@caracalai/core 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [2026] [Garudex Labs]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/cliconfig.d.ts

@@ -0,0 +1,30 @@
+export declare const DEFAULT_API_URL = "http://localhost:3000";
+export declare const DEFAULT_COORDINATOR_URL = "http://localhost:4000";
+export interface Credential {
+    env: string;
+    resource: string;
+}
+export interface OptionalCredential extends Credential {
+    on_failure: 'warn' | 'error';
+}
+export interface McpGovernance {
+    mode: 'block' | 'log';
+}
+export interface CliConfig {
+    zone_url: string;
+    zone_id: string;
+    application_id: string;
+    app_client_secret: string;
+    continue_on_failure?: boolean;
+    credentials?: Credential[];
+    optional_credentials?: OptionalCredential[];
+    mcp_governance?: McpGovernance;
+}
+export declare function resolveCliConfigPath(env?: NodeJS.ProcessEnv): string | undefined;
+export declare class ServiceUrlMissingError extends Error {
+    readonly envKey: string;
+    readonly nodeEnv: string;
+    constructor(envKey: string, nodeEnv: string);
+}
+export declare function resolveServiceUrl(envKey: string, devDefault: string): string;
+//# sourceMappingURL=cliconfig.d.ts.map

package/dist/cliconfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliconfig.d.ts","sourceRoot":"","sources":["../src/cliconfig.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,eAAe,0BAA0B,CAAC;AACvD,eAAO,MAAM,uBAAuB,0BAA0B,CAAC;AAE/D,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,GAAG,KAAK,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,oBAAoB,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC5C,cAAc,CAAC,EAAE,aAAa,CAAC;CAChC;AAKD,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAc7F;AAED,qBAAa,sBAAuB,SAAQ,KAAK;aACnB,MAAM,EAAE,MAAM;aAAkB,OAAO,EAAE,MAAM;gBAA/C,MAAM,EAAE,MAAM,EAAkB,OAAO,EAAE,MAAM;CAI5E;AAID,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAQ5E"}

package/dist/cliconfig.js

@@ -0,0 +1,53 @@
+// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
+// Caracal, a product of Garudex Labs
+//
+// Shared CLI/TUI helpers: caracal.toml discovery and service URL resolution.
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export const DEFAULT_API_URL = 'http://localhost:3000';
+export const DEFAULT_COORDINATOR_URL = 'http://localhost:4000';
+// Resolves the path to caracal.toml using the documented precedence:
+//   $CARACAL_CONFIG → ./caracal.toml (cwd / $PWD / $INIT_CWD) → $XDG_CONFIG_HOME/caracal/caracal.toml
+// Returns undefined when no candidate exists on disk.
+export function resolveCliConfigPath(env = process.env) {
+    const candidates = [];
+    if (env.CARACAL_CONFIG)
+        candidates.push(env.CARACAL_CONFIG);
+    for (const dir of [process.cwd(), env.PWD, env.INIT_CWD]) {
+        if (dir)
+            candidates.push(join(dir, 'caracal.toml'));
+    }
+    const xdg = env.XDG_CONFIG_HOME && env.XDG_CONFIG_HOME.length > 0
+        ? env.XDG_CONFIG_HOME
+        : join(homedir(), '.config');
+    candidates.push(join(xdg, 'caracal', 'caracal.toml'));
+    for (const path of candidates) {
+        if (existsSync(path))
+            return path;
+    }
+    return undefined;
+}
+export class ServiceUrlMissingError extends Error {
+    envKey;
+    nodeEnv;
+    constructor(envKey, nodeEnv) {
+        super(`${envKey} is required when NODE_ENV=${nodeEnv}`);
+        this.envKey = envKey;
+        this.nodeEnv = nodeEnv;
+        this.name = 'ServiceUrlMissingError';
+    }
+}
+// Returns the env-var override or the dev default. Throws ServiceUrlMissingError
+// in non-development so a misconfigured production CLI never silently hits localhost.
+export function resolveServiceUrl(envKey, devDefault) {
+    const v = process.env[envKey];
+    if (v)
+        return v;
+    const env = process.env.NODE_ENV ?? 'development';
+    if (env !== 'development') {
+        throw new ServiceUrlMissingError(envKey, env);
+    }
+    return devDefault;
+}
+//# sourceMappingURL=cliconfig.js.map

package/dist/cliconfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliconfig.js","sourceRoot":"","sources":["../src/cliconfig.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,6EAA6E;AAE7E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AACvD,MAAM,CAAC,MAAM,uBAAuB,GAAG,uBAAuB,CAAC;AA0B/D,qEAAqE;AACrE,sGAAsG;AACtG,sDAAsD;AACtD,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,GAAG,CAAC,cAAc;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5D,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,IAAI,GAAG;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAC/D,CAAC,CAAC,GAAG,CAAC,eAAe;QACrB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACnB;IAAgC;IAA5D,YAA4B,MAAc,EAAkB,OAAe;QACzE,KAAK,CAAC,GAAG,MAAM,8BAA8B,OAAO,EAAE,CAAC,CAAC;QAD9B,WAAM,GAAN,MAAM,CAAQ;QAAkB,YAAO,GAAP,OAAO,CAAQ;QAEzE,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,iFAAiF;AACjF,sFAAsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,UAAkB;IAClE,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IAClD,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,11 @@
+export interface BaseConfig {
+    port: number;
+    databaseUrl: string;
+    redisUrl: string;
+    stsUrl: string;
+    logLevel: string;
+}
+export declare function mustGetenv(key: string): string;
+export declare function getenv(key: string, fallback: string): string;
+export declare function loadBaseConfig(): BaseConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI9C;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,cAAc,IAAI,UAAU,CAQ3C"}

package/dist/config.js

@@ -0,0 +1,23 @@
+// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
+// Caracal, a product of Garudex Labs
+//
+// Shared configuration loader for TypeScript services.
+export function mustGetenv(key) {
+    const v = process.env[key];
+    if (!v)
+        throw new Error(`Required env var missing: ${key}`);
+    return v;
+}
+export function getenv(key, fallback) {
+    return process.env[key] ?? fallback;
+}
+export function loadBaseConfig() {
+    return {
+        port: parseInt(mustGetenv('PORT'), 10),
+        databaseUrl: mustGetenv('DATABASE_URL'),
+        redisUrl: mustGetenv('REDIS_URL'),
+        stsUrl: getenv('STS_URL', 'http://localhost:8080'),
+        logLevel: getenv('LOG_LEVEL', 'info'),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,uDAAuD;AAUvD,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,QAAgB;IAClD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACtC,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;QACvC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC;QACjC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,uBAAuB,CAAC;QAClD,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC;KACtC,CAAC;AACJ,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,14 @@
+export interface SealedSecret {
+    ciphertext: Buffer;
+    nonce: Buffer;
+}
+export declare function sha256(input: string | Buffer): Buffer;
+export declare function sha256Hex(input: string | Buffer): string;
+export declare function loadZoneKek(): Buffer;
+export declare function seal(key: Buffer, plaintext: Buffer): SealedSecret;
+export declare function open(key: Buffer, sealed: SealedSecret): Buffer;
+export declare const STREAM_SIG_FIELD = "_sig";
+export type StreamValue = string | number | boolean | null | undefined;
+export declare function loadStreamsHmacKey(): Buffer | null;
+export declare function signStream(key: Buffer, stream: string, values: Record<string, StreamValue>): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAWpC;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CAMjE;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAO9D;AAID,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAIvE,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAQlD;AAgBD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAEnG"}

package/dist/crypto.js

@@ -0,0 +1,78 @@
+// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
+// Caracal, a product of Garudex Labs
+//
+// ChaCha20-Poly1305 envelope encryption that matches the Go shared/crypto format.
+import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'node:crypto';
+const KEY_BYTES = 32;
+const NONCE_BYTES = 12;
+const TAG_BYTES = 16;
+export function sha256(input) {
+    return createHash('sha256').update(input).digest();
+}
+export function sha256Hex(input) {
+    return createHash('sha256').update(input).digest('hex');
+}
+export function loadZoneKek() {
+    const raw = process.env.ZONE_KEK;
+    if (!raw)
+        throw new Error('ZONE_KEK is required');
+    const key = Buffer.from(raw, 'hex');
+    if (key.length !== KEY_BYTES) {
+        throw new Error(`ZONE_KEK must be ${KEY_BYTES} bytes, got ${key.length}`);
+    }
+    let allZero = 0;
+    for (const b of key)
+        allZero |= b;
+    if (allZero === 0)
+        throw new Error('ZONE_KEK must not be all zeros');
+    return key;
+}
+export function seal(key, plaintext) {
+    const nonce = randomBytes(NONCE_BYTES);
+    const cipher = createCipheriv('chacha20-poly1305', key, nonce, { authTagLength: TAG_BYTES });
+    const enc = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return { ciphertext: Buffer.concat([enc, tag]), nonce };
+}
+export function open(key, sealed) {
+    if (sealed.ciphertext.length < TAG_BYTES)
+        throw new Error('ciphertext too short');
+    const tag = sealed.ciphertext.subarray(sealed.ciphertext.length - TAG_BYTES);
+    const body = sealed.ciphertext.subarray(0, sealed.ciphertext.length - TAG_BYTES);
+    const decipher = createDecipheriv('chacha20-poly1305', key, sealed.nonce, { authTagLength: TAG_BYTES });
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(body), decipher.final()]);
+}
+// STREAM_SIG_FIELD is the reserved key used to carry an HMAC-SHA256 origin signature
+// on Redis stream messages. Mirrors `crypto.StreamSigField` in the Go shared package.
+export const STREAM_SIG_FIELD = '_sig';
+// loadStreamsHmacKey reads STREAMS_HMAC_KEY (hex) and enforces ≥32 bytes. Returns
+// null when unset; callers in production paths must reject null themselves.
+export function loadStreamsHmacKey() {
+    const raw = process.env.STREAMS_HMAC_KEY;
+    if (!raw)
+        return null;
+    const key = Buffer.from(raw, 'hex');
+    if (key.length < 32) {
+        throw new Error('STREAMS_HMAC_KEY must be hex-encoded with at least 32 bytes');
+    }
+    return key;
+}
+function canonicalizeStream(stream, values) {
+    const keys = Object.keys(values).filter((k) => k !== STREAM_SIG_FIELD).sort();
+    let out = `${stream}\n`;
+    for (const k of keys) {
+        const v = values[k];
+        if (v === null || v === undefined)
+            continue;
+        out += `${k}=${String(v)}\n`;
+    }
+    return out;
+}
+// signStream returns the hex HMAC-SHA256 over the canonical form of the values map.
+// Mirrors `crypto.SignStream` in the Go shared package so producers and consumers
+// across language boundaries agree on the signature.
+export function signStream(key, stream, values) {
+    return createHmac('sha256', key).update(canonicalizeStream(stream, values)).digest('hex');
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,kFAAkF;AAElF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEpG,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AAOrB,MAAM,UAAU,MAAM,CAAC,KAAsB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAsB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,SAAiB;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,MAAoB;IACpD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACxG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,qFAAqF;AACrF,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAIvC,kFAAkF;AAClF,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,MAAmC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,GAAG,GAAG,GAAG,MAAM,IAAI,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC5C,GAAG,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,kFAAkF;AAClF,qDAAqD;AACrD,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,MAAc,EAAE,MAAmC;IACzF,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC"}

package/dist/env.d.ts

@@ -0,0 +1,3 @@
+export declare function caracalEnv(): string;
+export declare function isProduction(): boolean;
+//# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAKA,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,wBAAgB,YAAY,IAAI,OAAO,CAGtC"}

package/dist/env.js

@@ -0,0 +1,12 @@
+// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
+// Caracal, a product of Garudex Labs
+//
+// Shared environment classification for TypeScript services.
+export function caracalEnv() {
+    return process.env.CARACAL_ENV ?? 'development';
+}
+export function isProduction() {
+    const env = caracalEnv();
+    return env === 'production' || env === 'prod' || env === 'staging';
+}
+//# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,6DAA6D;AAE7D,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,aAAa,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,CAAC;AACrE,CAAC"}

package/dist/envfile.d.ts

@@ -0,0 +1,3 @@
+export declare function readEnvFile(path: string): Record<string, string>;
+export declare function discoverAdminToken(explicit?: string): string | undefined;
+//# sourceMappingURL=envfile.d.ts.map

package/dist/envfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envfile.d.ts","sourceRoot":"","sources":["../src/envfile.ts"],"names":[],"mappings":"AAQA,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAahE;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAaxE"}

package/dist/envfile.js

@@ -0,0 +1,40 @@
+// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
+// Caracal, a product of Garudex Labs
+//
+// Helpers for reading dotenv files and discovering the Caracal admin token.
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+export function readEnvFile(path) {
+    if (!existsSync(path))
+        return {};
+    const out = {};
+    for (const line of readFileSync(path, 'utf8').split(/\r?\n/)) {
+        const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.*)\s*$/);
+        if (!m)
+            continue;
+        let value = m[2];
+        if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        out[m[1]] = value;
+    }
+    return out;
+}
+export function discoverAdminToken(explicit) {
+    if (explicit)
+        return explicit;
+    if (process.env.CARACAL_ADMIN_TOKEN)
+        return process.env.CARACAL_ADMIN_TOKEN;
+    const candidates = [
+        process.env.CARACAL_ENV_FILE,
+        join(process.cwd(), 'infra', 'docker', '.env'),
+        join(process.cwd(), '.env'),
+    ].filter((p) => Boolean(p));
+    for (const path of candidates) {
+        const env = readEnvFile(path);
+        if (env.CARACAL_ADMIN_TOKEN)
+            return env.CARACAL_ADMIN_TOKEN;
+    }
+    return undefined;
+}
+//# sourceMappingURL=envfile.js.map

package/dist/envfile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envfile.js","sourceRoot":"","sources":["../src/envfile.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,4EAA4E;AAE5E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC5E,MAAM,UAAU,GAAG;QACjB,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;KAC5B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,GAAG,CAAC,mBAAmB;YAAE,OAAO,GAAG,CAAC,mBAAmB,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,12 @@
+export type ErrorCode = 'access_denied' | 'invalid_token' | 'resource_not_found' | 'internal_error' | 'policy_eval_failed' | 'provider_rate_limited' | 'interaction_required' | 'sts_unavailable' | 'credential_expired_not_renewable' | 'payload_too_large';
+export declare class CaracalError extends Error {
+    readonly code: ErrorCode;
+    readonly requestId?: string | undefined;
+    constructor(code: ErrorCode, message: string, requestId?: string | undefined);
+    toJSON(): {
+        requestId?: string | undefined;
+        error: ErrorCode;
+        error_description: string;
+    };
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,SAAS,GACjB,eAAe,GACf,eAAe,GACf,oBAAoB,GACpB,gBAAgB,GAChB,oBAAoB,GACpB,uBAAuB,GACvB,sBAAsB,GACtB,iBAAiB,GACjB,kCAAkC,GAClC,mBAAmB,CAAC;AAExB,qBAAa,YAAa,SAAQ,KAAK;aAEnB,IAAI,EAAE,SAAS;aAEf,SAAS,CAAC,EAAE,MAAM;gBAFlB,IAAI,EAAE,SAAS,EAC/B,OAAO,EAAE,MAAM,EACC,SAAS,CAAC,EAAE,MAAM,YAAA;IAMpC,MAAM;;;;;CAOP"}

package/dist/errors.js

@@ -0,0 +1,22 @@
+// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
+// Caracal, a product of Garudex Labs
+//
+// Shared error codes and types for TypeScript services.
+export class CaracalError extends Error {
+    code;
+    requestId;
+    constructor(code, message, requestId) {
+        super(message);
+        this.code = code;
+        this.requestId = requestId;
+        this.name = 'CaracalError';
+    }
+    toJSON() {
+        return {
+            error: this.code,
+            error_description: this.message,
+            ...(this.requestId ? { requestId: this.requestId } : {}),
+        };
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,wDAAwD;AAcxD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAEnB;IAEA;IAHlB,YACkB,IAAe,EAC/B,OAAe,EACC,SAAkB;QAElC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAW;QAEf,cAAS,GAAT,SAAS,CAAS;QAGlC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;IAED,MAAM;QACJ,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,iBAAiB,EAAE,IAAI,CAAC,OAAO;YAC/B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export * from './config.js';
+export * from './crypto.js';
+export * from './env.js';
+export * from './envfile.js';
+export * from './errors.js';
+export * from './logging.js';
+export * from './scope.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
+// Caracal, a product of Garudex Labs
+//
+// @caracalai/core — configuration, errors, and logging for TypeScript services.
+export * from './config.js';
+export * from './crypto.js';
+export * from './env.js';
+export * from './envfile.js';
+export * from './errors.js';
+export * from './logging.js';
+export * from './scope.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,gFAAgF;AAEhF,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/logging.d.ts

@@ -0,0 +1,10 @@
+type Level = 'debug' | 'info' | 'warn' | 'error';
+export type Logger = ReturnType<typeof createLogger>;
+export declare function createLogger(service: string, level?: Level): {
+    debug: (msg: string, fields?: Record<string, unknown>) => void;
+    info: (msg: string, fields?: Record<string, unknown>) => void;
+    warn: (msg: string, fields?: Record<string, unknown>) => void;
+    error: (msg: string, fields?: Record<string, unknown>) => void;
+};
+export {};
+//# sourceMappingURL=logging.d.ts.map

package/dist/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAKA,KAAK,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAQjD,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AAErD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,KAAc;iBASlD,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBACzC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBACxC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;iBACvC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;EAExD"}

package/dist/logging.js

@@ -0,0 +1,23 @@
+// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
+// Caracal, a product of Garudex Labs
+//
+// Structured JSON logger for TypeScript services.
+const ORDER = ['debug', 'info', 'warn', 'error'];
+function shouldLog(msgLevel, configLevel) {
+    return ORDER.indexOf(msgLevel) >= ORDER.indexOf(configLevel);
+}
+export function createLogger(service, level = 'info') {
+    const emit = (msgLevel, msg, fields) => {
+        if (!shouldLog(msgLevel, level))
+            return;
+        process.stderr.write(JSON.stringify({ level: msgLevel, service, msg, time: new Date().toISOString(), ...fields }) +
+            '\n');
+    };
+    return {
+        debug: (msg, fields) => emit('debug', msg, fields),
+        info: (msg, fields) => emit('info', msg, fields),
+        warn: (msg, fields) => emit('warn', msg, fields),
+        error: (msg, fields) => emit('error', msg, fields),
+    };
+}
+//# sourceMappingURL=logging.js.map

package/dist/logging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.js","sourceRoot":"","sources":["../src/logging.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,kDAAkD;AAIlD,MAAM,KAAK,GAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1D,SAAS,SAAS,CAAC,QAAe,EAAE,WAAkB;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;AAC/D,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,QAAe,MAAM;IACjE,MAAM,IAAI,GAAG,CAAC,QAAe,EAAE,GAAW,EAAE,MAAgC,EAAE,EAAE;QAC9E,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC;YAC1F,IAAI,CACP,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,CAAC,GAAW,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;QACpF,IAAI,EAAE,CAAC,GAAW,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;QAClF,IAAI,EAAE,CAAC,GAAW,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC;QAClF,KAAK,EAAE,CAAC,GAAW,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC;KACrF,CAAC;AACJ,CAAC"}

package/dist/scope.d.ts

@@ -0,0 +1,4 @@
+export declare function parseScope(scope: string | null | undefined): string[];
+export declare function hasScope(scope: string | null | undefined, required: string): boolean;
+export declare function scopesAllowed(requested: string[], available: string[]): boolean;
+//# sourceMappingURL=scope.d.ts.map

package/dist/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAQA,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAUrE;AAID,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGpF;AAGD,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAG/E"}

package/dist/scope.js

@@ -0,0 +1,33 @@
+// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
+// Caracal, a product of Garudex Labs
+//
+// Canonical OAuth 2.0 scope-string parser shared across all TS callers.
+// parseScope splits an OAuth 2.0 scope string per RFC 6749 §3.3: tokens are
+// separated by ASCII whitespace and empty tokens are ignored. Returns a
+// distinct, order-preserving array.
+export function parseScope(scope) {
+    if (!scope)
+        return [];
+    const seen = new Set();
+    const out = [];
+    for (const token of scope.split(/\s+/)) {
+        if (token === '' || seen.has(token))
+            continue;
+        seen.add(token);
+        out.push(token);
+    }
+    return out;
+}
+// hasScope reports whether the parsed scope grants `required`. Empty `required`
+// is treated as a programming error and never matches.
+export function hasScope(scope, required) {
+    if (!required)
+        return false;
+    return parseScope(scope).includes(required);
+}
+// scopesAllowed reports whether every scope in `requested` is present in `available`.
+export function scopesAllowed(requested, available) {
+    const allowed = new Set(available);
+    return requested.every((s) => allowed.has(s));
+}
+//# sourceMappingURL=scope.js.map

package/dist/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,wEAAwE;AAExE,4EAA4E;AAC5E,wEAAwE;AACxE,oCAAoC;AACpC,MAAM,UAAU,UAAU,CAAC,KAAgC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,KAAK,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ;QAC7C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gFAAgF;AAChF,uDAAuD;AACvD,MAAM,UAAU,QAAQ,CAAC,KAAgC,EAAE,QAAgB;IACzE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC7C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,SAAmB,EAAE,SAAmB;IACpE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAA;IAClC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AAC/C,CAAC"}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@caracalai/core",
+  "version": "0.1.0",
+  "description": "Caracal SDK foundation: logging, config, errors.",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/Garudex-Labs/caracal",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Garudex-Labs/caracal.git",
+    "directory": "packages/core/ts"
+  },
+  "keywords": ["caracal", "agent", "identity", "sdk"],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./cli": {
+      "import": "./dist/cliconfig.js",
+      "types": "./dist/cliconfig.d.ts"
+    }
+  },
+  "files": ["dist", "README.md", "LICENSE"],
+  "publishConfig": { "access": "public" },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --root ../../.. tests/typescript/unit/shared",
+    "prepublishOnly": "tsc"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.0.0"
+  }
+}