prehello 0.0.0-stage → 1.0.0

package/dist/text/comments.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.splitFences = splitFences;
+exports.stripHtmlComments = stripHtmlComments;
+/** Split markdown into alternating [prose, fence, prose, fence...] segments (``` or ~~~ fences). */
+function splitFences(text) {
+    const lines = text.split("\n");
+    const out = [];
+    let cur = [];
+    let inFence = false;
+    let marker = "";
+    const flush = (code) => {
+        if (cur.length)
+            out.push({ code, text: cur.join("\n") });
+        cur = [];
+    };
+    for (const line of lines) {
+        const fm = /^\s{0,3}(`{3,}|~{3,})/.exec(line);
+        if (!inFence && fm) {
+            flush(false);
+            inFence = true;
+            marker = fm[1][0];
+            cur.push(line);
+        }
+        else if (inFence && fm && fm[1][0] === marker && /^\s{0,3}(`{3,}|~{3,})\s*$/.test(line)) {
+            cur.push(line);
+            flush(true);
+            inFence = false;
+        }
+        else {
+            cur.push(line);
+        }
+    }
+    flush(inFence);
+    return out;
+}
+/** Claude Code strips block-level HTML comments before injection; comments inside code fences are kept. */
+function stripHtmlComments(text) {
+    return splitFences(text)
+        .map((seg) => (seg.code ? seg.text : stripComments(seg.text)))
+        .join("\n");
+}
+/**
+ * Linear-time equivalent of text.replace(/<!--[\s\S]*?-->/g, ""). The regex form is quadratic on input such as "<!--" repeated
+ * (every start rescans to the end for a "-->" that never comes), which a hostile 4 MiB CLAUDE.md turns into a hang.
+ */
+function stripComments(text) {
+    let out = "";
+    let i = 0;
+    for (;;) {
+        const s = text.indexOf("<!--", i);
+        if (s < 0)
+            return out + text.slice(i);
+        const e = text.indexOf("-->", s + 4);
+        if (e < 0)
+            return out + text.slice(i); // an unclosed comment is left as it is, like the regex
+        out += text.slice(i, s);
+        i = e + 3;
+    }
+}

package/dist/text/frontmatter.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseFrontmatter = parseFrontmatter;
+exports.asList = asList;
+exports.asString = asString;
+function unquote(s) {
+    const t = s.trim();
+    if (t.length >= 2 && ((t[0] === '"' && t.endsWith('"')) || (t[0] === "'" && t.endsWith("'"))))
+        return t.slice(1, -1);
+    return t;
+}
+/** Tiny YAML-subset frontmatter parser: scalars, booleans, inline lists, "- item" lists, | and > block scalars. */
+function parseFrontmatter(text) {
+    const t = text.replace(/\r\n?/g, "\n");
+    if (!t.startsWith("---\n") && t !== "---")
+        return { data: Object.create(null), body: t, hasFrontmatter: false };
+    const rest = t.slice(4);
+    const m = /(^|\n)---[ \t]*(\n|$)/.exec(rest);
+    if (!m)
+        return { data: Object.create(null), body: t, hasFrontmatter: false };
+    const header = rest.slice(0, m.index);
+    const body = rest.slice(m.index + m[0].length);
+    // no prototype: a key such as `__proto__: [a, b]` in an untrusted file must stay plain data
+    const data = Object.create(null);
+    const lines = header.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const km = /^([A-Za-z_][\w-]*)\s*:\s*(.*)$/.exec(line);
+        if (!km)
+            continue;
+        const key = km[1];
+        const val = km[2].trim();
+        if (val === "|" || val === ">" || val === "|-" || val === ">-") {
+            const parts = [];
+            while (i + 1 < lines.length && (/^\s+/.test(lines[i + 1]) || lines[i + 1] === ""))
+                parts.push(lines[++i].trim());
+            data[key] = parts.join(val.startsWith(">") ? " " : "\n").trim();
+        }
+        else if (val === "") {
+            const items = [];
+            while (i + 1 < lines.length && /^\s*-\s+/.test(lines[i + 1]))
+                items.push(unquote(lines[++i].replace(/^\s*-\s+/, "")));
+            data[key] = items.length ? items : "";
+        }
+        else if (val.startsWith("[") && val.endsWith("]")) {
+            data[key] = val
+                .slice(1, -1)
+                .split(",")
+                .map((x) => unquote(x))
+                .filter(Boolean);
+        }
+        else if (val === "true" || val === "false") {
+            data[key] = val === "true";
+        }
+        else {
+            // plain or quoted scalar that continues on indented lines (YAML folds the line breaks into spaces)
+            let full = val;
+            const q = full[0] === '"' || full[0] === "'" ? full[0] : "";
+            const closed = () => q === "" || full.indexOf(q, 1) !== -1;
+            while (i + 1 < lines.length && (!closed() || (/^[ \t]+\S/.test(lines[i + 1]) && !/^\s*-\s/.test(lines[i + 1])))) {
+                if (q && closed())
+                    break;
+                i++;
+                full += " " + lines[i].trim();
+                if (i > 4000)
+                    break;
+            }
+            data[key] = unquote(full);
+        }
+    }
+    return { data, body, hasFrontmatter: true };
+}
+/** Normalise a frontmatter value that may be a list or a comma-separated string. */
+function asList(v) {
+    if (v === undefined || typeof v === "boolean")
+        return [];
+    if (Array.isArray(v))
+        return v.filter(Boolean);
+    return v
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+function asString(v) {
+    if (v === undefined)
+        return "";
+    if (typeof v === "boolean")
+        return String(v);
+    return Array.isArray(v) ? v.join(", ") : v;
+}

package/dist/text/imports.js

@@ -0,0 +1,86 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isInside = void 0;
+exports.expandImports = expandImports;
+const node_path_1 = __importDefault(require("node:path"));
+const fs_safe_1 = require("../fs-safe");
+Object.defineProperty(exports, "isInside", { enumerable: true, get: function () { return fs_safe_1.isInside; } });
+const comments_1 = require("./comments");
+const MAX_DEPTH = 4;
+/** Upper bound on @path candidates examined per file tree; a hostile file with 150,000 of them would otherwise cost seconds of stat calls. */
+const MAX_CANDIDATES = 2000;
+function candidates(prose) {
+    // Drop inline code spans first, then find @path tokens.
+    const noCode = prose.replace(/`[^`\n]*`/g, " ");
+    const out = [];
+    const re = /(^|[\s(])@([^\s)]+)/g;
+    let m;
+    while ((m = re.exec(noCode))) {
+        let spec = m[2].replace(/[.,;:!?]+$/, "");
+        if (!spec)
+            continue;
+        const looksLikePath = spec.includes("/") || /\.[A-Za-z0-9]{1,8}$/.test(spec);
+        if (!looksLikePath || /^[\w.-]+@[\w.-]+$/.test(spec))
+            continue; // @mentions / emails
+        out.push(spec);
+    }
+    return out;
+}
+/**
+ * Expand Claude-style `@path` imports (depth ≤ 4, cycle-safe, code spans/fences skipped).
+ * Imports do NOT reduce cost, so imported text is added to the total.
+ * `allowed(realPath)` restricts which files may be read (project tree / home).
+ */
+function expandImports(fileText, filePath, home, allowed, opts) {
+    const seen = new Set([(0, fs_safe_1.realpathOrSelf)(filePath)]);
+    const skipped = [];
+    let imported = 0;
+    let tried = 0;
+    const parts = [];
+    const walk = (text, from, depth) => {
+        const prose = (0, comments_1.splitFences)(text)
+            .filter((s) => !s.code)
+            .map((s) => s.text)
+            .join("\n");
+        for (const spec of candidates(prose)) {
+            if (++tried > MAX_CANDIDATES) {
+                if (tried === MAX_CANDIDATES + 1)
+                    skipped.push({ spec: "(more)", reason: `more than ${MAX_CANDIDATES} @imports; the rest were not followed` });
+                continue;
+            }
+            if (opts.relativeOnly && (spec.startsWith("~") || node_path_1.default.isAbsolute(spec) || /^[A-Za-z]:[\\/]/.test(spec))) {
+                skipped.push({ spec, reason: "absolute or ~/ path (not loaded by this agent)" });
+                continue;
+            }
+            const target = spec.startsWith("~/") ? node_path_1.default.join(home, spec.slice(2)) : node_path_1.default.resolve(node_path_1.default.dirname(from), spec);
+            const real = (0, fs_safe_1.realpathOrSelf)(target);
+            if (seen.has(real))
+                continue;
+            const maxDepth = opts.maxDepth ?? MAX_DEPTH;
+            if (depth >= maxDepth) {
+                skipped.push({ spec, reason: `depth>${maxDepth}` });
+                continue;
+            }
+            if (!allowed(real)) {
+                skipped.push({ spec, reason: "outside allowed roots" });
+                continue;
+            }
+            const r = (opts.read ?? ((t) => (0, fs_safe_1.readTextSafe)(t)))(target);
+            if (!r.ok) {
+                if (r.reason !== "missing")
+                    skipped.push({ spec, reason: r.reason });
+                continue;
+            }
+            seen.add(real);
+            imported++;
+            const t = opts.stripComments ? (0, comments_1.stripHtmlComments)(r.text) : r.text;
+            parts.push(t);
+            walk(t, target, depth + 1);
+        }
+    };
+    walk(fileText, filePath, 0);
+    return { text: [fileText, ...parts].join("\n"), imported, skipped };
+}

package/dist/tokens/counter.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeCounter = makeCounter;
+function heuristicCount(text) {
+    if (!text)
+        return 0;
+    const jsonish = (text.match(/[{}\[\]":,]/g) || []).length / text.length > 0.08;
+    return Math.ceil(text.length / (jsonish ? 3.0 : 3.5));
+}
+function makeCounter(requested) {
+    if (requested === "auto") {
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            const enc = require("gpt-tokenizer/encoding/o200k_base");
+            // Verify it works (and that special-token text such as "<|endoftext|>" cannot throw).
+            enc.encode("hello", { disallowedSpecial: new Set() });
+            return {
+                method: "bpe-o200k",
+                note: "o200k BPE (gpt-tokenizer, bundled) with per-family scaling",
+                count(text) {
+                    if (!text)
+                        return 0;
+                    try {
+                        return enc.encode(text, { disallowedSpecial: new Set() }).length;
+                    }
+                    catch {
+                        return heuristicCount(text);
+                    }
+                },
+            };
+        }
+        catch {
+            /* fall through to heuristic */
+        }
+    }
+    return {
+        method: "heuristic",
+        note: requested === "auto" ? "BPE tokenizer unavailable; fell back to chars/3.5 heuristic" : "chars/3.5 (prose) or chars/3.0 (JSON/code) heuristic",
+        count: heuristicCount,
+    };
+}

package/dist/tokens/families.js

@@ -0,0 +1,79 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudeCalibration = claudeCalibration;
+exports.profileFor = profileFor;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const agents_1 = require("../agents");
+let calCache;
+/** Claude ratios from spec/calibration.json (published count_tokens measurements; see docs/ACCURACY.md). */
+function claudeCalibration() {
+    if (!calCache) {
+        const j = JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(__dirname, "..", "..", "spec", "calibration.json"), "utf8"));
+        calCache = j.claude;
+    }
+    return calCache;
+}
+function sym(raw, factor, bandPct) {
+    const est = Math.round(raw * factor);
+    return { est, low: Math.round(est * (1 - bandPct)), high: Math.round(est * (1 + bandPct)) };
+}
+const pct = (x) => `±${Math.round(x * 100)}%`;
+/**
+ * Claude factors come from spec/calibration.json (published ratios, still unvalidated: n is small). Codex is o200k itself.
+ * "mixed" agents (Cursor, Copilot) let the user pick the model, so they span GPT-like to Claude-like. Gemini has no measured ratio.
+ */
+function profileFor(agent, method, claude) {
+    if (method === "heuristic") {
+        return {
+            id: "heuristic",
+            label: "heuristic chars/3.5 (no tokenizer)",
+            band: "±35%",
+            apply: (raw) => sym(raw, 1, 0.35),
+            unvalidated: true,
+        };
+    }
+    const family = (0, agents_1.agentMeta)(agent).tokenFamily;
+    if (family === "openai") {
+        return { id: "openai-o200k", label: "o200k BPE (OpenAI-family)", band: "±3%", apply: (raw) => sym(raw, 1.0, 0.03), unvalidated: false };
+    }
+    const cal = claudeCalibration();
+    const scale = claude === "current" ? 1 : cal.legacyRatio.value;
+    const f = (k) => Math.round(cal.byKind[k].factor * scale * 1000) / 1000;
+    const b = (k) => cal.byKind[k].band;
+    const claudeProfile = {
+        id: `claude-${claude}`,
+        label: `o200k × ${f("markdown")} (text) / × ${f("json")} (JSON), Claude-${claude} ratios from published count_tokens measurements`,
+        band: pct(b("markdown")),
+        apply: (raw, kind = "markdown") => sym(raw, f(kind), b(kind)),
+        unvalidated: cal.unvalidated,
+    };
+    if (family === "claude")
+        return claudeProfile;
+    if (family === "gemini") {
+        // No published Gemini-vs-o200k ratio was found (docs/ACCURACY.md), so prehello does not invent one: the estimate is the
+        // raw o200k count and the band is the same GPT-like-to-Claude-like spread used for "model unknown". NOT a Gemini measurement.
+        return {
+            id: "gemini-unvalidated",
+            label: `o200k × 1.0; no measured Gemini ratio, band borrowed from the GPT-like (×1.0) to Claude-like (×${f("markdown")}) spread`,
+            band: `wide, unvalidated: −3% to +${Math.round((f("markdown") * (1 + b("markdown")) - 1) * 100)}%`,
+            apply: (raw, kind = "markdown") => ({ est: Math.round(raw), low: Math.round(raw * 0.97), high: Math.round(raw * f(kind) * (1 + b(kind))) }),
+            unvalidated: true,
+        };
+    }
+    // mixed (Cursor, GitHub Copilot: the model is user-selectable and not discoverable from disk): span GPT-like (×1.0, −3%) to Claude-like (×f, +band); est = midpoint.
+    return {
+        id: agent === "cursor" ? "cursor-mixed" : "mixed",
+        label: `o200k; model unknown, so midpoint of GPT-like (×1.0) and Claude-like (×${f("markdown")}) ratios`,
+        band: `wide: GPT-like −3% to Claude-like +${Math.round(b("markdown") * 100)}%`,
+        apply: (raw, kind = "markdown") => {
+            const lo = Math.round(raw * 0.97);
+            const hi = Math.round(raw * f(kind) * (1 + b(kind)));
+            return { est: Math.round((raw * (1 + f(kind))) / 2), low: lo, high: hi };
+        },
+        unvalidated: true,
+    };
+}

package/dist/util/fmt.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitize = sanitize;
+exports.fmtInt = fmtInt;
+exports.fmtTok = fmtTok;
+exports.fmtPct = fmtPct;
+exports.parseWindow = parseWindow;
+exports.fmtWindow = fmtWindow;
+exports.xmlEscape = xmlEscape;
+exports.wrap = wrap;
+exports.shortenLeft = shortenLeft;
+exports.shortenLabel = shortenLabel;
+exports.cmp = cmp;
+const secrets_1 = require("./secrets");
+/** Remove control characters / ANSI escapes so file names from untrusted repos cannot hijack the terminal or a downstream agent. */
+function sanitize(s, max = 120) {
+    // eslint-disable-next-line no-control-regex
+    let out = s.replace(/\u001b\[[0-9;?]*[ -\/]*[@-~]/g, "").replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, "?");
+    // Scrub BEFORE truncating: a cut-off key (sk-ant-…) would no longer match and would leak its prefix.
+    out = (0, secrets_1.scrubSecrets)(out);
+    if (out.length > max)
+        out = out.slice(0, max - 1) + "…";
+    return out;
+}
+function fmtInt(n) {
+    return Math.round(n).toLocaleString("en-US");
+}
+/** 16440 -> "16.4k", 950 -> "950". */
+function fmtTok(n) {
+    const r = Math.round(n);
+    if (r < 1000)
+        return String(r);
+    if (r < 100000)
+        return (r / 1000).toFixed(1).replace(/\.0$/, "") + "k";
+    if (r < 999500)
+        return Math.round(r / 1000) + "k";
+    return (r / 1_000_000).toFixed(r < 10_000_000 ? 2 : 1).replace(/\.?0+$/, "") + "M";
+}
+function fmtPct(x) {
+    if (x < 0.1)
+        return x === 0 ? "0%" : "< 0.1%";
+    return (x < 10 ? x.toFixed(1) : String(Math.round(x))) + "%";
+}
+function parseWindow(s) {
+    const m = /^(\d+(?:\.\d+)?)\s*([km]?)$/i.exec(s.trim());
+    if (!m)
+        return null;
+    const n = parseFloat(m[1]);
+    const mult = m[2].toLowerCase() === "k" ? 1000 : m[2].toLowerCase() === "m" ? 1_000_000 : 1;
+    const v = Math.round(n * mult);
+    return v >= 1000 ? v : null;
+}
+function fmtWindow(n) {
+    if (n >= 1_000_000 && n % 1_000_000 === 0)
+        return n / 1_000_000 + "M";
+    if (n >= 1000 && n % 1000 === 0)
+        return n / 1000 + "k";
+    return String(n);
+}
+function xmlEscape(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[c]);
+}
+/** Greedy word wrap; first line gets `first`, continuation lines get `indent`. */
+function wrap(text, width, first = "", indent = "") {
+    const room = Math.max(20, width - Math.max(first.length, indent.length) - 1);
+    const words = text
+        .split(/\s+/)
+        .filter(Boolean)
+        .flatMap((w) => (w.length > room ? w.match(new RegExp(`[\\s\\S]{1,${room}}`, "gu")) ?? [w] : [w]));
+    const lines = [];
+    let cur = first;
+    let empty = true;
+    for (const w of words) {
+        if (!empty && cur.length + 1 + w.length > width) {
+            lines.push(cur);
+            cur = indent + w;
+        }
+        else {
+            cur += (empty ? "" : " ") + w;
+        }
+        empty = false;
+    }
+    lines.push(cur);
+    return lines;
+}
+/** Truncate from the LEFT, keeping the end (the file name) of a path-like label. */
+function shortenLeft(s, max) {
+    if (s.length <= max)
+        return s;
+    return "…" + s.slice(s.length - (max - 1));
+}
+/** Shorten a row label: paths keep their tail (the file name); prose keeps its start. */
+function shortenLabel(s, max) {
+    const t = s.replace(/^\.\//, "");
+    if (t.length <= max)
+        return t;
+    return /[\\/]/.test(t) && !/\s/.test(t) ? "…" + t.slice(t.length - (max - 1)) : t.slice(0, max - 1) + "…";
+}
+/** Locale-independent, ICU-independent string order (UTF-16 code units). Use instead of localeCompare for deterministic output. */
+function cmp(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}

package/dist/util/secrets.js

@@ -0,0 +1,35 @@
+"use strict";
+/** Secret-shaped string detection. Dependency-free so util/fmt can use it (sanitize() scrubs everything it displays). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECRET_RES = void 0;
+exports.findSecretLines = findSecretLines;
+exports.scrubSecrets = scrubSecrets;
+exports.SECRET_RES = [
+    /AKIA[0-9A-Z]{16}/,
+    /gh[pousr]_[A-Za-z0-9]{30,}/,
+    /github_pat_[A-Za-z0-9_]{30,}/,
+    /sk-[A-Za-z0-9_-]{20,}/,
+    /xox[baprs]-[A-Za-z0-9-]{10,}/,
+    /AIza[0-9A-Za-z_-]{35}/,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
+    /(api[_-]?key|secret|token|passwd|password)["']?\s*[:=]\s*["']?[A-Za-z0-9_\-\/+=.]{16,}/i,
+];
+/** 1-based line numbers containing something that looks like a secret. Values are never returned. */
+function findSecretLines(text) {
+    const out = [];
+    const lines = text.split("\n");
+    for (let i = 0; i < lines.length && out.length < 50; i++) {
+        if (lines[i].length > 4000)
+            continue;
+        if (exports.SECRET_RES.some((re) => re.test(lines[i])))
+            out.push(i + 1);
+    }
+    return out;
+}
+/** Replace anything secret-looking inside a string we are about to display. */
+function scrubSecrets(s) {
+    let out = s;
+    for (const re of exports.SECRET_RES)
+        out = out.replace(new RegExp(re.source, re.flags.includes("g") ? re.flags : re.flags + "g"), "[redacted]");
+    return out;
+}

package/dist/version.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VERSION = void 0;
+// Generated by scripts/gen-version.mjs from package.json. Do not edit.
+exports.VERSION = "1.0.0";

package/package.json

@@ -1,6 +1,72 @@
 {
   "name": "prehello",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "See what your coding agent (Claude Code, Cursor, Codex, GitHub Copilot, Gemini CLI) loads before you say hello, and what you could cut. Local-only, read-only, no API key.",
+  "license": "MIT",
+  "author": "Piyush Kumar",
+  "homepage": "https://github.com/PIYUSH-KUMAR1809/prehello#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/PIYUSH-KUMAR1809/prehello.git"
+  },
+  "bugs": {
+    "url": "https://github.com/PIYUSH-KUMAR1809/prehello/issues"
+  },
+  "bin": {
+    "prehello": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "assets",
+    "spec",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "prebuild": "node scripts/gen-version.mjs",
+    "build": "tsc -p tsconfig.build.json",
+    "pretypecheck": "node scripts/gen-version.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && vitest run",
+    "prepack": "npm run clean && npm run build",
+    "prehello": "node dist/cli.js"
+  },
+  "keywords": [
+    "claude-code",
+    "cursor",
+    "codex",
+    "github-copilot",
+    "gemini-cli",
+    "agents-md",
+    "ai-agents",
+    "context-window",
+    "tokens",
+    "token-counter",
+    "mcp",
+    "sarif",
+    "cli",
+    "developer-tools"
+  ],
+  "dependencies": {
+    "gpt-tokenizer": "^4.1.0",
+    "picomatch": "^4.0.7",
+    "smol-toml": "^1.9.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.19.0",
+    "@types/picomatch": "^4.0.3",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.7"
+  },
+  "optionalDependencies": {
+    "@resvg/resvg-wasm": "^2.6.2"
+  }
+}

package/spec/calibration.json

@@ -0,0 +1,33 @@
+{
+  "version": 1,
+  "note": "Claude-to-o200k token ratios from PUBLISHED Anthropic count_tokens measurements (not measured by prehello). factor = median of the published points for that content kind; band = relative half-width used for low/high. Unvalidated until n >= 100 own measurements (scripts/calibrate-anthropic.mjs). See docs/ACCURACY.md.",
+  "claude": {
+    "measuredAt": "2026-10-23",
+    "tokenizer": "Claude 4.7 and later (Opus/Sonnet/Haiku 5.5 give identical counts per both sources)",
+    "n": 10,
+    "unvalidated": true,
+    "byKind": {
+      "markdown": {
+        "factor": 1.43,
+        "band": 0.15,
+        "points": [
+          { "ratio": 1.486, "what": "English prose reference text, 430 o200k tokens", "source": "https://measuredlab.com/tools/token-counter/" },
+          { "ratio": 1.38, "what": "5 Markdown/reST files, 44,621 o200k tokens", "source": "https://aitoollabs.dev/posts/count-tokens-in-codebase/" }
+        ]
+      },
+      "json": {
+        "factor": 1.35,
+        "band": 0.15,
+        "points": [
+          { "ratio": 1.282, "what": "JSON reference text, 535 o200k tokens", "source": "https://measuredlab.com/tools/token-counter/" },
+          { "ratio": 1.42, "what": "5 YAML/JSON/TOML files, 3,391 o200k tokens", "source": "https://aitoollabs.dev/posts/count-tokens-in-codebase/" }
+        ]
+      }
+    },
+    "legacyRatio": {
+      "value": 0.82,
+      "what": "Sonnet 4.6 (pre-4.7 tokenizer) used 18% fewer tokens than 4.7+ on the same 33 files",
+      "source": "https://aitoollabs.dev/posts/count-tokens-in-codebase/"
+    }
+  }
+}

package/spec/claude-code.json

@@ -0,0 +1,22 @@
+{
+  "agent": "claude-code",
+  "verifiedAt": "2026-10-25",
+  "verifiedNote": "Skills (locations, combined 1,536-char description cap, disable-model-invocation, skillOverrides, nested lazy loading, commands merged into skills, claude.ai synced skills) and plugin install records (installed_plugins.json with installPath, enabledPlugins, plugins cache layout) are from Claude Code docs (fetched 2026-10-25). The 1% skill listing budget is documented but its unit (tokens vs characters) is unclear. managed-mcp.json is documented by name; its location inside the managed directory is assumed. Not re-verified against a real install.",
+  "docs": {
+    "memory": "https://code.claude.com/docs/en/memory",
+    "mcp": "https://code.claude.com/docs/en/mcp",
+    "skills": "https://code.claude.com/docs/en/skills",
+    "plugins": "https://code.claude.com/docs/en/plugins/loading"
+  },
+  "caps": {
+    "instructionFileGuidelineLines": 200,
+    "memoryMaxLines": 200,
+    "memoryMaxBytes": 25600,
+    "skillDescriptionMaxChars": 1536,
+    "skillListingBudgetFractionOfWindow": 0.01,
+    "importMaxDepth": 4
+  },
+  "minVersions": {
+    "agentsMdFallback": "2.1.277"
+  }
+}

package/spec/codex.json

@@ -0,0 +1,14 @@
+{
+  "agent": "codex",
+  "verifiedAt": "2026-10-25",
+  "verifiedNote": "AGENTS.md discovery, the 32 KiB default, skills locations (.agents/skills cwd\u2192repo root, ~/.agents/skills, /etc/codex/skills), the name+description+path listing and [[skills.config]] disabling are from OpenAI's docs (fetched 2026-10-25). ASSUMED: project .codex/config.toml MCP, MCP schema loading (modelled upfront), ~/.codex/skills as a legacy skills path. Token accuracy was never validated.",
+  "docs": {
+    "agentsMd": "https://learn.chatgpt.com/docs/agent-configuration/agents-md",
+    "mcp": "https://learn.chatgpt.com/docs/extend/mcp?surface=cli",
+    "skills": "https://learn.chatgpt.com/docs/build-skills",
+    "config": "https://learn.chatgpt.com/docs/config-file/config-reference"
+  },
+  "caps": {
+    "projectDocMaxBytesDefault": 32768
+  }
+}