karajan-code 3.12.1 → 3.12.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "3.12.1",
+  "version": "3.12.2",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",
@@ -98,7 +98,6 @@
   },
   "dependencies": {
     "@babel/parser": "^7.29.7",
-    "@karajan/core": "*",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "better-sqlite3": "^12.10.0",
     "chokidar": "^5.0.0",
@@ -108,15 +107,13 @@
     "express-rate-limit": "^8.5.0",
     "helmet": "^8.1.0",
     "js-yaml": "^4.2.0",
+    "karajan-core": "^1.0.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",
     "sqlite-vec": "^0.1.9",
     "valibot": "^1.4.1",
     "web-tree-sitter": "^0.26.9"
   },
-  "bundleDependencies": [
-    "@karajan/core"
-  ],
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@vitest/coverage-v8": "^4.1.8",

package/packages/hu-board/package.json

@@ -13,7 +13,7 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@karajan/core": "*",
+    "karajan-core": "*",
     "better-sqlite3": "^12.10.0",
     "chokidar": "^5.0.0",
     "express": "^5.1.0",

package/packages/hu-board/src/plan-mutations.js

@@ -17,13 +17,13 @@
 import { readFileSync, existsSync, readdirSync, mkdirSync, openSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { homedir } from 'node:os';
-import { writeJsonAtomicSync } from '@karajan/core/atomic-write';
+import { writeJsonAtomicSync } from 'karajan-core/atomic-write';
 import { spawn } from 'node:child_process';
 import { trackRun, untrack } from './run-tracker.js';
 import { getHuBoardRunsDir } from './db.js';
 import { fileURLToPath } from 'node:url';
-import { updateHuStatus, certifyAllHus, updateHu } from '@karajan/core/plan-hu-ops';
-import { validateBlockedByChange } from '@karajan/core/plan-validation';
+import { updateHuStatus, certifyAllHus, updateHu } from 'karajan-core/plan-hu-ops';
+import { validateBlockedByChange } from 'karajan-core/plan-validation';
 import { syncPlanFile } from './sync.js';
 import { getDb } from './db.js';
 
@@ -230,7 +230,7 @@ export async function revertHuFromSnapshot({ planId, huId, projectId }) {
   const projectDir = plan.projectDir;
   if (!projectDir) return { ok: false, error: 'plan sin projectDir' };
 
-  const { restoreHuSnapshot } = await import('@karajan/core/hu-snapshot');
+  const { restoreHuSnapshot } = await import('karajan-core/hu-snapshot');
   const restore = await restoreHuSnapshot({ projectDir, huId });
   if (!restore.ok) return { ok: false, error: `restore falló: ${restore.error}` };
 

package/packages/hu-board/src/routes/api.js

@@ -1361,7 +1361,7 @@ router.post('/rag/query', async (req, res) => {
     return res.status(400).json({ error: "'text' is required (non-empty string)" });
   }
   try {
-    const { openVecStore, countChunks } = await import('@karajan/core/vec-store');
+    const { openVecStore, countChunks } = await import('karajan-core/vec-store');
     const { makeEmbedder } = await import('../../../../src/rag/embedders/factory.js');
     const { query } = await import('../../../../src/rag/retriever.js');
     const db = openVecStore({ dim: 768 });

package/packages/hu-board/src/routes/rag.js

@@ -5,7 +5,7 @@
 import { Router } from "express";
 import { existsSync, statSync } from "node:fs";
 import Database from "better-sqlite3";
-import { dbPath } from "@karajan/core/vec-store";
+import { dbPath } from "karajan-core/vec-store";
 import { readConfig } from "../config-yaml.js";
 
 const router = Router();

package/packages/hu-board/src/routes/wiki.js

@@ -4,7 +4,7 @@
 // 503 with installable:true so the front renders an "Install QMD" CTA
 // instead of a generic error when the binary is missing.
 import { Router } from "express";
-import { runCommand } from "@karajan/core/process";
+import { runCommand } from "karajan-core/process";
 
 const router = Router();
 const QMD_NOT_INSTALLED = /command not found|ENOENT|not recognized as/i;

package/packages/hu-board/src/run-tracker.js

@@ -16,7 +16,7 @@
  * se borran como cleanup (responsabilidad de run-registry).
  */
 
-import { listActiveRuns as fsList } from "@karajan/core/run-registry";
+import { listActiveRuns as fsList } from "karajan-core/run-registry";
 
 const runs = new Map();
 let reaperTimer = null;

package/packages/hu-board/src/server.js

@@ -17,7 +17,7 @@ import { reapZombieSessions } from './zombie-reaper.js';
 import { reapZombieHus } from './hu-zombie-reaper.js';
 import { setHuStatus as setHuStatusPlanMutation, setHuFailResult as setHuFailResultPlanMutation } from './plan-mutations.js';
 import { cleanupEphemeralProjects } from './ephemeral-cleaner.js';
-import { findAvailablePort as findAvailablePortBase } from '@karajan/core/port-check';
+import { findAvailablePort as findAvailablePortBase } from 'karajan-core/port-check';
 
 /**
  * Path to the PID file the CLI's `kj board start` / `kj board stop`
@@ -238,7 +238,7 @@ async function main() {
   //   - cooldownUntil > now  → re-programa setTimeout que dispara en cooldown
   // Idempotente (lockfile per session). Cero polling.
   try {
-    const { reconcileAll } = await import('@karajan/core/standby-scheduler');
+    const { reconcileAll } = await import('karajan-core/standby-scheduler');
     const { spawn } = await import('node:child_process');
     const { join, dirname } = await import('node:path');
     const { fileURLToPath } = await import('node:url');

package/packages/hu-board/src/sync.js

@@ -14,7 +14,7 @@ import {
   removeTombstone,
 } from './db.js';
 import { publish as publishEvent } from './event-bus.js';
-import { getSharedPlansDir, SHARED_DIR_NAME, isSharedPath } from '@karajan/core/shared-paths';
+import { getSharedPlansDir, SHARED_DIR_NAME, isSharedPath } from 'karajan-core/shared-paths';
 import { readConfig } from './config-yaml.js';
 
 /**

package/scripts/verify-pack.mjs

@@ -3,7 +3,7 @@
  * Pre-publish tarball smoke gate (KJC-TSK-0553).
  *
  * WHY: the test suite runs against the linked workspace, where
- * `@karajan/core` and its deps resolve via symlink — so a broken
+ * `karajan-core` and its deps resolve via symlink — so a broken
  * PUBLISHED artifact (bundleDependencies dragging in sqlite-vec without
  * its entry point, KJC-BUG-0082 / 0086) passed CI yet failed on every
  * clean `npm install`. v3.2.0, v3.3.0 and v3.4.1 all shipped unable to
@@ -50,6 +50,7 @@ function fail(msg, detail) {
 
 let tgzPath = null;
 let tmpDir = null;
+let gTmp = null;
 let pnpmTmp = null;
 try {
   console.log(`verify-pack: packing karajan-code@${expectedVersion}…`);
@@ -92,15 +93,16 @@ try {
   console.log("verify-pack: kj --help ✓");
 
   // 3. The deps that broke before must resolve in the installed tree.
-  const installedRoot = path.join(tmpDir, "node_modules", "karajan-code");
+  // karajan-core is a registry dep since KJC-BUG-0103 (no bundling), so it
+  // hoists to the consumer's top-level node_modules like everything else.
   const checks = [
     path.join(tmpDir, "node_modules", "sqlite-vec", "index.mjs"),
-    path.join(installedRoot, "node_modules", "@karajan", "core", "src", "vec-store.js"),
+    path.join(tmpDir, "node_modules", "karajan-core", "src", "vec-store.js"),
   ];
   for (const p of checks) {
     if (!fs.existsSync(p)) fail(`expected resolved path missing in install: ${p}`);
   }
-  console.log("verify-pack: sqlite-vec + @karajan/core resolve ✓");
+  console.log("verify-pack: sqlite-vec + karajan-core resolve ✓");
 
   // 4. kj-trash (ai-trash safety binary) must ship + link onto PATH and boot
   // without a module-resolution crash. It was silently absent from the tarball
@@ -115,9 +117,38 @@ try {
   }
   console.log("verify-pack: kj-trash ships + boots ✓");
 
-  // 5. pnpm install smoke (KJC-TSK-0580). pnpm's layout differs from npm's
+  // 5. GLOBAL install smoke (KJC-BUG-0103). `npm install -g` nests every dep
+  // under karajan-code/node_modules; with bundleDependencies present, npm
+  // treated that whole subtree as "already in the tarball" and skipped
+  // fetching better-sqlite3 & friends — EMPTY dirs whose install scripts then
+  // crashed. Local installs hoist and never hit it, which is exactly why the
+  // check above stayed green for ~15 broken releases. A fresh global install
+  // must succeed and kj must boot.
+  gTmp = fs.mkdtempSync(path.join(os.tmpdir(), "kj-verify-g-"));
+  console.log(`verify-pack: installing the tarball GLOBALLY into ${gTmp}…`);
+  try {
+    run("npm", ["install", "-g", tgzPath, "--no-audit", "--no-fund", "--silent", "--prefix", gTmp]);
+  } catch (err) {
+    fail("`npm install -g` of the tarball failed (KJC-BUG-0103 class)", err.stderr || err.message);
+  }
+  const gBin = process.platform === "win32"
+    ? path.join(gTmp, "kj.cmd")
+    : path.join(gTmp, "bin", "kj");
+  if (!fs.existsSync(gBin)) fail(`kj binary missing after global install: ${gBin}`);
+  let gVersion;
+  try {
+    gVersion = run(gBin, ["--version"]).trim();
+  } catch (err) {
+    fail("`kj --version` crashed on a fresh GLOBAL install", err.stderr || err.message);
+  }
+  if (!gVersion.includes(expectedVersion)) {
+    fail(`kj --version (global) returned "${gVersion}", expected ${expectedVersion}`);
+  }
+  console.log(`verify-pack: global install + kj --version → ${gVersion} ✓`);
+
+  // 6. pnpm install smoke (KJC-TSK-0580). pnpm's layout differs from npm's
   // (a symlinked virtual store), so it can break resolution of the bundled
-  // @karajan/core the way npm packaging breakage did before (KJC-BUG-0082/0086).
+  // karajan-core the way npm packaging breakage did before (KJC-BUG-0082/0086).
   // Verify a pnpm install resolves the JS tree and `kj --version` boots — every
   // release catches a pnpm packaging regression. (pnpm also blocks
   // better-sqlite3's native build by default, so DB-backed commands need
@@ -158,5 +189,6 @@ try {
 } finally {
   if (tgzPath && fs.existsSync(tgzPath)) fs.rmSync(tgzPath, { force: true });
   if (tmpDir && fs.existsSync(tmpDir)) fs.rmSync(tmpDir, { recursive: true, force: true });
+  if (gTmp && fs.existsSync(gTmp)) fs.rmSync(gTmp, { recursive: true, force: true });
   if (pnpmTmp && fs.existsSync(pnpmTmp)) fs.rmSync(pnpmTmp, { recursive: true, force: true });
 }

package/src/brain/standby-scheduler.js

@@ -1,8 +1,8 @@
-// Shim de compatibilidad: standby-scheduler vive ahora en @karajan/core.
+// Shim de compatibilidad: standby-scheduler vive ahora en karajan-core.
 // Mantiene la ruta para callers internos del CLI.
 export {
   _resetScheduledForTests,
   scheduleResume,
   cancelScheduled,
   reconcileAll,
-} from "@karajan/core/standby-scheduler";
+} from "karajan-core/standby-scheduler";

package/src/brain/standby-store.js

@@ -1,4 +1,4 @@
-// Shim de compatibilidad: standby-store vive ahora en @karajan/core.
+// Shim de compatibilidad: standby-store vive ahora en karajan-core.
 // Mantiene la ruta para callers internos del CLI.
 export {
   standbyDir,
@@ -9,4 +9,4 @@ export {
   listPendingStandby,
   markStandbyDone,
   acquireStandbyLock,
-} from "@karajan/core/standby-store";
+} from "karajan-core/standby-store";

package/src/git/hu-snapshot.js

@@ -1,4 +1,4 @@
-// Shim de compatibilidad: hu-snapshot vive ahora en @karajan/core.
+// Shim de compatibilidad: hu-snapshot vive ahora en karajan-core.
 // Mantenemos esta ruta para que callers internos del CLI (orchestrator,
 // runners) sigan funcionando sin tocar imports.
 export {
@@ -7,4 +7,4 @@ export {
   hasHuSnapshot,
   restoreHuSnapshot,
   removeHuSnapshot,
-} from "@karajan/core/hu-snapshot";
+} from "karajan-core/hu-snapshot";

package/src/plan/plan-hu-ops.js

@@ -1,4 +1,4 @@
-// Shim: plan-hu-ops now lives in @karajan/core/plan-hu-ops so the
+// Shim: plan-hu-ops now lives in karajan-core/plan-hu-ops so the
 // hu-board workspace can consume it without a relative dep on the CLI
 // src tree. KJC-TSK-0511 PR5.
 export {
@@ -13,4 +13,4 @@ export {
   computePlanOutcome,
   certifyAllHus,
   reorderHus,
-} from "@karajan/core/plan-hu-ops";
+} from "karajan-core/plan-hu-ops";

package/src/plan/plan-id.js

@@ -1,4 +1,4 @@
-// Shim: plan-id primitives now live in @karajan/core/plan-id so the
+// Shim: plan-id primitives now live in karajan-core/plan-id so the
 // hu-board workspace can consume them without a relative dep on the
 // CLI src tree. KJC-TSK-0511 PR5.
-export { generatePlanId, generateHuId, normaliseAlias } from "@karajan/core/plan-id";
+export { generatePlanId, generateHuId, normaliseAlias } from "karajan-core/plan-id";

package/src/plan/plan-validation.js

@@ -1,4 +1,4 @@
-// Shim: plan-validation now lives in @karajan/core/plan-validation so
+// Shim: plan-validation now lives in karajan-core/plan-validation so
 // the hu-board workspace can consume it without a relative dep on the
 // CLI src tree. KJC-TSK-0511 PR6.
-export { validateBlockedByChange } from "@karajan/core/plan-validation";
+export { validateBlockedByChange } from "karajan-core/plan-validation";

package/src/rag/vec-store.js

@@ -1,4 +1,4 @@
-// Shim: vec-store primitives now live in @karajan/core/vec-store so
+// Shim: vec-store primitives now live in karajan-core/vec-store so
 // the hu-board workspace can consume them without a relative dep on the
 // CLI src tree. KJC-TSK-0511 PR4.
 export {
@@ -14,4 +14,4 @@ export {
   findChunkByHash,
   countChunks,
   searchBM25,
-} from "@karajan/core/vec-store";
+} from "karajan-core/vec-store";

package/src/utils/atomic-write.js

@@ -1,6 +1,6 @@
-// Shim — the real implementation now lives in @karajan/core/atomic-write.
+// Shim — the real implementation now lives in karajan-core/atomic-write.
 // Kept here so CLI callers (src/**/*.js) keep importing
 // "#utils/atomic-write.js" without churn during KJC-TSK-0511 (decouple
 // @karajan/hu-board). Will be retired once every consumer migrates to
-// the @karajan/core import.
-export { writeJsonAtomic, writeJsonAtomicSync } from "@karajan/core/atomic-write";
+// the karajan-core import.
+export { writeJsonAtomic, writeJsonAtomicSync } from "karajan-core/atomic-write";

package/src/utils/paths.js

@@ -1,4 +1,4 @@
-// Shim: paths primitives now live in @karajan/core/paths so the
+// Shim: paths primitives now live in karajan-core/paths so the
 // hu-board workspace can consume them without a relative dep on the
 // CLI src tree. KJC-TSK-0511 PR3.
 export {
@@ -10,4 +10,4 @@ export {
   getOllamaComposePath,
   getWebperfDir,
   getPromptsDir,
-} from "@karajan/core/paths";
+} from "karajan-core/paths";

package/src/utils/port-check.js

@@ -1,6 +1,6 @@
-// Shim — the real implementation now lives in @karajan/core/port-check.
+// Shim — the real implementation now lives in karajan-core/port-check.
 // Kept here so CLI callers (src/**/*.js) keep importing
 // "../utils/port-check.js" without churn during KJC-TSK-0511 (decouple
 // @karajan/hu-board). Will be retired once every consumer migrates to
-// the @karajan/core import.
-export { isPortAvailable, findAvailablePort } from "@karajan/core/port-check";
+// the karajan-core import.
+export { isPortAvailable, findAvailablePort } from "karajan-core/port-check";

package/src/utils/process.js

@@ -1,4 +1,4 @@
-// Shim: process runner now lives in @karajan/core/process so the
+// Shim: process runner now lives in karajan-core/process so the
 // hu-board workspace can consume it without a relative dep on the CLI
 // src tree. KJC-TSK-0511 PR6.
-export { runCommand } from "@karajan/core/process";
+export { runCommand } from "karajan-core/process";

package/src/utils/run-registry.js

@@ -1,4 +1,4 @@
-// Shim: run-registry now lives in @karajan/core/run-registry so the
+// Shim: run-registry now lives in karajan-core/run-registry so the
 // hu-board workspace can consume it without a relative dep on the CLI
 // src tree. KJC-TSK-0511 PR3.
 export {
@@ -6,4 +6,4 @@ export {
   registerRun,
   unregisterRun,
   listActiveRuns,
-} from "@karajan/core/run-registry";
+} from "karajan-core/run-registry";

package/src/utils/shared-paths.js

@@ -1,12 +1,12 @@
-// Shim — the real implementation now lives in @karajan/core/shared-paths.
+// Shim — the real implementation now lives in karajan-core/shared-paths.
 // Kept here so CLI callers (src/**/*.js) keep importing
 // "../utils/shared-paths.js" without churn during KJC-TSK-0511 (decouple
 // @karajan/hu-board). Will be retired once every consumer migrates to
-// the @karajan/core import.
+// the karajan-core import.
 export {
   SHARED_DIR_NAME,
   getSharedRoot,
   getSharedPlansDir,
   getSharedHuStoriesDir,
   isSharedPath,
-} from "@karajan/core/shared-paths";
+} from "karajan-core/shared-paths";

package/node_modules/@karajan/core/README.md

@@ -1,42 +0,0 @@
-# @karajan/core
-
-Shared modules for the Karajan Code CLI and `@karajan/hu-board`. Private
-workspace package — not published to npm.
-
-## Scope
-
-`@karajan/core` is the extraction destination for code that both the CLI
-package (`karajan-code`) and the HU Board package (`@karajan/hu-board`)
-need. Today it ships the atomic JSON writer; subsequent commits of
-KJC-TSK-0511 will land the shared paths, port-check, run-registry,
-process runner, plan validation, vector store, and plan/HU ops modules
-here.
-
-## Exports
-
-| Subpath | Module |
-| --- | --- |
-| `@karajan/core/atomic-write` | `writeJsonAtomic`, `writeJsonAtomicSync` |
-| `@karajan/core/shared-paths` | `SHARED_DIR_NAME`, `getSharedRoot`, `getSharedPlansDir`, `getSharedHuStoriesDir`, `isSharedPath` |
-| `@karajan/core/port-check` | `isPortAvailable`, `findAvailablePort` |
-| `@karajan/core/paths` | `resolveHome`, `getKarajanHome`, `getSessionRoot`, `getSonarComposePath`, `getOllamaComposePath`, `getWebperfDir`, `getRunsDir`, `getPromptsDir`, `__resetKjHomeWarningForTests` |
-| `@karajan/core/run-registry` | `runsDir`, `registerRun`, `unregisterRun`, `listActiveRuns` |
-| `@karajan/core/vec-store` | `dbPath`, `openVecStore`, `insertChunk`, `searchSimilar`, `searchBM25`, `projectSlug`, `deleteChunksBySource`, `findChunkByHash`, `getEmbeddingsByIds`, `getLastIndexedCommit`, `setLastIndexedCommit`, `countChunks` |
-| `@karajan/core/plan-id` | `generatePlanId`, `generateHuId`, `normaliseAlias` |
-| `@karajan/core/plan-hu-ops` | `addHu`, `removeHu`, `updateHu`, `updateHuStatus`, `setHuOutcome`, `setPlanOutcome`, `autoCertifyPendingHus`, `assertPlanRunnable`, `computePlanOutcome`, `certifyAllHus`, `reorderHus` |
-| `@karajan/core/plan-validation` | `validateBlockedByChange` |
-| `@karajan/core/process` | `runCommand` (execa wrapper with output streaming, silence/total timeouts, ENOENT enrichment) |
-| `@karajan/core/hu-snapshot` | `snapshotRefForHu`, `createHuSnapshot`, `hasHuSnapshot`, `restoreHuSnapshot`, `removeHuSnapshot` |
-| `@karajan/core/standby-store` | `persistStandby`, `loadStandby`, `listPendingStandby`, `markStandbyDone`, `acquireStandbyLock`, `buildStandbyState`, `standbyDir`, `standbyDoneDir` |
-| `@karajan/core/standby-scheduler` | `scheduleResume`, `cancelScheduled`, `reconcileAll`, `acquireStandbyLock`, `markStandbyDone`, `_resetScheduledForTests` |
-
-The root export (`@karajan/core`) re-exports everything via the barrel
-in `src/index.js`, but prefer the subpath form so the bundler can
-tree-shake unused modules.
-
-## Status
-
-KJC-TSK-0511 PR8 — `standby-store` + `standby-scheduler` extracted.
-With this PR `@karajan/hu-board` no longer reaches into `../../../src`
-from any static **or dynamic** import. PR9 will re-add
-`packages/hu-board` to the root `workspaces` array.

package/node_modules/@karajan/core/package.json

@@ -1,49 +0,0 @@
-{
-  "name": "@karajan/core",
-  "version": "0.1.0",
-  "description": "Shared modules for Karajan Code CLI and @karajan/hu-board (atomic-write, paths, RAG store, plan ops, process runner).",
-  "type": "module",
-  "private": true,
-  "engines": {
-    "node": ">=22.22.1"
-  },
-  "exports": {
-    "./atomic-write": "./src/atomic-write.js",
-    "./shared-paths": "./src/shared-paths.js",
-    "./port-check": "./src/port-check.js",
-    "./paths": "./src/paths.js",
-    "./run-registry": "./src/run-registry.js",
-    "./vec-store": "./src/vec-store.js",
-    "./plan-id": "./src/plan-id.js",
-    "./plan-hu-ops": "./src/plan-hu-ops.js",
-    "./plan-validation": "./src/plan-validation.js",
-    "./process": "./src/process.js",
-    "./hu-snapshot": "./src/hu-snapshot.js",
-    "./standby-store": "./src/standby-store.js",
-    "./standby-scheduler": "./src/standby-scheduler.js",
-    "./pricing": "./src/pricing/index.js",
-    "./cost": "./src/cost/index.js"
-  },
-  "scripts": {
-    "test": "vitest run"
-  },
-  "peerDependencies": {
-    "better-sqlite3": "^12.10.0",
-    "execa": "^9.6.0",
-    "sqlite-vec": "^0.1.9"
-  },
-  "peerDependenciesMeta": {
-    "better-sqlite3": {
-      "optional": true
-    },
-    "execa": {
-      "optional": true
-    },
-    "sqlite-vec": {
-      "optional": true
-    }
-  },
-  "devDependencies": {
-    "vitest": "^4.0.0"
-  }
-}

package/node_modules/@karajan/core/src/atomic-write.js

@@ -1,43 +0,0 @@
-// Atomic JSON writes for persistent state (resilience audit, Phase 2).
-//
-// A plain `writeFile(path, JSON.stringify(...))` truncates the live file
-// before the new content lands. If the process is killed mid-write
-// (SIGKILL, crash, power loss) the file is left truncated and the only
-// good copy is already gone — the plan / session / standby JSON
-// silently corrupts.
-//
-// write-temp + rename fixes it: `rename` is atomic on the same
-// filesystem, so a reader sees either the old file or the complete new
-// one, never a half-written one. The temp file sits next to the target
-// (same dir → same FS) and is uniquely named so concurrent writers do
-// not clobber each other's temp. A crash before the rename leaves an
-// orphan `.tmp` but never a corrupt target.
-
-import { writeFileSync, renameSync } from "node:fs";
-import { writeFile, rename } from "node:fs/promises";
-
-function tempPath(target) {
-  return `${target}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-}
-
-/**
- * Atomically write `obj` as pretty JSON to `target` (synchronous).
- * @param {string} target - destination path; its directory must exist
- * @param {unknown} obj
- */
-export function writeJsonAtomicSync(target, obj) {
-  const tmp = tempPath(target);
-  writeFileSync(tmp, JSON.stringify(obj, null, 2), "utf-8");
-  renameSync(tmp, target);
-}
-
-/**
- * Atomically write `obj` as pretty JSON to `target` (async).
- * @param {string} target - destination path; its directory must exist
- * @param {unknown} obj
- */
-export async function writeJsonAtomic(target, obj) {
-  const tmp = tempPath(target);
-  await writeFile(tmp, JSON.stringify(obj, null, 2), "utf-8");
-  await rename(tmp, target);
-}

package/node_modules/@karajan/core/src/cost/index.js

@@ -1,102 +0,0 @@
-/**
- * Cost aggregator (Cost B — KJC-TSK-0513).
- *
- * Turns a list of token-usage events emitted by the orchestrator into
- * a USD breakdown for a single run / HU. The pipeline calls this once
- * when a HU finishes; the result is what Cost C will persist in
- * board.db and Cost E will expose as `/api/projects/:id/cost`.
- *
- * Inputs are deliberately permissive: any extra field on an event is
- * ignored. We only require `role`, `model`, `tokensIn`, `tokensOut`.
- *
- * Unknown models do NOT throw. Their token counts accumulate into
- * `unknownModelTokens` and the function returns a flag so the caller
- * can surface it in the UI (orange badge instead of `$X.XXXX`).
- */
-
-import { getModelPricing } from "../pricing/index.js";
-
-const DEFAULT_ROUND_DECIMALS = 4;
-
-function round(n, decimals = DEFAULT_ROUND_DECIMALS) {
-  const f = 10 ** decimals;
-  return Math.round(n * f) / f;
-}
-
-function priceTokens(pricing, tokensIn, tokensOut) {
-  const inUsd = (tokensIn / 1_000_000) * pricing.inputPerMTok;
-  const outUsd = (tokensOut / 1_000_000) * pricing.outputPerMTok;
-  return inUsd + outUsd;
-}
-
-/**
- * Aggregate cost of a run.
- *
- * @param {object} args
- * @param {Array<{role:string, model:string, tokensIn:number, tokensOut:number}>} args.events
- * @param {(level:"warn"|"info", msg:string, ctx?:object)=>void} [args.logger]
- *        Optional structured logger. When a model is unknown we call
- *        logger("warn", ...) so the user sees it once per run.
- * @returns {{
- *   totalUsd:number,
- *   byRole:Record<string,number>,
- *   byModel:Record<string,number>,
- *   unknownModelTokens:{ tokensIn:number, tokensOut:number, models:string[] },
- *   hasUnknown:boolean,
- *   currency:string
- * }}
- */
-export function aggregateRunCost({ events, logger } = {}) {
-  const safeEvents = Array.isArray(events) ? events : [];
-  const byRole = {};
-  const byModel = {};
-  const unknownModels = new Set();
-  let totalUsd = 0;
-  let unknownIn = 0;
-  let unknownOut = 0;
-
-  for (const ev of safeEvents) {
-    if (!ev || typeof ev !== "object") continue;
-    const role = typeof ev.role === "string" && ev.role.length > 0 ? ev.role : "unknown";
-    const model = typeof ev.model === "string" ? ev.model : "";
-    const tokensIn = Number.isFinite(ev.tokensIn) ? ev.tokensIn : 0;
-    const tokensOut = Number.isFinite(ev.tokensOut) ? ev.tokensOut : 0;
-    if (tokensIn === 0 && tokensOut === 0) continue;
-
-    const pricing = getModelPricing(model);
-    if (!pricing) {
-      unknownIn += tokensIn;
-      unknownOut += tokensOut;
-      if (model.length > 0) unknownModels.add(model);
-      if (typeof logger === "function") {
-        logger("warn", "cost-aggregator: unknown model pricing", { model, role, tokensIn, tokensOut });
-      }
-      continue;
-    }
-
-    const cost = priceTokens(pricing, tokensIn, tokensOut);
-    totalUsd += cost;
-    byRole[role] = (byRole[role] || 0) + cost;
-    byModel[model] = (byModel[model] || 0) + cost;
-  }
-
-  const roundedByRole = Object.fromEntries(
-    Object.entries(byRole).map(([k, v]) => [k, round(v)])
-  );
-  const roundedByModel = Object.fromEntries(
-    Object.entries(byModel).map(([k, v]) => [k, round(v)])
-  );
-
-  return {
-    totalUsd: round(totalUsd),
-    byRole: roundedByRole,
-    byModel: roundedByModel,
-    unknownModelTokens: {
-      tokensIn: unknownIn,
-      tokensOut: unknownOut,
-      models: Array.from(unknownModels).sort(),
-    },
-    hasUnknown: unknownIn > 0 || unknownOut > 0,
-    currency: "USD",
-  };
-}