mewkit 1.15.0 → 1.16.1

package/dist/local-web/request-body.js

@@ -0,0 +1,68 @@
+/**
+ * Bounded request-body reader with a socket timeout.
+ *
+ * Behavior extracted verbatim from the loopback write pipeline: collect the body
+ * up to `capBytes`, destroying the socket and rejecting with `BodyError(413)` on
+ * overflow or `BodyError(408)` on timeout. The cap + timeout are the DoS guard
+ * for any POST/PATCH route; the consumer supplies both (the write pipeline uses
+ * a 4096-byte cap).
+ */
+/** Carries the HTTP status + a short tag for a body-read failure. */
+export class BodyError extends Error {
+    status;
+    tag;
+    constructor(status, tag) {
+        super(tag);
+        this.status = status;
+        this.tag = tag;
+        this.name = "BodyError";
+    }
+}
+/**
+ * Collect the full request body up to `capBytes`. Destroys the socket if the
+ * body exceeds the cap OR if `timeoutMs` elapses first. Rejects with
+ * `BodyError(413,"body-too-large")` on overflow, `BodyError(408,"request-timeout")`
+ * on timeout.
+ */
+export function bufferBody(req, capBytes, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let total = 0;
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            req.socket?.destroy();
+            reject(new BodyError(408, "request-timeout"));
+        }, timeoutMs);
+        req.on("data", (chunk) => {
+            total += chunk.length;
+            if (total > capBytes) {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                req.socket?.destroy();
+                reject(new BodyError(413, "body-too-large"));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(Buffer.concat(chunks));
+        });
+        req.on("error", (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(err);
+        });
+    });
+}
+//# sourceMappingURL=request-body.js.map

package/dist/local-web/request-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-body.js","sourceRoot":"","sources":["../../src/local-web/request-body.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,qEAAqE;AACrE,MAAM,OAAO,SAAU,SAAQ,KAAK;IAElB;IACA;IAFjB,YACiB,MAAc,EACd,GAAW;QAE3B,KAAK,CAAC,GAAG,CAAC,CAAC;QAHK,WAAM,GAAN,MAAM,CAAQ;QACd,QAAG,GAAH,GAAG,CAAQ;QAG3B,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IACzB,CAAC;CACD;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAoB,EAAE,QAAgB,EAAE,SAAiB;IACnF,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC/C,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAChC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACtB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBAC7C,OAAO;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YAClB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/local-web/static-handler.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Static file serving with a path-traversal guard.
+ *
+ * Ported from patoles/agent-flow @ 59ccf4e (app/src/static.ts).
+ * License Apache-2.0 — see the repository NOTICE file.
+ *
+ * Two-layer traversal defense: reject any raw URL containing "..", then resolve
+ * the candidate and require it to sit at or inside the base directory. Serves
+ * GET/HEAD only; long-cache for /assets/, no-cache otherwise.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+/** Serve a file from `staticDir` for GET/HEAD, guarding against path traversal. */
+export declare function serveStatic(req: IncomingMessage, res: ServerResponse, staticDir: string): void;
+//# sourceMappingURL=static-handler.d.ts.map

package/dist/local-web/static-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-handler.d.ts","sourceRoot":"","sources":["../../src/local-web/static-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAsBjE,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAgD9F"}

package/dist/{orchviz/server → local-web}/static-handler.js

@@ -1,11 +1,16 @@
 /**
- * Static file serving with path-traversal guard.
+ * Static file serving with a path-traversal guard.
  *
  * Ported from patoles/agent-flow @ 59ccf4e (app/src/static.ts).
- * License Apache-2.0 (see ../../NOTICE).
+ * License Apache-2.0 — see the repository NOTICE file.
+ *
+ * Two-layer traversal defense: reject any raw URL containing "..", then resolve
+ * the candidate and require it to sit at or inside the base directory. Serves
+ * GET/HEAD only; long-cache for /assets/, no-cache otherwise.
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { LOOPBACK_HOST } from "./constants.js";
 const MIME = {
     ".html": "text/html; charset=utf-8",
     ".js": "application/javascript; charset=utf-8",
@@ -22,6 +27,7 @@ function send404(res) {
     res.writeHead(404, { "Content-Type": "text/plain" });
     res.end("Not Found");
 }
+/** Serve a file from `staticDir` for GET/HEAD, guarding against path traversal. */
 export function serveStatic(req, res, staticDir) {
     if (req.method !== "GET" && req.method !== "HEAD") {
         res.writeHead(405, { Allow: "GET, HEAD", "Content-Type": "text/plain" });
@@ -34,7 +40,7 @@ export function serveStatic(req, res, staticDir) {
         send404(res);
         return;
     }
-    const url = new URL(reqUrl, "http://127.0.0.1");
+    const url = new URL(reqUrl, `http://${LOOPBACK_HOST}`);
     let pathname = url.pathname;
     if (pathname === "/")
         pathname = "/index.html";
@@ -57,12 +63,11 @@ export function serveStatic(req, res, staticDir) {
         return;
     }
     const isAsset = pathname.startsWith("/assets/");
-    const headers = {
+    res.writeHead(200, {
         "Content-Type": mimeFor(candidate),
         "Content-Length": String(stat.size),
         "Cache-Control": isAsset ? "public, max-age=31536000, immutable" : "no-cache",
-    };
-    res.writeHead(200, headers);
+    });
     if (req.method === "HEAD") {
         res.end();
         return;

package/dist/local-web/static-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-handler.js","sourceRoot":"","sources":["../../src/local-web/static-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,MAAM,IAAI,GAA2B;IACpC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,yBAAyB;IACjC,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,eAAe;IACvB,QAAQ,EAAE,YAAY;IACtB,OAAO,EAAE,iCAAiC;CAC1C,CAAC;AAEF,SAAS,OAAO,CAAC,QAAgB;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,0BAA0B,CAAC;AACjF,CAAC;AAED,SAAS,OAAO,CAAC,GAAmB;IACnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACtB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,GAAoB,EAAE,GAAmB,EAAE,SAAiB;IACvF,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACzE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC9B,OAAO;IACR,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;IAC9B,2EAA2E;IAC3E,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;IACR,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,aAAa,EAAE,CAAC,CAAC;IACvD,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC5B,IAAI,QAAQ,KAAK,GAAG;QAAE,QAAQ,GAAG,aAAa,CAAC;IAE/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,CAAC,CAAC;IACxD,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;IACR,CAAC;IAED,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACJ,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;IACR,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC;QACb,OAAO;IACR,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QAClB,cAAc,EAAE,OAAO,CAAC,SAAS,CAAC;QAClC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,UAAU;KAC7E,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACR,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC"}

package/dist/migrate/reconcile/portable-manifest.d.ts

@@ -9,12 +9,12 @@ declare const PortableEvolutionManifestSchema: z.ZodObject<{
         type: z.ZodEnum<["agent", "command", "skill", "config", "rules", "hooks"]>;
         since: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         from: string;
         to: string;
         since: string;
     }, {
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         from: string;
         to: string;
         since: string;
@@ -26,13 +26,13 @@ declare const PortableEvolutionManifestSchema: z.ZodObject<{
         to: z.ZodType<string, z.ZodTypeDef, string>;
         since: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         provider: string;
         from: string;
         to: string;
         since: string;
     }, {
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         provider: string;
         from: string;
         to: string;
@@ -44,12 +44,12 @@ declare const PortableEvolutionManifestSchema: z.ZodObject<{
         to: z.ZodString;
         since: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        type: "agent" | "config" | "rules";
+        type: "rules" | "agent" | "config";
         from: string;
         to: string;
         since: string;
     }, {
-        type: "agent" | "config" | "rules";
+        type: "rules" | "agent" | "config";
         from: string;
         to: string;
         since: string;
@@ -58,20 +58,20 @@ declare const PortableEvolutionManifestSchema: z.ZodObject<{
     version: "1.0";
     mewkitVersion: string;
     renames: {
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         from: string;
         to: string;
         since: string;
     }[];
     providerPathMigrations: {
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         provider: string;
         from: string;
         to: string;
         since: string;
     }[];
     sectionRenames: {
-        type: "agent" | "config" | "rules";
+        type: "rules" | "agent" | "config";
         from: string;
         to: string;
         since: string;
@@ -80,20 +80,20 @@ declare const PortableEvolutionManifestSchema: z.ZodObject<{
     version: "1.0";
     mewkitVersion: string;
     renames: {
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         from: string;
         to: string;
         since: string;
     }[];
     providerPathMigrations: {
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         provider: string;
         from: string;
         to: string;
         since: string;
     }[];
     sectionRenames: {
-        type: "agent" | "config" | "rules";
+        type: "rules" | "agent" | "config";
         from: string;
         to: string;
         since: string;

package/dist/migrate/reconcile/portable-registry.d.ts

@@ -18,30 +18,30 @@ declare const PortableInstallationSchemaV3: z.ZodObject<{
     installedChecksum: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     path: string;
-    type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+    type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
     installedAt: string;
-    item: string;
-    provider: string;
     global: boolean;
     sourcePath: string;
+    item: string;
+    provider: string;
     sourceChecksum: string;
     targetChecksum: string;
-    installSource: "kit" | "manual";
+    installSource: "manual" | "kit";
     installedVersion?: string | undefined;
     cliVersion?: string | undefined;
     ownedSections?: string[] | undefined;
     installedChecksum?: string | undefined;
 }, {
     path: string;
-    type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+    type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
     installedAt: string;
-    item: string;
-    provider: string;
     global: boolean;
     sourcePath: string;
+    item: string;
+    provider: string;
     sourceChecksum: string;
     targetChecksum: string;
-    installSource: "kit" | "manual";
+    installSource: "manual" | "kit";
     installedVersion?: string | undefined;
     cliVersion?: string | undefined;
     ownedSections?: string[] | undefined;
@@ -67,30 +67,30 @@ declare const PortableRegistrySchemaV3: z.ZodObject<{
         installedChecksum: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         path: string;
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         installedAt: string;
-        item: string;
-        provider: string;
         global: boolean;
         sourcePath: string;
+        item: string;
+        provider: string;
         sourceChecksum: string;
         targetChecksum: string;
-        installSource: "kit" | "manual";
+        installSource: "manual" | "kit";
         installedVersion?: string | undefined;
         cliVersion?: string | undefined;
         ownedSections?: string[] | undefined;
         installedChecksum?: string | undefined;
     }, {
         path: string;
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         installedAt: string;
-        item: string;
-        provider: string;
         global: boolean;
         sourcePath: string;
+        item: string;
+        provider: string;
         sourceChecksum: string;
         targetChecksum: string;
-        installSource: "kit" | "manual";
+        installSource: "manual" | "kit";
         installedVersion?: string | undefined;
         cliVersion?: string | undefined;
         ownedSections?: string[] | undefined;
@@ -102,15 +102,15 @@ declare const PortableRegistrySchemaV3: z.ZodObject<{
     version: "3.0";
     installations: {
         path: string;
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         installedAt: string;
-        item: string;
-        provider: string;
         global: boolean;
         sourcePath: string;
+        item: string;
+        provider: string;
         sourceChecksum: string;
         targetChecksum: string;
-        installSource: "kit" | "manual";
+        installSource: "manual" | "kit";
         installedVersion?: string | undefined;
         cliVersion?: string | undefined;
         ownedSections?: string[] | undefined;
@@ -122,15 +122,15 @@ declare const PortableRegistrySchemaV3: z.ZodObject<{
     version: "3.0";
     installations: {
         path: string;
-        type: "agent" | "command" | "skill" | "config" | "rules" | "hooks";
+        type: "skill" | "hooks" | "rules" | "agent" | "command" | "config";
         installedAt: string;
-        item: string;
-        provider: string;
         global: boolean;
         sourcePath: string;
+        item: string;
+        provider: string;
         sourceChecksum: string;
         targetChecksum: string;
-        installSource: "kit" | "manual";
+        installSource: "manual" | "kit";
         installedVersion?: string | undefined;
         cliVersion?: string | undefined;
         ownedSections?: string[] | undefined;

package/dist/migrate/types.d.ts

@@ -118,45 +118,45 @@ export declare const MigrateOptionsSchema: z.ZodObject<{
     /** Opt-in: convert .mcp.json server definitions into the provider MCP config */
     includeMcp: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    providers?: boolean | undefined;
-    source?: string | undefined;
+    force?: boolean | undefined;
     tool?: string | undefined;
-    global?: boolean | undefined;
+    install?: boolean | undefined;
     tools?: string[] | undefined;
     all?: boolean | undefined;
+    global?: boolean | undefined;
     yes?: boolean | undefined;
     dryRun?: boolean | undefined;
-    force?: boolean | undefined;
+    source?: string | undefined;
     only?: string | undefined;
     skipConfig?: boolean | undefined;
     skipRules?: boolean | undefined;
     skipHooks?: boolean | undefined;
-    install?: boolean | undefined;
     reconcile?: boolean | undefined;
     reinstallEmptyDirs?: boolean | undefined;
     respectDeletions?: boolean | undefined;
     sourceVersion?: string | undefined;
+    providers?: boolean | undefined;
     allRules?: boolean | undefined;
     includeMcp?: boolean | undefined;
 }, {
-    providers?: boolean | undefined;
-    source?: string | undefined;
+    force?: boolean | undefined;
     tool?: string | undefined;
-    global?: boolean | undefined;
+    install?: boolean | undefined;
     tools?: string[] | undefined;
     all?: boolean | undefined;
+    global?: boolean | undefined;
     yes?: boolean | undefined;
     dryRun?: boolean | undefined;
-    force?: boolean | undefined;
+    source?: string | undefined;
     only?: string | undefined;
     skipConfig?: boolean | undefined;
     skipRules?: boolean | undefined;
     skipHooks?: boolean | undefined;
-    install?: boolean | undefined;
     reconcile?: boolean | undefined;
     reinstallEmptyDirs?: boolean | undefined;
     respectDeletions?: boolean | undefined;
     sourceVersion?: string | undefined;
+    providers?: boolean | undefined;
     allRules?: boolean | undefined;
     includeMcp?: boolean | undefined;
 }>;

package/dist/{orchviz/token-estimator.d.ts → token-estimator/index.d.ts}

@@ -4,8 +4,13 @@
  * Ported verbatim from patoles/agent-flow @ 59ccf4e
  *   Original: extension/src/token-estimator.ts
  *   License:  Apache-2.0 (see ../../NOTICE)
+ *
+ * Lives in this neutral module (not under any command subtree) so it has no
+ * dependency on removed code. It is the canonical heuristic the `context-audit`
+ * skill cites (that skill re-implements the same chars/4 rule in bash; it does
+ * not import this module). The five tuning constants are inlined and standalone.
  */
 export declare function estimateTokensFromContent(content: unknown): number;
 export declare function estimateTokensFromText(text: string): number;
 export declare function estimateTokenCost(toolName: string, result: string): number;
-//# sourceMappingURL=token-estimator.d.ts.map
+//# sourceMappingURL=index.d.ts.map

package/dist/token-estimator/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/token-estimator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAelE;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAO1E"}

package/dist/{orchviz/token-estimator.js → token-estimator/index.js}

@@ -4,8 +4,17 @@
  * Ported verbatim from patoles/agent-flow @ 59ccf4e
  *   Original: extension/src/token-estimator.ts
  *   License:  Apache-2.0 (see ../../NOTICE)
+ *
+ * Lives in this neutral module (not under any command subtree) so it has no
+ * dependency on removed code. It is the canonical heuristic the `context-audit`
+ * skill cites (that skill re-implements the same chars/4 rule in bash; it does
+ * not import this module). The five tuning constants are inlined and standalone.
  */
-import { CHARS_PER_TOKEN, MIN_TOKEN_ESTIMATE, FALLBACK_TOKEN_ESTIMATE, GREP_TOKEN_MULTIPLIER, DEFAULT_TOKEN_MULTIPLIER, } from "./constants.js";
+const CHARS_PER_TOKEN = 4;
+const MIN_TOKEN_ESTIMATE = 10;
+const FALLBACK_TOKEN_ESTIMATE = 200;
+const GREP_TOKEN_MULTIPLIER = 0.5;
+const DEFAULT_TOKEN_MULTIPLIER = 0.3;
 export function estimateTokensFromContent(content) {
     if (typeof content === "string") {
         return Math.max(Math.ceil(content.length / CHARS_PER_TOKEN), MIN_TOKEN_ESTIMATE);
@@ -35,4 +44,4 @@ export function estimateTokenCost(toolName, result) {
     }
     return Math.ceil(baseTokens * DEFAULT_TOKEN_MULTIPLIER);
 }
-//# sourceMappingURL=token-estimator.js.map
+//# sourceMappingURL=index.js.map

package/dist/token-estimator/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/token-estimator/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAErC,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACzD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,eAAe,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;iBAC9C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC7D,KAAK,IAAI,MAAM,CAAE,IAA2B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACjE,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,uBAAuB,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAc;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;IAC9D,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC;IAC3C,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,qBAAqB,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,wBAAwB,CAAC,CAAC;AACzD,CAAC"}

package/dist/visual-plan/__fixtures__/valid-plan.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Canonical valid `visual-plan/v1` fixture (as a builder returning a fresh deep
+ * copy each call, so a test can mutate one failure class without touching
+ * others). Source hashes are left empty here — the test helper stamps them from
+ * the on-disk plan.md/phase files so the "valid" case passes freshness.
+ *
+ * The wireframe HTML uses only the allowed `.wf-*` structural vocabulary and no
+ * form controls, so it survives the reject-mode sanitizer unchanged.
+ */
+/** A structurally + referentially valid artifact. Deep-copied on every call. */
+export declare function makeValidPlan(): Record<string, unknown>;
+/** Markdown the fixture's source hashes are computed against. */
+export declare const FIXTURE_PLAN_MD = "# Sample Plan\n\nAuth flow.\n";
+export declare const FIXTURE_PHASE_MD = "---\nphase: 1\n---\n\n# Phase 1\n\nLogin screen.\n";
+//# sourceMappingURL=valid-plan.d.ts.map

package/dist/visual-plan/__fixtures__/valid-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"valid-plan.d.ts","sourceRoot":"","sources":["../../../src/visual-plan/__fixtures__/valid-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAaH,gFAAgF;AAChF,wBAAgB,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEvD;AAED,iEAAiE;AACjE,eAAO,MAAM,eAAe,kCAAkC,CAAC;AAC/D,eAAO,MAAM,gBAAgB,uDAAuD,CAAC"}

package/dist/visual-plan/__fixtures__/valid-plan.js

@@ -0,0 +1,79 @@
+/**
+ * Canonical valid `visual-plan/v1` fixture (as a builder returning a fresh deep
+ * copy each call, so a test can mutate one failure class without touching
+ * others). Source hashes are left empty here — the test helper stamps them from
+ * the on-disk plan.md/phase files so the "valid" case passes freshness.
+ *
+ * The wireframe HTML uses only the allowed `.wf-*` structural vocabulary and no
+ * form controls, so it survives the reject-mode sanitizer unchanged.
+ */
+const SAFE_LOGIN_HTML = '<section class="wf-screen"><header class="wf-topbar"><h1>Sign in</h1></header>' +
+    '<div class="wf-form"><label>Email</label><div class="wf-input"></div>' +
+    '<label>Password</label><div class="wf-input"></div>' +
+    '<a href="#submit" class="wf-button">Continue</a></div></section>';
+const SAFE_ERROR_HTML = '<section class="wf-screen"><header class="wf-topbar"><h1>Sign in</h1></header>' +
+    '<p class="wf-error">Incorrect email or password.</p>' +
+    '<div class="wf-form"><label>Email</label><div class="wf-input"></div></div></section>';
+/** A structurally + referentially valid artifact. Deep-copied on every call. */
+export function makeValidPlan() {
+    return JSON.parse(JSON.stringify(BASE));
+}
+/** Markdown the fixture's source hashes are computed against. */
+export const FIXTURE_PLAN_MD = "# Sample Plan\n\nAuth flow.\n";
+export const FIXTURE_PHASE_MD = "---\nphase: 1\n---\n\n# Phase 1\n\nLogin screen.\n";
+const BASE = {
+    schemaVersion: "visual-plan/v1",
+    id: "sample-plan",
+    revision: 0,
+    source: { planPath: "plan.md", planHash: "", phaseHashes: {} },
+    uiCoverage: {
+        surfaces: [
+            {
+                id: "s-auth",
+                label: "Authentication",
+                states: [
+                    { id: "st-login-default", label: "Login (default)", frameIds: ["fr-login"], sourceRefIds: ["ref-login-code"] },
+                    { id: "st-login-error", label: "Login (error)", frameIds: ["fr-login-error"], sourceRefIds: [] },
+                    { id: "st-forgot", label: "Forgot password", frameIds: [], sourceRefIds: [], omitted: { reason: "out-of-scope" } },
+                    { id: "st-2fa", label: "2FA", frameIds: [], sourceRefIds: [], omitted: { reason: "equivalent-layout", representedBy: "st-login-default" } },
+                ],
+            },
+        ],
+    },
+    canvas: {
+        lanes: [{ id: "lane-primary", label: "Primary flow" }],
+        frames: [
+            {
+                id: "fr-login",
+                label: "Login",
+                surface: "browser",
+                laneId: "lane-primary",
+                order: 0,
+                changeMode: "current",
+                coverageStateIds: ["st-login-default"],
+                sourceRefIds: ["ref-login-code"],
+                wireframe: { format: "semantic-html", html: SAFE_LOGIN_HTML },
+            },
+            {
+                id: "fr-login-error",
+                label: "Login error",
+                surface: "browser",
+                laneId: "lane-primary",
+                order: 1,
+                changeMode: "target",
+                coverageStateIds: ["st-login-error"],
+                sourceRefIds: [],
+                wireframe: { format: "semantic-html", html: SAFE_ERROR_HTML },
+            },
+        ],
+        connectors: [{ id: "c-login-error", from: "fr-login", to: "fr-login-error", label: "invalid credentials" }],
+        annotations: [{ id: "an-note-1", kind: "note", text: "Primary CTA", targetId: "fr-login", placement: "top" }],
+    },
+    documentBlocks: [{ id: "db-mechanics", title: "Mechanics", body: "Session cookie set on success." }],
+    sourceRefs: [
+        { id: "ref-login-code", kind: "code", ref: "src/features/auth/login.tsx" },
+        { id: "ref-new-2fa", kind: "plan-requirement", ref: "phase-01#2fa" },
+    ],
+    review: { status: "draft", approvedRevision: null, approvedAt: null, pendingFeedbackBatchIds: [] },
+};
+//# sourceMappingURL=valid-plan.js.map

package/dist/visual-plan/__fixtures__/valid-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"valid-plan.js","sourceRoot":"","sources":["../../../src/visual-plan/__fixtures__/valid-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,eAAe,GACpB,gFAAgF;IAChF,uEAAuE;IACvE,qDAAqD;IACrD,kEAAkE,CAAC;AAEpE,MAAM,eAAe,GACpB,gFAAgF;IAChF,sDAAsD;IACtD,uFAAuF,CAAC;AAEzF,gFAAgF;AAChF,MAAM,UAAU,aAAa;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAA4B,CAAC;AACpE,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAErF,MAAM,IAAI,GAAG;IACZ,aAAa,EAAE,gBAAgB;IAC/B,EAAE,EAAE,aAAa;IACjB,QAAQ,EAAE,CAAC;IACX,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,WAAW,EAAE,EAA4B,EAAE;IACxF,UAAU,EAAE;QACX,QAAQ,EAAE;YACT;gBACC,EAAE,EAAE,QAAQ;gBACZ,KAAK,EAAE,gBAAgB;gBACvB,MAAM,EAAE;oBACP,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC,gBAAgB,CAAC,EAAE;oBAC9G,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE;oBAChG,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE;oBAClH,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAAE,EAAE;iBAC3I;aACD;SACD;KACD;IACD,MAAM,EAAE;QACP,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QACtD,MAAM,EAAE;YACP;gBACC,EAAE,EAAE,UAAU;gBACd,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,CAAC;gBACR,UAAU,EAAE,SAAS;gBACrB,gBAAgB,EAAE,CAAC,kBAAkB,CAAC;gBACtC,YAAY,EAAE,CAAC,gBAAgB,CAAC;gBAChC,SAAS,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE;aAC7D;YACD;gBACC,EAAE,EAAE,gBAAgB;gBACpB,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,CAAC;gBACR,UAAU,EAAE,QAAQ;gBACpB,gBAAgB,EAAE,CAAC,gBAAgB,CAAC;gBACpC,YAAY,EAAE,EAAE;gBAChB,SAAS,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE;aAC7D;SACD;QACD,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC3G,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;KAC7G;IACD,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC;IACpG,UAAU,EAAE;QACX,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,6BAA6B,EAAE;QAC1E,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,cAAc,EAAE;KACpE;IACD,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAc,EAAE;CAC9G,CAAC"}

package/dist/visual-plan/application/apply-feedback.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Apply-feedback CLI mechanics (deterministic half of the Phase-6 loop).
+ *
+ * The AGENT (the mk:visual-plan skill) classifies + applies each operation
+ * (visual-only → CLI patch; plan-semantic → Markdown edit; implementation →
+ * deferred; ambiguous → ask). This module owns only the deterministic guards:
+ *   - `checkBatchFresh` — STOP before ANY mutation if the batch's baseRevision/
+ *     baseHash no longer match the artifact (no auto-merge onto drifted state).
+ *   - `recordResolution` — write the per-op receipt write-once (refuse a second
+ *     apply of the same batch). Receipt existence is the "resolved" marker.
+ */
+export interface FreshnessResult {
+    ok: boolean;
+    stale?: boolean;
+    reason?: string;
+}
+/** Verify the batch still applies to the CURRENT artifact (pre-apply gate). */
+export declare function checkBatchFresh(planDir: string, batchId: string): FreshnessResult;
+export interface RecordResult {
+    ok: boolean;
+    receiptPath?: string;
+    reopenCommand?: string;
+    error?: string;
+}
+/**
+ * Write the resolution receipt (agent supplies per-op outcomes). Refuses a
+ * double-apply. `resolvedAtRevision` is the artifact's CURRENT revision (after
+ * the agent applied ops). Returns the reopen command for re-review.
+ */
+export declare function recordResolution(planDir: string, batchId: string, entries: unknown): RecordResult;
+//# sourceMappingURL=apply-feedback.d.ts.map

package/dist/visual-plan/application/apply-feedback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-feedback.d.ts","sourceRoot":"","sources":["../../../src/visual-plan/application/apply-feedback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAYH,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,eAAe,CAcjF;AAED,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,YAAY,CAiCjG"}