@vibe-agent-toolkit/utils 0.2.0-rc.3 → 0.2.0-rc.4

package/dist/index.d.ts

@@ -3,40 +3,39 @@
  * Core shared utilities with no dependencies on other packages
  *
  * Utilities are added as needed by other packages, not speculatively.
+ *
+ * **A module that brings a third-party dependency belongs on a subpath, not
+ * here.** This entry has ~245 in-repo importers plus published adopters, and
+ * every one of them pays for the whole graph reachable from it — a bundler that
+ * cannot tree-shake a dependency (a CJS package, or one reached through
+ * `new URL(..., import.meta.url)`) inlines it into every consumer that touched
+ * a path helper. The domains that carry weight each have their own entry:
+ * `./crawl`, `./git`, `./process`, `./skill-test`, `./template`, `./yaml`.
+ * `./skill-test` is there for a *transitive* reason rather than a direct one —
+ * it declares no dependency itself, but spawning a headless agent goes through
+ * `./process`, which reaches `which` and (because `safeExecSync` refuses `git`
+ * and delegates) `@vibe-validate/git`. Reachability is the criterion, not the
+ * import a module happens to write.
+ *
+ * The rule is enforced, not merely stated: `test/subpath-purity.test.ts` asserts
+ * this entry's reachable third-party set by equality, so a dependency arriving
+ * here — directly or transitively, through any module below — turns that row red
+ * and has to be an argued edit rather than an unnoticed one.
  */
-export * from './safe-exec.js';
-export * from './windows-shell.js';
-export * from './spawn-hardened.js';
 export * from './path-utils.js';
 export * from './text-content.js';
 export * from './text-file.js';
-export * from './stdio-blocking.js';
 export * from './asset-reference.js';
 export { classifyFilenameCaseFrom, copyDirectory, fillRealpaths, fillSiblingNames, FsLookupCache, isFilesystemAccessError, realpathFrom, } from './fs-utils.js';
 export type { FilenameCaseVerdict, FilenameMatch, PathProbe, PathProbeStats, RealpathTable, SiblingNamesTable, } from './fs-utils.js';
-export * from './file-crawler.js';
-export * from './gitignore-checker.js';
-export * from './git-run.js';
-export * from './git-url.js';
-export * from './git-utils.js';
-export * from './git-snapshot.js';
 export * from './project-utils.js';
-export * from './git-tracker.js';
 export * from './test-helpers.js';
 export * from './zod-introspection.js';
-export * from './template.js';
 export * from './skill-targets.js';
-export { type LinkAuthConfig, type Provider, type ProviderAuth, type ProviderCheck, resolveAuthenticatedUrl, type ResolveOutcome, } from './link-auth/resolve.js';
-export type { ProviderMatch } from './link-auth/select-provider.js';
-export type { RewriteRule } from './link-auth/rewrite.js';
-export { defaultRunCommand, type TokenSource } from './link-auth/resolve-token.js';
-export { expandMacro, UnknownMacroError } from './link-auth/expand-macro.js';
-export * from './skill-test/index.js';
 export * from './glob/glob-pattern.js';
 export * from './fs/file-hash.js';
-export * from './yaml/surgical-yaml.js';
 export { parseWholeNumberAtLeast } from './numeric-args.js';
 export { compareCodeUnits } from './compare-code-units.js';
-export { CRAWL_BLOB_POPULATE_ID, CRAWL_CLOSURE_CONTRIBUTE_ID, CRAWL_CLOSURE_RESOLVE_ID, CRAWL_PASS_INSIDE, CRAWL_REGISTRY_ADD_RESOURCE_ID, CRAWL_REGISTRY_ENUMERATE_ID, CRAWL_REGISTRY_ID_PREFIX, CRAWL_REGISTRY_RESOLVE_LINKS_ID, CRAWL_SEAM_DUMP_VERSION, CRAWL_SHARED_GIT_TRACKER_ID, CRAWL_STORE_READ_ID, CRAWL_STORE_WRITE_ID, CRAWL_STRATA, CRAWL_WALKER_GITIGNORE_ID, CRAWL_WALKER_ID, crawlTimingStart, recordContributorInvocation, recordCrawlPass, recordRegistryPass, recordSharedPass, withContributorStratum, withOuterBracket, type CrawlDriverStratum, type CrawlStratum, type CrawlTimingDump, type CrawlTimingEntry, type CrawlTimingProcess, __readCrawlTimingSnapshot, __setCrawlTimingForTest, __writeCrawlTimingDumpForTest, } from './crawl-timing.js';
+export { CRAWL_BLOB_POPULATE_ID, CRAWL_CLOSURE_CONTRIBUTE_ID, CRAWL_CLOSURE_RESOLVE_ID, CRAWL_PASS_INSIDE, CRAWL_REGISTRY_ADMIT_ID, CRAWL_REGISTRY_ENUMERATE_ID, CRAWL_REGISTRY_ID_PREFIX, CRAWL_REGISTRY_RESOLVE_LINKS_ID, CRAWL_SHARED_GIT_TRACKER_ID, CRAWL_STORE_READ_ID, CRAWL_STORE_WRITE_ID, CRAWL_STRATA, CRAWL_WALKER_GITIGNORE_ID, CRAWL_WALKER_ID, crawlTimingStart, recordContributorInvocation, recordCrawlPass, recordRegistryPass, recordSharedPass, withContributorStratum, withOuterBracket, type CrawlDriverStratum, type CrawlStratum, type CrawlTimingDump, type CrawlTimingEntry, type CrawlTimingProcess, __readCrawlTimingSnapshot, __setCrawlTimingForTest, __writeCrawlTimingDumpForTest, } from './crawl-timing.js';
 export { ensureTimingDirectory, normalizeTimingDirectory, readTimingProcess, type TimingProcess, writeTimingDump, } from './timing-dump.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,cAAc,gBAAgB,CAAC;AAG/B,cAAc,oBAAoB,CAAC;AAGnC,cAAc,qBAAqB,CAAC;AAGpC,cAAc,iBAAiB,CAAC;AAShC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAG/B,cAAc,qBAAqB,CAAC;AAGpC,cAAc,sBAAsB,CAAC;AAqCrC,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,cAAc,EACd,aAAa,EACb,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAGvB,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAKvC,cAAc,cAAc,CAAC;AAG7B,cAAc,cAAc,CAAC;AAG7B,cAAc,gBAAgB,CAAC;AAG/B,cAAc,mBAAmB,CAAC;AAIlC,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,eAAe,CAAC;AAG9B,cAAc,oBAAoB,CAAC;AAInC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,uBAAuB,EACvB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAG7E,cAAc,uBAAuB,CAAC;AAGtC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,yBAAyB,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAgB3D,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,8BAA8B,EAC9B,2BAA2B,EAC3B,wBAAwB,EACxB,+BAA+B,EAK/B,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,aAAa,EAClB,eAAe,GAChB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,cAAc,iBAAiB,CAAC;AAShC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAG/B,cAAc,sBAAsB,CAAC;AAqCrC,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,SAAS,EACT,cAAc,EACd,aAAa,EACb,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAIvB,cAAc,oBAAoB,CAAC;AAGnC,cAAc,mBAAmB,CAAC;AAGlC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,oBAAoB,CAAC;AAGnC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,mBAAmB,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAgB3D,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,+BAA+B,EAC/B,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,yBAAyB,EACzB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,aAAa,EAClB,eAAe,GAChB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -3,13 +3,25 @@
  * Core shared utilities with no dependencies on other packages
  *
  * Utilities are added as needed by other packages, not speculatively.
+ *
+ * **A module that brings a third-party dependency belongs on a subpath, not
+ * here.** This entry has ~245 in-repo importers plus published adopters, and
+ * every one of them pays for the whole graph reachable from it — a bundler that
+ * cannot tree-shake a dependency (a CJS package, or one reached through
+ * `new URL(..., import.meta.url)`) inlines it into every consumer that touched
+ * a path helper. The domains that carry weight each have their own entry:
+ * `./crawl`, `./git`, `./process`, `./skill-test`, `./template`, `./yaml`.
+ * `./skill-test` is there for a *transitive* reason rather than a direct one —
+ * it declares no dependency itself, but spawning a headless agent goes through
+ * `./process`, which reaches `which` and (because `safeExecSync` refuses `git`
+ * and delegates) `@vibe-validate/git`. Reachability is the criterion, not the
+ * import a module happens to write.
+ *
+ * The rule is enforced, not merely stated: `test/subpath-purity.test.ts` asserts
+ * this entry's reachable third-party set by equality, so a dependency arriving
+ * here — directly or transitively, through any module below — turns that row red
+ * and has to be an argued edit rather than an unnoticed one.
  */
-// Safe command execution (cross-platform, no shell injection)
-export * from './safe-exec.js';
-// Windows shell-invocation helpers (.cmd/.bat/.ps1 handling), shared by every spawn wrapper
-export * from './windows-shell.js';
-// Hardened async spawn (streaming stdio + correct Windows .cmd/.bat launching)
-export * from './spawn-hardened.js';
 // Cross-platform path utilities
 export * from './path-utils.js';
 // THE content-decoding seam: bytes to text, in one place. `decodeTextContent` is
@@ -21,8 +33,6 @@ export * from './path-utils.js';
 // of the repo is a migration ledger in `eslint.config.js`, not a covered claim.
 export * from './text-content.js';
 export * from './text-file.js';
-// Blocking stdio for published bins (process.exit must not truncate output)
-export * from './stdio-blocking.js';
 // Asset reference resolution (paths + npm bare specifiers)
 export * from './asset-reference.js';
 // Filesystem utilities.
@@ -61,46 +71,19 @@ export * from './asset-reference.js';
 // symptom is a type that cannot be imported, which surfaces the first time
 // someone tries — not a silent break in existing code.
 export { classifyFilenameCaseFrom, copyDirectory, fillRealpaths, fillSiblingNames, FsLookupCache, isFilesystemAccessError, realpathFrom, } from './fs-utils.js';
-// Directory crawling with glob patterns
-export * from './file-crawler.js';
-// Git ignore checking
-export * from './gitignore-checker.js';
-// The one way to run git: scrubbed by default, `ambient: true` to opt out.
-// safeExecSync/safeExecResult refuse `git` and point here. The scrub itself,
-// and dirty-corrected tree snapshots, come from `@vibe-validate/git`.
-export * from './git-run.js';
-// Git URL parsing (parse/detect git URLs, GitHub shorthand, SSH forms)
-export * from './git-url.js';
-// Git utilities (using git commands directly)
-export * from './git-utils.js';
-// Dirty-corrected tree snapshots: paths, on-disk blob OIDs and modes in one call
-export * from './git-snapshot.js';
 // Project root discovery (canonical: config → git → null).
 // CLI-boundary use only — see docs/concepts/roots-and-config.md.
 export * from './project-utils.js';
-// Git tracking cache (for efficient git-ignore checking)
-export * from './git-tracker.js';
 // Test helpers for isolated test output directories
 export * from './test-helpers.js';
 // Zod type introspection (version-agnostic)
 export * from './zod-introspection.js';
-// Handlebars template rendering (cached, no HTML escaping)
-export * from './template.js';
 // Skill target resolution (cross-platform flat skill install paths)
 export * from './skill-targets.js';
-// linkAuth pure engine — public API only (issue #113).
-// Internal helpers (rewrite, build-headers, etc.) stay module-private.
-export { resolveAuthenticatedUrl, } from './link-auth/resolve.js';
-export { defaultRunCommand } from './link-auth/resolve-token.js';
-export { expandMacro, UnknownMacroError } from './link-auth/expand-macro.js';
-// Skill testing utilities (environment management for headless agent runs)
-export * from './skill-test/index.js';
 // Glob pattern helpers (isGlob, staticGlobBase, globMagicRemainder)
 export * from './glob/glob-pattern.js';
 // Filesystem hashing (sha256 of raw file bytes)
 export * from './fs/file-hash.js';
-// Byte-surgical YAML value updater (replace/insert without reflowing the doc)
-export * from './yaml/surgical-yaml.js';
 export { parseWholeNumberAtLeast } from './numeric-args.js';
 // Machine-independent string ordering for hashed/serialized output — never `localeCompare`.
 export { compareCodeUnits } from './compare-code-units.js';
@@ -118,12 +101,7 @@ export { compareCodeUnits } from './compare-code-units.js';
 // `keyOf`, `recordInheritedPass`) are not surface, and `timing-dump.ts` is
 // plumbing shared with `resources`' package-internal `parse-timing.ts` — a star
 // re-export would publish both the moment either grew a symbol.
-export { CRAWL_BLOB_POPULATE_ID, CRAWL_CLOSURE_CONTRIBUTE_ID, CRAWL_CLOSURE_RESOLVE_ID, CRAWL_PASS_INSIDE, CRAWL_REGISTRY_ADD_RESOURCE_ID, CRAWL_REGISTRY_ENUMERATE_ID, CRAWL_REGISTRY_ID_PREFIX, CRAWL_REGISTRY_RESOLVE_LINKS_ID, 
-// Exported so the READER can pin itself against the WRITER. `@vibe-agent-toolkit/lab`
-// hard-refuses a dump whose version it does not recognise, and the two constants
-// used to be unrelated literals in two packages — drift was silent, and its symptom
-// is every dump being refused rather than a subtly wrong number.
-CRAWL_SEAM_DUMP_VERSION, CRAWL_SHARED_GIT_TRACKER_ID, CRAWL_STORE_READ_ID, CRAWL_STORE_WRITE_ID, CRAWL_STRATA, CRAWL_WALKER_GITIGNORE_ID, CRAWL_WALKER_ID, crawlTimingStart, recordContributorInvocation, recordCrawlPass, recordRegistryPass, recordSharedPass, withContributorStratum, withOuterBracket, __readCrawlTimingSnapshot, __setCrawlTimingForTest, __writeCrawlTimingDumpForTest, } from './crawl-timing.js';
+export { CRAWL_BLOB_POPULATE_ID, CRAWL_CLOSURE_CONTRIBUTE_ID, CRAWL_CLOSURE_RESOLVE_ID, CRAWL_PASS_INSIDE, CRAWL_REGISTRY_ADMIT_ID, CRAWL_REGISTRY_ENUMERATE_ID, CRAWL_REGISTRY_ID_PREFIX, CRAWL_REGISTRY_RESOLVE_LINKS_ID, CRAWL_SHARED_GIT_TRACKER_ID, CRAWL_STORE_READ_ID, CRAWL_STORE_WRITE_ID, CRAWL_STRATA, CRAWL_WALKER_GITIGNORE_ID, CRAWL_WALKER_ID, crawlTimingStart, recordContributorInvocation, recordCrawlPass, recordRegistryPass, recordSharedPass, withContributorStratum, withOuterBracket, __readCrawlTimingSnapshot, __setCrawlTimingForTest, __writeCrawlTimingDumpForTest, } from './crawl-timing.js';
 // The on-disk plumbing both timing seams share. Exported because
 // `resources`' `parse-timing.ts` is the other consumer and now sits a package
 // away; nothing else should reach for it.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8DAA8D;AAC9D,cAAc,gBAAgB,CAAC;AAE/B,4FAA4F;AAC5F,cAAc,oBAAoB,CAAC;AAEnC,+EAA+E;AAC/E,cAAc,qBAAqB,CAAC;AAEpC,gCAAgC;AAChC,cAAc,iBAAiB,CAAC;AAEhC,iFAAiF;AACjF,2EAA2E;AAC3E,iFAAiF;AACjF,gEAAgE;AAChE,6EAA6E;AAC7E,iFAAiF;AACjF,gFAAgF;AAChF,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAE/B,4EAA4E;AAC5E,cAAc,qBAAqB,CAAC;AAEpC,2DAA2D;AAC3D,cAAc,sBAAsB,CAAC;AAErC,wBAAwB;AACxB,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,iFAAiF;AACjF,+EAA+E;AAC/E,oEAAoE;AACpE,EAAE;AACF,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,wEAAwE;AACxE,gFAAgF;AAChF,kFAAkF;AAClF,yDAAyD;AACzD,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,yBAAyB;AACzB,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,8BAA8B;AAC9B,EAAE;AACF,gFAAgF;AAChF,kEAAkE;AAClE,8EAA8E;AAC9E,2EAA2E;AAC3E,uDAAuD;AACvD,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,YAAY,GACb,MAAM,eAAe,CAAC;AAUvB,wCAAwC;AACxC,cAAc,mBAAmB,CAAC;AAElC,sBAAsB;AACtB,cAAc,wBAAwB,CAAC;AAEvC,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,cAAc,cAAc,CAAC;AAE7B,uEAAuE;AACvE,cAAc,cAAc,CAAC;AAE7B,8CAA8C;AAC9C,cAAc,gBAAgB,CAAC;AAE/B,iFAAiF;AACjF,cAAc,mBAAmB,CAAC;AAElC,2DAA2D;AAC3D,iEAAiE;AACjE,cAAc,oBAAoB,CAAC;AAEnC,yDAAyD;AACzD,cAAc,kBAAkB,CAAC;AAEjC,oDAAoD;AACpD,cAAc,mBAAmB,CAAC;AAElC,4CAA4C;AAC5C,cAAc,wBAAwB,CAAC;AAEvC,2DAA2D;AAC3D,cAAc,eAAe,CAAC;AAE9B,oEAAoE;AACpE,cAAc,oBAAoB,CAAC;AAEnC,uDAAuD;AACvD,uEAAuE;AACvE,OAAO,EAKL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,8BAA8B,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAE7E,2EAA2E;AAC3E,cAAc,uBAAuB,CAAC;AAEtC,oEAAoE;AACpE,cAAc,wBAAwB,CAAC;AAEvC,gDAAgD;AAChD,cAAc,mBAAmB,CAAC;AAElC,8EAA8E;AAC9E,cAAc,yBAAyB,CAAC;AAExC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,4FAA4F;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,+EAA+E;AAC/E,mCAAmC;AACnC,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,gFAAgF;AAChF,gEAAgE;AAChE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,8BAA8B,EAC9B,2BAA2B,EAC3B,wBAAwB,EACxB,+BAA+B;AAC/B,sFAAsF;AACtF,iFAAiF;AACjF,oFAAoF;AACpF,iEAAiE;AACjE,uBAAuB,EACvB,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAMhB,yBAAyB,EACzB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,iEAAiE;AACjE,8EAA8E;AAC9E,0CAA0C;AAC1C,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EAEjB,eAAe,GAChB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,gCAAgC;AAChC,cAAc,iBAAiB,CAAC;AAEhC,iFAAiF;AACjF,2EAA2E;AAC3E,iFAAiF;AACjF,gEAAgE;AAChE,6EAA6E;AAC7E,iFAAiF;AACjF,gFAAgF;AAChF,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAE/B,2DAA2D;AAC3D,cAAc,sBAAsB,CAAC;AAErC,wBAAwB;AACxB,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,iFAAiF;AACjF,+EAA+E;AAC/E,oEAAoE;AACpE,EAAE;AACF,6EAA6E;AAC7E,EAAE;AACF,8EAA8E;AAC9E,iFAAiF;AACjF,iFAAiF;AACjF,wEAAwE;AACxE,gFAAgF;AAChF,kFAAkF;AAClF,yDAAyD;AACzD,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,yBAAyB;AACzB,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,+EAA+E;AAC/E,8BAA8B;AAC9B,EAAE;AACF,gFAAgF;AAChF,kEAAkE;AAClE,8EAA8E;AAC9E,2EAA2E;AAC3E,uDAAuD;AACvD,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,YAAY,GACb,MAAM,eAAe,CAAC;AAUvB,2DAA2D;AAC3D,iEAAiE;AACjE,cAAc,oBAAoB,CAAC;AAEnC,oDAAoD;AACpD,cAAc,mBAAmB,CAAC;AAElC,4CAA4C;AAC5C,cAAc,wBAAwB,CAAC;AAEvC,oEAAoE;AACpE,cAAc,oBAAoB,CAAC;AAEnC,oEAAoE;AACpE,cAAc,wBAAwB,CAAC;AAEvC,gDAAgD;AAChD,cAAc,mBAAmB,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,4FAA4F;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,+EAA+E;AAC/E,mCAAmC;AACnC,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,gFAAgF;AAChF,gEAAgE;AAChE,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,+BAA+B,EAC/B,2BAA2B,EAC3B,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,yBAAyB,EACzB,eAAe,EACf,gBAAgB,EAChB,2BAA2B,EAC3B,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAMhB,yBAAyB,EACzB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,mBAAmB,CAAC;AAE3B,iEAAiE;AACjE,8EAA8E;AAC9E,0CAA0C;AAC1C,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EAEjB,eAAe,GAChB,MAAM,kBAAkB,CAAC"}

package/dist/project.d.ts

@@ -14,11 +14,13 @@
  * they largely are not, for the reasons documented on the guard test in
  * `test/package-exports.test.ts`. But the question that decides whether an entry
  * should exist is "how heavy is the only remaining door?" With `./project` gone,
- * the sole route to these functions was the `.` barrel, which reaches
- * `handlebars`, `yaml`, `picomatch`, `ignore` and `which`. A consumer that avoids
- * the barrel on graph-weight grounds — which is the entire premise of this
- * package's subpath layout — could no longer reach a capability whose own code
- * imports nothing but `node:fs` and `node:path`.
+ * the sole route to these functions was the `.` barrel, which at the time reached
+ * five third-party packages. A consumer that avoids the barrel on graph-weight
+ * grounds — which is the entire premise of this package's subpath layout — could
+ * no longer reach a capability whose own code imports nothing but `node:fs` and
+ * `node:path`. The barrel is dependency-free today, which generalizes the
+ * argument rather than retiring it: every domain that carries weight is its own
+ * entry, and reaching a pure one must not cost a neighbour's graph.
  *
  * The functions remain VAT-shaped and are documented as such in README.md: they
  * look for `vibe-agent-toolkit.config.yaml`, then `.git/`. If your notion of a

package/dist/project.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}

package/dist/project.js

@@ -14,11 +14,13 @@
  * they largely are not, for the reasons documented on the guard test in
  * `test/package-exports.test.ts`. But the question that decides whether an entry
  * should exist is "how heavy is the only remaining door?" With `./project` gone,
- * the sole route to these functions was the `.` barrel, which reaches
- * `handlebars`, `yaml`, `picomatch`, `ignore` and `which`. A consumer that avoids
- * the barrel on graph-weight grounds — which is the entire premise of this
- * package's subpath layout — could no longer reach a capability whose own code
- * imports nothing but `node:fs` and `node:path`.
+ * the sole route to these functions was the `.` barrel, which at the time reached
+ * five third-party packages. A consumer that avoids the barrel on graph-weight
+ * grounds — which is the entire premise of this package's subpath layout — could
+ * no longer reach a capability whose own code imports nothing but `node:fs` and
+ * `node:path`. The barrel is dependency-free today, which generalizes the
+ * argument rather than retiring it: every domain that carries weight is its own
+ * entry, and reaching a pure one must not cost a neighbour's graph.
  *
  * The functions remain VAT-shaped and are documented as such in README.md: they
  * look for `vibe-agent-toolkit.config.yaml`, then `.git/`. If your notion of a

package/dist/project.js.map

@@ -1 +1 @@
-{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../src/project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,sBAAsB,GACvB,MAAM,oBAAoB,CAAC"}

package/dist/testing.d.ts

@@ -1,8 +1,78 @@
 /**
- * @vibe-agent-toolkit/utils/testing
+ * Fixture primitives shared by suites in more than one package.
  *
- * Isolated temp-directory helpers for test suites. Node-only. Intended for
- * a consumer's test code — not for their shipped runtime.
+ * Deliberately framework-free: nothing here imports `vitest`, so this module
+ * stays a plain function library rather than something that registers hooks as a
+ * side effect of being imported. Each suite owns its own `beforeEach`/
+ * `afterEach` and calls these from inside them — two lines, which is below
+ * anything worth sharing, while the part that is genuinely identical (mkdtemp,
+ * write the literal, remove the tree) lives here once.
+ *
+ * It earned a home in `utils` the ordinary way: two packages needed it, not one
+ * package speculating that a second might.
+ *
+ * ⛔ **Do not import `vitest` here to share the hook wrapper itself.**
+ * `subpath-purity.test.ts` pins this entry at an EMPTY third-party set, and that
+ * pin is load-bearing: `./testing` is a published subpath, so a test framework
+ * reached from it becomes a runtime requirement for every adopter who imports
+ * it. {@link replantableCorpus} exists precisely so the per-test wrapper each
+ * suite still writes is three lines rather than twelve.
  */
 export * from './test-helpers.js';
+/** A planted fixture tree and the means to remove it. */
+export interface TempCorpus {
+    /** Absolute path to the tree's root. */
+    root: string;
+    /** Remove the tree. Safe to call when it is already gone. */
+    cleanup: () => void;
+}
+/**
+ * Write a literal corpus into a fresh temp directory.
+ *
+ * 🪤 Fixture files must NOT be byte-identical to each other when the suite is
+ * about content-addressed behaviour: VAT's blobs are keyed on their bytes plus
+ * the parser kind, so two files with the same content collapse into ONE blob and
+ * assertions then describe whichever path sorted first. Give each fixture a
+ * distinguishing marker line.
+ *
+ * ⚠️ The root is minted per call, so a suite that plants per test must call this
+ * per test — a root captured once and reused across tests survives its own
+ * `cleanup`.
+ *
+ * @param prefix - `mkdtemp` prefix, so a leaked directory names its own suite
+ * @param corpus - Fixture name to file content; written verbatim as UTF-8.
+ *   Names may include forward-slash subpaths only if their parents already exist
+ * @returns The tree's root and its teardown
+ */
+export declare function createTempCorpus(prefix: string, corpus: Readonly<Record<string, string>>): TempCorpus;
+/** A corpus that can be planted and cleared repeatedly — one tree per test. */
+export interface ReplantableCorpus {
+    /** Plant a fresh tree. Drive from the suite's `beforeEach`. */
+    plant: () => void;
+    /** Remove the current tree, if any. Drive from the suite's `afterEach`. */
+    clear: () => void;
+    /** The root minted by the most recent {@link plant}. */
+    root: () => string;
+}
+/**
+ * Hold a per-test corpus root, so a suite's hook wrapper is three lines.
+ *
+ * ⚠️ **The root comes back through a GETTER, never as a value.** A per-test
+ * fixture is reminted for every test, so a root captured at registration time is
+ * `undefined` in the first test and stale in every one after it. That mistake is
+ * the reason this holder exists rather than each suite keeping its own `let`.
+ *
+ * ⭐ Framework-free on purpose: it takes no hooks and registers none, so the
+ * suite still owns its own `beforeEach`/`afterEach` and this module keeps the
+ * empty third-party set its purity pin asserts. See the module docstring.
+ *
+ * 🪤 `root()` before the first `plant()` THROWS by name. The shape it replaced
+ * read an uninitialised `let` and raised `Cannot read properties of undefined`
+ * from inside the fixture, which names neither the suite nor the missing hook.
+ *
+ * @param prefix - `mkdtemp` prefix, so a leaked directory names its own suite
+ * @param corpus - Fixture name to file content, as {@link createTempCorpus} takes it
+ * @returns Plant/clear/root, to be driven from the caller's own hooks
+ */
+export declare function replantableCorpus(prefix: string, corpus: Readonly<Record<string, string>>): ReplantableCorpus;
 //# sourceMappingURL=testing.d.ts.map

package/dist/testing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAUH,cAAc,mBAAmB,CAAC;AAElC,yDAAyD;AACzD,MAAM,WAAW,UAAU;IACzB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACvC,UAAU,CAOZ;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,2EAA2E;IAC3E,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,wDAAwD;IACxD,IAAI,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACvC,iBAAiB,CAyBnB"}

package/dist/testing.js

@@ -1,8 +1,98 @@
 /**
- * @vibe-agent-toolkit/utils/testing
+ * Fixture primitives shared by suites in more than one package.
  *
- * Isolated temp-directory helpers for test suites. Node-only. Intended for
- * a consumer's test code — not for their shipped runtime.
+ * Deliberately framework-free: nothing here imports `vitest`, so this module
+ * stays a plain function library rather than something that registers hooks as a
+ * side effect of being imported. Each suite owns its own `beforeEach`/
+ * `afterEach` and calls these from inside them — two lines, which is below
+ * anything worth sharing, while the part that is genuinely identical (mkdtemp,
+ * write the literal, remove the tree) lives here once.
+ *
+ * It earned a home in `utils` the ordinary way: two packages needed it, not one
+ * package speculating that a second might.
+ *
+ * ⛔ **Do not import `vitest` here to share the hook wrapper itself.**
+ * `subpath-purity.test.ts` pins this entry at an EMPTY third-party set, and that
+ * pin is load-bearing: `./testing` is a published subpath, so a test framework
+ * reached from it becomes a runtime requirement for every adopter who imports
+ * it. {@link replantableCorpus} exists precisely so the per-test wrapper each
+ * suite still writes is three lines rather than twelve.
  */
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { normalizedTmpdir, safePath } from './path-utils.js';
+// The rest of the testing surface. ⚠️ This re-export is the ENTIRETY of what
+// `./testing` used to be, and dropping it silently removed `detachGitEnv`,
+// `setupSyncTempDirSuite` and every sibling from a published subpath. A module
+// that is both a definition site and a barrel loses the barrel first.
 export * from './test-helpers.js';
+/**
+ * Write a literal corpus into a fresh temp directory.
+ *
+ * 🪤 Fixture files must NOT be byte-identical to each other when the suite is
+ * about content-addressed behaviour: VAT's blobs are keyed on their bytes plus
+ * the parser kind, so two files with the same content collapse into ONE blob and
+ * assertions then describe whichever path sorted first. Give each fixture a
+ * distinguishing marker line.
+ *
+ * ⚠️ The root is minted per call, so a suite that plants per test must call this
+ * per test — a root captured once and reused across tests survives its own
+ * `cleanup`.
+ *
+ * @param prefix - `mkdtemp` prefix, so a leaked directory names its own suite
+ * @param corpus - Fixture name to file content; written verbatim as UTF-8.
+ *   Names may include forward-slash subpaths only if their parents already exist
+ * @returns The tree's root and its teardown
+ */
+export function createTempCorpus(prefix, corpus) {
+    const root = mkdtempSync(safePath.join(normalizedTmpdir(), prefix));
+    for (const [name, content] of Object.entries(corpus)) {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename -- a fixture name from the caller's own literal corpus, under this call's fresh mkdtemp root
+        writeFileSync(safePath.join(root, name), content, 'utf8');
+    }
+    return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) };
+}
+/**
+ * Hold a per-test corpus root, so a suite's hook wrapper is three lines.
+ *
+ * ⚠️ **The root comes back through a GETTER, never as a value.** A per-test
+ * fixture is reminted for every test, so a root captured at registration time is
+ * `undefined` in the first test and stale in every one after it. That mistake is
+ * the reason this holder exists rather than each suite keeping its own `let`.
+ *
+ * ⭐ Framework-free on purpose: it takes no hooks and registers none, so the
+ * suite still owns its own `beforeEach`/`afterEach` and this module keeps the
+ * empty third-party set its purity pin asserts. See the module docstring.
+ *
+ * 🪤 `root()` before the first `plant()` THROWS by name. The shape it replaced
+ * read an uninitialised `let` and raised `Cannot read properties of undefined`
+ * from inside the fixture, which names neither the suite nor the missing hook.
+ *
+ * @param prefix - `mkdtemp` prefix, so a leaked directory names its own suite
+ * @param corpus - Fixture name to file content, as {@link createTempCorpus} takes it
+ * @returns Plant/clear/root, to be driven from the caller's own hooks
+ */
+export function replantableCorpus(prefix, corpus) {
+    let planted;
+    return {
+        plant: () => {
+            // 🪤 Removes any tree still standing FIRST. Nested `describe` blocks each
+            // get their own `beforeEach` and vitest runs outer-then-inner before a
+            // single `afterEach`, so a double plant is ordinary rather than exotic.
+            // Overwriting the handle without this would leak the first tree for the
+            // process's lifetime, silently and only on the suites that nest.
+            planted?.cleanup();
+            planted = createTempCorpus(prefix, corpus);
+        },
+        clear: () => {
+            planted?.cleanup();
+            planted = undefined;
+        },
+        root: () => {
+            if (planted === undefined) {
+                throw new Error(`replantableCorpus('${prefix}'): root() before plant() — the suite is missing its beforeEach`);
+            }
+            return planted.root;
+        },
+    };
+}
 //# sourceMappingURL=testing.js.map

package/dist/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,sEAAsE;AACtE,cAAc,mBAAmB,CAAC;AAUlC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,MAAwC;IAExC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,gKAAgK;QAChK,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACjF,CAAC;AAYD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,MAAwC;IAExC,IAAI,OAA+B,CAAC;IACpC,OAAO;QACL,KAAK,EAAE,GAAG,EAAE;YACV,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,EAAE,OAAO,EAAE,CAAC;YACnB,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,EAAE,GAAG,EAAE;YACV,OAAO,EAAE,OAAO,EAAE,CAAC;YACnB,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,EAAE,GAAG,EAAE;YACT,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACb,sBAAsB,MAAM,iEAAiE,CAC9F,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/timing-dump.d.ts

@@ -18,9 +18,14 @@
  * 2. A dump failure is written to **stderr and never thrown**. These run from
  *    an `exit` listener, where a throw changes the process's exit behaviour, and
  *    they must never touch stdout, which carries vat's report.
- * 3. A pid can file more than one dump. `vat validate` spawns the vat binary
- *    once per phase and pids are reused, so `<stem>-<pid>.json` genuinely
- *    collides; the name gains a counter rather than overwriting.
+ * 3. A pid can file more than one dump, and the name is CLAIMED rather than
+ *    checked. `vat validate` spawns the vat binary once per phase and pids are
+ *    reused, so `<stem>-<pid>.json` genuinely collides; worse, worker threads
+ *    SHARE their parent's pid, so a thread pool's whole cohort competes for one
+ *    `<stem>-<pid>` sequence at the same instant. The name gains a counter
+ *    rather than overwriting, and the counter is settled by
+ *    {@link EXCLUSIVE_CREATE} so the OS — not a check-then-write gap — decides
+ *    who won it.
  * 4. The process's own wall and CPU time is read ONCE, at dump time. It is a
  *    lifetime figure for the process and never a duration of the measured work;
  *    its value is the RATIO, which tells a reader whether the wall-timed
@@ -59,6 +64,16 @@ export interface TimingProcess {
     /** System CPU consumed by the process, across all its threads. */
     cpuSystemMs: number;
 }
+/**
+ * Ceiling on the pid-collision search. A directory holding this many dumps for
+ * one pid is a runaway, not a collision, and giving up on a reported line is a
+ * better outcome than spinning.
+ *
+ * Exhausting it does NOT fall back to overwriting the last slot. That was the
+ * old behaviour, and it destroyed a dump for the same reason the check-then-
+ * write gap did — silently, and precisely when the directory was busiest.
+ */
+export declare const MAX_DUMP_COLLISIONS = 1000;
 /**
  * Reduce a raw env value to a directory or `null`.
  *
@@ -107,13 +122,15 @@ export declare function readTimingProcess(): TimingProcess;
  * Write one seam's dump, if the seam is on.
  *
  * The body is built lazily, inside this call, so a disabled seam never pays to
- * snapshot accumulators nobody will read.
+ * snapshot accumulators nobody will read — and a `build` that throws is reported
+ * like any other failure, because this runs from an `exit` listener where a
+ * throw would change the process's exit behaviour.
  *
  * @param noun - What the seam is called, for any failure line
  * @param directory - Where to write, or `null` when the seam is off
  * @param basename - Basename stem for the file
  * @param build - Produces the dump body
- * @returns The path written, or `null` when the seam is off or the write failed
+ * @returns The path written, or `null` when the seam is off or nothing was written
  */
 export declare function writeTimingDump(noun: string, directory: string | null, basename: string, build: () => unknown): string | null;
 //# sourceMappingURL=timing-dump.d.ts.map

package/dist/timing-dump.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timing-dump.d.ts","sourceRoot":"","sources":["../src/timing-dump.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAOH;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACrB;AAeD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAE/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAG1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAM3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,aAAa,CAOjD;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,OAAO,GACnB,MAAM,GAAG,IAAI,CAYf"}
+{"version":3,"file":"timing-dump.d.ts","sourceRoot":"","sources":["../src/timing-dump.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAOH;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;CACrB;AAQD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,OAAO,CAAC;AA6BxC;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAE/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAG1F;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAM3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,aAAa,CAOjD;AA0DD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,OAAO,GACnB,MAAM,GAAG,IAAI,CAoBf"}