@aexhq/sdk 0.46.4-canary → 0.50.0

package/dist/_contracts/schemas/workspace-resources.d.ts

@@ -1,50 +0,0 @@
-/**
- * Schemas for persisted workspace resource references.
- *
- * Two independent gates live here:
- *
- * - {@link workspaceResourceNameSchema} — the directly-supplied resource *name*
- *   grammar. Validation only: an accepted name is stored verbatim, so there is
- *   deliberately no normaliser to pair with it (no trim, no case folding).
- * - {@link pinnedWorkspaceResourceSchema} — the immutable identity quartet every
- *   submitted resource carries, plus the `assetId`/`contentHash` agreement.
- *
- * **Both are factories over the wire grammars rather than owners of them.** The
- * name patterns are supplied because there are two of them with deliberately
- * separate identities (`workspace-resources.ts`), and the digest pattern is
- * supplied because `canonical-sha256.ts` is the single declaring site for that
- * grammar and `workspace-resources.ts` is its declared consumer — an invariant
- * `canonical-sha256-ownership.test.ts` enforces. Threading them in keeps this
- * module about *shape* and leaves grammar ownership where it already is.
- *
- * Neither schema is strict. `assertPinnedWorkspaceResource` is handed a fully
- * projected `WorkspaceResourceRef` — `kind`, `name`, `mountPath`, and friends
- * ride along — and rejecting those would break every caller. Unknown-key
- * rejection for the resource objects themselves is the submission parser's job,
- * one level up, where the per-kind key list actually exists.
- */
-import * as z from "zod/mini";
-/**
- * A directly supplied resource name: matches `pattern`, and never contains the
- * reserved `__` separator.
- *
- * The envelope failure and the type failure share one message because the
- * ladder this replaces collapsed them (`typeof value !== "string" || !pattern.test(value)`),
- * and `abort` keeps the separator complaint from firing on a name that never
- * cleared the envelope.
- */
-export declare function workspaceResourceNameSchema(path: string, pattern: RegExp): z.ZodMiniString<string>;
-/**
- * The immutable identity fields common to every submitted workspace resource.
- *
- * Field order is the order the sequential assertions this replaces ran in, and
- * `errorFromZod` reports the shallowest issue, so a field complaint still wins
- * over the `assetId`/`contentHash` agreement — which Zod only evaluates once
- * every field has parsed (measured), exactly as the original ladder did.
- */
-export declare function pinnedWorkspaceResourceSchema(path: string, digestPattern: RegExp): z.ZodMiniObject<{
-    resourceId: z.ZodMiniString<string>;
-    version: z.ZodMiniNumber<number>;
-    assetId: z.ZodMiniString<string>;
-    contentHash: z.ZodMiniString<string>;
-}, z.core.$strip>;

package/dist/_contracts/schemas/workspace-resources.js

@@ -1,87 +0,0 @@
-/**
- * Schemas for persisted workspace resource references.
- *
- * Two independent gates live here:
- *
- * - {@link workspaceResourceNameSchema} — the directly-supplied resource *name*
- *   grammar. Validation only: an accepted name is stored verbatim, so there is
- *   deliberately no normaliser to pair with it (no trim, no case folding).
- * - {@link pinnedWorkspaceResourceSchema} — the immutable identity quartet every
- *   submitted resource carries, plus the `assetId`/`contentHash` agreement.
- *
- * **Both are factories over the wire grammars rather than owners of them.** The
- * name patterns are supplied because there are two of them with deliberately
- * separate identities (`workspace-resources.ts`), and the digest pattern is
- * supplied because `canonical-sha256.ts` is the single declaring site for that
- * grammar and `workspace-resources.ts` is its declared consumer — an invariant
- * `canonical-sha256-ownership.test.ts` enforces. Threading them in keeps this
- * module about *shape* and leaves grammar ownership where it already is.
- *
- * Neither schema is strict. `assertPinnedWorkspaceResource` is handed a fully
- * projected `WorkspaceResourceRef` — `kind`, `name`, `mountPath`, and friends
- * ride along — and rejecting those would break every caller. Unknown-key
- * rejection for the resource objects themselves is the submission parser's job,
- * one level up, where the per-kind key list actually exists.
- */
-import * as z from "zod/mini";
-import { idPattern } from "../ids.js";
-/**
- * Opaque logical resource id minted by the platform.
- *
- * Sourced from the id owner rather than re-declared: `scripts/validate/id-format-parity.test.ts`
- * fails on any `^<prefix>_` literal outside `ids.ts`, because eight hand-copies of the
- * workspace-id pattern had already drifted (one lacked the `/i` flag the others carried,
- * so the same id passed everywhere and threw at the telemetry boundary).
- */
-const WORKSPACE_RESOURCE_ID_PATTERN = idPattern("resource");
-/** Bytes prefix stripped from a canonical digest to derive the asset id. */
-const DIGEST_PREFIX = "sha256:";
-/**
- * A directly supplied resource name: matches `pattern`, and never contains the
- * reserved `__` separator.
- *
- * The envelope failure and the type failure share one message because the
- * ladder this replaces collapsed them (`typeof value !== "string" || !pattern.test(value)`),
- * and `abort` keeps the separator complaint from firing on a name that never
- * cleared the envelope.
- */
-export function workspaceResourceNameSchema(path, pattern) {
-    const envelope = `${path} must match ${pattern.source}`;
-    return z.string({ error: envelope }).check(z.refine((value) => pattern.test(value), { error: envelope, abort: true }), z.refine((value) => !value.includes("__"), {
-        error: `${path} must not contain "__"`,
-        abort: true
-    }));
-}
-/**
- * The immutable identity fields common to every submitted workspace resource.
- *
- * Field order is the order the sequential assertions this replaces ran in, and
- * `errorFromZod` reports the shallowest issue, so a field complaint still wins
- * over the `assetId`/`contentHash` agreement — which Zod only evaluates once
- * every field has parsed (measured), exactly as the original ladder did.
- */
-export function pinnedWorkspaceResourceSchema(path, digestPattern) {
-    const resourceId = `${path}.resourceId must match wres_<32 lowercase hex>`;
-    const version = `${path}.version must be a positive integer`;
-    const assetId = `${path}.assetId must be a non-empty string`;
-    const contentHash = `${path}.contentHash must be a sha256 digest`;
-    return z
-        .object({
-        resourceId: z.string({ error: resourceId }).check(z.refine((value) => WORKSPACE_RESOURCE_ID_PATTERN.test(value), {
-            error: resourceId,
-            abort: true
-        })),
-        version: z.number({ error: version }).check(z.refine((value) => Number.isSafeInteger(value) && value >= 1, {
-            error: version,
-            abort: true
-        })),
-        assetId: z
-            .string({ error: assetId })
-            .check(z.minLength(1, { error: assetId, abort: true })),
-        contentHash: z.string({ error: contentHash }).check(z.refine((value) => digestPattern.test(value), {
-            error: contentHash,
-            abort: true
-        }))
-    })
-        .check(z.refine((value) => value.assetId === `asset_${value.contentHash.slice(DIGEST_PREFIX.length)}`, { error: `${path}.assetId must identify the same bytes as contentHash` }));
-}

package/dist/_contracts/sdk-errors.d.ts

@@ -1,212 +0,0 @@
-import { type AexApiErrorCode } from "./error-codes.js";
-import type { ProviderFault } from "./provider-fault.js";
-export type AexErrorCode = "SESSION_CONFIG_INVALID" | "CREDENTIAL_INVALID" | "PROVIDER_ERROR" | "SESSION_STATE_ERROR" | "CLEANUP_ERROR" | "RUNTIME_UNSUPPORTED" | "API_ERROR" | "NETWORK_ERROR";
-export declare class AexError extends Error {
-    readonly code: AexErrorCode;
-    readonly details?: unknown;
-    constructor(code: AexErrorCode, message: string, details?: unknown, options?: {
-        readonly cause?: unknown;
-    });
-}
-export interface SessionConfigValidationDetails {
-    /** Stable public field path; human error prose is not a branching contract. */
-    readonly field: string;
-}
-export declare class SessionConfigValidationError extends AexError {
-    readonly details: SessionConfigValidationDetails;
-    /**
-     * `code` and `details.field` are the stable machine contract. An optional
-     * cause is best-effort diagnostic context and must not be used for branching.
-     */
-    constructor(message: string, details: SessionConfigValidationDetails, options?: {
-        readonly cause?: unknown;
-    });
-}
-export declare class CredentialValidationError extends AexError {
-    constructor(message: string, details?: unknown);
-}
-export declare class ProviderError extends AexError {
-    readonly status: number | undefined;
-    constructor(message: string, options?: {
-        status?: number;
-        details?: unknown;
-    });
-}
-export declare class SessionStateError extends AexError {
-    /**
-     * HTTP status from a wrapped API rejection, when this state error is a
-     * bounded client-side interpretation of that rejection.
-     */
-    readonly status: number | undefined;
-    /** Stable API code from a wrapped API rejection, when available. */
-    readonly apiCode: AexApiErrorCode | undefined;
-    /** Request id from a wrapped API rejection, when available. */
-    readonly requestId: string | undefined;
-    constructor(message: string, details?: unknown, options?: {
-        readonly cause?: unknown;
-    });
-}
-export declare class CleanupError extends AexError {
-    constructor(message: string, details?: unknown);
-}
-/**
- * Thrown by SDK and CLI operations when the hosted aex API returns a non-2xx
- * response. Carries the HTTP status, the redacted parsed body, the server's
- * STABLE {@link AexApiErrorCode} (when present), and a `requestId` for support.
- * Construct via {@link import("./error-factory.js").apiErrorFromResponse} — the
- * single wire→exception mapping — which dispatches to a typed subclass
- * ({@link AexAuthError} / {@link AexIdempotencyConflictError} /
- * {@link AexNotFoundError} / {@link AexRateLimitError}).
- */
-export declare class AexApiError extends AexError {
-    readonly status: number;
-    readonly body: unknown;
-    /** The server's stable error code, when the body carried a known one. */
-    readonly apiCode: AexApiErrorCode | undefined;
-    /** Request id (body `requestId` or a response header) for support correlation. */
-    readonly requestId: string | undefined;
-    constructor(status: number, message: string, body: unknown, options?: {
-        readonly apiCode?: AexApiErrorCode | undefined;
-        readonly requestId?: string | undefined;
-        readonly cause?: unknown;
-    });
-}
-/** Shared construction shape for the typed {@link AexApiError} subclasses. */
-export interface AexApiErrorInit {
-    readonly status: number;
-    readonly message: string;
-    readonly body: unknown;
-    readonly apiCode?: AexApiErrorCode | undefined;
-    readonly requestId?: string | undefined;
-    readonly cause?: unknown;
-}
-/** 401/403 auth failure (token invalid/revoked/expired, forbidden, insufficient scope). */
-export declare class AexAuthError extends AexApiError {
-    /** The scope the endpoint required, when the server named it (insufficient_scope). */
-    readonly requiredScope: string | undefined;
-    constructor(init: AexApiErrorInit & {
-        readonly requiredScope?: string | undefined;
-    });
-}
-/** 409 — the idempotency key was reused with a different request body. */
-export declare class AexIdempotencyConflictError extends AexApiError {
-    constructor(init: AexApiErrorInit);
-}
-/** 404 — the requested resource was not found. */
-export declare class AexNotFoundError extends AexApiError {
-    constructor(init: AexApiErrorInit);
-}
-/** Construction shape for {@link AexRateLimitError}. */
-export type AexRateLimitErrorInit = Omit<AexApiErrorInit, "message" | "body"> & {
-    /** Omitted when the retry policy builds the error: a fixed, non-leaky summary is generated. */
-    readonly message?: string;
-    readonly body?: unknown;
-    /** Suggested backoff (ms), when the server advertised one (Retry-After). */
-    readonly retryAfterMs?: number | undefined;
-    /** How many transport attempts were made before giving up. Defaults to `1`. */
-    readonly attempts?: number;
-    /** Whether the throttle came from the aex API plane or the upstream provider. */
-    readonly source?: "api" | "provider";
-    /** The upstream provider fault, when the throttle originated there. */
-    readonly providerFault?: ProviderFault;
-};
-/**
- * 429 / 503 / 529 — the workspace hit a rate/concurrency limit, or an upstream
- * provider said "slow down"; retry after a backoff.
- *
- * ONE class for both producers: the wire→exception factory
- * (`apiErrorFromResponse`) and the shared HTTP retry policy, so `isRateLimited`
- * recognises both with no split-brain. When the retry policy raises it, `message`
- * is a fixed non-leaky summary (never an echo of the raw body, which is still
- * available redacted on `.body`) and `attempts` / `source` / `providerFault`
- * carry the retry-layer detail.
- */
-export declare class AexRateLimitError extends AexApiError {
-    /** Suggested backoff (ms), when the server advertised one (Retry-After). */
-    readonly retryAfterMs: number | undefined;
-    /** How many attempts were made before giving up; `1` for a single-shot rejection. */
-    readonly attempts: number;
-    /** Whether the throttle came from the aex API plane or the upstream provider. */
-    readonly source: "api" | "provider";
-    /** The upstream provider fault, when the throttle originated there. */
-    readonly providerFault?: ProviderFault;
-    constructor(init: AexRateLimitErrorInit);
-}
-/**
- * 410 (WS4) — the session's CONTENT (events, messages, files, manifest,
- * archive, event stream) was deleted after its retention window; only the
- * session RECORD (metadata) remains. Carries the `sessionId`, when the content
- * was `purgedAt`, and what triggered it (`deletedBy`). Every content read AND
- * `session…stream()` surface it via the one wire→exception factory. Narrow with
- * {@link isContentDeleted}; check `session.dataState === "metadata_only"` first
- * to avoid the round-trip.
- */
-export declare class ContentDeletedError extends AexApiError {
-    /** The session whose content was deleted. */
-    readonly sessionId: string | undefined;
-    /** When the content was purged (ISO 8601), when the server reported it. */
-    readonly purgedAt: string | undefined;
-    /** What triggered the purge: retention-window elapse or an explicit user delete. */
-    readonly deletedBy: "retention" | "user" | undefined;
-    constructor(init: AexApiErrorInit & {
-        readonly sessionId?: string | undefined;
-        readonly purgedAt?: string | undefined;
-        readonly deletedBy?: "retention" | "user" | undefined;
-    });
-}
-/** True for a 401/403 authentication/authorization failure. */
-export declare function isAuthError(err: unknown): err is AexAuthError;
-/** True for a 403 whose cause is a missing scope (`insufficient_scope`). */
-export declare function isInsufficientScope(err: unknown): boolean;
-/** True for a 409 idempotency-key reuse conflict. */
-export declare function isIdempotencyConflict(err: unknown): err is AexIdempotencyConflictError;
-/** True for a 404 not-found error. */
-export declare function isNotFound(err: unknown): err is AexNotFoundError;
-/** True for a 429 rate/concurrency-limit error. */
-export declare function isRateLimited(err: unknown): err is AexRateLimitError;
-/** True for a 410 whose session content was deleted after its retention window. */
-export declare function isContentDeleted(err: unknown): err is ContentDeletedError;
-/**
- * Thrown when a BFF-bound request fails BEFORE any HTTP response exists — DNS
- * failure, connection refused, TLS error, socket reset. Wraps the raw fetch
- * rejection (whose undici form is a bare `TypeError: fetch failed` with the
- * useful code hidden on `cause.code`) into a message that names the request
- * and the transport failure, e.g.
- * `POST api.aex.dev/api/assets/presign failed: ECONNREFUSED (connect ECONNREFUSED 127.0.0.1:443)`.
- * The original rejection is preserved on `cause`.
- */
-export declare class AexNetworkError extends AexError {
-    readonly method: string;
-    /** Request host — never carries credentials or the query string. */
-    readonly host: string;
-    readonly path: string;
-    /** Transport failure code (e.g. `ECONNREFUSED`), when detectable. */
-    readonly causeCode: string | undefined;
-    /** Attempts made when a retry layer exhausted its budget; `1` otherwise. */
-    readonly attempts: number;
-    /** Total elapsed time (ms) across all attempts, when the retry layer set it. */
-    readonly elapsedMs: number | undefined;
-    constructor(args: {
-        readonly method: string;
-        readonly host: string;
-        readonly path: string;
-        readonly cause: unknown;
-        /** Set by the retry layer when it gave up: appended to the message. */
-        readonly attempts?: number;
-        readonly elapsedMs?: number;
-    });
-}
-/**
- * Best-effort transport error code (`ECONNREFUSED`, `ENOTFOUND`, …): checks
- * `err.code`, then a bounded native `cause` chain (where undici and database
- * drivers hide it), then falls back to an `E…`-shaped token in the outer
- * message. Five inspected values matches the platform diagnostic boundary and
- * prevents malformed/cyclic cause graphs from becoming unbounded work.
- */
-export declare function extractErrorCode(err: unknown): string | undefined;
-/**
- * Redact a URL down to protocol + host + path: credentials become
- * `[redacted]@` and any query string becomes `?[redacted]` (presigned URLs
- * carry signatures there). Tolerates unparseable input.
- */
-export declare function redactUrl(url: string): string;

package/dist/_contracts/sdk-errors.js

@@ -1,313 +0,0 @@
-import { redactSecrets } from "./sdk-secrets.js";
-import { isAexApiErrorCode } from "./error-codes.js";
-export class AexError extends Error {
-    code;
-    details;
-    constructor(code, message, details, options) {
-        super(redactSecrets(message), options?.cause === undefined ? undefined : { cause: options.cause });
-        this.name = this.constructor.name;
-        this.code = code;
-        this.details = details === undefined ? undefined : redactSecrets(details);
-    }
-}
-export class SessionConfigValidationError extends AexError {
-    /**
-     * `code` and `details.field` are the stable machine contract. An optional
-     * cause is best-effort diagnostic context and must not be used for branching.
-     */
-    constructor(message, details, options) {
-        super("SESSION_CONFIG_INVALID", message, Object.freeze({ field: details.field }), options?.cause === undefined ? undefined : { cause: options.cause });
-    }
-}
-export class CredentialValidationError extends AexError {
-    constructor(message, details) {
-        super("CREDENTIAL_INVALID", message, details);
-    }
-}
-export class ProviderError extends AexError {
-    status;
-    constructor(message, options = {}) {
-        super("PROVIDER_ERROR", message, options.details);
-        this.status = options.status;
-    }
-}
-export class SessionStateError extends AexError {
-    /**
-     * HTTP status from a wrapped API rejection, when this state error is a
-     * bounded client-side interpretation of that rejection.
-     */
-    status;
-    /** Stable API code from a wrapped API rejection, when available. */
-    apiCode;
-    /** Request id from a wrapped API rejection, when available. */
-    requestId;
-    constructor(message, details, options) {
-        const detailRecord = details && typeof details === "object" && !Array.isArray(details)
-            ? details
-            : undefined;
-        const cause = options?.cause ?? detailRecord?.cause;
-        super("SESSION_STATE_ERROR", message, details, cause === undefined ? undefined : { cause });
-        const status = detailRecord?.httpStatus ?? detailRecord?.status;
-        const apiCode = detailRecord?.apiCode;
-        this.status = typeof status === "number" ? status : undefined;
-        this.apiCode = isAexApiErrorCode(apiCode) ? apiCode : undefined;
-        this.requestId = typeof detailRecord?.requestId === "string" ? detailRecord.requestId : undefined;
-    }
-}
-export class CleanupError extends AexError {
-    constructor(message, details) {
-        super("CLEANUP_ERROR", message, details);
-    }
-}
-/**
- * Thrown by SDK and CLI operations when the hosted aex API returns a non-2xx
- * response. Carries the HTTP status, the redacted parsed body, the server's
- * STABLE {@link AexApiErrorCode} (when present), and a `requestId` for support.
- * Construct via {@link import("./error-factory.js").apiErrorFromResponse} — the
- * single wire→exception mapping — which dispatches to a typed subclass
- * ({@link AexAuthError} / {@link AexIdempotencyConflictError} /
- * {@link AexNotFoundError} / {@link AexRateLimitError}).
- */
-export class AexApiError extends AexError {
-    status;
-    body;
-    /** The server's stable error code, when the body carried a known one. */
-    apiCode;
-    /** Request id (body `requestId` or a response header) for support correlation. */
-    requestId;
-    constructor(status, message, body, options) {
-        super("API_ERROR", message, body, options?.cause === undefined ? undefined : { cause: options.cause });
-        this.status = status;
-        this.body = redactSecrets(body);
-        this.apiCode = options?.apiCode;
-        this.requestId = options?.requestId;
-    }
-}
-/** 401/403 auth failure (token invalid/revoked/expired, forbidden, insufficient scope). */
-export class AexAuthError extends AexApiError {
-    /** The scope the endpoint required, when the server named it (insufficient_scope). */
-    requiredScope;
-    constructor(init) {
-        super(init.status, init.message, init.body, {
-            apiCode: init.apiCode,
-            requestId: init.requestId,
-            cause: init.cause
-        });
-        this.requiredScope = init.requiredScope;
-    }
-}
-/** 409 — the idempotency key was reused with a different request body. */
-export class AexIdempotencyConflictError extends AexApiError {
-    constructor(init) {
-        super(init.status, init.message, init.body, {
-            apiCode: init.apiCode,
-            requestId: init.requestId,
-            cause: init.cause
-        });
-    }
-}
-/** 404 — the requested resource was not found. */
-export class AexNotFoundError extends AexApiError {
-    constructor(init) {
-        super(init.status, init.message, init.body, {
-            apiCode: init.apiCode,
-            requestId: init.requestId,
-            cause: init.cause
-        });
-    }
-}
-/**
- * 429 / 503 / 529 — the workspace hit a rate/concurrency limit, or an upstream
- * provider said "slow down"; retry after a backoff.
- *
- * ONE class for both producers: the wire→exception factory
- * (`apiErrorFromResponse`) and the shared HTTP retry policy, so `isRateLimited`
- * recognises both with no split-brain. When the retry policy raises it, `message`
- * is a fixed non-leaky summary (never an echo of the raw body, which is still
- * available redacted on `.body`) and `attempts` / `source` / `providerFault`
- * carry the retry-layer detail.
- */
-export class AexRateLimitError extends AexApiError {
-    /** Suggested backoff (ms), when the server advertised one (Retry-After). */
-    retryAfterMs;
-    /** How many attempts were made before giving up; `1` for a single-shot rejection. */
-    attempts;
-    /** Whether the throttle came from the aex API plane or the upstream provider. */
-    source;
-    /** The upstream provider fault, when the throttle originated there. */
-    providerFault;
-    constructor(init) {
-        const attempts = init.attempts ?? 1;
-        const source = init.source ?? "api";
-        super(init.status, init.message ?? throttleSummary(init.status, attempts, source, init.retryAfterMs), init.body, {
-            apiCode: init.apiCode,
-            requestId: init.requestId,
-            cause: init.cause
-        });
-        this.retryAfterMs = init.retryAfterMs;
-        this.attempts = attempts;
-        this.source = source;
-        if (init.providerFault !== undefined)
-            this.providerFault = init.providerFault;
-    }
-}
-/** Fixed, non-leaky throttle summary — never echoes the server's error body. */
-function throttleSummary(status, attempts, source, retryAfterMs) {
-    const who = source === "provider" ? "upstream provider" : "aex API";
-    const label = status === 529 ? "overloaded" : "rate limit reached";
-    const attemptsLabel = `${attempts} attempt${attempts === 1 ? "" : "s"}`;
-    const wait = retryAfterMs !== undefined ? `; retry after ~${Math.ceil(retryAfterMs / 1000)}s` : "";
-    return `${who} ${label} (HTTP ${status}) after ${attemptsLabel}${wait}`;
-}
-/**
- * 410 (WS4) — the session's CONTENT (events, messages, files, manifest,
- * archive, event stream) was deleted after its retention window; only the
- * session RECORD (metadata) remains. Carries the `sessionId`, when the content
- * was `purgedAt`, and what triggered it (`deletedBy`). Every content read AND
- * `session…stream()` surface it via the one wire→exception factory. Narrow with
- * {@link isContentDeleted}; check `session.dataState === "metadata_only"` first
- * to avoid the round-trip.
- */
-export class ContentDeletedError extends AexApiError {
-    /** The session whose content was deleted. */
-    sessionId;
-    /** When the content was purged (ISO 8601), when the server reported it. */
-    purgedAt;
-    /** What triggered the purge: retention-window elapse or an explicit user delete. */
-    deletedBy;
-    constructor(init) {
-        super(init.status, init.message, init.body, {
-            apiCode: init.apiCode,
-            requestId: init.requestId,
-            cause: init.cause
-        });
-        this.sessionId = init.sessionId;
-        this.purgedAt = init.purgedAt;
-        this.deletedBy = init.deletedBy;
-    }
-}
-/** True for a 401/403 authentication/authorization failure. */
-export function isAuthError(err) {
-    return err instanceof AexAuthError;
-}
-/** True for a 403 whose cause is a missing scope (`insufficient_scope`). */
-export function isInsufficientScope(err) {
-    return err instanceof AexAuthError && err.apiCode === "insufficient_scope";
-}
-/** True for a 409 idempotency-key reuse conflict. */
-export function isIdempotencyConflict(err) {
-    return err instanceof AexIdempotencyConflictError;
-}
-/** True for a 404 not-found error. */
-export function isNotFound(err) {
-    return err instanceof AexNotFoundError;
-}
-/** True for a 429 rate/concurrency-limit error. */
-export function isRateLimited(err) {
-    return err instanceof AexRateLimitError;
-}
-/** True for a 410 whose session content was deleted after its retention window. */
-export function isContentDeleted(err) {
-    return err instanceof ContentDeletedError;
-}
-/**
- * Thrown when a BFF-bound request fails BEFORE any HTTP response exists — DNS
- * failure, connection refused, TLS error, socket reset. Wraps the raw fetch
- * rejection (whose undici form is a bare `TypeError: fetch failed` with the
- * useful code hidden on `cause.code`) into a message that names the request
- * and the transport failure, e.g.
- * `POST api.aex.dev/api/assets/presign failed: ECONNREFUSED (connect ECONNREFUSED 127.0.0.1:443)`.
- * The original rejection is preserved on `cause`.
- */
-export class AexNetworkError extends AexError {
-    method;
-    /** Request host — never carries credentials or the query string. */
-    host;
-    path;
-    /** Transport failure code (e.g. `ECONNREFUSED`), when detectable. */
-    causeCode;
-    /** Attempts made when a retry layer exhausted its budget; `1` otherwise. */
-    attempts;
-    /** Total elapsed time (ms) across all attempts, when the retry layer set it. */
-    elapsedMs;
-    constructor(args) {
-        const causeCode = extractErrorCode(args.cause);
-        super("NETWORK_ERROR", networkErrorMessage(args, causeCode), { method: args.method, host: args.host, path: args.path, ...(causeCode ? { code: causeCode } : {}) }, { cause: args.cause });
-        this.method = args.method;
-        this.host = args.host;
-        this.path = args.path;
-        this.causeCode = causeCode;
-        this.attempts = args.attempts ?? 1;
-        this.elapsedMs = args.elapsedMs;
-    }
-}
-function networkErrorMessage(args, causeCode) {
-    const target = args.host ? `${args.host}${args.path}` : "request";
-    const detail = shortCauseMessage(args.cause, causeCode);
-    const suffix = args.attempts === undefined
-        ? ""
-        : ` after ${args.attempts} attempt${args.attempts === 1 ? "" : "s"} over ${args.elapsedMs ?? 0}ms`;
-    let message = `${args.method} ${target} failed`;
-    if (causeCode)
-        message += `: ${causeCode}`;
-    if (detail)
-        message += causeCode ? ` (${detail})` : `: ${detail}`;
-    return message + suffix;
-}
-/** The innermost useful message off the rejection, URL-redacted and bounded. */
-function shortCauseMessage(cause, causeCode) {
-    const nested = cause instanceof Error && cause.cause instanceof Error ? cause.cause : cause;
-    const message = nested instanceof Error ? nested.message || nested.name : typeof nested === "string" ? nested : undefined;
-    if (!message || message === causeCode)
-        return undefined;
-    return message.replace(/https?:\/\/[^\s<>"'`]+/g, (raw) => redactUrl(raw)).slice(0, 200);
-}
-/**
- * Best-effort transport error code (`ECONNREFUSED`, `ENOTFOUND`, …): checks
- * `err.code`, then a bounded native `cause` chain (where undici and database
- * drivers hide it), then falls back to an `E…`-shaped token in the outer
- * message. Five inspected values matches the platform diagnostic boundary and
- * prevents malformed/cyclic cause graphs from becoming unbounded work.
- */
-export function extractErrorCode(err) {
-    let current = err;
-    for (let depth = 0; depth < 5 && current && typeof current === "object"; depth += 1) {
-        const code = stringProperty(current, "code");
-        if (code)
-            return code;
-        current = current.cause;
-    }
-    const match = /\bE[A-Z0-9_]+\b/.exec(errorMessageOf(err));
-    return match?.[0];
-}
-/**
- * Redact a URL down to protocol + host + path: credentials become
- * `[redacted]@` and any query string becomes `?[redacted]` (presigned URLs
- * carry signatures there). Tolerates unparseable input.
- */
-export function redactUrl(url) {
-    try {
-        const parsed = new URL(url);
-        const auth = parsed.username || parsed.password ? "[redacted]@" : "";
-        const query = parsed.search ? "?[redacted]" : "";
-        return `${parsed.protocol}//${auth}${parsed.host}${parsed.pathname}${query}`;
-    }
-    catch {
-        const withoutAuth = url.replace(/\/\/[^/?#\s]+@/, "//[redacted]@");
-        const queryStart = withoutAuth.indexOf("?");
-        return queryStart === -1 ? withoutAuth : `${withoutAuth.slice(0, queryStart)}?[redacted]`;
-    }
-}
-function errorMessageOf(err) {
-    if (err instanceof Error)
-        return err.message || err.name;
-    if (typeof err === "string")
-        return err;
-    return String(err);
-}
-function stringProperty(value, key) {
-    if (!value || typeof value !== "object")
-        return undefined;
-    const prop = value[key];
-    return typeof prop === "string" && prop.length > 0 ? prop : undefined;
-}