@vibe-agent-toolkit/cli 0.2.0-rc.4 → 0.2.0-rc.5

package/dist/utils/projection-store.d.ts

@@ -44,6 +44,7 @@
  * standard legible error, and a tree that cannot be keyed says so on stderr
  * rather than silently declining.
  */
+import type * as ProjectionSqlite from '@vibe-agent-toolkit/projection-sqlite';
 import type { PopulationCache } from '@vibe-agent-toolkit/resources';
 /**
  * The env var that selects a projection store for this process.
@@ -90,6 +91,34 @@ import type { PopulationCache } from '@vibe-agent-toolkit/resources';
 export declare const PROJECTION_STORE_ENV = "VAT_PROJECTION_STORE";
 /** {@link PROJECTION_STORE_ENV}'s value that selects the SQLite backend. */
 export declare const PROJECTION_STORE_SQLITE = "sqlite";
+/**
+ * Where the projection store's database lives, overriding the default.
+ *
+ * The default is `tmpdir/.vat-cache/<version>/projection-<shapeDigest>` — one
+ * database per VAT release, shared by every root on the machine. This names a
+ * different one **explicitly**, which is what an adopter with a per-job cache
+ * directory, a shared build agent running two jobs at once, or a test arm that
+ * must not touch the developer's live cache actually needs.
+ *
+ * 🪤 **What it replaces is redirecting `TMPDIR`, which works and is the wrong
+ * instrument.** `defaultStoreDirectory()` resolves through
+ * `vatCacheNamespaceRoot()` → `normalizedTmpdir()`, so pointing the OS temp
+ * directory elsewhere does move the store — along with every other temp
+ * consumer in the process, on a variable whose name is not the same on both
+ * platforms (`TMPDIR` on POSIX; `TEMP`, then `TMP`, on Windows, so setting one
+ * is silently inert on the other). It relocates the store as a side effect of
+ * relocating something larger. This variable says the one thing meant.
+ *
+ * ⚠️ It does **not** consult `XDG_CACHE_HOME` or `HOME`. A caller that set
+ * those believed it had its own database and was writing into the shared one;
+ * the fix is to name the directory here, not to add more implicit roots.
+ *
+ * An environment variable rather than a config field, for the same reason
+ * {@link PROJECTION_STORE_ENV} is one: it says where an INSTRUMENT keeps its
+ * scratch space, not what the project means, and it has to be reachable from a
+ * harness that spawns the binary.
+ */
+export declare const PROJECTION_STORE_DIR_ENV = "VAT_PROJECTION_STORE_DIR";
 /**
  * The env var that turns VAT's disk caches off for a run.
  *
@@ -133,7 +162,19 @@ export declare const CACHE_DISABLED = "0";
  * @returns `true` when a store is selected
  */
 export declare function projectionStoreSelected(): boolean;
-/** An open store, the key half it is used with, and the way to let it go. */
+/**
+ * An open store, the key half it is used with, and the way to let it go.
+ *
+ * ⚠️ **Deliberately NOT typed for SQL, and do not re-widen it.** This handle
+ * reaches the database at {@link PROJECTION_STORE_DIR_ENV}'s directory, which
+ * defaults to one file per VAT release shared by every root on the machine —
+ * holding other repositories' link text, heading text and frontmatter. A field
+ * typed `SqlQueryableStore` used to live here "for a caller that needs to ASK
+ * the store something", and that caller was removed precisely because arbitrary
+ * SQL over this store answers from trees the asker never named. `populate()`
+ * needs the engine-free {@link PopulationCache} and nothing more; a query lane
+ * builds its own store (see `projection-query.ts`).
+ */
 export interface OpenedPopulationCache {
     /** Hand this to `populate()`. */
     readonly cache: PopulationCache;
@@ -163,6 +204,57 @@ export interface OpenedPopulationCache {
 export declare function openPopulationCache(options: {
     root: string;
 }): Promise<OpenedPopulationCache | undefined>;
+/**
+ * Open a store that lives only in this process's memory.
+ *
+ * 🔑 **This is what keeps the query surface an ANSWER rather than a privilege.**
+ * A caller with no store selected — CI's first run, or a developer who never set
+ * the selector — still gets the same SQL over the same schema; the on-disk store
+ * only makes the second run cheap. Without it, "what does this tree contain"
+ * would be answerable only where a cache happened to exist, and two callers
+ * would hold differently-shaped views of one tree.
+ *
+ * It is a cache that cannot hit: nothing survives the close, so a caller must
+ * write the projection into it before asking anything.
+ *
+ * @returns An open, empty store; close it when done
+ */
+export declare function openEphemeralQueryStore(): Promise<ProjectionSqlite.SqlQueryableStore>;
+/**
+ * The legible failure for "your Node is too old", or `undefined` when this is
+ * some other failure — including "the package is absent".
+ *
+ * Exported, and returning the error rather than throwing it, so the DIAGNOSIS
+ * is unit-testable without a mocked dynamic import. A test cannot make a mocked
+ * `import()` reject with a plain `{ code }` — the test runner wraps whatever a
+ * module factory throws in its own error, so the code never survives to be
+ * read — and the branch's whole value is the message it produces.
+ *
+ * 🪤 The two are **different error codes**, and only one of them reaches
+ * {@link isModuleMissing}. `@vibe-agent-toolkit/projection-sqlite` imports
+ * `node:sqlite`, which arrived in Node 22.13.0; on 22.0–22.12 the import fails
+ * with `ERR_UNKNOWN_BUILTIN_MODULE`, not `ERR_MODULE_NOT_FOUND`. Without this
+ * branch the user gets a bare `No such built-in module: node:sqlite` — which
+ * names neither the version floor nor the fix.
+ *
+ * ⚠️ It is reachable on EVERY `vat resources query`/`check` run, and not a
+ * corner: VAT's own floor is `>=22.0.0`, so a supported Node hits it. That was
+ * already true before the store-selected path stopped querying a shared
+ * database — the query lane has always fallen back to
+ * {@link openEphemeralQueryStore} when no store is selected, which is the
+ * default, so `node:sqlite` was required on every default run. Nothing here
+ * became newly reachable; the branch is load-bearing because the FLOOR is,
+ * whichever way the lane resolves its store.
+ *
+ * The repair stays distinct from the missing-package one on purpose:
+ * "install this package" is the wrong instruction for "upgrade Node", and
+ * sending someone round that loop cannot terminate.
+ *
+ * @param error - Whatever the dynamic import threw
+ * @returns The error to raise when Node itself lacks the builtin; `undefined`
+ *   when this failure is something else and the caller should keep diagnosing
+ */
+export declare function nodeSqliteFloorFailure(error: unknown): Error | undefined;
 /**
  * Run one command's work with a projection store open for its whole duration,
  * and closed however it ends.
@@ -175,7 +267,17 @@ export declare function openPopulationCache(options: {
  *
  * It is also the `withGitSnapshotCache` bracket for the work inside it, so the
  * key and the extent filed under it come from ONE git snapshot — see the note
- * on the call below.
+ * in the body.
+ *
+ * `undefined` on a run with no store selected, which is the shape every
+ * population lane wants: no store means re-derive, not fail.
+ *
+ * ⚠️ A caller that wants to run SQL must NOT query this store. It is one
+ * database per VAT release, shared by every root on the machine, so arbitrary
+ * SQL over it answers from other repositories — see `projection-query.ts`.
+ * That is also why this is the ONLY scope over the opened store: there is no
+ * separate "opened handle" bracket for a caller wanting more than the cache,
+ * because there is nothing legitimate for such a caller to want.
  *
  * @param options - Where the corpus is
  * @param options.root - The absolute corpus root

package/dist/utils/projection-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"projection-store.d.ts","sourceRoot":"","sources":["../../src/utils/projection-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAKrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAEhD;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,gHAAgH;AAChH,eAAO,MAAM,cAAc,MAAM,CAAC;AAelC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAGjD;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC;;;;;;OAMG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAsB7C;AAuBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACzB,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC,CA0BZ"}
+{"version":3,"file":"projection-store.d.ts","sourceRoot":"","sources":["../../src/utils/projection-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,KAAK,gBAAgB,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAmB,MAAM,+BAA+B,CAAC;AAKtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,WAAW,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,gHAAgH;AAChH,eAAO,MAAM,cAAc,MAAM,CAAC;AAkBlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,IAAI,OAAO,CAGjD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC;;;;;;OAMG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE;IACjD,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAsB7C;AA2BD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAE3F;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,CAaxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EACzB,IAAI,EAAE,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC,CA0BZ"}

package/dist/utils/projection-store.js

@@ -91,6 +91,34 @@ import { isModuleMissing, reportMissingBackend } from './optional-backend.js';
 export const PROJECTION_STORE_ENV = 'VAT_PROJECTION_STORE';
 /** {@link PROJECTION_STORE_ENV}'s value that selects the SQLite backend. */
 export const PROJECTION_STORE_SQLITE = 'sqlite';
+/**
+ * Where the projection store's database lives, overriding the default.
+ *
+ * The default is `tmpdir/.vat-cache/<version>/projection-<shapeDigest>` — one
+ * database per VAT release, shared by every root on the machine. This names a
+ * different one **explicitly**, which is what an adopter with a per-job cache
+ * directory, a shared build agent running two jobs at once, or a test arm that
+ * must not touch the developer's live cache actually needs.
+ *
+ * 🪤 **What it replaces is redirecting `TMPDIR`, which works and is the wrong
+ * instrument.** `defaultStoreDirectory()` resolves through
+ * `vatCacheNamespaceRoot()` → `normalizedTmpdir()`, so pointing the OS temp
+ * directory elsewhere does move the store — along with every other temp
+ * consumer in the process, on a variable whose name is not the same on both
+ * platforms (`TMPDIR` on POSIX; `TEMP`, then `TMP`, on Windows, so setting one
+ * is silently inert on the other). It relocates the store as a side effect of
+ * relocating something larger. This variable says the one thing meant.
+ *
+ * ⚠️ It does **not** consult `XDG_CACHE_HOME` or `HOME`. A caller that set
+ * those believed it had its own database and was writing into the shared one;
+ * the fix is to name the directory here, not to add more implicit roots.
+ *
+ * An environment variable rather than a config field, for the same reason
+ * {@link PROJECTION_STORE_ENV} is one: it says where an INSTRUMENT keeps its
+ * scratch space, not what the project means, and it has to be reachable from a
+ * harness that spawns the binary.
+ */
+export const PROJECTION_STORE_DIR_ENV = 'VAT_PROJECTION_STORE_DIR';
 /**
  * The env var that turns VAT's disk caches off for a run.
  *
@@ -111,6 +139,8 @@ export const CACHE_DISABLED = '0';
  * it: RAG carries a platform-native binary, while this one carries a Node
  * version floor.
  */
+/** What Node throws for `import('node:sqlite')` before 22.13.0. */
+const UNKNOWN_BUILTIN_MODULE = 'ERR_UNKNOWN_BUILTIN_MODULE';
 const PROJECTION_STORE_BACKEND = {
     feature: 'The projection store',
     packageName: '@vibe-agent-toolkit/projection-sqlite',
@@ -193,19 +223,101 @@ export async function openPopulationCache(options) {
  * for "upgrade Node", and diagnosing a version floor as a missing dependency
  * sends a user round a loop that cannot terminate.
  *
- * @returns The opened store
+ * @returns The opened store, typed as the engine-free contract — the SQLite
+ *   backend really does return a `SqlQueryableStore`, and this narrows it away
+ *   on purpose so the population path cannot grow a query
  */
 async function loadStore() {
+    const directory = process.env[PROJECTION_STORE_DIR_ENV];
+    // Spread rather than passed, because the backend defaults the field when it is
+    // ABSENT and an explicit `undefined` is a different argument under
+    // `exactOptionalPropertyTypes`. Empty string is treated as unset: an unset
+    // variable and one exported as `''` are the same intent, and `''` would
+    // otherwise resolve to the process cwd.
+    return (await loadBackend()).openSqliteProjectionStore(directory === undefined || directory === '' ? {} : { directory });
+}
+/**
+ * Open a store that lives only in this process's memory.
+ *
+ * 🔑 **This is what keeps the query surface an ANSWER rather than a privilege.**
+ * A caller with no store selected — CI's first run, or a developer who never set
+ * the selector — still gets the same SQL over the same schema; the on-disk store
+ * only makes the second run cheap. Without it, "what does this tree contain"
+ * would be answerable only where a cache happened to exist, and two callers
+ * would hold differently-shaped views of one tree.
+ *
+ * It is a cache that cannot hit: nothing survives the close, so a caller must
+ * write the projection into it before asking anything.
+ *
+ * @returns An open, empty store; close it when done
+ */
+export async function openEphemeralQueryStore() {
+    return (await loadBackend()).openEphemeralProjectionStore();
+}
+/**
+ * Load the selected backend module, or report it as uninstalled and exit.
+ *
+ * @returns The backend's module namespace
+ */
+async function loadBackend() {
     try {
-        const backend = await import('@vibe-agent-toolkit/projection-sqlite');
-        return backend.openSqliteProjectionStore();
+        return await import('@vibe-agent-toolkit/projection-sqlite');
     }
     catch (error) {
+        const floor = nodeSqliteFloorFailure(error);
+        if (floor !== undefined)
+            throw floor;
         if (!isModuleMissing(error))
             throw error;
         reportMissingBackend(PROJECTION_STORE_BACKEND);
     }
 }
+/**
+ * The legible failure for "your Node is too old", or `undefined` when this is
+ * some other failure — including "the package is absent".
+ *
+ * Exported, and returning the error rather than throwing it, so the DIAGNOSIS
+ * is unit-testable without a mocked dynamic import. A test cannot make a mocked
+ * `import()` reject with a plain `{ code }` — the test runner wraps whatever a
+ * module factory throws in its own error, so the code never survives to be
+ * read — and the branch's whole value is the message it produces.
+ *
+ * 🪤 The two are **different error codes**, and only one of them reaches
+ * {@link isModuleMissing}. `@vibe-agent-toolkit/projection-sqlite` imports
+ * `node:sqlite`, which arrived in Node 22.13.0; on 22.0–22.12 the import fails
+ * with `ERR_UNKNOWN_BUILTIN_MODULE`, not `ERR_MODULE_NOT_FOUND`. Without this
+ * branch the user gets a bare `No such built-in module: node:sqlite` — which
+ * names neither the version floor nor the fix.
+ *
+ * ⚠️ It is reachable on EVERY `vat resources query`/`check` run, and not a
+ * corner: VAT's own floor is `>=22.0.0`, so a supported Node hits it. That was
+ * already true before the store-selected path stopped querying a shared
+ * database — the query lane has always fallen back to
+ * {@link openEphemeralQueryStore} when no store is selected, which is the
+ * default, so `node:sqlite` was required on every default run. Nothing here
+ * became newly reachable; the branch is load-bearing because the FLOOR is,
+ * whichever way the lane resolves its store.
+ *
+ * The repair stays distinct from the missing-package one on purpose:
+ * "install this package" is the wrong instruction for "upgrade Node", and
+ * sending someone round that loop cannot terminate.
+ *
+ * @param error - Whatever the dynamic import threw
+ * @returns The error to raise when Node itself lacks the builtin; `undefined`
+ *   when this failure is something else and the caller should keep diagnosing
+ */
+export function nodeSqliteFloorFailure(error) {
+    const isFloor = typeof error === 'object'
+        && error !== null
+        && 'code' in error
+        && error.code === UNKNOWN_BUILTIN_MODULE;
+    if (!isFloor)
+        return undefined;
+    return new Error('The projection store needs `node:sqlite`, which this Node does not have.'
+        + ` VAT runs on Node >= 22.0.0, but \`node:sqlite\` arrived in 22.13.0 — you are on ${process.version}.`
+        + ' Upgrade Node to 22.13.0 or newer. Installing a package will not help:'
+        + ' the module is built into Node, not published to npm.');
+}
 /**
  * Run one command's work with a projection store open for its whole duration,
  * and closed however it ends.
@@ -218,7 +330,17 @@ async function loadStore() {
  *
  * It is also the `withGitSnapshotCache` bracket for the work inside it, so the
  * key and the extent filed under it come from ONE git snapshot — see the note
- * on the call below.
+ * in the body.
+ *
+ * `undefined` on a run with no store selected, which is the shape every
+ * population lane wants: no store means re-derive, not fail.
+ *
+ * ⚠️ A caller that wants to run SQL must NOT query this store. It is one
+ * database per VAT release, shared by every root on the machine, so arbitrary
+ * SQL over it answers from other repositories — see `projection-query.ts`.
+ * That is also why this is the ONLY scope over the opened store: there is no
+ * separate "opened handle" bracket for a caller wanting more than the cache,
+ * because there is nothing legitimate for such a caller to want.
  *
  * @param options - Where the corpus is
  * @param options.root - The absolute corpus root

package/dist/utils/projection-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"projection-store.js","sourceRoot":"","sources":["../../src/utils/projection-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAGH,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAEtF,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAwB,MAAM,uBAAuB,CAAC;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAErC,gHAAgH;AAChH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,wBAAwB,GAAoB;IAChD,OAAO,EAAE,sBAAsB;IAC/B,WAAW,EAAE,uCAAuC;CACrD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,uBAAuB,CAAC;AACvE,CAAC;AAgBD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAEzC;IACC,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO,SAAS,CAAC;IAEjD,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,uEAAuE;IACvE,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,oBAAoB,gBAAgB,OAAO,CAAC,IAAI,+BAA+B;cAChF,4EAA4E;cAC5E,gCAAgC,CACnC,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,OAAO;QACL,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;QACzC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,SAAS;IACtB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;QACtE,OAAO,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACzC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAyB,EACzB,IAAwD;IAExD,4EAA4E;IAC5E,+EAA+E;IAC/E,uEAAuE;IACvE,8EAA8E;IAC9E,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,+EAA+E;IAC/E,yEAAyE;IACzE,2EAA2E;IAC3E,EAAE;IACF,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,4CAA4C;IAC5C,OAAO,oBAAoB,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"projection-store.js","sourceRoot":"","sources":["../../src/utils/projection-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAIH,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAEtF,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAwB,MAAM,uBAAuB,CAAC;AAEpG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAErC,gHAAgH;AAChH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC;;;;;;;GAOG;AACH,mEAAmE;AACnE,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAE5D,MAAM,wBAAwB,GAAoB;IAChD,OAAO,EAAE,sBAAsB;IAC/B,WAAW,EAAE,uCAAuC;CACrD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,uBAAuB;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,uBAAuB,CAAC;AACvE,CAAC;AA4BD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAEzC;IACC,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO,SAAS,CAAC;IAEjD,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,uEAAuE;IACvE,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,oBAAoB,gBAAgB,OAAO,CAAC,IAAI,+BAA+B;cAChF,4EAA4E;cAC5E,gCAAgC,CACnC,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,OAAO;QACL,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;QACzC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,SAAS;IACtB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACxD,+EAA+E;IAC/E,mEAAmE;IACnE,2EAA2E;IAC3E,wEAAwE;IACxE,wCAAwC;IACxC,OAAO,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,yBAAyB,CACpD,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CACjE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,OAAO,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,4BAA4B,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC;QACrC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACzC,oBAAoB,CAAC,wBAAwB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,OAAO,GACX,OAAO,KAAK,KAAK,QAAQ;WACtB,KAAK,KAAK,IAAI;WACd,MAAM,IAAI,KAAK;WACd,KAA4B,CAAC,IAAI,KAAK,sBAAsB,CAAC;IACnE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,IAAI,KAAK,CACd,0EAA0E;UACxE,oFAAoF,OAAO,CAAC,OAAO,GAAG;UACtG,wEAAwE;UACxE,uDAAuD,CAC1D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAyB,EACzB,IAAwD;IAExD,4EAA4E;IAC5E,+EAA+E;IAC/E,uEAAuE;IACvE,8EAA8E;IAC9E,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,+EAA+E;IAC/E,yEAAyE;IACzE,2EAA2E;IAC3E,EAAE;IACF,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,4CAA4C;IAC5C,OAAO,oBAAoB,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/vat-bin-path.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Where the built vat CLI entry is, for the commands that re-invoke it as a
+ * child process.
+ *
+ * ## 🪤 `dist/bin.js`, deliberately NOT `dist/bin/vat.js`
+ *
+ * `packages/lab/src/harness/instrument.ts` documents `dist/bin/vat.js` as a
+ * re-resolving WRAPPER: it looks the CLI up again at run time, so spawning it
+ * can execute a different build than the one the caller is running from. A
+ * supervisor that thinks it is bounding its own code, and a corpus runner that
+ * thinks it is auditing with its own validators, both need the entry point that
+ * cannot be redirected.
+ *
+ * ## Why the two branches
+ *
+ * `node` cannot execute `.ts`, so a caller running from SOURCE under vitest
+ * still has to reach the COMPILED entry — which is why the source-tree branch
+ * walks across to `packages/cli/dist/bin.js` rather than to a sibling. A build
+ * is therefore a precondition for every test that spawns the CLI, and a system
+ * test that skipped it would prove things about a stale `dist`.
+ *
+ * 🪤 Shared rather than copied. This resolution lived inline in
+ * `commands/corpus/runner.ts` and a second caller wanted it; a second copy is a
+ * duplication-gate failure under this repo's zero-tolerance policy, and — worse
+ * — two copies drift, so one caller would keep spawning the wrapper long after
+ * the other stopped. The `__dirname`-relative hops below are correct for THIS
+ * module's location and nothing else, which is precisely why it is not a snippet
+ * to paste.
+ */
+/**
+ * Resolve the path to the built vat CLI entry.
+ *
+ * @returns An absolute path to `dist/bin.js`
+ */
+export declare function resolveVatBinPath(): string;
+//# sourceMappingURL=vat-bin-path.d.ts.map

package/dist/utils/vat-bin-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vat-bin-path.d.ts","sourceRoot":"","sources":["../../src/utils/vat-bin-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAUH;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAO1C"}

package/dist/utils/vat-bin-path.js

@@ -0,0 +1,49 @@
+/**
+ * Where the built vat CLI entry is, for the commands that re-invoke it as a
+ * child process.
+ *
+ * ## 🪤 `dist/bin.js`, deliberately NOT `dist/bin/vat.js`
+ *
+ * `packages/lab/src/harness/instrument.ts` documents `dist/bin/vat.js` as a
+ * re-resolving WRAPPER: it looks the CLI up again at run time, so spawning it
+ * can execute a different build than the one the caller is running from. A
+ * supervisor that thinks it is bounding its own code, and a corpus runner that
+ * thinks it is auditing with its own validators, both need the entry point that
+ * cannot be redirected.
+ *
+ * ## Why the two branches
+ *
+ * `node` cannot execute `.ts`, so a caller running from SOURCE under vitest
+ * still has to reach the COMPILED entry — which is why the source-tree branch
+ * walks across to `packages/cli/dist/bin.js` rather than to a sibling. A build
+ * is therefore a precondition for every test that spawns the CLI, and a system
+ * test that skipped it would prove things about a stale `dist`.
+ *
+ * 🪤 Shared rather than copied. This resolution lived inline in
+ * `commands/corpus/runner.ts` and a second caller wanted it; a second copy is a
+ * duplication-gate failure under this repo's zero-tolerance policy, and — worse
+ * — two copies drift, so one caller would keep spawning the wrapper long after
+ * the other stopped. The `__dirname`-relative hops below are correct for THIS
+ * module's location and nothing else, which is precisely why it is not a snippet
+ * to paste.
+ */
+import { existsSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { safePath } from '@vibe-agent-toolkit/utils';
+const HERE = dirname(fileURLToPath(import.meta.url));
+/**
+ * Resolve the path to the built vat CLI entry.
+ *
+ * @returns An absolute path to `dist/bin.js`
+ */
+export function resolveVatBinPath() {
+    // Compiled tree: packages/cli/dist/utils/vat-bin-path.js → packages/cli/dist/bin.js
+    const compiled = safePath.resolve(HERE, '../bin.js');
+    // eslint-disable-next-line security/detect-non-literal-fs-filename -- internal path
+    if (existsSync(compiled))
+        return compiled;
+    // Source tree (vitest): packages/cli/src/utils/vat-bin-path.ts → packages/cli/dist/bin.js
+    return safePath.resolve(HERE, '../../dist/bin.js');
+}
+//# sourceMappingURL=vat-bin-path.js.map

package/dist/utils/vat-bin-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vat-bin-path.js","sourceRoot":"","sources":["../../src/utils/vat-bin-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAErD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,oFAAoF;IACpF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrD,oFAAoF;IACpF,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,0FAA0F;IAC1F,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;AACrD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-agent-toolkit/cli",
-  "version": "0.2.0-rc.4",
+  "version": "0.2.0-rc.5",
   "description": "Command-line interface for vibe-agent-toolkit",
   "type": "module",
   "bin": {
@@ -46,14 +46,15 @@
   "//dependencies-note": "DO NOT add example agent packages or adopter packages here. Adopter packages (like vat-development-agents) depend on the CLI binary at build time — declaring them as deps creates a circular build dependency. They are built in a second turbo pass via package#task overrides in turbo.json.",
   "dependencies": {
     "@anthropic-ai/sdk": "^0.71.2",
-    "@vibe-agent-toolkit/agent-config": "0.2.0-rc.4",
-    "@vibe-agent-toolkit/schema": "0.2.0-rc.4",
-    "@vibe-agent-toolkit/agent-skills": "0.2.0-rc.4",
-    "@vibe-agent-toolkit/claude-marketplace": "0.2.0-rc.4",
-    "@vibe-agent-toolkit/discovery": "0.2.0-rc.4",
-    "@vibe-agent-toolkit/gateway-mcp": "0.2.0-rc.4",
-    "@vibe-agent-toolkit/resources": "0.2.0-rc.4",
-    "@vibe-agent-toolkit/utils": "0.2.0-rc.4",
+    "@vibe-agent-toolkit/agent-config": "0.2.0-rc.5",
+    "@vibe-agent-toolkit/agent-skills": "0.2.0-rc.5",
+    "@vibe-agent-toolkit/claude-marketplace": "0.2.0-rc.5",
+    "@vibe-agent-toolkit/discovery": "0.2.0-rc.5",
+    "@vibe-agent-toolkit/gateway-mcp": "0.2.0-rc.5",
+    "@vibe-agent-toolkit/projection-sqlite": "0.2.0-rc.5",
+    "@vibe-agent-toolkit/resources": "0.2.0-rc.5",
+    "@vibe-agent-toolkit/schema": "0.2.0-rc.5",
+    "@vibe-agent-toolkit/utils": "0.2.0-rc.5",
     "adm-zip": "^0.6.0",
     "commander": "^12.1.0",
     "picomatch": "^4.0.3",
@@ -68,7 +69,9 @@
     "@types/picomatch": "^4.0.2",
     "@types/semver": "^7.7.1",
     "@types/tar": "^6.1.13",
-    "@vibe-agent-toolkit/dev-tools": "0.2.0-rc.4",
+    "@vibe-agent-toolkit/dev-tools": "0.2.0-rc.5",
+    "@vibe-agent-toolkit/rag": "0.2.0-rc.5",
+    "@vibe-agent-toolkit/rag-lancedb": "0.2.0-rc.5",
     "rimraf": "^6.0.1",
     "typescript": "^5.7.3",
     "vitest": "^3.2.4"
@@ -80,9 +83,17 @@
     "type": "git",
     "url": "https://github.com/jdutton/vibe-agent-toolkit.git"
   },
-  "optionalDependencies": {
-    "@vibe-agent-toolkit/projection-sqlite": "0.2.0-rc.4",
-    "@vibe-agent-toolkit/rag": "0.2.0-rc.4",
-    "@vibe-agent-toolkit/rag-lancedb": "0.2.0-rc.4"
+  "//peerDependencies-note": "The RAG backends are OPTIONAL PEERS, never optionalDependencies. `optionalDependencies` are INSTALLED BY DEFAULT by npm and pnpm alike - 'optional' there means the install may fail without failing the build, not that it is skipped - so declaring them that way shipped ~240 MB (onnxruntime-web 136 MB, a LanceDB platform binary 93 MB, a third apache-arrow, protobufjs) to every adopter, contradicting the seam in src/utils/optional-backend.ts that exists precisely to keep them out. Optional peers are NOT auto-installed, so the manifest now says what that module already says: these ship separately, and an absent one is a legible error naming the package to install. projection-sqlite is deliberately NOT in this group: it has zero third-party dependencies (only node:sqlite, which is built into Node) and a 152 KB dist, so the platform-binary argument that justifies the seam is simply false for it. It is also what `vat resources query` builds its ephemeral in-memory store from, and a query surface that works only where a backend was separately installed is the capability gate the projection design forbids.",
+  "peerDependencies": {
+    "@vibe-agent-toolkit/rag": "0.2.0-rc.5",
+    "@vibe-agent-toolkit/rag-lancedb": "0.2.0-rc.5"
+  },
+  "peerDependenciesMeta": {
+    "@vibe-agent-toolkit/rag": {
+      "optional": true
+    },
+    "@vibe-agent-toolkit/rag-lancedb": {
+      "optional": true
+    }
   }
 }