@theokit/sdk 5.11.0 → 5.12.0

package/dist/{chunk-ZDYDBXSD.js.map → chunk-RN3XDZGS.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/runtime/plugin-loader/plugin-bundles.ts","../src/internal/runtime/skills/subagents-loader.ts"],"names":["join"],"mappings":";;;;;;;AAyBA,eAAsB,gBAAA,CACpB,GAAA,EAEA,aAAA,GAAoD,EAAC,EAClC;AACnB,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,KAAA,MAAW,IAAA,IAAQ,iBAAA,CAAkB,GAAA,EAAK,aAAa,CAAA,EAAG;AACxD,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,OAAA,CAAQ,IAAA,EAAM,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACvD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,IAAI,KAAA,CAAM,aAAY,EAAG,IAAA,CAAK,KAAK,IAAA,CAAK,IAAA,EAAM,KAAA,CAAM,IAAI,CAAC,CAAA;AAAA,IAC3D;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;;;ACrBA,eAAsB,cACpB,GAAA,EACA,4BAAA,EACA,MAAA,EAEA,aAAA,GAAoD,EAAC,EACX;AAC1C,EAAA,MAAM,SAA0C,EAAC;AACjD,EAAA,IAAI,4BAAA,EAA8B;AAChC,IAAA,MAAM,aAAA,GAAgB,MAAM,oBAAA,CAAqB,GAAA,EAAK,aAAa,CAAA;AACnE,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,aAAa,CAAA,EAAG;AAC9D,MAAA,MAAA,CAAO,IAAI,CAAA,GAAI,UAAA;AAAA,IACjB;AAAA,EACF;AACA,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACvD,MAAA,MAAA,CAAO,IAAI,CAAA,GAAI,UAAA;AAAA,IACjB;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAQA,eAAe,oBAAA,CACb,KACA,aAAA,EAC0C;AAC1C,EAAA,MAAM,YAA6C,EAAC;AACpD,EAAA,KAAA,MAAW,UAAA,IAAc,kBAAA,CAAmB,GAAA,EAAK,aAAA,EAAe,WAAW,CAAA,EAAG;AAC5E,IAAA,MAAM,iBAAA,CAAkBA,IAAAA,CAAK,UAAA,EAAY,QAAQ,GAAG,SAAS,CAAA;AAAA,EAC/D;AAGA,EAAA,KAAA,MAAW,MAAA,IAAU,MAAM,gBAAA,CAAiB,GAAA,EAAK,aAAa,CAAA,EAAG;AAC/D,IAAA,MAAM,iBAAA,CAAkBA,IAAAA,CAAK,MAAA,EAAQ,QAAQ,GAAG,SAAS,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,SAAA;AACT;AA2BA,SAAS,yBAAA,CACP,KACA,QAAA,EACsD;AACtD,EAAA,IAAI;AACF,IAAA,OAAO,qBAAA,CAAsB,KAAK,QAAQ,CAAA;AAAA,EAC5C,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,YAAiB,kBAAA,IAAsB,KAAA,CAAM,IAAA,KAAS,gCAAA,EAAkC;AAC1F,MAAA,IAAA,CAAK,CAAA,cAAA,EAAiB,QAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,2BAAA,CAAwB,CAAA;AACxE,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,eAAe,iBAAA,CACb,MACA,SAAA,EACe;AACf,EAAA,MAAM,OAAA,GAAU,MAAM,gBAAA,CAAiB,IAAA,EAAM,wBAAwB,qBAAqB,CAAA;AAC1F,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,IAAI,CAAC,MAAM,MAAA,EAAO,IAAK,CAAC,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,EAAG;AACpD,IAAA,MAAM,IAAA,GAAOA,IAAAA,CAAK,IAAA,EAAM,KAAA,CAAM,IAAI,CAAA;AAClC,IAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AASvC,IAAA,IAAI,CAAC,cAAA,CAAe,GAAG,CAAA,EAAG;AACxB,MAAA,IAAA,CAAK,CAAA,cAAA,EAAiB,KAAA,CAAM,IAAI,CAAA,6DAAA,CAA0D,CAAA;AAC1F,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,GAAA,EAAK,KAAA,CAAM,IAAI,CAAA;AAC5D,IAAA,IAAI,eAAe,IAAA,EAAM;AACzB,IAAA,IAAI,SAAA,CAAU,UAAA,CAAW,IAAI,CAAA,KAAM,MAAA,EAAW;AAG5C,MAAA,SAAA,CAAU,UAAA,CAAW,IAAI,CAAA,GAAI,EAAE,GAAG,UAAA,CAAW,UAAA,EAAY,QAAQ,IAAA,EAAK;AAAA,IACxE;AAAA,EACF;AACF;AAKA,IAAM,eAAA,uBAAsB,GAAA,CAAI;AAAA,EAC9B,MAAA;AAAA,EACA,aAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,kBAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAC,CAAA;AAcD,IAAM,wBAAA,uBAA+B,GAAA,CAAI;AAAA;AAAA,EAEvC;AACF,CAAC,CAAA;AAED,SAAS,qBAAA,CACP,KACA,QAAA,EAC+C;AAC/C,EAAA,MAAM,EAAE,WAAA,EAAa,IAAA,EAAK,GAAI,gBAAA,CAAiB,KAAK,QAAQ,CAAA;AAC5D,EAAA,MAAM,MAAA,GAAS,uBAAuB,WAAW,CAAA;AACjD,EAAA,mBAAA,CAAoB,QAAQ,QAAQ,CAAA;AACpC,EAAA,SAAA,CAAU,QAAQ,QAAQ,CAAA;AAE1B,EAAA,MAAM,UAAA,GAA8B;AAAA,IAClC,WAAA,EAAa,QAAA,CAAS,MAAA,CAAO,WAAW,CAAA,IAAK,EAAA;AAAA,IAC7C,MAAA,EAAQ;AAAA,GACV;AACA,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,MAAA,EAAQ,QAAQ,CAAA;AAC3C,EAAA,IAAI,KAAA,KAAU,MAAA,EAAW,UAAA,CAAW,KAAA,GAAQ,KAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AACvC,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,UAAA,CAAW,KAAA,GAAQ,KAAA;AACzC,EAAA,MAAM,OAAA,GAAU,cAAA,CAAe,MAAA,EAAQ,QAAQ,CAAA;AAC/C,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,UAAA,CAAW,OAAA,GAAU,OAAA;AAGhD,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,MAAA,CAAO,MAAM,CAAA;AACrC,EAAA,IAAI,MAAA,KAAW,MAAA,EAAW,UAAA,CAAW,MAAA,GAAS,MAAA;AAE9C,EAAA,MAAM,IAAA,GAAO,SAAS,MAAA,CAAO,IAAI,KAAK,QAAA,CAAS,OAAA,CAAQ,SAAS,EAAE,CAAA;AAClE,EAAA,OAAO,EAAE,MAAM,UAAA,EAAW;AAC5B;AAeA,IAAM,wBAAA,uBAA+B,GAAA,CAAI;AAAA,EACvC,iBAAA;AAAA,EACA,gBAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,OAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAC,CAAA;AAOD,SAAS,iBAAA,CAAkB,KAAa,QAAA,EAAsC;AAC5E,EAAA,MAAM,OAAA,GAAU,wBAAA,CAAyB,GAAA,CAAI,GAAG,CAAA;AAChD,EAAA,MAAM,QAAA,GAAW,CAAC,GAAG,wBAAwB,EAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,KAAM,GAAG,CAAA;AACtE,EAAA,MAAM,MAAA,GAAS,UACX,CAAA,SAAA,EAAO,GAAG,8FACc,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,6FAAA,CAAA,GAE3C,EAAA;AAQJ,EAAA,IAAI,OAAA;AACF,IAAA,OAAO,IAAI,kBAAA;AAAA,MACT,CAAA,SAAA,EAAY,QAAQ,CAAA,6BAAA,EAAgC,GAAG,CAAA,aAAA,EAAgB,CAAC,GAAG,eAAe,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,IAAI,MAAM,CAAA,CAAA;AAAA,MAChH,EAAE,MAAM,gCAAA;AAAiC,KAC3C;AACF,EAAA,OAAO,IAAI,kBAAA;AAAA,IACT,CAAA,SAAA,EAAY,QAAQ,CAAA,6BAAA,EAAgC,GAAG,CAAA,aAAA,EAAgB,CAAC,GAAG,eAAe,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,IAAI,MAAM,CAAA,CAAA;AAAA,IAChH,EAAE,MAAM,wBAAA;AAAyB,GACnC;AACF;AAEA,SAAS,mBAAA,CACP,QACA,QAAA,EACM;AACN,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACrC,IAAA,IAAI,wBAAA,CAAyB,GAAA,CAAI,GAAG,CAAA,EAAG;AACvC,IAAA,IAAI,CAAC,gBAAgB,GAAA,CAAI,GAAG,GAAG,MAAM,iBAAA,CAAkB,KAAK,QAAQ,CAAA;AAAA,EACtE;AACF;AAOA,SAAS,SAAA,CAAU,QAAsD,QAAA,EAAwB;AAC/F,EAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,YAAY,QAAQ,CAAA,wIAAA,CAAA;AAAA,MACpB,EAAE,MAAM,gCAAA;AAAiC,KAC3C;AAAA,EACF;AACF;AAKA,SAAS,YAAA,CACP,QACA,QAAA,EACwC;AACxC,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,MAAA,CAAO,KAAK,CAAA;AACrC,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,MAAA,CAAO,gBAAgB,CAAA;AAI/C,EAAA,IAAI,MAAA,KAAW,MAAA,KAAc,OAAA,KAAY,MAAA,IAAa,YAAY,SAAA,CAAA,EAAY;AAC5E,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,YAAY,QAAQ,CAAA,wHAAA,CAAA;AAAA,MACpB,EAAE,MAAM,yCAAA;AAA0C,KACpD;AAAA,EACF;AACA,EAAA,IAAI,OAAA,KAAY,QAAW,OAAO,MAAA;AAClC,EAAA,IAAI,OAAA,KAAY,WAAW,OAAO,SAAA;AAClC,EAAA,OAAO,WAAW,MAAA,GACd,EAAE,EAAA,EAAI,OAAA,EAAS,QAAQ,CAAC,EAAE,EAAA,EAAI,UAAA,EAAY,OAAO,MAAA,EAAQ,GAAE,GAC3D,EAAE,IAAI,OAAA,EAAQ;AACpB;AAIA,SAAS,cAAA,CACP,QACA,QAAA,EACqB;AACrB,EAAA,IAAI,MAAA,CAAO,OAAA,KAAY,MAAA,EAAW,OAAO,MAAA;AACzC,EAAA,IAAI,OAAO,MAAA,CAAO,OAAA,KAAY,SAAA,EAAW;AACvC,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,YAAY,QAAQ,CAAA,kCAAA,EAAqC,MAAA,CAAO,MAAA,CAAO,OAAO,CAAC,CAAA,2DAAA,CAAA;AAAA,MAC/E,EAAE,MAAM,8BAAA;AAA+B,KACzC;AAAA,EACF;AACA,EAAA,OAAO,MAAA,CAAO,OAAA;AAChB;AAEA,SAAS,SAAS,CAAA,EAAqD;AACrE,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,MAAA;AAIlC,EAAA,MAAM,CAAA,GAAI,gBAAA,CAAiB,IAAA,CAAK,CAAC,CAAA;AACjC,EAAA,OAAO,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,GAAI,CAAA;AACpB;AAGA,SAAS,aAAa,CAAA,EAA2C;AAC/D,EAAA,IAAI,MAAM,OAAA,CAAQ,CAAC,GAAG,OAAO,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAC9E,EAAA,IAAI,OAAO,MAAM,QAAA,EAAU;AACzB,IAAA,OAAO,EACJ,KAAA,CAAM,QAAQ,CAAA,CACd,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,EACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,EAAC;AACV;AAGA,SAAS,eAAe,GAAA,EAAsB;AAC5C,EAAA,OAAO,WAAA,CAAY,KAAK,GAAG,CAAA;AAC7B;AAEA,SAAS,gBAAA,CAAiB,KAAa,QAAA,EAAyD;AAC9F,EAAA,MAAM,KAAA,GAAQ,yCAAA,CAA0C,IAAA,CAAK,GAAG,CAAA;AAChE,EAAA,IAAI,UAAU,IAAA,EAAM;AAClB,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,SAAA,EAAY,QAAQ,CAAA,uBAAA,CAAA,EAA2B;AAAA,MAC1E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,EAAE,WAAA,EAAa,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA,EAAI,IAAA,EAAA,CAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA,EAAI,IAAA,EAAK,EAAE;AACtE;AAEA,SAAS,uBAAuB,WAAA,EAAmE;AAIjG,EAAA,OAAO,gBAAgB,WAAW,CAAA;AACpC","file":"chunk-ZDYDBXSD.js","sourcesContent":["/**\n * Locating the plugin bundles a project carries.\n *\n * Shared by the skills and subagents loaders, which both need the same answer to \"which folders in\n * this project are plugins\" and would otherwise each grow their own copy of the directory walk.\n *\n * @internal\n */\n\nimport type { Dirent } from \"node:fs\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { pluginBundleRoots } from \"../../persistence/paths.js\";\nimport type { CompatSourceDeclaration } from \"../compat/foreign-config-sources.js\";\n\n/**\n * Every plugin folder under the project's plugin roots.\n *\n * Returns the FOLDERS, not their contents — what a bundle contributes (`skills/`, `agents/`) is the\n * caller's business, and a loader that also knew the layout would have to change whenever the other\n * one did.\n *\n * A missing root is not an error: most projects carry no plugins, and treating their absence as a\n * failure would make \"none installed\" indistinguishable from \"the directory could not be read\".\n */\nexport async function pluginBundleDirs(\n  cwd: string,\n  /** Declared foreign dialects (#524). Empty reads `.theokit/plugins` only. */\n  compatSources: readonly CompatSourceDeclaration[] = [],\n): Promise<string[]> {\n  const dirs: string[] = [];\n  for (const root of pluginBundleRoots(cwd, compatSources)) {\n    let entries: Dirent[];\n    try {\n      entries = await readdir(root, { withFileTypes: true });\n    } catch {\n      continue;\n    }\n    for (const entry of entries) {\n      if (entry.isDirectory()) dirs.push(join(root, entry.name));\n    }\n  }\n  return dirs;\n}\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { ConfigurationError } from \"../../../errors.js\";\nimport type { AgentDefinition } from \"../../../types/agent.js\";\nimport type { ModelSelection } from \"../../../types/agent-prims.js\";\nimport { diag } from \"../../diagnostics.js\";\nimport { projectConfigRoots } from \"../../persistence/paths.js\";\nimport type { CompatSourceDeclaration } from \"../compat/foreign-config-sources.js\";\nimport { readWorkspaceDir } from \"../config/workspace-dir.js\";\nimport { type FrontmatterValue, parseSimpleYaml } from \"../context/yaml-frontmatter.js\";\nimport { pluginBundleDirs } from \"../plugin-loader/plugin-bundles.js\";\n\n/**\n * Load file-based subagents from `.theokit/agents/*.md` and merge with\n * inline definitions. Inline overrides file-based on name conflict.\n *\n * Each markdown file has YAML frontmatter (description + optional model)\n * and a body that becomes the subagent prompt.\n *\n * @internal\n */\nexport async function loadSubagents(\n  cwd: string,\n  settingSourcesIncludeProject: boolean,\n  inline: Record<string, AgentDefinition> | undefined,\n  /** Declared foreign dialects (#524). Empty reads `.theokit/` only. */\n  compatSources: readonly CompatSourceDeclaration[] = [],\n): Promise<Record<string, AgentDefinition>> {\n  const result: Record<string, AgentDefinition> = {};\n  if (settingSourcesIncludeProject) {\n    const projectAgents = await readProjectSubagents(cwd, compatSources);\n    for (const [name, definition] of Object.entries(projectAgents)) {\n      result[name] = definition;\n    }\n  }\n  if (inline !== undefined) {\n    for (const [name, definition] of Object.entries(inline)) {\n      result[name] = definition;\n    }\n  }\n  return result;\n}\n\n/**\n * Read agent declarations from every project config root (`.theokit`, then `.claude`).\n *\n * FIRST occurrence of a name wins, which is what makes `projectConfigRoots`' order a contract rather\n * than a detail: a project declaring the same agent in both means the explicit namespace.\n */\nasync function readProjectSubagents(\n  cwd: string,\n  compatSources: readonly CompatSourceDeclaration[],\n): Promise<Record<string, AgentDefinition>> {\n  const subagents: Record<string, AgentDefinition> = {};\n  for (const configRoot of projectConfigRoots(cwd, compatSources, \"subagents\")) {\n    await readSubagentsFrom(join(configRoot, \"agents\"), subagents);\n  }\n  // A Claude Code plugin is a BUNDLE, and its `agents/` is what it exists to contribute. Read after\n  // the project's own, so a project can shadow an agent a plugin ships without editing the plugin.\n  for (const bundle of await pluginBundleDirs(cwd, compatSources)) {\n    await readSubagentsFrom(join(bundle, \"agents\"), subagents);\n  }\n  return subagents;\n}\n\n/**\n * Parse an agent file, or return null when it was written for another runtime.\n *\n * ## What this changed, and what it deliberately did not\n *\n * The failure used to take the whole directory, and that was a decision rather than an oversight:\n * \"a file that HAS frontmatter and gets it wrong is a broken agent and still fails loudly, which is\n * what keeps a typo'd `sandbox` from returning as a silent gate through this door. Isolating the\n * failure per file would hand that risk back.\"\n *\n * The risk named there is real and is NOT handed back, because the isolation is narrower than the\n * one that argument refuses. Only `KNOWN_CLAUDE_CODE_FIELDS` takes this door — the set that already\n * encodes \"this key belongs to another runtime and carries no behaviour here\". A misspelling of one\n * of OUR keys carries `subagent_unknown_field` and still propagates, so `sandboxx` remains fatal\n * and cannot return as a silent gate. `a-claude-code-field-names-itself.test.ts` pins both halves.\n *\n * What moved the decision was the cost, measured in a live TUI on 2026-09-15: one ported\n * `.claude/agents/*.md` carrying `memory:` stopped every sibling agent from loading and the turn\n * produced no answer at all — on an agent the task never used. Beside it, on the same prompt and\n * the same project, another runtime answered normally. The diagnosis fix this file shipped tells a\n * user which key is foreign; it does not give them back the turn.\n *\n * The loader already draws exactly this line for a file with no frontmatter, and for the same\n * stated reason: one of them must not stop every agent in the directory from loading.\n */\nfunction parseOrSkipForeignRuntime(\n  raw: string,\n  filename: string,\n): { name: string; definition: AgentDefinition } | null {\n  try {\n    return parseSubagentMarkdown(raw, filename);\n  } catch (error) {\n    if (error instanceof ConfigurationError && error.code === \"subagent_foreign_runtime_field\") {\n      diag(`[theokit-sdk] ${filename}: ${error.message} — skipping this agent`);\n      return null;\n    }\n    throw error;\n  }\n}\n\nasync function readSubagentsFrom(\n  root: string,\n  subagents: Record<string, AgentDefinition>,\n): Promise<void> {\n  const entries = await readWorkspaceDir(root, \"subagents_read_error\", \"subagents directory\");\n  for (const entry of entries) {\n    if (!entry.isFile() || !entry.name.endsWith(\".md\")) continue;\n    const path = join(root, entry.name);\n    const raw = await readFile(path, \"utf8\");\n    // A markdown file with NO frontmatter is not an agent declaration — a directory of agents\n    // written for the Claude Code CLI conventionally carries documentation beside them, and\n    // `.claude/agents/README.md` exists in this repository. Throwing on it made ONE such file stop\n    // every agent in the directory from loading.\n    //\n    // Skipped with a warn rather than in silence, and ONLY for the no-frontmatter case: a file that\n    // HAS frontmatter and gets it wrong is a broken agent and still fails loudly, which is what\n    // keeps a typo'd `sandbox` from returning as a silent gate through this door.\n    if (!hasFrontmatter(raw)) {\n      diag(`[theokit-sdk] ${entry.name} has no frontmatter — not an agent declaration, skipping`);\n      continue;\n    }\n    const definition = parseOrSkipForeignRuntime(raw, entry.name);\n    if (definition === null) continue;\n    if (subagents[definition.name] === undefined) {\n      // `path` is computed above to read the file and was then dropped. Keeping it is the whole\n      // visibility fix (#524): without it a listing cannot say which root an agent came from.\n      subagents[definition.name] = { ...definition.definition, source: path };\n    }\n  }\n}\n\n// The frontmatter keys a disk subagent may declare. Any other key is a typed load\n// error rather than a silent drop — a dropped `sandbox` an operator wrote believing\n// it confines the child is exactly the silent-gate failure class this guards against.\nconst ACCEPTED_FIELDS = new Set([\n  \"name\",\n  \"description\",\n  \"model\",\n  \"tools\",\n  \"reasoning_effort\",\n  \"mcp\",\n  \"sandbox\",\n  \"memory\",\n]);\n\n// Fields the Claude Code CLI writes that carry NO behaviour for this runtime. Accepted and ignored,\n// so an agent authored for the CLI loads here unchanged — measured 2026-08-26 across the 59 agent\n// files on one machine, where `color` appeared in 38 of them and made every one of those a\n// `subagent_unknown_field` load error.\n//\n// Named explicitly instead of loosening the check above, because that check's reason is sound: a\n// dropped `sandbox` an operator wrote believing it confines the child is a silent gate. A field that\n// COULD change behaviour must still fail loudly. This set is the difference between \"we know this\n// one and it does nothing\" and \"we have never heard of this\" — two facts a bare allow-everything\n// would collapse into one.\n//\n// Anything added here needs the same justification: inert for THIS runtime, not merely unfamiliar.\nconst INERT_CLAUDE_CODE_FIELDS = new Set([\n  /** The CLI's label colour for the agent. Presentation only. */\n  \"color\",\n]);\n\nfunction parseSubagentMarkdown(\n  raw: string,\n  filename: string,\n): { name: string; definition: AgentDefinition } {\n  const { frontmatter, body } = splitFrontmatter(raw, filename);\n  const fields = parseFrontmatterFields(frontmatter);\n  rejectUnknownFields(fields, filename);\n  rejectMcp(fields, filename);\n\n  const definition: AgentDefinition = {\n    description: asString(fields.description) ?? \"\",\n    prompt: body,\n  };\n  const model = resolveModel(fields, filename);\n  if (model !== undefined) definition.model = model;\n  const tools = toStringList(fields.tools);\n  if (tools.length > 0) definition.tools = tools;\n  const sandbox = resolveSandbox(fields, filename);\n  if (sandbox !== undefined) definition.sandbox = sandbox;\n  // Carried unjudged — see `AgentDefinition.memory`. Which root a scope names, and whether the\n  // name is one at all, is `@theokit/agents`' decision and refusing it twice means two lists.\n  const memory = asString(fields.memory);\n  if (memory !== undefined) definition.memory = memory;\n\n  const name = asString(fields.name) ?? filename.replace(/\\.md$/, \"\");\n  return { name, definition };\n}\n\n/**\n * Frontmatter keys that Claude Code documents for a subagent and this runtime does not accept.\n *\n * Not an allow-list — every one of these still fails the load. It exists so the FAILURE can say\n * which kind of unknown it met. A user migrating a `.claude/agents/` tree used to learn one key per\n * round trip: fix `memory`, meet `permissionMode`, fix that, meet `maxTurns` — with nothing saying\n * the set was finite or that the tree was simply written for another runtime.\n *\n * The distinction this file already draws for `INERT_CLAUDE_CODE_FIELDS` is the same one: \"the\n * difference between 'we know this one and it does nothing' and 'we have never heard of this' — two\n * facts a bare allow-everything would collapse into one.\" This is the third fact beside them —\n * \"another runtime's field\" — and it changes only the message, never the verdict.\n */\nconst KNOWN_CLAUDE_CODE_FIELDS = new Set([\n  \"disallowedTools\",\n  \"permissionMode\",\n  \"maxTurns\",\n  \"skills\",\n  \"background\",\n  \"effort\",\n  \"isolation\",\n  \"initialPrompt\",\n  \"hooks\",\n  \"experimental\",\n  \"mcpServers\",\n]);\n\n/**\n * The typed error for a key we do not accept. Built here rather than inline so `rejectUnknownFields`\n * stays a plain loop: the message has two shapes and the code has two values, and computing all four\n * at the throw site is what pushed that function past the cognitive-complexity gate.\n */\nfunction unknownFieldError(key: string, filename: string): ConfigurationError {\n  const foreign = KNOWN_CLAUDE_CODE_FIELDS.has(key);\n  const siblings = [...KNOWN_CLAUDE_CODE_FIELDS].filter((f) => f !== key);\n  const origin = foreign\n    ? ` — \"${key}\" is a Claude Code subagent field that this runtime does not support. ` +\n      `The same applies to: ${siblings.join(\", \")}. Removing them one at a time will meet each ` +\n      `in turn; the tree is written for another runtime`\n    : \"\";\n  // The two codes are written as LITERALS, one per branch, rather than as a ternary inside the\n  // options object. `tools/generate-error-codes.mjs` walks the source for the literal assigned to\n  // `code:`, so a ternary there is not a literal and it extracted NEITHER — measured 2026-09-15,\n  // when `quality:docs-errors` went red and the regenerated reference had lost\n  // `subagent_unknown_field` without ever gaining `subagent_foreign_runtime_field`. Two real,\n  // throwable codes were absent from the published error reference, which is the one place a\n  // consumer looks to find out what they can catch.\n  if (foreign)\n    return new ConfigurationError(\n      `Subagent ${filename}: unknown frontmatter field \"${key}\" (accepted: ${[...ACCEPTED_FIELDS].join(\", \")})${origin}`,\n      { code: \"subagent_foreign_runtime_field\" },\n    );\n  return new ConfigurationError(\n    `Subagent ${filename}: unknown frontmatter field \"${key}\" (accepted: ${[...ACCEPTED_FIELDS].join(\", \")})${origin}`,\n    { code: \"subagent_unknown_field\" },\n  );\n}\n\nfunction rejectUnknownFields(\n  fields: Record<string, FrontmatterValue | undefined>,\n  filename: string,\n): void {\n  for (const key of Object.keys(fields)) {\n    if (INERT_CLAUDE_CODE_FIELDS.has(key)) continue;\n    if (!ACCEPTED_FIELDS.has(key)) throw unknownFieldError(key, filename);\n  }\n}\n\n// mcp: a known field, but not yet honored on the LOCAL delegation path. The frontmatter YAML can only\n// express server NAMES (parseSimpleYaml has no nested-object support), while a child's `Agent.create`\n// needs `mcpServers` as a Record<name, config>; resolving names→config per-subagent in local delegation\n// is its own follow-up. Rather than silently drop it (the M26/M32 silent-gate class), it is a typed load\n// error that names the field and points at the alternative.\nfunction rejectMcp(fields: Record<string, FrontmatterValue | undefined>, filename: string): void {\n  if (fields.mcp !== undefined) {\n    throw new ConfigurationError(\n      `Subagent ${filename}: per-subagent \"mcp\" is not yet supported on the local delegation path; declare MCP servers in .theokit/mcp.json (or the parent) instead`,\n      { code: \"subagent_mcp_unsupported_local\" },\n    );\n  }\n}\n\n// model + reasoning_effort — effort rides inside `model.params[thinking]`, so it requires a concrete\n// model id to attach to (a child inheriting the parent's model cannot carry the parent's provider-\n// specific effort param safely).\nfunction resolveModel(\n  fields: Record<string, FrontmatterValue | undefined>,\n  filename: string,\n): ModelSelection | \"inherit\" | undefined {\n  const modelId = asString(fields.model);\n  const effort = asString(fields.reasoning_effort);\n  // reasoning_effort rides in model.params[thinking], so it needs a CONCRETE model id to attach to.\n  // Neither an absent model NOR `model: inherit` can carry it (the inherited id is unknown at load), so\n  // both are typed errors rather than a silently-dropped effort — the silent-gate class this guards.\n  if (effort !== undefined && (modelId === undefined || modelId === \"inherit\")) {\n    throw new ConfigurationError(\n      `Subagent ${filename}: reasoning_effort requires a concrete model (effort is a model parameter; an absent model or \"inherit\" cannot carry it)`,\n      { code: \"subagent_reasoning_effort_without_model\" },\n    );\n  }\n  if (modelId === undefined) return undefined;\n  if (modelId === \"inherit\") return \"inherit\";\n  return effort !== undefined\n    ? { id: modelId, params: [{ id: \"thinking\", value: effort }] }\n    : { id: modelId };\n}\n\n// sandbox: boolean only. A granular mode string (read-only/…) is unsupported by the SDK runtime and is\n// a typed error rather than a silent coercion to a boolean.\nfunction resolveSandbox(\n  fields: Record<string, FrontmatterValue | undefined>,\n  filename: string,\n): boolean | undefined {\n  if (fields.sandbox === undefined) return undefined;\n  if (typeof fields.sandbox !== \"boolean\") {\n    throw new ConfigurationError(\n      `Subagent ${filename}: sandbox must be a boolean (got \"${String(fields.sandbox)}\"); granular sandbox modes are not supported by the runtime`,\n      { code: \"subagent_sandbox_not_boolean\" },\n    );\n  }\n  return fields.sandbox;\n}\n\nfunction asString(v: FrontmatterValue | undefined): string | undefined {\n  if (typeof v !== \"string\") return undefined;\n  // parseSimpleYaml does not strip quotes (documented), and `model`/`reasoning_effort` are fields users\n  // habitually quote (`model: \"openai/gpt-4o\"`). Strip a single matching surrounding quote pair so a\n  // quoted id/effort does not slip past validation and fail only at the provider.\n  const m = /^([\"'])(.*)\\1$/.exec(v);\n  return m ? m[2] : v;\n}\n\n/** Accept a YAML list (`string[]`) or a comma/space-separated scalar; trim + drop empties. */\nfunction toStringList(v: FrontmatterValue | undefined): string[] {\n  if (Array.isArray(v)) return v.map((t) => t.trim()).filter((t) => t.length > 0);\n  if (typeof v === \"string\") {\n    return v\n      .split(/[\\s,]+/)\n      .map((t) => t.trim())\n      .filter((t) => t.length > 0);\n  }\n  return [];\n}\n\n/** Does this file open with a frontmatter block at all? Its ABSENCE means \"not an agent\". */\nfunction hasFrontmatter(raw: string): boolean {\n  return /^---\\s*\\n/.test(raw);\n}\n\nfunction splitFrontmatter(raw: string, filename: string): { frontmatter: string; body: string } {\n  const match = /^---\\s*\\n([\\s\\S]*?)\\n---\\s*\\n([\\s\\S]*)$/.exec(raw);\n  if (match === null) {\n    throw new ConfigurationError(`Subagent ${filename} is missing frontmatter`, {\n      code: \"subagent_missing_frontmatter\",\n    });\n  }\n  return { frontmatter: match[1] ?? \"\", body: (match[2] ?? \"\").trim() };\n}\n\nfunction parseFrontmatterFields(frontmatter: string): Record<string, FrontmatterValue | undefined> {\n  // Preserve the rich YAML value types (boolean/number/string[]): `sandbox: true` and\n  // `mcp: [a, b]` are meaningful here, so narrowing everything to string (as the\n  // pre-M33 loader did) would drop them. Per-field validation happens in parseSubagentMarkdown.\n  return parseSimpleYaml(frontmatter);\n}\n"]}
+{"version":3,"sources":["../src/internal/runtime/plugin-loader/plugin-bundles.ts","../src/internal/runtime/skills/subagents-loader.ts"],"names":["join"],"mappings":";;;;;;;AAyBA,eAAsB,gBAAA,CACpB,GAAA,EAEA,aAAA,GAAoD,EAAC,EAClC;AACnB,EAAA,MAAM,OAAiB,EAAC;AACxB,EAAA,KAAA,MAAW,IAAA,IAAQ,iBAAA,CAAkB,GAAA,EAAK,aAAa,CAAA,EAAG;AACxD,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,OAAA,CAAQ,IAAA,EAAM,EAAE,aAAA,EAAe,MAAM,CAAA;AAAA,IACvD,CAAA,CAAA,MAAQ;AACN,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,MAAA,IAAI,KAAA,CAAM,aAAY,EAAG,IAAA,CAAK,KAAK,IAAA,CAAK,IAAA,EAAM,KAAA,CAAM,IAAI,CAAC,CAAA;AAAA,IAC3D;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;;;ACrBA,eAAsB,cACpB,GAAA,EACA,4BAAA,EACA,MAAA,EAEA,aAAA,GAAoD,EAAC,EACX;AAC1C,EAAA,MAAM,SAA0C,EAAC;AACjD,EAAA,IAAI,4BAAA,EAA8B;AAChC,IAAA,MAAM,aAAA,GAAgB,MAAM,oBAAA,CAAqB,GAAA,EAAK,aAAa,CAAA;AACnE,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,aAAa,CAAA,EAAG;AAC9D,MAAA,MAAA,CAAO,IAAI,CAAA,GAAI,UAAA;AAAA,IACjB;AAAA,EACF;AACA,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACvD,MAAA,MAAA,CAAO,IAAI,CAAA,GAAI,UAAA;AAAA,IACjB;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAQA,eAAe,oBAAA,CACb,KACA,aAAA,EAC0C;AAC1C,EAAA,MAAM,YAA6C,EAAC;AACpD,EAAA,KAAA,MAAW,UAAA,IAAc,kBAAA,CAAmB,GAAA,EAAK,aAAA,EAAe,WAAW,CAAA,EAAG;AAC5E,IAAA,MAAM,iBAAA,CAAkBA,IAAAA,CAAK,UAAA,EAAY,QAAQ,GAAG,SAAS,CAAA;AAAA,EAC/D;AAGA,EAAA,KAAA,MAAW,MAAA,IAAU,MAAM,gBAAA,CAAiB,GAAA,EAAK,aAAa,CAAA,EAAG;AAC/D,IAAA,MAAM,iBAAA,CAAkBA,IAAAA,CAAK,MAAA,EAAQ,QAAQ,GAAG,SAAS,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,SAAA;AACT;AA2BA,SAAS,yBAAA,CACP,KACA,QAAA,EACsD;AACtD,EAAA,IAAI;AACF,IAAA,OAAO,qBAAA,CAAsB,KAAK,QAAQ,CAAA;AAAA,EAC5C,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,YAAiB,kBAAA,IAAsB,KAAA,CAAM,IAAA,KAAS,gCAAA,EAAkC;AAC1F,MAAA,IAAA,CAAK,CAAA,cAAA,EAAiB,QAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,2BAAA,CAAwB,CAAA;AACxE,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,eAAe,iBAAA,CACb,MACA,SAAA,EACe;AACf,EAAA,MAAM,OAAA,GAAU,MAAM,gBAAA,CAAiB,IAAA,EAAM,wBAAwB,qBAAqB,CAAA;AAC1F,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,IAAI,CAAC,MAAM,MAAA,EAAO,IAAK,CAAC,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,KAAK,CAAA,EAAG;AACpD,IAAA,MAAM,IAAA,GAAOA,IAAAA,CAAK,IAAA,EAAM,KAAA,CAAM,IAAI,CAAA;AAClC,IAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AASvC,IAAA,IAAI,CAAC,cAAA,CAAe,GAAG,CAAA,EAAG;AACxB,MAAA,IAAA,CAAK,CAAA,cAAA,EAAiB,KAAA,CAAM,IAAI,CAAA,6DAAA,CAA0D,CAAA;AAC1F,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAA,GAAa,yBAAA,CAA0B,GAAA,EAAK,KAAA,CAAM,IAAI,CAAA;AAC5D,IAAA,IAAI,eAAe,IAAA,EAAM;AACzB,IAAA,IAAI,SAAA,CAAU,UAAA,CAAW,IAAI,CAAA,KAAM,MAAA,EAAW;AAG5C,MAAA,SAAA,CAAU,UAAA,CAAW,IAAI,CAAA,GAAI,EAAE,GAAG,UAAA,CAAW,UAAA,EAAY,QAAQ,IAAA,EAAK;AAAA,IACxE;AAAA,EACF;AACF;AAKA,IAAM,eAAA,uBAAsB,GAAA,CAAI;AAAA,EAC9B,MAAA;AAAA,EACA,aAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,kBAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EACA;AACF,CAAC,CAAA;AAcD,IAAM,wBAAA,uBAA+B,GAAA,CAAI;AAAA;AAAA,EAEvC;AACF,CAAC,CAAA;AAED,SAAS,qBAAA,CACP,KACA,QAAA,EAC+C;AAC/C,EAAA,MAAM,EAAE,WAAA,EAAa,IAAA,EAAK,GAAI,gBAAA,CAAiB,KAAK,QAAQ,CAAA;AAC5D,EAAA,MAAM,MAAA,GAAS,uBAAuB,WAAW,CAAA;AACjD,EAAA,mBAAA,CAAoB,QAAQ,QAAQ,CAAA;AACpC,EAAA,SAAA,CAAU,QAAQ,QAAQ,CAAA;AAE1B,EAAA,MAAM,UAAA,GAA8B;AAAA,IAClC,WAAA,EAAa,QAAA,CAAS,MAAA,CAAO,WAAW,CAAA,IAAK,EAAA;AAAA,IAC7C,MAAA,EAAQ;AAAA,GACV;AACA,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,MAAA,EAAQ,QAAQ,CAAA;AAC3C,EAAA,IAAI,KAAA,KAAU,MAAA,EAAW,UAAA,CAAW,KAAA,GAAQ,KAAA;AAC5C,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AACvC,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,UAAA,CAAW,KAAA,GAAQ,KAAA;AACzC,EAAA,MAAM,OAAA,GAAU,cAAA,CAAe,MAAA,EAAQ,QAAQ,CAAA;AAC/C,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,UAAA,CAAW,OAAA,GAAU,OAAA;AAGhD,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,MAAA,CAAO,MAAM,CAAA;AACrC,EAAA,IAAI,MAAA,KAAW,MAAA,EAAW,UAAA,CAAW,MAAA,GAAS,MAAA;AAE9C,EAAA,MAAM,IAAA,GAAO,SAAS,MAAA,CAAO,IAAI,KAAK,QAAA,CAAS,OAAA,CAAQ,SAAS,EAAE,CAAA;AAClE,EAAA,OAAO,EAAE,MAAM,UAAA,EAAW;AAC5B;AAeA,IAAM,wBAAA,uBAA+B,GAAA,CAAI;AAAA,EACvC,iBAAA;AAAA,EACA,gBAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,eAAA;AAAA,EACA,OAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAC,CAAA;AAOD,SAAS,iBAAA,CAAkB,KAAa,QAAA,EAAsC;AAC5E,EAAA,MAAM,OAAA,GAAU,wBAAA,CAAyB,GAAA,CAAI,GAAG,CAAA;AAChD,EAAA,MAAM,QAAA,GAAW,CAAC,GAAG,wBAAwB,EAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,KAAM,GAAG,CAAA;AACtE,EAAA,MAAM,MAAA,GAAS,UACX,CAAA,SAAA,EAAO,GAAG,8FACc,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,6FAAA,CAAA,GAE3C,EAAA;AAQJ,EAAA,IAAI,OAAA;AACF,IAAA,OAAO,IAAI,kBAAA;AAAA,MACT,CAAA,SAAA,EAAY,QAAQ,CAAA,6BAAA,EAAgC,GAAG,CAAA,aAAA,EAAgB,CAAC,GAAG,eAAe,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,IAAI,MAAM,CAAA,CAAA;AAAA,MAChH,EAAE,MAAM,gCAAA;AAAiC,KAC3C;AACF,EAAA,OAAO,IAAI,kBAAA;AAAA,IACT,CAAA,SAAA,EAAY,QAAQ,CAAA,6BAAA,EAAgC,GAAG,CAAA,aAAA,EAAgB,CAAC,GAAG,eAAe,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,IAAI,MAAM,CAAA,CAAA;AAAA,IAChH,EAAE,MAAM,wBAAA;AAAyB,GACnC;AACF;AAEA,SAAS,mBAAA,CACP,QACA,QAAA,EACM;AACN,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,EAAG;AACrC,IAAA,IAAI,wBAAA,CAAyB,GAAA,CAAI,GAAG,CAAA,EAAG;AACvC,IAAA,IAAI,CAAC,gBAAgB,GAAA,CAAI,GAAG,GAAG,MAAM,iBAAA,CAAkB,KAAK,QAAQ,CAAA;AAAA,EACtE;AACF;AAOA,SAAS,SAAA,CAAU,QAAsD,QAAA,EAAwB;AAC/F,EAAA,IAAI,MAAA,CAAO,QAAQ,MAAA,EAAW;AAC5B,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,YAAY,QAAQ,CAAA,wIAAA,CAAA;AAAA,MACpB,EAAE,MAAM,gCAAA;AAAiC,KAC3C;AAAA,EACF;AACF;AAKA,SAAS,YAAA,CACP,QACA,QAAA,EACwC;AACxC,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,MAAA,CAAO,KAAK,CAAA;AACrC,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,MAAA,CAAO,gBAAgB,CAAA;AAI/C,EAAA,IAAI,MAAA,KAAW,MAAA,KAAc,OAAA,KAAY,MAAA,IAAa,YAAY,SAAA,CAAA,EAAY;AAC5E,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,YAAY,QAAQ,CAAA,wHAAA,CAAA;AAAA,MACpB,EAAE,MAAM,yCAAA;AAA0C,KACpD;AAAA,EACF;AACA,EAAA,IAAI,OAAA,KAAY,QAAW,OAAO,MAAA;AAClC,EAAA,IAAI,OAAA,KAAY,WAAW,OAAO,SAAA;AAClC,EAAA,OAAO,WAAW,MAAA,GACd,EAAE,EAAA,EAAI,OAAA,EAAS,QAAQ,CAAC,EAAE,EAAA,EAAI,UAAA,EAAY,OAAO,MAAA,EAAQ,GAAE,GAC3D,EAAE,IAAI,OAAA,EAAQ;AACpB;AAIA,SAAS,cAAA,CACP,QACA,QAAA,EACqB;AACrB,EAAA,IAAI,MAAA,CAAO,OAAA,KAAY,MAAA,EAAW,OAAO,MAAA;AACzC,EAAA,IAAI,OAAO,MAAA,CAAO,OAAA,KAAY,SAAA,EAAW;AACvC,IAAA,MAAM,IAAI,kBAAA;AAAA,MACR,YAAY,QAAQ,CAAA,kCAAA,EAAqC,MAAA,CAAO,MAAA,CAAO,OAAO,CAAC,CAAA,2DAAA,CAAA;AAAA,MAC/E,EAAE,MAAM,8BAAA;AAA+B,KACzC;AAAA,EACF;AACA,EAAA,OAAO,MAAA,CAAO,OAAA;AAChB;AAEA,SAAS,SAAS,CAAA,EAAqD;AACrE,EAAA,IAAI,OAAO,CAAA,KAAM,QAAA,EAAU,OAAO,MAAA;AAIlC,EAAA,MAAM,CAAA,GAAI,gBAAA,CAAiB,IAAA,CAAK,CAAC,CAAA;AACjC,EAAA,OAAO,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,GAAI,CAAA;AACpB;AAGA,SAAS,aAAa,CAAA,EAA2C;AAC/D,EAAA,IAAI,MAAM,OAAA,CAAQ,CAAC,GAAG,OAAO,CAAA,CAAE,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAC9E,EAAA,IAAI,OAAO,MAAM,QAAA,EAAU;AACzB,IAAA,OAAO,EACJ,KAAA,CAAM,QAAQ,CAAA,CACd,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,EACnB,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,EAAC;AACV;AAGA,SAAS,eAAe,GAAA,EAAsB;AAC5C,EAAA,OAAO,WAAA,CAAY,KAAK,GAAG,CAAA;AAC7B;AAEA,SAAS,gBAAA,CAAiB,KAAa,QAAA,EAAyD;AAC9F,EAAA,MAAM,KAAA,GAAQ,yCAAA,CAA0C,IAAA,CAAK,GAAG,CAAA;AAChE,EAAA,IAAI,UAAU,IAAA,EAAM;AAClB,IAAA,MAAM,IAAI,kBAAA,CAAmB,CAAA,SAAA,EAAY,QAAQ,CAAA,uBAAA,CAAA,EAA2B;AAAA,MAC1E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,EAAE,WAAA,EAAa,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA,EAAI,IAAA,EAAA,CAAO,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA,EAAI,IAAA,EAAK,EAAE;AACtE;AAEA,SAAS,uBAAuB,WAAA,EAAmE;AAIjG,EAAA,OAAO,gBAAgB,WAAW,CAAA;AACpC","file":"chunk-RN3XDZGS.js","sourcesContent":["/**\n * Locating the plugin bundles a project carries.\n *\n * Shared by the skills and subagents loaders, which both need the same answer to \"which folders in\n * this project are plugins\" and would otherwise each grow their own copy of the directory walk.\n *\n * @internal\n */\n\nimport type { Dirent } from \"node:fs\";\nimport { readdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { pluginBundleRoots } from \"../../persistence/paths.js\";\nimport type { CompatSourceDeclaration } from \"../compat/foreign-config-sources.js\";\n\n/**\n * Every plugin folder under the project's plugin roots.\n *\n * Returns the FOLDERS, not their contents — what a bundle contributes (`skills/`, `agents/`) is the\n * caller's business, and a loader that also knew the layout would have to change whenever the other\n * one did.\n *\n * A missing root is not an error: most projects carry no plugins, and treating their absence as a\n * failure would make \"none installed\" indistinguishable from \"the directory could not be read\".\n */\nexport async function pluginBundleDirs(\n  cwd: string,\n  /** Declared foreign dialects (#524). Empty reads `.theokit/plugins` only. */\n  compatSources: readonly CompatSourceDeclaration[] = [],\n): Promise<string[]> {\n  const dirs: string[] = [];\n  for (const root of pluginBundleRoots(cwd, compatSources)) {\n    let entries: Dirent[];\n    try {\n      entries = await readdir(root, { withFileTypes: true });\n    } catch {\n      continue;\n    }\n    for (const entry of entries) {\n      if (entry.isDirectory()) dirs.push(join(root, entry.name));\n    }\n  }\n  return dirs;\n}\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { ConfigurationError } from \"../../../errors.js\";\nimport type { AgentDefinition } from \"../../../types/agent.js\";\nimport type { ModelSelection } from \"../../../types/agent-prims.js\";\nimport { diag } from \"../../diagnostics.js\";\nimport { projectConfigRoots } from \"../../persistence/paths.js\";\nimport type { CompatSourceDeclaration } from \"../compat/foreign-config-sources.js\";\nimport { readWorkspaceDir } from \"../config/workspace-dir.js\";\nimport { type FrontmatterValue, parseSimpleYaml } from \"../context/yaml-frontmatter.js\";\nimport { pluginBundleDirs } from \"../plugin-loader/plugin-bundles.js\";\n\n/**\n * Load file-based subagents from `.theokit/agents/*.md` and merge with\n * inline definitions. Inline overrides file-based on name conflict.\n *\n * Each markdown file has YAML frontmatter (description + optional model)\n * and a body that becomes the subagent prompt.\n *\n * @internal\n */\nexport async function loadSubagents(\n  cwd: string,\n  settingSourcesIncludeProject: boolean,\n  inline: Record<string, AgentDefinition> | undefined,\n  /** Declared foreign dialects (#524). Empty reads `.theokit/` only. */\n  compatSources: readonly CompatSourceDeclaration[] = [],\n): Promise<Record<string, AgentDefinition>> {\n  const result: Record<string, AgentDefinition> = {};\n  if (settingSourcesIncludeProject) {\n    const projectAgents = await readProjectSubagents(cwd, compatSources);\n    for (const [name, definition] of Object.entries(projectAgents)) {\n      result[name] = definition;\n    }\n  }\n  if (inline !== undefined) {\n    for (const [name, definition] of Object.entries(inline)) {\n      result[name] = definition;\n    }\n  }\n  return result;\n}\n\n/**\n * Read agent declarations from every project config root (`.theokit`, then `.claude`).\n *\n * FIRST occurrence of a name wins, which is what makes `projectConfigRoots`' order a contract rather\n * than a detail: a project declaring the same agent in both means the explicit namespace.\n */\nasync function readProjectSubagents(\n  cwd: string,\n  compatSources: readonly CompatSourceDeclaration[],\n): Promise<Record<string, AgentDefinition>> {\n  const subagents: Record<string, AgentDefinition> = {};\n  for (const configRoot of projectConfigRoots(cwd, compatSources, \"subagents\")) {\n    await readSubagentsFrom(join(configRoot, \"agents\"), subagents);\n  }\n  // A Claude Code plugin is a BUNDLE, and its `agents/` is what it exists to contribute. Read after\n  // the project's own, so a project can shadow an agent a plugin ships without editing the plugin.\n  for (const bundle of await pluginBundleDirs(cwd, compatSources)) {\n    await readSubagentsFrom(join(bundle, \"agents\"), subagents);\n  }\n  return subagents;\n}\n\n/**\n * Parse an agent file, or return null when it was written for another runtime.\n *\n * ## What this changed, and what it deliberately did not\n *\n * The failure used to take the whole directory, and that was a decision rather than an oversight:\n * \"a file that HAS frontmatter and gets it wrong is a broken agent and still fails loudly, which is\n * what keeps a typo'd `sandbox` from returning as a silent gate through this door. Isolating the\n * failure per file would hand that risk back.\"\n *\n * The risk named there is real and is NOT handed back, because the isolation is narrower than the\n * one that argument refuses. Only `KNOWN_CLAUDE_CODE_FIELDS` takes this door — the set that already\n * encodes \"this key belongs to another runtime and carries no behaviour here\". A misspelling of one\n * of OUR keys carries `subagent_unknown_field` and still propagates, so `sandboxx` remains fatal\n * and cannot return as a silent gate. `a-claude-code-field-names-itself.test.ts` pins both halves.\n *\n * What moved the decision was the cost, measured in a live TUI on 2026-09-15: one ported\n * `.claude/agents/*.md` carrying `memory:` stopped every sibling agent from loading and the turn\n * produced no answer at all — on an agent the task never used. Beside it, on the same prompt and\n * the same project, another runtime answered normally. The diagnosis fix this file shipped tells a\n * user which key is foreign; it does not give them back the turn.\n *\n * The loader already draws exactly this line for a file with no frontmatter, and for the same\n * stated reason: one of them must not stop every agent in the directory from loading.\n */\nfunction parseOrSkipForeignRuntime(\n  raw: string,\n  filename: string,\n): { name: string; definition: AgentDefinition } | null {\n  try {\n    return parseSubagentMarkdown(raw, filename);\n  } catch (error) {\n    if (error instanceof ConfigurationError && error.code === \"subagent_foreign_runtime_field\") {\n      diag(`[theokit-sdk] ${filename}: ${error.message} — skipping this agent`);\n      return null;\n    }\n    throw error;\n  }\n}\n\nasync function readSubagentsFrom(\n  root: string,\n  subagents: Record<string, AgentDefinition>,\n): Promise<void> {\n  const entries = await readWorkspaceDir(root, \"subagents_read_error\", \"subagents directory\");\n  for (const entry of entries) {\n    if (!entry.isFile() || !entry.name.endsWith(\".md\")) continue;\n    const path = join(root, entry.name);\n    const raw = await readFile(path, \"utf8\");\n    // A markdown file with NO frontmatter is not an agent declaration — a directory of agents\n    // written for the Claude Code CLI conventionally carries documentation beside them, and\n    // `.claude/agents/README.md` exists in this repository. Throwing on it made ONE such file stop\n    // every agent in the directory from loading.\n    //\n    // Skipped with a warn rather than in silence, and ONLY for the no-frontmatter case: a file that\n    // HAS frontmatter and gets it wrong is a broken agent and still fails loudly, which is what\n    // keeps a typo'd `sandbox` from returning as a silent gate through this door.\n    if (!hasFrontmatter(raw)) {\n      diag(`[theokit-sdk] ${entry.name} has no frontmatter — not an agent declaration, skipping`);\n      continue;\n    }\n    const definition = parseOrSkipForeignRuntime(raw, entry.name);\n    if (definition === null) continue;\n    if (subagents[definition.name] === undefined) {\n      // `path` is computed above to read the file and was then dropped. Keeping it is the whole\n      // visibility fix (#524): without it a listing cannot say which root an agent came from.\n      subagents[definition.name] = { ...definition.definition, source: path };\n    }\n  }\n}\n\n// The frontmatter keys a disk subagent may declare. Any other key is a typed load\n// error rather than a silent drop — a dropped `sandbox` an operator wrote believing\n// it confines the child is exactly the silent-gate failure class this guards against.\nconst ACCEPTED_FIELDS = new Set([\n  \"name\",\n  \"description\",\n  \"model\",\n  \"tools\",\n  \"reasoning_effort\",\n  \"mcp\",\n  \"sandbox\",\n  \"memory\",\n]);\n\n// Fields the Claude Code CLI writes that carry NO behaviour for this runtime. Accepted and ignored,\n// so an agent authored for the CLI loads here unchanged — measured 2026-08-26 across the 59 agent\n// files on one machine, where `color` appeared in 38 of them and made every one of those a\n// `subagent_unknown_field` load error.\n//\n// Named explicitly instead of loosening the check above, because that check's reason is sound: a\n// dropped `sandbox` an operator wrote believing it confines the child is a silent gate. A field that\n// COULD change behaviour must still fail loudly. This set is the difference between \"we know this\n// one and it does nothing\" and \"we have never heard of this\" — two facts a bare allow-everything\n// would collapse into one.\n//\n// Anything added here needs the same justification: inert for THIS runtime, not merely unfamiliar.\nconst INERT_CLAUDE_CODE_FIELDS = new Set([\n  /** The CLI's label colour for the agent. Presentation only. */\n  \"color\",\n]);\n\nfunction parseSubagentMarkdown(\n  raw: string,\n  filename: string,\n): { name: string; definition: AgentDefinition } {\n  const { frontmatter, body } = splitFrontmatter(raw, filename);\n  const fields = parseFrontmatterFields(frontmatter);\n  rejectUnknownFields(fields, filename);\n  rejectMcp(fields, filename);\n\n  const definition: AgentDefinition = {\n    description: asString(fields.description) ?? \"\",\n    prompt: body,\n  };\n  const model = resolveModel(fields, filename);\n  if (model !== undefined) definition.model = model;\n  const tools = toStringList(fields.tools);\n  if (tools.length > 0) definition.tools = tools;\n  const sandbox = resolveSandbox(fields, filename);\n  if (sandbox !== undefined) definition.sandbox = sandbox;\n  // Carried unjudged — see `AgentDefinition.memory`. Which root a scope names, and whether the\n  // name is one at all, is `@theokit/agents`' decision and refusing it twice means two lists.\n  const memory = asString(fields.memory);\n  if (memory !== undefined) definition.memory = memory;\n\n  const name = asString(fields.name) ?? filename.replace(/\\.md$/, \"\");\n  return { name, definition };\n}\n\n/**\n * Frontmatter keys that Claude Code documents for a subagent and this runtime does not accept.\n *\n * Not an allow-list — every one of these still fails the load. It exists so the FAILURE can say\n * which kind of unknown it met. A user migrating a `.claude/agents/` tree used to learn one key per\n * round trip: fix `memory`, meet `permissionMode`, fix that, meet `maxTurns` — with nothing saying\n * the set was finite or that the tree was simply written for another runtime.\n *\n * The distinction this file already draws for `INERT_CLAUDE_CODE_FIELDS` is the same one: \"the\n * difference between 'we know this one and it does nothing' and 'we have never heard of this' — two\n * facts a bare allow-everything would collapse into one.\" This is the third fact beside them —\n * \"another runtime's field\" — and it changes only the message, never the verdict.\n */\nconst KNOWN_CLAUDE_CODE_FIELDS = new Set([\n  \"disallowedTools\",\n  \"permissionMode\",\n  \"maxTurns\",\n  \"skills\",\n  \"background\",\n  \"effort\",\n  \"isolation\",\n  \"initialPrompt\",\n  \"hooks\",\n  \"experimental\",\n  \"mcpServers\",\n]);\n\n/**\n * The typed error for a key we do not accept. Built here rather than inline so `rejectUnknownFields`\n * stays a plain loop: the message has two shapes and the code has two values, and computing all four\n * at the throw site is what pushed that function past the cognitive-complexity gate.\n */\nfunction unknownFieldError(key: string, filename: string): ConfigurationError {\n  const foreign = KNOWN_CLAUDE_CODE_FIELDS.has(key);\n  const siblings = [...KNOWN_CLAUDE_CODE_FIELDS].filter((f) => f !== key);\n  const origin = foreign\n    ? ` — \"${key}\" is a Claude Code subagent field that this runtime does not support. ` +\n      `The same applies to: ${siblings.join(\", \")}. Removing them one at a time will meet each ` +\n      `in turn; the tree is written for another runtime`\n    : \"\";\n  // The two codes are written as LITERALS, one per branch, rather than as a ternary inside the\n  // options object. `tools/generate-error-codes.mjs` walks the source for the literal assigned to\n  // `code:`, so a ternary there is not a literal and it extracted NEITHER — measured 2026-09-15,\n  // when `quality:docs-errors` went red and the regenerated reference had lost\n  // `subagent_unknown_field` without ever gaining `subagent_foreign_runtime_field`. Two real,\n  // throwable codes were absent from the published error reference, which is the one place a\n  // consumer looks to find out what they can catch.\n  if (foreign)\n    return new ConfigurationError(\n      `Subagent ${filename}: unknown frontmatter field \"${key}\" (accepted: ${[...ACCEPTED_FIELDS].join(\", \")})${origin}`,\n      { code: \"subagent_foreign_runtime_field\" },\n    );\n  return new ConfigurationError(\n    `Subagent ${filename}: unknown frontmatter field \"${key}\" (accepted: ${[...ACCEPTED_FIELDS].join(\", \")})${origin}`,\n    { code: \"subagent_unknown_field\" },\n  );\n}\n\nfunction rejectUnknownFields(\n  fields: Record<string, FrontmatterValue | undefined>,\n  filename: string,\n): void {\n  for (const key of Object.keys(fields)) {\n    if (INERT_CLAUDE_CODE_FIELDS.has(key)) continue;\n    if (!ACCEPTED_FIELDS.has(key)) throw unknownFieldError(key, filename);\n  }\n}\n\n// mcp: a known field, but not yet honored on the LOCAL delegation path. The frontmatter YAML can only\n// express server NAMES (parseSimpleYaml has no nested-object support), while a child's `Agent.create`\n// needs `mcpServers` as a Record<name, config>; resolving names→config per-subagent in local delegation\n// is its own follow-up. Rather than silently drop it (the M26/M32 silent-gate class), it is a typed load\n// error that names the field and points at the alternative.\nfunction rejectMcp(fields: Record<string, FrontmatterValue | undefined>, filename: string): void {\n  if (fields.mcp !== undefined) {\n    throw new ConfigurationError(\n      `Subagent ${filename}: per-subagent \"mcp\" is not yet supported on the local delegation path; declare MCP servers in .theokit/mcp.json (or the parent) instead`,\n      { code: \"subagent_mcp_unsupported_local\" },\n    );\n  }\n}\n\n// model + reasoning_effort — effort rides inside `model.params[thinking]`, so it requires a concrete\n// model id to attach to (a child inheriting the parent's model cannot carry the parent's provider-\n// specific effort param safely).\nfunction resolveModel(\n  fields: Record<string, FrontmatterValue | undefined>,\n  filename: string,\n): ModelSelection | \"inherit\" | undefined {\n  const modelId = asString(fields.model);\n  const effort = asString(fields.reasoning_effort);\n  // reasoning_effort rides in model.params[thinking], so it needs a CONCRETE model id to attach to.\n  // Neither an absent model NOR `model: inherit` can carry it (the inherited id is unknown at load), so\n  // both are typed errors rather than a silently-dropped effort — the silent-gate class this guards.\n  if (effort !== undefined && (modelId === undefined || modelId === \"inherit\")) {\n    throw new ConfigurationError(\n      `Subagent ${filename}: reasoning_effort requires a concrete model (effort is a model parameter; an absent model or \"inherit\" cannot carry it)`,\n      { code: \"subagent_reasoning_effort_without_model\" },\n    );\n  }\n  if (modelId === undefined) return undefined;\n  if (modelId === \"inherit\") return \"inherit\";\n  return effort !== undefined\n    ? { id: modelId, params: [{ id: \"thinking\", value: effort }] }\n    : { id: modelId };\n}\n\n// sandbox: boolean only. A granular mode string (read-only/…) is unsupported by the SDK runtime and is\n// a typed error rather than a silent coercion to a boolean.\nfunction resolveSandbox(\n  fields: Record<string, FrontmatterValue | undefined>,\n  filename: string,\n): boolean | undefined {\n  if (fields.sandbox === undefined) return undefined;\n  if (typeof fields.sandbox !== \"boolean\") {\n    throw new ConfigurationError(\n      `Subagent ${filename}: sandbox must be a boolean (got \"${String(fields.sandbox)}\"); granular sandbox modes are not supported by the runtime`,\n      { code: \"subagent_sandbox_not_boolean\" },\n    );\n  }\n  return fields.sandbox;\n}\n\nfunction asString(v: FrontmatterValue | undefined): string | undefined {\n  if (typeof v !== \"string\") return undefined;\n  // parseSimpleYaml does not strip quotes (documented), and `model`/`reasoning_effort` are fields users\n  // habitually quote (`model: \"openai/gpt-4o\"`). Strip a single matching surrounding quote pair so a\n  // quoted id/effort does not slip past validation and fail only at the provider.\n  const m = /^([\"'])(.*)\\1$/.exec(v);\n  return m ? m[2] : v;\n}\n\n/** Accept a YAML list (`string[]`) or a comma/space-separated scalar; trim + drop empties. */\nfunction toStringList(v: FrontmatterValue | undefined): string[] {\n  if (Array.isArray(v)) return v.map((t) => t.trim()).filter((t) => t.length > 0);\n  if (typeof v === \"string\") {\n    return v\n      .split(/[\\s,]+/)\n      .map((t) => t.trim())\n      .filter((t) => t.length > 0);\n  }\n  return [];\n}\n\n/** Does this file open with a frontmatter block at all? Its ABSENCE means \"not an agent\". */\nfunction hasFrontmatter(raw: string): boolean {\n  return /^---\\s*\\n/.test(raw);\n}\n\nfunction splitFrontmatter(raw: string, filename: string): { frontmatter: string; body: string } {\n  const match = /^---\\s*\\n([\\s\\S]*?)\\n---\\s*\\n([\\s\\S]*)$/.exec(raw);\n  if (match === null) {\n    throw new ConfigurationError(`Subagent ${filename} is missing frontmatter`, {\n      code: \"subagent_missing_frontmatter\",\n    });\n  }\n  return { frontmatter: match[1] ?? \"\", body: (match[2] ?? \"\").trim() };\n}\n\nfunction parseFrontmatterFields(frontmatter: string): Record<string, FrontmatterValue | undefined> {\n  // Preserve the rich YAML value types (boolean/number/string[]): `sandbox: true` and\n  // `mcp: [a, b]` are meaningful here, so narrowing everything to string (as the\n  // pre-M33 loader did) would drop them. Per-field validation happens in parseSubagentMarkdown.\n  return parseSimpleYaml(frontmatter);\n}\n"]}

package/dist/{chunk-6LHQPOMI.cjs → chunk-RNXXYF22.cjs}

@@ -62,15 +62,74 @@ if (!REDACT_ENABLED && !warnedOptOut) {
   );
   warnedOptOut = true;
 }
+function isSegmentChar(code) {
+  return code >= 48 && code <= 57 || // 0-9
+  code >= 65 && code <= 90 || // A-Z
+  code >= 97 && code <= 122 || // a-z
+  code === 45 || // -
+  code === 95;
+}
+function runEnd(s, from) {
+  let i = from;
+  while (i < s.length && isSegmentChar(s.charCodeAt(i))) i++;
+  return i;
+}
+function jwtEndAfterFirstRun(s, r1) {
+  if (s[r1] !== "." || !s.startsWith("eyJ", r1 + 1)) return -1;
+  const r2 = runEnd(s, r1 + 4);
+  if (r2 - (r1 + 4) < 4 || s[r2] !== ".") return -1;
+  const r3 = runEnd(s, r2 + 1);
+  return r3 - (r2 + 1) < 4 ? -1 : r3;
+}
+function maskJwts(s) {
+  let out = "";
+  let copied = 0;
+  let start = s.indexOf("eyJ");
+  while (start >= 0) {
+    const r1 = runEnd(s, start + 3);
+    const end = r1 - (start + 3) >= 4 ? jwtEndAfterFirstRun(s, r1) : -1;
+    if (end < 0) {
+      start = s.indexOf("eyJ", r1 + 1);
+      continue;
+    }
+    out += s.slice(copied, start) + maskToken(s.slice(start, end));
+    copied = end;
+    start = s.indexOf("eyJ", end);
+  }
+  return copied === 0 ? s : out + s.slice(copied);
+}
+var PEM_LABEL = "(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)";
+var PEM_BEGIN = new RegExp(`-----BEGIN[ ]+${PEM_LABEL}PRIVATE KEY-----`, "g");
+var PEM_END = new RegExp(`-----END[ ]+${PEM_LABEL}PRIVATE KEY-----`, "g");
+function maskPemBlocks(s) {
+  let out = "";
+  let cursor = 0;
+  for (; ; ) {
+    PEM_BEGIN.lastIndex = cursor;
+    const begin = PEM_BEGIN.exec(s);
+    if (begin === null) break;
+    PEM_END.lastIndex = begin.index + begin[0].length + 1;
+    const end = PEM_END.exec(s);
+    if (end === null) break;
+    const blockEnd = end.index + end[0].length;
+    out += s.slice(cursor, begin.index) + maskToken(s.slice(begin.index, blockEnd));
+    cursor = blockEnd;
+  }
+  return out + s.slice(cursor);
+}
 var BUILTIN_PATTERNS = [
   // T5.4: 30+ vendor prefixes (was 12 pre-T5.4). Order matters — more
   // specific prefixes precede generic ones (e.g., sk-ant-admin01 before
   // sk-ant-, sk-proj- before sk-). PEM block deliberately first so its
-  // multi-line span runs before any per-line patterns can fire.
-  /-----BEGIN[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----[\s\S]+?-----END[ ]+(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----/g,
+  // multi-line span runs before any per-line patterns can fire. A scan
+  // rather than a regex: the regex was quadratic on many BEGIN headers with
+  // no END header (B-544).
+  maskPemBlocks,
   // JWT — exact 3-segment base64url. Dotted; the body floor of 4 chars per
   // segment matches the minimum legal payload while skipping `a.b.c` noise.
-  /eyJ[A-Za-z0-9_-]{4,}\.eyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g,
+  // A scan rather than a regex: the regex was quadratic on a long run of
+  // `eyJ` it could not complete (B-554).
+  maskJwts,
   // Azure Storage SAS — match the sig= component (URL-encoded base64).
   /(?<=[?&]sig=)[A-Za-z0-9%+/]{20,}/g,
   // Anthropic
@@ -164,8 +223,8 @@ function redactSecrets(text, opts) {
   if (coerced === null) return "";
   if (!REDACT_ENABLED) return coerced;
   let s = coerced;
-  for (const re of BUILTIN_PATTERNS) {
-    s = s.replace(re, (m) => maskToken(m));
+  for (const masker of BUILTIN_PATTERNS) {
+    s = typeof masker === "function" ? masker(s) : s.replace(masker, (m) => maskToken(m));
   }
   for (const re of _extraPatterns) {
     s = s.replace(re, (m) => maskToken(m));
@@ -189,5 +248,5 @@ exports.readEnv = readEnv;
 exports.redactSecrets = redactSecrets;
 exports.resolveApiKey = resolveApiKey;
 exports.setDiagnosticsSink = setDiagnosticsSink;
-//# sourceMappingURL=chunk-6LHQPOMI.cjs.map
-//# sourceMappingURL=chunk-6LHQPOMI.cjs.map
+//# sourceMappingURL=chunk-RNXXYF22.cjs.map
+//# sourceMappingURL=chunk-RNXXYF22.cjs.map

package/dist/chunk-RNXXYF22.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/env.ts","../src/internal/diagnostics.ts","../src/internal/security/redact.ts"],"names":[],"mappings":";;;AAKO,IAAM,eAAA,GAAkB;AAoBxB,SAAS,QAAQ,IAAA,EAAkC;AACxD,EAAA,OAAO,UAAA,CAAW,OAAA,EAAS,GAAA,GAAM,IAAI,CAAA;AACvC;AAYO,SAAS,cAAc,QAAA,EAAuC;AACnE,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AACjD,IAAA,OAAO,QAAA;AAAA,EACT;AACA,EAAA,MAAM,OAAA,GAAU,QAAQ,eAAe,CAAA;AACvC,EAAA,IAAI,OAAA,KAAY,MAAA,IAAa,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC/C,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,OAAO,MAAA;AACT;;;ACoBA,IAAM,SAAA,mBAAY,MAAA,CAAO,GAAA,CAAI,iCAAiC,CAAA;AAI9D,SAAS,WAAA,GAA2C;AAClD,EAAA,OAAQ,WAAqC,SAAS,CAAA;AACxD;AASO,SAAS,mBAAmB,IAAA,EAAyC;AAC1E,EAAC,UAAA,CAAqC,SAAS,CAAA,GAAI,IAAA;AACrD;AAQO,SAAS,KAAK,OAAA,EAAuB;AAG1C,EAAA,MAAM,OAAO,WAAA,EAAY;AACzB,EAAA,IAAI,SAAS,MAAA,EAAW;AACxB,EAAA,IAAI;AACF,IAAA,IAAA,CAAK,OAAO,CAAA;AAAA,EACd,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAqBO,SAAS,YAAY,OAAA,EAAuB;AACjD,EAAA,MAAM,OAAO,WAAA,EAAY;AACzB,EAAA,IAAI,SAAS,MAAA,EAAW;AACtB,IAAA,IAAI;AACF,MAAA,IAAA,CAAK,OAAO,CAAA;AACZ,MAAA;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,IAAI;AAKF,IAAA,UAAA,CAAW,OAAA,EAAS,MAAA,EAAQ,KAAA,CAAM,CAAA,EAAG,OAAO;AAAA,CAAI,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;;;ACtHA,IAAI,iBAA0B,WAAA,EAAY;AAE1C,SAAS,WAAA,GAAuB;AAG9B,EAAA,MAAM,GAAA,GAAM,QAAQ,wBAAwB,CAAA;AAC5C,EAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,IAAA;AAC9B,EAAA,OAAO,CAAC,KAAK,MAAA,EAAQ,KAAA,EAAO,IAAI,CAAA,CAAE,QAAA,CAAS,GAAA,CAAI,WAAA,EAAa,CAAA;AAC9D;AAGA,IAAI,YAAA,GAAe,KAAA;AACnB,IAAI,CAAC,cAAA,IAAkB,CAAC,YAAA,EAAc;AACpC,EAAA,IAAA;AAAA,IACE;AAAA,GAEF;AACA,EAAA,YAAA,GAAe,IAAA;AACjB;AASA,SAAS,cAAc,IAAA,EAAuB;AAC5C,EAAA,OACG,IAAA,IAAQ,MAAM,IAAA,IAAQ,EAAA;AAAA,EACtB,IAAA,IAAQ,MAAM,IAAA,IAAQ,EAAA;AAAA,EACtB,IAAA,IAAQ,MAAM,IAAA,IAAQ,GAAA;AAAA,EACvB,IAAA,KAAS,EAAA;AAAA,EACT,IAAA,KAAS,EAAA;AAEb;AAGA,SAAS,MAAA,CAAO,GAAW,IAAA,EAAsB;AAC/C,EAAA,IAAI,CAAA,GAAI,IAAA;AACR,EAAA,OAAO,CAAA,GAAI,EAAE,MAAA,IAAU,aAAA,CAAc,EAAE,UAAA,CAAW,CAAC,CAAC,CAAA,EAAG,CAAA,EAAA;AACvD,EAAA,OAAO,CAAA;AACT;AAMA,SAAS,mBAAA,CAAoB,GAAW,EAAA,EAAoB;AAC1D,EAAA,IAAI,CAAA,CAAE,EAAE,CAAA,KAAM,GAAA,IAAO,CAAC,CAAA,CAAE,UAAA,CAAW,KAAA,EAAO,EAAA,GAAK,CAAC,CAAA,EAAG,OAAO,EAAA;AAC1D,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,CAAA,EAAG,EAAA,GAAK,CAAC,CAAA;AAC3B,EAAA,IAAI,EAAA,IAAM,KAAK,CAAA,CAAA,GAAK,CAAA,IAAK,EAAE,EAAE,CAAA,KAAM,KAAK,OAAO,EAAA;AAC/C,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,CAAA,EAAG,EAAA,GAAK,CAAC,CAAA;AAC3B,EAAA,OAAO,EAAA,IAAM,EAAA,GAAK,CAAA,CAAA,GAAK,CAAA,GAAI,EAAA,GAAK,EAAA;AAClC;AAcA,SAAS,SAAS,CAAA,EAAmB;AACnC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAI,KAAA,GAAQ,CAAA,CAAE,OAAA,CAAQ,KAAK,CAAA;AAC3B,EAAA,OAAO,SAAS,CAAA,EAAG;AACjB,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,CAAA,EAAG,KAAA,GAAQ,CAAC,CAAA;AAC9B,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,GAAQ,CAAA,CAAA,IAAM,IAAI,mBAAA,CAAoB,CAAA,EAAG,EAAE,CAAA,GAAI,EAAA;AACjE,IAAA,IAAI,MAAM,CAAA,EAAG;AACX,MAAA,KAAA,GAAQ,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,EAAA,GAAK,CAAC,CAAA;AAC/B,MAAA;AAAA,IACF;AACA,IAAA,GAAA,IAAO,CAAA,CAAE,KAAA,CAAM,MAAA,EAAQ,KAAK,CAAA,GAAI,UAAU,CAAA,CAAE,KAAA,CAAM,KAAA,EAAO,GAAG,CAAC,CAAA;AAC7D,IAAA,MAAA,GAAS,GAAA;AACT,IAAA,KAAA,GAAQ,CAAA,CAAE,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AAAA,EAC9B;AACA,EAAA,OAAO,WAAW,CAAA,GAAI,CAAA,GAAI,GAAA,GAAM,CAAA,CAAE,MAAM,MAAM,CAAA;AAChD;AAEA,IAAM,SAAA,GAAY,wCAAA;AAClB,IAAM,YAAY,IAAI,MAAA,CAAO,CAAA,cAAA,EAAiB,SAAS,oBAAoB,GAAG,CAAA;AAC9E,IAAM,UAAU,IAAI,MAAA,CAAO,CAAA,YAAA,EAAe,SAAS,oBAAoB,GAAG,CAAA;AAc1E,SAAS,cAAc,CAAA,EAAmB;AACxC,EAAA,IAAI,GAAA,GAAM,EAAA;AACV,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,WAAS;AACP,IAAA,SAAA,CAAU,SAAA,GAAY,MAAA;AACtB,IAAA,MAAM,KAAA,GAAQ,SAAA,CAAU,IAAA,CAAK,CAAC,CAAA;AAC9B,IAAA,IAAI,UAAU,IAAA,EAAM;AACpB,IAAA,OAAA,CAAQ,YAAY,KAAA,CAAM,KAAA,GAAQ,KAAA,CAAM,CAAC,EAAE,MAAA,GAAS,CAAA;AACpD,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA;AAC1B,IAAA,IAAI,QAAQ,IAAA,EAAM;AAClB,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,KAAA,GAAQ,GAAA,CAAI,CAAC,CAAA,CAAE,MAAA;AACpC,IAAA,GAAA,IAAO,CAAA,CAAE,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,KAAK,CAAA,GAAI,SAAA,CAAU,CAAA,CAAE,KAAA,CAAM,KAAA,CAAM,KAAA,EAAO,QAAQ,CAAC,CAAA;AAC9E,IAAA,MAAA,GAAS,QAAA;AAAA,EACX;AACA,EAAA,OAAO,GAAA,GAAM,CAAA,CAAE,KAAA,CAAM,MAAM,CAAA;AAC7B;AAWA,IAAM,gBAAA,GAA6C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjD,aAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,QAAA;AAAA;AAAA,EAEA,mCAAA;AAAA;AAAA,EAEA,oCAAA;AAAA;AAAA,EACA,4BAAA;AAAA;AAAA;AAAA,EAEA,6BAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA;AAAA,EAEA,wBAAA;AAAA;AAAA,EACA,mBAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,8BAAA;AAAA;AAAA,EACA,uBAAA;AAAA;AAAA,EACA,sBAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,2BAAA;AAAA;AAAA,EACA,2BAAA;AAAA;AAAA,EACA,0BAAA;AAAA;AAAA,EACA,yBAAA;AAAA;AAAA,EACA,+BAAA;AAAA;AAAA;AAAA,EAEA,sBAAA;AAAA;AAAA,EACA,2CAAA;AAAA;AAAA,EACA,wBAAA;AAAA;AAAA,EACA,uBAAA;AAAA;AAAA,EACA,2DAAA;AAAA;AAAA,EACA;AAAA;AACF,CAAA;AAKA,IAAM,cAAA,GAAiB,wCAAA;AAoBvB,IAAM,aAAA,GACJ,4NAAA;AAEF,IAAM,iBAA2B,EAAC;AA0B3B,SAAS,WAAW,EAAA,EAAkB;AAC3C,EAAA,IAAI,CAAC,GAAG,MAAA,EAAQ;AASd,IAAA,MAAM,IAAI,MAAM,+DAA+D,CAAA;AAAA,EACjF;AACA,EAAA,cAAA,CAAe,KAAK,EAAE,CAAA;AACxB;AA4BO,SAAS,UAAU,KAAA,EAAuB;AAC/C,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,EAAA,EAAI,OAAO,KAAA;AAC9B,EAAA,OAAO,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,EAAM,KAAA,CAAM,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAClD;AAKA,IAAM,UAAA,GAAa,mBAAA;AAMnB,SAAS,eAAe,KAAA,EAA+B;AACrD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,KAAA;AACtC,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AAClD,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA;AAC9B,MAAA,OAAO,CAAA,KAAM,SAAY,IAAA,GAAO,CAAA;AAAA,IAClC,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,0BAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,OAAO,KAAK,CAAA;AACrB;AAqBO,SAAS,aAAA,CAAc,MAAe,IAAA,EAAuC;AAClF,EAAA,MAAM,OAAA,GAAU,eAAe,IAAI,CAAA;AACnC,EAAA,IAAI,OAAA,KAAY,MAAM,OAAO,EAAA;AAC7B,EAAA,IAAI,CAAC,gBAAgB,OAAO,OAAA;AAE5B,EAAA,IAAI,CAAA,GAAI,OAAA;AACR,EAAA,KAAA,MAAW,UAAU,gBAAA,EAAkB;AACrC,IAAA,CAAA,GAAI,OAAO,MAAA,KAAW,UAAA,GAAa,MAAA,CAAO,CAAC,CAAA,GAAI,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA,KAAM,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,EACtF;AACA,EAAA,KAAA,MAAW,MAAM,cAAA,EAAgB;AAC/B,IAAA,CAAA,GAAI,EAAE,OAAA,CAAQ,EAAA,EAAI,CAAC,CAAA,KAAM,SAAA,CAAU,CAAC,CAAC,CAAA;AAAA,EACvC;AACA,EAAA,IAAI,CAAC,MAAM,QAAA,EAAU;AAInB,IAAA,CAAA,GAAI,CAAA,CAAE,QAAQ,cAAA,EAAgB,CAAC,GAAG,MAAA,KAAmB,CAAA,EAAG,MAAM,CAAA,GAAA,CAAK,CAAA;AAInE,IAAA,CAAA,GAAI,EAAE,OAAA,CAAQ,aAAA,EAAe,CAAC,KAAA,EAAO,QAAgB,KAAA,KAAkB;AAOrE,MAAA,IAAI,UAAA,CAAW,IAAA,CAAK,KAAK,CAAA,EAAG,OAAO,KAAA;AACnC,MAAA,OAAO,GAAG,MAAM,CAAA,GAAA,CAAA;AAAA,IAClB,CAAC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,CAAA;AACT","file":"chunk-RNXXYF22.cjs","sourcesContent":["/**\n * Environment variable used to provide the default API key.\n *\n * @internal\n */\nexport const API_KEY_ENV_VAR = \"THEOKIT_API_KEY\";\n\n/**\n * Read an environment variable without assuming `process` exists.\n *\n * Parts of this package legitimately reach a browser: `errors.ts` is imported by the client\n * bindings that framework consumers ship to the front end, and it in turn pulls in the redaction\n * and retry modules. `process` is a Node global — a bare `process.env` in any of them throws\n * `ReferenceError: process is not defined` while the module graph is still evaluating, before a\n * single component renders. The page goes blank with one console error that names no cause.\n *\n * `globalThis.process?.env?.[name]` degrades instead: on the server it reads the variable, and in\n * a browser it yields `undefined`, which every caller here already treats as \"not set\". Bundlers\n * that inline `process.env.X` at build time keep working, because they replace the expression\n * before it ever runs.\n *\n * This is the same pattern the sibling design system uses for `NODE_ENV`, for the same reason.\n *\n * @internal\n */\nexport function readEnv(name: string): string | undefined {\n  return globalThis.process?.env?.[name];\n}\n\n/**\n * Resolve the API key with the documented precedence:\n *\n *   1. Explicit `apiKey` argument.\n *   2. The `THEOKIT_API_KEY` environment variable.\n *\n * Returns `undefined` when neither is set.\n *\n * @internal\n */\nexport function resolveApiKey(explicit?: string): string | undefined {\n  if (explicit !== undefined && explicit.length > 0) {\n    return explicit;\n  }\n  const fromEnv = readEnv(API_KEY_ENV_VAR);\n  if (fromEnv !== undefined && fromEnv.length > 0) {\n    return fromEnv;\n  }\n  return undefined;\n}\n","/**\n * The library's single diagnostics channel — silent by default (#147).\n *\n * ## The problem\n *\n * The SDK wrote diagnostics straight to `process.stderr` from hot paths — 92 sites across 51\n * files under `internal/`. In a TUI host (Ink, alternate screen), those writes interleave with the\n * render and **corrupt the frame**. And the host had no way to intercept them: there was no\n * injectable logger. One consumer went as far as installing `proper-lockfile` just to silence ONE\n * of them.\n *\n * A library cannot assume `stdout`/`stderr` are free sinks. The application owns the terminal, not\n * the dependency.\n *\n * ## The contract\n *\n * - **`setDiagnosticsSink(fn)`** hands the messages to the application, which decides where to put\n *   them (a status line, a file, a panel). It is what was missing for a TUI to coexist with the SDK.\n * - **With no sink, nothing is emitted.** A library does not own the host's terminal.\n *\n * ## Silent by default, and how 36 suites survived the flip\n *\n * The default WAS `stderr`, and 36 test files spy on `process.stderr.write` to assert a given\n * warning is emitted. That contract is real and had to survive; migrating all 36 by hand, across\n * four different spy styles, is how you weaken 36 suites in one commit.\n *\n * So the flip happened at the default, and `vitest.setup.ts` installs a sink that FORWARDS to\n * `stderr` for the duration of every test. Those assertions still test what they always tested —\n * \"this condition emits a diagnostic\" — through the channel a host would use, while production\n * emits nothing unless asked.\n *\n * The cost is stated rather than hidden: no test observes the production default by accident, so\n * `tests/diagnostics-public-entry.test.ts` pins it explicitly by clearing the sink first.\n *\n * ## Coverage is the whole guarantee\n *\n * The first sweep migrated the 92 sites under `internal/` and left `src/`'s own modules —\n * `event-bus.ts`, `batch.ts`, `compaction.ts`, `internal/workflow/step-branch.ts`. A host could\n * therefore install a sink and still have its frame corrupted by a batch run, which is the reported\n * defect with a smaller blast radius. Those are routed here too, and\n * `tests/lint/no-direct-terminal-write.test.ts` is what keeps the next hot path from\n * reintroducing one. \"Mostly interceptable\" is not interceptable.\n *\n * The remaining direct writers are allowlisted there with a reason, and every one of them is a seam\n * whose destination the CALLER already chooses (`opts.warn`, `opts.logger`, the Workflow logger).\n *\n * ## What this is NOT\n *\n * It is not a logger with levels, formatting or multiple destinations. It is the minimum that\n * resolves the reported blocker; a full logger here would be inventing a requirement nobody asked\n * for.\n */\n\n/** Receives each diagnostic message already formatted, with the trailing `\\n`. */\nexport type DiagnosticsSink = (message: string) => void;\n\n/**\n * The registry lives on `globalThis`, not in a module-level `let` (theokit#173).\n *\n * A module-level binding is a per-INSTANCE singleton, and a package manager will install two\n * physical copies of the same version whenever two dependents resolve different peer sets. Measured:\n * `@theokit/sdk@4.39.1` existed under two pnpm store hashes in the theokit workspace, so a sink\n * installed through `@theokit/agents` landed in a different registry than the emitter writes to.\n *\n * The failure mode is the quiet one — the re-export resolves, the function is callable, nothing\n * throws, and no diagnostic ever arrives. `Symbol.for` gives every copy in the process the same\n * slot; the `v1` suffix leaves room to change the shape without colliding with an older copy.\n */\nconst SINK_SLOT = Symbol.for(\"theokit.sdk.diagnostics.sink.v1\");\n\ntype SinkHolder = Record<symbol, DiagnosticsSink | undefined>;\n\nfunction currentSink(): DiagnosticsSink | undefined {\n  return (globalThis as unknown as SinkHolder)[SINK_SLOT];\n}\n\n/**\n * Installs (or removes, by passing `undefined`) the diagnostics destination.\n *\n * When a sink is present it is the ONLY destination — `stderr` gets no copy. Duplicating\n * destinations would hand the problem back to the TUI that installed the sink precisely to get the\n * messages out of the terminal.\n */\nexport function setDiagnosticsSink(next: DiagnosticsSink | undefined): void {\n  (globalThis as unknown as SinkHolder)[SINK_SLOT] = next;\n}\n\n/**\n * Emits a library diagnostic message.\n *\n * Replaces `process.stderr.write` on internal paths. Never throws: a faulty sink must not\n * must not take down the run it merely observes.\n */\nexport function diag(message: string): void {\n  // Silent by default (#147): with no sink installed the message is dropped. A library must not\n  // assume the host's stdout/stderr are free-form log sinks — in a TUI they are the render surface.\n  const sink = currentSink();\n  if (sink === undefined) return;\n  try {\n    sink(message);\n  } catch {\n    // Observability never breaks the run — same principle as `emitRunEvent`.\n  }\n}\n\n/**\n * Emits a diagnostic that reports a USER-VISIBLE FAILURE, and is never silently dropped.\n *\n * `diag` is silent with no sink installed, and that is right for chatter: a library must not assume\n * the host's stderr is a free-form log, because in a TUI it is the render surface. A failure is a\n * different message. `theokit-sdk#189` is the record of the difference — an MCP server failed to\n * start, the only report went to `diag()`, the embedding UI never read it, and the user saw an\n * agent with missing tools and no reason given.\n *\n * The two failure modes are not symmetric, which is the whole decision: a corrupted frame is\n * visible and recoverable, while a silently dropped failure is neither. So this falls back to\n * stderr rather than to silence.\n *\n * A sink still takes precedence — the host installed it precisely to keep these off the terminal —\n * EXCEPT when the sink throws. A broken sink swallowing the one report of a failure is the same\n * defect one layer further in.\n *\n * @internal\n */\nexport function diagFailure(message: string): void {\n  const sink = currentSink();\n  if (sink !== undefined) {\n    try {\n      sink(message);\n      return;\n    } catch {\n      // Fall through: the sink is broken, and this message is too important to drop with it.\n    }\n  }\n  try {\n    // `globalThis.process?.stderr` rather than a bare `process`: in a browser the bare form is a\n    // ReferenceError that the catch below would swallow — working by accident, on an exception used\n    // as ordinary control flow. Optional chaining states the intent: write to stderr where one\n    // exists, stay silent where none does.\n    globalThis.process?.stderr?.write(`${message}\\n`);\n  } catch {\n    // Nothing left to try. Observability never breaks the run.\n  }\n}\n","import { diag } from \"../diagnostics.js\";\nimport { readEnv } from \"../env.js\";\n\n/**\n * Canonical secret redaction module (ADRs D68-D73).\n *\n * Single source of truth for credential pattern masking across the SDK.\n * Wired at output boundaries: `ErrorMetadata.raw` (mappers/shared.ts),\n * telemetry span attributes (telemetry/tracer.ts), transcript JSONL\n * appends (agent-session-store.ts), migration logger output\n * (memory/migrate-sqlite-to-lance.ts).\n *\n * - D68: central module, single source of truth (replaces 2 duplicates)\n * - D69: env snapshot at module init (prompt-injection defense)\n * - D70: ON by default, warn on opt-out\n * - D71: two-bucket masking — short fully masked, long preserves prefix+suffix\n * - D72: `codeFile` opt-out for legitimate prefix-shaped content\n * - D73: redact at OUTPUT boundaries, not at storage\n *\n * @internal\n */\n\n// D69: env snapshot captured at module load. Subsequent mutations of\n// process.env.THEOKIT_REDACT_SECRETS are ignored — defends against\n// prompt injection that tries to disable redaction mid-run.\nlet REDACT_ENABLED: boolean = readEnvOnce();\n\nfunction readEnvOnce(): boolean {\n  // `readEnv` rather than `process.env`: this module reaches the browser through `errors.ts`, and\n  // a bare `process` there is a ReferenceError at module scope — a blank page, not a warning.\n  const raw = readEnv(\"THEOKIT_REDACT_SECRETS\");\n  if (raw === undefined) return true; // D70: default ON\n  return [\"1\", \"true\", \"yes\", \"on\"].includes(raw.toLowerCase());\n}\n\n// D70: warn once on opt-out so the user knows they're vulnerable.\nlet warnedOptOut = false;\nif (!REDACT_ENABLED && !warnedOptOut) {\n  diag(\n    \"[theokit-sdk] Secret redaction is DISABLED via THEOKIT_REDACT_SECRETS. \" +\n      \"Credentials may leak into errors, telemetry, logs, transcripts.\\n\",\n  );\n  warnedOptOut = true;\n}\n\n/**\n * One built-in masker: a global regex whose every match `redactSecrets` replaces with `maskToken`\n * of it, or a function that does its own masking in one pass over the string.\n */\ntype BuiltinMasker = RegExp | ((s: string) => string);\n\n/** True for a character of a JWT segment, `[A-Za-z0-9_-]`. */\nfunction isSegmentChar(code: number): boolean {\n  return (\n    (code >= 48 && code <= 57) || // 0-9\n    (code >= 65 && code <= 90) || // A-Z\n    (code >= 97 && code <= 122) || // a-z\n    code === 45 || // -\n    code === 95 // _\n  );\n}\n\n/** Index of the first character at or after `from` that is not a JWT segment character. */\nfunction runEnd(s: string, from: number): number {\n  let i = from;\n  while (i < s.length && isSegmentChar(s.charCodeAt(i))) i++;\n  return i;\n}\n\n/**\n * End of the JWT whose first segment is the run ending at `r1`, or -1 when none completes there:\n * `.`, `eyJ` and 4 or more segment characters running to a `.`, then a third run of 4 or more.\n */\nfunction jwtEndAfterFirstRun(s: string, r1: number): number {\n  if (s[r1] !== \".\" || !s.startsWith(\"eyJ\", r1 + 1)) return -1;\n  const r2 = runEnd(s, r1 + 4);\n  if (r2 - (r1 + 4) < 4 || s[r2] !== \".\") return -1;\n  const r3 = runEnd(s, r2 + 1);\n  return r3 - (r2 + 1) < 4 ? -1 : r3;\n}\n\n/**\n * Masks every three-segment JWT the regex `eyJ[A-Za-z0-9_-]{4,}\\.eyJ[A-Za-z0-9_-]{4,}\\.[A-Za-z0-9_-]{4,}`\n * masks, with the same output, in time linear in the length of `s`.\n *\n * The regex retried from every `eyJ` of a run it could not complete, giving the run back one\n * character at a time, which took minutes on a few hundred thousand characters of `eyJa`. Every\n * `eyJ` in one run ends its first segment at the same character, with fewer characters than the\n * first `eyJ` has, and what must follow that character is the same for all of them. So when the\n * first `eyJ` of a run fails, every later one in that run fails too: the scan tries only the\n * first, then resumes after the run. Each run is read at most three times, as the first, second\n * and third segment.\n */\nfunction maskJwts(s: string): string {\n  let out = \"\";\n  let copied = 0;\n  let start = s.indexOf(\"eyJ\");\n  while (start >= 0) {\n    const r1 = runEnd(s, start + 3);\n    const end = r1 - (start + 3) >= 4 ? jwtEndAfterFirstRun(s, r1) : -1;\n    if (end < 0) {\n      start = s.indexOf(\"eyJ\", r1 + 1);\n      continue;\n    }\n    out += s.slice(copied, start) + maskToken(s.slice(start, end));\n    copied = end;\n    start = s.indexOf(\"eyJ\", end);\n  }\n  return copied === 0 ? s : out + s.slice(copied);\n}\n\nconst PEM_LABEL = \"(?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)\";\nconst PEM_BEGIN = new RegExp(`-----BEGIN[ ]+${PEM_LABEL}PRIVATE KEY-----`, \"g\");\nconst PEM_END = new RegExp(`-----END[ ]+${PEM_LABEL}PRIVATE KEY-----`, \"g\");\n\n/**\n * Mask each PEM private key block: a BEGIN header, then the first END header that starts at least\n * one character after it, any label on either side. Masks the same spans the lazy regex\n * `BEGIN[\\s\\S]+?END` did, in linear time.\n *\n * The regex retried its span at every BEGIN header, and each retry walked to the end of the string\n * when no END header followed, so many unmatched headers cost the square of the length (seconds on\n * a few hundred KB). Here a failed END search ends the scan: if no END header starts after one\n * BEGIN, none starts after a later one, so the rest of the string is left as it is, exactly as the\n * regex left it. Each search starts where the previous one ended, so every character is read a\n * bounded number of times.\n */\nfunction maskPemBlocks(s: string): string {\n  let out = \"\";\n  let cursor = 0;\n  for (;;) {\n    PEM_BEGIN.lastIndex = cursor;\n    const begin = PEM_BEGIN.exec(s);\n    if (begin === null) break;\n    PEM_END.lastIndex = begin.index + begin[0].length + 1;\n    const end = PEM_END.exec(s);\n    if (end === null) break;\n    const blockEnd = end.index + end[0].length;\n    out += s.slice(cursor, begin.index) + maskToken(s.slice(begin.index, blockEnd));\n    cursor = blockEnd;\n  }\n  return out + s.slice(cursor);\n}\n\n/**\n * Built-in credential maskers. Order matters — more specific prefixes\n * must come before generic ones (e.g., `sk-ant-` before `sk-`). The JWT\n * and PEM shapes are the `maskJwts` and `maskPemBlocks` scans rather than\n * regexes, because each regex was quadratic on input it could not complete\n * (a long run of `eyJ`, many BEGIN headers with no END header).\n *\n * @internal\n */\nconst BUILTIN_PATTERNS: readonly BuiltinMasker[] = [\n  // T5.4: 30+ vendor prefixes (was 12 pre-T5.4). Order matters — more\n  // specific prefixes precede generic ones (e.g., sk-ant-admin01 before\n  // sk-ant-, sk-proj- before sk-). PEM block deliberately first so its\n  // multi-line span runs before any per-line patterns can fire. A scan\n  // rather than a regex: the regex was quadratic on many BEGIN headers with\n  // no END header (B-544).\n  maskPemBlocks,\n  // JWT — exact 3-segment base64url. Dotted; the body floor of 4 chars per\n  // segment matches the minimum legal payload while skipping `a.b.c` noise.\n  // A scan rather than a regex: the regex was quadratic on a long run of\n  // `eyJ` it could not complete (B-554).\n  maskJwts,\n  // Azure Storage SAS — match the sig= component (URL-encoded base64).\n  /(?<=[?&]sig=)[A-Za-z0-9%+/]{20,}/g,\n  // Anthropic\n  /sk-ant-admin01-[A-Za-z0-9_-]{10,}/g, //   Anthropic admin keys (must precede sk-ant-)\n  /sk-ant-[A-Za-z0-9_-]{10,}/g, //           Anthropic regular\n  // OpenAI family + clones (sk- generic must come AFTER all sk-foo- variants)\n  /sk-proj-[A-Za-z0-9_-]{10,}/g, //  OpenAI project key (must precede sk- generic)\n  /sk-[A-Za-z0-9_-]{10,}/g, //       OpenAI / OpenRouter / DeepInfra / Together / DeepSeek\n  // Provider prefixes (alphabetized for maintainability)\n  /AIza[A-Za-z0-9_-]{35}/g, //       Google API key\n  /AKIA[A-Z0-9]{16}/g, //            AWS access key\n  /fw_[A-Za-z0-9]{20,}/g, //         Fireworks\n  /glpat-[A-Za-z0-9_-]{20}/g, //     GitLab PAT\n  /ghp_[A-Za-z0-9]{36}/g, //         GitHub PAT classic\n  /github_pat_[A-Za-z0-9_]{82}/g, // GitHub PAT fine-grained\n  /gsk_[A-Za-z0-9]{20,}/g, //        Groq\n  /hf_[A-Za-z0-9]{20,}/g, //         HuggingFace\n  /\\bpa-[A-Za-z0-9_-]{20,}/g, //     Voyage AI (word-boundary to skip CSS / kebab IDs)\n  /pcsk_[A-Za-z0-9_-]{20,}/g, //     Pinecone\n  /pplx-[A-Za-z0-9_-]{20,}/g, //     Perplexity\n  /r8_[A-Za-z0-9_-]{20,}/g, //       Replicate\n  /rk_live_[A-Za-z0-9]{20,}/g, //    Stripe restricted\n  /sk_live_[A-Za-z0-9]{20,}/g, //    Stripe secret\n  /sntrys_[A-Za-z0-9]{40,}/g, //     Sentry user auth\n  /xai-[A-Za-z0-9_-]{20,}/g, //      xAI (Grok)\n  /xox[bpasr]-[A-Za-z0-9-]{10,}/g, //Slack tokens\n  // Additional unique-prefix tokens with low false-positive risk\n  /npm_[A-Za-z0-9]{36}/g, //         npm access token\n  /SG\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]{43}/g, // SendGrid\n  /\\bSK[A-Za-z0-9]{32}\\b/g, //       Twilio API SID (word-boundary to skip CSS class noise)\n  /\\bkey-[a-f0-9]{32}\\b/g, //        Mailgun (hex-only narrows false positives)\n  /MT[A-Za-z0-9_-]{23}\\.[A-Za-z0-9_-]{6}\\.[A-Za-z0-9_-]{27}/g, // Discord bot\n  /\\b(?:sdk|mob)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\\b/g, // LaunchDarkly\n];\n\n// `Bearer <token>` matched as its own first-class pattern so PARAM_PATTERN\n// doesn't have to handle the unusual `Authorization: Bearer xxx` shape\n// (no `:` or `=` between \"Bearer\" and the value — bare whitespace).\nconst BEARER_PATTERN = /\\b(Bearer\\s+)([A-Za-z0-9_\\-.+/=]{8,})/g;\n\n// Parametric: matches `key=value` and `key: value` (with optional quote\n// between the key and the separator, to handle JSON: `\"api_key\": \"...\"`)\n// in URLs, query strings, JSON-like bodies, HTTP headers. Captures the\n// prefix so we keep it visible while masking the value.\n//\n// `authorization` deliberately excluded — BEARER_PATTERN handles the\n// common `Authorization: Bearer xxx` shape. Including it here causes\n// double-masking (\"Authorization: *** ***\") after Bearer fires.\n// T5.4: keyword set expanded from 6 → 16 to cover the OAuth / JWT / generic\n// credential vocabulary surfaced by DR6 finding #4. `authorization`,\n// `auth`, `bearer` stay excluded — BEARER_PATTERN handles the\n// `Authorization: Bearer xxx` shape and including these here would\n// re-catch the post-BUILTIN-masked form (D71 prefix-preservation\n// contract) and double-mask to `***`.\n//\n// Value class includes `.` so JWT / `.env` / dotted base64url values\n// match; the callback skips already-masked values (containing the\n// `...` D71 separator) to preserve the BUILTIN prefix-mask result.\nconst PARAM_PATTERN =\n  /(\\b(?:access_token|api_key|api-key|client_secret|credential|credentials|id_token|jwt|password|private_key|refresh_token|secret|service_account|session_token|token|x-api-key)\\b[\"']?\\s*[:=]\\s*[\"']?)([A-Za-z0-9_\\-.+/]+)/gi;\n\nconst _extraPatterns: RegExp[] = [];\n\n/**\n * Register an extra pattern for `redactSecrets` to mask, on top of the built-in vendor set.\n *\n * Additive and irreversible for the life of the process: patterns accumulate in module scope,\n * builtins are never replaced or reordered, and there is no way to remove one. Registering the\n * same regex twice registers it twice.\n *\n * Throws immediately when the regex has no `/g` flag. That is not pedantry — `String.replace`\n * with a non-global regex substitutes only the FIRST match, so a pattern registered without it\n * would mask the first credential in a payload and let every later one through, which reads as\n * working.\n *\n * Extras run after the builtins and before the parametric `key=value` sweep, and each whole match\n * is replaced by `maskToken` of that match. Anchor and bound the pattern with care: a regex that\n * matches more than the secret masks more than the secret, and one that backtracks badly runs on\n * every string crossing an output boundary.\n *\n * Registering a pattern does not enable redaction. When `THEOKIT_REDACT_SECRETS` was off at\n * module load, `redactSecrets` returns its input untouched and extras never run.\n *\n * Also exposed publicly, and under semver, as `Security.addPattern` in `src/security.ts`; the\n * direct export here additionally reaches the semver-exempt `@theokit/sdk/internal/security`\n * sub-path.\n */\nexport function addPattern(re: RegExp): void {\n  if (!re.global) {\n    // A BARE Error here, deliberately, and this is the one place in the package where that is the\n    // right answer. `errors.ts` imports `redactSecrets` from this module for the anti-leak invariant\n    // on `providerError`, so this module must stay below it — importing ConfigurationError closes a\n    // cycle (measured: `madge --circular` reports `errors.ts > internal/security/redact.ts`).\n    //\n    // The typed error lives at the surface a consumer touches: `Security.addPattern` in\n    // `src/security.ts` validates first and throws ConfigurationError with a code. This throw is the\n    // backstop for the semver-exempt `@theokit/sdk/internal/security` sub-path.\n    throw new Error(\"addPattern: regex must have /g flag for replace-all semantics\");\n  }\n  _extraPatterns.push(re);\n}\n\n/**\n * Mask one string, keeping enough of it to be recognizable in a log.\n *\n * Under 18 characters the whole string becomes the literal `***`; the length is not preserved and\n * nothing of the input survives. From 18 characters up, the result is the first 6 characters, the\n * literal `...`, and the last 4 — so exactly 10 characters of the input are RETAINED IN CLEAR and\n * the middle is dropped. That is the trade the threshold encodes: short strings could be brute\n * forced from a partial, long ones cannot, and the surviving prefix is usually the vendor tag\n * (`sk-ant`, `ghp_de`) that tells an operator which credential misbehaved.\n *\n * Be clear about what this is and is not. It is a readability aid for logs, not an anonymizer and\n * not a security boundary. The retained prefix and suffix identify the credential's issuer and\n * often the credential itself to anyone who has seen it before, so a masked value still belongs in\n * a trusted log and not in a bug report or a support ticket.\n *\n * It masks whatever it is handed. There is no check that the argument is a secret, so calling it\n * on ordinary text mangles the text, and calling it on something the caller merely hopes is a\n * secret proves nothing about what leaked.\n *\n * `redactSecrets` applies it to the ENTIRE match of a pattern, not to a captured group. For a\n * match like `Bearer sk-ant-...` the first 6 characters retained are `Bearer`, not the key's\n * prefix.\n *\n * Semver-exempt: reachable via the `@theokit/sdk/internal/security` sub-path, which the package\n * declares in `exports` but does NOT cover with its semver contract.\n */\nexport function maskToken(token: string): string {\n  if (token.length < 18) return \"***\";\n  return `${token.slice(0, 6)}...${token.slice(-4)}`;\n}\n\n// issue #117 — the EXACT shape of a `maskToken` output (`slice(0,6)+\"...\"+slice(-4)`\n// = 6 chars, literal `...`, 4 chars). Used to detect a value PARAM_PATTERN would\n// otherwise re-mask, WITHOUT skipping a raw secret that merely contains `...`.\nconst MASK_SHAPE = /^.{6}\\.\\.\\..{4}$/s;\n\n// Coerce arbitrary input to a string for redaction. Returns `null`\n// sentinel when the value is null/undefined/non-stringifiable, so the\n// caller can short-circuit with `\"\"`. EC-7 fix: circular refs go through\n// the try/catch and produce the sentinel marker, never throwing.\nfunction coerceToString(value: unknown): string | null {\n  if (typeof value === \"string\") return value;\n  if (value === null || value === undefined) return null;\n  if (typeof value === \"object\") {\n    try {\n      const s = JSON.stringify(value);\n      return s === undefined ? null : s;\n    } catch {\n      return \"[unredactable: circular]\";\n    }\n  }\n  return String(value);\n}\n\n/**\n * Redact known credential patterns from `text`. Default behavior masks\n * builtins + extras + parametric `key=value` sinks.\n *\n * With `{ codeFile: true }` (D72), skips PARAM_PATTERN to avoid mangling\n * `.env.example`, schema JSON, or test fixtures that legitimately contain\n * prefix-like strings.\n *\n * Returns the redacted string. Coerces non-strings via JSON.stringify;\n * EC-7 fix (edge-case review): wraps in try/catch so circular references\n * never propagate — returns sentinel `\"[unredactable: circular]\"`.\n *\n * `null` and `undefined` return `\"\"`. When redaction was switched off at module load via\n * `THEOKIT_REDACT_SECRETS`, the coerced input is returned with no masking at all — the value is\n * still stringified, but nothing is removed from it.\n *\n * Masking is best-effort against a list of known shapes. A credential in a format no pattern\n * covers passes through unchanged, so a redacted string is not a string proven free of secrets.\n */\nexport function redactSecrets(text: unknown, opts?: { codeFile?: boolean }): string {\n  const coerced = coerceToString(text);\n  if (coerced === null) return \"\";\n  if (!REDACT_ENABLED) return coerced;\n\n  let s = coerced;\n  for (const masker of BUILTIN_PATTERNS) {\n    s = typeof masker === \"function\" ? masker(s) : s.replace(masker, (m) => maskToken(m));\n  }\n  for (const re of _extraPatterns) {\n    s = s.replace(re, (m) => maskToken(m));\n  }\n  if (!opts?.codeFile) {\n    // Bearer first (preserves \"Bearer \" prefix, masks the token after).\n    // Must run before PARAM_PATTERN so the bare-whitespace shape doesn't\n    // get mis-handled as a value.\n    s = s.replace(BEARER_PATTERN, (_, prefix: string) => `${prefix}***`);\n    // T5.4: skip if value already contains the D71 bucket-mask separator\n    // (`...`) — BUILTIN ran first and produced a prefix-preserved mask;\n    // re-masking would lose the prefix and degrade debuggability.\n    s = s.replace(PARAM_PATTERN, (whole, prefix: string, value: string) => {\n      // issue #117 — skip ONLY when the value is already a mask that a BUILTIN\n      // pattern produced (maskToken's exact `6chars...4chars` shape), so we don't\n      // re-mask and lose the prefix. The old `value.includes(\"...\")` was too broad:\n      // a REAL secret that happens to contain `...` (e.g. `L_-cxw-.2UI_..._`) was\n      // skipped and LEAKED. The mask shape is exact (maskToken: slice(0,6)+\"...\"+\n      // slice(-4)), so a raw secret with `...` elsewhere is now masked.\n      if (MASK_SHAPE.test(value)) return whole;\n      return `${prefix}***`;\n    });\n  }\n  return s;\n}\n\n/**\n * Test-only helper exported for `_test-reset.ts`. NOT included in the\n * `index.ts` barrel — vitest setup imports the dedicated module via\n * explicit path to discourage production callers.\n *\n * @internal\n */\nexport function _resetForTests(opts: { enabled?: boolean; clearExtras?: boolean }): void {\n  if (opts.enabled !== undefined) REDACT_ENABLED = opts.enabled;\n  if (opts.clearExtras === true) _extraPatterns.length = 0;\n}\n\n/**\n * T5.4 — Test-only count of BUILTIN_PATTERNS. Exposed so the count-floor\n * assertion can run without re-deriving the array shape in test land.\n * NOT included in the public barrel.\n *\n * @internal\n */\nexport function __TESTING__BUILTIN_PATTERN_COUNT(): number {\n  return BUILTIN_PATTERNS.length;\n}\n"]}

package/dist/{chunk-TMKTSYDS.cjs → chunk-RS7YQR4X.cjs}

@@ -1,21 +1,21 @@
 'use strict';
 
-var chunkJLRLCBJ4_cjs = require('./chunk-JLRLCBJ4.cjs');
-var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
+var chunkZOFRNNZD_cjs = require('./chunk-ZOFRNNZD.cjs');
+var chunkRNXXYF22_cjs = require('./chunk-RNXXYF22.cjs');
 var path = require('path');
 
 async function persistActiveMemoryTranscript(root, transcript) {
   try {
     const dir = path.join(root, "transcripts", "active-memory");
     const file = path.join(dir, `${transcript.runId}.json`);
-    await chunkJLRLCBJ4_cjs.atomicWriteJson(file, transcript);
+    await chunkZOFRNNZD_cjs.atomicWriteJson(file, transcript);
   } catch (cause) {
     const message = cause instanceof Error ? cause.message : String(cause);
-    chunk6LHQPOMI_cjs.diag(`[theokit-sdk] active-memory transcript persist failed: ${message}
+    chunkRNXXYF22_cjs.diag(`[theokit-sdk] active-memory transcript persist failed: ${message}
 `);
   }
 }
 
 exports.persistActiveMemoryTranscript = persistActiveMemoryTranscript;
-//# sourceMappingURL=chunk-TMKTSYDS.cjs.map
-//# sourceMappingURL=chunk-TMKTSYDS.cjs.map
+//# sourceMappingURL=chunk-RS7YQR4X.cjs.map
+//# sourceMappingURL=chunk-RS7YQR4X.cjs.map

package/dist/{chunk-TMKTSYDS.cjs.map → chunk-RS7YQR4X.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/internal/memory/storage/transcript-store.ts"],"names":["join","atomicWriteJson","diag"],"mappings":";;;;;;AA2CA,eAAsB,6BAAA,CACpB,MACA,UAAA,EACe;AACf,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAMA,SAAA,CAAK,IAAA,EAAM,aAAA,EAAe,eAAe,CAAA;AACrD,IAAA,MAAM,OAAOA,SAAA,CAAK,GAAA,EAAK,CAAA,EAAG,UAAA,CAAW,KAAK,CAAA,KAAA,CAAO,CAAA;AAGjD,IAAA,MAAMC,iCAAA,CAAgB,MAAM,UAAU,CAAA;AAAA,EACxC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,IAAAC,sBAAA,CAAK,0DAA0D,OAAO;AAAA,CAAI,CAAA;AAAA,EAC5E;AACF","file":"chunk-TMKTSYDS.cjs","sourcesContent":["import { join } from \"node:path\";\nimport { diag } from \"../../diagnostics.js\";\nimport { atomicWriteJson } from \"../../persistence/atomic-write.js\";\nimport type { MemoryRoot } from \"./memory-root.js\";\n\n/**\n * Optional on-disk persistence for Active Memory recall transcripts (ADR D6).\n *\n * Writes one JSON file per run under\n * `.theokit/memory/transcripts/active-memory/<runId>.json` when the agent\n * passes `persistTranscripts: true`. Failures are swallowed with a stderr\n * warning so transcript IO never crashes the agent run.\n *\n * Shared with `@theokit/sdk-memory` through the semver-exempt `internal/memory-store`\n * sub-path, so it carries no internal-visibility tag. `stripInternal` matches that tag as TEXT\n * anywhere in the block, so naming it here — even in backticks, even to say it is absent — deletes\n * this symbol from the published declarations and forces the satellite back onto a copy. Measured:\n * the first draft of this very note did exactly that. See #430 and #463.\n */\n\nexport interface ActiveMemoryTranscript {\n  runId: string;\n  startedAtMs: number;\n  userText: string;\n  queryMode: string;\n  status: string;\n  durationMs: number;\n  summary: string | undefined;\n  hits: ReadonlyArray<{\n    path: string;\n    startLine: number;\n    endLine: number;\n    score: number;\n    snippet: string;\n  }>;\n}\n\n/**\n * Write one active-memory recall transcript under `<memory root>/transcripts/active-memory`.\n *\n * Never throws. Transcript IO is observability, and observability must not break the run it merely\n * observes — a failure is reported through the diagnostics sink and swallowed.\n */\nexport async function persistActiveMemoryTranscript(\n  root: MemoryRoot,\n  transcript: ActiveMemoryTranscript,\n): Promise<void> {\n  try {\n    const dir = join(root, \"transcripts\", \"active-memory\");\n    const file = join(dir, `${transcript.runId}.json`);\n    // atomicWriteJson auto-creates the parent directory + writes atomically\n    // (no torn writes during crash).\n    await atomicWriteJson(file, transcript);\n  } catch (cause) {\n    const message = cause instanceof Error ? cause.message : String(cause);\n    diag(`[theokit-sdk] active-memory transcript persist failed: ${message}\\n`);\n  }\n}\n"]}
+{"version":3,"sources":["../src/internal/memory/storage/transcript-store.ts"],"names":["join","atomicWriteJson","diag"],"mappings":";;;;;;AA2CA,eAAsB,6BAAA,CACpB,MACA,UAAA,EACe;AACf,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAMA,SAAA,CAAK,IAAA,EAAM,aAAA,EAAe,eAAe,CAAA;AACrD,IAAA,MAAM,OAAOA,SAAA,CAAK,GAAA,EAAK,CAAA,EAAG,UAAA,CAAW,KAAK,CAAA,KAAA,CAAO,CAAA;AAGjD,IAAA,MAAMC,iCAAA,CAAgB,MAAM,UAAU,CAAA;AAAA,EACxC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AACrE,IAAAC,sBAAA,CAAK,0DAA0D,OAAO;AAAA,CAAI,CAAA;AAAA,EAC5E;AACF","file":"chunk-RS7YQR4X.cjs","sourcesContent":["import { join } from \"node:path\";\nimport { diag } from \"../../diagnostics.js\";\nimport { atomicWriteJson } from \"../../persistence/atomic-write.js\";\nimport type { MemoryRoot } from \"./memory-root.js\";\n\n/**\n * Optional on-disk persistence for Active Memory recall transcripts (ADR D6).\n *\n * Writes one JSON file per run under\n * `.theokit/memory/transcripts/active-memory/<runId>.json` when the agent\n * passes `persistTranscripts: true`. Failures are swallowed with a stderr\n * warning so transcript IO never crashes the agent run.\n *\n * Shared with `@theokit/sdk-memory` through the semver-exempt `internal/memory-store`\n * sub-path, so it carries no internal-visibility tag. `stripInternal` matches that tag as TEXT\n * anywhere in the block, so naming it here — even in backticks, even to say it is absent — deletes\n * this symbol from the published declarations and forces the satellite back onto a copy. Measured:\n * the first draft of this very note did exactly that. See #430 and #463.\n */\n\nexport interface ActiveMemoryTranscript {\n  runId: string;\n  startedAtMs: number;\n  userText: string;\n  queryMode: string;\n  status: string;\n  durationMs: number;\n  summary: string | undefined;\n  hits: ReadonlyArray<{\n    path: string;\n    startLine: number;\n    endLine: number;\n    score: number;\n    snippet: string;\n  }>;\n}\n\n/**\n * Write one active-memory recall transcript under `<memory root>/transcripts/active-memory`.\n *\n * Never throws. Transcript IO is observability, and observability must not break the run it merely\n * observes — a failure is reported through the diagnostics sink and swallowed.\n */\nexport async function persistActiveMemoryTranscript(\n  root: MemoryRoot,\n  transcript: ActiveMemoryTranscript,\n): Promise<void> {\n  try {\n    const dir = join(root, \"transcripts\", \"active-memory\");\n    const file = join(dir, `${transcript.runId}.json`);\n    // atomicWriteJson auto-creates the parent directory + writes atomically\n    // (no torn writes during crash).\n    await atomicWriteJson(file, transcript);\n  } catch (cause) {\n    const message = cause instanceof Error ? cause.message : String(cause);\n    diag(`[theokit-sdk] active-memory transcript persist failed: ${message}\\n`);\n  }\n}\n"]}

package/dist/{chunk-HU666T3Q.cjs → chunk-S46WJTDL.cjs}

@@ -1,10 +1,10 @@
 'use strict';
 
 var chunkNVXXWAU7_cjs = require('./chunk-NVXXWAU7.cjs');
-var chunkSKDNCTXG_cjs = require('./chunk-SKDNCTXG.cjs');
-var chunkNAGPKWOD_cjs = require('./chunk-NAGPKWOD.cjs');
-var chunkUNFBHV46_cjs = require('./chunk-UNFBHV46.cjs');
-var chunk6LHQPOMI_cjs = require('./chunk-6LHQPOMI.cjs');
+var chunk5A4UFBHW_cjs = require('./chunk-5A4UFBHW.cjs');
+var chunkQISSETTG_cjs = require('./chunk-QISSETTG.cjs');
+var chunkCEGU5AVD_cjs = require('./chunk-CEGU5AVD.cjs');
+var chunkRNXXYF22_cjs = require('./chunk-RNXXYF22.cjs');
 var zod = require('zod');
 var os = require('os');
 
@@ -16,14 +16,14 @@ var REGISTRY = chunkNVXXWAU7_cjs.globalSingleton(
 var ALIASES = chunkNVXXWAU7_cjs.globalSingleton("theokit-sdk.providers.aliases", () => /* @__PURE__ */ new Map());
 function registerProvider(profile) {
   if (REGISTRY.has(profile.name)) {
-    chunk6LHQPOMI_cjs.diag(`[theokit-sdk] Provider "${profile.name}" overridden by user plugin.
+    chunkRNXXYF22_cjs.diag(`[theokit-sdk] Provider "${profile.name}" overridden by user plugin.
 `);
   }
   REGISTRY.set(profile.name, profile);
   for (const alias of profile.aliases ?? []) {
     const previous = ALIASES.get(alias);
     if (previous !== void 0 && previous !== profile.name) {
-      chunk6LHQPOMI_cjs.diag(`[theokit-sdk] Alias "${alias}" collision: was "${previous}", now "${profile.name}".
+      chunkRNXXYF22_cjs.diag(`[theokit-sdk] Alias "${alias}" collision: was "${previous}", now "${profile.name}".
 `);
     }
     ALIASES.set(alias, profile.name);
@@ -1438,7 +1438,7 @@ function ensureModelIndexLoaded() {
       indexEntryModels(entry);
     }
   } catch (err) {
-    chunk6LHQPOMI_cjs.diag(
+    chunkRNXXYF22_cjs.diag(
       `[theokit-sdk] WARN: provider catalog unavailable (${err.message}) \u2014 per-model data disabled
 `
     );
@@ -1449,7 +1449,7 @@ function indexEntryModels(entry) {
   for (const [modelId, raw] of Object.entries(entry.models)) {
     const parsed = catalogModelSchema.safeParse(raw);
     if (!parsed.success) {
-      chunk6LHQPOMI_cjs.diag(
+      chunkRNXXYF22_cjs.diag(
         `[theokit-sdk] WARN: Skipping malformed catalog model "${entry.id}/${modelId}": ${parsed.error.issues[0]?.message ?? "invalid"}
 `
       );
@@ -1478,7 +1478,7 @@ function loadProviderCatalog(opts) {
   for (const raw of entries) {
     const validated = validateEntry(raw);
     if (validated === null) {
-      chunk6LHQPOMI_cjs.diag(
+      chunkRNXXYF22_cjs.diag(
         `[theokit-sdk] WARN: Skipping malformed catalog entry: ${JSON.stringify(raw).slice(0, 100)}
 `
       );
@@ -1716,19 +1716,19 @@ var OPENAI_OAUTH_CONFIG = {
 function codexFetch() {
   return (async (input, init) => {
     const env = process.env;
-    const resolved = await chunkSKDNCTXG_cjs.resolveCredential({
+    const resolved = await chunk5A4UFBHW_cjs.resolveCredential({
       provider: "openai",
       store: DEFAULT_STORE,
       oauth: OPENAI_OAUTH_CONFIG,
       env
     });
     if (resolved === void 0) {
-      throw new chunkUNFBHV46_cjs.AuthenticationError(
+      throw new chunkCEGU5AVD_cjs.AuthenticationError(
         'openai-chatgpt: no ChatGPT credential found \u2014 run the OpenAI device login (e.g. "/login openai") first.',
         { code: "missing_credential" }
       );
     }
-    const accountId = chunkNAGPKWOD_cjs.readStoredOAuth(DEFAULT_STORE, env)?.account_id;
+    const accountId = chunkQISSETTG_cjs.readStoredOAuth(DEFAULT_STORE, env)?.account_id;
     const headers = new Headers(init?.headers);
     headers.set("authorization", `Bearer ${resolved.apiKey}`);
     if (accountId !== void 0) headers.set("ChatGPT-Account-Id", accountId);
@@ -1887,5 +1887,5 @@ exports.resolveBedrockBaseUrl = resolveBedrockBaseUrl;
 exports.resolveVertexBaseUrl = resolveVertexBaseUrl;
 exports.stripBedrockPrefix = stripBedrockPrefix;
 exports.stripVertexPrefix = stripVertexPrefix;
-//# sourceMappingURL=chunk-HU666T3Q.cjs.map
-//# sourceMappingURL=chunk-HU666T3Q.cjs.map
+//# sourceMappingURL=chunk-S46WJTDL.cjs.map
+//# sourceMappingURL=chunk-S46WJTDL.cjs.map