@theokit/sdk 5.15.0 → 5.15.2

package/dist/chunk-X2XLSE2N.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sandbox/shell-escape.ts","../src/sandbox/types.ts","../src/sandbox/local-sandbox.ts"],"names":["TheokitAgentError","ConfigurationError","execFile","resolveChildEnv","mkdir","dirname","fsWriteFile"],"mappings":";;;;;;;;;AAoBO,SAAS,iBAAiB,GAAA,EAAqB;AACpD,EAAA,MAAM,aAAA,GAAgB,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AAC/C,EAAA,OAAO,CAAA,CAAA,EAAI,aAAA,CAAc,OAAA,CAAQ,mBAAA,EAAqB,QAAQ,CAAC,CAAA,CAAA,CAAA;AACjE;;;AC+DO,IAAM,oBAAA,GAAN,cAAmCA,mCAAA,CAAkB;AAAA,EACxC,IAAA,GAAO,sBAAA;AAAA,EACP,IAAA,GAAO,kBAAA;AAAA,EACzB,YAAY,OAAA,EAAiB;AAE3B,IAAA,KAAA,CAAM,SAAS,EAAE,IAAA,EAAM,kBAAA,EAAoB,WAAA,EAAa,OAAO,CAAA;AAAA,EACjE;AACF;AAYO,IAAM,wBAAA,GAAN,cAAuCA,mCAAA,CAAkB;AAAA,EAC5C,IAAA,GAAO,0BAAA;AAAA,EACP,IAAA,GAAO,uBAAA;AAAA,EACzB,YAAY,OAAA,EAAiB;AAE3B,IAAA,KAAA,CAAM,SAAS,EAAE,IAAA,EAAM,uBAAA,EAAyB,WAAA,EAAa,OAAO,CAAA;AAAA,EACtE;AACF;AA2BO,IAAe,iBAAf,MAA8B;AAAA,EACzB,MAAA;AAAA,EAUV,WAAA,CAAY,MAAA,GAAwB,EAAC,EAAG;AACtC,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,OAAA,EAAS,OAAO,OAAA,IAAW,MAAA;AAAA,MAC3B,SAAA,EAAW,OAAO,SAAA,IAAa,GAAA;AAAA,MAC/B,cAAA,EAAgB,MAAA,CAAO,cAAA,IAAkB,CAAA,GAAI,IAAA,GAAO,IAAA;AAAA;AAAA,MAEpD,GAAA,EAAK,OAAO,GAAA,IAAO;AAAA,KACrB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAAA,GAAyB;AAAA,EAAC;AAAA,EAEhC,MAAM,SAAS,IAAA,EAA+B;AAC5C,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAO,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA,CAAE,CAAA;AACjE,IAAA,IAAI,MAAA,CAAO,aAAa,CAAA,EAAG;AACzB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,iBAAA,EAAoB,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,IACrD;AACA,IAAA,OAAO,MAAA,CAAO,MAAA;AAAA,EAChB;AAAA,EAEA,MAAM,SAAA,CAAU,IAAA,EAAc,OAAA,EAAgC;AAC5D,IAAA,MAAM,IAAA,CAAK,UAAA,CAAW,IAAA,EAAM,OAAO,CAAA;AAAA,EACrC;AAAA,EAEA,MAAM,IAAA,CAAK,OAAA,EAAiB,GAAA,EAAiC;AAC3D,IAAA,MAAM,GAAA,GAAM,GAAA,IAAO,IAAA,CAAK,MAAA,CAAO,OAAA,IAAW,GAAA;AAC1C,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,OAAA;AAAA,MACxB,CAAA,KAAA,EAAQ,KAAK,WAAA,CAAY,GAAG,CAAC,CAAA,OAAA,EAAU,IAAA,CAAK,WAAA,CAAY,OAAO,CAAC,CAAA,oBAAA;AAAA,KAClE;AACA,IAAA,IAAA,CAAK,gBAAA,CAAiB,QAAQ,MAAM,CAAA;AACpC,IAAA,OAAO,MAAA,CAAO,OAAO,IAAA,EAAK,CAAE,MAAM,IAAI,CAAA,CAAE,OAAO,OAAO,CAAA;AAAA,EACxD;AAAA,EAEA,MAAM,IAAA,CAAK,OAAA,EAAiB,IAAA,EAAkC;AAC5D,IAAA,MAAM,SAAS,IAAA,IAAQ,GAAA;AACvB,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,OAAA;AAAA,MACxB,CAAA,SAAA,EAAY,KAAK,WAAA,CAAY,OAAO,CAAC,CAAA,CAAA,EAAI,IAAA,CAAK,WAAA,CAAY,MAAM,CAAC,CAAA,YAAA;AAAA,KACnE;AAEA,IAAA,IAAI,OAAO,QAAA,KAAa,CAAA,EAAG,IAAA,CAAK,gBAAA,CAAiB,QAAQ,MAAM,CAAA;AAC/D,IAAA,OAAO,MAAA,CAAO,OAAO,IAAA,EAAK,CAAE,MAAM,IAAI,CAAA,CAAE,OAAO,OAAO,CAAA;AAAA,EACxD;AAAA,EAEA,MAAM,QAAQ,IAAA,EAAiC;AAC7C,IAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,OAAA,CAAQ,SAAS,IAAA,CAAK,WAAA,CAAY,IAAI,CAAC,CAAA,CAAE,CAAA;AACnE,IAAA,IAAA,CAAK,gBAAA,CAAiB,WAAW,MAAM,CAAA;AACvC,IAAA,OAAO,MAAA,CAAO,OAAO,IAAA,EAAK,CAAE,MAAM,IAAI,CAAA,CAAE,OAAO,OAAO,CAAA;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcQ,gBAAA,CAAiB,WAAmB,MAAA,EAA6B;AACvE,IAAA,IAAI,MAAA,CAAO,aAAa,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAIC,oCAAA;AAAA,MACR,CAAA,EAAG,SAAS,CAAA,cAAA,EAAiB,MAAA,CAAO,MAAA,CAAO,QAAQ,CAAC,CAAA,GAAA,EAAM,MAAA,CAAO,MAAA,CAAO,IAAA,EAAK,IAAK,WAAW,CAAA,mJAAA,CAAA;AAAA,MAG7F,EAAE,MAAM,+BAAA;AAAgC,KAC1C;AAAA,EACF;AAAA,EAEU,eAAe,MAAA,EAAwB;AAC/C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,CAAO,cAAA,IAAkB,IAAI,IAAA,GAAO,IAAA;AACrD,IAAA,IAAI,MAAA,CAAO,UAAA,CAAW,MAAM,CAAA,GAAI,GAAA,EAAK;AACnC,MAAA,OAAO,CAAA,EAAG,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,GAAG,CAAC;AAAA,cAAA,CAAA;AAAA,IAChC;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEQ,YAAY,GAAA,EAAqB;AACvC,IAAA,OAAO,iBAAiB,GAAG,CAAA;AAAA,EAC7B;AACF;AAgBA,eAAsB,cAAA,CACpB,UACA,GAAA,EACyB;AACzB,EAAA,OAAO,QAAA,YAAoB,cAAA,GAAiB,QAAA,GAAW,QAAA,CAAS,GAAG,CAAA;AACrE;ACzMO,IAAM,YAAA,GAAN,cAA2B,cAAA,CAAe;AAAA;AAAA,EAE7B,aAAA,GAAsC,EAAE,IAAA,EAAM,cAAA,EAAe;AAAA,EAE/E,WAAA,CAAY,MAAA,GAAwB,EAAC,EAAG;AACtC,IAAA,KAAA,CAAM,MAAM,CAAA;AAAA,EACd;AAAA,EAEA,MAAM,OAAA,CAAQ,OAAA,EAAiB,IAAA,EAAuD;AACpF,IAAA,MAAM,OAAA,GAAU,IAAA,EAAM,SAAA,IAAa,IAAA,CAAK,OAAO,SAAA,IAAa,GAAA;AAC5D,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,CAAO,cAAA,IAAkB,IAAI,IAAA,GAAO,IAAA;AAErD,IAAA,OAAO,IAAI,OAAA,CAAuB,CAAC,OAAA,KAAY;AAC7C,MAAA,MAAM,KAAA,GAAQC,2BAAA;AAAA,QACZ,SAAA;AAAA,QACA,CAAC,MAAM,OAAO,CAAA;AAAA,QACd;AAAA,UACE,GAAA,EAAK,KAAK,MAAA,CAAO,OAAA;AAAA,UACjB,OAAA;AAAA,UACA,SAAA,EAAW,GAAA;AAAA,UACX,QAAA,EAAU,OAAA;AAAA;AAAA,UAEV,KAAKC,iCAAA,CAAgB,EAAE,QAAQ,IAAA,CAAK,MAAA,CAAO,KAAK;AAAA,SAClD;AAAA,QACA,CAAC,KAAA,EAAO,MAAA,EAAQ,MAAA,KAAW;AACzB,UAAA,OAAA,CAAQ,KAAK,WAAA,CAAY,KAAA,EAAO,UAAU,EAAA,EAAI,MAAA,IAAU,EAAE,CAAC,CAAA;AAAA,QAC7D;AAAA,OACF;AAGA,MAAA,KAAA,CAAM,EAAA,CAAG,SAAS,MAAM;AACtB,QAAA,OAAA,CAAQ,EAAE,QAAQ,EAAA,EAAI,MAAA,EAAQ,eAAe,QAAA,EAAU,CAAA,EAAG,QAAA,EAAU,KAAA,EAAO,CAAA;AAAA,MAC7E,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EAEQ,WAAA,CAAY,KAAA,EAAqB,MAAA,EAAgB,MAAA,EAA+B;AACtF,IAAA,MAAM,QAAA,GAAW,KAAA,KAAU,IAAA,IAAQ,QAAA,IAAY,SAAU,KAAA,CAA8B,MAAA;AAKvF,IAAA,MAAM,UAAA,GACJ,KAAA,KAAU,IAAA,IAAS,KAAA,CAA6B,IAAA,KAAS,mCAAA;AAC3D,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,SAAA,CAAU,KAAK,cAAA,CAAe,MAAM,GAAG,UAAU,CAAA;AAAA,MAC9D,QAAQ,IAAA,CAAK,SAAA,CAAU,KAAK,cAAA,CAAe,MAAM,GAAG,UAAU,CAAA;AAAA,MAC9D,QAAA,EAAU,QAAA,GAAW,GAAA,GAAM,KAAA,GAAQ,CAAA,GAAI,CAAA;AAAA,MACvC;AAAA,KACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,SAAA,CAAU,QAAgB,UAAA,EAA6B;AAC7D,IAAA,IAAI,CAAC,YAAY,OAAO,MAAA;AACxB,IAAA,IAAI,MAAA,CAAO,QAAA,CAAS,gBAAgB,CAAA,EAAG,OAAO,MAAA;AAC9C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,MAAA,CAAO,cAAA,IAAkB,IAAI,IAAA,GAAO,IAAA;AACrD,IAAA,OAAO,OAAO,UAAA,CAAW,MAAM,CAAA,IAAK,GAAA,GAAM,GAAG,MAAM;AAAA,cAAA,CAAA,GAAqB,MAAA;AAAA,EAC1E;AAAA,EAEA,MAAM,UAAA,CAAW,IAAA,EAAc,OAAA,EAAyC;AACtE,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,GAAI,IAAA,GAAO,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,OAAO,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA;AAC7E,IAAA,MAAMC,eAAMC,iBAAA,CAAQ,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAClD,IAAA,MAAMC,kBAAA,CAAY,QAAA,EAAU,OAAA,EAAS,OAAO,CAAA;AAAA,EAC9C;AACF","file":"chunk-X2XLSE2N.cjs","sourcesContent":["/**\n * POSIX shell escaping for values interpolated into a `SandboxBackend.execute`\n * command string. `execute` runs via `/bin/sh -c`, so any untrusted value\n * (repo URL, ref, path) MUST be quoted to prevent command injection.\n */\n\n/**\n * Quotes `arg` as one word for POSIX `sh`, for a command line you build yourself and hand to\n * `SandboxBackend.execute`. A value from outside cannot end the word and start another command,\n * whatever it holds: quotes, `$()`, backticks, newlines, backslashes. An empty string comes back as\n * `''`. Quoting does not stop the program you call from reading a leading dash as an option, so put\n * `--` before the value for one that parses options. The derived helpers and `provisionRepo` use this\n * same quoter.\n *\n * Wrap `arg` in single quotes, escaping embedded single quotes (`'\\''`). A backslash before a quote,\n * a backslash or the end is written outside the quotes too (`'\\\\'`), so the word parses the same\n * under fish, which reads `\\'` and `\\\\` inside single quotes as escapes, as under sh (B-600): the PTY\n * runs the sandbox wrap under the user's `$SHELL`. After the first pass an original quote reads\n * `'\\''`, whose own backslash is always followed by `''`, so the second pass never matches it.\n */\nexport function shellEscapePosix(arg: string): string {\n  const quotesEscaped = arg.replace(/'/g, \"'\\\\''\");\n  return `'${quotesEscaped.replace(/\\\\(?=\\\\|'\\\\''|$)/g, \"'\\\\\\\\'\")}'`;\n}\n","/**\n * Sandbox backend protocol — pluggable execution environment for agent tools.\n *\n * Per ADR D1: only 2 abstract methods (`execute` + `uploadFile`). All\n * higher-level operations are derived on the base class. New backends\n * (Docker, Firecracker, E2B) only implement those 2 methods.\n *\n * @public\n */\n\nimport { ConfigurationError, TheokitAgentError } from \"../errors.js\";\nimport type { EnvPolicy } from \"../types/env-policy.js\";\nimport { shellEscapePosix } from \"./shell-escape.js\";\n\n/**\n * What a {@link SandboxBackend} returns for one command.\n *\n * `exitCode` is a coarse signal rather than the child's real exit status: the backends in this\n * package report `0` on success, `124` on timeout, and `1` for everything else — including a command\n * that exited with its own non-zero code. Read `timedOut` to tell a killed command from a failed one,\n * and `stderr` for the reason; branching on a specific exit code will not work here.\n *\n * `stdout` and `stderr` are truncated independently at `SandboxConfig.maxOutputBytes`, with a\n * trailing `...(truncated)` marker. Neither is safe to parse as a complete document without checking\n * for it.\n */\nexport interface ExecuteResult {\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  timedOut: boolean;\n}\n\n/**\n * Construction-time settings shared by every {@link SandboxBackend}. All fields are optional and the\n * base constructor fills them in, so `{}` is a valid config: `workDir` `/tmp`, `timeoutMs` 30000,\n * `maxOutputBytes` 5 MiB, `env` `\"inherit-scrubbed\"`.\n *\n * `workDir` is the child process's cwd and the base a relative `uploadFile` path resolves against. It\n * is not a boundary — under `LocalSandbox` nothing stops a command, or an absolute path, from leaving\n * it. Only `LinuxSandbox` makes it enforceable.\n *\n * `timeoutMs` is the default for every call; `execute(command, { timeoutMs })` overrides it per\n * command. On expiry the child is killed and the result carries `timedOut: true` with `exitCode`\n * 124 — the partial output collected so far is still returned.\n */\nexport interface SandboxConfig {\n  workDir?: string;\n  timeoutMs?: number;\n  maxOutputBytes?: number;\n  /**\n   * #54 — env inherit/scrub policy for the executed command's child process.\n   * Defaults to `\"inherit-scrubbed\"` (drop secret-like vars: `*KEY*`, `*SECRET*`,\n   * `*TOKEN*`, `*PASSWORD*`, `*_AUTH*`). Pass `\"all\"` to restore full inheritance\n   * or `\"core\"` for a minimal safe allowlist.\n   */\n  env?: EnvPolicy;\n}\n\n/**\n * What a {@link SandboxBackend} states about its outbound network. It is a statement the backend\n * makes about itself, for a caller that wants to ask before it trusts: this package enforces nothing\n * from it, and a custom backend is responsible for the claim being true.\n *\n * `\"unrestricted\"` means a command can reach whatever the host can. `\"none\"` means it cannot reach\n * the network at all. `\"allowlist\"` means it can reach only the destinations in `allow`, written as\n * the backend's own firewall spells them (usually domain names); the field is meaningful only with\n * that mode. A backend that says nothing leaves `networkPolicy` undefined, which is not the same as\n * `\"unrestricted\"`: it means the backend makes no claim either way.\n */\nexport interface SandboxNetworkPolicy {\n  readonly mode: \"unrestricted\" | \"allowlist\" | \"none\";\n  readonly allow?: readonly string[];\n}\n\n/**\n * A backend refused a command on policy grounds — the environment works, and it said no. Carries a\n * stable `code: \"sandbox_security\"` for callers that prefer not to match on the class.\n *\n * Nothing in this package throws it, which is worth knowing before you write a `catch` for it:\n * `LocalSandbox` and `LinuxSandbox` report a refusal through {@link ExecuteResult} (non-zero\n * `exitCode`, reason on `stderr`), and a write blocked under confinement surfaces as a plain `Error`\n * from `uploadFile`. This type exists so a custom backend that must reject a command BEFORE spawning\n * anything — a container or VM runner enforcing its own policy — can do so in the protocol's\n * vocabulary instead of inventing an error of its own.\n */\nexport class SandboxSecurityError extends TheokitAgentError {\n  override readonly name = \"SandboxSecurityError\";\n  override readonly code = \"sandbox_security\" as const;\n  constructor(message: string) {\n    // not retryable: a refused command is refused every time; retrying re-asks the same question\n    super(message, { code: \"sandbox_security\", isRetryable: false });\n  }\n}\n\n/**\n * A backend cannot be used at all: its runtime is missing or unusable. The distinction from\n * {@link SandboxSecurityError} is which side failed — there the sandbox worked and denied the\n * command, here there is no sandbox. Carries `code: \"sandbox_not_available\"`.\n *\n * Nothing in this package throws it either, and that is a position rather than an oversight:\n * `createSandboxBackend` treats a missing bubblewrap as a degradation, warns once, and hands back an\n * unconfined `LocalSandbox`. Throw this instead from a backend that must never silently run outside\n * its isolation.\n */\nexport class SandboxNotAvailableError extends TheokitAgentError {\n  override readonly name = \"SandboxNotAvailableError\";\n  override readonly code = \"sandbox_not_available\" as const;\n  constructor(message: string) {\n    // not retryable: a missing runtime does not appear on a second attempt\n    super(message, { code: \"sandbox_not_available\", isRetryable: false });\n  }\n}\n\n/**\n * The execution capability handed to an agent tool, and the extension point for new environments.\n *\n * A backend implements exactly two methods, `execute` and `uploadFile`. Everything else here —\n * `readFile`, `glob`, `grep`, `listDir` — is derived from `execute` by shelling out `cat`, `find`,\n * `grep` and `ls`, so a subclass that overrides `execute` alone inherits confined reads, searches and\n * listings for free. It does not inherit confined writes: `writeFile` delegates to `uploadFile`, and\n * that is the second override `LinuxSandbox` needs.\n *\n * Choosing one: `LocalSandbox` runs the command on the host with no isolation and suits code you\n * already trust; `LinuxSandbox` adds kernel confinement where bubblewrap is available;\n * `createSandboxBackend` probes and picks between them, and is the right entry point unless you have\n * a reason to pin one. For genuinely untrusted code you want a container or VM backend, which this\n * package does not ship — write it against these two methods.\n *\n * Two optional members let a backend say more about itself. {@link SandboxBackend.networkPolicy}\n * states its egress: `LocalSandbox` declares `\"unrestricted\"`, `LinuxSandbox` declares `\"none\"` when\n * bubblewrap unshares the network, and a backend that does not override it states nothing. Nothing in\n * this package enforces an allowlist, so `\"allowlist\"` is only ever a claim a custom backend makes\n * for itself. {@link SandboxBackend.dispose} releases what the backend holds, and the owner of the\n * backend calls it.\n *\n * Because the derived helpers assemble shell command lines (arguments escaped for POSIX `sh`), a\n * backend whose `execute` is not a POSIX shell must override them as well.\n */\nexport abstract class SandboxBackend {\n  protected config: SandboxConfig;\n\n  /**\n   * What this backend states about its outbound network, or `undefined` when it states nothing.\n   * Read it to check an isolation claim before trusting a backend; do not read `undefined` as\n   * \"unrestricted\". A subclass sets it as a field, and it is a statement only: the backend must\n   * enforce it itself.\n   */\n  declare readonly networkPolicy?: SandboxNetworkPolicy;\n\n  constructor(config: SandboxConfig = {}) {\n    this.config = {\n      workDir: config.workDir ?? \"/tmp\",\n      timeoutMs: config.timeoutMs ?? 30_000,\n      maxOutputBytes: config.maxOutputBytes ?? 5 * 1024 * 1024,\n      // #54 — preserve the env policy so backends can scrub secrets.\n      env: config.env ?? \"inherit-scrubbed\",\n    };\n  }\n\n  abstract execute(command: string, opts?: { timeoutMs?: number }): Promise<ExecuteResult>;\n\n  abstract uploadFile(path: string, content: string | Buffer): Promise<void>;\n\n  /**\n   * Releases whatever the backend holds, such as a VM or a container. The default does nothing,\n   * which is correct for a backend that holds nothing, so existing subclasses need no change. Safe\n   * to call more than once. The owner of the backend calls it; nothing in this package does.\n   */\n  async dispose(): Promise<void> {}\n\n  async readFile(path: string): Promise<string> {\n    const result = await this.execute(`cat ${this.shellEscape(path)}`);\n    if (result.exitCode !== 0) {\n      throw new Error(`readFile failed: ${result.stderr}`);\n    }\n    return result.stdout;\n  }\n\n  async writeFile(path: string, content: string): Promise<void> {\n    await this.uploadFile(path, content);\n  }\n\n  async glob(pattern: string, cwd?: string): Promise<string[]> {\n    const dir = cwd ?? this.config.workDir ?? \".\";\n    const result = await this.execute(\n      `find ${this.shellEscape(dir)} -name ${this.shellEscape(pattern)} -type f 2>/dev/null`,\n    );\n    this.assertCommandRan(\"glob\", result);\n    return result.stdout.trim().split(\"\\n\").filter(Boolean);\n  }\n\n  async grep(pattern: string, path?: string): Promise<string[]> {\n    const target = path ?? \".\";\n    const result = await this.execute(\n      `grep -rn ${this.shellEscape(pattern)} ${this.shellEscape(target)} 2>/dev/null`,\n    );\n    // `grep` exits 1 for NO MATCH and >= 2 for an error, so a 1 is an answer and is not asserted on.\n    if (result.exitCode !== 1) this.assertCommandRan(\"grep\", result);\n    return result.stdout.trim().split(\"\\n\").filter(Boolean);\n  }\n\n  async listDir(path: string): Promise<string[]> {\n    const result = await this.execute(`ls -1 ${this.shellEscape(path)}`);\n    this.assertCommandRan(\"listDir\", result);\n    return result.stdout.trim().split(\"\\n\").filter(Boolean);\n  }\n\n  /**\n   * Turns \"the command did not run\" into an error instead of an empty array.\n   *\n   * `glob`, `grep` and `listDir` used to `return []` on any non-zero exit, so a search that could not\n   * run reported the same thing as a search that found nothing — opposite facts, one normal and one\n   * meaning the agent is looking at a filesystem it cannot read. That is the failure mode a backend\n   * whose `execute` is not a POSIX shell hits, which this class's own docblock warns about in prose\n   * and could not enforce.\n   *\n   * A genuine no-match is still `[]`: `find` exits 0 with empty output, and `grep`'s exit 1 is\n   * checked by its caller before this is reached.\n   */\n  private assertCommandRan(operation: string, result: ExecuteResult): void {\n    if (result.exitCode === 0) return;\n    throw new ConfigurationError(\n      `${operation} failed (exit ${String(result.exitCode)}): ${result.stderr.trim() || \"no stderr\"}. ` +\n        `The derived helpers shell out to POSIX \\`cat\\`/\\`find\\`/\\`grep\\`/\\`ls\\` — a backend whose ` +\n        `execute() is not a POSIX shell must override them.`,\n      { code: \"sandbox_derived_helper_failed\" },\n    );\n  }\n\n  protected truncateOutput(output: string): string {\n    const max = this.config.maxOutputBytes ?? 5 * 1024 * 1024;\n    if (Buffer.byteLength(output) > max) {\n      return `${output.slice(0, max)}\\n...(truncated)`;\n    }\n    return output;\n  }\n\n  private shellEscape(arg: string): string {\n    return shellEscapePosix(arg);\n  }\n}\n\n/**\n * A backend OR a per-request resolver of one — mirrors `FilesystemProvider` / `InteractiveProvider`.\n * A resolver runs at tool-execution time (request scope), so a multi-tenant / multi-role agent gets a\n * distinct sandbox per request without a shared mutable one. This is how a tool takes execution as an\n * INJECTED capability: the same tool runs on a local sandbox, a container/E2B backend (cluster/web), or\n * any future backend, with no direct `child_process` import.\n *\n * @public\n */\nexport type SandboxProvider<Ctx = unknown> =\n  | SandboxBackend\n  | ((ctx: Ctx) => SandboxBackend | Promise<SandboxBackend>);\n\n/** Resolve a {@link SandboxProvider} to a concrete backend for `ctx`. */\nexport async function resolveSandbox<Ctx>(\n  provider: SandboxProvider<Ctx>,\n  ctx: Ctx,\n): Promise<SandboxBackend> {\n  return provider instanceof SandboxBackend ? provider : provider(ctx);\n}\n\n/** Codex's three canonical sandbox modes; lives in this leaf module so bwrap.ts and deny-read.ts need not import each other. */\nexport type SandboxMode = \"read-only\" | \"workspace-write\" | \"danger-full-access\";\n\n/** Result of probing for bubblewrap. Detection never throws. */\nexport type BwrapDetection = { ok: true; bin: string } | { ok: false; reason: string };\n","/**\n * LocalSandbox — subprocess-based execution. **This is NOT an isolation\n * boundary.** It runs the command via `/bin/sh -c` in the SAME OS as the host\n * with the host's filesystem and network fully reachable — it provides NO\n * process, filesystem, or network isolation. Its only safety affordances are:\n *   - a wall-clock timeout (kills a runaway command),\n *   - an output-size cap (bounds memory), and\n *   - env scrubbing (#54): secret-like parent env vars (`*KEY*`/`*SECRET*`/\n *     `*TOKEN*`/`*PASSWORD*`/`*_AUTH*`) are dropped from the child by default\n *     (`SandboxConfig.env`), so a shell tool cannot exfiltrate host secrets via\n *     the environment.\n *\n * For real isolation (untrusted code), use a container/VM backend — NOT this.\n *\n * @public\n */\n\nimport { execFile } from \"node:child_process\";\nimport { writeFile as fsWriteFile, mkdir } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\n\nimport { resolveChildEnv } from \"../internal/runtime/lifecycle/env-policy.js\";\nimport {\n  type ExecuteResult,\n  SandboxBackend,\n  type SandboxConfig,\n  type SandboxNetworkPolicy,\n} from \"./types.js\";\n\n/**\n * Runs a command with `/bin/sh -c` on the host. NOT an isolation boundary — the\n * module note above states exactly what it does and does not protect.\n *\n *   const sandbox = new LocalSandbox({ workDir: \"/srv/repo\", timeoutMs: 10_000 });\n *   const { stdout, exitCode, timedOut } = await sandbox.execute(\"ls -1\");\n *\n * Needs a POSIX host with `/bin/sh`. Every helper inherited from\n * {@link SandboxBackend} — `readFile`, `glob`, `grep`, `listDir` — is built on\n * this `execute`, so they inherit that requirement too.\n *\n * How it fails: `execute` NEVER rejects. Every outcome, including a failure to\n * spawn, comes back as an {@link ExecuteResult}; read `timedOut` first\n * (`true` implies `exitCode` 124) and `stderr` for the reason. `uploadFile` DOES\n * reject, with the raw `node:fs` error, on a bad path or missing permission.\n *\n * Traps:\n *  - `exitCode` is not the child's exit code. It is 0, 124 (timed out) or 1 — a\n *    command that exits 3 is reported as 1, so branching on a specific code does\n *    not work here.\n *  - Output beyond `maxOutputBytes` (default 5 MiB) makes Node kill the child.\n *    The result is `exitCode: 1` and `timedOut: false`, with the cut stream\n *    carrying the `...(truncated)` marker described on `ExecuteResult` (#363).\n *    Since `exitCode` is 1 either way, that marker is what tells a lost-output\n *    result from a command that genuinely failed.\n *  - `uploadFile` resolves a relative path against `workDir` but does not contain\n *    it: an absolute path, or one containing `..`, writes wherever the process\n *    can. `workDir` is a starting directory, not a jail.\n *  - Secret-like parent env vars are dropped by default. Passing\n *    `env: \"all\"` in {@link SandboxConfig} puts the host's API keys back within\n *    reach of any command the agent runs.\n */\nexport class LocalSandbox extends SandboxBackend {\n  /** Runs on the host, so the network is whatever the host's is. */\n  override readonly networkPolicy: SandboxNetworkPolicy = { mode: \"unrestricted\" };\n\n  constructor(config: SandboxConfig = {}) {\n    super(config);\n  }\n\n  async execute(command: string, opts?: { timeoutMs?: number }): Promise<ExecuteResult> {\n    const timeout = opts?.timeoutMs ?? this.config.timeoutMs ?? 30_000;\n    const max = this.config.maxOutputBytes ?? 5 * 1024 * 1024;\n\n    return new Promise<ExecuteResult>((resolve) => {\n      const child = execFile(\n        \"/bin/sh\",\n        [\"-c\", command],\n        {\n          cwd: this.config.workDir,\n          timeout,\n          maxBuffer: max,\n          encoding: \"utf-8\",\n          // #54 — scrub secret-like host env vars from the child by default.\n          env: resolveChildEnv({ policy: this.config.env }),\n        },\n        (error, stdout, stderr) => {\n          resolve(this.buildResult(error, stdout ?? \"\", stderr ?? \"\"));\n        },\n      );\n\n      // Safety: if child somehow doesn't callback\n      child.on(\"error\", () => {\n        resolve({ stdout: \"\", stderr: \"spawn error\", exitCode: 1, timedOut: false });\n      });\n    });\n  }\n\n  private buildResult(error: Error | null, stdout: string, stderr: string): ExecuteResult {\n    const timedOut = error !== null && \"killed\" in error && (error as { killed: boolean }).killed;\n    // #363 — the ONLY reliable signal that output was lost. Node caps the buffer AT `maxBuffer`, so\n    // for ASCII output the string comes back exactly at the cap and `truncateOutput`'s `> max` test\n    // never fires; a length comparison cannot tell a cut document from a complete one that happens\n    // to be that long. The child being killed for overflow can.\n    const overflowed =\n      error !== null && (error as { code?: unknown }).code === \"ERR_CHILD_PROCESS_STDIO_MAXBUFFER\";\n    return {\n      stdout: this.markIfCut(this.truncateOutput(stdout), overflowed),\n      stderr: this.markIfCut(this.truncateOutput(stderr), overflowed),\n      exitCode: timedOut ? 124 : error ? 1 : 0,\n      timedOut,\n    };\n  }\n\n  /**\n   * Append the `...(truncated)` marker `ExecuteResult` tells callers to branch on, when the child\n   * was killed for exceeding `maxOutputBytes` and this stream is the one sitting at the cap.\n   *\n   * `truncateOutput` has already run, so an output it marked is left alone rather than marked\n   * twice. Node does not say WHICH stream overflowed, so the stream at the cap is the one that\n   * lost data — the other, being shorter, is complete.\n   */\n  private markIfCut(output: string, overflowed: boolean): string {\n    if (!overflowed) return output;\n    if (output.endsWith(\"...(truncated)\")) return output;\n    const max = this.config.maxOutputBytes ?? 5 * 1024 * 1024;\n    return Buffer.byteLength(output) >= max ? `${output}\\n...(truncated)` : output;\n  }\n\n  async uploadFile(path: string, content: string | Buffer): Promise<void> {\n    const fullPath = path.startsWith(\"/\") ? path : `${this.config.workDir}/${path}`;\n    await mkdir(dirname(fullPath), { recursive: true });\n    await fsWriteFile(fullPath, content, \"utf-8\");\n  }\n}\n"]}

package/dist/{chunk-UDAKAE4Z.cjs → chunk-X4ZYEZPD.cjs}

@@ -1,11 +1,11 @@
 'use strict';
 
-var chunkYQ3XC6C2_cjs = require('./chunk-YQ3XC6C2.cjs');
+var chunkJVH3NNJ3_cjs = require('./chunk-JVH3NNJ3.cjs');
 var chunkCEGU5AVD_cjs = require('./chunk-CEGU5AVD.cjs');
 var chunkRNXXYF22_cjs = require('./chunk-RNXXYF22.cjs');
-var fs = require('fs');
-var promises = require('fs/promises');
-var path = require('path');
+var node_fs = require('node:fs');
+var promises = require('node:fs/promises');
+var node_path = require('node:path');
 
 var CLAUDE_CODE_EVENT_MAP = {
   PreToolUse: "preToolUse",
@@ -30,11 +30,11 @@ async function loadHookConfig(cwd, compatSources = []) {
   const merged = {};
   let sawAny = false;
   for (const path of hookConfigCandidates(cwd, compatSources)) {
-    if (!fs.existsSync(path)) continue;
+    if (!node_fs.existsSync(path)) continue;
     sawAny = true;
     mergeInto(merged, stampSource(await readHookFile(path), path));
   }
-  if (!sawAny && fs.existsSync(path.join(chunkYQ3XC6C2_cjs.theokitConfigRoot(cwd), "hooks"))) {
+  if (!sawAny && node_fs.existsSync(node_path.join(chunkJVH3NNJ3_cjs.theokitConfigRoot(cwd), "hooks"))) {
     warnOnce(
       "hooks-md-unsupported",
       "[theokit-sdk] .theokit/hooks/*.md hooks are no longer supported (ADR 0016) \u2014 migrate to a Claude-Code-shaped .theokit/hooks.json"
@@ -43,11 +43,11 @@ async function loadHookConfig(cwd, compatSources = []) {
   return merged;
 }
 function hookConfigCandidates(cwd, compatSources) {
-  const roots = chunkYQ3XC6C2_cjs.projectConfigRoots(cwd, compatSources, "hooks");
+  const roots = chunkJVH3NNJ3_cjs.projectConfigRoots(cwd, compatSources, "hooks");
   return [
-    ...roots.map((root) => path.join(root, "hooks.json")),
-    ...roots.map((root) => path.join(root, "settings.json")),
-    ...roots.map((root) => path.join(root, "settings.local.json"))
+    ...roots.map((root) => node_path.join(root, "hooks.json")),
+    ...roots.map((root) => node_path.join(root, "settings.json")),
+    ...roots.map((root) => node_path.join(root, "settings.local.json"))
   ];
 }
 function stampSource(config, sourcePath) {
@@ -179,5 +179,5 @@ function parseClaudeCodeCommand(raw, matcher, path, ccEvent) {
 exports.loadHookConfig = loadHookConfig;
 exports.warnFailureOnce = warnFailureOnce;
 exports.warnOnce = warnOnce;
-//# sourceMappingURL=chunk-UDAKAE4Z.cjs.map
-//# sourceMappingURL=chunk-UDAKAE4Z.cjs.map
+//# sourceMappingURL=chunk-X4ZYEZPD.cjs.map
+//# sourceMappingURL=chunk-X4ZYEZPD.cjs.map

package/dist/chunk-X4ZYEZPD.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/hooks/hooks-source.ts"],"names":["diag","diagFailure","existsSync","join","theokitConfigRoot","projectConfigRoots","readFile","ConfigurationError"],"mappings":";;;;;;;;;AA8DO,IAAM,qBAAA,GAA6D;AAAA,EACxE,UAAA,EAAY,YAAA;AAAA,EACZ,WAAA,EAAa,aAAA;AAAA,EACb,gBAAA,EAAkB,QAAA;AAAA,EAClB,IAAA,EAAM;AACR,CAAA;AA+BA,IAAM,MAAA,uBAAa,GAAA,EAAY;AAYxB,SAAS,QAAA,CAAS,KAAa,OAAA,EAAuB;AAC3D,EAAA,IAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,EAAG;AACrB,EAAA,MAAA,CAAO,IAAI,GAAG,CAAA;AACd,EAAAA,sBAAA,CAAK,GAAG,OAAO;AAAA,CAAI,CAAA;AACrB;AAoBO,SAAS,eAAA,CAAgB,KAAa,OAAA,EAAuB;AAClE,EAAA,IAAI,MAAA,CAAO,GAAA,CAAI,GAAG,CAAA,EAAG;AACrB,EAAA,MAAA,CAAO,IAAI,GAAG,CAAA;AACd,EAAAC,6BAAA,CAAY,GAAG,OAAO;AAAA,CAAI,CAAA;AAC5B;AAcA,eAAsB,cAAA,CACpB,GAAA,EACA,aAAA,GAAoD,EAAC,EAChC;AACrB,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,IAAI,MAAA,GAAS,KAAA;AACb,EAAA,KAAA,MAAW,IAAA,IAAQ,oBAAA,CAAqB,GAAA,EAAK,aAAa,CAAA,EAAG;AAC3D,IAAA,IAAI,CAACC,kBAAA,CAAW,IAAI,CAAA,EAAG;AACvB,IAAA,MAAA,GAAS,IAAA;AAIT,IAAA,SAAA,CAAU,QAAQ,WAAA,CAAY,MAAM,aAAa,IAAI,CAAA,EAAG,IAAI,CAAC,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,CAAC,UAAUA,kBAAA,CAAWC,cAAA,CAAKC,oCAAkB,GAAG,CAAA,EAAG,OAAO,CAAC,CAAA,EAAG;AAChE,IAAA,QAAA;AAAA,MACE,sBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAaA,SAAS,oBAAA,CACP,KACA,aAAA,EACU;AACV,EAAA,MAAM,KAAA,GAAQC,oCAAA,CAAmB,GAAA,EAAK,aAAA,EAAe,OAAO,CAAA;AAC5D,EAAA,OAAO;AAAA,IACL,GAAG,MAAM,GAAA,CAAI,CAAC,SAASF,cAAA,CAAK,IAAA,EAAM,YAAY,CAAC,CAAA;AAAA,IAC/C,GAAG,MAAM,GAAA,CAAI,CAAC,SAASA,cAAA,CAAK,IAAA,EAAM,eAAe,CAAC,CAAA;AAAA,IAClD,GAAG,MAAM,GAAA,CAAI,CAAC,SAASA,cAAA,CAAK,IAAA,EAAM,qBAAqB,CAAC;AAAA,GAC1D;AACF;AAQA,SAAS,WAAA,CAAY,QAAoB,UAAA,EAAgC;AACvE,EAAA,IAAI,MAAA,CAAO,KAAA,KAAU,MAAA,EAAW,OAAO,MAAA;AACvC,EAAA,MAAM,QAA0C,EAAC;AACjD,EAAA,KAAA,MAAW,CAAC,OAAO,QAAQ,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAA,EAGtD;AACH,IAAA,IAAI,aAAa,MAAA,EAAW;AAC5B,IAAA,KAAA,CAAM,KAAK,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,CAAC,OAAO,EAAE,UAAA,EAAY,GAAG,CAAA,EAAE,CAAE,CAAA;AAAA,EAC3D;AACA,EAAA,OAAO,EAAE,KAAA,EAAM;AACjB;AAWA,SAAS,SAAA,CAAU,QAAoB,MAAA,EAA0B;AAC/D,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,QAAQ,CAAA,IAAK,MAAA,CAAO,QAAQ,MAAA,CAAO,KAAA,IAAS,EAAE,CAAA,EAG5D;AACH,IAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG;AACrD,IAAA,MAAA,CAAO,UAAU,EAAC;AAClB,IAAA,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,GAAI,CAAC,GAAI,MAAA,CAAO,KAAA,CAAM,KAAK,CAAA,IAAK,EAAC,EAAI,GAAG,QAAQ,CAAA;AAAA,EACpE;AACF;AAEA,eAAe,aAAa,QAAA,EAAuC;AACjE,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMG,iBAAA,CAAS,QAAA,EAAU,MAAM,CAAA;AAAA,EACvC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAIC,oCAAA,CAAmB,CAAA,6BAAA,EAAgC,QAAQ,CAAA,CAAA,EAAI;AAAA,MACvE,IAAA,EAAM,kBAAA;AAAA,MACN;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,8BAAA,EAAiC,QAAQ,CAAA,CAAA,EAAI;AAAA,MACxE,IAAA,EAAM,oBAAA;AAAA,MACN;AAAA,KACD,CAAA;AAAA,EACH;AACA,EAAA,OAAO,qBAAA,CAAsB,QAAQ,QAAQ,CAAA;AAC/C;AAYA,SAAS,QAAA,CACP,KAAA,EACA,IAAA,EACA,KAAA,EACA,IAAA,EACyB;AACzB,EAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACvE,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,CAAA,6BAAA,EAAgC,KAAK,CAAA,IAAA,EAAO,IAAI,CAAA,EAAG,SAAS,MAAA,GAAY,EAAA,GAAK,CAAA,QAAA,EAAM,IAAI,CAAA,CAAE,CAAA,CAAA;AAAA,MACzF,EAAE,MAAM,oBAAA;AAAqB,KAC/B;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAMA,IAAM,gBAAA,GACJ,+HAAA;AAIF,SAAS,OAAA,CAAQ,KAAA,EAAgB,IAAA,EAAc,KAAA,EAA0B;AACvE,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,4BAAA,EAA+B,KAAK,CAAA,IAAA,EAAO,IAAI,CAAA,CAAA,EAAI;AAAA,MAC9E,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AACA,EAAA,OAAO,KAAA;AACT;AAQA,SAAS,qBAAA,CAAsB,KAAc,IAAA,EAA0B;AACrE,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,GAAA,EAAK,IAAA,EAAM,UAAU,CAAA;AAC3C,EAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAW,OAAO,EAAC;AACtC,EAAA,MAAM,WAAW,QAAA,CAAS,IAAA,CAAK,KAAA,EAAO,IAAA,EAAM,WAAW,gBAAgB,CAAA;AACvE,EAAA,MAAM,UAAqD,EAAC;AAE5D,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,MAAM,KAAK,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAA,EAAG;AACxD,IAAA,MAAM,KAAA,GAAQ,sBAAsB,OAAO,CAAA;AAC3C,IAAA,IAAI,UAAU,MAAA,EAAW;AAGvB,MAAA,eAAA;AAAA,QACE,eAAe,OAAO,CAAA,CAAA;AAAA,QACtB,CAAA,4BAAA,EAA+B,OAAO,CAAA,8CAAA,EAAiD,MAAA,CAAO,KAAK,qBAAqB,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,iBAAA;AAAA,OACtI;AACA,MAAA;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,KAAK,CAAA,GAAI,CAAC,GAAI,QAAQ,KAAK,CAAA,IAAK,EAAC,EAAI,GAAG,kBAAA,CAAmB,MAAA,EAAQ,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,EAC3F;AACA,EAAA,OAAO,EAAE,OAAO,OAAA,EAAQ;AAC1B;AAGA,SAAS,kBAAA,CAAmB,MAAA,EAAiB,IAAA,EAAc,OAAA,EAAgC;AACzF,EAAA,MAAM,WAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,YAAY,OAAA,CAAQ,MAAA,EAAQ,MAAM,CAAA,MAAA,EAAS,OAAO,EAAE,CAAA,EAAG;AAChE,IAAA,MAAM,QAAQ,QAAA,CAAS,QAAA,EAAU,IAAA,EAAM,CAAA,MAAA,EAAS,OAAO,CAAA,EAAA,CAAI,CAAA;AAC3D,IAAA,MAAM,UAAU,KAAA,CAAM,OAAA,KAAY,SAAY,MAAA,GAAY,MAAA,CAAO,MAAM,OAAO,CAAA;AAC9E,IAAA,KAAA,MAAW,MAAA,IAAU,QAAQ,KAAA,CAAM,KAAA,EAAO,MAAM,CAAA,MAAA,EAAS,OAAO,UAAU,CAAA,EAAG;AAC3E,MAAA,QAAA,CAAS,KAAK,sBAAA,CAAuB,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,OAAO,CAAC,CAAA;AAAA,IACtE;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAmBO,IAAM,qCAAA,uBAA4C,GAAA,CAAI;AAAA,EAC3D,IAAA;AAAA,EACA,MAAA;AAAA,EACA,eAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAC,CAAA;AAOM,IAAM,uCAAuB,IAAI,GAAA,CAAI,CAAC,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAC,CAAA;AAU1E,SAAS,sBAAA,CAAuB,GAAA,EAA8B,IAAA,EAAc,OAAA,EAAuB;AACjG,EAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,EAAG;AAClC,IAAA,IAAI,oBAAA,CAAqB,GAAA,CAAI,GAAG,CAAA,EAAG;AACnC,IAAA,MAAM,MAAA,GAAS,sCAAsC,GAAA,CAAI,GAAG,IACxD,CAAA,SAAA,EAAO,GAAG,4FACK,CAAC,GAAG,qCAAqC,CAAA,CAAE,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,KAAM,GAAG,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAC7F,EAAA;AACJ,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,CAAA,MAAA,EAAS,OAAO,CAAA,qBAAA,EAAwB,GAAG,gBAAgB,CAAC,GAAG,oBAAoB,CAAA,CAAE,KAAK,IAAI,CAAC,CAAA,KAAA,EAAQ,IAAI,GAAG,MAAM,CAAA,CAAA;AAAA,MACpH,EAAE,MAAM,yBAAA;AAA0B,KACpC;AAAA,EACF;AACF;AAGA,SAAS,sBAAA,CACP,GAAA,EACA,OAAA,EACA,IAAA,EACA,OAAA,EACa;AACb,EAAA,MAAM,MAAM,QAAA,CAAS,GAAA,EAAK,IAAA,EAAM,CAAA,MAAA,EAAS,OAAO,CAAA,UAAA,CAAY,CAAA;AAC5D,EAAA,IAAI,GAAA,CAAI,SAAS,SAAA,EAAW;AAC1B,IAAA,MAAM,IAAIA,oCAAA;AAAA,MACR,uDAAuD,IAAA,CAAK,SAAA,CAAU,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAA,CAAA;AAAA,MAC3F,EAAE,MAAM,wBAAA;AAAyB,KACnC;AAAA,EACF;AACA,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC/D,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,+CAAA,EAAkD,IAAI,CAAA,CAAA,EAAI;AAAA,MACrF,IAAA,EAAM;AAAA,KACP,CAAA;AAAA,EACH;AAGA,EAAA,sBAAA,CAAuB,GAAA,EAAK,MAAM,OAAO,CAAA;AACzC,EAAA,MAAM,KAAkB,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,aAAa,OAAA,EAAQ;AACrE,EAAA,IAAI,OAAA,KAAY,MAAA,EAAW,EAAA,CAAG,OAAA,GAAU,OAAA;AACxC,EAAA,IAAI,OAAO,GAAA,CAAI,OAAA,KAAY,QAAA,IAAY,GAAA,CAAI,UAAU,CAAA,EAAG;AACtD,IAAA,EAAA,CAAG,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,UAAU,GAAI,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,EAAA;AACT","file":"chunk-X4ZYEZPD.cjs","sourcesContent":["/**\n * Single source of truth for loading the hooks config (ADR 0016 — reverses\n * D74/D77 for hooks: JSON is canonical again, in the Claude Code shape).\n *\n * `.theokit/hooks.json` (Claude-Code-shaped JSON) is the only supported form.\n * A stray legacy `.theokit/hooks/*.md` dir (no hooks.json) is NOT loaded — it\n * warns to migrate and yields no hooks. Absent both → empty config.\n *\n * Consumed by `hooks-executor.ts` (runtime dispatch).\n *\n * Config SHAPE is Claude Code's `settings.json` hooks:\n *   { \"hooks\": { \"PreToolUse\": [ { \"matcher\": \"shell\",\n *       \"hooks\": [ { \"type\": \"command\", \"command\": \"…\", \"timeout\": 30 } ] } ] } }\n *\n * The shape, not the event COVERAGE. Four of the thirty-three documented events are fired by this\n * runtime — see {@link CLAUDE_CODE_EVENT_MAP} for which, why the rest are refused rather than\n * mapped, and the order in which they should be added. An event outside the set is reported to the\n * operator rather than skipped in silence.\n *\n * @internal\n */\n\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { ConfigurationError } from \"../../../errors.js\";\nimport { diag, diagFailure } from \"../../diagnostics.js\";\nimport { projectConfigRoots, theokitConfigRoot } from \"../../persistence/paths.js\";\nimport type { CompatSourceDeclaration } from \"../compat/foreign-config-sources.js\";\n\n/** The five lifecycle events the SDK runtime actually fires. */\nexport type HookEvent = \"preRun\" | \"postRun\" | \"preToolUse\" | \"postToolUse\" | \"stop\";\n\n/**\n * The Claude Code event names this runtime actually FIRES, and the internal event each becomes.\n *\n * Exported so the supported set is stated rather than implied. It used to be private, and the\n * docblock above claimed a shape \"identical to Claude Code's `settings.json` hooks\" while accepting\n * four of the thirty-three documented events — a claim nothing could contradict.\n *\n * A Claude Code event with no firing point here — `SessionStart`, `SubagentStop`, `PreCompact`,\n * `Notification`, `SessionEnd` among them — is skipped with a report rather than silently accepted,\n * because it would never run.\n *\n * ## Why this map is not simply grown\n *\n * Mapping a name the runtime does not fire is strictly WORSE than refusing it. An operator declaring\n * `PreCompact` today gets a report saying it will not fire; with the name mapped they would get\n * silence and a guard that never runs — a declared veto that does not exist. The map grows when the\n * seam exists, one event at a time.\n *\n * ## Priority, when it does grow\n *\n * The blocking events first. An unwired veto loses a CAPABILITY; an unwired observer loses a\n * SIGNAL. Thirteen of the sixteen the spec marks \"Can block? Yes\" are unwired, and\n * `tests/internal/runtime/hooks/the-supported-event-set-is-stated.test.ts` lists them in the order\n * they should be taken, so the next person does not re-derive which is which.\n *\n * `postRun` is reachable through this SDK's own config and has no entry here on purpose: it fires\n * per RUN, and no documented Claude Code event means that. `SessionEnd` is the near miss, and a\n * session is not a run.\n */\nexport const CLAUDE_CODE_EVENT_MAP: Readonly<Record<string, HookEvent>> = {\n  PreToolUse: \"preToolUse\",\n  PostToolUse: \"postToolUse\",\n  UserPromptSubmit: \"preRun\",\n  Stop: \"stop\",\n};\n\nexport interface HookCommand {\n  command: string;\n  matcher?: string;\n  timeoutMs?: number;\n  /**\n   * #637 — the event key as written in the config file (`PreToolUse`), carried so the approval\n   * gate can report the vocabulary the consumer's stored fingerprint was taken against.\n   *\n   * REQUIRED, not optional: `parseClaudeCodeCommand` is the only producer of a `HookCommand` in\n   * this package, so every command has one. An optional field would hand every reader a fallback\n   * branch for a case that cannot occur — and if an in-memory producer is added later, required is\n   * what forces it to supply a value instead of inheriting a silent `undefined`.\n   */\n  sourceEvent: string;\n  /**\n   * The config file this command was declared in.\n   *\n   * Carried so the executor can supply the runtime contract the declaring DIALECT presumes — a\n   * command from `.claude/settings.json` is written against Claude Code's runtime and expects\n   * `$CLAUDE_PROJECT_DIR` to exist (#522). Absent for a command built in memory, which is native by\n   * construction.\n   */\n  sourcePath?: string;\n}\n\nexport interface HookConfig {\n  hooks?: Partial<Record<HookEvent, HookCommand[]>>;\n}\n\nconst warned = new Set<string>();\n\n/**\n * Emit a stderr warn once per process per unique key. Helps surface the\n * deprecation path without spamming when the loader is called many times\n * during a session (cron + send + skills all hit this).\n *\n * Note: spawned workers (cron, subagent) start fresh processes — warn\n * re-emits there, by design (1 per process boot, not per call).\n *\n * @internal\n */\nexport function warnOnce(key: string, message: string): void {\n  if (warned.has(key)) return;\n  warned.add(key);\n  diag(`${message}\\n`);\n}\n\n/**\n * A warn-once that is NOT dropped when the host installed no diagnostics sink.\n *\n * `diag` is silent by default and that is right for chatter — a library must not assume the host's\n * stderr is a free-form log, because in a TUI it is the render surface. A configuration the operator\n * WROTE and this runtime will not honour is not chatter. `diagFailure`'s own docblock records the\n * precedent, `theokit-sdk#189`: an MCP server failed to start, the only report went to `diag()`, the\n * embedding UI never read it, and \"the user saw an agent with missing tools and no reason given\".\n *\n * A dropped hook is that shape with a sharper edge, because the missing thing is a guard: the\n * operator declared a refusal, it silently does not exist, and nothing distinguishes that from a\n * refusal that ran and approved.\n *\n * The asymmetry that decides it is quoted from the same place: a corrupted frame is visible and\n * recoverable, while a silently dropped failure is neither.\n *\n * @internal\n */\nexport function warnFailureOnce(key: string, message: string): void {\n  if (warned.has(key)) return;\n  warned.add(key);\n  diagFailure(`${message}\\n`);\n}\n\n/** Reset for tests; not exported via barrel. @internal */\nexport function _resetWarnOnceForTests(): void {\n  warned.clear();\n}\n\n/**\n * Load hooks from `.theokit/hooks.json` (Claude-Code-shaped — the only supported\n * form). A stray legacy `.theokit/hooks/*.md` markdown dir (no `hooks.json`) is\n * NOT loaded — it emits a one-time migration warn and yields no hooks.\n *\n * @internal\n */\nexport async function loadHookConfig(\n  cwd: string,\n  compatSources: readonly CompatSourceDeclaration[] = [],\n): Promise<HookConfig> {\n  const merged: HookConfig = {};\n  let sawAny = false;\n  for (const path of hookConfigCandidates(cwd, compatSources)) {\n    if (!existsSync(path)) continue;\n    sawAny = true;\n    // Stamped at merge, where the file is still known. One line later the commands are pooled per\n    // event and every trace of which dialect declared them is gone — which is how a Claude Code\n    // command came to be run without Claude Code's runtime (#522).\n    mergeInto(merged, stampSource(await readHookFile(path), path));\n  }\n  if (!sawAny && existsSync(join(theokitConfigRoot(cwd), \"hooks\"))) {\n    warnOnce(\n      \"hooks-md-unsupported\",\n      \"[theokit-sdk] .theokit/hooks/*.md hooks are no longer supported (ADR 0016) — migrate to a Claude-Code-shaped .theokit/hooks.json\",\n    );\n  }\n  return merged;\n}\n\n/**\n * Every file that may declare hooks, in precedence order.\n *\n * `hooks.json` under each project config root, then the Claude Code CLI's own settings files — which\n * is where the CLI actually keeps hooks, so a repository set up for it presents its hooks here\n * without being converted. `settings.local.json` is the CLI's personal-override file and sits beside\n * the shared one rather than replacing it.\n *\n * The shape never needed translating: `parseClaudeCodeConfig` reads the `hooks` key off whatever\n * object it is given, and a settings file is that same object with other keys alongside.\n */\nfunction hookConfigCandidates(\n  cwd: string,\n  compatSources: readonly CompatSourceDeclaration[],\n): string[] {\n  const roots = projectConfigRoots(cwd, compatSources, \"hooks\");\n  return [\n    ...roots.map((root) => join(root, \"hooks.json\")),\n    ...roots.map((root) => join(root, \"settings.json\")),\n    ...roots.map((root) => join(root, \"settings.local.json\")),\n  ];\n}\n\n/**\n * Record which file each command came from.\n *\n * A command already carrying a `sourcePath` keeps it: nothing produces that today, and a nested\n * config that declared its own origin would be describing something this function cannot see.\n */\nfunction stampSource(config: HookConfig, sourcePath: string): HookConfig {\n  if (config.hooks === undefined) return config;\n  const hooks: NonNullable<HookConfig[\"hooks\"]> = {};\n  for (const [event, commands] of Object.entries(config.hooks) as [\n    HookEvent,\n    HookCommand[] | undefined,\n  ][]) {\n    if (commands === undefined) continue;\n    hooks[event] = commands.map((c) => ({ sourcePath, ...c }));\n  }\n  return { hooks };\n}\n\n/**\n * Append one source's commands onto the accumulator, per event.\n *\n * MERGED, not first-wins, and the distinction is deliberate. An agent or a skill is a NAMED\n * declaration: two files claiming one name collide, and the explicit namespace should win. Hooks are\n * unnamed lists — two files declaring `PreToolUse` are two sets of commands an operator wrote, and\n * keeping only one drops the other in silence, which is the failure class this package guards\n * against everywhere else.\n */\nfunction mergeInto(target: HookConfig, source: HookConfig): void {\n  for (const [event, commands] of Object.entries(source.hooks ?? {}) as [\n    HookEvent,\n    HookCommand[] | undefined,\n  ][]) {\n    if (commands === undefined || commands.length === 0) continue;\n    target.hooks ??= {};\n    target.hooks[event] = [...(target.hooks[event] ?? []), ...commands];\n  }\n}\n\nasync function readHookFile(jsonPath: string): Promise<HookConfig> {\n  let raw: string;\n  try {\n    raw = await readFile(jsonPath, \"utf8\");\n  } catch (cause) {\n    throw new ConfigurationError(`Failed to read hooks config: ${jsonPath}`, {\n      code: \"hooks_read_error\",\n      cause,\n    });\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (cause) {\n    throw new ConfigurationError(`Invalid JSON in hooks config: ${jsonPath}`, {\n      code: \"hooks_json_invalid\",\n      cause,\n    });\n  }\n  return parseClaudeCodeConfig(parsed, jsonPath);\n}\n\n/**\n * Narrow an unknown to a record, or throw a typed config error.\n *\n * `hint` names the shape that WOULD be accepted, and exists because the message without it names\n * only the validator's expectation. Measured on a consumer in 2026-09: a flat `hooks` array in a\n * `.theokit/settings.json` made this throw on every turn, and `expected an object at \"hooks\"` gave\n * the operator nothing to act on — the file parses fine for the product that wrote it, and it is\n * this independent read of the same path that fails. An error on a refusal path should carry the\n * fix, not the diagnosis.\n */\nfunction asRecord(\n  value: unknown,\n  path: string,\n  where: string,\n  hint?: string,\n): Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    throw new ConfigurationError(\n      `hooks: expected an object at ${where} in ${path}${hint === undefined ? \"\" : ` — ${hint}`}`,\n      { code: \"hooks_json_invalid\" },\n    );\n  }\n  return value as Record<string, unknown>;\n}\n\n/**\n * The shape this loader accepts, quoted back on the one refusal an operator is most likely to hit:\n * `hooks` keyed by event, each event an array of matcher groups.\n */\nconst HOOKS_SHAPE_HINT =\n  'hooks are keyed by event, e.g. { \"hooks\": { \"PreToolUse\": [ { \"hooks\": ' +\n  '[ { \"type\": \"command\", \"command\": \"…\" } ] } ] } }';\n\n/** Narrow an unknown to an array, or throw a typed config error. */\nfunction asArray(value: unknown, path: string, where: string): unknown[] {\n  if (!Array.isArray(value)) {\n    throw new ConfigurationError(`hooks: expected an array at ${where} in ${path}`, {\n      code: \"hooks_json_invalid\",\n    });\n  }\n  return value;\n}\n\n/**\n * Parse Claude Code's nested hooks config into the SDK's flat internal shape:\n * `{ hooks: { PreToolUse: [{ matcher?, hooks: [{ type:\"command\", command, timeout? }] }] } }`\n * → `{ hooks: { preToolUse: [{ command, matcher?, timeoutMs? }] } }`. Each group's\n * `matcher` applies to every command it wraps; `timeout` (seconds) → `timeoutMs`.\n */\nfunction parseClaudeCodeConfig(raw: unknown, path: string): HookConfig {\n  const root = asRecord(raw, path, \"the root\");\n  if (root.hooks === undefined) return {};\n  const hooksRec = asRecord(root.hooks, path, `\"hooks\"`, HOOKS_SHAPE_HINT);\n  const grouped: Partial<Record<HookEvent, HookCommand[]>> = {};\n\n  for (const [ccEvent, groups] of Object.entries(hooksRec)) {\n    const event = CLAUDE_CODE_EVENT_MAP[ccEvent];\n    if (event === undefined) {\n      // The operator wrote this event and it will not fire. Reported through the channel that\n      // survives an absent sink — see `warnFailureOnce`.\n      warnFailureOnce(\n        `hooks-event-${ccEvent}`,\n        `[theokit-sdk] hooks: event \"${ccEvent}\" is not fired by the SDK runtime (supported: ${Object.keys(CLAUDE_CODE_EVENT_MAP).join(\", \")}) — skipping`,\n      );\n      continue;\n    }\n    grouped[event] = [...(grouped[event] ?? []), ...flattenEventGroups(groups, path, ccEvent)];\n  }\n  return { hooks: grouped };\n}\n\n/** Flatten one Claude Code event's matcher-groups into internal HookCommands. */\nfunction flattenEventGroups(groups: unknown, path: string, ccEvent: string): HookCommand[] {\n  const commands: HookCommand[] = [];\n  for (const rawGroup of asArray(groups, path, `hooks.${ccEvent}`)) {\n    const group = asRecord(rawGroup, path, `hooks.${ccEvent}[]`);\n    const matcher = group.matcher === undefined ? undefined : String(group.matcher);\n    for (const rawCmd of asArray(group.hooks, path, `hooks.${ccEvent}[].hooks`)) {\n      commands.push(parseClaudeCodeCommand(rawCmd, matcher, path, ccEvent));\n    }\n  }\n  return commands;\n}\n\n/**\n * Fields a Claude Code hook entry may declare that this runtime does not implement.\n *\n * Listed rather than lumped into \"unknown\" because the two are different facts to the operator\n * reading the error: a typo is theirs to fix, and a field written for another runtime is a tree\n * that was never going to work here. The same split is made for subagent frontmatter, for the same\n * reason — an operator migrating a `.claude/` tree learned one key per round trip otherwise.\n *\n * `if` is the one that made refusal the right answer rather than a warning. Dropped, it fails OPEN:\n * a deny hook narrowed to one dangerous command shape silently becomes a deny hook over every call\n * of that tool. Every other field in this set loses a convenience; this one inverts the intent.\n *\n * Exported for the same reason {@link CLAUDE_CODE_EVENT_MAP} is: so the set is DERIVED by whoever\n * states it, rather than restated and left to drift. The README documents this list, and\n * `tests/the-readme-hooks-shape-matches-the-loader.test.ts` reads it from here — #638, where the\n * README told a consumer to validate \"against the shape above\" and no shape was above it.\n */\nexport const UNIMPLEMENTED_CLAUDE_CODE_HOOK_FIELDS = new Set([\n  \"if\",\n  \"args\",\n  \"statusMessage\",\n  \"once\",\n  \"async\",\n  \"asyncRewake\",\n  \"shell\",\n]);\n\n/**\n * What `parseClaudeCodeCommand` reads. Anything else is refused.\n *\n * Exported for the README gate — see the note on the set above.\n */\nexport const ACCEPTED_HOOK_FIELDS = new Set([\"type\", \"command\", \"timeout\"]);\n\n/**\n * Refuse a hook entry that declares a field this parser does not read.\n *\n * The parser used to take `type`, `command` and `timeout` and discard the rest in silence, while\n * `packages/agents` — reading the same file one layer up — already refused an unknown key loudly\n * through a `.strict()` schema. Two layers disagreeing about whether a field is an error is bad on\n * its own; the permissive one being the layer that actually runs the hook is the defect.\n */\nfunction rejectUnreadHookFields(cmd: Record<string, unknown>, path: string, ccEvent: string): void {\n  for (const key of Object.keys(cmd)) {\n    if (ACCEPTED_HOOK_FIELDS.has(key)) continue;\n    const origin = UNIMPLEMENTED_CLAUDE_CODE_HOOK_FIELDS.has(key)\n      ? ` — \"${key}\" is a Claude Code hook field that this runtime does not implement. The same ` +\n        `applies to: ${[...UNIMPLEMENTED_CLAUDE_CODE_HOOK_FIELDS].filter((f) => f !== key).join(\", \")}`\n      : \"\";\n    throw new ConfigurationError(\n      `hooks.${ccEvent}: unsupported field \"${key}\" (accepted: ${[...ACCEPTED_HOOK_FIELDS].join(\", \")}) in ${path}${origin}`,\n      { code: \"hooks_unsupported_field\" },\n    );\n  }\n}\n\n/** One `{ type:\"command\", command, timeout? }` entry → an internal HookCommand. */\nfunction parseClaudeCodeCommand(\n  raw: unknown,\n  matcher: string | undefined,\n  path: string,\n  ccEvent: string,\n): HookCommand {\n  const cmd = asRecord(raw, path, `hooks.${ccEvent}[].hooks[]`);\n  if (cmd.type !== \"command\") {\n    throw new ConfigurationError(\n      `hooks: only { \"type\": \"command\" } is supported (got ${JSON.stringify(cmd.type)}) in ${path}`,\n      { code: \"hooks_unsupported_type\" },\n    );\n  }\n  if (typeof cmd.command !== \"string\" || cmd.command.length === 0) {\n    throw new ConfigurationError(`hooks: \"command\" must be a non-empty string in ${path}`, {\n      code: \"hooks_invalid_command\",\n    });\n  }\n  // After the type/command checks, so a `{ type: \"http\", url }` entry still fails for its own\n  // reason rather than for its `url`.\n  rejectUnreadHookFields(cmd, path, ccEvent);\n  const hc: HookCommand = { command: cmd.command, sourceEvent: ccEvent };\n  if (matcher !== undefined) hc.matcher = matcher;\n  if (typeof cmd.timeout === \"number\" && cmd.timeout > 0) {\n    hc.timeoutMs = Math.round(cmd.timeout * 1000);\n  }\n  return hc;\n}\n"]}

package/dist/{chunk-QG4SXZ2A.cjs → chunk-XR6O6G3B.cjs}

@@ -1,12 +1,12 @@
 'use strict';
 
-var chunkUDAKAE4Z_cjs = require('./chunk-UDAKAE4Z.cjs');
+var chunkX4ZYEZPD_cjs = require('./chunk-X4ZYEZPD.cjs');
 var chunkKRD3GQAA_cjs = require('./chunk-KRD3GQAA.cjs');
-var chunkSWALPLFQ_cjs = require('./chunk-SWALPLFQ.cjs');
-var chunkSA6K24NB_cjs = require('./chunk-SA6K24NB.cjs');
-var os = require('os');
-var path = require('path');
-var promises = require('fs/promises');
+var chunkRTCO3USA_cjs = require('./chunk-RTCO3USA.cjs');
+var chunkMXJJMP4U_cjs = require('./chunk-MXJJMP4U.cjs');
+var node_os = require('node:os');
+var node_path = require('node:path');
+var promises = require('node:fs/promises');
 var zod = require('zod');
 
 var HEAD_RATIO = 0.7;
@@ -67,10 +67,10 @@ async function resolveImports(content, basePath, opts) {
 
 `;
   }
-  const baseDir = path.dirname(basePath);
+  const baseDir = node_path.dirname(basePath);
   return replaceAsync(content, IMPORT_RE, async (raw) => {
     const absolute = resolveImportPath(raw, baseDir);
-    if (opts.projectRoot !== void 0 && !chunkSA6K24NB_cjs.insideRoot(absolute, opts.projectRoot)) {
+    if (opts.projectRoot !== void 0 && !chunkMXJJMP4U_cjs.insideRoot(absolute, opts.projectRoot)) {
       return `[@import outside the project root, refused: ${raw}]`;
     }
     if (opts.visited.has(absolute)) {
@@ -91,12 +91,12 @@ async function resolveImports(content, basePath, opts) {
 }
 function resolveImportPath(raw, baseDir) {
   if (raw.startsWith("~/")) {
-    return path.resolve(path.join(os.homedir(), raw.slice(2)));
+    return node_path.resolve(node_path.join(node_os.homedir(), raw.slice(2)));
   }
-  if (path.isAbsolute(raw)) {
-    return path.resolve(raw);
+  if (node_path.isAbsolute(raw)) {
+    return node_path.resolve(raw);
   }
-  return path.resolve(path.join(baseDir, raw));
+  return node_path.resolve(node_path.join(baseDir, raw));
 }
 async function replaceAsync(content, re, replacer) {
   const matches = [];
@@ -185,12 +185,12 @@ function shouldActivate(fm, touchedFiles) {
 
 // src/internal/runtime/context/context-discovery-runner.ts
 async function runDiscovery(opts) {
-  const gitRoot = chunkSWALPLFQ_cjs.findGitRoot(opts.cwd);
-  const registry = opts.specs ?? chunkSWALPLFQ_cjs.DEFAULT_DISCOVERY_SPECS;
-  const specs = chunkSWALPLFQ_cjs.admittedSpecs(registry, opts.declaredCompatKinds);
-  const withheld = chunkSWALPLFQ_cjs.withheldSpecs(registry, opts.declaredCompatKinds);
+  const gitRoot = chunkRTCO3USA_cjs.findGitRoot(opts.cwd);
+  const registry = opts.specs ?? chunkRTCO3USA_cjs.DEFAULT_DISCOVERY_SPECS;
+  const specs = chunkRTCO3USA_cjs.admittedSpecs(registry, opts.declaredCompatKinds);
+  const withheld = chunkRTCO3USA_cjs.withheldSpecs(registry, opts.declaredCompatKinds);
   if (withheld.length > 0) {
-    chunkUDAKAE4Z_cjs.warnOnce(
+    chunkX4ZYEZPD_cjs.warnOnce(
       `context-withheld:${withheld.map((w) => w.id).join(",")}`,
       `[theokit-sdk] not loaded, no grant declared: ${withheld.map((w) => `${w.pattern} (declare '${w.grant}' in compatSources)`).join("; ")}`
     );
@@ -211,27 +211,27 @@ async function runDiscovery(opts) {
 }
 async function resolvePathsForSpec(spec, cwd, gitRoot) {
   if (spec.scope === "cwd-only") {
-    return chunkSWALPLFQ_cjs.walkUpForFile(cwd, spec.pattern, cwd);
+    return chunkRTCO3USA_cjs.walkUpForFile(cwd, spec.pattern, cwd);
   }
   if (spec.scope === "git-root-walk") {
-    return chunkSWALPLFQ_cjs.walkUpForFile(cwd, spec.pattern, gitRoot ?? cwd);
+    return chunkRTCO3USA_cjs.walkUpForFile(cwd, spec.pattern, gitRoot ?? cwd);
   }
-  return chunkSWALPLFQ_cjs.walkUpForGlob(cwd, spec.pattern);
+  return chunkRTCO3USA_cjs.walkUpForGlob(cwd, spec.pattern);
 }
-async function loadOneSource(spec, path$1, opts, gitRoot) {
-  const relPath = path.relative(gitRoot ?? opts.cwd, path.dirname(path$1));
+async function loadOneSource(spec, path, opts, gitRoot) {
+  const relPath = node_path.relative(gitRoot ?? opts.cwd, node_path.dirname(path));
   const needsSuffix = spec.scope !== "cwd-only" && relPath !== "" && relPath !== ".";
   const id = needsSuffix ? `${spec.id}@${relPath}` : spec.id;
   if (spec.parser === "mdc") {
-    return loadMdcSource(spec, path$1, id, opts);
+    return loadMdcSource(spec, path, id, opts);
   }
   if (spec.parser === "rules-frontmatter") {
-    return loadRulesSource(spec, path$1, id, opts);
+    return loadRulesSource(spec, path, id, opts);
   }
   if (spec.parser === "frontmatter-zod") {
     return void 0;
   }
-  return loadPlainMarkdownSource(spec, path$1, id, opts, gitRoot);
+  return loadPlainMarkdownSource(spec, path, id, opts, gitRoot);
 }
 async function loadParsedSource(spec, path, id, parse, isActive) {
   let raw;
@@ -293,5 +293,5 @@ exports.resolveImports = resolveImports;
 exports.runDiscovery = runDiscovery;
 exports.shouldActivateRule = shouldActivateRule;
 exports.truncateWithMarker = truncateWithMarker;
-//# sourceMappingURL=chunk-QG4SXZ2A.cjs.map
-//# sourceMappingURL=chunk-QG4SXZ2A.cjs.map
+//# sourceMappingURL=chunk-XR6O6G3B.cjs.map
+//# sourceMappingURL=chunk-XR6O6G3B.cjs.map

package/dist/chunk-XR6O6G3B.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/runtime/context/context-loaders.ts","../src/internal/runtime/context/context-import-resolver.ts","../src/internal/runtime/context/context-glob.ts","../src/internal/runtime/context/context-rules-frontmatter.ts","../src/internal/runtime/context/context-mdc-parser.ts","../src/internal/runtime/context/context-discovery-runner.ts"],"names":["readFile","dirname","insideRoot","resolvePath","join","homedir","isAbsolute","z","splitFrontmatter","parseSimpleYaml","findGitRoot","DEFAULT_DISCOVERY_SPECS","admittedSpecs","withheldSpecs","warnOnce","walkUpForFile","walkUpForGlob","relative"],"mappings":";;;;;;;;;;;AAaA,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,UAAA,GAAa,GAAA;AACnB,IAAM,MAAA,GAAS,sCAAA;AAGR,IAAM,0BAAA,GAA6B;AAqCnC,SAAS,kBAAA,CAAmB,SAAiB,GAAA,EAA6B;AAC/E,EAAA,IAAI,OAAA,CAAQ,UAAU,GAAA,EAAK;AACzB,IAAA,OAAO,EAAE,SAAA,EAAW,KAAA,EAAO,YAAA,EAAc,OAAA,EAAQ;AAAA,EACnD;AAEA,EAAA,IAAI,GAAA,IAAO,OAAO,MAAA,EAAQ;AACxB,IAAA,OAAO,EAAE,WAAW,IAAA,EAAM,YAAA,EAAc,QAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,EAAE;AAAA,EAChE;AACA,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA;AAC5B,EAAA,MAAM,YAAY,IAAA,CAAK,KAAA,CAAM,MAAA,IAAU,UAAA,IAAc,aAAa,UAAA,CAAA,CAAY,CAAA;AAC9E,EAAA,MAAM,YAAY,MAAA,GAAS,SAAA;AAC3B,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,IAAA;AAAA,IACX,YAAA,EAAc,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,SAAS,IAAI,MAAA,GAAS,OAAA,CAAQ,KAAA,CAAM,CAAC,SAAS;AAAA,GAC/E;AACF;AAWA,eAAsB,iBAAA,CACpB,OAAA,EACA,IAAA,GAAqC,EAAC,EACH;AACnC,EAAA,MAAM,GAAA,GAAM,KAAK,eAAA,IAAmB,0BAAA;AACpC,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI;AACF,IAAA,OAAA,GAAU,MAAMA,iBAAA,CAAS,OAAA,EAAS,MAAM,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,EAAE,SAAA,EAAW,YAAA,EAAa,GAAI,kBAAA,CAAmB,SAAS,GAAG,CAAA;AACnE,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,qBAAA,CAAsB,OAAO,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,OAAA;AAAA,IACR,OAAA,EAAS,YAAA;AAAA,IACT,eAAe,OAAA,CAAQ,MAAA;AAAA,IACvB;AAAA,GACF;AACF;AAUA,SAAS,sBAAsB,MAAA,EAAsB;AAGnD,EAAA,MAAM,SACJ,UAAA,CACA,gBAAA;AACF,EAAA,IAAI,MAAA,EAAQ,QAAQ,MAAA,EAAW;AAC/B,EAAA,IAAI;AACF,IAAA,MAAA,CAAO,GAAA,CAAI,yBAAA,EAA2B,EAAE,IAAA,EAAM,QAAQ,CAAA;AAAA,EACxD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;;;ACtGA,IAAM,SAAA,GAAY,eAAA;AAClB,IAAM,QAAA,GAAW,CAAA;AAwCjB,eAAsB,cAAA,CACpB,OAAA,EACA,QAAA,EACA,IAAA,EACiB;AACjB,EAAA,IAAI,IAAA,CAAK,SAAS,QAAA,EAAU;AAC1B,IAAA,OAAO,GAAG,OAAO;;AAAA,2BAAA,EAA6B,QAAQ,CAAA;;AAAA,CAAA;AAAA,EACxD;AACA,EAAA,MAAM,OAAA,GAAUC,kBAAQ,QAAQ,CAAA;AAChC,EAAA,OAAO,YAAA,CAAa,OAAA,EAAS,SAAA,EAAW,OAAO,GAAA,KAAQ;AACrD,IAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,GAAA,EAAK,OAAO,CAAA;AAK/C,IAAA,IAAI,IAAA,CAAK,gBAAgB,MAAA,IAAa,CAACC,6BAAW,QAAA,EAAU,IAAA,CAAK,WAAW,CAAA,EAAG;AAC7E,MAAA,OAAO,+CAA+C,GAAG,CAAA,CAAA,CAAA;AAAA,IAC3D;AACA,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA,EAAG;AAC9B,MAAA,OAAO,4BAA4B,GAAG,CAAA,CAAA,CAAA;AAAA,IACxC;AACA,IAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,QAAQ,CAAA;AACzB,IAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,QAAA,EAAU,EAAE,eAAA,EAAiB,IAAA,CAAK,iBAAiB,CAAA;AAC1F,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,OAAO,uBAAuB,GAAG,CAAA,CAAA,CAAA;AAAA,IACnC;AAIA,IAAA,OAAO,cAAA,CAAe,MAAA,CAAO,OAAA,EAAS,QAAA,EAAU;AAAA,MAC9C,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,KAAA,EAAO,KAAK,KAAA,GAAQ,CAAA;AAAA,MACpB,iBAAiB,IAAA,CAAK,eAAA;AAAA,MACtB,GAAI,KAAK,WAAA,KAAgB,MAAA,GAAY,EAAC,GAAI,EAAE,WAAA,EAAa,IAAA,CAAK,WAAA;AAAY,KAC3E,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAEA,SAAS,iBAAA,CAAkB,KAAa,OAAA,EAAyB;AAC/D,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAI,CAAA,EAAG;AACxB,IAAA,OAAOC,iBAAA,CAAYC,eAAKC,eAAA,EAAQ,EAAG,IAAI,KAAA,CAAM,CAAC,CAAC,CAAC,CAAA;AAAA,EAClD;AACA,EAAA,IAAIC,oBAAA,CAAW,GAAG,CAAA,EAAG;AACnB,IAAA,OAAOH,kBAAY,GAAG,CAAA;AAAA,EACxB;AACA,EAAA,OAAOA,iBAAA,CAAYC,cAAA,CAAK,OAAA,EAAS,GAAG,CAAC,CAAA;AACvC;AAQA,eAAe,YAAA,CACb,OAAA,EACA,EAAA,EACA,QAAA,EACiB;AACjB,EAAA,MAAM,UAAgE,EAAC;AAEvE,EAAA,MAAM,UAAU,IAAI,MAAA,CAAO,EAAA,CAAG,MAAA,EAAQ,GAAG,KAAK,CAAA;AAC9C,EAAA,IAAI,CAAA;AAEJ,EAAA,OAAA,CAAQ,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,OAAO,OAAO,IAAA,EAAM;AAC3C,IAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,CAAA,CAAE,CAAC,CAAA,EAAG,GAAA,EAAK,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA,EAAI,KAAA,EAAO,CAAA,CAAE,OAAO,CAAA;AAC7D,IAAA,IAAI,CAAA,CAAE,KAAA,KAAU,OAAA,CAAQ,SAAA,UAAmB,SAAA,IAAa,CAAA;AAAA,EAC1D;AACA,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,OAAA;AACjC,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,OAAA,EAAS;AAC3B,IAAA,MAAA,IAAU,OAAA,CAAQ,KAAA,CAAM,MAAA,EAAQ,KAAA,CAAM,KAAK,CAAA;AAC3C,IAAA,MAAA,IAAU,MAAM,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA;AAClC,IAAA,MAAA,GAAS,KAAA,CAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,CAAM,MAAA;AAAA,EACrC;AACA,EAAA,MAAA,IAAU,OAAA,CAAQ,MAAM,MAAM,CAAA;AAC9B,EAAA,OAAO,MAAA;AACT;;;ACnIO,SAAS,YAAY,IAAA,EAAsB;AAMhD,EAAA,MAAM,QAAA,GAAW,IAAA,CACd,OAAA,CAAQ,mBAAA,EAAqB,MAAM,CAAA,CACnC,OAAA,CAAQ,SAAA,EAAW,oBAAoB,CAAA,CACvC,OAAA,CAAQ,OAAA,EAAS,cAAc,CAAA,CAC/B,OAAA,CAAQ,KAAA,EAAO,OAAO,CAAA,CACtB,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAA,CACrB,OAAA,CAAQ,qBAAA,EAAuB,UAAU,CAAA,CACzC,OAAA,CAAQ,eAAA,EAAiB,IAAI,CAAA;AAChC,EAAA,OAAO,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA,CAAG,CAAA;AACnC;AAQO,SAAS,cAAA,CACd,UACA,KAAA,EACS;AACT,EAAA,IAAI,SAAS,MAAA,KAAW,CAAA,IAAK,KAAA,CAAM,MAAA,KAAW,GAAG,OAAO,KAAA;AACxD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,GAAA,CAAI,WAAW,CAAA;AACpC,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,GAAA,CAAI,IAAA,CAAK,CAAC,EAAA,KAAO,EAAA,CAAG,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA;AACvD;;;ACKO,IAAM,sBAAA,GAAyBG,MAAE,MAAA,CAAO;AAAA,EAC7C,WAAA,EAAaA,KAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,OAAOA,KAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACpC,OAAOA,KAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACpC,WAAA,EAAaA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAClC,OAAA,EAASA,KAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AACvB,CAAC,CAAA;AA6BM,SAAS,WAAW,OAAA,EAA+C;AACxE,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAIC,mCAAiB,OAAO,CAAA;AAC/C,EAAA,IAAI,SAAS,MAAA,EAAW;AACtB,IAAA,OAAO,EAAE,WAAA,EAAa,EAAE,aAAa,IAAA,EAAK,EAAG,MAAM,OAAA,EAAQ;AAAA,EAC7D;AACA,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAASC,kCAAgB,IAAI,CAAA;AACnC,IAAA,MAAM,SAAA,GAAY,sBAAA,CAAuB,SAAA,CAAU,MAAM,CAAA;AACzD,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA,EAAS,OAAO,KAAA,CAAA;AAC/B,IAAA,OAAO,EAAE,WAAA,EAAa,SAAA,CAAU,IAAA,EAAM,IAAA,EAAK;AAAA,EAC7C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AA0BO,SAAS,kBAAA,CACd,IACA,YAAA,EACS;AACT,EAAA,IAAI,EAAA,CAAG,OAAA,KAAY,KAAA,EAAO,OAAO,KAAA;AACjC,EAAA,IAAI,EAAA,CAAG,WAAA,KAAgB,IAAA,EAAM,OAAO,IAAA;AACpC,EAAA,MAAM,QAAA,GAAW,CAAC,GAAI,EAAA,CAAG,KAAA,IAAS,EAAC,EAAI,GAAI,EAAA,CAAG,KAAA,IAAS,EAAG,CAAA;AAC1D,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAClC,EAAA,OAAO,cAAA,CAAe,UAAU,YAAY,CAAA;AAC9C;ACtGO,IAAM,oBAAA,GAAuBF,MAAE,MAAA,CAAO;AAAA,EAC3C,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACjC,OAAOA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACpC,WAAA,EAAaA,KAAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAC3B,CAAC,CAAA;AAmBM,SAAS,SAAS,OAAA,EAA6C;AACpE,EAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAIC,mCAAiB,OAAO,CAAA;AAC/C,EAAA,IAAI,SAAS,MAAA,EAAW;AAEtB,IAAA,OAAO,EAAE,WAAA,EAAa,EAAE,aAAa,IAAA,EAAK,EAAG,MAAM,OAAA,EAAQ;AAAA,EAC7D;AACA,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAASC,kCAAgB,IAAI,CAAA;AACnC,IAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,SAAA,CAAU,MAAM,CAAA;AACvD,IAAA,IAAI,CAAC,SAAA,CAAU,OAAA,EAAS,OAAO,KAAA,CAAA;AAC/B,IAAA,OAAO,EAAE,WAAA,EAAa,SAAA,CAAU,IAAA,EAAM,IAAA,EAAK;AAAA,EAC7C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AASO,SAAS,cAAA,CAAe,IAAoB,YAAA,EAA8C;AAC/F,EAAA,IAAI,EAAA,CAAG,WAAA,KAAgB,IAAA,EAAM,OAAO,IAAA;AACpC,EAAA,IAAI,GAAG,KAAA,KAAU,MAAA,IAAa,GAAG,KAAA,CAAM,MAAA,KAAW,GAAG,OAAO,KAAA;AAC5D,EAAA,OAAO,cAAA,CAAe,EAAA,CAAG,KAAA,EAAO,YAAY,CAAA;AAC9C;;;ACmCA,eAAsB,aAAa,IAAA,EAA2D;AAC5F,EAAA,MAAM,OAAA,GAAUC,6BAAA,CAAY,IAAA,CAAK,GAAG,CAAA;AACpC,EAAA,MAAM,QAAA,GAAW,KAAK,KAAA,IAASC,yCAAA;AAC/B,EAAA,MAAM,KAAA,GAAQC,+BAAA,CAAc,QAAA,EAAU,IAAA,CAAK,mBAAmB,CAAA;AAS9D,EAAA,MAAM,QAAA,GAAWC,+BAAA,CAAc,QAAA,EAAU,IAAA,CAAK,mBAAmB,CAAA;AACjE,EAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,IAAAC,0BAAA;AAAA,MACE,CAAA,iBAAA,EAAoB,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,EAAE,CAAA,CAAE,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAAA,MACvD,CAAA,6CAAA,EAAgD,QAAA,CAC7C,GAAA,CAAI,CAAC,MAAM,CAAA,EAAG,CAAA,CAAE,OAAO,CAAA,WAAA,EAAc,EAAE,KAAK,CAAA,mBAAA,CAAqB,CAAA,CACjE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KACf;AAAA,EACF;AACA,EAAA,MAAM,MAA0B,EAAC;AACjC,EAAA,MAAM,QAAA,uBAAe,GAAA,EAAY;AAEjC,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,IAAA,CAAK,wBAAA,IAA4B,IAAA,CAAK,EAAA,KAAO,iBAAA,EAAmB;AACpE,IAAA,MAAM,QAAQ,MAAM,mBAAA,CAAoB,IAAA,EAAM,IAAA,CAAK,KAAK,OAAO,CAAA;AAC/D,IAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,MAAA,IAAI,QAAA,CAAS,GAAA,CAAI,IAAI,CAAA,EAAG;AACxB,MAAA,QAAA,CAAS,IAAI,IAAI,CAAA;AACjB,MAAA,MAAM,SAAS,MAAM,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,MAAM,OAAO,CAAA;AAC5D,MAAA,IAAI,MAAA,KAAW,MAAA,EAAW,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AAAA,IAC3C;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAEA,eAAe,mBAAA,CACb,IAAA,EACA,GAAA,EACA,OAAA,EACmB;AACnB,EAAA,IAAI,IAAA,CAAK,UAAU,UAAA,EAAY;AAC7B,IAAA,OAAOC,+BAAA,CAAc,GAAA,EAAK,IAAA,CAAK,OAAA,EAAS,GAAG,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,IAAA,CAAK,UAAU,eAAA,EAAiB;AAClC,IAAA,OAAOA,+BAAA,CAAc,GAAA,EAAK,IAAA,CAAK,OAAA,EAAS,WAAW,GAAG,CAAA;AAAA,EACxD;AAEA,EAAA,OAAOC,+BAAA,CAAc,GAAA,EAAK,IAAA,CAAK,OAAO,CAAA;AACxC;AAEA,eAAe,aAAA,CACb,IAAA,EACA,IAAA,EACA,IAAA,EACA,OAAA,EACuC;AAKvC,EAAA,MAAM,UAAUC,kBAAA,CAAS,OAAA,IAAW,KAAK,GAAA,EAAKhB,iBAAAA,CAAQ,IAAI,CAAC,CAAA;AAC3D,EAAA,MAAM,cAAc,IAAA,CAAK,KAAA,KAAU,UAAA,IAAc,OAAA,KAAY,MAAM,OAAA,KAAY,GAAA;AAC/E,EAAA,MAAM,EAAA,GAAK,cAAc,CAAA,EAAG,IAAA,CAAK,EAAE,CAAA,CAAA,EAAI,OAAO,KAAK,IAAA,CAAK,EAAA;AAExD,EAAA,IAAI,IAAA,CAAK,WAAW,KAAA,EAAO;AACzB,IAAA,OAAO,aAAA,CAAc,IAAA,EAAM,IAAA,EAAM,EAAA,EAAI,IAAI,CAAA;AAAA,EAC3C;AACA,EAAA,IAAI,IAAA,CAAK,WAAW,mBAAA,EAAqB;AACvC,IAAA,OAAO,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,EAAA,EAAI,IAAI,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,IAAA,CAAK,WAAW,iBAAA,EAAmB;AAIrC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,uBAAA,CAAwB,IAAA,EAAM,IAAA,EAAM,EAAA,EAAI,MAAM,OAAO,CAAA;AAC9D;AAQA,eAAe,gBAAA,CACb,IAAA,EACA,IAAA,EACA,EAAA,EACA,OACA,QAAA,EACuC;AACvC,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,MAAMD,iBAAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,MAAA,GAAS,MAAM,GAAG,CAAA;AACxB,EAAA,IAAI,WAAW,MAAA,IAAa,CAAC,SAAS,MAAA,CAAO,WAAW,GAAG,OAAO,MAAA;AAClE,EAAA,OAAO,EAAE,EAAA,EAAI,MAAA,EAAQ,IAAA,EAAM,OAAA,EAAS,MAAA,CAAO,IAAA,EAAM,QAAA,EAAU,IAAA,CAAK,QAAA,EAAU,SAAA,EAAW,KAAA,EAAM;AAC7F;AAEA,SAAS,aAAA,CACP,IAAA,EACA,IAAA,EACA,EAAA,EACA,IAAA,EACuC;AACvC,EAAA,OAAO,gBAAA;AAAA,IAAiB,IAAA;AAAA,IAAM,IAAA;AAAA,IAAM,EAAA;AAAA,IAAI,QAAA;AAAA,IAAU,CAAC,EAAA,KACjD,cAAA,CAAe,IAAI,IAAA,CAAK,YAAA,IAAgB,EAAE;AAAA,GAC5C;AACF;AAEA,SAAS,eAAA,CACP,IAAA,EACA,IAAA,EACA,EAAA,EACA,IAAA,EACuC;AACvC,EAAA,OAAO,gBAAA;AAAA,IAAiB,IAAA;AAAA,IAAM,IAAA;AAAA,IAAM,EAAA;AAAA,IAAI,UAAA;AAAA,IAAY,CAAC,EAAA,KACnD,kBAAA,CAAmB,IAAI,IAAA,CAAK,YAAA,IAAgB,EAAE;AAAA,GAChD;AACF;AAEA,eAAe,uBAAA,CACb,IAAA,EACA,IAAA,EACA,EAAA,EACA,MACA,OAAA,EACuC;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,IAAA,EAAM,EAAE,eAAA,EAAiB,IAAA,CAAK,iBAAiB,CAAA;AACtF,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,IAAI,UAAU,MAAA,CAAO,OAAA;AACrB,EAAA,IAAI,KAAK,aAAA,EAAe;AACtB,IAAA,OAAA,GAAU,MAAM,cAAA,CAAe,OAAA,EAAS,IAAA,EAAM;AAAA,MAC5C,OAAA,kBAAS,IAAI,GAAA,CAAI,CAAC,IAAI,CAAC,CAAA;AAAA,MACvB,KAAA,EAAO,CAAA;AAAA,MACP,iBAAiB,IAAA,CAAK,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAKtB,WAAA,EAAa,IAAA,CAAK,UAAA,IAAc,OAAA,IAAW,IAAA,CAAK;AAAA,KACjD,CAAA;AAAA,EACH;AACA,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,MAAA,EAAQ,IAAA;AAAA,IACR,OAAA;AAAA,IACA,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,WAAW,MAAA,CAAO;AAAA,GACpB;AACF","file":"chunk-XR6O6G3B.cjs","sourcesContent":["/**\n * Context file loaders + truncation (T1.2, ADRs D154 / D155 / D159).\n *\n * Reads context source files from disk, applies the per-file size cap\n * with 70%/20% head/tail truncation, and emits the\n * `context_files_truncated` telemetry counter when the cap fires.\n * Pure (no I/O) for `truncateWithMarker` — testable in isolation.\n *\n * @internal\n */\n\nimport { readFile } from \"node:fs/promises\";\n\nconst HEAD_RATIO = 0.7;\nconst TAIL_RATIO = 0.2;\nconst MARKER = \"\\n\\n…[truncated by theokit]\\n\\n\";\n\n/** Default per-file cap (40k chars ≈ 10k tokens). D155. */\nexport const DEFAULT_MAX_BYTES_PER_FILE = 40_000;\n\nexport interface LoadedSource {\n  /** Absolute path the content came from. */\n  readonly source: string;\n  readonly content: string;\n  readonly originalBytes: number;\n  readonly truncated: boolean;\n}\n\nexport interface TruncateResult {\n  readonly truncated: boolean;\n  readonly finalContent: string;\n}\n\n/**\n * Cap `content` at `max` characters with 70%/20% head/tail truncation\n * and an explicit marker. Pure — no I/O, no telemetry.\n *\n * EC-C: when `max <= MARKER.length`, skip the marker entirely and\n * return a head-only slice. Without this guard, `budget = max -\n * MARKER.length` would go negative and `content.slice(-tailBytes)`\n * would slice from the END of the string rather than truncating.\n *\n * EC-H: codepoint integrity — `String.slice()` operates on UTF-16\n * code units, which can split surrogate pairs. We accept that\n * trailing/leading replacement chars (U+FFFD) may appear at boundaries.\n * Modern LLMs tolerate them; byte-exact safety would require Buffer\n * slicing + TextDecoder with `fatal: true` retry, which adds complexity\n * without value.\n *\n * Deliberately untagged for the public surface. A tag was here and no entry exported it, so the\n * docblock promised a symbol\n * nobody could import. Exporting it was the other option and the wrong one: this is a pure\n * truncation helper whose docblock describes implementation edge cases (EC-C, EC-H), not a\n * contract — and an export is a semver commitment somebody then has to keep.\n */\nexport function truncateWithMarker(content: string, max: number): TruncateResult {\n  if (content.length <= max) {\n    return { truncated: false, finalContent: content };\n  }\n  // EC-C: max too small to fit even the marker — return head-only slice.\n  if (max <= MARKER.length) {\n    return { truncated: true, finalContent: content.slice(0, max) };\n  }\n  const budget = max - MARKER.length;\n  const headBytes = Math.floor(budget * (HEAD_RATIO / (HEAD_RATIO + TAIL_RATIO)));\n  const tailBytes = budget - headBytes;\n  return {\n    truncated: true,\n    finalContent: content.slice(0, headBytes) + MARKER + content.slice(-tailBytes),\n  };\n}\n\n/**\n * Read a file from disk and apply the per-file cap. Emits telemetry\n * counter when truncation fires.\n *\n * EC-G: file deleted between discovery and read (FS race) → returns\n * `undefined`, never throws.\n *\n * @internal\n */\nexport async function loadPlainMarkdown(\n  absPath: string,\n  opts: { maxBytesPerFile?: number } = {},\n): Promise<LoadedSource | undefined> {\n  const max = opts.maxBytesPerFile ?? DEFAULT_MAX_BYTES_PER_FILE;\n  let content: string;\n  try {\n    content = await readFile(absPath, \"utf8\");\n  } catch {\n    // EC-G: ENOENT / EACCES / etc → caller treats as missing.\n    return undefined;\n  }\n  const { truncated, finalContent } = truncateWithMarker(content, max);\n  if (truncated) {\n    emitTruncationCounter(absPath);\n  }\n  return {\n    source: absPath,\n    content: finalContent,\n    originalBytes: content.length,\n    truncated,\n  };\n}\n\n/**\n * EC-L: telemetry no-op when OTel is not imported. We import the tracer\n * lazily and use `safeCall` so the lookup never throws and never pulls\n * OTel into the import graph for users without `@opentelemetry/api`\n * installed.\n *\n * @internal\n */\nfunction emitTruncationCounter(source: string): void {\n  // Lazy resolution via globalThis avoids static import of telemetry/tracer.\n  // Tests can spy via the same path; production users without OTel see no-op.\n  const tracer = (\n    globalThis as { __theokit_tracer?: { inc?: (k: string, attrs: unknown) => void } }\n  ).__theokit_tracer;\n  if (tracer?.inc === undefined) return;\n  try {\n    tracer.inc(\"context_files_truncated\", { file: source });\n  } catch {\n    // Telemetry must never break the loader.\n  }\n}\n","/**\n * `@path/to/file` import resolver (T2.1, ADR D156).\n *\n * Anthropic/Gemini convention: lines that are EXACTLY `@path` get\n * replaced with the imported file's content, recursively (5-hop cap),\n * with cycle detection. Inline `see @x.md, also @y.md` references are\n * NOT resolved (EC-Q — own-line only, mirrors Anthropic's actual\n * behavior).\n *\n * EC-D fix: every imported file is itself capped at `maxBytesPerFile`\n * via `loadPlainMarkdown` BEFORE concatenation. Prevents a CLAUDE.md\n * with 5 imports of 30k each from ballooning to 150k of imported\n * content before the outer cap fires.\n *\n * @internal\n */\n\nimport { homedir } from \"node:os\";\nimport { dirname, isAbsolute, join, resolve as resolvePath } from \"node:path\";\nimport { insideRoot } from \"../../security/path-containment.js\";\nimport { loadPlainMarkdown } from \"./context-loaders.js\";\n\n/** EC-Q: line-anchored. `@path` must be alone on its line. */\nconst IMPORT_RE = /^@(\\S+)\\s*$/gm;\nconst MAX_HOPS = 5;\n\nexport interface ResolveImportsOptions {\n  /** Absolute paths already resolved (cycle detection). */\n  readonly visited: Set<string>;\n  /** Current recursion depth — caps at MAX_HOPS. */\n  readonly depth: number;\n  /** Per-import file cap (EC-D). Forwarded to loadPlainMarkdown. */\n  readonly maxBytesPerFile: number;\n  /**\n   * The directory an import may not escape. When set, a target resolving outside it is\n   * refused and replaced with a placeholder.\n   *\n   * The file carrying the import is REPOSITORY-CONTROLLED — `CLAUDE.md` and `GEMINI.md`\n   * are the two default specs with `followImports: true`, and both are found by\n   * `git-root-walk` inside the tree the agent was pointed at. Without a root, a cloned\n   * repository could name `@~/.ssh/id_rsa` or any absolute path and have its contents\n   * inlined into the system prompt, and from there sent to the model provider. The\n   * traversal guard that already existed (`isSafePattern`) guards the discovery PATTERN,\n   * not the import TARGET, so it never saw this.\n   *\n   * OPTIONAL, so a caller outside the discovery path keeps the previous behaviour rather\n   * than breaking on an upgrade. `runDiscovery` always supplies `gitRoot ?? cwd` — the\n   * same value it already uses to keep absolute paths out of `<source name=\"\">`.\n   */\n  readonly projectRoot?: string;\n}\n\n/**\n * Resolve `@path` directives in `content`. Each match is replaced with\n * the imported file content (already cap-truncated per EC-D), and\n * recursion continues on the resolved content until MAX_HOPS or cycle.\n *\n * Failure modes (placeholders, never throws):\n *  - file not found → `[@import not found: <path>]`\n *  - cycle detected → `[@import cycle detected: <path>]`\n *  - depth exceeded → trailing `\\n\\n…[@import depth limit 5 reached]\\n\\n`\n *\n * @internal\n */\nexport async function resolveImports(\n  content: string,\n  basePath: string,\n  opts: ResolveImportsOptions,\n): Promise<string> {\n  if (opts.depth >= MAX_HOPS) {\n    return `${content}\\n\\n…[@import depth limit ${MAX_HOPS} reached]\\n\\n`;\n  }\n  const baseDir = dirname(basePath);\n  return replaceAsync(content, IMPORT_RE, async (raw) => {\n    const absolute = resolveImportPath(raw, baseDir);\n    // Containment BEFORE the read. Reporting the refusal after loading the file would\n    // already have put the bytes in memory, and the placeholder names the path the author\n    // wrote rather than the resolved one — echoing `/home/<user>/.ssh/id_rsa` back into the\n    // prompt would leak the layout of the machine to the same untrusted document.\n    if (opts.projectRoot !== undefined && !insideRoot(absolute, opts.projectRoot)) {\n      return `[@import outside the project root, refused: ${raw}]`;\n    }\n    if (opts.visited.has(absolute)) {\n      return `[@import cycle detected: ${raw}]`;\n    }\n    opts.visited.add(absolute);\n    const loaded = await loadPlainMarkdown(absolute, { maxBytesPerFile: opts.maxBytesPerFile });\n    if (loaded === undefined) {\n      return `[@import not found: ${raw}]`;\n    }\n    // Recurse with same visited set + incremented depth. `projectRoot` is FORWARDED: an\n    // imported file is repository-controlled too, so a root that applied only at depth 0\n    // would be escapable in one extra hop.\n    return resolveImports(loaded.content, absolute, {\n      visited: opts.visited,\n      depth: opts.depth + 1,\n      maxBytesPerFile: opts.maxBytesPerFile,\n      ...(opts.projectRoot === undefined ? {} : { projectRoot: opts.projectRoot }),\n    });\n  });\n}\n\nfunction resolveImportPath(raw: string, baseDir: string): string {\n  if (raw.startsWith(\"~/\")) {\n    return resolvePath(join(homedir(), raw.slice(2)));\n  }\n  if (isAbsolute(raw)) {\n    return resolvePath(raw);\n  }\n  return resolvePath(join(baseDir, raw));\n}\n\n/**\n * Async equivalent of `String.prototype.replace` — sequential. Returns\n * `content` with every `re` match replaced by `await replacer(match)`.\n *\n * @internal\n */\nasync function replaceAsync(\n  content: string,\n  re: RegExp,\n  replacer: (raw: string) => Promise<string>,\n): Promise<string> {\n  const matches: Array<{ match: string; raw: string; index: number }> = [];\n  // Reset lastIndex; clone the regex to avoid stateful traps.\n  const localRe = new RegExp(re.source, re.flags);\n  let m: RegExpExecArray | null;\n  // biome-ignore lint/suspicious/noAssignInExpressions: idiomatic regex loop\n  while ((m = localRe.exec(content)) !== null) {\n    matches.push({ match: m[0], raw: m[1] ?? \"\", index: m.index });\n    if (m.index === localRe.lastIndex) localRe.lastIndex += 1;\n  }\n  if (matches.length === 0) return content;\n  let result = \"\";\n  let cursor = 0;\n  for (const entry of matches) {\n    result += content.slice(cursor, entry.index);\n    result += await replacer(entry.raw);\n    cursor = entry.index + entry.match.length;\n  }\n  result += content.slice(cursor);\n  return result;\n}\n","/**\n * Shared glob → RegExp compiler for context discovery (extracted from the\n * MDC parser so the `.cursor/rules/*.mdc` and `.theokit/rules/*.md` parsers\n * share ONE implementation — DRY, no new dependency).\n *\n * Supports `**` (any depth), `*` (single path segment, no `/`), `?` (single\n * non-separator char). Sufficient for the patterns Cursor and Claude Code\n * themselves recommend.\n *\n * @internal\n */\nexport function globToRegex(glob: string): RegExp {\n  // Support **/ (zero-or-more path segments), ** (any depth), * (single\n  // segment), ? (single non-separator char). `**/` collapses so `src/**/*.ts`\n  // matches `src/foo.ts` AND `src/a/b/foo.ts` — the semantics Cursor and Claude\n  // Code document (\"src/**/* → all files under src/\"). `*` and `?` never cross a\n  // `/` (strict glob segment semantics). Escape other regex metas.\n  const compiled = glob\n    .replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\")\n    .replace(/\\*\\*\\//g, \"::GLOBSTAR_SLASH::\")\n    .replace(/\\*\\*/g, \"::GLOBSTAR::\")\n    .replace(/\\*/g, \"[^/]*\")\n    .replace(/\\?/g, \"[^/]\")\n    .replace(/::GLOBSTAR_SLASH::/g, \"(?:.*/)?\")\n    .replace(/::GLOBSTAR::/g, \".*\");\n  return new RegExp(`^${compiled}$`);\n}\n\n/**\n * True when any of `patterns` glob-matches any of `paths`. Central helper so\n * both rule parsers agree on activation semantics.\n *\n * @internal\n */\nexport function anyGlobMatches(\n  patterns: ReadonlyArray<string>,\n  paths: ReadonlyArray<string>,\n): boolean {\n  if (patterns.length === 0 || paths.length === 0) return false;\n  const res = patterns.map(globToRegex);\n  return paths.some((p) => res.some((re) => re.test(p)));\n}\n","/**\n * Parser for `.theokit/rules/*.md` — theokit-native path-scoped rules,\n * mirroring Claude Code's `.claude/rules/`.\n *\n * Frontmatter fields:\n *  - `paths` — glob-pattern array (Claude Code parity: `.claude/rules` uses `paths:`).\n *  - `globs` — glob-pattern array (Cursor-compatible alias; unioned with `paths`).\n *  - `alwaysApply` — activate unconditionally (no scope needed).\n *  - `enabled` — set `false` to disable the rule entirely (wins over everything).\n *  - `description` — human note; not used for activation in v1.\n *\n * Activation (`shouldActivateRule`):\n *  - `enabled: false` → never activates.\n *  - `alwaysApply: true` → always activates.\n *  - otherwise → activates iff a `paths`/`globs` pattern matches an in-scope\n *    file (the caller's `agent.send(..., { contextPaths })`). With no in-scope\n *    files, a scoped rule stays dormant (parity with Cursor `.mdc`).\n *\n * A file with no `---` frontmatter is treated as an unconditional rule\n * (`alwaysApply: true`). Malformed YAML → `undefined` (caller drops + counts).\n *\n * Glob + YAML subset are shared with the MDC parser (DRY, no new dependency).\n *\n * NOTE — no internal-visibility tag in this block. `tsconfig.base.json` sets `stripInternal: true`,\n * and TypeScript scans EVERY leading comment range of the declaration that follows, including the\n * import right below this one. The tag that used to sit here deleted that import from the emitted\n * `.d.ts`, leaving the types it binds unresolvable for any consumer running type-aware lint\n * (usetheodev/theokit-sdk#283 records the same trap on a declaration).\n */\n\nimport { z } from \"zod\";\n\nimport { anyGlobMatches } from \"./context-glob.js\";\nimport { parseSimpleYaml, splitFrontmatter } from \"./context-yaml-lite.js\";\n\n/**\n * YAML frontmatter schema for `.theokit/rules/*.md` files.\n *\n * Every field is optional, and unknown keys are dropped rather than rejected — `safeParse` failing\n * therefore means a declared key had the wrong TYPE (`paths` as a bare string, `enabled` as the\n * string `\"false\"`), never that an unexpected key was present.\n *\n * Exported because {@link RulesFrontmatter} is inferred from it and appears in the signature of\n * {@link shouldActivateRule}, which `@theokit/sdk/context` publishes: the constant has to reach the\n * emitted declarations for that inferred type to resolve in a consumer's project.\n */\nexport const RulesFrontmatterSchema = z.object({\n  description: z.string().optional(),\n  paths: z.array(z.string()).optional(),\n  globs: z.array(z.string()).optional(),\n  alwaysApply: z.boolean().optional(),\n  enabled: z.boolean().optional(),\n});\n\nexport type RulesFrontmatter = z.infer<typeof RulesFrontmatterSchema>;\n\nexport interface RulesParseResult {\n  readonly frontmatter: RulesFrontmatter;\n  readonly body: string;\n}\n\n/**\n * Split a `.theokit/rules/*.md` document into its frontmatter and its body.\n *\n * A file with no `---` fence is not an error: the whole text becomes the body and the frontmatter\n * is synthesised as `{ alwaysApply: true }`, so a plain markdown rule with no metadata applies\n * unconditionally. That default is the one thing to know before adding a fence — adding one and\n * omitting both `alwaysApply` and a path pattern turns an always-on rule into a dormant one.\n *\n * `undefined` means the fence was there and its contents did not survive: YAML the lite parser\n * could not read, or a shape the schema rejected (`paths` as a bare string rather than a list,\n * `enabled` as `\"false\"` rather than `false`). It never throws, and it does not say WHICH of the\n * two happened — the caller drops the file and counts it.\n *\n * Unknown frontmatter keys are dropped rather than rejected, so a misspelled `alwaysAply` parses\n * fine and simply has no effect.\n *\n * Nothing here decides whether the rule applies; that is `shouldActivateRule`.\n *\n * @public — re-exported from `@theokit/sdk/context`, and therefore under semver.\n */\nexport function parseRules(content: string): RulesParseResult | undefined {\n  const { yaml, body } = splitFrontmatter(content);\n  if (yaml === undefined) {\n    return { frontmatter: { alwaysApply: true }, body: content };\n  }\n  try {\n    const parsed = parseSimpleYaml(yaml);\n    const validated = RulesFrontmatterSchema.safeParse(parsed);\n    if (!validated.success) return undefined;\n    return { frontmatter: validated.data, body };\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Decide whether a parsed rule applies to this turn, given the files in scope.\n *\n * Checked in strict order, first match wins:\n *\n *   1. `enabled: false` — never applies, whatever else the frontmatter says. This overrides\n *      `alwaysApply: true`, which is the point of having it.\n *   2. `alwaysApply: true` — applies, and `inScopePaths` is not consulted.\n *   3. otherwise — applies only if some pattern from `paths` or `globs` matches some path in\n *      `inScopePaths`. The two lists are a union, not alternatives; `globs` exists for\n *      Cursor compatibility and behaves identically.\n *\n * A scoped rule with an EMPTY `inScopePaths` never applies. That is the case worth planning for:\n * `contextPaths` is empty on a plain `agent.send()`, so a rule scoped by path stays dormant until\n * the caller declares which files the turn is about. It is quiet — a dormant rule looks exactly\n * like a rule that was never written.\n *\n * A rule with a fence but no patterns and no `alwaysApply` also never applies, since step 3 has\n * nothing to match.\n *\n * `description` is not consulted. It is a note for humans, not an activation condition.\n *\n * @public — re-exported from `@theokit/sdk/context`, and therefore under semver.\n */\nexport function shouldActivateRule(\n  fm: RulesFrontmatter,\n  inScopePaths: ReadonlyArray<string>,\n): boolean {\n  if (fm.enabled === false) return false;\n  if (fm.alwaysApply === true) return true;\n  const patterns = [...(fm.paths ?? []), ...(fm.globs ?? [])];\n  if (patterns.length === 0) return false;\n  return anyGlobMatches(patterns, inScopePaths);\n}\n","/**\n * MDC (Markdown Cursor) parser for `.cursor/rules/*.mdc` (T3.1, ADR D154).\n *\n * Parses YAML frontmatter with `description` / `globs` / `alwaysApply`\n * fields. Honors activation per Cursor's docs:\n *  - `alwaysApply: true` → activates unconditionally.\n *  - `alwaysApply: false` + matching glob in `touchedFiles` → activates.\n *  - `alwaysApply: false` + no glob match → skipped.\n *\n * **EC-I (v1 semantic):** at `agent.send()` time, `touchedFiles` is empty\n * UNLESS the caller passes `contextPaths` (the in-scope file set). When\n * `contextPaths` is provided, per-glob activation fires; otherwise only\n * `alwaysApply: true` rules activate. Description-based \"agent requested\"\n * classification is out of scope.\n *\n * Glob matching + the YAML subset are shared with the `.theokit/rules/*.md`\n * parser via `context-glob.ts` / `context-yaml-lite.ts` (DRY, no new dep).\n *\n * @internal\n */\n\nimport { z } from \"zod\";\n\nimport { anyGlobMatches } from \"./context-glob.js\";\nimport { parseSimpleYaml, splitFrontmatter } from \"./context-yaml-lite.js\";\n\n/** YAML frontmatter schema for MDC files. @internal */\nexport const McdFrontmatterSchema = z.object({\n  description: z.string().optional(),\n  globs: z.array(z.string()).optional(),\n  alwaysApply: z.boolean().optional(),\n});\n\nexport type McdFrontmatter = z.infer<typeof McdFrontmatterSchema>;\n\nexport interface McdParseResult {\n  readonly frontmatter: McdFrontmatter;\n  readonly body: string;\n}\n\n/**\n * Parse `.mdc` content. Returns frontmatter + body. EC-18: when the\n * file has no `---` frontmatter, returns `frontmatter: {alwaysApply:\n * true}` so the body is treated as an unconditional rule.\n *\n * On YAML parse error, returns `undefined` and the caller emits a\n * telemetry counter (EC-21).\n *\n * @internal\n */\nexport function parseMdc(content: string): McdParseResult | undefined {\n  const { yaml, body } = splitFrontmatter(content);\n  if (yaml === undefined) {\n    // EC-18: no frontmatter — treat as alwaysApply\n    return { frontmatter: { alwaysApply: true }, body: content };\n  }\n  try {\n    const parsed = parseSimpleYaml(yaml);\n    const validated = McdFrontmatterSchema.safeParse(parsed);\n    if (!validated.success) return undefined;\n    return { frontmatter: validated.data, body };\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Decide whether an MDC rule activates given the currently-touched\n * files. EC-I: empty `touchedFiles` → only `alwaysApply: true`\n * activates.\n *\n * @internal\n */\nexport function shouldActivate(fm: McdFrontmatter, touchedFiles: ReadonlyArray<string>): boolean {\n  if (fm.alwaysApply === true) return true;\n  if (fm.globs === undefined || fm.globs.length === 0) return false;\n  return anyGlobMatches(fm.globs, touchedFiles);\n}\n","/**\n * Multi-format context discovery runner (T5.1, ADRs D150-D156).\n *\n * Walks `DEFAULT_DISCOVERY_SPECS` (or caller override), loads each\n * spec via the appropriate parser, applies `@import` resolution where\n * declared, and returns a flat list of `AggregatorSource[]` ready for\n * the aggregate cap.\n *\n * **EC-E privacy fix:** source disambiguation uses\n * `relative(gitRoot ?? cwd, ...)` — NEVER absolute paths in\n * `<source name=\"\">`.\n *\n * @internal\n */\n\nimport { readFile } from \"node:fs/promises\";\nimport { dirname, relative } from \"node:path\";\nimport { warnOnce } from \"../hooks/hooks-source.js\";\nimport type { AggregatorSource } from \"./context-aggregator.js\";\nimport {\n  admittedSpecs,\n  DEFAULT_DISCOVERY_SPECS,\n  type DiscoverySpec,\n  findGitRoot,\n  walkUpForFile,\n  walkUpForGlob,\n  withheldSpecs,\n} from \"./context-discovery.js\";\nimport { resolveImports } from \"./context-import-resolver.js\";\nimport { loadPlainMarkdown } from \"./context-loaders.js\";\nimport { parseMdc, shouldActivate } from \"./context-mdc-parser.js\";\nimport { parseRules, shouldActivateRule } from \"./context-rules-frontmatter.js\";\n\n/**\n * Input to the context-discovery run: where to walk, how much of each file to keep, and which\n * trust boundary an `@import` may not cross.\n *\n * `cwd` and `maxBytesPerFile` are required because neither has a safe default — an unset root walks\n * the wrong tree, and an unset cap lets one large file consume the context window.\n *\n * `importRoot` is the field to reach for when the caller's trust boundary is narrower than the\n * repository. Left unset, the repository IS the boundary (`gitRoot ?? cwd`), which is the honest\n * default for a document found by walking the repository — but it does mean an `@import` can pull\n * in any file the repo contains.\n *\n * @public — re-exported from '@theokit/sdk/context', and therefore under semver.\n */\nexport interface DiscoveryRunnerOptions {\n  /** Workspace root passed to all discovery scopes. */\n  readonly cwd: string;\n  /** Per-file truncation cap (D155). */\n  readonly maxBytesPerFile: number;\n  /** Optional override of the default registry. */\n  readonly specs?: ReadonlyArray<DiscoverySpec>;\n  /**\n   * The foreign dialects the consumer granted the `context` surface to — the output of\n   * `adaptersForSurface(compatSources, \"context\")`, mapped to `.kind`.\n   *\n   * Left unset, every spec runs, which is what every caller before usetheokit/theokit-sdk#652 got.\n   * Set, it filters specs carrying a {@link DiscoverySpec.dialect} the list does not name — so an\n   * empty array is a real value meaning \"no foreign dialect granted\", NOT the same as absent.\n   *\n   * That distinction is the whole option. `resolveCompatSources` returns `[]` for a consumer who\n   * declared nothing, and collapsing `[]` into `undefined` here would restore the defect: a\n   * repository's `.claude/rules/*.md` entering the system prompt of a consumer who never asked for\n   * that dialect.\n   */\n  readonly declaredCompatKinds?: ReadonlyArray<string>;\n  /** Cursor MDC: file paths the LLM has touched this turn (EC-I: empty at send-time). */\n  readonly touchedFiles?: ReadonlyArray<string>;\n  /** When true, skip `theokit-context` spec — caller already handles the legacy path. */\n  readonly skipLegacyTheokitContext?: boolean;\n  /**\n   * The root an `@import` may not escape. Defaults to `gitRoot ?? cwd` — the same value\n   * this runner already uses to keep absolute paths out of `<source name=\"\">`.\n   *\n   * Present so an embedder with a trust boundary narrower than the repository can declare\n   * it. Absent, the repository IS the boundary, which is the honest default for a document\n   * discovered by walking the repository.\n   */\n  readonly importRoot?: string;\n}\n\n/**\n * Find, read and parse every context file the specs describe, and return them ready for the\n * aggregator.\n *\n * Specs are processed in the order given — `opts.specs` when supplied, otherwise\n * `DEFAULT_DISCOVERY_SPECS` — and within a spec, in the order its scope resolves paths. The\n * returned array carries `priority` on each source; it is NOT sorted here, so the aggregator is\n * what applies the ordering.\n *\n * A path already emitted is skipped, across specs as well as within one. Paths arrive resolved\n * through `realpath`, so two specs pointing at the same physical file through a symlink produce\n * one source rather than two.\n *\n * Missing and unreadable files are not errors: a file that does not exist is simply not matched,\n * and one that fails to read or parse is dropped and the run continues. A frontmatter file whose\n * activation conditions do not hold — `enabled: false`, or a scope that no touched file matches —\n * is dropped the same way. So a shorter result than expected means \"nothing qualified\", and this\n * function will not tell you which of those it was.\n *\n * Reads the filesystem and nothing else. No network, no writes, and no mutation of `opts`.\n *\n * Privacy: `<source name=\"\">` is built from the path RELATIVE to the git root (or `cwd` when\n * there is no git root), never an absolute path, so a home directory never reaches the prompt.\n * `@import` resolution is bounded by `opts.importRoot`, defaulting to that same root — a document\n * cannot pull in a file from outside the repository.\n *\n * @public — re-exported from `@theokit/sdk/context`, and therefore under semver.\n */\n// biome-ignore lint/complexity/noExcessiveCognitiveComplexity: per-spec dispatch ladder + cross-spec dedup is a flat orchestrator; splitting would obscure the priority-merge invariant.\nexport async function runDiscovery(opts: DiscoveryRunnerOptions): Promise<AggregatorSource[]> {\n  const gitRoot = findGitRoot(opts.cwd);\n  const registry = opts.specs ?? DEFAULT_DISCOVERY_SPECS;\n  const specs = admittedSpecs(registry, opts.declaredCompatKinds);\n\n  // The loud half of B-081. Gating the four repo-root instruction files means a consumer who\n  // declares nothing goes from four files in the prompt to none, and a silent drop there is the\n  // failure this whole line of work removes: the operator cannot tell \"not granted\" from \"not\n  // present\" by any experiment they can run.\n  //\n  // Each file is NAMED with the grant that restores it, never counted. A count cannot be acted on —\n  // you cannot decide whether to grant a dialect without knowing which file it brings.\n  const withheld = withheldSpecs(registry, opts.declaredCompatKinds);\n  if (withheld.length > 0) {\n    warnOnce(\n      `context-withheld:${withheld.map((w) => w.id).join(\",\")}`,\n      `[theokit-sdk] not loaded, no grant declared: ${withheld\n        .map((w) => `${w.pattern} (declare '${w.grant}' in compatSources)`)\n        .join(\"; \")}`,\n    );\n  }\n  const out: AggregatorSource[] = [];\n  const seenReal = new Set<string>();\n\n  for (const spec of specs) {\n    if (opts.skipLegacyTheokitContext && spec.id === \"theokit-context\") continue;\n    const paths = await resolvePathsForSpec(spec, opts.cwd, gitRoot);\n    for (const path of paths) {\n      if (seenReal.has(path)) continue;\n      seenReal.add(path);\n      const source = await loadOneSource(spec, path, opts, gitRoot);\n      if (source !== undefined) out.push(source);\n    }\n  }\n  return out;\n}\n\nasync function resolvePathsForSpec(\n  spec: DiscoverySpec,\n  cwd: string,\n  gitRoot: string | undefined,\n): Promise<string[]> {\n  if (spec.scope === \"cwd-only\") {\n    return walkUpForFile(cwd, spec.pattern, cwd);\n  }\n  if (spec.scope === \"git-root-walk\") {\n    return walkUpForFile(cwd, spec.pattern, gitRoot ?? cwd);\n  }\n  // globbed\n  return walkUpForGlob(cwd, spec.pattern);\n}\n\nasync function loadOneSource(\n  spec: DiscoverySpec,\n  path: string,\n  opts: DiscoveryRunnerOptions,\n  gitRoot: string | undefined,\n): Promise<AggregatorSource | undefined> {\n  // EC-E privacy: name uses relative-to-git-root for disambiguation;\n  // NEVER absolute paths in the public `<source name=\"\">` attribute.\n  // For cwd-only specs (THEO.md), no disambiguation is needed because\n  // the scope can only ever match a single file.\n  const relPath = relative(gitRoot ?? opts.cwd, dirname(path));\n  const needsSuffix = spec.scope !== \"cwd-only\" && relPath !== \"\" && relPath !== \".\";\n  const id = needsSuffix ? `${spec.id}@${relPath}` : spec.id;\n\n  if (spec.parser === \"mdc\") {\n    return loadMdcSource(spec, path, id, opts);\n  }\n  if (spec.parser === \"rules-frontmatter\") {\n    return loadRulesSource(spec, path, id, opts);\n  }\n  if (spec.parser === \"frontmatter-zod\") {\n    // Legacy `.theokit/context/*.md` — handled by `loadContextConfig` in\n    // `context-manager.ts` for backward compat. We skip here unless caller\n    // explicitly wants us to load it (currently always skipped).\n    return undefined;\n  }\n  // plain-markdown\n  return loadPlainMarkdownSource(spec, path, id, opts, gitRoot);\n}\n\n/**\n * Shared read → parse → activation-gate → source pipeline for the frontmatter\n * discovery parsers (mdc, rules). Binds the parser + the activation predicate so\n * the mdc and rules loaders differ only in those two, not in the surrounding\n * read/guard/shape boilerplate (DRY).\n */\nasync function loadParsedSource<F>(\n  spec: DiscoverySpec,\n  path: string,\n  id: string,\n  parse: (raw: string) => { frontmatter: F; body: string } | undefined,\n  isActive: (frontmatter: F) => boolean,\n): Promise<AggregatorSource | undefined> {\n  let raw: string;\n  try {\n    raw = await readFile(path, \"utf8\");\n  } catch {\n    return undefined;\n  }\n  const parsed = parse(raw);\n  if (parsed === undefined || !isActive(parsed.frontmatter)) return undefined;\n  return { id, source: path, content: parsed.body, priority: spec.priority, truncated: false };\n}\n\nfunction loadMdcSource(\n  spec: DiscoverySpec,\n  path: string,\n  id: string,\n  opts: DiscoveryRunnerOptions,\n): Promise<AggregatorSource | undefined> {\n  return loadParsedSource(spec, path, id, parseMdc, (fm) =>\n    shouldActivate(fm, opts.touchedFiles ?? []),\n  );\n}\n\nfunction loadRulesSource(\n  spec: DiscoverySpec,\n  path: string,\n  id: string,\n  opts: DiscoveryRunnerOptions,\n): Promise<AggregatorSource | undefined> {\n  return loadParsedSource(spec, path, id, parseRules, (fm) =>\n    shouldActivateRule(fm, opts.touchedFiles ?? []),\n  );\n}\n\nasync function loadPlainMarkdownSource(\n  spec: DiscoverySpec,\n  path: string,\n  id: string,\n  opts: DiscoveryRunnerOptions,\n  gitRoot: string | undefined,\n): Promise<AggregatorSource | undefined> {\n  const loaded = await loadPlainMarkdown(path, { maxBytesPerFile: opts.maxBytesPerFile });\n  if (loaded === undefined) return undefined;\n  let content = loaded.content;\n  if (spec.followImports) {\n    content = await resolveImports(content, path, {\n      visited: new Set([path]),\n      depth: 0,\n      maxBytesPerFile: opts.maxBytesPerFile,\n      // The document carrying the import is repository-controlled, so the repository is the\n      // boundary it may not cross. Without this, `CLAUDE.md` / `GEMINI.md` — the two specs\n      // with `followImports: true` — could name any absolute or `~/` path and have it\n      // inlined into the system prompt.\n      projectRoot: opts.importRoot ?? gitRoot ?? opts.cwd,\n    });\n  }\n  return {\n    id,\n    source: path,\n    content,\n    priority: spec.priority,\n    truncated: loaded.truncated,\n  };\n}\n"]}

package/dist/{chunk-BWYC7RZG.cjs → chunk-XTQWTVVI.cjs}

@@ -1,11 +1,11 @@
 'use strict';
 
-var chunkZOFRNNZD_cjs = require('./chunk-ZOFRNNZD.cjs');
+var chunkIZV72OEI_cjs = require('./chunk-IZV72OEI.cjs');
 var chunkCEGU5AVD_cjs = require('./chunk-CEGU5AVD.cjs');
 var chunkRNXXYF22_cjs = require('./chunk-RNXXYF22.cjs');
-var fs = require('fs');
-var promises = require('fs/promises');
-var path = require('path');
+var node_fs = require('node:fs');
+var promises = require('node:fs/promises');
+var node_path = require('node:path');
 
 // src/internal/task/task-id.ts
 var TASK_ID_GRAMMAR = /^[a-z0-9][a-z0-9_-]*$/;
@@ -118,25 +118,25 @@ var JsonFileTaskStore = class {
   constructor(dir) {
     this.dir = dir;
     try {
-      fs.mkdirSync(dir, { recursive: true });
+      node_fs.mkdirSync(dir, { recursive: true });
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
     }
   }
   dir;
   filePath(id) {
-    return path.join(this.dir, `${id}.json`);
+    return node_path.join(this.dir, `${id}.json`);
   }
   async insert(handle) {
     assertValidIdForStore(handle.id);
-    await chunkZOFRNNZD_cjs.atomicWriteText(this.filePath(handle.id), JSON.stringify(handle));
+    await chunkIZV72OEI_cjs.atomicWriteText(this.filePath(handle.id), JSON.stringify(handle));
   }
   async update(id, mutate) {
     assertValidIdForStore(id);
     const existing = await this.get(id);
     if (existing === void 0) return void 0;
     const next = mutate(existing);
-    await chunkZOFRNNZD_cjs.atomicWriteText(this.filePath(id), JSON.stringify(next));
+    await chunkIZV72OEI_cjs.atomicWriteText(this.filePath(id), JSON.stringify(next));
     return next;
   }
   async get(id) {
@@ -162,7 +162,7 @@ var JsonFileTaskStore = class {
   candidateIds() {
     let entries;
     try {
-      entries = fs.readdirSync(this.dir);
+      entries = node_fs.readdirSync(this.dir);
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw err;
@@ -231,5 +231,5 @@ exports.JsonFileTaskStore = JsonFileTaskStore;
 exports.TASK_RESERVED_PREFIXES = TASK_RESERVED_PREFIXES;
 exports.getTaskStoreFor = getTaskStoreFor;
 exports.isValidTaskId = isValidTaskId;
-//# sourceMappingURL=chunk-BWYC7RZG.cjs.map
-//# sourceMappingURL=chunk-BWYC7RZG.cjs.map
+//# sourceMappingURL=chunk-XTQWTVVI.cjs.map
+//# sourceMappingURL=chunk-XTQWTVVI.cjs.map

package/dist/chunk-XTQWTVVI.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/task/task-id.ts","../src/internal/task/store.ts"],"names":["InvalidTaskIdError","mkdirSync","join","atomicWriteText","readFile","diag","readdirSync","unlink"],"mappings":";;;;;;;;;;AAmBA,IAAM,eAAA,GAAkB,uBAAA;AAGxB,IAAM,iBAAA,GAAoB,CAAC,KAAA,EAAO,IAAA,EAAM,OAAO,CAAA;AAUxC,SAAS,aAAA,CAAc,IAAY,aAAA,EAAiC;AACzE,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,EAAE,GAAG,OAAO,KAAA;AACtC,EAAA,IAAI,eAAe,OAAO,IAAA;AAC1B,EAAA,KAAA,MAAW,UAAU,iBAAA,EAAmB;AACtC,IAAA,IAAI,EAAA,CAAG,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,KAAA;AAAA,EACpC;AACA,EAAA,OAAO,IAAA;AACT;AAGO,IAAM,sBAAA,GAA4C;ACRzD,IAAM,aAAA,GAAgB,GAAA;AACtB,IAAM,kBAAA,GAAqB,GAAA;AAuB3B,SAAS,sBAAsB,EAAA,EAAkB;AAC/C,EAAA,IAAI,CAAC,aAAA;AAAA,IAAc,EAAA;AAAA;AAAA,IAAwB;AAAA,GAAI,EAAG;AAChD,IAAA,MAAM,IAAIA,oCAAA,CAAmB,CAAA,+BAAA,EAAkC,EAAE,IAAI,EAAE,CAAA;AAAA,EACzE;AACF;AAEA,SAAS,kBAAkB,CAAA,EAAmC;AAC5D,EAAA,IAAI,CAAA,CAAE,KAAA,KAAU,UAAA,EAAY,OAAO,CAAA,CAAE,UAAA;AACrC,EAAA,IAAI,CAAA,CAAE,KAAA,KAAU,OAAA,EAAS,OAAO,CAAA,CAAE,SAAA;AAClC,EAAA,IAAI,CAAA,CAAE,KAAA,KAAU,WAAA,EAAa,OAAO,CAAA,CAAE,WAAA;AACtC,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,WAAW,KAAA,EAA2B;AAC7C,EAAA,OAAO,KAAA,KAAU,UAAA,IAAc,KAAA,KAAU,OAAA,IAAW,KAAA,KAAU,WAAA;AAChE;AAEA,SAAS,YAAA,CAAa,GAAe,MAAA,EAA6B;AAChE,EAAA,IAAI,MAAA,CAAO,KAAA,KAAU,MAAA,EAAW,OAAO,IAAA;AACvC,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,KAAK,IAAI,MAAA,CAAO,KAAA,GAAQ,CAAC,MAAA,CAAO,KAAK,CAAA;AACzE,EAAA,OAAO,MAAA,CAAO,QAAA,CAAS,CAAA,CAAE,KAAK,CAAA;AAChC;AACA,SAAS,WAAA,CAAY,GAAe,MAAA,EAA6B;AAC/D,EAAA,IAAI,MAAA,CAAO,IAAA,KAAS,MAAA,EAAW,OAAO,IAAA;AACtC,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,IAAI,IAAI,MAAA,CAAO,IAAA,GAAO,CAAC,MAAA,CAAO,IAAI,CAAA;AACrE,EAAA,OAAO,KAAA,CAAM,QAAA,CAAS,CAAA,CAAE,IAAI,CAAA;AAC9B;AACA,SAAS,WAAA,CAAY,GAAe,MAAA,EAA6B;AAC/D,EAAA,IAAI,OAAO,cAAA,KAAmB,MAAA,IAAa,EAAE,WAAA,IAAe,MAAA,CAAO,gBAAgB,OAAO,KAAA;AAC1F,EAAA,IAAI,OAAO,eAAA,KAAoB,MAAA,IAAa,EAAE,WAAA,IAAe,MAAA,CAAO,iBAAiB,OAAO,KAAA;AAC5F,EAAA,OAAO,IAAA;AACT;AACA,SAAS,aAAA,CAAc,GAAe,MAAA,EAA6B;AACjE,EAAA,OAAO,YAAA,CAAa,CAAA,EAAG,MAAM,CAAA,IAAK,WAAA,CAAY,GAAG,MAAM,CAAA,IAAK,WAAA,CAAY,CAAA,EAAG,MAAM,CAAA;AACnF;AAGA,IAAM,eAAA,GAAwC,CAAC,UAAA,EAAY,OAAA,EAAS,WAAW,CAAA;AAS/E,SAAS,cAAA,CAAe,aAAoC,WAAA,EAA6B;AACvF,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,WAAA,CAAY,QAAQ,CAAA,EAAA,EAAK;AAC3C,IAAA,MAAM,KAAA,GAAQ,YAAY,CAAC,CAAA;AAC3B,IAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,CAAM,WAAA,GAAc,aAAa,OAAO,CAAA;AAAA,EACrE;AACA,EAAA,OAAO,WAAA,CAAY,MAAA;AACrB;AAEA,SAAS,WAAA,CAAY,QAA8B,MAAA,EAAkC;AACnF,EAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,IAAS,kBAAA;AAC9B,EAAA,MAAM,MAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,IAAI,aAAA,CAAc,CAAA,EAAG,MAAM,CAAA,EAAG;AAC5B,MAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AACV,MAAA,IAAI,GAAA,CAAI,UAAU,KAAA,EAAO;AAAA,IAC3B;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AA0BO,IAAM,oBAAN,MAA6C;AAAA,EACjC,GAAA,uBAAU,GAAA,EAAwB;AAAA,EAEnD,MAAM,OAAO,MAAA,EAAmC;AAC9C,IAAA,qBAAA,CAAsB,OAAO,EAAE,CAAA;AAC/B,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,EAAA,EAAI,MAAM,CAAA;AAAA,EAChC;AAAA,EAEA,MAAM,MAAA,CAAO,EAAA,EAAY,MAAA,EAAwE;AAC/F,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA;AAChC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,IAAA,MAAM,IAAA,GAAO,OAAO,QAAQ,CAAA;AAC5B,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,IAAI,CAAA;AACrB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAI,EAAA,EAA6C;AACrD,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA;AAAA,EACxB;AAAA,EAEA,MAAM,KAAK,MAAA,EAA2C;AACpD,IAAA,OAAO,WAAA,CAAY,IAAA,CAAK,GAAA,CAAI,MAAA,IAAU,MAAM,CAAA;AAAA,EAC9C;AAAA,EAEA,MAAM,OAAO,EAAA,EAA8B;AACzC,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,OAAO,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,EAAE,CAAA;AAAA,EAC3B;AAAA,EAEA,MAAM,uBAAuB,OAAA,EAAkC;AAC7D,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,CAAC,KAAK,IAAA,CAAK,GAAA,CAAI,SAAQ,EAAG;AACxC,MAAA,IAAI,CAAC,UAAA,CAAW,CAAA,CAAE,KAAK,CAAA,EAAG;AAC1B,MAAA,MAAM,EAAA,GAAK,kBAAkB,CAAC,CAAA;AAC9B,MAAA,IAAI,EAAA,KAAO,MAAA,IAAa,EAAA,GAAK,OAAA,EAAS;AACpC,QAAA,IAAA,CAAK,GAAA,CAAI,OAAO,EAAE,CAAA;AAClB,QAAA,KAAA,EAAA;AAAA,MACF;AAAA,IACF;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAkDO,IAAM,oBAAN,MAA6C;AAAA,EAClD,YAA6B,GAAA,EAAa;AAAb,IAAA,IAAA,CAAA,GAAA,GAAA,GAAA;AAE3B,IAAA,IAAI;AACF,MAAAC,iBAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAAA,IACpC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,MAAM,GAAA;AAAA,IAC9D;AAAA,EACF;AAAA,EAP6B,GAAA;AAAA,EASrB,SAAS,EAAA,EAAoB;AACnC,IAAA,OAAOC,cAAA,CAAK,IAAA,CAAK,GAAA,EAAK,CAAA,EAAG,EAAE,CAAA,KAAA,CAAO,CAAA;AAAA,EACpC;AAAA,EAEA,MAAM,OAAO,MAAA,EAAmC;AAC9C,IAAA,qBAAA,CAAsB,OAAO,EAAE,CAAA;AAC/B,IAAA,MAAMC,iCAAA,CAAgB,KAAK,QAAA,CAAS,MAAA,CAAO,EAAE,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAAA,EACxE;AAAA,EAEA,MAAM,MAAA,CAAO,EAAA,EAAY,MAAA,EAAwE;AAC/F,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,GAAA,CAAI,EAAE,CAAA;AAClC,IAAA,IAAI,QAAA,KAAa,QAAW,OAAO,MAAA;AACnC,IAAA,MAAM,IAAA,GAAO,OAAO,QAAQ,CAAA;AAC5B,IAAA,MAAMA,iCAAA,CAAgB,KAAK,QAAA,CAAS,EAAE,GAAG,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAC7D,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,IAAI,EAAA,EAA6C;AACrD,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAMC,iBAAA,CAAS,KAAK,QAAA,CAAS,EAAE,GAAG,MAAM,CAAA;AACpD,MAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,IACvB,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,OAAQ,GAAA,CAA8B,IAAA;AAC5C,MAAA,IAAI,IAAA,KAAS,UAAU,OAAO,MAAA;AAE9B,MAAAC,sBAAA,CAAK,CAAA,4BAAA,EAA+B,EAAE,CAAA,EAAA,EAAM,GAAA,CAAc,OAAO;AAAA,CAAI,CAAA;AACrE,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,YAAA,GAAyB;AAC/B,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAUC,mBAAA,CAAY,KAAK,GAAG,CAAA;AAAA,IAChC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,OAAO,EAAC;AAC9D,MAAA,MAAM,GAAA;AAAA,IACR;AACA,IAAA,OAAO,OAAA,CACJ,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,QAAA,CAAS,OAAO,CAAA,IAAK,CAAC,IAAA,CAAK,QAAA,CAAS,MAAM,CAAC,CAAA,CACjE,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,CAAC,QAAQ,MAAM,CAAC,CAAA,CAC5C,MAAA,CAAO,CAAC,EAAA,KAAO,aAAA,CAAc,EAAA,EAAI,IAAI,CAAC,CAAA;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,aAAA,CACZ,GAAA,EACA,KAAA,EACe;AACf,IAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,GAAA,CAAI,MAAA,EAAQ,SAAS,aAAA,EAAe;AAC9D,MAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,KAAA,EAAO,QAAQ,aAAa,CAAA;AACpD,MAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,OAAO,EAAA,KAAO,IAAA,CAAK,GAAA,CAAI,EAAE,CAAC,CAAC,CAAA;AACtE,MAAA,KAAA,MAAW,UAAU,MAAA,EAAQ;AAC3B,QAAA,IAAI,MAAA,KAAW,MAAA,EAAW,MAAM,KAAA,CAAM,MAAM,CAAA;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,MAAA,EAA2C;AACpD,IAAA,MAAM,KAAA,GAAQ,OAAO,KAAA,IAAS,kBAAA;AAK9B,IAAA,MAAM,SAAuB,EAAC;AAC9B,IAAA,MAAM,KAAK,aAAA,CAAc,IAAA,CAAK,YAAA,EAAa,EAAG,CAAC,MAAA,KAAW;AACxD,MAAA,IAAI,CAAC,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA,EAAG;AACpC,MAAA,MAAM,EAAA,GAAK,cAAA,CAAe,MAAA,EAAQ,MAAA,CAAO,WAAW,CAAA;AACpD,MAAA,IAAI,MAAM,KAAA,EAAO;AACjB,MAAA,MAAA,CAAO,MAAA,CAAO,EAAA,EAAI,CAAA,EAAG,MAAM,CAAA;AAC3B,MAAA,IAAI,MAAA,CAAO,MAAA,GAAS,KAAA,EAAO,MAAA,CAAO,GAAA,EAAI;AAAA,IACxC,CAAC,CAAA;AACD,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,EAAA,EAA8B;AACzC,IAAA,qBAAA,CAAsB,EAAE,CAAA;AACxB,IAAA,IAAI;AACF,MAAA,MAAMC,eAAA,CAAO,IAAA,CAAK,QAAA,CAAS,EAAE,CAAC,CAAA;AAC9B,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAK,GAAA,CAA8B,IAAA,KAAS,QAAA,EAAU,OAAO,KAAA;AAC7D,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAM,uBAAuB,OAAA,EAAkC;AAM7D,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,MAAM,KAAK,aAAA,CAAc,IAAA,CAAK,YAAA,EAAa,EAAG,OAAO,MAAA,KAAW;AAC9D,MAAA,IAAI,CAAC,eAAA,CAAgB,QAAA,CAAS,MAAA,CAAO,KAAK,CAAA,EAAG;AAC7C,MAAA,MAAM,EAAA,GAAK,kBAAkB,MAAM,CAAA;AACnC,MAAA,IAAI,EAAA,KAAO,MAAA,IAAa,EAAA,IAAM,OAAA,EAAS;AACvC,MAAA,IAAI,MAAM,IAAA,CAAK,MAAA,CAAO,MAAA,CAAO,EAAE,CAAA,EAAG,KAAA,EAAA;AAAA,IACpC,CAAC,CAAA;AACD,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAGO,SAAS,gBAAgB,OAAA,EAAsC;AACpE,EAAA,IAAI,OAAA,CAAQ,OAAA,KAAY,QAAA,EAAU,OAAO,IAAI,iBAAA,EAAkB;AAC/D,EAAA,OAAO,IAAI,iBAAA,CAAkB,OAAA,CAAQ,GAAG,CAAA;AAC1C","file":"chunk-XTQWTVVI.cjs","sourcesContent":["/**\n * Task-id grammar (D368) — runtime, deliberately NOT in `types/`.\n *\n * It lived in `types/task.ts`, which `types/index.ts` re-exports with `export type *`. That star\n * cannot carry a value, so the only reason `isValidTaskId` ever reached a consumer is that the DTS\n * rollup hoists the declaration while the runtime bundle emits nothing — exactly the shape of #279,\n * where the import typechecked and was `undefined` at the call site. `src/index.ts` re-exports both\n * names from here, so the public API is unchanged.\n *\n * @internal\n */\n\n/**\n * Grammar for user-supplied task IDs (D368).\n * `crypto.randomUUID()` outputs do NOT match this (UUIDs have dashes\n * AND uppercase letters in their canonical form on some Node versions),\n * but the registry normalizes auto-generated IDs to lowercase before\n * insertion, so they pass the same regex.\n */\nconst TASK_ID_GRAMMAR = /^[a-z0-9][a-z0-9_-]*$/;\n\n/** Reserved prefixes for adapter-generated IDs (D368, EC-5). */\nconst RESERVED_PREFIXES = [\"wf-\", \"b-\", \"cron-\"] as const;\n\n/**\n * Validates a task ID against the public grammar + reserved prefixes.\n * Throws `InvalidTaskIdError` from `../errors.js` on rejection.\n *\n * Adapter callers (workflow/batch/cron) MUST set `allowReserved: true`\n * to register their own IDs; user-facing surfaces (`Task.submit`,\n * `agent.send({ task: { id } })`) leave it false.\n */\nexport function isValidTaskId(id: string, allowReserved: boolean): boolean {\n  if (!TASK_ID_GRAMMAR.test(id)) return false;\n  if (allowReserved) return true;\n  for (const prefix of RESERVED_PREFIXES) {\n    if (id.startsWith(prefix)) return false;\n  }\n  return true;\n}\n\n/** Re-exported for adapter implementations + tests. */\nexport const TASK_RESERVED_PREFIXES: readonly string[] = RESERVED_PREFIXES;\n","/**\n * `TaskStore` interface + 2 implementations (ADR D364).\n *\n *   - `InMemoryTaskStore` — default, transient, single-process.\n *   - `JsonFileTaskStore` — opt-in, one JSON file per task under a\n *     dedicated dir; single-process invariant (EC-15 documented).\n *\n * Edge cases absorbed:\n *   - EC-1: constructor auto-creates dir (mkdirSync recursive idempotent).\n *   - EC-2: every method validates the task id against the public\n *     grammar (D368) BEFORE doing any path I/O — path-traversal defense.\n *   - EC-6: `list()` returns `[]` on ENOENT (fresh install path).\n *   - EC-8: `list()` skips `.tmp.*` orphan files left by interrupted\n *     atomic writes.\n *   - EC-14 (DOCUMENT): `list()` JSDoc documents the 256-row hard cap.\n *     It no longer advertises `submittedBefore` as a way to page past it:\n *     the cap is applied to the raw directory listing before any filter, so\n *     paging beyond 256 files is not reachable through this interface.\n *   - EC-15 (DOCUMENT): `JsonFileTaskStore` JSDoc documents the\n *     single-process invariant; v0.2 SQLite covers cross-process.\n *\n * @internal\n */\n\nimport { mkdirSync, readdirSync } from \"node:fs\";\nimport { readFile, unlink } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nimport { InvalidTaskIdError } from \"../../errors.js\";\nimport type { TaskFilter, TaskHandle, TaskState, TaskStoreOptions } from \"../../types/task.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { atomicWriteText } from \"../persistence/atomic-write.js\";\nimport { isValidTaskId } from \"./task-id.js\";\n\nconst JSON_LOAD_CAP = 256;\nconst DEFAULT_LIST_LIMIT = 100;\n\n/** Storage interface used by `TaskRegistry`. */\nexport interface TaskStore {\n  insert(handle: TaskHandle): Promise<void>;\n  update(id: string, mutate: (h: TaskHandle) => TaskHandle): Promise<TaskHandle | undefined>;\n  get(id: string): Promise<TaskHandle | undefined>;\n  /**\n   * Returns at most `filter.limit ?? 100` matching handles.\n   *\n   * `JsonFileTaskStore` returns them newest-first and considers every task in its\n   * directory, reading at most 256 files concurrently (#362 — that number bounds\n   * I/O, not which tasks are visible). Walk past `limit` by passing the oldest\n   * `submittedAt` of a page as the next call's `submittedBefore`; the ordering is\n   * what makes that a cursor rather than a re-roll of an arbitrary subset.\n   * `InMemoryTaskStore` applies the same filters but does not order its result.\n   */\n  list(filter: TaskFilter): Promise<TaskHandle[]>;\n  delete(id: string): Promise<boolean>;\n  /** Removes terminal handles whose terminal-timestamp is older than `epochMs`. */\n  evictTerminalOlderThan(epochMs: number): Promise<number>;\n}\n\nfunction assertValidIdForStore(id: string): void {\n  if (!isValidTaskId(id, /* allowReserved */ true)) {\n    throw new InvalidTaskIdError(`store rejects invalid task id: ${id}`, id);\n  }\n}\n\nfunction terminalTimestamp(h: TaskHandle): number | undefined {\n  if (h.state === \"finished\") return h.finishedAt;\n  if (h.state === \"error\") return h.erroredAt;\n  if (h.state === \"cancelled\") return h.cancelledAt;\n  return undefined;\n}\n\nfunction isTerminal(state: TaskState): boolean {\n  return state === \"finished\" || state === \"error\" || state === \"cancelled\";\n}\n\nfunction matchesState(h: TaskHandle, filter: TaskFilter): boolean {\n  if (filter.state === undefined) return true;\n  const states = Array.isArray(filter.state) ? filter.state : [filter.state];\n  return states.includes(h.state);\n}\nfunction matchesKind(h: TaskHandle, filter: TaskFilter): boolean {\n  if (filter.kind === undefined) return true;\n  const kinds = Array.isArray(filter.kind) ? filter.kind : [filter.kind];\n  return kinds.includes(h.kind);\n}\nfunction matchesTime(h: TaskHandle, filter: TaskFilter): boolean {\n  if (filter.submittedAfter !== undefined && h.submittedAt <= filter.submittedAfter) return false;\n  if (filter.submittedBefore !== undefined && h.submittedAt >= filter.submittedBefore) return false;\n  return true;\n}\nfunction matchesFilter(h: TaskHandle, filter: TaskFilter): boolean {\n  return matchesState(h, filter) && matchesKind(h, filter) && matchesTime(h, filter);\n}\n\n/** The states `evictTerminalOlderThan` considers terminal. */\nconst TERMINAL_STATES: readonly TaskState[] = [\"finished\", \"error\", \"cancelled\"];\n\n/**\n * Where `submittedAt` belongs in a newest-first list — the first index whose entry is older.\n *\n * Linear rather than binary: the list is bounded by the caller's `limit` (100 by default) and the\n * scan runs once per MATCHING handle, so the comparison count is dwarfed by the file read that\n * produced the handle. A binary search here would trade a real cost for an imagined one.\n */\nfunction insertionIndex(newestFirst: readonly TaskHandle[], submittedAt: number): number {\n  for (let i = 0; i < newestFirst.length; i++) {\n    const entry = newestFirst[i];\n    if (entry !== undefined && entry.submittedAt < submittedAt) return i;\n  }\n  return newestFirst.length;\n}\n\nfunction applyFilter(values: Iterable<TaskHandle>, filter: TaskFilter): TaskHandle[] {\n  const limit = filter.limit ?? DEFAULT_LIST_LIMIT;\n  const out: TaskHandle[] = [];\n  for (const h of values) {\n    if (matchesFilter(h, filter)) {\n      out.push(h);\n      if (out.length >= limit) break;\n    }\n  }\n  return out;\n}\n\n/* ─── InMemory ─── */\n\n/**\n * Default `TaskStore` — a plain `Map` living in the current process.\n *\n * Nothing reaches disk and nothing survives the process, so a task recorded here\n * is invisible to a reader in another process (`theokit tasks`). Select it with\n * `getTaskStoreFor({ backend: \"memory\" })`.\n *\n * How it fails: every id-taking method validates against the task-id grammar\n * (`^[a-z0-9][a-z0-9_-]*$`; reserved `wf-`/`b-`/`cron-` prefixes are permitted\n * here) and throws `InvalidTaskIdError` before touching the map. A missing id is\n * reported by returning `undefined` (`get`, `update`) or `false` (`delete`), never\n * by throwing.\n *\n * Traps:\n *  - `insert()` is a `Map.set`: an existing id is overwritten silently, not\n *    rejected.\n *  - `list()` walks in INSERTION order and stops as soon as `filter.limit ?? 100`\n *    matches are collected. It never sorts, so the limit truncates an\n *    oldest-first scan rather than returning the most recent tasks.\n *  - Nothing evicts on its own; terminal handles accumulate until a caller invokes\n *    `evictTerminalOlderThan`.\n */\nexport class InMemoryTaskStore implements TaskStore {\n  private readonly map = new Map<string, TaskHandle>();\n\n  async insert(handle: TaskHandle): Promise<void> {\n    assertValidIdForStore(handle.id);\n    this.map.set(handle.id, handle);\n  }\n\n  async update(id: string, mutate: (h: TaskHandle) => TaskHandle): Promise<TaskHandle | undefined> {\n    assertValidIdForStore(id);\n    const existing = this.map.get(id);\n    if (existing === undefined) return undefined;\n    const next = mutate(existing);\n    this.map.set(id, next);\n    return next;\n  }\n\n  async get(id: string): Promise<TaskHandle | undefined> {\n    assertValidIdForStore(id);\n    return this.map.get(id);\n  }\n\n  async list(filter: TaskFilter): Promise<TaskHandle[]> {\n    return applyFilter(this.map.values(), filter);\n  }\n\n  async delete(id: string): Promise<boolean> {\n    assertValidIdForStore(id);\n    return this.map.delete(id);\n  }\n\n  async evictTerminalOlderThan(epochMs: number): Promise<number> {\n    let count = 0;\n    for (const [id, h] of this.map.entries()) {\n      if (!isTerminal(h.state)) continue;\n      const ts = terminalTimestamp(h);\n      if (ts !== undefined && ts < epochMs) {\n        this.map.delete(id);\n        count++;\n      }\n    }\n    return count;\n  }\n}\n\n/* ─── JsonFile (opt-in) ───\n *\n * IMPORTANT (EC-15): `JsonFileTaskStore` is **single-process**.\n * Concurrent writers from multiple Node processes against the same\n * directory may corrupt entries (atomic-write protects per-file, but\n * the `list()` scan + `update()` read-modify-write cycle is not\n * serialised across processes). Use only when the `TaskRegistry`\n * runs in exactly one process. v0.2 will add a SQLite backend with\n * the same interface for cross-process scenarios (D364 + D61).\n */\n/**\n * Opt-in `TaskStore` that keeps one JSON file per task under `dir`, so another\n * process can read the registry off disk.\n *\n *   const store = new JsonFileTaskStore(\"/var/lib/theokit/tasks\");\n *\n * Two calls are synchronous, and both are deliberate: the constructor creates `dir`\n * recursively (`mkdirSync`), and `list()` scans it with `readdirSync` before awaiting\n * anything. Every other operation is async — `get` uses `readFile`, `delete` uses\n * `unlink`, and every write goes through an atomic temp-file-plus-rename.\n *\n * SINGLE-PROCESS ONLY — see the note above. Per-file atomicity does not make\n * `update()` safe: it is a read-modify-write, so two writers that both `get`\n * before either writes lose one of the two mutations. That is true within one\n * process as well as across processes.\n *\n * How it fails:\n *  - An invalid id throws `InvalidTaskIdError` BEFORE any path is constructed.\n *    That ordering is the path-traversal defence, and it is why ids are validated\n *    rather than escaped.\n *  - A missing task is `undefined` from `get` and `false` from `delete`.\n *  - A file that exists but does not parse is NOT surfaced as an error: `get`\n *    writes to the diagnostics channel and returns `undefined`, so a corrupted\n *    task also silently vanishes from `list()`.\n *  - `list()` returns `[]` when `dir` does not exist; any other `readdir` failure\n *    (for example a permission error) throws.\n *\n * Traps:\n *  - `list()` reads every task file in the directory (256 at a time) to apply the\n *    filter, because `state`, `kind` and `submittedAt` live inside the files. On a\n *    large directory that is a lot of I/O for one call; the memory it holds is\n *    bounded by `limit`, the time is not.\n *  - `list()` is `async`, but its directory scan is not: `readdirSync` blocks the event\n *    loop for the whole listing before the first `await`. Only the per-file reads that\n *    follow it are concurrent.\n *  - Files whose name contains `.tmp` are skipped as orphans of an interrupted\n *    write, and nothing ever removes them.\n */\nexport class JsonFileTaskStore implements TaskStore {\n  constructor(private readonly dir: string) {\n    // EC-1: idempotent mkdir; ignore EEXIST.\n    try {\n      mkdirSync(dir, { recursive: true });\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"EEXIST\") throw err;\n    }\n  }\n\n  private filePath(id: string): string {\n    return join(this.dir, `${id}.json`);\n  }\n\n  async insert(handle: TaskHandle): Promise<void> {\n    assertValidIdForStore(handle.id);\n    await atomicWriteText(this.filePath(handle.id), JSON.stringify(handle));\n  }\n\n  async update(id: string, mutate: (h: TaskHandle) => TaskHandle): Promise<TaskHandle | undefined> {\n    assertValidIdForStore(id);\n    const existing = await this.get(id);\n    if (existing === undefined) return undefined;\n    const next = mutate(existing);\n    await atomicWriteText(this.filePath(id), JSON.stringify(next));\n    return next;\n  }\n\n  async get(id: string): Promise<TaskHandle | undefined> {\n    assertValidIdForStore(id);\n    try {\n      const raw = await readFile(this.filePath(id), \"utf8\");\n      return JSON.parse(raw) as TaskHandle;\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code === \"ENOENT\") return undefined;\n      // Corrupt JSON or other I/O error — log + degrade gracefully (D50/EC-7 cache pattern).\n      diag(`[task-store] failed to read ${id}: ${(err as Error).message}\\n`);\n      return undefined;\n    }\n  }\n\n  /**\n   * Task ids backed by a file in `dir`, in readdir order.\n   *\n   * EC-8: orphan `.tmp` files left by an interrupted atomic write are skipped, as is any name\n   * outside the id grammar. EC-6: a missing directory lists as empty; any other `readdir` failure\n   * (a permission error, say) throws rather than being reported as \"no tasks\".\n   */\n  private candidateIds(): string[] {\n    let entries: string[];\n    try {\n      entries = readdirSync(this.dir);\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return []; // EC-6\n      throw err;\n    }\n    return entries\n      .filter((name) => name.endsWith(\".json\") && !name.includes(\".tmp\"))\n      .map((name) => name.slice(0, -\".json\".length))\n      .filter((id) => isValidTaskId(id, true));\n  }\n\n  /**\n   * Read every task in `ids`, handing each loaded handle to `visit`, at most `JSON_LOAD_CAP` file\n   * reads in flight.\n   *\n   * #362 — the cap used to be applied to the directory listing, which made it a bound on WHICH\n   * tasks were visible rather than on how much I/O ran at once. Every filter then ran on that\n   * arbitrary readdir-ordered prefix. As a concurrency bound it does the job it was named for\n   * without deciding what the caller gets to see; the caller's own bound on memory is whatever\n   * `visit` chooses to retain.\n   */\n  private async forEachHandle(\n    ids: readonly string[],\n    visit: (handle: TaskHandle) => void | Promise<void>,\n  ): Promise<void> {\n    for (let start = 0; start < ids.length; start += JSON_LOAD_CAP) {\n      const batch = ids.slice(start, start + JSON_LOAD_CAP);\n      const loaded = await Promise.all(batch.map(async (id) => this.get(id)));\n      for (const handle of loaded) {\n        if (handle !== undefined) await visit(handle);\n      }\n    }\n  }\n\n  async list(filter: TaskFilter): Promise<TaskHandle[]> {\n    const limit = filter.limit ?? DEFAULT_LIST_LIMIT;\n    // Newest-first, keeping at most `limit` handles in memory regardless of how many match. The\n    // order is what makes `submittedBefore` a real cursor: with the previous readdir order, a page\n    // was an arbitrary subset, so a caller walking the timeline skipped every task that happened\n    // to fall outside its window and could never come back for them.\n    const newest: TaskHandle[] = [];\n    await this.forEachHandle(this.candidateIds(), (handle) => {\n      if (!matchesFilter(handle, filter)) return;\n      const at = insertionIndex(newest, handle.submittedAt);\n      if (at >= limit) return; // older than everything already held, and the page is full\n      newest.splice(at, 0, handle);\n      if (newest.length > limit) newest.pop();\n    });\n    return newest;\n  }\n\n  async delete(id: string): Promise<boolean> {\n    assertValidIdForStore(id);\n    try {\n      await unlink(this.filePath(id));\n      return true;\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n      throw err;\n    }\n  }\n\n  async evictTerminalOlderThan(epochMs: number): Promise<number> {\n    // #362 — eviction scans the directory itself rather than borrowing `list()`. Sharing that path\n    // made one call incomplete twice over: it saw only a 256-file window, and it wanted the OLDEST\n    // handles while `list()` is ordered newest-first — so on a large directory it could delete\n    // nothing while thousands of eligible handles sat just outside the page. Sweeping every\n    // candidate is what lets one call mean \"everything eligible is gone\".\n    let count = 0;\n    await this.forEachHandle(this.candidateIds(), async (handle) => {\n      if (!TERMINAL_STATES.includes(handle.state)) return;\n      const ts = terminalTimestamp(handle);\n      if (ts === undefined || ts >= epochMs) return;\n      if (await this.delete(handle.id)) count++;\n    });\n    return count;\n  }\n}\n\n/** Factory used by `TaskRegistry.configure` (D364). */\nexport function getTaskStoreFor(options: TaskStoreOptions): TaskStore {\n  if (options.backend === \"memory\") return new InMemoryTaskStore();\n  return new JsonFileTaskStore(options.dir);\n}\n"]}

package/dist/{chunk-MLJDW2YK.js → chunk-YSGS57DA.js}

@@ -1,7 +1,7 @@
 import { ConfigurationError } from './chunk-TNFOU6SB.js';
 import { diag } from './chunk-3OY6H3I7.js';
-import { mkdir, rename } from 'fs/promises';
-import { dirname } from 'path';
+import { mkdir, rename } from 'node:fs/promises';
+import { dirname } from 'node:path';
 
 // src/internal/persistence/sqlite-wal.ts
 var warnedLabels = /* @__PURE__ */ new Set();
@@ -117,5 +117,5 @@ async function renameAside(filePath, label) {
 }
 
 export { applyWalWithFallback, isCorruptionError, openSqliteResilient };
-//# sourceMappingURL=chunk-MLJDW2YK.js.map
-//# sourceMappingURL=chunk-MLJDW2YK.js.map
+//# sourceMappingURL=chunk-YSGS57DA.js.map
+//# sourceMappingURL=chunk-YSGS57DA.js.map