\n      code: \"invalid_identifier\",\n    });\n  }\n  return input.toLowerCase();\n}\n\n/**\n * Convert ANY opaque id (agent id, run id, conversation id, namespace, email,\n * arbitrary string) into a deterministic, filesystem-safe filename component.\n *\n * Unlike {@link sanitizeIdentifier} (which THROWS on non-conforming input),\n * this is a total function: it NEVER throws on a non-empty string. It returns\n * the lowercased id verbatim when it already matches the safe grammar\n * `^[a-z0-9][a-z0-9-_]*$` and fits `maxLen` (so UUIDs, hashes, and slugs stay\n * human-readable), otherwise a deterministic `h-<16 hex>` sha256 token\n * (collision-resistant and always a valid filename). The output charset is\n * always `[a-z0-9_-]`, safe as a literal path segment on every filesystem.\n *\n * @param id - any opaque identifier (must be a non-empty string)\n * @param options.maxLen - max length for the passthrough branch (default 128).\n *   Ids longer than this are hashed; the hash token itself is always short.\n * @throws ConfigurationError (code `invalid_filename_id`) only on empty input.\n *\n * @example\n *   safeFilenameForId(\"550e8400-e29b-41d4-a716-446655440000\") // passthrough\n *   safeFilenameForId(\"user@example.com\")                      // \"h-<16hex>\"\n *\n */\nexport function safeFilenameForId(id: string, options?: { maxLen?: number }): string {\n  if (id.length === 0) {\n    throw new ConfigurationError(\"Filename id must be a non-empty string\", {\n      code: \"invalid_filename_id\",\n    });\n  }\n  const maxLen = options?.maxLen ?? 128;\n  const lower = id.toLowerCase();\n  if (lower.length <= maxLen && IDENTIFIER_PATTERN.test(lower)) {\n    return lower;\n  }\n  return `h-${createHash(\"sha256\").update(id).digest(\"hex\").slice(0, 16)}`;\n}\n"]}

package/dist/chunk-VCLBZAZU.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/runtime/hooks/hooks-source.ts","../src/internal/personality/context.ts"],"names":["diag","existsSync","join","projectConfigRoots","readFile","ConfigurationError","AsyncLocalStorage"],"mappings":";;;;;;;;;;AAiCA,IAAM,qBAAA,GAA6D;AAAA,EACjE,UAAA,EAAY,YAAA;AAAA,EACZ,WAAA,EAAa,aAAA;AAAA,EACb,gBAAA,EAAkB,QAAA;AAAA,EAClB,IAAA,EAAM;AACR,CAAA;AAqBA,IAAM,MAAA,uBAAa,GAAA,EAAY;AAYxB,SAAS,QAAA,CAAS,KAAa,OAAA,EAAuB;AAC3D,EAAA,IAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,EAAG;AACrB,EAAA,MAAA,CAAO,IAAI,GAAG,CAAA;AACd,EAAAA,sBAAA,CAAK,GAAG,OAAO;AAAA,CAAI,CAAA;AACrB;AAcA,eAAsB,eAAe,GAAA,EAAkC;AACrE,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,oBAAA,CAAqB,GAAG,CAAA,EAAG;AAC5C,IAAA,IAAI,CAACC,aAAA,CAAW,IAAI,CAAA,EAAG;AACvB,IAAA,MAAA,GAAS,IAAA;AAIT,IAAA,SAAA,CAAU,QAAQ,WAAA,CAAY,MAAM,aAAa,IAAI,CAAA,EAAG,IAAI,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,CAAC,UAAUA,aAAA,CAAWC,SAAA,CAAK,KAAK,UAAA,EAAY,OAAO,CAAC,CAAA,EAAG;AACzD,IAAA,QAAA;AAAA,MACE,sBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAaA,SAAS,qBAAqB,GAAA,EAAuB;AACnD,EAAA,MAAM,KAAA,GAAQC,qCAAmB,GAAG,CAAA;AACpC,EAAA,OAAO;AAAA,IACL,GAAG,MAAM,GAAA,CAAI,CAAC,SAASD,SAAA,CAAK,IAAA,EAAM,YAAY,CAAC,CAAA;AAAA,IAC/C,GAAG,MAAM,GAAA,CAAI,CAAC,SAASA,SAAA,CAAK,IAAA,EAAM,eAAe,CAAC,CAAA;AAAA,IAClD,GAAG,MAAM,GAAA,CAAI,CAAC,SAASA,SAAA,CAAK,IAAA,EAAM,qBAAqB,CAAC;AAAA,GAC1D;AACF;AAQA,SAAS,WAAA,CAAY,QAAoB,UAAA,EAAgC;AACvE,EAAA,IAAI,MAAA,CAAO,KAAA,KAAU,MAAA,EAAW,OAAO,MAAA;AACvC,EAAA,MAAM,QAA0C,EAAC;AACjD,EAAA,KAAA,MAAW,CAAC,OAAO,QAAQ,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,EAGtD;AACH,IAAA,IAAI,aAAa,MAAA,EAAW;AAC5B,IAAA,KAAA,CAAM,KAAK,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,CAAC,OAAO,EAAE,UAAA,EAAY,GAAG,CAAA,EAAE,CAAE,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,EAAE,KAAA,EAAM;AACjB;AAWA,SAAS,SAAA,CAAU,QAAoB,MAAA,EAA0B;AAC/D,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,QAAQ,CAAA,IAAK,MAAA,CAAO,QAAQ,MAAA,CAAO,KAAA,IAAS,EAAE,CAAA,EAG5D;AACH,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACrD,IAAA,MAAA,CAAO,UAAU,EAAC;AAClB,IAAA,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,GAAI,CAAC,GAAI,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,IAAK,EAAC,EAAI,GAAG,QAAQ,CAAA;AAAA,EACpE;AACF;AAEA,eAAe,aAAa,QAAA,EAAuC;AACjE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAME,iBAAA,CAAS,QAAA,EAAU,MAAM,CAAA;AAAA,EACvC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAIC,oCAAA,CAAmB,CAAA,6BAAA,EAAgC,QAAQ,CAAA,CAAA,EAAI;AAAA,MACvE,IAAA,EAAM,kBAAA;AAAA,MACN;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,8BAAA,EAAiC,QAAQ,CAAA,CAAA,EAAI;AAAA,MACxE,IAAA,EAAM,oBAAA;AAAA,MACN;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,OAAO,qBAAA,CAAsB,QAAQ,QAAQ,CAAA;AAC/C;AAGA,SAAS,QAAA,CAAS,KAAA,EAAgB,IAAA,EAAc,KAAA,EAAwC;AACtF,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACvE,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,6BAAA,EAAgC,KAAK,CAAA,IAAA,EAAO,IAAI,CAAA,CAAA,EAAI;AAAA,MAC/E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,OAAA,CAAQ,KAAA,EAAgB,IAAA,EAAc,KAAA,EAA0B;AACvE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,4BAAA,EAA+B,KAAK,CAAA,IAAA,EAAO,IAAI,CAAA,CAAA,EAAI;AAAA,MAC9E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAQA,SAAS,qBAAA,CAAsB,KAAc,IAAA,EAA0B;AACrE,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,GAAA,EAAK,IAAA,EAAM,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAW,OAAO,EAAC;AACtC,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,IAAA,CAAK,KAAA,EAAO,MAAM,CAAA,OAAA,CAAS,CAAA;AACrD,EAAA,MAAM,UAAqD,EAAC;AAE5D,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,MAAM,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACxD,IAAA,MAAM,KAAA,GAAQ,sBAAsB,OAAO,CAAA;AAC3C,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,QAAA;AAAA,QACE,eAAe,OAAO,CAAA,CAAA;AAAA,QACtB,CAAA,4BAAA,EAA+B,OAAO,CAAA,8CAAA,EAAiD,MAAA,CAAO,KAAK,qBAAqB,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,iBAAA;AAAA,OACtI;AACA,MAAA;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAA,GAAI,CAAC,GAAI,QAAQ,KAAK,CAAA,IAAK,EAAC,EAAI,GAAG,kBAAA,CAAmB,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,EAC3F;AACA,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC1B;AAGA,SAAS,kBAAA,CAAmB,MAAA,EAAiB,IAAA,EAAc,OAAA,EAAgC;AACzF,EAAA,MAAM,WAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,YAAY,OAAA,CAAQ,MAAA,EAAQ,MAAM,CAAA,MAAA,EAAS,OAAO,EAAE,CAAA,EAAG;AAChE,IAAA,MAAM,QAAQ,QAAA,CAAS,QAAA,EAAU,IAAA,EAAM,CAAA,MAAA,EAAS,OAAO,CAAA,EAAA,CAAI,CAAA;AAC3D,IAAA,MAAM,UAAU,KAAA,CAAM,OAAA,KAAY,SAAY,MAAA,GAAY,MAAA,CAAO,MAAM,OAAO,CAAA;AAC9E,IAAA,KAAA,MAAW,MAAA,IAAU,QAAQ,KAAA,CAAM,KAAA,EAAO,MAAM,CAAA,MAAA,EAAS,OAAO,UAAU,CAAA,EAAG;AAC3E,MAAA,QAAA,CAAS,KAAK,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,IACtE;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAGA,SAAS,sBAAA,CACP,GAAA,EACA,OAAA,EACA,IAAA,EACA,OAAA,EACa;AACb,EAAA,MAAM,MAAM,QAAA,CAAS,GAAA,EAAK,IAAA,EAAM,CAAA,MAAA,EAAS,OAAO,CAAA,UAAA,CAAY,CAAA;AAC5D,EAAA,IAAI,GAAA,CAAI,SAAS,SAAA,EAAW;AAC1B,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,uDAAuD,IAAA,CAAK,SAAA,CAAU,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAA,CAAA;AAAA,MAC3F,EAAE,MAAM,wBAAA;AAAyB,KACnC;AAAA,EACF;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,+CAAA,EAAkD,IAAI,CAAA,CAAA,EAAI;AAAA,MACrF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,MAAM,EAAA,GAAkB,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAQ;AAC/C,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,EAAA,CAAG,OAAA,GAAU,OAAA;AACxC,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,GAAA,CAAI,UAAU,CAAA,EAAG;AACtD,IAAA,EAAA,CAAG,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,UAAU,GAAI,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,EAAA;AACT;;;ACjPA,IAAM,OAAA,GAAU,IAAIC,6BAAA,EAA0C;AAQvD,SAAS,sBAAA,CACd,KACA,EAAA,EACY;AACZ,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,EAAE,CAAA;AAC5B;AAQO,SAAS,yBAAA,GAAgE;AAC9E,EAAA,OAAO,QAAQ,QAAA,EAAS;AAC1B;AASO,SAAS,gCAAgC,OAAA,EAAuB;AACrE,EAAA,QAAA;AAAA,IACE,8BAA8B,OAAO,CAAA,CAAA;AAAA,IACrC,CAAA,0IAAA;AAAA,GACF;AACF","file":"chunk-VCLBZAZU.cjs","sourcesContent":["/**\n * Single source of truth for loading the hooks config (ADR 0016 — reverses\n * D74/D77 for hooks: JSON is canonical again, in the Claude Code shape).\n *\n * `.theokit/hooks.json` (Claude-Code-shaped JSON) is the only supported form.\n * A stray legacy `.theokit/hooks/*.md` dir (no hooks.json) is NOT loaded — it\n * warns to migrate and yields no hooks. Absent both → empty config.\n *\n * Consumed by `hooks-executor.ts` (runtime dispatch).\n *\n * Config shape (identical to Claude Code's `settings.json` hooks):\n *   { \"hooks\": { \"PreToolUse\": [ { \"matcher\": \"shell\",\n *       \"hooks\": [ { \"type\": \"command\", \"command\": \"…\", \"timeout\": 30 } ] } ] } }\n *\n * @internal\n */\n\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { ConfigurationError } from \"../../../errors.js\";\nimport { diag } from \"../../diagnostics.js\";\nimport { projectConfigRoots } from \"../../persistence/paths.js\";\n\n/** The five lifecycle events the SDK runtime actually fires. */\nexport type HookEvent = \"preRun\" | \"postRun\" | \"preToolUse\" | \"postToolUse\" | \"stop\";\n\n/**\n * Claude Code event name → the SDK firing event. Only events the runtime\n * genuinely emits are mapped; a Claude Code event with no SDK firing point\n * (SessionStart / SubagentStop / PreCompact / Notification / SessionEnd) is\n * skipped with a warn rather than silently accepted (it would never run).\n */\nconst CLAUDE_CODE_EVENT_MAP: Readonly<Record<string, HookEvent>> = {\n  PreToolUse: \"preToolUse\",\n  PostToolUse: \"postToolUse\",\n  UserPromptSubmit: \"preRun\",\n  Stop: \"stop\",\n};\n\nexport interface HookCommand {\n  command: string;\n  matcher?: string;\n  timeoutMs?: number;\n  /**\n   * The config file this command was declared in.\n   *\n   * Carried so the executor can supply the runtime contract the declaring DIALECT presumes — a\n   * command from `.claude/settings.json` is written against Claude Code's runtime and expects\n   * `$CLAUDE_PROJECT_DIR` to exist (#522). Absent for a command built in memory, which is native by\n   * construction.\n   */\n  sourcePath?: string;\n}\n\nexport interface HookConfig {\n  hooks?: Partial<Record<HookEvent, HookCommand[]>>;\n}\n\nconst warned = new Set<string>();\n\n/**\n * Emit a stderr warn once per process per unique key. Helps surface the\n * deprecation path without spamming when the loader is called many times\n * during a session (cron + send + skills all hit this).\n *\n * Note: spawned workers (cron, subagent) start fresh processes — warn\n * re-emits there, by design (1 per process boot, not per call).\n *\n * @internal\n */\nexport function warnOnce(key: string, message: string): void {\n  if (warned.has(key)) return;\n  warned.add(key);\n  diag(`${message}\\n`);\n}\n\n/** Reset for tests; not exported via barrel. @internal */\nexport function _resetWarnOnceForTests(): void {\n  warned.clear();\n}\n\n/**\n * Load hooks from `.theokit/hooks.json` (Claude-Code-shaped — the only supported\n * form). A stray legacy `.theokit/hooks/*.md` markdown dir (no `hooks.json`) is\n * NOT loaded — it emits a one-time migration warn and yields no hooks.\n *\n * @internal\n */\nexport async function loadHookConfig(cwd: string): Promise<HookConfig> {\n  const merged: HookConfig = {};\n  let sawAny = false;\n  for (const path of hookConfigCandidates(cwd)) {\n    if (!existsSync(path)) continue;\n    sawAny = true;\n    // Stamped at merge, where the file is still known. One line later the commands are pooled per\n    // event and every trace of which dialect declared them is gone — which is how a Claude Code\n    // command came to be run without Claude Code's runtime (#522).\n    mergeInto(merged, stampSource(await readHookFile(path), path));\n  }\n  if (!sawAny && existsSync(join(cwd, \".theokit\", \"hooks\"))) {\n    warnOnce(\n      \"hooks-md-unsupported\",\n      \"[theokit-sdk] .theokit/hooks/*.md hooks are no longer supported (ADR 0016) — migrate to a Claude-Code-shaped .theokit/hooks.json\",\n    );\n  }\n  return merged;\n}\n\n/**\n * Every file that may declare hooks, in precedence order.\n *\n * `hooks.json` under each project config root, then the Claude Code CLI's own settings files — which\n * is where the CLI actually keeps hooks, so a repository set up for it presents its hooks here\n * without being converted. `settings.local.json` is the CLI's personal-override file and sits beside\n * the shared one rather than replacing it.\n *\n * The shape never needed translating: `parseClaudeCodeConfig` reads the `hooks` key off whatever\n * object it is given, and a settings file is that same object with other keys alongside.\n */\nfunction hookConfigCandidates(cwd: string): string[] {\n  const roots = projectConfigRoots(cwd);\n  return [\n    ...roots.map((root) => join(root, \"hooks.json\")),\n    ...roots.map((root) => join(root, \"settings.json\")),\n    ...roots.map((root) => join(root, \"settings.local.json\")),\n  ];\n}\n\n/**\n * Record which file each command came from.\n *\n * A command already carrying a `sourcePath` keeps it: nothing produces that today, and a nested\n * config that declared its own origin would be describing something this function cannot see.\n */\nfunction stampSource(config: HookConfig, sourcePath: string): HookConfig {\n  if (config.hooks === undefined) return config;\n  const hooks: NonNullable<HookConfig[\"hooks\"]> = {};\n  for (const [event, commands] of Object.entries(config.hooks) as [\n    HookEvent,\n    HookCommand[] | undefined,\n  ][]) {\n    if (commands === undefined) continue;\n    hooks[event] = commands.map((c) => ({ sourcePath, ...c }));\n  }\n  return { hooks };\n}\n\n/**\n * Append one source's commands onto the accumulator, per event.\n *\n * MERGED, not first-wins, and the distinction is deliberate. An agent or a skill is a NAMED\n * declaration: two files claiming one name collide, and the explicit namespace should win. Hooks are\n * unnamed lists — two files declaring `PreToolUse` are two sets of commands an operator wrote, and\n * keeping only one drops the other in silence, which is the failure class this package guards\n * against everywhere else.\n */\nfunction mergeInto(target: HookConfig, source: HookConfig): void {\n  for (const [event, commands] of Object.entries(source.hooks ?? {}) as [\n    HookEvent,\n    HookCommand[] | undefined,\n  ][]) {\n    if (commands === undefined || commands.length === 0) continue;\n    target.hooks ??= {};\n    target.hooks[event] = [...(target.hooks[event] ?? []), ...commands];\n  }\n}\n\nasync function readHookFile(jsonPath: string): Promise<HookConfig> {\n  let raw: string;\n  try {\n    raw = await readFile(jsonPath, \"utf8\");\n  } catch (cause) {\n    throw new ConfigurationError(`Failed to read hooks config: ${jsonPath}`, {\n      code: \"hooks_read_error\",\n      cause,\n    });\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (cause) {\n    throw new ConfigurationError(`Invalid JSON in hooks config: ${jsonPath}`, {\n      code: \"hooks_json_invalid\",\n      cause,\n    });\n  }\n  return parseClaudeCodeConfig(parsed, jsonPath);\n}\n\n/** Narrow an unknown to a record, or throw a typed config error. */\nfunction asRecord(value: unknown, path: string, where: string): Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    throw new ConfigurationError(`hooks: expected an object at ${where} in ${path}`, {\n      code: \"hooks_json_invalid\",\n    });\n  }\n  return value as Record<string, unknown>;\n}\n\n/** Narrow an unknown to an array, or throw a typed config error. */\nfunction asArray(value: unknown, path: string, where: string): unknown[] {\n  if (!Array.isArray(value)) {\n    throw new ConfigurationError(`hooks: expected an array at ${where} in ${path}`, {\n      code: \"hooks_json_invalid\",\n    });\n  }\n  return value;\n}\n\n/**\n * Parse Claude Code's nested hooks config into the SDK's flat internal shape:\n * `{ hooks: { PreToolUse: [{ matcher?, hooks: [{ type:\"command\", command, timeout? }] }] } }`\n * → `{ hooks: { preToolUse: [{ command, matcher?, timeoutMs? }] } }`. Each group's\n * `matcher` applies to every command it wraps; `timeout` (seconds) → `timeoutMs`.\n */\nfunction parseClaudeCodeConfig(raw: unknown, path: string): HookConfig {\n  const root = asRecord(raw, path, \"the root\");\n  if (root.hooks === undefined) return {};\n  const hooksRec = asRecord(root.hooks, path, `\"hooks\"`);\n  const grouped: Partial<Record<HookEvent, HookCommand[]>> = {};\n\n  for (const [ccEvent, groups] of Object.entries(hooksRec)) {\n    const event = CLAUDE_CODE_EVENT_MAP[ccEvent];\n    if (event === undefined) {\n      warnOnce(\n        `hooks-event-${ccEvent}`,\n        `[theokit-sdk] hooks: event \"${ccEvent}\" is not fired by the SDK runtime (supported: ${Object.keys(CLAUDE_CODE_EVENT_MAP).join(\", \")}) — skipping`,\n      );\n      continue;\n    }\n    grouped[event] = [...(grouped[event] ?? []), ...flattenEventGroups(groups, path, ccEvent)];\n  }\n  return { hooks: grouped };\n}\n\n/** Flatten one Claude Code event's matcher-groups into internal HookCommands. */\nfunction flattenEventGroups(groups: unknown, path: string, ccEvent: string): HookCommand[] {\n  const commands: HookCommand[] = [];\n  for (const rawGroup of asArray(groups, path, `hooks.${ccEvent}`)) {\n    const group = asRecord(rawGroup, path, `hooks.${ccEvent}[]`);\n    const matcher = group.matcher === undefined ? undefined : String(group.matcher);\n    for (const rawCmd of asArray(group.hooks, path, `hooks.${ccEvent}[].hooks`)) {\n      commands.push(parseClaudeCodeCommand(rawCmd, matcher, path, ccEvent));\n    }\n  }\n  return commands;\n}\n\n/** One `{ type:\"command\", command, timeout? }` entry → an internal HookCommand. */\nfunction parseClaudeCodeCommand(\n  raw: unknown,\n  matcher: string | undefined,\n  path: string,\n  ccEvent: string,\n): HookCommand {\n  const cmd = asRecord(raw, path, `hooks.${ccEvent}[].hooks[]`);\n  if (cmd.type !== \"command\") {\n    throw new ConfigurationError(\n      `hooks: only { \"type\": \"command\" } is supported (got ${JSON.stringify(cmd.type)}) in ${path}`,\n      { code: \"hooks_unsupported_type\" },\n    );\n  }\n  if (typeof cmd.command !== \"string\" || cmd.command.length === 0) {\n    throw new ConfigurationError(`hooks: \"command\" must be a non-empty string in ${path}`, {\n      code: \"hooks_invalid_command\",\n    });\n  }\n  const hc: HookCommand = { command: cmd.command };\n  if (matcher !== undefined) hc.matcher = matcher;\n  if (typeof cmd.timeout === \"number\" && cmd.timeout > 0) {\n    hc.timeoutMs = Math.round(cmd.timeout * 1000);\n  }\n  return hc;\n}\n","/**\n * Personality fork-context (ADR D168 + EC-A snapshot semantic).\n *\n * Uses Node's `AsyncLocalStorage` so a fork's execution chain can know\n * that it is running inside a fork AND can see the slug that was active\n * on the parent **at fork-construction time**.\n *\n * **EC-A:** The slug stored here is captured ONCE at the wrap site\n * (`localAgentFork`) — passing `parentStore.active(parentAgentId)`\n * returns a primitive `string | undefined`, which is then frozen\n * inside the ALS context object. Subsequent `usePersonality` calls on\n * the parent do NOT mutate the fork's view, because the fork reads from\n * its own ALS frame, not from the parent's store.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nimport { warnOnce } from \"../runtime/hooks/hooks-source.js\";\n\n/**\n * Snapshot data carried into a fork's async context.\n *\n * @internal\n */\nexport interface PersonalityForkContext {\n  /** Parent's active personality slug at fork-construction time. */\n  readonly slug: string | undefined;\n  /** Always `true` inside this scope (used by guards). */\n  readonly isFork: true;\n}\n\nconst storage = new AsyncLocalStorage<PersonalityForkContext>();\n\n/**\n * Run `fn` with `ctx` bound as the active fork context. Nested calls\n * shadow the outer context (EC-22).\n *\n * @internal\n */\nexport function withPersonalityContext<T>(\n  ctx: PersonalityForkContext,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return storage.run(ctx, fn);\n}\n\n/**\n * Return the active fork context, or `undefined` when called outside a\n * fork scope.\n *\n * @internal\n */\nexport function currentPersonalityContext(): PersonalityForkContext | undefined {\n  return storage.getStore();\n}\n\n/**\n * Emit one warning per agentId stating that personality switches inside\n * a fork are no-ops. The fork inherits the parent snapshot — runtime\n * mutation is intentionally rejected to keep fork voice deterministic.\n *\n * @internal\n */\nexport function warnPersonalitySwitchInsideFork(agentId: string): void {\n  warnOnce(\n    `personality-switch-in-fork-${agentId}`,\n    `[theokit-sdk] usePersonality is a no-op inside a fork (D168). Subagents inherit the parent's active personality at fork-construction time.`,\n  );\n}\n"]}

package/dist/chunk-VJ26EKGJ.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/runtime/concurrency/async-local-storage.ts"],"names":["AsyncLocalStorage"],"mappings":";;;;;AAsBA,IAAM,kBAAA,GAAqB,IAAIA,6BAAA,EAA+B;AAQ9D,eAAsB,iBAAA,CACpB,WACA,EAAA,EACY;AACZ,EAAA,OAAO,kBAAA,CAAmB,GAAA,CAAI,SAAA,EAAW,EAAE,CAAA;AAC7C;AAQO,SAAS,oBAAA,GAAgD;AAC9D,EAAA,OAAO,mBAAmB,QAAA,EAAS;AACrC;AAoBO,SAAS,mBAAmB,QAAA,EAAyC;AAC1E,EAAA,MAAM,YAAY,oBAAA,EAAqB;AACvC,EAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAO,EAAE,SAAS,IAAA,EAAK;AACpD,EAAA,IAAI,CAAC,SAAA,CAAU,GAAA,CAAI,QAAQ,CAAA,EAAG;AAC5B,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,MAAA,EAAQ,SAAS,QAAQ,CAAA,oCAAA;AAAA,KAC3B;AAAA,EACF;AACA,EAAA,OAAO,EAAE,SAAS,IAAA,EAAK;AACzB","file":"chunk-VJ26EKGJ.cjs","sourcesContent":["/**\n * Per-fork tool whitelist via `AsyncLocalStorage` (ADR D111).\n *\n * Forked agents (background review, curator, judge) need a tool subset\n * distinct from the parent's. A global mutable `let _whitelist` would\n * corrupt state when two forks run in parallel. `AsyncLocalStorage`\n * propagates the whitelist through the async chain so each fork sees its\n * own — no cross-fork bleed.\n *\n * Outside a `withToolWhitelist(...)` scope, `currentToolWhitelist()`\n * returns `undefined` and `checkToolWhitelist` allows every tool — the\n * parent agent is unaffected.\n *\n * Wire site: `internal/agent-loop/tool-dispatch.ts:dispatchSingleCall`\n * calls `checkToolWhitelist` after the repair middleware and before\n * `tools.find`.\n *\n * @internal\n */\n\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nconst toolWhitelistStore = new AsyncLocalStorage<Set<string>>();\n\n/**\n * Run `fn` with `whitelist` as the active tool filter. Nested calls\n * shadow the outer set; the outer is restored on return (EC-F).\n *\n * @internal\n */\nexport async function withToolWhitelist<T>(\n  whitelist: Set<string>,\n  fn: () => Promise<T>,\n): Promise<T> {\n  return toolWhitelistStore.run(whitelist, fn);\n}\n\n/**\n * Active tool whitelist for the current async context, or `undefined`\n * when not inside a `withToolWhitelist(...)` scope.\n *\n * @internal\n */\nexport function currentToolWhitelist(): Set<string> | undefined {\n  return toolWhitelistStore.getStore();\n}\n\n/**\n * Decision returned by {@link checkToolWhitelist}.\n *\n * @internal\n */\nexport interface ToolWhitelistDecision {\n  allowed: boolean;\n  /** Populated only when `allowed === false`. */\n  reason?: string;\n}\n\n/**\n * Check whether `toolName` is allowed in the current fork context.\n * Returns `{ allowed: true }` when no fork is active — preserves the\n * parent agent's full tool surface.\n *\n * @internal\n */\nexport function checkToolWhitelist(toolName: string): ToolWhitelistDecision {\n  const whitelist = currentToolWhitelist();\n  if (whitelist === undefined) return { allowed: true };\n  if (!whitelist.has(toolName)) {\n    return {\n      allowed: false,\n      reason: `Tool \"${toolName}\" not available in this fork context`,\n    };\n  }\n  return { allowed: true };\n}\n"]}

package/dist/chunk-VKJ7V7EB.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/runtime/context/path-containment.ts"],"names":["realpathSync","relative","isAbsolute"],"mappings":";;;;;;AAoCO,SAAS,eAAe,IAAA,EAAsB;AACnD,EAAA,IAAI;AACF,IAAA,OAAOA,gBAAa,IAAI,CAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAUO,SAAS,UAAA,CAAW,QAAgB,IAAA,EAAuB;AAChE,EAAA,MAAM,MAAMC,aAAA,CAAS,cAAA,CAAe,IAAI,CAAA,EAAG,cAAA,CAAe,MAAM,CAAC,CAAA;AACjE,EAAA,OAAO,GAAA,KAAQ,MAAM,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAACC,eAAA,CAAW,GAAG,CAAA;AAC/D;AAgBO,SAAS,cAAA,CAAe,QAAgB,IAAA,EAAuB;AACpE,EAAA,OAAO,UAAA,CAAW,QAAQ,IAAI,CAAA,IAAK,eAAe,MAAM,CAAA,KAAM,eAAe,IAAI,CAAA;AACnF","file":"chunk-VKJ7V7EB.cjs","sourcesContent":["/**\n * The one rule for \"is this resolved path inside that root\".\n *\n * Extracted because the package held it twice, at different strengths, for the same question. The\n * correct version lived as a private function in `context-import-resolver.ts`, written for the\n * 4.41.1 patch; the context manager had its own `absolute.startsWith(resolvePath(cwd))`, which\n * admits two escapes:\n *\n *   - **No separator boundary.** With `root = /home/user/proj`, the path `/home/user/proj-evil/x`\n *     starts with the root string and is NOT inside it. A sibling directory whose name merely\n *     extends the project's is enough; no `..` past the parent is needed.\n *   - **Lexical, not real.** A symlink whose name sits inside the root and whose target does not\n *     passes any comparison made before symlink resolution.\n *\n * The obvious escapes (`../../etc/passwd`, an absolute path) ARE refused by a prefix test, which is\n * why the weaker version survived review: it looks like it works on the inputs a reader tries.\n *\n * Both readers of repository-supplied paths now share this module. That is DRY about the RULE\n * rather than about line count — one piece of knowledge, one representation, so the two cannot\n * drift apart again.\n *\n * @internal\n */\n\nimport { realpathSync } from \"node:fs\";\nimport { isAbsolute, relative } from \"node:path\";\n\n/**\n * The real path, or the lexical one when it cannot be resolved.\n *\n * The fallback is load-bearing rather than defensive: the context manager checks containment BEFORE\n * it stats the file, so a source that is legitimately absent must still be judged on its declared\n * location instead of being refused for the wrong reason.\n *\n * @internal\n */\nexport function realOrResolved(path: string): string {\n  try {\n    return realpathSync(path);\n  } catch {\n    return path;\n  }\n}\n\n/**\n * Whether `target` is inside `root`, compared AFTER symlink resolution.\n *\n * `relative()` supplies the separator boundary that a prefix test lacks: it answers `..` for a\n * sibling, `''` for the root itself, and an absolute path when the two are on different roots.\n *\n * @internal\n */\nexport function insideRoot(target: string, root: string): boolean {\n  const rel = relative(realOrResolved(root), realOrResolved(target));\n  return rel !== \"\" && !rel.startsWith(\"..\") && !isAbsolute(rel);\n}\n\n/**\n * Whether `target` is the root ITSELF or inside it, compared after symlink resolution.\n *\n * Separate from {@link insideRoot} because the two answer a genuinely different question and their\n * callers need different ones. The context manager asks \"is this source under the project?\", where\n * the project directory itself is not a source. A path JOIN asks \"did this stay within its base?\",\n * where joining nothing and getting the base back is the ordinary case — `safePathJoin(base)` must\n * return `base`.\n *\n * Named here rather than written out at each call site: it appeared twice within one change, which\n * is how this rule ended up with three copies at three strengths the first time.\n *\n * @internal\n */\nexport function atOrInsideRoot(target: string, root: string): boolean {\n  return insideRoot(target, root) || realOrResolved(target) === realOrResolved(root);\n}\n"]}

package/dist/chunk-VLVVJLDH.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/memory/escape-like-pattern.ts","../src/internal/memory/memory-index.ts","../src/internal/memory/lance-memory-adapter.ts","../src/internal/memory/index-manager-dispatch.ts","../src/internal/memory/sqlite-vec-loader.ts","../src/internal/memory/storage/chunk-markdown.ts","../src/internal/memory/vec-index.ts","../src/internal/memory/index-manager.ts"],"names":["ConfigurationError","LanceIndex","createHash","LruEmbeddingCache","resolveMemoryRoot","defaultIndexPath","projectMemoryDir","openMemoryDb","collectMarkdownFiles","readFile","sha256","stat","sanitizeFts5Query","truncateSnippet","resolveWeights","blendScores"],"mappings":";;;;;;;;;;AAqBO,SAAS,kBAAkB,KAAA,EAAuB;AACvD,EAAA,OAAO,CAAA,CAAA,EAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,KAAK,CAAC,CAAA,CAAA,CAAA;AACnF;;;ACaO,SAAS,kBAAA,CAAmB,OAAA,GAAyB,EAAC,EAG3D;AACA,EAAA,OAAO;AAAA,IACL,YAAY,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,OAAA,CAAQ,cAAc,EAAE,CAAA;AAAA,IAChD,QAAA,EAAU,QAAQ,QAAA,IAAY;AAAA,GAChC;AACF;;;ACNA,IAAM,iBAAA,GAAoB,SAAA;AAG1B,IAAM,iBAAA,GAAgC,OAAO,MAAA,CAAO;AAAA,EAClD,YAAA,EAAc,CAAA;AAAA,EACd,YAAA,EAAc,CAAA;AAAA,EACd,aAAA,EAAe,CAAA;AAAA,EACf,cAAA,EAAgB;AAClB,CAAC,CAAA;AAEM,IAAM,qBAAN,MAAgD;AAAA,EACrD,YAA6B,KAAA,EAAmB;AAAnB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAoB;AAAA,EAApB,KAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM7B,MAAM,IAAA,GAA4B;AAChC,IAAA,OAAO,iBAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAA,CAAO,KAAA,EAAe,OAAA,GAAyB,EAAC,EAA+B;AACnF,IAAA,IAAI,MAAM,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,SAAU,EAAC;AACvC,IAAA,MAAM,EAAE,UAAA,EAAY,QAAA,EAAS,GAAI,mBAAmB,OAAO,CAAA;AAE3D,IAAA,MAAM,SAAA,GAAY,MAAM,IAAA,CAAK,KAAA,CAAM,OAAO,KAAA,EAAO;AAAA,MAC/C,SAAA,EAAW,iBAAA;AAAA,MACX,OAAO,UAAA,GAAa,CAAA;AAAA,MACpB,GAAI,QAAQ,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAQ,GAAI;AAAC,KACrE,CAAA;AACD,IAAA,OAAO,UACJ,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,KAAA,IAAS,QAAQ,CAAA,CACjC,KAAA,CAAM,CAAA,EAAG,UAAU,EACnB,GAAA,CAAI,CAAC,MAAM,iBAAA,CAAkB,CAAA,EAAG,KAAK,CAAC,CAAA;AAAA,EAC3C;AAAA,EAEA,MAAA,GAAsB;AAIpB,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,QAAA;AAAA,MACT,YAAA,EAAc,CAAA;AAAA,MACd,aAAA,EAAe;AAAA,KACjB;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,GAAuB;AAC3B,IAAA,MAAM,IAAA,CAAK,MAAM,KAAA,EAAM;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAA,GAAqB;AACnB,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF,CAAA;AAcA,SAAS,iBAAA,CACP,KACA,KAAA,EACiB;AACjB,EAAA,MAAM,YAAY,KAAA,KAAU,MAAA,GAAY,wBAAwB,KAAA,EAAO,GAAA,CAAI,IAAI,CAAA,GAAI,CAAA;AACnF,EAAA,MAAM,cAAc,GAAA,CAAI,KAAA;AAExB,EAAA,MAAM,QAAA,GAAW,GAAA,GAAM,WAAA,GAAc,GAAA,GAAM,SAAA;AAC3C,EAAA,OAAO;AAAA,IACL,MAAM,GAAA,CAAI,EAAA;AAAA,IACV,SAAA,EAAW,CAAA;AAAA,IACX,OAAA,EAAS,CAAA;AAAA,IACT,KAAA,EAAO,QAAA;AAAA,IACP,SAAA;AAAA,IACA,WAAA;AAAA,IACA,OAAA,EAAS,GAAA,CAAI,IAAA,CAAK,KAAA,CAAM,GAAG,GAAG,CAAA;AAAA,IAC9B,QAAQ,GAAA,CAAI,MAAA;AAAA,IACZ,UAAU,GAAA,CAAI;AAAA,GAChB;AACF;AAQA,SAAS,uBAAA,CAAwB,OAAe,IAAA,EAAsB;AACpE,EAAA,MAAM,UAAA,GAAa,KAAA,CAChB,WAAA,EAAY,CACZ,KAAA,CAAM,KAAK,CAAA,CACX,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA;AAC7B,EAAA,IAAI,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG,OAAO,CAAA;AACpC,EAAA,MAAM,SAAA,GAAY,KAAK,WAAA,EAAY;AACnC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAA,CAAO,CAAC,SAAS,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA,CAAE,MAAA;AACtE,EAAA,OAAO,UAAU,UAAA,CAAW,MAAA;AAC9B;;;ACvIO,IAAM,cAAA,GAA2C,CAAC,YAAA,EAAc,OAAO,CAAA;AAOvE,SAAS,mBAAmB,OAAA,EAAmD;AACpF,EAAA,IAAI,CAAC,cAAA,CAAe,QAAA,CAAS,OAAwB,CAAA,EAAG;AACtD,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,2BAA2B,OAAO,CAAA,iBAAA,EAAoB,cAAA,CAAe,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,MAC/E,EAAE,MAAM,wBAAA;AAAyB,KACnC;AAAA,EACF;AACF;AAQA,eAAsB,eAAe,IAAA,EAA8C;AACjF,EAAA,IAAI,IAAA,CAAK,cAAc,MAAA,EAAW;AAChC,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,gKAAA;AAAA,MACA,EAAE,MAAM,0BAAA;AAA2B,KACrC;AAAA,EACF;AACA,EAAA,MAAM,KAAA,GAAQ,MAAMC,4BAAA,CAAW,IAAA,CAAK;AAAA,IAClC,KAAK,IAAA,CAAK,GAAA;AAAA,IACV,WAAW,IAAA,CAAK,SAAA;AAAA,IAChB,GAAI,KAAK,QAAA,KAAa,MAAA,GAAY,EAAE,WAAA,EAAa,IAAA,CAAK,QAAA,EAAS,GAAI;AAAC,GACrE,CAAA;AACD,EAAA,OAAO,IAAI,mBAAmB,KAAK,CAAA;AACrC;;;ACrCA,eAAsB,uBAAuB,EAAA,EAA6B;AACxE,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,OAAO,YAAY,CAAA;AACrC,IAAA,MAAM,SAAU,GAAA,CAAyC,IAAA;AACzD,IAAA,IAAI,OAAO,WAAW,UAAA,EAAY;AAChC,MAAA,MAAM,IAAI,MAAM,4CAA4C,CAAA;AAAA,IAC9D;AACA,IAAA,MAAA,CAAO,EAAE,CAAA;AAAA,EACX,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,IAAA,MAAM,IAAID,oCAAA;AAAA,MACR,wHAAwH,OAAO,CAAA,CAAA;AAAA,MAC/H,EAAE,IAAA,EAAM,wBAAA,EAA0B,KAAA;AAAM,KAC1C;AAAA,EACF;AACF;ACEA,IAAM,UAAA,GAAa,uBAAA;AASZ,SAAS,aAAA,CAAc,IAAA,EAAc,OAAA,GAAgC,EAAC,EAAkB;AAC7F,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,GAAA;AACrC,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAC/B,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC7B,EAAA,MAAM,GAAA,GAAwB,EAAE,MAAA,EAAQ,EAAC,EAAG,KAAA,EAAO,EAAC,EAAG,KAAA,EAAO,CAAA,EAAG,OAAA,EAAS,MAAA,EAAU;AACpF,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,IAAA,MAAM,IAAA,GAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AACzB,IAAA,MAAM,aAAa,CAAA,GAAI,CAAA;AACvB,IAAA,WAAA,CAAY,GAAA,EAAK,IAAA,EAAM,UAAA,EAAY,QAAQ,CAAA;AAAA,EAC7C;AACA,EAAA,gBAAA,CAAiB,GAAA,EAAK,KAAA,CAAM,MAAA,EAAQ,QAAQ,CAAA;AAC5C,EAAA,OAAO,GAAA,CAAI,MAAA;AACb;AAEA,SAAS,WAAA,CACP,GAAA,EACA,IAAA,EACA,UAAA,EACA,QAAA,EACM;AACN,EAAA,MAAM,YAAA,GAAe,UAAA,CAAW,IAAA,CAAK,IAAI,CAAA;AACzC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA;AACvC,EAAA,IAAI,YAAA,KAAiB,IAAA,IAAQ,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACjD,IAAA,gBAAA,CAAiB,GAAA,EAAK,UAAA,GAAa,CAAA,EAAG,QAAQ,CAAA;AAAA,EAChD;AACA,EAAA,IAAI,YAAA,KAAiB,IAAA,EAAM,GAAA,CAAI,OAAA,GAAU,aAAa,CAAC,CAAA;AACvD,EAAA,GAAA,CAAI,KAAA,CAAM,KAAK,IAAI,CAAA;AACnB,EAAA,IAAI,OAAA,IAAW,GAAA,CAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG;AACnC,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AAClC,IAAA,IAAI,MAAA,CAAO,MAAK,CAAE,MAAA,GAAS,GAAG,gBAAA,CAAiB,GAAA,EAAK,YAAY,QAAQ,CAAA;AAAA,EAC1E;AACF;AAEA,SAAS,gBAAA,CAAiB,GAAA,EAAuB,gBAAA,EAA0B,QAAA,EAAwB;AACjG,EAAA,IAAI,GAAA,CAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG;AAC5B,EAAA,MAAM,SAAA,GAAY,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA;AACrC,EAAA,IAAI,SAAA,CAAU,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,EAAG;AACjC,IAAA,GAAA,CAAI,QAAQ,EAAC;AACb,IAAA,GAAA,CAAI,QAAQ,gBAAA,GAAmB,CAAA;AAC/B,IAAA;AAAA,EACF;AACA,EAAA,IAAI,SAAA,CAAU,SAAS,QAAA,EAAU;AAC/B,IAAA,mBAAA,CAAoB,IAAI,MAAA,EAAQ,SAAA,EAAW,IAAI,KAAA,EAAO,GAAA,CAAI,SAAS,QAAQ,CAAA;AAAA,EAC7E,CAAA,MAAO;AACL,IAAA,GAAA,CAAI,MAAA,CAAO,KAAK,UAAA,CAAW,SAAA,EAAW,IAAI,KAAA,EAAO,gBAAA,EAAkB,GAAA,CAAI,OAAO,CAAC,CAAA;AAAA,EACjF;AACA,EAAA,GAAA,CAAI,QAAQ,EAAC;AACb,EAAA,GAAA,CAAI,QAAQ,gBAAA,GAAmB,CAAA;AACjC;AAEA,SAAS,UAAA,CACP,IAAA,EACA,SAAA,EACA,OAAA,EACA,OAAA,EACa;AACb,EAAA,OAAO;AAAA,IACL,SAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA,IAAA,EAAME,kBAAW,QAAQ,CAAA,CAAE,OAAO,IAAI,CAAA,CAAE,OAAO,KAAK,CAAA;AAAA,IACpD,GAAI,OAAA,KAAY,MAAA,GAAY,EAAE,OAAA,KAAY;AAAC,GAC7C;AACF;AAEA,SAAS,mBAAA,CACP,MAAA,EACA,IAAA,EACA,SAAA,EACA,SACA,QAAA,EACM;AACN,EAAA,IAAI,SAAA,GAAY,IAAA;AAChB,EAAA,IAAI,UAAA,GAAa,SAAA;AACjB,EAAA,OAAO,SAAA,CAAU,SAAS,QAAA,EAAU;AAClC,IAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,SAAA,EAAW,QAAQ,CAAA;AACzD,IAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA;AACxC,IAAA,MAAM,UAAA,GAAa,KAAA,CAAM,KAAA,CAAM,IAAI,CAAA,CAAE,MAAA;AACrC,IAAA,MAAA,CAAO,IAAA,CAAK,WAAW,KAAA,EAAO,UAAA,EAAY,aAAa,UAAA,GAAa,CAAA,EAAG,OAAO,CAAC,CAAA;AAC/E,IAAA,SAAA,GAAY,UAAU,KAAA,CAAM,OAAO,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AACvD,IAAA,UAAA,IAAc,UAAA,GAAa,CAAA;AAAA,EAC7B;AACA,EAAA,IAAI,SAAA,CAAU,SAAS,CAAA,EAAG;AACxB,IAAA,MAAM,UAAA,GAAa,SAAA,CAAU,KAAA,CAAM,IAAI,CAAA,CAAE,MAAA;AACzC,IAAA,MAAA,CAAO,IAAA,CAAK,WAAW,SAAA,EAAW,UAAA,EAAY,aAAa,UAAA,GAAa,CAAA,EAAG,OAAO,CAAC,CAAA;AAAA,EACrF;AACF;AAOA,SAAS,qBAAA,CAAsB,MAAc,QAAA,EAA0B;AACrE,EAAA,IAAI,IAAA,CAAK,MAAA,IAAU,QAAA,EAAU,OAAO,IAAA,CAAK,MAAA;AAEzC,EAAA,KAAA,IAAS,CAAA,GAAI,UAAU,CAAA,GAAI,IAAA,CAAK,IAAI,CAAA,EAAG,QAAA,GAAW,GAAG,CAAA,EAAG,CAAA,EAAA,EAAK;AAC3D,IAAA,IAAI,KAAK,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,IAAK,GAAG,GAAG,OAAO,CAAA;AAAA,EACxC;AAEA,EAAA,OAAO,QAAA;AACT;;;AC7HO,IAAM,oBAAA,GAAuB,sBAAA;AAC7B,IAAM,cAAA,GAAiB,iBAAA;AACvB,IAAM,kBAAA,GAAqB,qBAAA;AAQ3B,SAAS,sBAAsB,EAAA,EAA6C;AACjF,EAAA,MAAM,GAAA,GAAM,CAAC,GAAA,KAAoC;AAC/C,IAAA,MAAM,MAAM,EAAA,CAAG,OAAA,CAAQ,sCAAsC,CAAA,CAAE,IAAI,GAAG,CAAA;AACtE,IAAA,OAAO,GAAA,KAAQ,MAAA,GAAY,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA,GAAI,MAAA;AAAA,EACjD,CAAA;AACA,EAAA,MAAM,UAAA,GAAa,IAAI,oBAAoB,CAAA;AAC3C,EAAA,MAAM,KAAA,GAAQ,IAAI,cAAc,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,IAAI,kBAAkB,CAAA;AACrC,EAAA,IAAI,eAAe,MAAA,IAAa,KAAA,KAAU,MAAA,IAAa,MAAA,KAAW,QAAW,OAAO,MAAA;AACpF,EAAA,MAAM,SAAA,GAAY,OAAO,MAAM,CAAA;AAC/B,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,SAAS,CAAA,IAAK,SAAA,IAAa,GAAG,OAAO,MAAA;AAC1D,EAAA,OAAO,EAAE,UAAA,EAAY,KAAA,EAAO,SAAA,EAAU;AACxC;AAEO,SAAS,sBAAA,CAAuB,IAAc,QAAA,EAAmC;AACtF,EAAA,MAAM,OAAO,EAAA,CAAG,OAAA;AAAA,IACd;AAAA,GACF;AACA,EAAA,IAAA,CAAK,GAAA,CAAI,oBAAA,EAAsB,QAAA,CAAS,UAAU,CAAA;AAClD,EAAA,IAAA,CAAK,GAAA,CAAI,cAAA,EAAgB,QAAA,CAAS,KAAK,CAAA;AACvC,EAAA,IAAA,CAAK,GAAA,CAAI,kBAAA,EAAoB,MAAA,CAAO,QAAA,CAAS,SAAS,CAAC,CAAA;AACzD;AAEO,SAAS,eAAA,CAAgB,GAAsB,CAAA,EAA+B;AACnF,EAAA,OAAO,CAAA,CAAE,UAAA,KAAe,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,UAAU,CAAA,CAAE,KAAA,IAAS,CAAA,CAAE,SAAA,KAAc,CAAA,CAAE,SAAA;AACnF;AAEO,SAAS,gBAAgB,EAAA,EAAoB;AAClD,EAAA,EAAA,CAAG,KAAK,iCAAiC,CAAA;AAC3C;AAEO,SAAS,iBAAA,CAAkB,IAAc,SAAA,EAAyB;AACvE,EAAA,EAAA,CAAG,IAAA,CAAK,CAAA;AAAA;AAAA,cAAA,EAEM,SAAS,CAAA;AAAA,GAAA,CACrB,CAAA;AACJ;AAGO,SAAS,WAAW,GAAA,EAAoC;AAC7D,EAAA,MAAM,GAAA,GAAM,IAAI,YAAA,CAAa,GAAA,CAAI,MAAM,CAAA;AACvC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,CAAC,CAAA,IAAK,CAAA;AACxD,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AAC/B;AAEO,SAAS,eAAA,CAAgB,EAAA,EAAc,OAAA,EAAiB,GAAA,EAAkC;AAI/F,EAAA,MAAM,EAAA,GAAK,OAAO,OAAO,CAAA;AACzB,EAAA,EAAA,CAAG,OAAA,CAAQ,2CAA2C,CAAA,CAAE,GAAA,CAAI,EAAE,CAAA;AAC9D,EAAA,EAAA,CAAG,QAAQ,sDAAsD,CAAA,CAAE,IAAI,EAAA,EAAI,UAAA,CAAW,GAAG,CAAC,CAAA;AAC5F;AAOO,SAAS,YAAA,CACd,EAAA,EACA,KAAA,EACA,CAAA,EACgB;AAGhB,EAAA,MAAM,OAAO,EAAA,CACV,OAAA;AAAA,IACC,CAAA;AAAA;AAAA,wBAAA;AAAA,IAID,GAAA,CAAI,UAAA,CAAW,KAAK,CAAA,EAAG,MAAA,CAAO,CAAC,CAAC,CAAA;AACnC,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAC,GAAA,MAAS,EAAE,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,QAAQ,GAAG,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,QAAQ,GAAE,CAAE,CAAA;AAC/F;AAQA,eAAsB,mBAAmB,IAAA,EAAqC;AAC5E,EAAA,MAAM,IAAA,GAAO,KAAK,EAAA,CACf,OAAA;AAAA,IACC,CAAA;AAAA;AAAA;AAAA,wCAAA;AAAA,IAKD,GAAA,EAAI;AACP,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,CAAA;AAC9B,EAAA,MAAM,aAAa,IAAA,CAAK,GAAA,CAAI,CAAC,GAAA,MAAS,EAAE,EAAA,EAAI,MAAA,CAAO,GAAA,CAAI,EAAE,GAAG,IAAA,EAAM,MAAA,CAAO,IAAI,IAAA,IAAQ,EAAE,GAAE,CAAE,CAAA;AAC3F,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AACtE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,UAAA,CAAW,QAAQ,CAAA,EAAA,EAAK;AAC1C,IAAA,MAAM,GAAA,GAAM,WAAW,CAAC,CAAA;AACxB,IAAA,MAAM,MAAA,GAAS,QAAQ,CAAC,CAAA;AACxB,IAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,MAAA,KAAW,MAAA,EAAW;AAC/C,IAAA,eAAA,CAAgB,IAAA,CAAK,EAAA,EAAI,GAAA,CAAI,EAAA,EAAI,MAAM,CAAA;AAAA,EACzC;AACA,EAAA,OAAO,UAAA,CAAW,MAAA;AACpB;;;ACrGA,IAAM,gBAAA,GAAmB,IAAIC,mCAAA,CAAkB,GAAI,CAAA;AA2C5C,IAAM,YAAA,GAAN,MAAM,aAAA,CAAoC;AAAA,EAIvC,WAAA,CACW,UAAA,EACA,EAAA,EACA,SAAA,EACjB;AAHiB,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AACA,IAAA,IAAA,CAAA,EAAA,GAAA,EAAA;AACA,IAAA,IAAA,CAAA,SAAA,GAAA,SAAA;AAAA,EAChB;AAAA,EAHgB,UAAA;AAAA,EACA,EAAA;AAAA,EACA,SAAA;AAAA,EANX,UAAA;AAAA,EACA,WAAA,GAAc,KAAA;AAAA,EAiBtB,aAAa,KAAK,IAAA,EAA8C;AAC9D,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,IAAW,YAAA;AAChC,IAAA,kBAAA,CAAmB,OAAO,CAAA;AAC1B,IAAA,IAAI,OAAA,KAAY,OAAA,EAAS,OAAO,MAAM,eAAe,IAAI,CAAA;AACzD,IAAA,OAAO,MAAM,aAAA,CAAa,kBAAA,CAAmB,IAAI,CAAA;AAAA,EACnD;AAAA;AAAA,EAGA,aAAqB,mBAAmB,IAAA,EAA+C;AACrF,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,UAAA,IAAcC,mCAAA,CAAkB,KAAK,GAAG,CAAA;AAMhE,IAAA,MAAM,WAAW,IAAA,CAAK,QAAA,IAAYC,mCAAiBC,kCAAA,CAAiB,IAAA,CAAK,GAAG,CAAC,CAAA;AAC7E,IAAA,MAAM,EAAA,GAAK,MAAMC,8BAAA,CAAa,EAAE,UAAU,CAAA;AAC1C,IAAA,MAAM,UAAU,IAAI,aAAA,CAAa,UAAA,EAAY,EAAA,EAAI,KAAK,SAAS,CAAA;AAC/D,IAAA,IAAI,KAAK,SAAA,KAAc,MAAA,QAAiB,OAAA,CAAQ,iBAAA,CAAkB,KAAK,SAAS,CAAA;AAChF,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAc,kBAAkB,OAAA,EAA0C;AACxE,IAAA,MAAM,sBAAA,CAAuB,KAAK,EAAE,CAAA;AACpC,IAAA,MAAM,eAAA,GAAkB;AAAA,MACtB,YAAY,OAAA,CAAQ,EAAA;AAAA,MACpB,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,WAAW,OAAA,CAAQ;AAAA,KACrB;AACA,IAAA,MAAM,SAAA,GAAY,qBAAA,CAAsB,IAAA,CAAK,EAAE,CAAA;AAC/C,IAAA,IAAI,cAAc,MAAA,IAAa,CAAC,eAAA,CAAgB,SAAA,EAAW,eAAe,CAAA,EAAG;AAG3E,MAAA,eAAA,CAAgB,KAAK,EAAE,CAAA;AAAA,IACzB;AACA,IAAA,iBAAA,CAAkB,IAAA,CAAK,EAAA,EAAI,OAAA,CAAQ,SAAS,CAAA;AAC5C,IAAA,sBAAA,CAAuB,IAAA,CAAK,IAAI,eAAe,CAAA;AAC/C,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA;AAAA,EACrB;AAAA;AAAA,EAGA,MAAM,IAAA,GAKH;AACD,IAAA,MAAM,KAAA,GAAQ,MAAMC,sCAAA,CAAqB,IAAA,CAAK,UAAU,CAAA;AACxD,IAAA,IAAI,YAAA,GAAe,CAAA;AACnB,IAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,IAAA,MAAM,cAAA,GAAiB,KAAK,cAAA,EAAe;AAC3C,IAAA,KAAA,MAAW,SAAS,KAAA,EAAO;AACzB,MAAA,MAAM,GAAA,GAAM,MAAMC,iBAAA,CAAS,KAAA,CAAM,cAAc,MAAM,CAAA;AACrD,MAAA,MAAM,IAAA,GAAOC,yBAAO,GAAG,CAAA;AACvB,MAAA,MAAM,QAAA,GAAW,cAAA,CAAe,GAAA,CAAI,KAAA,CAAM,YAAY,CAAA;AACtD,MAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,IAAA,KAAS,IAAA,EAAM;AACtD,MAAA,MAAM,KAAA,GAAQ,MAAMC,aAAA,CAAK,KAAA,CAAM,YAAY,CAAA;AAC3C,MAAA,MAAM,SAAS,IAAA,CAAK,UAAA;AAAA,QAClB,KAAA,CAAM,YAAA;AAAA,QACN,KAAA,CAAM,OAAA;AAAA,QACN,IAAA;AAAA,QACA,KAAA,CAAM,OAAA;AAAA,QACN,KAAA,CAAM;AAAA,OACR;AACA,MAAA,IAAA,CAAK,oBAAoB,MAAM,CAAA;AAC/B,MAAA,MAAM,MAAA,GAAS,cAAc,GAAG,CAAA;AAChC,MAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,QAAA,IAAA,CAAK,WAAA,CAAY,QAAQ,KAAA,CAAM,SAAA,EAAW,MAAM,OAAA,EAAS,KAAA,CAAM,IAAA,EAAM,KAAA,CAAM,IAAI,CAAA;AAAA,MACjF;AACA,MAAA,YAAA,IAAgB,CAAA;AAChB,MAAA,aAAA,IAAiB,MAAA,CAAO,MAAA;AAAA,IAC1B;AACA,IAAA,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAA,IAAI,IAAA,CAAK,WAAA,IAAe,IAAA,CAAK,SAAA,KAAc,MAAA,EAAW;AACpD,MAAA,cAAA,GAAiB,MAAM,mBAAmB,EAAE,EAAA,EAAI,KAAK,EAAA,EAAI,OAAA,EAAS,IAAA,CAAK,SAAA,EAAW,CAAA;AAAA,IACpF;AACA,IAAA,IAAA,CAAK,UAAA,GAAa,KAAK,GAAA,EAAI;AAC3B,IAAA,OAAO,EAAE,YAAA,EAAc,KAAA,CAAM,MAAA,EAAQ,YAAA,EAAc,eAAe,cAAA,EAAe;AAAA,EACnF;AAAA,EAEA,MAAM,MAAA,CAAO,KAAA,EAAe,OAAA,GAAyB,EAAC,EAA+B;AACnF,IAAA,IAAI,MAAM,IAAA,EAAK,CAAE,MAAA,KAAW,CAAA,SAAU,EAAC;AACvC,IAAA,MAAM,EAAE,UAAA,EAAY,QAAA,EAAS,GAAI,mBAAmB,OAAO,CAAA;AAC3D,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,KAAA,EAAO,aAAa,CAAC,CAAA;AACrD,IAAA,MAAM,iBAAiB,MAAM,IAAA,CAAK,gBAAA,CAAiB,KAAA,EAAO,aAAa,CAAC,CAAA;AACxE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,mBAAA,CAAoB,QAAA,EAAU,gBAAgB,OAAO,CAAA;AAC3E,IAAA,OAAO,QAAA,CACJ,OAAO,CAAC,CAAA,KAAM,EAAE,KAAA,IAAS,QAAQ,CAAA,CACjC,MAAA,CAAO,CAAC,CAAA,KAAM,QAAQ,OAAA,KAAY,MAAA,IAAa,OAAA,CAAQ,OAAA,CAAQ,QAAA,CAAS,CAAA,CAAE,MAAM,CAAC,CAAA,CACjF,KAAA,CAAM,CAAA,EAAG,UAAU,CAAA;AAAA,EACxB;AAAA,EAEA,MAAA,GAAsB;AACpB,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,EAAA,CAAG,OAAA,CAAQ,iCAAiC,EAAE,GAAA,EAAI,IAAK,EAAE,CAAA,EAAG,CAAA,EAAE;AACjF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,EAAA,CAAG,OAAA,CAAQ,kCAAkC,EAAE,GAAA,EAAI,IAAK,EAAE,CAAA,EAAG,CAAA,EAAE;AACnF,IAAA,MAAM,MAAA,GAAsB;AAAA,MAC1B,OAAA,EAAS,IAAA,CAAK,WAAA,GAAc,QAAA,GAAW,UAAA;AAAA,MACvC,YAAA,EAAc,MAAA,CAAO,KAAA,CAAM,CAAA,IAAK,CAAC,CAAA;AAAA,MACjC,aAAA,EAAe,MAAA,CAAO,MAAA,CAAO,CAAA,IAAK,CAAC;AAAA,KACrC;AACA,IAAA,IAAI,IAAA,CAAK,UAAA,KAAe,MAAA,EAAW,MAAA,CAAO,aAAa,IAAA,CAAK,UAAA;AAC5D,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA,EAIQ,SAAA,CAAU,OAAe,KAAA,EAA6D;AAG5F,IAAA,MAAM,SAAA,GAAYC,oCAAkB,KAAK,CAAA;AACzC,IAAA,IAAI,SAAA,CAAU,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AACpC,IAAA,MAAM,IAAA,GAAO,KAAK,EAAA,CAAG,OAAA;AAAA,MACnB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAAA;AAAA,KASF;AACA,IAAA,IAAI,OAAuC,EAAC;AAC5C,IAAA,IAAI;AACF,MAAA,IAAA,GAAO,IAAA,CAAK,GAAA,CAAI,SAAA,EAAW,KAAK,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AAKN,MAAA,OAAO,IAAA,CAAK,kBAAA,CAAmB,KAAA,EAAO,KAAK,CAAA;AAAA,IAC7C;AACA,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAC,GAAA,KAAQ;AACvB,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,UAAA,IAAc,CAAC,CAAA;AACvC,MAAA,MAAM,SAAA,GAAY,IAAA,GAAO,CAAA,GAAI,CAAA,IAAK,CAAA,GAAI,KAAK,GAAA,CAAI,IAAI,CAAA,CAAA,GAAK,CAAA,IAAK,CAAA,GAAI,IAAA,CAAA;AACjE,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,GAAA,CAAI,UAAA,IAAc,CAAC,CAAA;AAC5C,MAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,QAAA,IAAY,CAAC,CAAA;AACxC,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AAChC,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,SAAA;AAAA,QACA,OAAA;AAAA,QACA,KAAA,EAAO,SAAA;AAAA,QACP,SAAA;AAAA,QACA,SAASC,iCAAA,CAAgB,MAAA,CAAO,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAC,CAAA;AAAA,QAC/C,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAAA,QACzB,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,SAAS,IAAI,OAAO,CAAA,CAAA;AAAA;AAAA;AAAA,QAGzC,OAAA,EAAS,MAAA,CAAO,GAAA,CAAI,EAAE;AAAA,OACxB;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBAAA,CACN,OACA,KAAA,EAC8C;AAC9C,IAAA,MAAM,OAAA,GAAU,kBAAkB,KAAK,CAAA;AACvC,IAAA,MAAM,IAAA,GAAO,KAAK,EAAA,CAAG,OAAA;AAAA,MACnB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAAA;AAAA,KAOF;AACA,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AACpC,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAC,GAAA,KAAQ;AACvB,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,QAAA,IAAY,EAAE,CAAA;AACtC,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,GAAA,CAAI,UAAA,IAAc,CAAC,CAAA;AAC5C,MAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,QAAA,IAAY,CAAC,CAAA;AACxC,MAAA,OAAO;AAAA,QACL,IAAA;AAAA,QACA,SAAA;AAAA,QACA,OAAA;AAAA,QACA,KAAA,EAAO,GAAA;AAAA;AAAA,QACP,SAAA,EAAW,GAAA;AAAA,QACX,SAASA,iCAAA,CAAgB,MAAA,CAAO,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAC,CAAA;AAAA,QAC/C,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAAA,QACzB,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,SAAS,IAAI,OAAO,CAAA,CAAA;AAAA,QACzC,OAAA,EAAS,MAAA,CAAO,GAAA,CAAI,EAAE;AAAA,OACxB;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAc,gBAAA,CACZ,KAAA,EACA,KAAA,EACiE;AACjE,IAAA,IAAI,CAAC,KAAK,WAAA,IAAe,IAAA,CAAK,cAAc,MAAA,EAAW,2BAAW,GAAA,EAAI;AAMtE,IAAA,MAAM,QAAA,GAAWX,kBAAW,QAAQ,CAAA,CAAE,OAAO,KAAK,CAAA,CAAE,OAAO,KAAK,CAAA;AAChE,IAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,GAAA,CAAI,QAAQ,CAAA;AAC5C,IAAA,MAAM,QAAA,GAAW,MAAA,IAAA,CAAW,MAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,KAAK,CAAC,CAAA,EAAG,CAAC,CAAA;AAClE,IAAA,IAAI,QAAA,KAAa,MAAA,EAAW,uBAAO,IAAI,GAAA,EAAI;AAC3C,IAAA,IAAI,MAAA,KAAW,MAAA,EAAW,gBAAA,CAAiB,GAAA,CAAI,UAAU,QAAQ,CAAA;AACjE,IAAA,MAAM,IAAA,GAAO,YAAA,CAAa,IAAA,CAAK,EAAA,EAAI,UAAU,KAAK,CAAA;AAElD,IAAA,MAAM,GAAA,uBAAU,GAAA,EAAqC;AACrD,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,MAAM,QAAQ,CAAA,IAAK,CAAA,GAAI,KAAK,GAAA,CAAI,CAAA,EAAG,IAAI,QAAQ,CAAA,CAAA;AAC/C,MAAA,GAAA,CAAI,IAAI,GAAA,CAAI,QAAA,EAAU,EAAE,WAAA,EAAa,OAAO,CAAA;AAAA,IAC9C;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEQ,mBAAA,CACN,QAAA,EACA,cAAA,EACA,OAAA,EACmB;AACnB,IAAA,MAAM,OAAA,GAAUY,iCAAe,OAAO,CAAA;AACtC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,QAAA,EAAU,cAAc,CAAA;AACtD,IAAA,MAAM,WAAW,CAAC,GAAG,MAAA,CAAO,MAAA,EAAQ,CAAA,CAAE,GAAA;AAAA,MAAI,CAAC,GAAA,KACzCC,6BAAA,CAAY,GAAA,EAAK,cAAA,CAAe,GAAA,CAAI,GAAA,CAAI,OAAO,CAAA,EAAG,WAAA,IAAe,CAAA,EAAG,OAAO;AAAA,KAC7E;AACA,IAAA,OAAO,QAAA,CAAS,KAAK,CAAC,CAAA,EAAG,MAAM,CAAA,CAAE,KAAA,GAAQ,EAAE,KAAK,CAAA;AAAA,EAClD;AAAA,EAEQ,SAAA,CACN,UACA,cAAA,EACoD;AACpD,IAAA,MAAM,MAAA,uBAAa,GAAA,EAAmD;AACtE,IAAA,KAAA,MAAW,OAAO,QAAA,EAAU,MAAA,CAAO,GAAA,CAAI,GAAA,CAAI,SAAS,GAAG,CAAA;AACvD,IAAA,MAAM,UAAA,GAAa,CAAC,GAAG,cAAA,CAAe,MAAM,CAAA,CAAE,MAAA,CAAO,CAAC,EAAA,KAAO,CAAC,MAAA,CAAO,GAAA,CAAI,EAAE,CAAC,CAAA;AAC5E,IAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,MAAA,KAAA,MAAW,GAAA,IAAO,IAAA,CAAK,gBAAA,CAAiB,UAAU,CAAA,EAAG;AACnD,QAAA,MAAA,CAAO,GAAA,CAAI,GAAA,CAAI,OAAA,EAAS,EAAE,GAAG,KAAK,KAAA,EAAO,CAAA,EAAG,SAAA,EAAW,CAAA,EAAG,CAAA;AAAA,MAC5D;AAAA,IACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,iBACN,GAAA,EAC8C;AAC9C,IAAA,IAAI,GAAA,CAAI,MAAA,KAAW,CAAA,EAAG,OAAO,EAAC;AAC9B,IAAA,MAAM,eAAe,GAAA,CAAI,GAAA,CAAI,MAAM,GAAG,CAAA,CAAE,KAAK,GAAG,CAAA;AAChD,IAAA,MAAM,IAAA,GAAO,KAAK,EAAA,CACf,OAAA;AAAA,MACC,CAAA;AAAA;AAAA;AAAA;AAAA,6BAAA,EAIuB,YAAY,CAAA,CAAA;AAAA,KACrC,CACC,GAAA,CAAI,GAAG,GAAG,CAAA;AACb,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAC,GAAA,KAAQ;AACvB,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,GAAA,CAAI,UAAA,IAAc,CAAC,CAAA;AAC5C,MAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,QAAA,IAAY,CAAC,CAAA;AACxC,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,QAAQ,CAAA;AAChC,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAAA,QACtB,IAAA;AAAA,QACA,SAAA;AAAA,QACA,OAAA;AAAA,QACA,KAAA,EAAO,CAAA;AAAA,QACP,SAAA,EAAW,CAAA;AAAA,QACX,SAASF,iCAAA,CAAgB,MAAA,CAAO,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAC,CAAA;AAAA,QAC/C,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAAA,QACzB,UAAU,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,SAAS,IAAI,OAAO,CAAA;AAAA,OAC3C;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA,EAIQ,cAAA,GAA4D;AAClE,IAAA,MAAM,OAAO,IAAA,CAAK,EAAA,CAAG,OAAA,CAAQ,kCAAkC,EAAE,GAAA,EAAI;AAKrE,IAAA,OAAO,IAAI,GAAA,CAAI,IAAA,CAAK,IAAI,CAAC,GAAA,KAAQ,CAAC,GAAA,CAAI,IAAA,EAAM,EAAE,EAAA,EAAI,IAAI,EAAA,EAAI,IAAA,EAAM,IAAI,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,EAC9E;AAAA,EAEQ,WACN,OAAA,EACA,OAAA,EACA,IAAA,EACA,OAAA,EACA,SAAyC,QAAA,EACjC;AACR,IAAA,MAAM,IAAA,GAAO,KAAK,EAAA,CAAG,OAAA;AAAA,MACnB,CAAA;AAAA;AAAA,mBAAA;AAAA,KAGF;AACA,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,OAAA,EAAS,KAAK,KAAA,CAAM,OAAO,CAAA,EAAG,IAAA,EAAM,MAAM,CAAA;AACxE,IAAA,OAAO,GAAA,CAAI,EAAA;AAAA,EACb;AAAA,EAEQ,oBAAoB,MAAA,EAAsB;AAChD,IAAA,IAAA,CAAK,EAAA,CAAG,OAAA,CAAQ,sCAAsC,CAAA,CAAE,IAAI,MAAM,CAAA;AAAA,EACpE;AAAA,EAEQ,WAAA,CACN,MAAA,EACA,SAAA,EACA,OAAA,EACA,MACA,IAAA,EACM;AACN,IAAA,IAAA,CAAK,EAAA,CACF,OAAA;AAAA,MACC;AAAA,MAED,GAAA,CAAI,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,MAAM,IAAI,CAAA;AAAA,EAC/C;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,GAAG,KAAA,EAAM;AAAA,EAChB;AACF","file":"chunk-VLVVJLDH.cjs","sourcesContent":["/**\n * Escapes a user query for a SQL `LIKE ... ESCAPE '\\'` clause.\n *\n * The order of the three replacements is the whole correctness argument, so it is its own\n * function rather than a chain inline at the call site.\n *\n * The previous version escaped `%` and `_` but not the escape character itself, which is the\n * defect CodeQL reports as `js/incomplete-sanitization` (alerts #14, #15). Two things went wrong,\n * and the second is the one that matters:\n *\n *   \"back\\slash\"  ->  \"%back\\slash%\"    the `\\s` is an escape of `s`, which LIKE does not define\n *   \"x\\%y\"        ->  \"%x\\\\%y%\"         the inserted `\\` is consumed escaping the user's `\\`,\n *                                       leaving `%` UNESCAPED — a wildcard the caller did not\n *                                       write, matching anything between `x\\` and `y`\n *\n * The second is wildcard injection: a search for a literal string silently becomes a scan. In a\n * memory index that is both a wrong answer and a way to pull back rows the query never asked for.\n *\n * Escaping the backslash FIRST is what fixes it — afterwards every `\\` in the string is one this\n * function put there, so the later replacements cannot collide with a user-supplied one.\n */\nexport function escapeLikePattern(query: string): string {\n  return `%${query.replace(/\\\\/g, \"\\\\\\\\\").replace(/%/g, \"\\\\%\").replace(/_/g, \"\\\\_\")}%`;\n}\n","/**\n * Common `MemoryIndex` interface shared between the SQLite-backed\n * `IndexManager` (default) and the Lance-backed adapter (ADR D43, shipped\n * v1.4.0 via lancedb-backend-ship-v1-1 plan).\n *\n * Consumers (`local-agent-memory.ts`, `active-memory.ts`, `tools.ts`,\n * `runActiveMemory`) only ever call `sync()`, `search()`, `status()`,\n * `close()` — the union of those four methods is the portable surface.\n *\n * Why a separate file (vs declaring inline in `index-manager.ts`)? D43\n * promised \"extract an abstract `MemoryIndex` interface in\n * `internal/memory/index-interface.ts`\". Keeping the contract physically\n * separated from one of its implementations preserves OCP — future\n * backends (Qdrant, PGVector) can land without touching IndexManager.\n *\n * @internal\n */\n\nimport type { IndexStatus, MemorySearchHit, SearchOptions } from \"./index-manager-contract.js\";\n\n// Re-export consumer-facing shapes for stable internal import paths.\nexport type { IndexStatus, MemorySearchHit, SearchOptions };\n\nexport interface SyncResult {\n  filesScanned: number;\n  filesUpdated: number;\n  chunksWritten: number;\n  chunksEmbedded: number;\n}\n\n/**\n * Common search-options parser used by both `IndexManager.search` and\n * `LanceMemoryAdapter.search`. Returns the normalized cap + minimum-score\n * floor — eliminates jscpd duplication while keeping per-backend search\n * logic distinct.\n */\nexport function parseSearchOptions(options: SearchOptions = {}): {\n  maxResults: number;\n  minScore: number;\n} {\n  return {\n    maxResults: Math.max(1, options.maxResults ?? 10),\n    minScore: options.minScore ?? 0,\n  };\n}\n\nexport interface MemoryIndex {\n  /**\n   * Walk the memory corpus + reindex changed files. Lance backend has no\n   * markdown corpus to walk — its adapter returns zero counts (no-op) and\n   * relies on explicit `addFact` calls instead.\n   */\n  sync(): Promise<SyncResult>;\n\n  /**\n   * Semantic + textual search over the indexed corpus. Both backends\n   * return the same `MemorySearchHit[]` shape; Lance leaves `textScore`\n   * undefined (vector-only — no FTS5 layer).\n   */\n  search(query: string, options?: SearchOptions): Promise<MemorySearchHit[]>;\n\n  /** Snapshot of the index health (backend type + counts). */\n  status(): IndexStatus;\n\n  /** Release native handles. Idempotent. */\n  close(): Promise<void> | void;\n}\n","/**\n * `LanceMemoryAdapter` — wraps `LanceIndex` to expose the common\n * `MemoryIndex` interface (sync/search/status/close) so consumers of\n * `IndexManager.open({ backend: \"lance\" })` get a drop-in replacement\n * for the SQLite-backed `IndexManager`.\n *\n * Semantic deltas vs SQLite (documented so callers know what to expect):\n *\n *  - `sync()` is a NO-OP. Lance is a pure vector store — there is no\n *    markdown corpus to crawl. Returns zero counts. Consumers writing\n *    facts use `LanceIndex.addFacts` directly (exposed via the index\n *    object returned to advanced callers).\n *  - `search()` performs vector-only retrieval. `MemorySearchHit.textScore`\n *    is undefined (no FTS5 layer); `vectorScore === score`.\n *  - `status()` reports `backend: \"hybrid\"` only when an embedding runtime\n *    is wired (always the case for Lance — embedding is required at open).\n *    `chunksIndexed` reflects total Lance row count; `filesIndexed` is 0\n *    because Lance does not track file provenance per-row.\n *\n * Ships with the lancedb-backend-ship-v1-1 plan (close D12, supersede via\n * D43). v1.4.0 of `@theokit/sdk`.\n *\n * @internal\n */\n\nimport type { IndexStatus, MemorySearchHit, SearchOptions } from \"./index-manager-contract.js\";\nimport type { LanceIndex } from \"./lance-index.js\";\nimport { type MemoryIndex, parseSearchOptions, type SyncResult } from \"./memory-index.js\";\n\n/**\n * Default namespace used when consumers call `search()` without specifying\n * one. The SQLite `IndexManager` does not surface namespace in its public\n * `search()` signature either — both backends therefore behave consistently\n * under the \"single-workspace, single-namespace\" assumption that v1.4 ships.\n *\n * v1.5 candidate: surface `namespace` in `SearchOptions` (additive — no\n * breaking change) so multi-tenant Lance consumers can scope queries.\n */\nconst DEFAULT_NAMESPACE = \"default\";\n\n/** Empty sync result — Lance has no corpus to walk. */\nconst EMPTY_SYNC_RESULT: SyncResult = Object.freeze({\n  filesScanned: 0,\n  filesUpdated: 0,\n  chunksWritten: 0,\n  chunksEmbedded: 0,\n});\n\nexport class LanceMemoryAdapter implements MemoryIndex {\n  constructor(private readonly inner: LanceIndex) {}\n\n  /**\n   * No-op for Lance — see file header. Returns zero counts so callers'\n   * existing logging (`filesScanned: X`) does not break.\n   */\n  async sync(): Promise<SyncResult> {\n    return EMPTY_SYNC_RESULT;\n  }\n\n  // jscpd:ignore-start — search signature + early-out is idiomatic\n  // overlap with IndexManager.search; further factoring would hurt\n  // readability (the bodies diverge sharply right after).\n  async search(query: string, options: SearchOptions = {}): Promise<MemorySearchHit[]> {\n    if (query.trim().length === 0) return [];\n    const { maxResults, minScore } = parseSearchOptions(options);\n    // jscpd:ignore-end\n    const lanceHits = await this.inner.search(query, {\n      namespace: DEFAULT_NAMESPACE,\n      limit: maxResults * 2,\n      ...(options.sources !== undefined ? { sources: options.sources } : {}),\n    });\n    return lanceHits\n      .filter((h) => h.score >= minScore)\n      .slice(0, maxResults)\n      .map((h) => translateLanceHit(h, query));\n  }\n\n  status(): IndexStatus {\n    // chunksIndexed via a synchronous best-effort — Lance API is async so\n    // we surface zero here and document that consumers needing exact counts\n    // should call `inner.countFacts()` directly.\n    return {\n      backend: \"hybrid\",\n      filesIndexed: 0,\n      chunksIndexed: 0,\n    };\n  }\n\n  async close(): Promise<void> {\n    await this.inner.close();\n  }\n\n  /**\n   * Escape hatch for advanced callers (migration tool, benchmark script)\n   * that need direct access to addFacts/countFacts/removeFacts.\n   */\n  unwrap(): LanceIndex {\n    return this.inner;\n  }\n}\n\n/**\n * Translate `LanceSearchHit` to `MemorySearchHit`. Field mapping:\n *\n *   - `id` → `path` (Lance has no file-system provenance; use opaque id)\n *   - `text` → `snippet` (truncated to 200 chars matching IndexManager convention)\n *   - `score` → combined (0.7 × vectorScore + 0.3 × textScore)\n *   - `vectorScore` → from Lance's distance metric\n *   - `textScore` → T4.5 client-side term-overlap ratio (removes ADR D43 vector-only caveat)\n *   - `source` → `source`\n *   - synthetic `startLine: 0, endLine: 0` (Lance has no line info)\n *   - synthetic `citation: id` (no path:line citation available)\n */\nfunction translateLanceHit(\n  hit: { id: string; text: string; source: \"memory\" | \"sessions\" | \"wiki\"; score: number },\n  query?: string,\n): MemorySearchHit {\n  const textScore = query !== undefined ? computeTermOverlapScore(query, hit.text) : 0;\n  const vectorScore = hit.score;\n  // Hybrid combination: 70% vector (semantic) + 30% text (lexical).\n  const combined = 0.7 * vectorScore + 0.3 * textScore;\n  return {\n    path: hit.id,\n    startLine: 0,\n    endLine: 0,\n    score: combined,\n    textScore,\n    vectorScore,\n    snippet: hit.text.slice(0, 200),\n    source: hit.source,\n    citation: hit.id,\n  };\n}\n\n/**\n * T4.5 — Client-side term-overlap score for Lance hybrid search.\n * Counts what fraction of query terms appear in the text (case-insensitive).\n * Simple but effective for re-ranking vector hits by lexical relevance.\n * Returns 0..1 where 1 = all query terms present.\n */\nfunction computeTermOverlapScore(query: string, text: string): number {\n  const queryTerms = query\n    .toLowerCase()\n    .split(/\\s+/)\n    .filter((t) => t.length > 1);\n  if (queryTerms.length === 0) return 0;\n  const textLower = text.toLowerCase();\n  const matched = queryTerms.filter((term) => textLower.includes(term)).length;\n  return matched / queryTerms.length;\n}\n","/**\n * Dispatch helpers for `IndexManager.open`. Extracted to keep\n * `index-manager.ts` under the G8 400-LoC budget (lancedb-backend-ship-v1-1).\n *\n * @internal\n */\n\nimport { ConfigurationError } from \"../../errors.js\";\nimport type { MemoryBackend, OpenIndexOptions } from \"./index-manager-contract.js\";\nimport { LanceIndex } from \"./lance-index.js\";\nimport { LanceMemoryAdapter } from \"./lance-memory-adapter.js\";\nimport type { MemoryIndex } from \"./memory-index.js\";\n\n/** Valid backend identifiers — runtime guard against TS-narrowing escapes (EC-1). */\nexport const VALID_BACKENDS: readonly MemoryBackend[] = [\"sqlite-vec\", \"lance\"];\n\n/**\n * EC-1: runtime guard for `opts.backend`. TS union is compile-time only;\n * consumers passing JS `as any` typos must hit a typed error, not silent\n * SQLite fallback.\n */\nexport function assertValidBackend(backend: string): asserts backend is MemoryBackend {\n  if (!VALID_BACKENDS.includes(backend as MemoryBackend)) {\n    throw new ConfigurationError(\n      `Invalid memory backend \"${backend}\". Valid values: ${VALID_BACKENDS.join(\", \")}.`,\n      { code: \"invalid_memory_backend\" },\n    );\n  }\n}\n\n/**\n * Lance-path open. Throws `lance_requires_embedding` when no embedding\n * runtime is provided (Lance is vector-only — no FTS fallback).\n * Surfaces `lance_backend_unavailable` from LanceIndex.open when peer\n * dep is absent.\n */\nexport async function openLanceIndex(opts: OpenIndexOptions): Promise<MemoryIndex> {\n  if (opts.embedding === undefined) {\n    throw new ConfigurationError(\n      \"Lance backend requires an embedding runtime. Pass `embedding: { provider, model, apiKey }` in Memory.create options (or omit `backend` to use SQLite default).\",\n      { code: \"lance_requires_embedding\" },\n    );\n  }\n  const lance = await LanceIndex.open({\n    cwd: opts.cwd,\n    embedding: opts.embedding,\n    ...(opts.filePath !== undefined ? { storagePath: opts.filePath } : {}),\n  });\n  return new LanceMemoryAdapter(lance);\n}\n","import { ConfigurationError } from \"../../errors.js\";\nimport type { MemoryDb } from \"./index-db.js\";\n\n/**\n * Load the `sqlite-vec` extension into an opened SQLite connection.\n *\n * Wraps the native `load(db)` call from the `sqlite-vec` npm package with a\n * typed error path (EC-8 of the edge-case review) so callers see a\n * `sqlite_vec_unavailable` ConfigurationError instead of a raw native error.\n *\n * @internal\n */\nexport async function loadSqliteVecExtension(db: MemoryDb): Promise<void> {\n  try {\n    const mod = await import(\"sqlite-vec\");\n    const loadFn = (mod as { load?: (db: unknown) => void }).load;\n    if (typeof loadFn !== \"function\") {\n      throw new Error(\"sqlite-vec module exposes no `load` export\");\n    }\n    loadFn(db);\n  } catch (cause) {\n    const message = cause instanceof Error ? cause.message : String(cause);\n    throw new ConfigurationError(\n      `sqlite-vec extension unavailable. Install \\`sqlite-vec\\` and ensure the native binary matches your Node + OS. Cause: ${message}`,\n      { code: \"sqlite_vec_unavailable\", cause },\n    );\n  }\n}\n","import { createHash } from \"node:crypto\";\n\nimport type { MemoryChunk } from \"../types.js\";\n\n/**\n * Split a markdown document into semantically meaningful chunks (ADR D1 of\n * memory-system-peer-project-parity).\n *\n * Algorithm:\n *   1. Walk lines tracking the current heading (latest `^#+ ` line).\n *   2. Split chunks at the next heading boundary AND on blank-line paragraph\n *      boundaries.\n *   3. If a single paragraph exceeds `maxChars`, split it at the nearest\n *      whitespace ≤ maxChars (word-aligned per edge-case review EC-6) —\n *      never mid-word.\n *\n * Mirrors peer-project's `chunkMarkdown` from\n * `packages/memory-host-sdk/src/host/chunk-markdown.ts`.\n *\n * @internal\n */\n\nexport interface ChunkMarkdownOptions {\n  /** Maximum chars per chunk. Default 800. */\n  maxChars?: number;\n  /** Minimum chars per chunk (avoids splintering tiny lines). Default 80. */\n  minChars?: number;\n}\n\nconst HEADING_RE = /^(#{1,6})\\s+(.+?)\\s*$/;\n\ninterface ChunkAccumulator {\n  chunks: MemoryChunk[];\n  lines: string[];\n  start: number;\n  heading: string | undefined;\n}\n\nexport function chunkMarkdown(text: string, options: ChunkMarkdownOptions = {}): MemoryChunk[] {\n  const maxChars = options.maxChars ?? 800;\n  if (text.length === 0) return [];\n  const lines = text.split(\"\\n\");\n  const acc: ChunkAccumulator = { chunks: [], lines: [], start: 1, heading: undefined };\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i] ?? \"\";\n    const lineNumber = i + 1;\n    processLine(acc, line, lineNumber, maxChars);\n  }\n  flushAccumulator(acc, lines.length, maxChars);\n  return acc.chunks;\n}\n\nfunction processLine(\n  acc: ChunkAccumulator,\n  line: string,\n  lineNumber: number,\n  maxChars: number,\n): void {\n  const headingMatch = HEADING_RE.exec(line);\n  const isBlank = line.trim().length === 0;\n  if (headingMatch !== null && acc.lines.length > 0) {\n    flushAccumulator(acc, lineNumber - 1, maxChars);\n  }\n  if (headingMatch !== null) acc.heading = headingMatch[2];\n  acc.lines.push(line);\n  if (isBlank && acc.lines.length > 1) {\n    const joined = acc.lines.join(\"\\n\");\n    if (joined.trim().length > 0) flushAccumulator(acc, lineNumber, maxChars);\n  }\n}\n\nfunction flushAccumulator(acc: ChunkAccumulator, endLineExclusive: number, maxChars: number): void {\n  if (acc.lines.length === 0) return;\n  const chunkText = acc.lines.join(\"\\n\");\n  if (chunkText.trim().length === 0) {\n    acc.lines = [];\n    acc.start = endLineExclusive + 1;\n    return;\n  }\n  if (chunkText.length > maxChars) {\n    pushOversizedSlices(acc.chunks, chunkText, acc.start, acc.heading, maxChars);\n  } else {\n    acc.chunks.push(buildChunk(chunkText, acc.start, endLineExclusive, acc.heading));\n  }\n  acc.lines = [];\n  acc.start = endLineExclusive + 1;\n}\n\nfunction buildChunk(\n  text: string,\n  startLine: number,\n  endLine: number,\n  heading: string | undefined,\n): MemoryChunk {\n  return {\n    startLine,\n    endLine,\n    text,\n    hash: createHash(\"sha256\").update(text).digest(\"hex\"),\n    ...(heading !== undefined ? { heading } : {}),\n  };\n}\n\nfunction pushOversizedSlices(\n  chunks: MemoryChunk[],\n  text: string,\n  startLine: number,\n  heading: string | undefined,\n  maxChars: number,\n): void {\n  let remaining = text;\n  let lineCursor = startLine;\n  while (remaining.length > maxChars) {\n    const splitAt = findWordBoundarySplit(remaining, maxChars);\n    const slice = remaining.slice(0, splitAt);\n    const sliceLines = slice.split(\"\\n\").length;\n    chunks.push(buildChunk(slice, lineCursor, lineCursor + sliceLines - 1, heading));\n    remaining = remaining.slice(splitAt).replace(/^\\s+/, \"\");\n    lineCursor += sliceLines - 1;\n  }\n  if (remaining.length > 0) {\n    const sliceLines = remaining.split(\"\\n\").length;\n    chunks.push(buildChunk(remaining, lineCursor, lineCursor + sliceLines - 1, heading));\n  }\n}\n\n/**\n * Find a split point ≤ maxChars that lands on a whitespace boundary so we\n * don't slice a word in half. Falls back to maxChars if no whitespace is\n * within range (very rare — a single token > maxChars).\n */\nfunction findWordBoundarySplit(text: string, maxChars: number): number {\n  if (text.length <= maxChars) return text.length;\n  // Walk backward from maxChars looking for whitespace.\n  for (let i = maxChars; i > Math.max(0, maxChars - 200); i--) {\n    if (/\\s/.test(text[i] ?? \"x\")) return i;\n  }\n  // No whitespace within 200 chars of the cap — accept a hard split.\n  return maxChars;\n}\n","import type { EmbeddingRuntime } from \"./embedding-adapter.js\";\nimport type { MemoryDb } from \"./index-db.js\";\n\n/**\n * Vector index helpers (ADR D2 + D4 of memory-system-peer-project-parity).\n *\n * Embeddings live in `embeddings(chunk_id, vec)` — a `vec0` virtual table\n * provided by the sqlite-vec extension. Embedding identity (providerId +\n * model + dimension) lives in the `meta` table; mismatches force a full\n * re-embed sweep (EC-1).\n *\n * @internal\n */\n\nexport const META_KEY_PROVIDER_ID = \"embedding.providerId\";\nexport const META_KEY_MODEL = \"embedding.model\";\nexport const META_KEY_DIMENSION = \"embedding.dimension\";\n\nexport interface EmbeddingIdentity {\n  providerId: string;\n  model: string;\n  dimension: number;\n}\n\nexport function readEmbeddingIdentity(db: MemoryDb): EmbeddingIdentity | undefined {\n  const get = (key: string): string | undefined => {\n    const row = db.prepare(\"SELECT value FROM meta WHERE key = ?\").get(key);\n    return row !== undefined ? String(row.value) : undefined;\n  };\n  const providerId = get(META_KEY_PROVIDER_ID);\n  const model = get(META_KEY_MODEL);\n  const dimRaw = get(META_KEY_DIMENSION);\n  if (providerId === undefined || model === undefined || dimRaw === undefined) return undefined;\n  const dimension = Number(dimRaw);\n  if (!Number.isFinite(dimension) || dimension <= 0) return undefined;\n  return { providerId, model, dimension };\n}\n\nexport function writeEmbeddingIdentity(db: MemoryDb, identity: EmbeddingIdentity): void {\n  const stmt = db.prepare(\n    \"INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value\",\n  );\n  stmt.run(META_KEY_PROVIDER_ID, identity.providerId);\n  stmt.run(META_KEY_MODEL, identity.model);\n  stmt.run(META_KEY_DIMENSION, String(identity.dimension));\n}\n\nexport function identityMatches(a: EmbeddingIdentity, b: EmbeddingIdentity): boolean {\n  return a.providerId === b.providerId && a.model === b.model && a.dimension === b.dimension;\n}\n\nexport function dropVectorIndex(db: MemoryDb): void {\n  db.exec(\"DROP TABLE IF EXISTS embeddings\");\n}\n\nexport function createVectorIndex(db: MemoryDb, dimension: number): void {\n  db.exec(`CREATE VIRTUAL TABLE IF NOT EXISTS embeddings USING vec0(\n    chunk_id INTEGER PRIMARY KEY,\n    vec FLOAT[${dimension}]\n  )`);\n}\n\n/** Pack a Float32Array into a Buffer suitable for sqlite-vec BLOB binding. */\nexport function packVector(vec: ReadonlyArray<number>): Buffer {\n  const f32 = new Float32Array(vec.length);\n  for (let i = 0; i < vec.length; i++) f32[i] = vec[i] ?? 0;\n  return Buffer.from(f32.buffer);\n}\n\nexport function upsertEmbedding(db: MemoryDb, chunkId: number, vec: ReadonlyArray<number>): void {\n  // sqlite-vec vec0 virtual tables don't support UPSERT — emulate via\n  // DELETE-then-INSERT. vec0 REJECTS JS Number for chunk_id columns; it\n  // requires BigInt binding. Verified via repro against vec0 v0.1.9.\n  const id = BigInt(chunkId);\n  db.prepare(\"DELETE FROM embeddings WHERE chunk_id = ?\").run(id);\n  db.prepare(\"INSERT INTO embeddings (chunk_id, vec) VALUES (?, ?)\").run(id, packVector(vec));\n}\n\nexport interface VectorHitRow {\n  chunk_id: number;\n  distance: number;\n}\n\nexport function vectorSearch(\n  db: MemoryDb,\n  query: ReadonlyArray<number>,\n  k: number,\n): VectorHitRow[] {\n  // sqlite-vec returns distance (lower = closer). Use KNN syntax. k needs\n  // a BigInt-typed binding too.\n  const rows = db\n    .prepare(\n      `SELECT chunk_id, distance FROM embeddings\n       WHERE vec MATCH ? AND k = ?\n       ORDER BY distance`,\n    )\n    .all(packVector(query), BigInt(k));\n  return rows.map((row) => ({ chunk_id: Number(row.chunk_id), distance: Number(row.distance) }));\n}\n\nexport interface EmbedAllArgs {\n  db: MemoryDb;\n  runtime: EmbeddingRuntime;\n}\n\n/** Embed every chunk that doesn't yet have a vector. */\nexport async function embedMissingChunks(args: EmbedAllArgs): Promise<number> {\n  const rows = args.db\n    .prepare(\n      `SELECT chunks.id as id, chunks.text as text\n       FROM chunks\n       LEFT JOIN embeddings ON embeddings.chunk_id = chunks.id\n       WHERE embeddings.chunk_id IS NULL`,\n    )\n    .all();\n  if (rows.length === 0) return 0;\n  const normalized = rows.map((row) => ({ id: Number(row.id), text: String(row.text ?? \"\") }));\n  const vectors = await args.runtime.embed(normalized.map((r) => r.text));\n  for (let i = 0; i < normalized.length; i++) {\n    const row = normalized[i];\n    const vector = vectors[i];\n    if (row === undefined || vector === undefined) continue;\n    upsertEmbedding(args.db, row.id, vector);\n  }\n  return normalized.length;\n}\n","import { createHash } from \"node:crypto\";\nimport { readFile, stat } from \"node:fs/promises\";\nimport { sanitizeFts5Query } from \"../persistence/fts5-sanitize.js\";\nimport type { EmbeddingRuntime } from \"./embedding-adapter.js\";\nimport { LruEmbeddingCache } from \"./embedding-cache.js\";\nimport { escapeLikePattern } from \"./escape-like-pattern.js\";\nimport { defaultIndexPath, type MemoryDb, openMemoryDb } from \"./index-db.js\";\nimport { assertValidBackend, openLanceIndex } from \"./index-manager-dispatch.js\";\nimport {\n  blendScores,\n  collectMarkdownFiles,\n  resolveWeights,\n  sha256,\n  truncateSnippet,\n} from \"./index-manager-helpers.js\";\nimport { type MemoryIndex, parseSearchOptions } from \"./memory-index.js\";\nimport { loadSqliteVecExtension } from \"./sqlite-vec-loader.js\";\nimport { chunkMarkdown } from \"./storage/chunk-markdown.js\";\nimport { type MemoryRoot, projectMemoryDir, resolveMemoryRoot } from \"./storage/memory-root.js\";\n\n// T4.1 — query-vector LRU cache (DR4 finding #1). Keyed by\n// sha256(query); caches the embedding vector so repeated search\n// queries skip the HTTP round-trip (p99 1.5-3s → ~0ms on hit).\n// Process-wide singleton with bounded capacity (default 2000 queries).\nconst queryVectorCache = new LruEmbeddingCache(2000);\n\nimport {\n  createVectorIndex,\n  dropVectorIndex,\n  embedMissingChunks,\n  identityMatches,\n  readEmbeddingIdentity,\n  vectorSearch,\n  writeEmbeddingIdentity,\n} from \"./vec-index.js\";\n\n/**\n * Memory index manager (ADR D2). FTS5-only at Phase 3; vector index lands in\n * Phase 5.\n *\n * Lifecycle:\n *   const idx = await IndexManager.open({ cwd });\n *   await idx.sync();\n *   const hits = await idx.search(\"query\");\n *   idx.close();\n *\n * @internal\n */\n\n// T2.1 / ADR D433 — these types now live in `index-manager-contract.ts`\n// to break the 3-cycle memory cluster. Re-exported here for back-compat\n// with downstream importers that historically pulled from this file.\nexport type {\n  IndexStatus,\n  MemoryBackend,\n  MemorySearchHit,\n  OpenIndexOptions,\n  SearchOptions,\n} from \"./index-manager-contract.js\";\n\nimport type {\n  IndexStatus,\n  MemorySearchHit,\n  OpenIndexOptions,\n  SearchOptions,\n} from \"./index-manager-contract.js\";\n\nexport class IndexManager implements MemoryIndex {\n  private lastSyncMs: number | undefined;\n  private vectorReady = false;\n\n  private constructor(\n    private readonly memoryRoot: MemoryRoot,\n    private readonly db: MemoryDb,\n    private readonly embedding: EmbeddingRuntime | undefined,\n  ) {}\n\n  /**\n   * Open a memory index. Dispatches to SQLite (default) or Lance (opt-in\n   * via `backend: \"lance\"`). See `openLanceInternal` for Lance-specific\n   * preconditions + typed errors.\n   */\n  static async open(opts: OpenIndexOptions & { backend: \"lance\" }): Promise<MemoryIndex>;\n  static async open(\n    opts: Omit<OpenIndexOptions, \"backend\"> | (OpenIndexOptions & { backend?: \"sqlite-vec\" }),\n  ): Promise<IndexManager>;\n  static async open(opts: OpenIndexOptions): Promise<MemoryIndex> {\n    const backend = opts.backend ?? \"sqlite-vec\";\n    assertValidBackend(backend);\n    if (backend === \"lance\") return await openLanceIndex(opts);\n    return await IndexManager.openSqliteInternal(opts);\n  }\n\n  /** Internal SQLite-path open. Renamed from previous public `open`. */\n  private static async openSqliteInternal(opts: OpenIndexOptions): Promise<IndexManager> {\n    const memoryRoot = opts.memoryRoot ?? resolveMemoryRoot(opts.cwd);\n    // What gets INDEXED and where the DATABASE lives are two decisions, and they diverge on\n    // purpose. The corpus is the configured root; the database stays in the project store, because\n    // `memory.directory` may name the directory the Claude Code CLI manages and that CLI has no\n    // index format (`docs/memory-decisions.md` § 1). Collapsing them writes a binary the partner\n    // does not understand into a directory it owns.\n    const filePath = opts.filePath ?? defaultIndexPath(projectMemoryDir(opts.cwd));\n    const db = await openMemoryDb({ filePath });\n    const manager = new IndexManager(memoryRoot, db, opts.embedding);\n    if (opts.embedding !== undefined) await manager.initVectorBackend(opts.embedding);\n    return manager;\n  }\n\n  private async initVectorBackend(runtime: EmbeddingRuntime): Promise<void> {\n    await loadSqliteVecExtension(this.db);\n    const currentIdentity = {\n      providerId: runtime.id,\n      model: runtime.model,\n      dimension: runtime.dimension,\n    };\n    const persisted = readEmbeddingIdentity(this.db);\n    if (persisted !== undefined && !identityMatches(persisted, currentIdentity)) {\n      // EC-1: dimension/model/provider changed — drop the vector index and\n      // force a full re-embed on next sync.\n      dropVectorIndex(this.db);\n    }\n    createVectorIndex(this.db, runtime.dimension);\n    writeEmbeddingIdentity(this.db, currentIdentity);\n    this.vectorReady = true;\n  }\n\n  /** Walk the memory corpus + (re)index changed files. */\n  async sync(): Promise<{\n    filesScanned: number;\n    filesUpdated: number;\n    chunksWritten: number;\n    chunksEmbedded: number;\n  }> {\n    const files = await collectMarkdownFiles(this.memoryRoot);\n    let filesUpdated = 0;\n    let chunksWritten = 0;\n    const existingByPath = this.loadFilesIndex();\n    for (const entry of files) {\n      const raw = await readFile(entry.absolutePath, \"utf8\");\n      const hash = sha256(raw);\n      const existing = existingByPath.get(entry.absolutePath);\n      if (existing !== undefined && existing.hash === hash) continue;\n      const stats = await stat(entry.absolutePath);\n      const fileId = this.upsertFile(\n        entry.absolutePath,\n        entry.relPath,\n        hash,\n        stats.mtimeMs,\n        entry.source,\n      );\n      this.deleteChunksForFile(fileId);\n      const chunks = chunkMarkdown(raw);\n      for (const chunk of chunks) {\n        this.insertChunk(fileId, chunk.startLine, chunk.endLine, chunk.text, chunk.hash);\n      }\n      filesUpdated += 1;\n      chunksWritten += chunks.length;\n    }\n    let chunksEmbedded = 0;\n    if (this.vectorReady && this.embedding !== undefined) {\n      chunksEmbedded = await embedMissingChunks({ db: this.db, runtime: this.embedding });\n    }\n    this.lastSyncMs = Date.now();\n    return { filesScanned: files.length, filesUpdated, chunksWritten, chunksEmbedded };\n  }\n\n  async search(query: string, options: SearchOptions = {}): Promise<MemorySearchHit[]> {\n    if (query.trim().length === 0) return [];\n    const { maxResults, minScore } = parseSearchOptions(options);\n    const textHits = this.ftsSearch(query, maxResults * 2);\n    const vectorHitsById = await this.vectorSearchById(query, maxResults * 2);\n    const combined = this.combineHybridScores(textHits, vectorHitsById, options);\n    return combined\n      .filter((h) => h.score >= minScore)\n      .filter((h) => options.sources === undefined || options.sources.includes(h.source))\n      .slice(0, maxResults);\n  }\n\n  status(): IndexStatus {\n    const files = this.db.prepare(\"SELECT COUNT(*) as n FROM files\").get() ?? { n: 0 };\n    const chunks = this.db.prepare(\"SELECT COUNT(*) as n FROM chunks\").get() ?? { n: 0 };\n    const status: IndexStatus = {\n      backend: this.vectorReady ? \"hybrid\" : \"fts-only\",\n      filesIndexed: Number(files.n ?? 0),\n      chunksIndexed: Number(chunks.n ?? 0),\n    };\n    if (this.lastSyncMs !== undefined) status.lastSyncMs = this.lastSyncMs;\n    return status;\n  }\n\n  // ───── search internals ──────────────────────────────────────────────\n\n  private ftsSearch(query: string, limit: number): Array<MemorySearchHit & { chunkId: number }> {\n    // EC-3: short-circuit when sanitizer reduces input to empty string.\n    // Calling `MATCH ''` would error inside FTS5 on some SQLite versions.\n    const sanitized = sanitizeFts5Query(query);\n    if (sanitized.length === 0) return [];\n    const stmt = this.db.prepare(\n      `SELECT chunks.id as id, files.rel_path as rel_path, files.source as source,\n              chunks.start_line as start_line, chunks.end_line as end_line,\n              chunks.text as text, bm25(chunks_fts) as bm25_score\n       FROM chunks_fts\n       JOIN chunks ON chunks_fts.rowid = chunks.id\n       JOIN files  ON chunks.file_id = files.id\n       WHERE chunks_fts MATCH ?\n       ORDER BY bm25_score\n       LIMIT ?`,\n    );\n    let rows: Array<Record<string, unknown>> = [];\n    try {\n      rows = stmt.all(sanitized, limit);\n    } catch {\n      // T4.8 — CJK fallback: FTS5's default tokenizer chokes on CJK\n      // characters (no word boundaries). Instead of returning empty,\n      // fall back to a LIKE search which handles CJK correctly (slower\n      // but correct). ADR D64 documents the trigram-routing deferral.\n      return this.likeSearchFallback(query, limit);\n    }\n    return rows.map((row) => {\n      const bm25 = Number(row.bm25_score ?? 0);\n      const textScore = bm25 < 0 ? 1 / (1 + Math.abs(bm25)) : 1 / (1 + bm25);\n      const startLine = Number(row.start_line ?? 0);\n      const endLine = Number(row.end_line ?? 0);\n      const path = String(row.rel_path);\n      return {\n        path,\n        startLine,\n        endLine,\n        score: textScore,\n        textScore,\n        snippet: truncateSnippet(String(row.text ?? \"\")),\n        source: String(row.source) as \"memory\" | \"sessions\" | \"wiki\",\n        citation: `${path}:${startLine}-${endLine}`,\n        // sneak the chunk id through for the hybrid join below\n        // (cast away later)\n        chunkId: Number(row.id),\n      } as MemorySearchHit & { chunkId: number };\n    });\n  }\n\n  /**\n   * T4.8 — LIKE-based fallback for CJK and other scripts that FTS5's\n   * default tokenizer cannot segment. Slower than FTS5 (full table scan)\n   * but correct for any Unicode input. Returns the same shape as\n   * `ftsSearch` so callers are unaware of the fallback.\n   */\n  private likeSearchFallback(\n    query: string,\n    limit: number,\n  ): Array<MemorySearchHit & { chunkId: number }> {\n    const pattern = escapeLikePattern(query);\n    const stmt = this.db.prepare(\n      `SELECT chunks.id as id, files.rel_path as rel_path, files.source as source,\n              chunks.start_line as start_line, chunks.end_line as end_line,\n              chunks.text as text\n       FROM chunks\n       JOIN files ON chunks.file_id = files.id\n       WHERE chunks.text LIKE ? ESCAPE '\\\\'\n       LIMIT ?`,\n    );\n    const rows = stmt.all(pattern, limit) as Array<Record<string, unknown>>;\n    return rows.map((row) => {\n      const path = String(row.rel_path ?? \"\");\n      const startLine = Number(row.start_line ?? 0);\n      const endLine = Number(row.end_line ?? 0);\n      return {\n        path,\n        startLine,\n        endLine,\n        score: 0.5, // LIKE has no relevance score — use a neutral midpoint\n        textScore: 0.5,\n        snippet: truncateSnippet(String(row.text ?? \"\")),\n        source: String(row.source) as \"memory\" | \"sessions\" | \"wiki\",\n        citation: `${path}:${startLine}-${endLine}`,\n        chunkId: Number(row.id),\n      } as MemorySearchHit & { chunkId: number };\n    });\n  }\n\n  private async vectorSearchById(\n    query: string,\n    limit: number,\n  ): Promise<Map<number, { vectorScore: number; snippet?: string }>> {\n    if (!this.vectorReady || this.embedding === undefined) return new Map();\n    // T4.1 — query-vector LRU cache. The embed call is the p99 hottest\n    // path (1.5-3s per hit). Cache by sha256(query) so repeated queries\n    // skip the HTTP round-trip entirely. The embedding cache (T4.4\n    // globalEmbeddingCache) catches text-level dedup; this catches the\n    // query-level search-result dedup on top.\n    const cacheKey = createHash(\"sha256\").update(query).digest(\"hex\");\n    const cached = queryVectorCache.get(cacheKey);\n    const queryVec = cached ?? (await this.embedding.embed([query]))[0];\n    if (queryVec === undefined) return new Map();\n    if (cached === undefined) queryVectorCache.set(cacheKey, queryVec);\n    const rows = vectorSearch(this.db, queryVec, limit);\n    // sqlite-vec distance: lower = closer. Normalize to 0..1 with higher = better.\n    const out = new Map<number, { vectorScore: number }>();\n    for (const row of rows) {\n      const score = 1 / (1 + Math.max(0, row.distance));\n      out.set(row.chunk_id, { vectorScore: score });\n    }\n    return out;\n  }\n\n  private combineHybridScores(\n    textHits: Array<MemorySearchHit & { chunkId: number }>,\n    vectorHitsById: Map<number, { vectorScore: number }>,\n    options: SearchOptions,\n  ): MemorySearchHit[] {\n    const weights = resolveWeights(options);\n    const merged = this.mergeHits(textHits, vectorHitsById);\n    const combined = [...merged.values()].map((hit) =>\n      blendScores(hit, vectorHitsById.get(hit.chunkId)?.vectorScore ?? 0, weights),\n    );\n    return combined.sort((a, b) => b.score - a.score);\n  }\n\n  private mergeHits(\n    textHits: Array<MemorySearchHit & { chunkId: number }>,\n    vectorHitsById: Map<number, { vectorScore: number }>,\n  ): Map<number, MemorySearchHit & { chunkId: number }> {\n    const merged = new Map<number, MemorySearchHit & { chunkId: number }>();\n    for (const hit of textHits) merged.set(hit.chunkId, hit);\n    const missingIds = [...vectorHitsById.keys()].filter((id) => !merged.has(id));\n    if (missingIds.length > 0) {\n      for (const hit of this.fetchChunksByIds(missingIds)) {\n        merged.set(hit.chunkId, { ...hit, score: 0, textScore: 0 });\n      }\n    }\n    return merged;\n  }\n\n  private fetchChunksByIds(\n    ids: ReadonlyArray<number>,\n  ): Array<MemorySearchHit & { chunkId: number }> {\n    if (ids.length === 0) return [];\n    const placeholders = ids.map(() => \"?\").join(\",\");\n    const rows = this.db\n      .prepare(\n        `SELECT chunks.id as id, files.rel_path as rel_path, files.source as source,\n                chunks.start_line as start_line, chunks.end_line as end_line,\n                chunks.text as text\n         FROM chunks JOIN files ON chunks.file_id = files.id\n         WHERE chunks.id IN (${placeholders})`,\n      )\n      .all(...ids);\n    return rows.map((row) => {\n      const startLine = Number(row.start_line ?? 0);\n      const endLine = Number(row.end_line ?? 0);\n      const path = String(row.rel_path);\n      return {\n        chunkId: Number(row.id),\n        path,\n        startLine,\n        endLine,\n        score: 0,\n        textScore: 0,\n        snippet: truncateSnippet(String(row.text ?? \"\")),\n        source: String(row.source) as \"memory\" | \"sessions\" | \"wiki\",\n        citation: `${path}:${startLine}-${endLine}`,\n      };\n    });\n  }\n\n  // ───── persistence helpers ─────────────────────────────────────────\n\n  private loadFilesIndex(): Map<string, { id: number; hash: string }> {\n    const rows = this.db.prepare(\"SELECT id, path, hash FROM files\").all() as Array<{\n      id: number;\n      path: string;\n      hash: string;\n    }>;\n    return new Map(rows.map((row) => [row.path, { id: row.id, hash: row.hash }]));\n  }\n\n  private upsertFile(\n    absPath: string,\n    relPath: string,\n    hash: string,\n    mtimeMs: number,\n    source: \"memory\" | \"wiki\" | \"sessions\" = \"memory\",\n  ): number {\n    const stmt = this.db.prepare(\n      `INSERT INTO files (path, rel_path, mtime, hash, source) VALUES (?, ?, ?, ?, ?)\n       ON CONFLICT(path) DO UPDATE SET hash = excluded.hash, mtime = excluded.mtime, source = excluded.source\n       RETURNING id`,\n    );\n    const row = stmt.get(absPath, relPath, Math.floor(mtimeMs), hash, source) as { id: number };\n    return row.id;\n  }\n\n  private deleteChunksForFile(fileId: number): void {\n    this.db.prepare(\"DELETE FROM chunks WHERE file_id = ?\").run(fileId);\n  }\n\n  private insertChunk(\n    fileId: number,\n    startLine: number,\n    endLine: number,\n    text: string,\n    hash: string,\n  ): void {\n    this.db\n      .prepare(\n        \"INSERT INTO chunks (file_id, start_line, end_line, text, hash) VALUES (?, ?, ?, ?, ?)\",\n      )\n      .run(fileId, startLine, endLine, text, hash);\n  }\n\n  close(): void {\n    this.db.close();\n  }\n}\n\n// Replaced by `sanitizeFts5Query` from `internal/persistence/fts5-sanitize.ts`\n// (T5.2, ADR D64). The new sanitizer is the 6-step port of Hermes'\n// `_sanitize_fts5_query` and handles hyphens/dots/underscores correctly\n// without quoting every token.\n"]}

package/dist/chunk-WLQNMXQE.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/internal/global-singleton.ts","../src/internal/providers/registry.ts","../src/internal/providers/catalog-schema.ts","../src/internal/providers/catalog-loader.ts","../src/internal/providers/builtin/anthropic.ts","../src/internal/providers/builtin/bedrock.ts","../src/internal/providers/builtin/openai-compatible.ts","../src/internal/providers/builtin/cerebras.ts","../src/internal/providers/builtin/cohere.ts","../src/internal/providers/builtin/deepinfra.ts","../src/internal/providers/builtin/gemini.ts","../src/internal/providers/builtin/google.ts","../src/internal/providers/builtin/groq.ts","../src/internal/providers/builtin/llamacpp.ts","../src/internal/providers/builtin/lmstudio.ts","../src/internal/providers/builtin/mistral.ts","../src/internal/providers/builtin/ollama.ts","../src/internal/providers/builtin/openai.ts","../src/internal/providers/builtin/openai-chatgpt.ts","../src/internal/providers/builtin/openrouter.ts","../src/internal/providers/builtin/perplexity.ts","../src/internal/providers/builtin/together.ts","../src/internal/providers/builtin/vertex.ts","../src/internal/providers/builtin/xai.ts","../src/internal/providers/builtin/index.ts"],"names":[],"mappings":";;;;;;;;;;AAYO,SAAS,eAAA,CAAmB,KAAa,MAAA,EAAoB;AAClE,EAAA,MAAM,CAAA,GAAI,UAAA;AACV,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA;AAC1B,EAAA,IAAI,EAAE,GAAG,CAAA,KAAM,QAAW,CAAA,CAAE,GAAG,IAAI,MAAA,EAAO;AAC1C,EAAA,OAAO,EAAE,GAAG,CAAA;AACd;;;ACIA,IAAM,QAAA,GAAW,eAAA;AAAA,EACf,gCAAA;AAAA,EACA,0BAAU,GAAA;AACZ,CAAA;AACA,IAAM,UAAU,eAAA,CAAgB,+BAAA,EAAiC,sBAAM,IAAI,KAAqB,CAAA;AAEzF,SAAS,iBAAiB,OAAA,EAAgC;AAC/D,EAAA,IAAI,QAAA,CAAS,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC9B,IAAA,IAAA,CAAK,CAAA,wBAAA,EAA2B,QAAQ,IAAI,CAAA;AAAA,CAAgC,CAAA;AAAA,EAC9E;AACA,EAAA,QAAA,CAAS,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AAClC,EAAA,KAAA,MAAW,KAAA,IAAS,OAAA,CAAQ,OAAA,IAAW,EAAC,EAAG;AAEzC,IAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA;AAClC,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,KAAa,OAAA,CAAQ,IAAA,EAAM;AACvD,MAAA,IAAA,CAAK,wBAAwB,KAAK,CAAA,kBAAA,EAAqB,QAAQ,CAAA,QAAA,EAAW,QAAQ,IAAI,CAAA;AAAA,CAAM,CAAA;AAAA,IAC9F;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,EAAO,OAAA,CAAQ,IAAI,CAAA;AAAA,EACjC;AACF;AAEO,SAAS,mBAAmB,IAAA,EAA2C;AAC5E,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,IAAI,CAAA,IAAK,IAAA;AACvC,EAAA,OAAO,QAAA,CAAS,IAAI,SAAS,CAAA;AAC/B;AAEO,SAAS,aAAA,GAAmC;AACjD,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,MAAA,EAAQ,CAAA;AACrC;AC7BO,IAAM,aAAa,CAAC,MAAA,EAAQ,OAAA,EAAS,OAAA,EAAS,SAAS,KAAK,CAAA;AAanE,IAAM,UAAA,GAAa,EAChB,MAAA,CAAO;AAAA;AAAA,EAEN,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,WAAA,EAAY;AAAA,EAC9B,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,WAAA,EAAY;AAAA,EAC/B,YAAY,CAAA,CAAE,MAAA,EAAO,CAAE,WAAA,GAAc,QAAA,EAAS;AAAA,EAC9C,aAAa,CAAA,CAAE,MAAA,EAAO,CAAE,WAAA,GAAc,QAAA;AACxC,CAAC,EACA,KAAA,EAAM;AAET,IAAM,WAAA,GAAc,EACjB,MAAA,CAAO;AAAA,EACN,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,OAAO,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EACtC,QAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,GAAW,QAAA;AAChC,CAAC,EACA,KAAA,EAAM;AAET,IAAM,gBAAA,GAAmB,EACtB,MAAA,CAAO;AAAA,EACN,KAAA,EAAO,EAAE,KAAA,CAAM,CAAA,CAAE,KAAK,UAAU,CAAC,EAAE,QAAA,EAAS;AAAA,EAC5C,MAAA,EAAQ,EAAE,KAAA,CAAM,CAAA,CAAE,KAAK,UAAU,CAAC,EAAE,QAAA;AACtC,CAAC,EACA,KAAA,EAAM;AAEF,IAAM,kBAAA,GAAqB,EAC/B,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1B,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAClC,UAAA,EAAY,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACjC,SAAA,EAAW,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAChC,WAAA,EAAa,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAClC,SAAA,EAAW,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA;AAAA,EAEhC,iBAAA,EAAmB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA;AAAA,EAExC,aAAA,EAAe,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACpC,IAAA,EAAM,WAAW,QAAA,EAAS;AAAA,EAC1B,KAAA,EAAO,YAAY,QAAA,EAAS;AAAA,EAC5B,UAAA,EAAY,iBAAiB,QAAA,EAAS;AAAA,EACtC,MAAA,EAAQ,EAAE,IAAA,CAAK,CAAC,SAAS,MAAA,EAAQ,YAAY,CAAC,CAAA,CAAE,QAAA;AAClD,CAAC,EACA,KAAA;;;ACzDH,IAAM,kBAAA,GAAqB,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAyCjE,IAAM,cAAA,GAAiB,eAAA;AAAA,EACrB,wCAAA;AAAA,EACA,0BAAU,GAAA;AACZ,CAAA;AAEA,IAAM,gBAAA,GAAmB,eAAA;AAAA,EACvB,0CAAA;AAAA,EACA,0BAAU,GAAA;AACZ,CAAA;AACA,IAAM,UAAA,GAAa,eAAA,CAAgB,yCAAA,EAA2C,OAAO;AAAA,EACnF,MAAA,EAAQ;AACV,CAAA,CAAE,CAAA;AASK,SAAS,oBAAoB,GAAA,EAAuC;AACzE,EAAA,sBAAA,EAAuB;AACvB,EAAA,OAAO,cAAA,CAAe,IAAI,GAAG,CAAA;AAC/B;AAGO,SAAS,kBAAkB,GAAA,EAAsB;AACtD,EAAA,OAAO,gBAAA,CAAiB,IAAI,GAAG,CAAA;AACjC;AASO,SAAS,cAAA,CAAe,KAAa,KAAA,EAA2B;AACrE,EAAA,sBAAA,EAAuB;AACvB,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,GAAA,CAAI,GAAG,CAAA;AACvC,EAAA,cAAA,CAAe,GAAA,CAAI,GAAA,EAAK,QAAA,KAAa,MAAA,GAAY,KAAA,GAAQ,EAAE,GAAG,QAAA,EAAU,GAAG,KAAA,EAAO,CAAA;AAClF,EAAA,gBAAA,CAAiB,IAAI,GAAG,CAAA;AAC1B;AAQA,SAAS,sBAAA,GAA+B;AACtC,EAAA,IAAI,WAAW,MAAA,EAAQ;AACvB,EAAA,UAAA,CAAW,MAAA,GAAS,IAAA;AAGpB,EAAA,IAAI;AACF,IAAA,MAAM,UAAU,mBAAA,EAAoB;AACpC,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG;AAC1C,MAAA,gBAAA,CAAiB,KAAK,CAAA;AAAA,IACxB;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA;AAAA,MACE,CAAA,kDAAA,EAAsD,IAAc,OAAO,CAAA;AAAA;AAAA,KAC7E;AAAA,EACF;AACF;AAYA,SAAS,iBAAiB,KAAA,EAA2B;AACnD,EAAA,IAAI,MAAM,MAAA,KAAW,MAAA,IAAa,OAAO,KAAA,CAAM,WAAW,QAAA,EAAU;AACpE,EAAA,KAAA,MAAW,CAAC,SAAS,GAAG,CAAA,IAAK,OAAO,OAAA,CAAQ,KAAA,CAAM,MAAM,CAAA,EAAG;AACzD,IAAA,MAAM,MAAA,GAAS,kBAAA,CAAmB,SAAA,CAAU,GAAG,CAAA;AAC/C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,IAAA;AAAA,QACE,CAAA,sDAAA,EAAyD,KAAA,CAAM,EAAE,CAAA,CAAA,EAAI,OAAO,CAAA,GAAA,EACvE,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,EAAG,OAAA,IAAW,SAAS;AAAA;AAAA,OACnD;AACA,MAAA;AAAA,IACF;AAIA,IAAA,cAAA,CAAe,GAAA,CAAI,GAAG,KAAA,CAAM,EAAE,IAAI,OAAO,CAAA,CAAA,EAAI,OAAO,IAAI,CAAA;AACxD,IAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,OAAA,IAAW,EAAC,EAAG;AACvC,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,KAAK,CAAA,CAAA,EAAI,OAAO,CAAA,CAAA;AAC/B,MAAA,IAAI,CAAC,eAAe,GAAA,CAAI,GAAG,GAAG,cAAA,CAAe,GAAA,CAAI,GAAA,EAAK,MAAA,CAAO,IAAI,CAAA;AAAA,IACnE;AAAA,EACF;AACF;AAaA,SAAS,cAAc,GAAA,EAAmD;AACxE,EAAA,IACE,OAAO,GAAA,CAAI,EAAA,KAAO,QAAA,IAClB,OAAO,IAAI,WAAA,KAAgB,QAAA,IAC3B,OAAO,GAAA,CAAI,YAAY,QAAA,IACvB,OAAO,IAAI,QAAA,KAAa,QAAA,IACxB,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IACvB,CAAC,MAAM,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,IAC1B,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,cAAc,KACjC,GAAA,CAAI,YAAA,IAAgB,QACpB,OAAO,GAAA,CAAI,iBAAiB,QAAA,EAC5B;AACA,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,oBAAoB,IAAA,EAAkD;AACpF,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,kBAAA,EAAoB,uBAAuB,CAAA;AACpE,EAAA,MAAM,OAAA,GAAU,YAAA,CAAa,WAAA,EAAa,OAAO,CAAA;AACjD,EAAA,IAAI,OAAA,GAAqC,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AAE3D,EAAA,IAAI,MAAM,oBAAA,EAAsB;AAC9B,IAAA,OAAA,GAAU;AAAA,MACR,GAAG,OAAA;AAAA,MACH,EAAE,EAAA,EAAI,oBAAA,EAAsB,WAAA,EAAa,KAAA;AAAM,KACjD;AAAA,EACF;AAEA,EAAA,MAAM,SAAuC,EAAC;AAC9C,EAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,IAAA,MAAM,SAAA,GAAY,cAAc,GAA8B,CAAA;AAC9D,IAAA,IAAI,cAAc,IAAA,EAAM;AACtB,MAAA,IAAA;AAAA,QACE,CAAA,sDAAA,EAAyD,KAAK,SAAA,CAAU,GAAG,EAAE,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC;AAAA;AAAA,OAC5F;AACA,MAAA;AAAA,IACF;AACA,IAAA,MAAA,CAAO,SAAA,CAAU,EAAE,CAAA,GAAI,SAAA;AAAA,EACzB;AACA,EAAA,OAAO,MAAA;AACT;AAEA,IAAI,kBAAA,GAAkE,IAAA;AAO/D,SAAS,uBAAuB,UAAA,EAAsD;AAC3F,EAAA,IAAI,uBAAuB,IAAA,EAAM;AAC/B,IAAA,MAAM,UAAU,mBAAA,EAAoB;AACpC,IAAA,kBAAA,GAAqB,EAAC;AACtB,IAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG;AAC1C,MAAA,kBAAA,CAAmB,KAAA,CAAM,EAAE,CAAA,GAAI,KAAA,CAAM,YAAA;AAGrC,MAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,OAAA,IAAW,EAAC,EAAG;AACvC,QAAA,IAAI,mBAAmB,KAAK,CAAA,KAAM,QAAW,kBAAA,CAAmB,KAAK,IAAI,KAAA,CAAM,YAAA;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,mBAAmB,UAAU,CAAA;AACtC;AAEO,SAAS,yBAAyB,IAAA,EAA0B;AACjE,EAAA,MAAM,OAAA,GAAU,oBAAoB,IAAI,CAAA;AACxC,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,MAAA,CAAO,OAAO,CAAA,EAAG;AAI1C,IAAA,IAAI,kBAAA,CAAmB,KAAA,CAAM,EAAE,CAAA,KAAM,MAAA,EAAW;AAChD,IAAA,IAAI,KAAA,CAAM,SAAS,IAAA,CAAK,CAAC,MAAM,kBAAA,CAAmB,CAAC,CAAA,KAAM,MAAS,CAAA,EAAG;AAErE,IAAA,MAAM,OAAA,GAA2B;AAAA,MAC/B,MAAM,KAAA,CAAM,EAAA;AAAA,MACZ,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,gBAAgB,KAAA,CAAM,cAAA;AAAA,MACtB,aAAa,KAAA,CAAM,WAAA;AAAA,MACnB,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,WAAW,KAAA,CAAM,SAAA;AAAA,MACjB,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,cAAc,KAAA,CAAM;AAAA,KACtB;AACA,IAAA,gBAAA,CAAiB,OAAO,CAAA;AAAA,EAC1B;AACF;;;ACjQO,IAAM,SAAA,GAA6B;AAAA,EACxC,IAAA,EAAM,WAAA;AAAA,EACN,OAAA,EAAS,oBAAA;AAAA,EACT,OAAA,EAAS,CAAC,mBAAmB,CAAA;AAAA,EAC7B,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,2BAAA;AAAA,EACT,SAAA,EAAW,qCAAA;AAAA,EACX,QAAA,EAAU,mBAAA;AAAA,EACV,cAAA,EAAgB,CAAC,iBAAA,EAAmB,mBAAA,EAAqB,2BAA2B,CAAA;AAAA;AAAA;AAAA;AAAA,EAIpF,YAAA,EAAc;AAAA,IACZ,gBAAA,EAAkB;AAAA;AAEtB,CAAA;;;ACDO,IAAM,OAAA,GAA2B;AAAA,EACtC,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS,mBAAA;AAAA,EACT,OAAA,EAAS,CAAC,0BAA0B,CAAA;AAAA,EACpC,QAAA,EAAU,YAAA;AAAA,EACV,OAAA,EAAS,iDAAA;AAAA,EACT,SAAA,EAAW,MAAA;AAAA,EACX,QAAA,EAAU,+BAAA;AAAA,EACV,cAAA,EAAgB;AAAA,IACd,6CAAA;AAAA,IACA,2CAAA;AAAA,IACA;AAAA;AAEJ,CAAA;AAGO,SAAS,mBAAmB,OAAA,EAAyB;AAC1D,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAA;AACzC;AAQO,SAAS,uBAAuB,OAAA,EAAqC;AAC1E,EAAA,MAAM,EAAA,GAAK,mBAAmB,OAAO,CAAA;AACrC,EAAA,IAAI,EAAA,CAAG,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,WAAA;AACrC,EAAA,IAAI,GAAG,UAAA,CAAW,KAAK,GAAG,OAAO,OAAA,CAAQ,IAAI,UAAA,IAAc,WAAA;AAC3D,EAAA,IAAI,GAAG,UAAA,CAAW,KAAK,GAAG,OAAO,OAAA,CAAQ,IAAI,UAAA,IAAc,WAAA;AAC3D,EAAA,IAAI,GAAG,UAAA,CAAW,OAAO,GAAG,OAAO,OAAA,CAAQ,IAAI,UAAA,IAAc,gBAAA;AAC7D,EAAA,IAAI,EAAA,CAAG,UAAA,CAAW,KAAK,CAAA,EAAG,OAAO,gBAAA;AACjC,EAAA,OAAO,MAAA;AACT;AAGO,SAAS,sBAAsB,OAAA,EAAyB;AAC7D,EAAA,MAAM,SAAS,sBAAA,CAAuB,OAAO,CAAA,IAAK,OAAA,CAAQ,IAAI,UAAA,IAAc,WAAA;AAC5E,EAAA,OAAO,2BAA2B,MAAM,CAAA,cAAA,CAAA;AAC1C;;;AC9CO,SAAS,wBACd,CAAA,EACiB;AACjB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,kBAAA;AAAA,IACT,QAAA,EAAU,SAAA;AAAA,IACV,gBAAgB,EAAC;AAAA,IACjB,GAAG;AAAA,GACL;AACF;;;ACbO,IAAM,WAAW,uBAAA,CAAwB;AAAA,EAC9C,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,4BAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,cAAA,EAAgB,CAAC,cAAA,EAAgB,aAAa,CAAA;AAAA,EAC9C,YAAA,EAAc,EAAE,kCAAA,EAAoC,SAAA,EAAU;AAAA,EAC9D,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACJM,IAAM,SAAS,uBAAA,CAAwB;AAAA,EAC5C,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,wCAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAA,EAAkB,YAAY,CAAA;AAAA,EACxC,cAAA,EAAgB,CAAC,mBAAmB,CAAA;AAAA,EACpC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACZM,IAAM,YAAY,uBAAA,CAAwB;AAAA,EAC/C,IAAA,EAAM,WAAA;AAAA,EACN,OAAA,EAAS,qCAAA;AAAA,EACT,OAAA,EAAS,CAAC,mBAAmB,CAAA;AAAA,EAC7B,cAAA,EAAgB,CAAC,gBAAgB,CAAA;AAAA,EACjC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACCM,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,oBAAoB,CAAA;AAAA,EAC9B,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,2BAAA;AAAA,EACT,QAAA,EAAU,eAAA;AAAA,EACV,cAAA,EAAgB,CAAC,6BAA6B;AAChD,CAAA;;;ACXO,IAAM,SAAS,uBAAA,CAAwB;AAAA,EAC5C,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,yDAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAA,EAAkB,gBAAA,EAAkB,8BAA8B,CAAA;AAAA,EAC5E,cAAA,EAAgB,CAAC,gBAAA,EAAkB,kBAAkB,CAAA;AAAA,EACrD,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACVM,IAAM,OAAO,uBAAA,CAAwB;AAAA,EAC1C,IAAA,EAAM,MAAA;AAAA,EACN,OAAA,EAAS,gCAAA;AAAA,EACT,OAAA,EAAS,CAAC,cAAc,CAAA;AAAA,EACxB,cAAA,EAAgB,CAAC,yBAAA,EAA2B,sBAAsB,CAAA;AAAA,EAClE,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACcM,IAAM,QAAA,GAA4B;AAAA,EACvC,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,CAAC,WAAA,EAAa,WAAW,CAAA;AAAA,EAClC,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,QAAA,EAAU,MAAA;AAAA,EACV,OAAA,EAAS,uBAAA;AAAA,EACT,SAAA,EAAW,iCAAA;AAAA,EACX,QAAA,EAAU,WAAA;AAAA,EACV,cAAA,EAAgB,CAAC,cAAc;AACjC,CAAA;;;ACZO,IAAM,QAAA,GAA4B;AAAA,EACvC,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,CAAC,WAAA,EAAa,WAAW,CAAA;AAAA,EAClC,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,QAAA,EAAU,MAAA;AAAA,EACV,OAAA,EAAS,uBAAA;AAAA,EACT,SAAA,EAAW,iCAAA;AAAA,EACX,QAAA,EAAU,WAAA;AAAA,EACV,cAAA,EAAgB,CAAC,cAAc;AACjC,CAAA;;;AC5BO,IAAM,UAAU,uBAAA,CAAwB;AAAA,EAC7C,IAAA,EAAM,SAAA;AAAA,EACN,OAAA,EAAS,2BAAA;AAAA,EACT,OAAA,EAAS,CAAC,iBAAiB,CAAA;AAAA,EAC3B,cAAA,EAAgB,CAAC,sBAAA,EAAwB,kBAAkB,CAAA;AAAA,EAC3D,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACQM,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAgB,CAAA;AAAA,EAC1B,QAAA,EAAU,MAAA;AAAA,EACV,OAAA,EAAS,wBAAA;AAAA,EACT,SAAA,EAAW,kCAAA;AAAA,EACX,QAAA,EAAU,WAAA;AAAA,EACV,cAAA,EAAgB,CAAC,UAAA,EAAY,SAAA,EAAW,SAAS;AACnD,CAAA;;;ACxBO,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,gBAAgB,CAAA;AAAA,EAC1B,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,wBAAA;AAAA,EACT,SAAA,EAAW,kCAAA;AAAA,EACX,QAAA,EAAU,gBAAA;AAAA,EACV,cAAA,EAAgB,CAAC,QAAA,EAAU,aAAa;AAC1C,CAAA;ACeA,IAAM,aAAA,GAAuC;AAAA,EAC3C,MAAM,OAAA,EAAQ;AAAA,EACd,OAAA,EAAS,UAAA;AAAA,EACT,QAAA,EAAU,WAAA;AAAA,EACV,UAAA,EAAY;AACd,CAAA;AAQA,IAAM,mBAAA,GAA2C;AAAA,EAC/C,QAAA,EAAU,QAAA;AAAA,EACV,iBAAA,EAAmB,yCAAA;AAAA,EACnB,aAAA,EAAe,qCAAA;AAAA,EACf,QAAA,EAAU,8BAAA;AAAA,EACV,MAAA,EAAQ,CAAC,QAAA,EAAU,SAAA,EAAW,SAAS,gBAAgB,CAAA;AAAA,EACvD,WAAA,EAAa;AACf,CAAA;AASA,SAAS,UAAA,GAA2B;AAClC,EAAA,QAAQ,OAAO,OAAoC,IAAA,KAAuC;AACxF,IAAA,MAAM,MAAM,OAAA,CAAQ,GAAA;AACpB,IAAA,MAAM,QAAA,GAAW,MAAM,iBAAA,CAAkB;AAAA,MACvC,QAAA,EAAU,QAAA;AAAA,MACV,KAAA,EAAO,aAAA;AAAA,MACP,KAAA,EAAO,mBAAA;AAAA,MACP;AAAA,KACD,CAAA;AACD,IAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,aAAA,EAAe,GAAG,CAAA,EAAG,UAAA;AACvD,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AACzC,IAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,QAAA,CAAS,MAAM,CAAA,CAAE,CAAA;AACxD,IAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,sBAAsB,SAAS,CAAA;AACxE,IAAA,OAAO,MAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,EAC1C,CAAA;AACF;AAEO,IAAM,cAAA,GAAkC;AAAA,EAC7C,IAAA,EAAM,gBAAA;AAAA,EACN,OAAA,EAAS,eAAA;AAAA,EACT,QAAA,EAAU,mBAAA;AAAA,EACV,OAAA,EAAS,uCAAA;AAAA,EACT,SAAS,EAAC;AAAA,EACV,cAAA,EAAgB;AAAA,IACd,wBAAA;AAAA,IACA,6BAAA;AAAA,IACA;AAAA,GACF;AAAA;AAAA;AAAA;AAAA,EAIA,YAAA,EAAc,EAAE,UAAA,EAAY,SAAA,EAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtC,kBAAA,EAAoB,IAAA;AAAA,EACpB,SAAA,EAAW;AAAA;AAAA,IAET,KAAA,EAAO,MAAM,UAAA;AAAW;AAE5B,CAAA;;;ACrGO,IAAM,UAAA,GAA8B;AAAA,EACzC,IAAA,EAAM,YAAA;AAAA,EACN,OAAA,EAAS,kBAAA;AAAA,EACT,OAAA,EAAS,CAAC,IAAI,CAAA;AAAA;AAAA,EAEd,OAAA,EAAS,CAAC,oBAAA,EAAsB,gBAAgB,CAAA;AAAA,EAChD,QAAA,EAAU,SAAA;AAAA,EACV,OAAA,EAAS,2BAAA;AAAA,EACT,SAAA,EAAW,qCAAA;AAAA,EACX,QAAA,EAAU,eAAA;AAAA;AAAA,EAEV,cAAA,EAAgB,CAAC,oBAAA,EAAsB,4BAA4B,CAAA;AAAA;AAAA;AAAA,EAGnE,YAAA,EAAc,EAAE,cAAA,EAAgB,qBAAA,EAAuB,WAAW,SAAA;AACpE,CAAA;;;ACXO,IAAM,aAAa,uBAAA,CAAwB;AAAA,EAChD,IAAA,EAAM,YAAA;AAAA,EACN,OAAA,EAAS,2BAAA;AAAA,EACT,mBAAA,EAAqB,mBAAA;AAAA,EACrB,OAAA,EAAS,CAAC,oBAAoB,CAAA;AAAA,EAC9B,cAAA,EAAgB,CAAC,WAAA,EAAa,OAAO,CAAA;AAAA,EACrC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACVM,IAAM,WAAW,uBAAA,CAAwB;AAAA,EAC9C,IAAA,EAAM,UAAA;AAAA,EACN,OAAA,EAAS,CAAC,YAAY,CAAA;AAAA,EACtB,OAAA,EAAS,6BAAA;AAAA,EACT,OAAA,EAAS,CAAC,kBAAkB,CAAA;AAAA,EAC5B,cAAA,EAAgB,CAAC,gCAAgC,CAAA;AAAA,EACjD,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACKM,IAAM,MAAA,GAA0B;AAAA,EACrC,IAAA,EAAM,QAAA;AAAA,EACN,OAAA,EAAS,oBAAA;AAAA;AAAA,EACT,OAAA,EAAS,CAAC,gCAAgC,CAAA;AAAA,EAC1C,QAAA,EAAU,WAAA;AAAA,EACV,OAAA,EAAS,+CAAA;AAAA,EACT,SAAA,EAAW,MAAA;AAAA,EACX,QAAA,EAAU,2BAAA;AAAA,EACV,cAAA,EAAgB;AAAA,IACd,6CAAA;AAAA,IACA;AAAA;AAEJ,CAAA;AAOO,SAAS,qBAAqB,IAAA,EAI1B;AACT,EAAA,MAAM,OACJ,IAAA,CAAK,QAAA,KAAa,WACd,2BAAA,GACA,CAAA,EAAG,KAAK,QAAQ,CAAA,0BAAA,CAAA;AACtB,EAAA,IAAI,IAAA,CAAK,iBAAiB,QAAA,EAAU;AAElC,IAAA,OAAO,WAAW,IAAI,CAAA,aAAA,EAAgB,KAAK,SAAS,CAAA,WAAA,EAAc,KAAK,QAAQ,CAAA,kBAAA,CAAA;AAAA,EACjF;AAEA,EAAA,OAAO,WAAW,IAAI,CAAA,aAAA,EAAgB,KAAK,SAAS,CAAA,WAAA,EAAc,KAAK,QAAQ,CAAA,qBAAA,CAAA;AACjF;AAGO,SAAS,kBAAkB,OAAA,EAAyC;AACzE,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,aAAa,CAAA,EAAG,OAAO,WAAA;AAC5C,EAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,UAAU,CAAA,EAAG,OAAO,QAAA;AACzC,EAAA,OAAO,QAAA;AACT;AAGO,SAAS,kBAAkB,OAAA,EAAyB;AACzD,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,+BAAA,EAAiC,EAAE,CAAA;AAC5D;;;AC1DO,IAAM,MAAM,uBAAA,CAAwB;AAAA,EACzC,IAAA,EAAM,KAAA;AAAA,EACN,OAAA,EAAS,CAAC,MAAM,CAAA;AAAA,EAChB,OAAA,EAAS,qBAAA;AAAA,EACT,OAAA,EAAS,CAAC,aAAa,CAAA;AAAA,EACvB,cAAA,EAAgB,CAAC,UAAA,EAAY,UAAU,CAAA;AAAA,EACvC,QAAA,EAAU;AACZ,CAAC,CAAA;;;ACwBD,IAAM,oBAAoB,MAAyB;AACjD,EAAA,MAAM,CAAA,GAAI,UAAA;AACV,EAAA,MAAM,GAAA,mBAAM,MAAA,CAAO,GAAA,CAAI,2CAA2C,CAAA;AAClE,EAAA,IAAI,CAAA,CAAE,GAAG,CAAA,KAAM,MAAA,IAAa,GAAG,CAAA,GAAI,EAAE,IAAA,EAAM,KAAA,EAAM;AACjD,EAAA,OAAO,EAAE,GAAG,CAAA;AACd,CAAA,GAAG;AAEI,SAAS,gBAAA,GAAyB;AACvC,EAAA,IAAI,iBAAiB,IAAA,EAAM;AAC3B,EAAA,gBAAA,CAAiB,IAAA,GAAO,IAAA;AAExB,EAAA,gBAAA,CAAiB,SAAS,CAAA;AAC1B,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,cAAc,CAAA;AAC/B,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AACzB,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AACzB,EAAA,gBAAA,CAAiB,OAAO,CAAA;AACxB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AAEvB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,OAAO,CAAA;AACxB,EAAA,gBAAA,CAAiB,IAAI,CAAA;AACrB,EAAA,gBAAA,CAAiB,MAAM,CAAA;AACvB,EAAA,gBAAA,CAAiB,SAAS,CAAA;AAC1B,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AACzB,EAAA,gBAAA,CAAiB,GAAG,CAAA;AACpB,EAAA,gBAAA,CAAiB,UAAU,CAAA;AAC3B,EAAA,gBAAA,CAAiB,QAAQ,CAAA;AAEzB,EAAA,wBAAA,EAAyB;AAC3B","file":"chunk-WLQNMXQE.js","sourcesContent":["/**\n * One singleton per realm, keyed by `Symbol.for`.\n *\n * It exists because a package can be loaded more than once in the same process (two copies in\n * `node_modules`, ESM and CJS side by side, a monorepo with distinct versions) — and then a module-level\n * `const x = new Map()` produces TWO caches that cannot see each other. `Symbol.for` uses the global\n * symbol registry, which belongs to the realm and not the module, so every copy converges on one instance.\n *\n * It was copied verbatim into `providers/discovery.ts` and `providers/catalog-loader.ts`. That is\n * duplicated KNOWLEDGE, not a coincidence of shape: the two copies have to agree on the\n * mechanism, and one fixed without the other produces exactly the bug the function exists to avoid.\n */\nexport function globalSingleton<T>(key: string, create: () => T): T {\n  const g = globalThis as unknown as Record<symbol, T>;\n  const sym = Symbol.for(key);\n  if (g[sym] === undefined) g[sym] = create();\n  return g[sym];\n}\n","/**\n * Provider registry (T3.2, ADR D107).\n *\n * `registerProvider` is idempotent and surface-warning: re-registering\n * a `name` logs to stderr (D107 last-writer-wins with WARN). Alias\n * collisions also warn (EC-5).\n *\n * @internal\n */\n\nimport { diag } from \"../diagnostics.js\";\nimport { globalSingleton } from \"../global-singleton.js\";\nimport type { ProviderProfile } from \"./types.js\";\n\n/**\n * M44 B1 fix — the registry state lives on `globalThis` keyed by `Symbol.for`, so EVERY bundle copy of this\n * module (tsup bundles each entry separately with `splitting: false` — `dist/index.js` and `dist/models.js`\n * each embed their own copy) shares the SAME maps. Without this, `@theokit/sdk/models`'s\n * `refreshModelCatalog` saw an eternally-empty registry and its patches were invisible to the core bundle's\n * capability/pricing lookups (state duplication made load-bearing by M44).\n */\nconst REGISTRY = globalSingleton(\n  \"theokit-sdk.providers.registry\",\n  () => new Map<string, ProviderProfile>(),\n);\nconst ALIASES = globalSingleton(\"theokit-sdk.providers.aliases\", () => new Map<string, string>());\n\nexport function registerProvider(profile: ProviderProfile): void {\n  if (REGISTRY.has(profile.name)) {\n    diag(`[theokit-sdk] Provider \"${profile.name}\" overridden by user plugin.\\n`);\n  }\n  REGISTRY.set(profile.name, profile);\n  for (const alias of profile.aliases ?? []) {\n    // EC-5: surface alias collision so operators notice mis-routing.\n    const previous = ALIASES.get(alias);\n    if (previous !== undefined && previous !== profile.name) {\n      diag(`[theokit-sdk] Alias \"${alias}\" collision: was \"${previous}\", now \"${profile.name}\".\\n`);\n    }\n    ALIASES.set(alias, profile.name);\n  }\n}\n\nexport function getProviderProfile(name: string): ProviderProfile | undefined {\n  const canonical = ALIASES.get(name) ?? name;\n  return REGISTRY.get(canonical);\n}\n\nexport function listProviders(): ProviderProfile[] {\n  return Array.from(REGISTRY.values());\n}\n\n/** Test-only reset. @internal */\nexport function _resetProvidersForTests(): void {\n  REGISTRY.clear();\n  ALIASES.clear();\n}\n","import { z } from \"zod\";\n\n/**\n * M44 — the per-model catalog sub-schema. Field names mirror models.dev VERBATIM (snake_case) so\n * `scripts/refresh-catalog.mjs` regenerates the vendored data mechanically from `api.json` with zero\n * renaming (ADR D1).\n * TOLERANT by design: every field optional, unknown keys ignored — models.dev adds fields over time and\n * additive drift must never break the loader (Blueprint §6.4).\n *\n * theokit extensions beyond models.dev: `structured_output` / `cache_control` (both already exist on the\n * SDK's `ModelCapabilities`; models.dev has no such flags).\n *\n * Semver-exempt: nothing here is declared in `package.json` `exports`. `MODALITIES` is nonetheless\n * reachable from published declarations through the type graph, so it must be EMITTED.\n *\n * NOTE — no internal-visibility tag in this block. `tsconfig.base.json` sets `stripInternal: true`,\n * and TypeScript scans EVERY leading comment range of the declaration that follows; the tag that\n * used to sit here deleted the `MODALITIES` declaration below from the emitted `.d.ts`.\n */\n\nexport const MODALITIES = [\"text\", \"audio\", \"image\", \"video\", \"pdf\"] as const;\n\n/**\n * One input or output medium a model accepts or produces.\n *\n * The union is derived from `MODALITIES`, so it is closed: a models.dev entry whose\n * `modalities.input` or `modalities.output` array contains a string outside this set fails\n * `catalogModelSchema.safeParse`, and `patchIndexFromApiJson` drops that single model rather\n * than the whole payload. Widening the catalog to a new medium means adding it to `MODALITIES`\n * first — nothing else in the schema enumerates media.\n */\nexport type Modality = (typeof MODALITIES)[number];\n\nconst costSchema = z\n  .object({\n    /** USD per 1M tokens (models.dev convention). */\n    input: z.number().nonnegative(),\n    output: z.number().nonnegative(),\n    cache_read: z.number().nonnegative().optional(),\n    cache_write: z.number().nonnegative().optional(),\n  })\n  .loose();\n\nconst limitSchema = z\n  .object({\n    context: z.number().positive(),\n    input: z.number().positive().optional(),\n    output: z.number().positive().optional(),\n  })\n  .loose();\n\nconst modalitiesSchema = z\n  .object({\n    input: z.array(z.enum(MODALITIES)).optional(),\n    output: z.array(z.enum(MODALITIES)).optional(),\n  })\n  .loose();\n\nexport const catalogModelSchema = z\n  .object({\n    name: z.string().optional(),\n    release_date: z.string().optional(),\n    attachment: z.boolean().optional(),\n    reasoning: z.boolean().optional(),\n    temperature: z.boolean().optional(),\n    tool_call: z.boolean().optional(),\n    /** theokit extension — maps to ModelCapabilities.supportsStructuredOutput. */\n    structured_output: z.boolean().optional(),\n    /** theokit extension — maps to ModelCapabilities.supportsCacheControl. */\n    cache_control: z.boolean().optional(),\n    cost: costSchema.optional(),\n    limit: limitSchema.optional(),\n    modalities: modalitiesSchema.optional(),\n    status: z.enum([\"alpha\", \"beta\", \"deprecated\"]).optional(),\n  })\n  .loose();\n\n/**\n * One model entry as it is stored in the vendored catalog and as models.dev publishes it.\n *\n * Every field is optional, so an entry that carries only `name` still parses. Reading a value\n * therefore means handling `undefined` at each level — `model.cost?.cache_read`, not\n * `model.cost.cache_read`. Field names are models.dev's own snake_case, kept verbatim so the\n * refresh script can copy `api.json` across without renaming.\n *\n * The schema is loose rather than strict: unknown keys survive parsing and stay on the returned\n * object instead of being rejected or dropped. That is what lets models.dev add a field without\n * breaking the loader — the cost is that a typo in a key name parses silently, so a caller\n * cannot use \"it parsed\" as evidence that a field it expected was present.\n *\n * `structured_output` and `cache_control` are theokit's own additions; models.dev publishes\n * neither.\n */\nexport type CatalogModel = z.infer<typeof catalogModelSchema>;\n\n/**\n * Per-token pricing for one model, in USD per 1M tokens (models.dev's unit — not per token, and\n * not per 1K).\n *\n * `input` and `output` are required and non-negative; the two cache buckets are optional and\n * absent for models that do not price caching separately. Absent is not zero: a missing\n * `cache_read` means the catalog says nothing about the cost of a cache hit, so a caller that\n * defaults it to 0 is asserting free cache reads on its own authority.\n *\n * Like `CatalogModel`, the shape is loose — unknown pricing keys published upstream are kept on\n * the parsed value.\n */\nexport type CatalogModelCost = z.infer<typeof costSchema>;\n","/**\n * Dynamic provider catalog loader (T10.1, ADR D447).\n *\n * Loads provider metadata from `provider-catalog.json` at runtime.\n * Malformed entries are skipped with WARN (EC-1) — never crash.\n *\n * @internal\n */\n\nimport { readFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { diag } from \"../diagnostics.js\";\nimport { globalSingleton } from \"../global-singleton.js\";\nimport { type CatalogModel, catalogModelSchema } from \"./catalog-schema.js\";\nimport { getProviderProfile, registerProvider } from \"./registry.js\";\nimport type { ApiMode, AuthType, ProviderProfile } from \"./types.js\";\n\nconst __dirname_resolved = dirname(fileURLToPath(import.meta.url));\n\nexport interface ProviderCapabilities {\n  supportsToolUse: boolean;\n  supportsVision: boolean;\n  supportsStructuredOutput: boolean;\n  supportsStreaming: boolean;\n  supportsCacheControl: boolean;\n  maxContextTokens?: number;\n  maxOutputTokens?: number;\n}\n\nexport interface CatalogEntry {\n  id: string;\n  displayName: string;\n  apiMode: ApiMode;\n  authType: AuthType;\n  baseUrl: string;\n  envVars: string[];\n  fallbackModels: string[];\n  capabilities: ProviderCapabilities;\n  aliases?: string[];\n  modelsUrl?: string;\n  hostname?: string;\n  extraHeaders?: Record<string, string>;\n  /**\n   * M44 — OPTIONAL per-model data (models.dev shape, snake_case — see `catalog-schema.ts`), keyed by the\n   * BARE model id. Additive: entries without it behave byte-identically to before. The loader indexes this\n   * into the model-info index (`getCatalogModelInfo`) rather than onto `ProviderProfile` (ADR D2 — the\n   * builtins-first registration skip means profile-attached data would never reach builtin providers).\n   */\n  models?: Record<string, CatalogModel>;\n}\n\n/**\n * M44 — the model-info index: `provider/model` → per-model catalog data (the EXACT-map key convention).\n * Populated by the vendored catalog load AND patched by the optional models-dev source (cache entries win\n * per model). The single lookup surface for capability / cost / limit enrichment.\n */\n// M44 B1 fix — index state on globalThis (Symbol.for) so every bundle copy shares the SAME maps (see the\n// identical pattern + rationale in registry.ts).\nconst modelInfoIndex = globalSingleton(\n  \"theokit-sdk.providers.model-info-index\",\n  () => new Map<string, CatalogModel>(),\n);\n/** M44 M5 fix — keys patched by the live models-dev source (honest pricing provenance). */\nconst patchedModelKeys = globalSingleton(\n  \"theokit-sdk.providers.model-info-patched\",\n  () => new Set<string>(),\n);\nconst indexState = globalSingleton(\"theokit-sdk.providers.model-info-loaded\", () => ({\n  loaded: false,\n}));\n\n/**\n * Look up per-model catalog data by `provider/model` key.\n *\n * Semver-exempt: not declared in `package.json` `exports`, but re-exported by\n * `catalog-source-models-dev.ts`, whose declaration is reachable from published entries — so it\n * must be EMITTED.\n */\nexport function getCatalogModelInfo(key: string): CatalogModel | undefined {\n  ensureModelIndexLoaded();\n  return modelInfoIndex.get(key);\n}\n\n/** Was this key patched by the LIVE models-dev source (vs the vendored catalog)? @internal */\nexport function isPatchedModelKey(key: string): boolean {\n  return patchedModelKeys.has(key);\n}\n\n/**\n * Patch the index with fresher per-model data (the models-dev source). M44 H2 fix — a per-FIELD shallow\n * MERGE, not a wholesale replace: models.dev can never supply the theokit extension fields\n * (`cache_control`, `structured_output` overlays), so a replace would wipe them and silently flip\n * capability answers. Incoming fields win; existing fields survive when the patch omits them.\n * @internal\n */\nexport function patchModelInfo(key: string, model: CatalogModel): void {\n  ensureModelIndexLoaded();\n  const existing = modelInfoIndex.get(key);\n  modelInfoIndex.set(key, existing === undefined ? model : { ...existing, ...model });\n  patchedModelKeys.add(key);\n}\n\n/** All indexed `provider/model` keys (for maintenance/tests). @internal */\nexport function listModelInfoKeys(): string[] {\n  ensureModelIndexLoaded();\n  return [...modelInfoIndex.keys()];\n}\n\nfunction ensureModelIndexLoaded(): void {\n  if (indexState.loaded) return;\n  indexState.loaded = true;\n  // M44 L9 fix — never throw from a capability/pricing lookup: a missing/corrupt vendored catalog degrades\n  // to conservative defaults with a WARN (the deleted EXACT map could never throw; keep that property).\n  try {\n    const catalog = loadProviderCatalog();\n    for (const entry of Object.values(catalog)) {\n      indexEntryModels(entry);\n    }\n  } catch (err) {\n    diag(\n      `[theokit-sdk] WARN: provider catalog unavailable (${(err as Error).message}) — per-model data disabled\\n`,\n    );\n  }\n}\n\n/**\n * Index an entry's `models` block. Runs for EVERY catalog entry — including those whose PROVIDER\n * registration is skipped builtins-first — so builtin providers still get their per-model data (ADR D2).\n * A malformed model sub-entry drops THAT MODEL with WARN and keeps the provider (EC-1 philosophy extended).\n */\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\nfunction indexEntryModels(entry: CatalogEntry): void {\n  if (entry.models === undefined || typeof entry.models !== \"object\") return;\n  for (const [modelId, raw] of Object.entries(entry.models)) {\n    const parsed = catalogModelSchema.safeParse(raw);\n    if (!parsed.success) {\n      diag(\n        `[theokit-sdk] WARN: Skipping malformed catalog model \"${entry.id}/${modelId}\": ` +\n          `${parsed.error.issues[0]?.message ?? \"invalid\"}\\n`,\n      );\n      continue;\n    }\n    // Index under the entry id AND every alias — capability lookups are VENDOR-keyed (e.g.\n    // `google/gemini-2.5-pro` while the entry id is `google-gemini` with alias `google`), so alias keys are\n    // what make the vendor-keyed convention resolve without a second mapping table.\n    modelInfoIndex.set(`${entry.id}/${modelId}`, parsed.data);\n    for (const alias of entry.aliases ?? []) {\n      const key = `${alias}/${modelId}`;\n      if (!modelInfoIndex.has(key)) modelInfoIndex.set(key, parsed.data);\n    }\n  }\n}\n\n/** Test-only reset for the model-info index. @internal */\nexport function _resetModelInfoIndexForTests(): void {\n  modelInfoIndex.clear();\n  patchedModelKeys.clear();\n  indexState.loaded = false;\n}\n\ninterface LoadOptions {\n  _testInjectMalformed?: boolean;\n}\n\nfunction validateEntry(raw: Record<string, unknown>): CatalogEntry | null {\n  if (\n    typeof raw.id !== \"string\" ||\n    typeof raw.displayName !== \"string\" ||\n    typeof raw.apiMode !== \"string\" ||\n    typeof raw.authType !== \"string\" ||\n    typeof raw.baseUrl !== \"string\" ||\n    !Array.isArray(raw.envVars) ||\n    !Array.isArray(raw.fallbackModels) ||\n    raw.capabilities == null ||\n    typeof raw.capabilities !== \"object\"\n  ) {\n    return null;\n  }\n  return raw as unknown as CatalogEntry;\n}\n\nexport function loadProviderCatalog(opts?: LoadOptions): Record<string, CatalogEntry> {\n  const catalogPath = join(__dirname_resolved, \"provider-catalog.json\");\n  const rawText = readFileSync(catalogPath, \"utf-8\");\n  let entries: Record<string, unknown>[] = JSON.parse(rawText);\n\n  if (opts?._testInjectMalformed) {\n    entries = [\n      ...entries,\n      { id: \"malformed-provider\", displayName: \"Bad\" } as Record<string, unknown>,\n    ];\n  }\n\n  const result: Record<string, CatalogEntry> = {};\n  for (const raw of entries) {\n    const validated = validateEntry(raw as Record<string, unknown>);\n    if (validated === null) {\n      diag(\n        `[theokit-sdk] WARN: Skipping malformed catalog entry: ${JSON.stringify(raw).slice(0, 100)}\\n`,\n      );\n      continue;\n    }\n    result[validated.id] = validated;\n  }\n  return result;\n}\n\nlet _capabilitiesCache: Record<string, ProviderCapabilities> | null = null;\n\n// PRE-EXISTING debt, exposed when M75 fixed the Biome config that used to abort before\n// sweeping these files (a nested root under refactor/). It is not new code and was not touched\n// by M75; refactoring SDK internals without review would trade a visible problem for a diff\n// risky. Tracked in usetheodev/theokit-sdk#151.\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: see the reason just above\nexport function getCatalogCapabilities(providerId: string): ProviderCapabilities | undefined {\n  if (_capabilitiesCache === null) {\n    const catalog = loadProviderCatalog();\n    _capabilitiesCache = {};\n    for (const entry of Object.values(catalog)) {\n      _capabilitiesCache[entry.id] = entry.capabilities;\n      // M45 review L4 — alias keys too (e.g. entry `google-gemini` alias `google`), consistent with the\n      // model-info index's alias-keyed convention.\n      for (const alias of entry.aliases ?? []) {\n        if (_capabilitiesCache[alias] === undefined) _capabilitiesCache[alias] = entry.capabilities;\n      }\n    }\n  }\n  return _capabilitiesCache[providerId];\n}\n\nexport function registerCatalogProviders(opts?: LoadOptions): void {\n  const catalog = loadProviderCatalog(opts);\n  for (const entry of Object.values(catalog)) {\n    // Skip catalog entries that would overwrite first-party builtins.\n    // Builtins have richer env-var handling and are registered first.\n    // Also skip if any alias collides with an existing provider name.\n    if (getProviderProfile(entry.id) !== undefined) continue;\n    if (entry.aliases?.some((a) => getProviderProfile(a) !== undefined)) continue;\n\n    const profile: ProviderProfile = {\n      name: entry.id,\n      apiMode: entry.apiMode,\n      authType: entry.authType,\n      baseUrl: entry.baseUrl,\n      envVars: entry.envVars,\n      fallbackModels: entry.fallbackModels,\n      displayName: entry.displayName,\n      aliases: entry.aliases,\n      modelsUrl: entry.modelsUrl,\n      hostname: entry.hostname,\n      extraHeaders: entry.extraHeaders,\n    };\n    registerProvider(profile);\n  }\n}\n","import type { ProviderProfile } from \"../types.js\";\n\nexport const ANTHROPIC: ProviderProfile = {\n  name: \"anthropic\",\n  apiMode: \"anthropic_messages\",\n  envVars: [\"ANTHROPIC_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://api.anthropic.com\",\n  modelsUrl: \"https://api.anthropic.com/v1/models\",\n  hostname: \"api.anthropic.com\",\n  fallbackModels: [\"claude-opus-4-7\", \"claude-sonnet-4-6\", \"claude-haiku-4-5-20251001\"],\n  // M45 — the Anthropic beta-features header (interleaved thinking + fine-grained tool streaming). An\n  // Anthropic API constant. The\n  // SANCTIONED behavior delta of M45 (ADR D4) — consumed by the anthropic transport's extraHeaders wiring.\n  extraHeaders: {\n    \"anthropic-beta\": \"interleaved-thinking-2025-05-14,fine-grained-tool-streaming-2025-05-14\",\n  },\n};\n","/**\n * AWS Bedrock profile (Adoption Roadmap #8; ADRs D286-D302).\n *\n * Bearer-only auth via `AWS_BEARER_TOKEN_BEDROCK` env (GA Sep 2025).\n * Optional `@aws/bedrock-token-generator` peer dep auto-refreshes short-term\n * tokens (D287). Transport via native `fetch`; no `@aws-sdk/*` dependency.\n *\n * Model IDs follow the `bedrock/{aws-id}` convention so the router can\n * infer the provider via prefix routing (D186). The client strips the\n * `bedrock/` prefix before building the URL.\n *\n * @internal\n */\n\nimport type { ProviderProfile } from \"../types.js\";\n\nexport const BEDROCK: ProviderProfile = {\n  name: \"bedrock\",\n  apiMode: \"bedrock_anthropic\",\n  envVars: [\"AWS_BEARER_TOKEN_BEDROCK\"],\n  authType: \"aws_bearer\",\n  baseUrl: \"https://bedrock-runtime.us-east-1.amazonaws.com\",\n  modelsUrl: undefined,\n  hostname: \"bedrock-runtime.amazonaws.com\",\n  fallbackModels: [\n    \"bedrock/us.anthropic.claude-sonnet-4-5-v1:0\",\n    \"bedrock/us.anthropic.claude-opus-4-7-v1:0\",\n    \"bedrock/global.anthropic.claude-haiku-4-5-v1:0\",\n  ],\n};\n\n/** Strip `\"bedrock/\"` prefix so the raw AWS model id is used in the URL. */\nexport function stripBedrockPrefix(modelId: string): string {\n  return modelId.replace(/^bedrock\\//, \"\");\n}\n\n/**\n * Infer AWS region from a Bedrock model id prefix (D290).\n *\n * `global.*` routes via `us-east-1` (AWS default entrypoint for global\n * inference profiles).\n */\nexport function inferRegionFromModelId(modelId: string): string | undefined {\n  const id = stripBedrockPrefix(modelId);\n  if (id.startsWith(\"global.\")) return \"us-east-1\";\n  if (id.startsWith(\"us.\")) return process.env.AWS_REGION ?? \"us-east-1\";\n  if (id.startsWith(\"eu.\")) return process.env.AWS_REGION ?? \"eu-west-1\";\n  if (id.startsWith(\"apac.\")) return process.env.AWS_REGION ?? \"ap-southeast-1\";\n  if (id.startsWith(\"jp.\")) return \"ap-northeast-1\";\n  return undefined;\n}\n\n/** Resolve baseUrl from model id; falls back to `AWS_REGION` env or `us-east-1`. */\nexport function resolveBedrockBaseUrl(modelId: string): string {\n  const region = inferRegionFromModelId(modelId) ?? process.env.AWS_REGION ?? \"us-east-1\";\n  return `https://bedrock-runtime.${region}.amazonaws.com`;\n}\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * M45 — the data-only base for OpenAI-compatible chat_completions providers. A profile-map pattern\n * flattened to\n * theokit's data model: leaves declare name/baseUrl/envVars (+ overrides) in ~10 lines; the router's\n * URL-join rule (version-segment detection + `chatCompletionsPath` escape) derives the endpoint.\n *\n * @internal\n */\nexport function openAiCompatibleProfile(\n  p: { name: string; baseUrl: string; envVars: readonly string[] } & Partial<ProviderProfile>,\n): ProviderProfile {\n  return {\n    apiMode: \"chat_completions\",\n    authType: \"api_key\",\n    fallbackModels: [],\n    ...p,\n  };\n}\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Cerebras. The integration header value is theokit's own: the header attributes TRAFFIC.\n * Models per models.dev (2026-07 snapshot).\n */\nexport const CEREBRAS = openAiCompatibleProfile({\n  name: \"cerebras\",\n  baseUrl: \"https://api.cerebras.ai/v1\",\n  envVars: [\"CEREBRAS_API_KEY\"],\n  fallbackModels: [\"gpt-oss-120b\", \"zai-glm-4.7\"],\n  extraHeaders: { \"X-Cerebras-3rd-Party-Integration\": \"theokit\" },\n  hostname: \"api.cerebras.ai\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Cohere via its OpenAI-compatibility surface (`api.cohere.ai/compatibility/v1` — the native v2 API\n * is NOT chat_completions; the discovery flagged the old catalog baseUrl as doubly wrong). Models per\n * models.dev `cohere` (2026-07 snapshot). SOURCE NOTE (review L2): the compatibility endpoint + `CO_API_KEY`\n * come from Cohere's own docs/python-SDK convention (not vendored in this repo's references) — verify with a\n * live smoke when a key is available.\n */\nexport const COHERE = openAiCompatibleProfile({\n  name: \"cohere\",\n  baseUrl: \"https://api.cohere.ai/compatibility/v1\",\n  envVars: [\"COHERE_API_KEY\", \"CO_API_KEY\"],\n  fallbackModels: [\"command-a-03-2025\"],\n  hostname: \"api.cohere.ai\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — DeepInfra. OpenAI-compat surface under /v1/openai (models.dev `deepinfra`). */\nexport const DEEPINFRA = openAiCompatibleProfile({\n  name: \"deepinfra\",\n  baseUrl: \"https://api.deepinfra.com/v1/openai\",\n  envVars: [\"DEEPINFRA_API_KEY\"],\n  fallbackModels: [\"Qwen/Qwen3-32B\"],\n  hostname: \"api.deepinfra.com\",\n});\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * Gemini via OpenRouter passthrough. Direct Gemini API uses a different\n * dialect (`generateContent`); SDK currently routes through OpenRouter's\n * OpenAI-compatible endpoint so the chat_completions transport works.\n *\n * A future plugin `@theokit-provider-gemini-direct` can override this with\n * `apiMode: \"gemini_generate_content\"` once that transport ships.\n */\nexport const GEMINI: ProviderProfile = {\n  name: \"gemini\",\n  apiMode: \"chat_completions\",\n  envVars: [\"OPENROUTER_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://openrouter.ai/api\",\n  hostname: \"openrouter.ai\",\n  fallbackModels: [\"google/gemini-2.0-flash-001\"],\n};\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Google Gemini via the DIRECT OpenAI-compat endpoint (a Google API key, not OpenRouter). Distinct\n * from the `gemini` builtin (an OpenRouter passthrough) by ADR D3 — two routes, two names. Endpoint + env\n * vars per Google's OpenAI-compatibility docs (mirrored by models.dev `google` + the M44 catalog entry).\n */\nexport const GOOGLE = openAiCompatibleProfile({\n  name: \"google\",\n  baseUrl: \"https://generativelanguage.googleapis.com/v1beta/openai\",\n  envVars: [\"GOOGLE_API_KEY\", \"GEMINI_API_KEY\", \"GOOGLE_GENERATIVE_AI_API_KEY\"],\n  fallbackModels: [\"gemini-2.5-pro\", \"gemini-2.5-flash\"],\n  hostname: \"generativelanguage.googleapis.com\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — Groq. Values per models.dev `groq` (2026-07 snapshot); OpenAI-compat surface under /openai/v1. */\nexport const GROQ = openAiCompatibleProfile({\n  name: \"groq\",\n  baseUrl: \"https://api.groq.com/openai/v1\",\n  envVars: [\"GROQ_API_KEY\"],\n  fallbackModels: [\"llama-3.3-70b-versatile\", \"llama-3.1-8b-instant\"],\n  hostname: \"api.groq.com\",\n});\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * llama.cpp server provider profile (T7.2, ADR D189).\n *\n * llama.cpp ships a HTTP server binary (`./server` since b1500+) that\n * implements the OpenAI-compatible `/v1/chat/completions` endpoint on\n * `http://localhost:8080` by default. Inherits `authType: \"none\"` from\n * D182 — no API key required for local use.\n *\n * llama.cpp idiosyncrasies:\n *  - Server loads a single GGUF model at startup via `--model` CLI\n *    flag. The `model` field in the chat-completions request is\n *    cosmetic — any string works; the response comes from the loaded\n *    model regardless. This is documented in\n *    `.claude/knowledge-base/reviews/edge-case/ollama-integration-edge-cases-2026-05-21.md`\n *    as EC-O.\n *  - Tool calling support depends entirely on the underlying model.\n *\n * Override the default URL with `LLAMACPP_HOST`.\n *\n * @internal\n */\nexport const LLAMACPP: ProviderProfile = {\n  name: \"llamacpp\",\n  aliases: [\"llama-cpp\", \"llama.cpp\"],\n  apiMode: \"chat_completions\",\n  envVars: [\"LLAMACPP_API_KEY\"],\n  authType: \"none\",\n  baseUrl: \"http://localhost:8080\",\n  modelsUrl: \"http://localhost:8080/v1/models\",\n  hostname: \"localhost\",\n  fallbackModels: [\"loaded-model\"],\n};\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * LM Studio provider profile (T7.1, ADR D188).\n *\n * LM Studio exposes an OpenAI-compatible `/v1/chat/completions` endpoint\n * on `http://localhost:1234` by default (configurable via the LM Studio\n * UI under \"Local Server\"). Inherits the `authType: \"none\"` primitive\n * from D182 — no API key required for local use.\n *\n * LM Studio idiosyncrasies:\n *  - Loads ONE model at a time via the desktop UI. The `model` field in\n *    the chat-completions request is informational only — LM Studio\n *    serves whatever model is currently loaded.\n *  - `/v1/models` returns a single entry pointing to the loaded model.\n *  - Tool calling depends on the underlying model.\n *\n * Override the default URL with `LMSTUDIO_HOST` (mirrors `OLLAMA_HOST`).\n *\n * @internal\n */\nexport const LMSTUDIO: ProviderProfile = {\n  name: \"lmstudio\",\n  aliases: [\"lm-studio\", \"lm_studio\"],\n  apiMode: \"chat_completions\",\n  envVars: [\"LMSTUDIO_API_KEY\"],\n  authType: \"none\",\n  baseUrl: \"http://localhost:1234\",\n  modelsUrl: \"http://localhost:1234/v1/models\",\n  hostname: \"localhost\",\n  fallbackModels: [\"loaded-model\"],\n};\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — Mistral (La Plateforme). Values per models.dev `mistral` (2026-07 snapshot). */\nexport const MISTRAL = openAiCompatibleProfile({\n  name: \"mistral\",\n  baseUrl: \"https://api.mistral.ai/v1\",\n  envVars: [\"MISTRAL_API_KEY\"],\n  fallbackModels: [\"mistral-large-latest\", \"codestral-latest\"],\n  hostname: \"api.mistral.ai\",\n});\n","import type { ProviderProfile } from \"../types.js\";\n\n/**\n * Ollama — local-first LLM runtime (ADR D182).\n *\n * Ships as a builtin so `Agent.create({ model: \"ollama/llama3.2\" })` works\n * with zero configuration when `ollama serve` is running on the default\n * port. `authType: \"none\"` signals the router to skip env-key resolution\n * and use a placeholder credential (Ollama ignores Authorization headers\n * on local installs).\n *\n * Overrides:\n * - `OLLAMA_HOST` — replaces the default `http://localhost:11434` baseUrl\n *   (advanced users running Ollama on a remote machine).\n * - `OLLAMA_API_KEY` — replaces the placeholder when Ollama is behind a\n *   reverse-proxy with auth or when using Ollama Cloud (paid tier).\n */\nexport const OLLAMA: ProviderProfile = {\n  name: \"ollama\",\n  apiMode: \"chat_completions\",\n  envVars: [\"OLLAMA_API_KEY\"],\n  authType: \"none\",\n  baseUrl: \"http://localhost:11434\",\n  modelsUrl: \"http://localhost:11434/v1/models\",\n  hostname: \"localhost\",\n  fallbackModels: [\"llama3.2\", \"qwen2.5\", \"mistral\"],\n};\n","import type { ProviderProfile } from \"../types.js\";\n\nexport const OPENAI: ProviderProfile = {\n  name: \"openai\",\n  apiMode: \"chat_completions\",\n  envVars: [\"OPENAI_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://api.openai.com\",\n  modelsUrl: \"https://api.openai.com/v1/models\",\n  hostname: \"api.openai.com\",\n  fallbackModels: [\"gpt-4o\", \"gpt-4o-mini\"],\n};\n","/**\n * M43 — the ChatGPT \"Codex\" backend as a first-class builtin `ProviderProfile`. Migrated from the\n * agent-builder M40 workaround; the SDK now owns the provider, so a consumer only selects\n * `openai-chatgpt/<model>` and logs in — ZERO provider logic in the consumer.\n *\n * The provider-auth model (see the codex-provider-in-sdk blueprint):\n * - static profile + a `transform.fetch` that resolves the LIVE credential per HTTP request (fresh Bearer +\n *   dynamic `ChatGPT-Account-Id`), so a mid-turn expiry refreshes transparently with NO agent rebuild;\n * - the protocol values (endpoint, models, oauth config, `originator` header) are SDK-owned constants.\n *\n * @internal\n */\n\nimport { homedir } from \"node:os\";\n\nimport type { CredentialStoreConfig, OAuthProviderConfig } from \"../../auth/auth-types.js\";\nimport { readStoredOAuth } from \"../../auth/credential-store.js\";\nimport { resolveCredential } from \"../../auth/resolve-credential.js\";\nimport type { ProviderProfile } from \"../types.js\";\n\n/**\n * The SDK-owned ambient credential store the transform reads. Defaults to `~/.theokit/auth.json`. A consumer\n * points it at its existing store dir via the DEDICATED `THEOKIT_AUTH_HOME` env var (NOT `THEOKIT_HOME` — that\n * is the SDK's whole home directory for personality/credential-pool/profiles; overloading it would redirect\n * the entire runtime). The SDK's ambient credential service.\n */\nconst DEFAULT_STORE: CredentialStoreConfig = {\n  home: homedir(),\n  dirName: \".theokit\",\n  fileName: \"auth.json\",\n  homeEnvVar: \"THEOKIT_AUTH_HOME\",\n};\n\n/**\n * The OpenAI OAuth config the transform resolves + refreshes against. `provider: \"openai\"` is the STORE\n * provider (what `/login` persists), deliberately distinct from this profile's routing name `openai-chatgpt`\n * — the two-namespace split separates the integration id from the routed provider. Endpoints/clientId/scopes\n * are OpenAI's published OAuth values.\n */\nconst OPENAI_OAUTH_CONFIG: OAuthProviderConfig = {\n  provider: \"openai\",\n  authorizeEndpoint: \"https://auth.openai.com/oauth/authorize\",\n  tokenEndpoint: \"https://auth.openai.com/oauth/token\",\n  clientId: \"app_EMoamEEZ73f0CkXaXp7hrann\",\n  scopes: [\"openid\", \"profile\", \"email\", \"offline_access\"],\n  redirectUri: \"https://auth.openai.com/deviceauth/callback\",\n};\n\n/**\n * Build the per-request fetch: resolve a FRESH (refreshed) Bearer + the LIVE account-id from the ambient\n * store, and inject them as headers. Re-resolves on EVERY call → mid-turn refresh with no rebuild. A\n * `Headers` object is used so `authorization` is set case-insensitively (never doubled). If no credential is\n * logged in, throw a clear error rather than putting the router's `__oauth_lazy_token__` placeholder on the\n * wire (fail-closed — missing-credential semantics).\n */\nfunction codexFetch(): typeof fetch {\n  return (async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {\n    const env = process.env as Record<string, string | undefined>;\n    const resolved = await resolveCredential({\n      provider: \"openai\",\n      store: DEFAULT_STORE,\n      oauth: OPENAI_OAUTH_CONFIG,\n      env,\n    });\n    if (resolved === undefined) {\n      throw new Error(\n        'openai-chatgpt: no ChatGPT credential found — run the OpenAI device login (e.g. \"/login openai\") first.',\n      );\n    }\n    const accountId = readStoredOAuth(DEFAULT_STORE, env)?.account_id;\n    const headers = new Headers(init?.headers);\n    headers.set(\"authorization\", `Bearer ${resolved.apiKey}`);\n    if (accountId !== undefined) headers.set(\"ChatGPT-Account-Id\", accountId);\n    return fetch(input, { ...init, headers });\n  }) as typeof fetch;\n}\n\nexport const OPENAI_CHATGPT: ProviderProfile = {\n  name: \"openai-chatgpt\",\n  apiMode: \"responses_api\",\n  authType: \"oauth_device_code\",\n  baseUrl: \"https://chatgpt.com/backend-api/codex\",\n  envVars: [],\n  fallbackModels: [\n    \"openai-chatgpt/gpt-5.4\",\n    \"openai-chatgpt/gpt-5.4-mini\",\n    \"openai-chatgpt/gpt-5.5\",\n  ],\n  // #165 — this shipped as `codex_cli_rs`, another vendor's client identifier. Claiming to be a different\n  // vendor's client is a false statement of identity. Third-party clients send their OWN name against\n  // this same endpoint, which also shows the route is not restricted to the official client.\n  extraHeaders: { originator: \"theokit\" },\n  // usetheokit/theokit-sdk#383 — carry the model's encrypted reasoning between the rounds of a turn.\n  // On for THIS profile and no other because this is the endpoint the issue measured: OpenAI Codex\n  // sends `include: [\"reasoning.encrypted_content\"]` with `reasoning.context: \"all_turns\"` to the\n  // same backend, same model, on the same account, so acceptance is observed rather than assumed.\n  // The issue's measurement — a third of our bytes, 2.8x our tokens — is what this closes together\n  // with `prompt_cache_key`.\n  encryptedReasoning: true,\n  transform: {\n    // Only `fetch` (async) can await the credential refresh; `headers` is sync and cannot.\n    fetch: () => codexFetch(),\n  },\n};\n","import type { ProviderProfile } from \"../types.js\";\n\nexport const OPENROUTER: ProviderProfile = {\n  name: \"openrouter\",\n  apiMode: \"chat_completions\",\n  aliases: [\"or\"],\n  // Ordered fallback (EC-10): OPENROUTER_API_KEY preferred, OPENAI_API_KEY as compat.\n  envVars: [\"OPENROUTER_API_KEY\", \"OPENAI_API_KEY\"],\n  authType: \"api_key\",\n  baseUrl: \"https://openrouter.ai/api\",\n  modelsUrl: \"https://openrouter.ai/api/v1/models\",\n  hostname: \"openrouter.ai\",\n  // M45 — models refreshed (claude-3-haiku retired upstream).\n  fallbackModels: [\"openai/gpt-4o-mini\", \"anthropic/claude-haiku-4-5\"],\n  // M45 — OpenRouter app-attribution headers. VALUES are\n  // theokit's own — copying another app's referer would misattribute traffic).\n  extraHeaders: { \"HTTP-Referer\": \"https://usetheo.dev\", \"X-Title\": \"theokit\" },\n};\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/**\n * M45 — Perplexity. Its endpoint is UNVERSIONED (`/chat/completions`) — the explicit `chatCompletionsPath`\n * escape expresses it (the sonar-online model family was retired; models per models.dev `perplexity`).\n */\nexport const PERPLEXITY = openAiCompatibleProfile({\n  name: \"perplexity\",\n  baseUrl: \"https://api.perplexity.ai\",\n  chatCompletionsPath: \"/chat/completions\",\n  envVars: [\"PERPLEXITY_API_KEY\"],\n  fallbackModels: [\"sonar-pro\", \"sonar\"],\n  hostname: \"api.perplexity.ai\",\n});\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — Together AI (models.dev id `togetherai` — kept as an alias). Values per the 2026-07 snapshot. */\nexport const TOGETHER = openAiCompatibleProfile({\n  name: \"together\",\n  aliases: [\"togetherai\"],\n  baseUrl: \"https://api.together.xyz/v1\",\n  envVars: [\"TOGETHER_API_KEY\"],\n  fallbackModels: [\"Qwen/Qwen2.5-7B-Instruct-Turbo\"],\n  hostname: \"api.together.xyz\",\n});\n","/**\n * GCP Vertex AI profile (Adoption Roadmap #8; ADRs D286-D302).\n *\n * Required peer dep: `google-auth-library` (D288). Resolves access tokens\n * via ADC (env → gcloud → metadata server → WIF).\n *\n * Model IDs follow the convention `vertex/{dialect}/{model}`:\n *   - `vertex/google/gemini-2.0-flash-001` → OpenAI-compat endpoint (D291)\n *   - `vertex/anthropic/claude-sonnet-4-5@20250929` → :rawPredict (D292)\n *\n * @internal\n */\n\nimport type { ProviderProfile } from \"../types.js\";\n\nexport const VERTEX: ProviderProfile = {\n  name: \"vertex\",\n  apiMode: \"anthropic_messages\", // sub-dispatched in selectTransport by profile.name\n  envVars: [\"GOOGLE_APPLICATION_CREDENTIALS\"],\n  authType: \"gcp_oauth\",\n  baseUrl: \"https://us-central1-aiplatform.googleapis.com\",\n  modelsUrl: undefined,\n  hostname: \"aiplatform.googleapis.com\",\n  fallbackModels: [\n    \"vertex/anthropic/claude-sonnet-4-5@20250929\",\n    \"vertex/google/gemini-2.0-flash-001\",\n  ],\n};\n\n/**\n * D293 absorbed: when location === \"global\", use `aiplatform.googleapis.com`\n * (no `global-` prefix) — known bug `streamRawPredict` 404 at\n * `global-aiplatform.googleapis.com` (a peer#10287).\n */\nexport function resolveVertexBaseUrl(opts: {\n  projectId: string;\n  location: string;\n  modelDialect: \"anthropic\" | \"gemini\";\n}): string {\n  const host =\n    opts.location === \"global\"\n      ? \"aiplatform.googleapis.com\"\n      : `${opts.location}-aiplatform.googleapis.com`;\n  if (opts.modelDialect === \"gemini\") {\n    // OpenAI-compat endpoint (D291) — the client appends `/chat/completions`.\n    return `https://${host}/v1/projects/${opts.projectId}/locations/${opts.location}/endpoints/openapi`;\n  }\n  // Anthropic — base URL up to `/publishers/anthropic` (model id appended by client).\n  return `https://${host}/v1/projects/${opts.projectId}/locations/${opts.location}/publishers/anthropic`;\n}\n\n/** Detect dialect from a `vertex/{dialect}/{model}` id. Default: gemini. */\nexport function inferModelDialect(modelId: string): \"anthropic\" | \"gemini\" {\n  if (modelId.includes(\"/anthropic/\")) return \"anthropic\";\n  if (modelId.includes(\"/google/\")) return \"gemini\";\n  return \"gemini\";\n}\n\n/** Strip the `vertex/{dialect}/` prefix so the raw model id is used in the URL. */\nexport function stripVertexPrefix(modelId: string): string {\n  return modelId.replace(/^vertex\\/(anthropic|google)\\//, \"\");\n}\n","import { openAiCompatibleProfile } from \"./openai-compatible.js\";\n\n/** M45 — xAI (Grok). Values per models.dev `xai` (2026-07 snapshot; grok-2 retired). */\nexport const XAI = openAiCompatibleProfile({\n  name: \"xai\",\n  aliases: [\"grok\"],\n  baseUrl: \"https://api.x.ai/v1\",\n  envVars: [\"XAI_API_KEY\"],\n  fallbackModels: [\"grok-4.5\", \"grok-4.3\"],\n  hostname: \"api.x.ai\",\n});\n","/**\n * Eager registration of builtin providers (T3.3). Side-effect import:\n * importing this module registers the 4 builtins with the registry.\n *\n * Lazy user-plugin discovery is handled by `discovery.ts` (T3.4).\n *\n * @internal\n */\n\nimport { registerCatalogProviders } from \"../catalog-loader.js\";\nimport { registerProvider } from \"../registry.js\";\nimport { ANTHROPIC } from \"./anthropic.js\";\nimport { BEDROCK } from \"./bedrock.js\";\nimport { CEREBRAS } from \"./cerebras.js\";\nimport { COHERE } from \"./cohere.js\";\nimport { DEEPINFRA } from \"./deepinfra.js\";\nimport { GEMINI } from \"./gemini.js\";\nimport { GOOGLE } from \"./google.js\";\nimport { GROQ } from \"./groq.js\";\nimport { LLAMACPP } from \"./llamacpp.js\";\nimport { LMSTUDIO } from \"./lmstudio.js\";\nimport { MISTRAL } from \"./mistral.js\";\nimport { OLLAMA } from \"./ollama.js\";\nimport { OPENAI } from \"./openai.js\";\nimport { OPENAI_CHATGPT } from \"./openai-chatgpt.js\";\nimport { OPENROUTER } from \"./openrouter.js\";\nimport { PERPLEXITY } from \"./perplexity.js\";\nimport { TOGETHER } from \"./together.js\";\nimport { VERTEX } from \"./vertex.js\";\nimport { XAI } from \"./xai.js\";\n\n// M45 review M2 — the guard lives on globalThis like the registry itself (M44 B1): a process importing both\n// bundle copies (`@theokit/sdk` + `@theokit/sdk/models`) must not re-register 19 builtins with bogus\n// \"overridden by user plugin\" WARNs.\nconst _registeredState = ((): { done: boolean } => {\n  const g = globalThis as unknown as Record<symbol, { done: boolean }>;\n  const sym = Symbol.for(\"theokit-sdk.providers.builtins-registered\");\n  if (g[sym] === undefined) g[sym] = { done: false };\n  return g[sym];\n})();\n\nexport function registerBuiltins(): void {\n  if (_registeredState.done) return;\n  _registeredState.done = true;\n  // First-party builtins (take priority — registered first)\n  registerProvider(ANTHROPIC);\n  registerProvider(OPENAI);\n  registerProvider(OPENAI_CHATGPT);\n  registerProvider(OPENROUTER);\n  registerProvider(GEMINI);\n  registerProvider(OLLAMA);\n  registerProvider(LMSTUDIO);\n  registerProvider(LLAMACPP);\n  registerProvider(BEDROCK);\n  registerProvider(VERTEX);\n  // M45 — the data-provider fleet (one file each on the openai-compatible base).\n  registerProvider(GOOGLE);\n  registerProvider(MISTRAL);\n  registerProvider(GROQ);\n  registerProvider(COHERE);\n  registerProvider(DEEPINFRA);\n  registerProvider(TOGETHER);\n  registerProvider(XAI);\n  registerProvider(PERPLEXITY);\n  registerProvider(CEREBRAS);\n  // Dynamic catalog — 40+ providers from JSON (T10.1, ADR D447)\n  registerCatalogProviders();\n}\n\n/** Test-only reset. @internal */\nexport function _resetBuiltinsRegistered(): void {\n  _registeredState.done = false;\n}\n\nexport {\n  ANTHROPIC,\n  BEDROCK,\n  GEMINI,\n  LLAMACPP,\n  LMSTUDIO,\n  OLLAMA,\n  OPENAI,\n  OPENAI_CHATGPT,\n  OPENROUTER,\n  VERTEX,\n};\n"]}