@apart-tech/intelligence-core 1.11.4 → 1.11.6

package/dist/index.d.ts

@@ -7,6 +7,12 @@ export { encryptAesGcm, decryptAesGcm, deriveKey, deriveKeyV2 } from "./lib/cryp
 export { getAgentKeySecret, getPiiKeySecret, getEmbeddingKeySecret } from "./lib/encryption-keys.js";
 export { verifyAuth0Jwt } from "./lib/jwt.js";
 export type { Auth0Config, Auth0JwtPayload } from "./lib/jwt.js";
+export type { Role, UserPrincipal, OrgAgentPrincipal, DelegatedAgentPrincipal, Principal, } from "./auth/principal.js";
+export { isUserPrincipal, isOrgAgentPrincipal, isDelegatedAgentPrincipal, } from "./auth/principal.js";
+export type { AppAction, AppSubject, AppAbility, AppRawRule } from "./auth/ability.js";
+export { buildAbility, intersect, UnsupportedIntersectionError, } from "./auth/ability.js";
+export type { DelegationTokenPayload, MintDelegationTokenArgs, DelegationTokenErrorReason, DelegationKeyLoadErrorReason, } from "./auth/delegation-jwt.js";
+export { DELEGATION_ALGORITHM, DELEGATION_ISSUER, DELEGATION_KEY_MIN_BYTES, DELEGATION_TTL_SECONDS, DelegationKeyLoadError, DelegationTokenError, loadDelegationKeyFromEnv, mintDelegationToken, peekIssuer, verifyDelegationToken, } from "./auth/delegation-jwt.js";
 export * from "./types/index.js";
 export { loadConfig } from "./config/index.js";
 export { NodeService } from "./services/node-service.js";
@@ -32,7 +38,11 @@ export type { OrgAgentTypeRecord, CreateOrgAgentTypeInput, UpdateOrgAgentTypeInp
 export { OrgMcpServerService } from "./services/org-mcp-server-service.js";
 export type { OrgMcpServerRecord, McpServerConfig, CreateOrgMcpServerInput, UpdateOrgMcpServerInput } from "./services/org-mcp-server-service.js";
 export { AgentRunService } from "./services/agent-run-service.js";
-export type { AgentRun } from "./services/agent-run-service.js";
+export type { AgentRun, AgentRunCreateInput } from "./services/agent-run-service.js";
+export { AuditEventService } from "./services/audit-event-service.js";
+export type { AuditAction, AuditResult, RecordAuditEventInput, } from "./services/audit-event-service.js";
+export { cancelOrphanedAgentRuns } from "./services/delegation-cleanup-service.js";
+export type { DelegationCleanupDb, CancelOrphanedAgentRunsResult, } from "./services/delegation-cleanup-service.js";
 export { AgentScheduleService } from "./services/agent-schedule-service.js";
 export type { AgentScheduleRecord, CreateAgentScheduleInput, UpdateAgentScheduleInput } from "./services/agent-schedule-service.js";
 export { CLI_REFERENCE } from "./services/agent-cli-reference.js";
@@ -43,6 +53,14 @@ export { MembershipService } from "./services/membership-service.js";
 export type { MembershipWithUser } from "./services/membership-service.js";
 export { InviteService } from "./services/invite-service.js";
 export type { Invite } from "./services/invite-service.js";
+export { UsageService } from "./services/usage-service.js";
+export type { UsageSnapshot, PlanLimits } from "./services/usage-service.js";
+export { TagService, TagValidationError, TagNotFoundError } from "./services/tag-service.js";
+export { ChunkService } from "./services/chunk-service.js";
+export { chunkText, estimateTokens, TARGET_CHUNK_TOKENS, MAX_CHUNK_TOKENS } from "./services/chunker.js";
+export type { ChunkInput } from "./services/chunker.js";
+export { backfillChunks } from "./services/backfill-chunks.js";
+export type { BackfillOptions, BackfillProgress } from "./services/backfill-chunks.js";
 export { createEmbeddingProvider, validateEmbeddingKey, OpenAIEmbeddingProvider, VoyageEmbeddingProvider, OllamaEmbeddingProvider } from "./providers/index.js";
 export type { CreateEmbeddingProviderOptions } from "./providers/index.js";
 export { BatchingEmbeddingProvider } from "./providers/batching.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACjE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvF,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGrG,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGjE,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACnH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AACjH,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AACvG,YAAY,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAChH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACjI,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAClJ,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACrP,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAG3D,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAChK,YAAY,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpG,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AACjE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACvF,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAGrG,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGjE,YAAY,EACV,IAAI,EACJ,aAAa,EACb,iBAAiB,EACjB,uBAAuB,EACvB,SAAS,GACV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EACL,YAAY,EACZ,SAAS,EACT,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAG3B,YAAY,EACV,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAGlC,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG/C,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACnH,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,YAAY,EAAE,oBAAoB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AACjH,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AACvG,YAAY,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAChH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,YAAY,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACjI,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAClJ,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACrF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,YAAY,EACV,WAAW,EACX,WAAW,EACX,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,YAAY,EACV,mBAAmB,EACnB,6BAA6B,GAC9B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,YAAY,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACrP,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAC5G,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,YAAY,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,YAAY,EAAE,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzG,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGvF,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAChK,YAAY,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpG,YAAY,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -7,6 +7,9 @@ export { encryptAesGcm, decryptAesGcm, deriveKey, deriveKeyV2 } from "./lib/cryp
 export { getAgentKeySecret, getPiiKeySecret, getEmbeddingKeySecret } from "./lib/encryption-keys.js";
 // JWT
 export { verifyAuth0Jwt } from "./lib/jwt.js";
+export { isUserPrincipal, isOrgAgentPrincipal, isDelegatedAgentPrincipal, } from "./auth/principal.js";
+export { buildAbility, intersect, UnsupportedIntersectionError, } from "./auth/ability.js";
+export { DELEGATION_ALGORITHM, DELEGATION_ISSUER, DELEGATION_KEY_MIN_BYTES, DELEGATION_TTL_SECONDS, DelegationKeyLoadError, DelegationTokenError, loadDelegationKeyFromEnv, mintDelegationToken, peekIssuer, verifyDelegationToken, } from "./auth/delegation-jwt.js";
 // Types
 export * from "./types/index.js";
 // Config
@@ -27,11 +30,18 @@ export { OrgAgentConfigService } from "./services/org-agent-config-service.js";
 export { OrgAgentTypeService } from "./services/org-agent-type-service.js";
 export { OrgMcpServerService } from "./services/org-mcp-server-service.js";
 export { AgentRunService } from "./services/agent-run-service.js";
+export { AuditEventService } from "./services/audit-event-service.js";
+export { cancelOrphanedAgentRuns } from "./services/delegation-cleanup-service.js";
 export { AgentScheduleService } from "./services/agent-schedule-service.js";
 export { CLI_REFERENCE } from "./services/agent-cli-reference.js";
 export { UserService } from "./services/user-service.js";
 export { MembershipService } from "./services/membership-service.js";
 export { InviteService } from "./services/invite-service.js";
+export { UsageService } from "./services/usage-service.js";
+export { TagService, TagValidationError, TagNotFoundError } from "./services/tag-service.js";
+export { ChunkService } from "./services/chunk-service.js";
+export { chunkText, estimateTokens, TARGET_CHUNK_TOKENS, MAX_CHUNK_TOKENS } from "./services/chunker.js";
+export { backfillChunks } from "./services/backfill-chunks.js";
 // Providers
 export { createEmbeddingProvider, validateEmbeddingKey, OpenAIEmbeddingProvider, VoyageEmbeddingProvider, OllamaEmbeddingProvider } from "./providers/index.js";
 export { BatchingEmbeddingProvider } from "./providers/batching.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,WAAW;AACX,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGvF,SAAS;AACT,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAErG,MAAM;AACN,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,WAAW;AACX,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAG3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAG7D,YAAY;AACZ,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEhK,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,WAAW;AACX,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGvF,SAAS;AACT,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAErG,MAAM;AACN,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAW9C,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,YAAY,EACZ,SAAS,EACT,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,WAAW;AACX,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAG3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAMtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAKnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzG,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAG/D,YAAY;AACZ,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEhK,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/lib/__tests__/jwt.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwt.test.d.ts.map

package/dist/lib/__tests__/jwt.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.test.d.ts","sourceRoot":"","sources":["../../../src/lib/__tests__/jwt.test.ts"],"names":[],"mappings":""}

package/dist/lib/__tests__/jwt.test.js

@@ -0,0 +1,97 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { JWKS_CACHE_MAX_AGE_MS, JWKS_COOLDOWN_MS, createAuth0JwksResolver, resetJwksCache, verifyAuth0Jwt, } from "../jwt.js";
+// A minimal JWKS response body. jose parses this on reload() but won't
+// fail just because the keys are not usable for real verification —
+// failure only happens when a JWT is actually verified against a key.
+const FAKE_JWKS_BODY = JSON.stringify({
+    keys: [
+        {
+            kty: "RSA",
+            kid: "test-key-1",
+            use: "sig",
+            alg: "RS256",
+            n: "xGP_acGn7xCn3OQ0qoBXwOyw5nSGY3SnlbSXr3QxBOQPfOSmM0wQ4TgKGhY0t5T3pNS6EHF3OwBf3jL5p8O5_yQ",
+            e: "AQAB",
+        },
+    ],
+});
+function fakeJwksFetch(counter) {
+    return async (_url, _init) => {
+        counter.calls += 1;
+        return new Response(FAKE_JWKS_BODY, {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        });
+    };
+}
+describe("JWKS bounded cache (finding M6)", () => {
+    afterEach(() => {
+        resetJwksCache();
+    });
+    it("publishes explicit cache bounds as source-visible constants", () => {
+        // The finding is that the JWKS cache has no visible invalidation.
+        // Closing it means the bounds live in our source, not in a library
+        // default that a future version bump could silently change.
+        expect(JWKS_CACHE_MAX_AGE_MS).toBe(5 * 60 * 1000);
+        expect(JWKS_COOLDOWN_MS).toBe(30 * 1000);
+    });
+    it("reload() on a fresh resolver triggers exactly one fetch", async () => {
+        const counter = { calls: 0 };
+        const resolver = createAuth0JwksResolver("example.auth0.com", {
+            cacheMaxAgeMs: 50,
+            cooldownMs: 0,
+            fetchImpl: fakeJwksFetch(counter),
+        });
+        await resolver.reload();
+        expect(counter.calls).toBe(1);
+        expect(resolver.fresh).toBe(true);
+    });
+    it("fresh becomes false after cacheMaxAge elapses", async () => {
+        const counter = { calls: 0 };
+        const resolver = createAuth0JwksResolver("example.auth0.com", {
+            cacheMaxAgeMs: 30,
+            cooldownMs: 0,
+            fetchImpl: fakeJwksFetch(counter),
+        });
+        await resolver.reload();
+        expect(resolver.fresh).toBe(true);
+        // Wait past cacheMaxAge. After this, jose's bounded-age check
+        // returns false, which is the signal that triggers automatic
+        // refetch on the next verification attempt.
+        await new Promise((r) => setTimeout(r, 60));
+        expect(resolver.fresh).toBe(false);
+    });
+    it("a second reload after cache expiry triggers a second fetch", async () => {
+        // The core M6 guarantee: a rotated/compromised signing key at
+        // Auth0 cannot stay trusted indefinitely. After cacheMaxAge
+        // elapses, jose re-fetches the JWKS — observable here via the
+        // mock fetch's call counter.
+        const counter = { calls: 0 };
+        const resolver = createAuth0JwksResolver("example.auth0.com", {
+            cacheMaxAgeMs: 20,
+            cooldownMs: 0,
+            fetchImpl: fakeJwksFetch(counter),
+        });
+        await resolver.reload();
+        expect(counter.calls).toBe(1);
+        await new Promise((r) => setTimeout(r, 40));
+        await resolver.reload();
+        expect(counter.calls).toBe(2);
+    });
+});
+describe("verifyAuth0Jwt", () => {
+    afterEach(() => {
+        resetJwksCache();
+    });
+    it("rejects a malformed token without touching the network", async () => {
+        // Sanity regression: verifyAuth0Jwt should fail fast on obviously
+        // invalid input. jose throws a parse error before any JWKS
+        // retrieval is attempted, so this is safe to run without
+        // mocking the network.
+        await expect(verifyAuth0Jwt("not-a-real-jwt", {
+            domain: "example.auth0.com",
+            audience: "https://api.example.com",
+        })).rejects.toThrow();
+    });
+});
+//# sourceMappingURL=jwt.test.js.map

package/dist/lib/__tests__/jwt.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/jwt.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,uEAAuE;AACvE,oEAAoE;AACpE,sEAAsE;AACtE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;IACpC,IAAI,EAAE;QACJ;YACE,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,YAAY;YACjB,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO;YACZ,CAAC,EAAE,yFAAyF;YAC5F,CAAC,EAAE,MAAM;SACV;KACF;CACF,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO,KAAK,EAAE,IAAkB,EAAE,KAAmB,EAAqB,EAAE;QAC1E,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE;YAClC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,SAAS,CAAC,GAAG,EAAE;QACb,cAAc,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,kEAAkE;QAClE,mEAAmE;QACnE,4DAA4D;QAC5D,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,mBAAmB,EAAE;YAC5D,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC;SAClC,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAExB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,mBAAmB,EAAE;YAC5D,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC;SAClC,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,8DAA8D;QAC9D,6DAA6D;QAC7D,4CAA4C;QAC5C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAE5C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,8DAA8D;QAC9D,4DAA4D;QAC5D,8DAA8D;QAC9D,6BAA6B;QAC7B,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,mBAAmB,EAAE;YAC5D,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC;SAClC,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE9B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAExB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,SAAS,CAAC,GAAG,EAAE;QACb,cAAc,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,kEAAkE;QAClE,2DAA2D;QAC3D,yDAAyD;QACzD,uBAAuB;QACvB,MAAM,MAAM,CACV,cAAc,CAAC,gBAAgB,EAAE;YAC/B,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,yBAAyB;SACpC,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/jwt.d.ts

@@ -1,3 +1,4 @@
+import { createRemoteJWKSet } from "jose";
 import type { JWTPayload } from "jose";
 export interface Auth0Config {
     domain: string;
@@ -6,8 +7,27 @@ export interface Auth0Config {
 export interface Auth0JwtPayload extends JWTPayload {
     sub: string;
     email?: string;
+    email_verified?: boolean;
     name?: string;
     org_id?: string;
 }
+export declare const JWKS_CACHE_MAX_AGE_MS: number;
+export declare const JWKS_COOLDOWN_MS: number;
+export type JwksResolver = ReturnType<typeof createRemoteJWKSet>;
+/**
+ * Build a remote JWKS resolver for an Auth0 domain with bounded caching.
+ * Exported for test injection; production callers use {@link getJWKS}.
+ */
+export declare function createAuth0JwksResolver(domain: string, options?: {
+    cacheMaxAgeMs?: number;
+    cooldownMs?: number;
+    fetchImpl?: (url: URL | string, init?: RequestInit) => Promise<Response>;
+}): JwksResolver;
+/**
+ * Invalidate the per-process JWKS cache for a given Auth0 domain.
+ * Intended for tests and for manual revocation flows. Production auth
+ * flows rely on the bounded cacheMaxAge above to rotate keys.
+ */
+export declare function resetJwksCache(domain?: string): void;
 export declare function verifyAuth0Jwt(token: string, config: Auth0Config): Promise<Auth0JwtPayload>;
 //# sourceMappingURL=jwt.d.ts.map

package/dist/lib/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEvC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAaD,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,eAAe,CAAC,CAc1B"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA0B,MAAM,MAAM,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEvC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAsBD,eAAO,MAAM,qBAAqB,QAAgB,CAAC;AACnD,eAAO,MAAM,gBAAgB,QAAY,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIjE;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1E,GACA,YAAY,CAcd;AAUD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAMpD;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,eAAe,CAAC,CAc1B"}

package/dist/lib/jwt.js

@@ -1,13 +1,66 @@
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
+// Bounded JWKS cache for Auth0 signing keys (closes finding M6).
+//
+// jose's createRemoteJWKSet has three relevant knobs: cooldownDuration
+// (minimum gap between HTTP refetches triggered by kid misses),
+// cacheMaxAge (maximum age before a refetch is mandatory regardless of
+// kid state), and reload() (manual invalidation). We configure the
+// first two explicitly so the security bounds are visible at the call
+// site instead of inherited from whatever jose's defaults happen to be
+// in the currently installed version.
+//
+// Exposure window for a compromised or rotated Auth0 signing key:
+//   - worst case ≤ JWKS_CACHE_MAX_AGE_MS (5 minutes) before jose
+//     force-refetches and drops the stale key from its internal cache.
+//   - best case: the next token Auth0 issues carries a kid not in
+//     cache, jose refetches immediately (subject to cooldown).
+//
+// We intentionally use a tighter cacheMaxAge than jose's 10-minute
+// default because Auth0 key rotations and key compromises are both
+// security-critical events where we'd rather hit jwks.json every few
+// minutes than trust a stale key for longer.
+export const JWKS_CACHE_MAX_AGE_MS = 5 * 60 * 1000;
+export const JWKS_COOLDOWN_MS = 30 * 1000;
 const jwksCache = new Map();
+/**
+ * Build a remote JWKS resolver for an Auth0 domain with bounded caching.
+ * Exported for test injection; production callers use {@link getJWKS}.
+ */
+export function createAuth0JwksResolver(domain, options) {
+    const url = new URL(`https://${domain}/.well-known/jwks.json`);
+    const createOpts = {
+        cacheMaxAge: options?.cacheMaxAgeMs ?? JWKS_CACHE_MAX_AGE_MS,
+        cooldownDuration: options?.cooldownMs ?? JWKS_COOLDOWN_MS,
+    };
+    if (options?.fetchImpl) {
+        // jose exposes a named `customFetch` symbol for fetch injection;
+        // tests pass their mock in this way. Production callers never
+        // need it — the default fetch is used.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        createOpts[customFetch] = options.fetchImpl;
+    }
+    return createRemoteJWKSet(url, createOpts);
+}
 function getJWKS(domain) {
     const key = domain;
     if (!jwksCache.has(key)) {
-        const url = new URL(`https://${domain}/.well-known/jwks.json`);
-        jwksCache.set(key, createRemoteJWKSet(url));
+        jwksCache.set(key, createAuth0JwksResolver(domain));
     }
     return jwksCache.get(key);
 }
+/**
+ * Invalidate the per-process JWKS cache for a given Auth0 domain.
+ * Intended for tests and for manual revocation flows. Production auth
+ * flows rely on the bounded cacheMaxAge above to rotate keys.
+ */
+export function resetJwksCache(domain) {
+    if (domain) {
+        jwksCache.delete(domain);
+    }
+    else {
+        jwksCache.clear();
+    }
+}
 export async function verifyAuth0Jwt(token, config) {
     const jwks = getJWKS(config.domain);
     const issuer = `https://${config.domain}/`;

package/dist/lib/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAerD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC;IACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,MAAM,wBAAwB,CAAC,CAAC;QAC/D,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,MAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC;IAE3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;KACP,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,OAA0B,CAAC;AACpC,CAAC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAgBlE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,uEAAuE;AACvE,mEAAmE;AACnE,sEAAsE;AACtE,uEAAuE;AACvE,sCAAsC;AACtC,EAAE;AACF,kEAAkE;AAClE,iEAAiE;AACjE,uEAAuE;AACvE,kEAAkE;AAClE,+DAA+D;AAC/D,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,qEAAqE;AACrE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAI1C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,OAIC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,MAAM,wBAAwB,CAAC,CAAC;IAC/D,MAAM,UAAU,GAA6C;QAC3D,WAAW,EAAE,OAAO,EAAE,aAAa,IAAI,qBAAqB;QAC5D,gBAAgB,EAAE,OAAO,EAAE,UAAU,IAAI,gBAAgB;KAC1D,CAAC;IACF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,iEAAiE;QACjE,8DAA8D;QAC9D,uCAAuC;QACvC,8DAA8D;QAC7D,UAAkB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACvD,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC;IACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,IAAI,MAAM,EAAE,CAAC;QACX,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,MAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC;IAE3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;KACP,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,OAA0B,CAAC;AACpC,CAAC"}

package/dist/services/__tests__/chunk-service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=chunk-service.test.d.ts.map

package/dist/services/__tests__/chunk-service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-service.test.d.ts","sourceRoot":"","sources":["../../../src/services/__tests__/chunk-service.test.ts"],"names":[],"mappings":""}

package/dist/services/__tests__/chunk-service.test.js

@@ -0,0 +1,111 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { ChunkService } from "../chunk-service.js";
+import { PiiDetectorService } from "../pii-detector-service.js";
+import { PiiEncryptionService } from "../pii-encryption-service.js";
+function createMockDb() {
+    const rawCalls = [];
+    return {
+        $executeRaw: vi.fn((...args) => {
+            rawCalls.push(args);
+            return Promise.resolve(1);
+        }),
+        $queryRaw: vi.fn().mockResolvedValue([]),
+        $queryRawUnsafe: vi.fn().mockResolvedValue([]),
+        _rawCalls: rawCalls,
+    };
+}
+function createMockEmbeddings() {
+    return {
+        lastBatchInput: null,
+        embed: vi.fn(async () => [0.1, 0.2, 0.3]),
+        embedBatch: vi.fn(async function (texts) {
+            this.lastBatchInput = texts;
+            return texts.map(() => [0.1, 0.2, 0.3]);
+        }),
+    };
+}
+describe("ChunkService", () => {
+    const detector = new PiiDetectorService();
+    const piiEncryption = new PiiEncryptionService(detector);
+    const tenantCtx = { organizationId: "org-1" };
+    let db;
+    let embeddings;
+    beforeEach(() => {
+        db = createMockDb();
+        embeddings = createMockEmbeddings();
+    });
+    describe("chunkAndEmbed", () => {
+        it("calls embedBatch with heading-prefixed texts", async () => {
+            const service = new ChunkService(db, embeddings, tenantCtx);
+            const content = "# Overview\n\nThis is a paragraph about the overview topic.";
+            await service.chunkAndEmbed("node-1", "Test Title", content);
+            expect(embeddings.embedBatch).toHaveBeenCalled();
+            const batchTexts = embeddings.embedBatch.mock.calls[0][0];
+            // At least one text should have heading prefix
+            expect(batchTexts.some((t) => t.includes("Overview:"))).toBe(true);
+        });
+        it("deletes existing chunks before inserting", async () => {
+            const service = new ChunkService(db, embeddings, tenantCtx);
+            await service.chunkAndEmbed("node-1", "Title", "Some content here.");
+            // $executeRaw should be called for DELETE
+            expect(db.$executeRaw).toHaveBeenCalled();
+            const deleteCall = db.$executeRaw.mock.calls.find((call) => {
+                const tpl = call[0];
+                return tpl.raw.join("").includes("DELETE FROM node_chunks");
+            });
+            expect(deleteCall).toBeDefined();
+        });
+        it("strips PII before chunking in encrypt mode", async () => {
+            const service = new ChunkService(db, embeddings, tenantCtx, piiEncryption, { mode: "encrypt", orgKey: Buffer.alloc(32) });
+            await service.chunkAndEmbed("node-1", "Contact", "Email john@example.com for info");
+            expect(embeddings.embedBatch).toHaveBeenCalled();
+            const batchTexts = embeddings.embedBatch.mock.calls[0][0];
+            // PII should be stripped
+            for (const text of batchTexts) {
+                expect(text).not.toContain("john@example.com");
+                expect(text).toContain("[EMAIL]");
+            }
+        });
+        it("sets embedding_pii_mode on chunks", async () => {
+            const service = new ChunkService(db, embeddings, tenantCtx, piiEncryption, { mode: "encrypt", orgKey: Buffer.alloc(32) });
+            await service.chunkAndEmbed("node-1", "Title", "Some content for testing.");
+            // $queryRawUnsafe should be called with INSERT containing pii mode
+            expect(db.$queryRawUnsafe).toHaveBeenCalled();
+            const insertCall = db.$queryRawUnsafe.mock.calls[0];
+            const sql = insertCall[0];
+            expect(sql).toContain("INSERT INTO node_chunks");
+            // One of the params should be the pii mode
+            expect(insertCall).toContain("encrypt");
+        });
+        it("does nothing for empty content", async () => {
+            const service = new ChunkService(db, embeddings, tenantCtx);
+            await service.chunkAndEmbed("node-1", "", "");
+            expect(embeddings.embedBatch).not.toHaveBeenCalled();
+            expect(db.$queryRawUnsafe).not.toHaveBeenCalled();
+        });
+    });
+    describe("deleteByNodeId", () => {
+        it("executes DELETE via $executeRaw", async () => {
+            const service = new ChunkService(db, embeddings, tenantCtx);
+            await service.deleteByNodeId("node-1");
+            expect(db.$executeRaw).toHaveBeenCalled();
+            const call = db.$executeRaw.mock.calls[0];
+            const tpl = call[0];
+            const sql = tpl.raw.join("");
+            expect(sql).toContain("DELETE FROM node_chunks");
+        });
+    });
+    describe("getByNodeId", () => {
+        it("queries with tenant filter and orders by chunk_index", async () => {
+            const service = new ChunkService(db, embeddings, tenantCtx);
+            await service.getByNodeId("node-1");
+            expect(db.$queryRaw).toHaveBeenCalled();
+            const call = db.$queryRaw.mock.calls[0];
+            const tpl = call[0];
+            const sql = tpl.raw.join("");
+            expect(sql).toContain("node_chunks");
+            expect(sql).toContain("ORDER BY chunk_index ASC");
+        });
+    });
+});
+//# sourceMappingURL=chunk-service.test.js.map

package/dist/services/__tests__/chunk-service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-service.test.js","sourceRoot":"","sources":["../../../src/services/__tests__/chunk-service.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAIpE,SAAS,YAAY;IACnB,MAAM,QAAQ,GAAgB,EAAE,CAAC;IACjC,OAAO;QACL,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAe,EAAE,EAAE;YACxC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC;QACF,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxC,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC9C,SAAS,EAAE,QAAQ;KACoC,CAAC;AAC5D,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO;QACL,cAAc,EAAE,IAAI;QACpB,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,WAAsD,KAAe;YAC1F,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;YAC5B,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1C,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,MAAM,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;IAE9C,IAAI,EAAmC,CAAC;IACxC,IAAI,UAAmD,CAAC;IAExD,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,GAAG,YAAY,EAAE,CAAC;QACpB,UAAU,GAAG,oBAAoB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC5D,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,6DAA6D,CAAC;YAC9E,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAE7D,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACjD,MAAM,UAAU,GAAI,UAAU,CAAC,UAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAa,CAAC;YACpG,+CAA+C;YAC/C,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAC5D,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAErE,0CAA0C;YAC1C,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAI,EAAE,CAAC,WAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBACvF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAA+B,CAAC;gBAClD,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,OAAO,GAAG,IAAI,YAAY,CAC9B,EAAE,EAAE,UAAU,EAAE,SAAS,EACzB,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAC7D,CAAC;YAEF,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,iCAAiC,CAAC,CAAC;YAEpF,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACjD,MAAM,UAAU,GAAI,UAAU,CAAC,UAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAa,CAAC;YACpG,yBAAyB;YACzB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;YACjD,MAAM,OAAO,GAAG,IAAI,YAAY,CAC9B,EAAE,EAAE,UAAU,EAAE,SAAS,EACzB,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAC7D,CAAC;YAEF,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;YAE5E,mEAAmE;YACnE,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAI,EAAE,CAAC,eAA4C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAW,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;YACjD,2CAA2C;YAC3C,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAC5D,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAE9C,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACrD,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAC5D,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAEvC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAI,EAAE,CAAC,WAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAA+B,CAAC;YAClD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YAC5D,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAEpC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACxC,MAAM,IAAI,GAAI,EAAE,CAAC,SAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACtE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAA+B,CAAC;YAClD,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/__tests__/chunker.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=chunker.test.d.ts.map

package/dist/services/__tests__/chunker.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunker.test.d.ts","sourceRoot":"","sources":["../../../src/services/__tests__/chunker.test.ts"],"names":[],"mappings":""}

package/dist/services/__tests__/chunker.test.js

@@ -0,0 +1,113 @@
+import { describe, it, expect } from "vitest";
+import { chunkText, estimateTokens, MAX_CHUNK_TOKENS, } from "../chunker.js";
+describe("estimateTokens", () => {
+    it("estimates ~4 chars per token", () => {
+        expect(estimateTokens("abcd")).toBe(1);
+        expect(estimateTokens("abcdefgh")).toBe(2);
+        expect(estimateTokens("a")).toBe(1); // ceil(1/4) = 1
+    });
+});
+describe("chunkText", () => {
+    it("returns empty array for empty content", () => {
+        expect(chunkText("")).toEqual([]);
+        expect(chunkText("   ")).toEqual([]);
+    });
+    it("returns single chunk for short text", () => {
+        const text = "This is a short paragraph.";
+        const chunks = chunkText(text);
+        expect(chunks).toHaveLength(1);
+        expect(chunks[0].content).toBe(text);
+        expect(chunks[0].chunkIndex).toBe(0);
+        expect(chunks[0].overlapPrev).toBe(0);
+        expect(chunks[0].tokenCount).toBeGreaterThan(0);
+    });
+    it("splits long text at paragraph boundaries", () => {
+        // Create text with multiple paragraphs that exceed TARGET_CHUNK_TOKENS
+        const para = "Lorem ipsum dolor sit amet, consectetur adipiscing elit. ".repeat(20);
+        const text = `${para}\n\n${para}\n\n${para}`;
+        const chunks = chunkText(text);
+        expect(chunks.length).toBeGreaterThan(1);
+        // Each chunk should be within bounds
+        for (const chunk of chunks) {
+            expect(chunk.tokenCount).toBeLessThanOrEqual(MAX_CHUNK_TOKENS);
+        }
+    });
+    it("carries heading context into chunks", () => {
+        const text = `# Introduction
+
+First paragraph under intro.
+
+# Details
+
+Detail paragraph here with some content.`;
+        const chunks = chunkText(text);
+        expect(chunks.length).toBeGreaterThanOrEqual(2);
+        const introChunk = chunks.find((c) => c.content.includes("First paragraph"));
+        expect(introChunk?.headingContext).toBe("Introduction");
+        const detailChunk = chunks.find((c) => c.content.includes("Detail paragraph"));
+        expect(detailChunk?.headingContext).toBe("Details");
+    });
+    it("does not split code blocks", () => {
+        const codeBlock = "```javascript\n" + "const x = 1;\n".repeat(50) + "```";
+        const text = `Some intro text.\n\n${codeBlock}\n\nSome outro text.`;
+        const chunks = chunkText(text);
+        // Find the chunk containing the code block
+        const codeChunk = chunks.find((c) => c.content.includes("```javascript"));
+        expect(codeChunk).toBeDefined();
+        expect(codeChunk.content).toContain("const x = 1;");
+        expect(codeChunk.content).toContain("```");
+    });
+    it("has overlap = 0 at structural boundaries", () => {
+        // Multiple short paragraphs that fit in separate chunks due to accumulation
+        const para = "Short paragraph. ".repeat(40); // ~160 tokens each
+        const text = `${para}\n\n${para}\n\n${para}`;
+        const chunks = chunkText(text);
+        // Structural boundaries (paragraph breaks) should have overlap = 0
+        for (const chunk of chunks) {
+            if (chunk.chunkIndex === 0 || chunk.content.startsWith("Short paragraph")) {
+                expect(chunk.overlapPrev).toBe(0);
+            }
+        }
+    });
+    it("produces multiple chunks for forced mid-paragraph splits of long text", () => {
+        // Single huge paragraph that forces mid-paragraph splitting
+        const longPara = "This is a sentence that keeps going. ".repeat(100);
+        const chunks = chunkText(longPara);
+        expect(chunks.length).toBeGreaterThan(1);
+        // Each chunk should respect the max token limit
+        for (const chunk of chunks) {
+            expect(chunk.tokenCount).toBeLessThanOrEqual(MAX_CHUNK_TOKENS);
+        }
+    });
+    it("produces correct offsets", () => {
+        const text = "First paragraph.\n\nSecond paragraph.\n\nThird paragraph.";
+        const chunks = chunkText(text);
+        // All chunks should have valid offset ranges
+        for (const chunk of chunks) {
+            expect(chunk.startOffset).toBeGreaterThanOrEqual(0);
+            expect(chunk.endOffset).toBeGreaterThan(chunk.startOffset);
+        }
+    });
+    it("assigns sequential chunk indices", () => {
+        const para = "Content paragraph with some text. ".repeat(30);
+        const text = `# Section 1\n\n${para}\n\n# Section 2\n\n${para}`;
+        const chunks = chunkText(text);
+        for (let i = 0; i < chunks.length; i++) {
+            expect(chunks[i].chunkIndex).toBe(i);
+        }
+    });
+    it("handles text with no headings", () => {
+        const text = "Just plain text without any markdown headings.\n\nAnother paragraph here.";
+        const chunks = chunkText(text);
+        expect(chunks.length).toBeGreaterThanOrEqual(1);
+        expect(chunks[0].headingContext).toBeNull();
+    });
+    it("handles text with only headings", () => {
+        const text = "# Heading 1\n\n## Heading 2";
+        const chunks = chunkText(text);
+        // Headings are parsed as structure, remaining text is minimal
+        // The exact count depends on how headings are parsed, but should be small
+        expect(chunks.length).toBeLessThanOrEqual(1);
+    });
+});
+//# sourceMappingURL=chunker.test.js.map

package/dist/services/__tests__/chunker.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunker.test.js","sourceRoot":"","sources":["../../../src/services/__tests__/chunker.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,SAAS,EACT,cAAc,EAEd,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,4BAA4B,CAAC;QAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,uEAAuE;QACvE,MAAM,IAAI,GAAG,2DAA2D,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,IAAI,OAAO,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACzC,qCAAqC;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG;;;;;;yCAMwB,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAEhD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAExD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC/E,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,SAAS,GAAG,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;QAC1E,MAAM,IAAI,GAAG,uBAAuB,SAAS,sBAAsB,CAAC;QACpE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAE/B,2CAA2C;QAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,CAAC,SAAU,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACrD,MAAM,CAAC,SAAU,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,4EAA4E;QAC5E,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB;QAChE,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,IAAI,OAAO,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAE/B,mEAAmE;QACnE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAC1E,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,uCAAuC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACzC,gDAAgD;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,2DAA2D,CAAC;QACzE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAE/B,6CAA6C;QAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,IAAI,GAAG,oCAAoC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,kBAAkB,IAAI,sBAAsB,IAAI,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,IAAI,GAAG,2EAA2E,CAAC;QACzF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,IAAI,GAAG,6BAA6B,CAAC;QAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,8DAA8D;QAC9D,0EAA0E;QAC1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/__tests__/delegation-cleanup-service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=delegation-cleanup-service.test.d.ts.map

package/dist/services/__tests__/delegation-cleanup-service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-cleanup-service.test.d.ts","sourceRoot":"","sources":["../../../src/services/__tests__/delegation-cleanup-service.test.ts"],"names":[],"mappings":""}