@arnilo/prism-supervisor 0.0.5

package/dist/a2a-server.js

@@ -0,0 +1,230 @@
+import { createA2AAgentCard } from "./a2a-card.js";
+import { A2AError } from "./errors.js";
+const JSON_HEADERS = { "content-type": "application/a2a+json; charset=utf-8" };
+const SSE_HEADERS = { "content-type": "text/event-stream; charset=utf-8", "cache-control": "no-cache, no-transform" };
+const DEFAULTS = { maxRequestBytes: 64 * 1024, maxResponseBytes: 1024 * 1024, maxEventBytes: 64 * 1024, maxStreamBytes: 10 * 1024 * 1024, maxStreamEvents: 10_000, maxConcurrentRequests: 16, timeoutMs: 120_000, maxCardBytes: 64 * 1024 };
+const HARD = { maxRequestBytes: 1024 * 1024, maxResponseBytes: 8 * 1024 * 1024, maxEventBytes: 1024 * 1024, maxStreamBytes: 64 * 1024 * 1024, maxStreamEvents: 100_000, maxConcurrentRequests: 256, timeoutMs: 30 * 60_000, maxCardBytes: 1024 * 1024 };
+export function createA2AHandler(options) {
+    const limits = resolveA2ALimits(options.limits);
+    const card = createA2AAgentCard(options.card);
+    const endpointPath = options.endpointPath ?? new URL(card.supportedInterfaces[0].url).pathname;
+    if (!endpointPath.startsWith("/"))
+        throw new A2AError("endpointPath must be absolute", 400, "ERR_PRISM_A2A_CONFIG");
+    const cardJson = JSON.stringify(card);
+    if (new TextEncoder().encode(cardJson).byteLength > limits.maxCardBytes)
+        throw new A2AError("Agent card exceeds max bytes", 400, "ERR_PRISM_A2A_CARD");
+    let active = 0;
+    let sequence = 0;
+    return async (request) => {
+        let acquired = false;
+        let transferred = false;
+        try {
+            const path = new URL(request.url).pathname;
+            if (request.method === "GET" && path === "/.well-known/agent-card.json")
+                return new Response(cardJson, { status: 200, headers: JSON_HEADERS });
+            if (request.method !== "POST" || path !== endpointPath)
+                return errorResponse(404, "Not found", null);
+            if (active >= limits.maxConcurrentRequests)
+                return errorResponse(429, "Too many requests", null);
+            active += 1;
+            acquired = true;
+            const owned = ownedSignal(request.signal, limits.timeoutMs);
+            try {
+                const contentType = request.headers.get("content-type")?.split(";", 1)[0]?.trim();
+                if (contentType !== "application/json" && contentType !== "application/a2a+json")
+                    return errorResponse(415, "Unsupported media type", null);
+                const body = await readJson(request, limits.maxRequestBytes, owned.signal);
+                const rpc = parseRpc(body);
+                const authorized = await abortable(Promise.resolve(options.authorize({ request, method: rpc.method, signal: owned.signal })), owned.signal);
+                if (!authorized)
+                    return errorResponse(403, "Forbidden", rpc.id);
+                if (rpc.method === "GetExtendedAgentCard")
+                    return boundedJson({ jsonrpc: "2.0", id: rpc.id, result: card }, limits.maxResponseBytes, options);
+                if (rpc.method !== "SendMessage" && rpc.method !== "SendStreamingMessage")
+                    return boundedJson({ jsonrpc: "2.0", id: rpc.id, error: { code: -32601, message: "Method not found" } }, limits.maxResponseBytes, options);
+                const message = parseMessage(rpc.params?.message, limits.maxRequestBytes);
+                const input = message.parts.map((part) => part.text).join("\n");
+                sequence += 1;
+                const taskId = `task-${crypto.randomUUID()}`;
+                const contextId = message.contextId ?? `context-${sequence}-${crypto.randomUUID()}`;
+                const session = await abortable(Promise.resolve(options.exposure.sessionFactory(authorized)), owned.signal);
+                if (rpc.method === "SendMessage") {
+                    const result = await abortable(session.run(input, { ownership: authorized.ownership, metadata: authorized.metadata, signal: owned.signal, redactor: options.redactor }), owned.signal);
+                    return boundedJson({ jsonrpc: "2.0", id: rpc.id, result: { task: toTask(taskId, contextId, result, options) } }, limits.maxResponseBytes, options);
+                }
+                if (rpc.method === "SendStreamingMessage") {
+                    transferred = true;
+                    const stream = taskStream(rpc.id, taskId, contextId, () => session.run(input, { ownership: authorized.ownership, metadata: authorized.metadata, signal: owned.signal, redactor: options.redactor }), owned, limits, options, () => { active -= 1; });
+                    return new Response(stream, { status: 200, headers: SSE_HEADERS });
+                }
+                throw new A2AError("Method not found", 400, "ERR_PRISM_A2A_METHOD");
+            }
+            finally {
+                if (!transferred)
+                    owned.dispose();
+            }
+        }
+        catch (error) {
+            const status = error instanceof A2AError ? error.status : error instanceof DOMException && error.name === "AbortError" ? 408 : 500;
+            return errorResponse(status, safeError(error, options), null);
+        }
+        finally {
+            if (acquired && !transferred)
+                active -= 1;
+        }
+    };
+}
+function taskStream(id, taskId, contextId, run, owned, limits, options, release) {
+    const iterator = (async function* () {
+        yield { jsonrpc: "2.0", id, result: { task: { id: taskId, contextId, status: { state: "TASK_STATE_WORKING", timestamp: new Date().toISOString() } } } };
+        try {
+            const result = await run();
+            yield { jsonrpc: "2.0", id, result: { task: toTask(taskId, contextId, result, options) } };
+        }
+        catch (error) {
+            yield { jsonrpc: "2.0", id, error: { code: -32000, message: safeError(error, options) } };
+        }
+    })()[Symbol.asyncIterator]();
+    let events = 0;
+    let bytes = 0;
+    let released = false;
+    const finish = () => { if (!released) {
+        released = true;
+        owned.dispose();
+        release();
+    } };
+    return new ReadableStream({
+        async pull(controller) {
+            try {
+                const next = await iterator.next();
+                if (next.done) {
+                    finish();
+                    controller.close();
+                    return;
+                }
+                const payload = options.redactor?.redact(next.value) ?? next.value;
+                const chunk = new TextEncoder().encode(`data: ${JSON.stringify(payload)}\n\n`);
+                events += 1;
+                bytes += chunk.byteLength;
+                if (chunk.byteLength > limits.maxEventBytes || events > limits.maxStreamEvents || bytes > limits.maxStreamBytes)
+                    throw new A2AError("A2A stream limit exceeded", 507, "ERR_PRISM_A2A_STREAM_LIMIT");
+                controller.enqueue(chunk);
+            }
+            catch (error) {
+                finish();
+                controller.error(error);
+            }
+        },
+        cancel(reason) { owned.abort(reason); finish(); void iterator.return?.(); },
+    });
+}
+function toTask(taskId, contextId, result, options) {
+    const state = result.status === "succeeded" ? "TASK_STATE_COMPLETED" : result.status === "aborted" ? "TASK_STATE_CANCELED" : "TASK_STATE_FAILED";
+    const text = options.redactor?.redact(result.text) ?? result.text;
+    return Object.freeze({
+        id: taskId,
+        contextId,
+        status: { state, timestamp: new Date().toISOString() },
+        artifacts: text ? [{ artifactId: `${taskId}-result`, parts: [{ text }] }] : undefined,
+    });
+}
+function parseRpc(value) {
+    if (!isRecord(value) || value.jsonrpc !== "2.0" || !(typeof value.id === "string" || typeof value.id === "number" || value.id === null) || typeof value.method !== "string")
+        throw new A2AError("Invalid JSON-RPC request", 400, "ERR_PRISM_A2A_REQUEST");
+    if (value.params !== undefined && !isRecord(value.params))
+        throw new A2AError("Invalid JSON-RPC params", 400, "ERR_PRISM_A2A_REQUEST");
+    return { jsonrpc: "2.0", id: value.id, method: value.method, params: value.params };
+}
+function parseMessage(value, maxBytes) {
+    if (!isRecord(value) || (value.role !== "user" && value.role !== "ROLE_USER") || typeof value.messageId !== "string" || !value.messageId || !Array.isArray(value.parts) || value.parts.length < 1 || value.parts.length > 32)
+        throw new A2AError("Invalid A2A message", 400, "ERR_PRISM_A2A_MESSAGE");
+    const parts = value.parts.map((part) => {
+        if (!isRecord(part) || typeof part.text !== "string" || Object.keys(part).some((key) => key !== "text" && key !== "metadata"))
+            throw new A2AError("Only text A2A parts are supported", 400, "ERR_PRISM_A2A_MESSAGE");
+        return { text: part.text, metadata: isRecord(part.metadata) ? part.metadata : undefined };
+    });
+    const message = { role: value.role, messageId: value.messageId, parts, contextId: typeof value.contextId === "string" ? value.contextId : undefined };
+    if (encode(message).byteLength > maxBytes)
+        throw new A2AError("A2A message exceeds max bytes", 413, "ERR_PRISM_A2A_MESSAGE_LIMIT");
+    return message;
+}
+function resolveA2ALimits(input = {}) {
+    const output = {};
+    for (const key of Object.keys(DEFAULTS)) {
+        const value = input[key] ?? DEFAULTS[key];
+        if (!Number.isSafeInteger(value) || value < 1 || value > HARD[key])
+            throw new A2AError(`${key} is invalid`, 400, "ERR_PRISM_A2A_CONFIG");
+        output[key] = value;
+    }
+    return output;
+}
+async function readJson(request, maxBytes, signal) {
+    if (!request.body)
+        throw new A2AError("Request body is required", 400, "ERR_PRISM_A2A_REQUEST");
+    const reader = request.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            signal.throwIfAborted();
+            const next = await reader.read();
+            if (next.done)
+                break;
+            size += next.value.byteLength;
+            if (size > maxBytes)
+                throw new A2AError("Request exceeds max bytes", 413, "ERR_PRISM_A2A_REQUEST_LIMIT");
+            chunks.push(next.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch {
+        throw new A2AError("Invalid JSON", 400, "ERR_PRISM_A2A_REQUEST");
+    }
+}
+function boundedJson(value, maxBytes, options) {
+    const body = JSON.stringify(options.redactor?.redact(value) ?? value);
+    if (new TextEncoder().encode(body).byteLength > maxBytes)
+        throw new A2AError("Response exceeds max bytes", 507, "ERR_PRISM_A2A_RESPONSE_LIMIT");
+    return new Response(body, { status: 200, headers: JSON_HEADERS });
+}
+function errorResponse(status, message, id) {
+    const body = { jsonrpc: "2.0", id, error: { code: status === 404 ? -32601 : -32000, message } };
+    return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+function ownedSignal(parent, timeoutMs) {
+    const controller = new AbortController();
+    const abort = () => controller.abort(parent.reason);
+    if (parent.aborted)
+        abort();
+    else
+        parent.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(() => controller.abort(new DOMException("A2A request timed out", "AbortError")), timeoutMs);
+    return { signal: controller.signal, abort: (reason) => controller.abort(reason), dispose: () => { clearTimeout(timer); parent.removeEventListener("abort", abort); } };
+}
+function abortable(promise, signal) {
+    if (signal.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const abort = () => reject(signal.reason);
+        signal.addEventListener("abort", abort, { once: true });
+        promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+    });
+}
+function encode(value) { return new TextEncoder().encode(JSON.stringify(value)); }
+function isRecord(value) { return !!value && typeof value === "object" && !Array.isArray(value); }
+function safeError(error, options) {
+    const message = (error instanceof Error ? error.message : "A2A request failed").slice(0, 1024);
+    return options.redactor?.redact(message) ?? message;
+}
+//# sourceMappingURL=a2a-server.js.map

package/dist/a2a-types.d.ts

@@ -0,0 +1,135 @@
+import type { AgentRunResult, AgentSession, OwnershipScope, SecretRedactor } from "@arnilo/prism";
+export declare const A2A_PROTOCOL_VERSION = "1.0";
+export interface A2AAgentInterface {
+    readonly url: string;
+    readonly protocolBinding: "JSONRPC";
+    readonly protocolVersion: "1.0";
+}
+export interface A2AAgentSkill {
+    readonly id: string;
+    readonly name: string;
+    readonly description: string;
+    readonly tags: readonly string[];
+    readonly examples?: readonly string[];
+    readonly inputModes?: readonly string[];
+    readonly outputModes?: readonly string[];
+}
+export interface A2AAgentCardSignature {
+    readonly protected: string;
+    readonly signature: string;
+    readonly header?: Readonly<Record<string, unknown>>;
+}
+export interface A2AAgentCard {
+    readonly name: string;
+    readonly description: string;
+    readonly supportedInterfaces: readonly A2AAgentInterface[];
+    readonly version: string;
+    readonly capabilities: {
+        readonly streaming: boolean;
+        readonly pushNotifications?: boolean;
+        readonly extendedAgentCard?: boolean;
+    };
+    readonly defaultInputModes: readonly string[];
+    readonly defaultOutputModes: readonly string[];
+    readonly skills: readonly A2AAgentSkill[];
+    readonly securitySchemes?: Readonly<Record<string, unknown>>;
+    readonly security?: readonly Readonly<Record<string, readonly string[]>>[];
+    readonly signatures?: readonly A2AAgentCardSignature[];
+}
+export interface A2ATextPart {
+    readonly text: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface A2AMessage {
+    readonly role: "user" | "agent" | "ROLE_USER" | "ROLE_AGENT";
+    readonly parts: readonly A2ATextPart[];
+    readonly messageId: string;
+    readonly contextId?: string;
+    readonly taskId?: string;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export type A2ATaskState = "TASK_STATE_SUBMITTED" | "TASK_STATE_WORKING" | "TASK_STATE_COMPLETED" | "TASK_STATE_FAILED" | "TASK_STATE_CANCELED";
+export interface A2ATask {
+    readonly id: string;
+    readonly contextId: string;
+    readonly status: {
+        readonly state: A2ATaskState;
+        readonly timestamp: string;
+        readonly message?: A2AMessage;
+    };
+    readonly artifacts?: readonly {
+        readonly artifactId: string;
+        readonly parts: readonly A2ATextPart[];
+    }[];
+}
+export type A2ARequestId = string | number | null;
+export interface A2AJsonRpcRequest {
+    readonly jsonrpc: "2.0";
+    readonly id: A2ARequestId;
+    readonly method: "SendMessage" | "SendStreamingMessage" | "GetExtendedAgentCard" | string;
+    readonly params?: Readonly<Record<string, unknown>>;
+}
+export interface A2AJsonRpcResponse {
+    readonly jsonrpc: "2.0";
+    readonly id: A2ARequestId;
+    readonly result?: unknown;
+    readonly error?: {
+        readonly code: number;
+        readonly message: string;
+        readonly data?: unknown;
+    };
+}
+export interface A2AAuthorization {
+    readonly ownership: OwnershipScope;
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export type A2AAuthorizer = (input: {
+    readonly request: Request;
+    readonly method: string;
+    readonly signal: AbortSignal;
+}) => false | A2AAuthorization | Promise<false | A2AAuthorization>;
+export interface A2AAgentExposure {
+    readonly sessionFactory: (authorization: A2AAuthorization) => AgentSession | Promise<AgentSession>;
+}
+export interface A2ALimits {
+    readonly maxRequestBytes?: number;
+    readonly maxResponseBytes?: number;
+    readonly maxEventBytes?: number;
+    readonly maxStreamBytes?: number;
+    readonly maxStreamEvents?: number;
+    readonly maxConcurrentRequests?: number;
+    readonly timeoutMs?: number;
+    readonly maxCardBytes?: number;
+}
+export interface CreateA2AHandlerOptions {
+    readonly card: A2AAgentCard;
+    readonly exposure: A2AAgentExposure;
+    readonly authorize: A2AAuthorizer;
+    readonly endpointPath?: string;
+    readonly redactor?: SecretRedactor;
+    readonly limits?: A2ALimits;
+}
+export interface A2AClientOptions {
+    readonly endpoint: string;
+    readonly allowedOrigins: readonly string[];
+    readonly fetch?: typeof globalThis.fetch;
+    readonly authorize?: (input: {
+        readonly endpoint: string;
+        readonly signal: AbortSignal;
+    }) => HeadersInit | Promise<HeadersInit>;
+    readonly verifyCard?: (card: A2AAgentCard) => void | Promise<void>;
+    readonly cardUrl?: string;
+    readonly limits?: A2ALimits;
+    readonly redactor?: SecretRedactor;
+}
+export interface A2AClient {
+    getCard(options?: {
+        readonly signal?: AbortSignal;
+    }): Promise<A2AAgentCard>;
+    send(input: string, options?: {
+        readonly signal?: AbortSignal;
+    }): Promise<AgentRunResult>;
+    stream(input: string, options?: {
+        readonly signal?: AbortSignal;
+    }): AsyncIterable<string>;
+}

package/dist/a2a-types.js

@@ -0,0 +1,2 @@
+export const A2A_PROTOCOL_VERSION = "1.0";
+//# sourceMappingURL=a2a-types.js.map

package/dist/errors.d.ts

@@ -0,0 +1,17 @@
+export declare class SupervisorError extends Error {
+    readonly code: string;
+    constructor(message: string, code?: string);
+}
+export declare class SupervisorValidationError extends SupervisorError {
+    constructor(message: string);
+}
+export declare class SupervisorLimitError extends SupervisorError {
+    constructor(message: string);
+}
+export declare class SupervisorDeniedError extends SupervisorError {
+    constructor(message?: string);
+}
+export declare class A2AError extends SupervisorError {
+    readonly status: number;
+    constructor(message: string, status?: number, code?: string);
+}

package/dist/errors.js

@@ -0,0 +1,26 @@
+export class SupervisorError extends Error {
+    code;
+    constructor(message, code = "ERR_PRISM_SUPERVISOR") {
+        super(message);
+        this.code = code;
+        this.name = "SupervisorError";
+    }
+}
+export class SupervisorValidationError extends SupervisorError {
+    constructor(message) { super(message, "ERR_PRISM_SUPERVISOR_VALIDATION"); this.name = "SupervisorValidationError"; }
+}
+export class SupervisorLimitError extends SupervisorError {
+    constructor(message) { super(message, "ERR_PRISM_SUPERVISOR_LIMIT"); this.name = "SupervisorLimitError"; }
+}
+export class SupervisorDeniedError extends SupervisorError {
+    constructor(message = "Delegation denied") { super(message, "ERR_PRISM_SUPERVISOR_DENIED"); this.name = "SupervisorDeniedError"; }
+}
+export class A2AError extends SupervisorError {
+    status;
+    constructor(message, status = 400, code = "ERR_PRISM_A2A") {
+        super(message, code);
+        this.status = status;
+        this.name = "A2AError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export * from "./a2a-card.js";
+export * from "./a2a-client.js";
+export * from "./a2a-server.js";
+export type * from "./a2a-types.js";
+export * from "./errors.js";
+export * from "./limits.js";
+export * from "./supervisor.js";
+export type * from "./types.js";
+export declare const packageName = "@arnilo/prism-supervisor";

package/dist/index.js

@@ -0,0 +1,8 @@
+export * from "./a2a-card.js";
+export * from "./a2a-client.js";
+export * from "./a2a-server.js";
+export * from "./errors.js";
+export * from "./limits.js";
+export * from "./supervisor.js";
+export const packageName = "@arnilo/prism-supervisor";
+//# sourceMappingURL=index.js.map

package/dist/limits.d.ts

@@ -0,0 +1,38 @@
+export declare const DEFAULT_MAX_DELEGATION_DEPTH = 4;
+export declare const HARD_MAX_DELEGATION_DEPTH = 16;
+export declare const DEFAULT_MAX_ACTIVE_CHILDREN = 4;
+export declare const HARD_MAX_ACTIVE_CHILDREN = 32;
+export declare const DEFAULT_MAX_DELEGATION_BYTES: number;
+export declare const HARD_MAX_DELEGATION_BYTES: number;
+export declare const DEFAULT_MAX_DELEGATION_STEPS = 8;
+export declare const HARD_MAX_DELEGATION_STEPS = 64;
+export declare const DEFAULT_MAX_DELEGATION_TOOL_CALLS = 32;
+export declare const HARD_MAX_DELEGATION_TOOL_CALLS = 256;
+export declare const DEFAULT_MAX_DELEGATION_TOKENS = 20000;
+export declare const HARD_MAX_DELEGATION_TOKENS = 1000000;
+export declare const DEFAULT_DELEGATION_TIMEOUT_MS = 60000;
+export declare const HARD_DELEGATION_TIMEOUT_MS: number;
+export declare const DEFAULT_MAX_SUPERVISOR_QUEUED_EVENTS = 128;
+export declare const HARD_MAX_SUPERVISOR_QUEUED_EVENTS = 4096;
+export interface SupervisorLimits {
+    readonly maxDepth?: number;
+    readonly maxActiveChildren?: number;
+    readonly maxMessageBytes?: number;
+    readonly maxSteps?: number;
+    readonly maxToolCalls?: number;
+    readonly maxTokens?: number;
+    readonly timeoutMs?: number;
+    readonly maxQueuedEvents?: number;
+}
+export interface ResolvedSupervisorLimits {
+    readonly maxDepth: number;
+    readonly maxActiveChildren: number;
+    readonly maxMessageBytes: number;
+    readonly maxSteps: number;
+    readonly maxToolCalls: number;
+    readonly maxTokens: number;
+    readonly timeoutMs: number;
+    readonly maxQueuedEvents: number;
+}
+export declare function resolveSupervisorLimits(input?: SupervisorLimits): ResolvedSupervisorLimits;
+export declare function narrowSupervisorLimits(parent: ResolvedSupervisorLimits, input?: SupervisorLimits): ResolvedSupervisorLimits;

package/dist/limits.js

@@ -0,0 +1,42 @@
+import { SupervisorValidationError } from "./errors.js";
+export const DEFAULT_MAX_DELEGATION_DEPTH = 4;
+export const HARD_MAX_DELEGATION_DEPTH = 16;
+export const DEFAULT_MAX_ACTIVE_CHILDREN = 4;
+export const HARD_MAX_ACTIVE_CHILDREN = 32;
+export const DEFAULT_MAX_DELEGATION_BYTES = 64 * 1024;
+export const HARD_MAX_DELEGATION_BYTES = 1024 * 1024;
+export const DEFAULT_MAX_DELEGATION_STEPS = 8;
+export const HARD_MAX_DELEGATION_STEPS = 64;
+export const DEFAULT_MAX_DELEGATION_TOOL_CALLS = 32;
+export const HARD_MAX_DELEGATION_TOOL_CALLS = 256;
+export const DEFAULT_MAX_DELEGATION_TOKENS = 20_000;
+export const HARD_MAX_DELEGATION_TOKENS = 1_000_000;
+export const DEFAULT_DELEGATION_TIMEOUT_MS = 60_000;
+export const HARD_DELEGATION_TIMEOUT_MS = 30 * 60_000;
+export const DEFAULT_MAX_SUPERVISOR_QUEUED_EVENTS = 128;
+export const HARD_MAX_SUPERVISOR_QUEUED_EVENTS = 4096;
+const SPECS = {
+    maxDepth: [DEFAULT_MAX_DELEGATION_DEPTH, HARD_MAX_DELEGATION_DEPTH],
+    maxActiveChildren: [DEFAULT_MAX_ACTIVE_CHILDREN, HARD_MAX_ACTIVE_CHILDREN],
+    maxMessageBytes: [DEFAULT_MAX_DELEGATION_BYTES, HARD_MAX_DELEGATION_BYTES],
+    maxSteps: [DEFAULT_MAX_DELEGATION_STEPS, HARD_MAX_DELEGATION_STEPS],
+    maxToolCalls: [DEFAULT_MAX_DELEGATION_TOOL_CALLS, HARD_MAX_DELEGATION_TOOL_CALLS],
+    maxTokens: [DEFAULT_MAX_DELEGATION_TOKENS, HARD_MAX_DELEGATION_TOKENS],
+    timeoutMs: [DEFAULT_DELEGATION_TIMEOUT_MS, HARD_DELEGATION_TIMEOUT_MS],
+    maxQueuedEvents: [DEFAULT_MAX_SUPERVISOR_QUEUED_EVENTS, HARD_MAX_SUPERVISOR_QUEUED_EVENTS],
+};
+export function resolveSupervisorLimits(input = {}) {
+    return Object.fromEntries(Object.entries(SPECS).map(([key, [fallback, hard]]) => {
+        const value = input[key] ?? fallback;
+        if (!Number.isSafeInteger(value) || value < 1 || value > hard)
+            throw new SupervisorValidationError(`${key} must be a positive integer at most ${hard}`);
+        return [key, value];
+    }));
+}
+export function narrowSupervisorLimits(parent, input) {
+    if (!input)
+        return parent;
+    const requested = resolveSupervisorLimits({ ...parent, ...input });
+    return Object.fromEntries(Object.keys(SPECS).map((key) => [key, Math.min(parent[key], requested[key])]));
+}
+//# sourceMappingURL=limits.js.map

package/dist/supervisor.d.ts

@@ -0,0 +1,2 @@
+import type { CreateSupervisorOptions, Supervisor } from "./types.js";
+export declare function createSupervisor(options: CreateSupervisorOptions): Supervisor;