@caracalai/core 0.1.6-rc.3 → 0.2.0-rc.2

package/dist/config.js

@@ -1,60 +0,0 @@
-// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
-// Caracal, a product of Garudex Labs
-//
-// Shared environment variable accessors for TypeScript services.
-import { readFileSync } from 'node:fs';
-export function mustGetenv(key) {
-    const v = process.env[key];
-    if (!v)
-        throw new Error(`Required env var missing: ${key}`);
-    return v;
-}
-export function getenv(key, fallback) {
-    return process.env[key] ?? fallback;
-}
-export function intEnv(key, fallback, min = 0) {
-    const raw = process.env[key];
-    if (raw === undefined || raw === '')
-        return fallback;
-    const n = parseInt(raw, 10);
-    if (!Number.isFinite(n) || n < min) {
-        throw new Error(`Invalid integer env var ${key}: ${raw}`);
-    }
-    return n;
-}
-export function boolEnv(key, fallback) {
-    const raw = process.env[key];
-    if (raw === undefined || raw === '')
-        return fallback;
-    switch (raw.toLowerCase()) {
-        case '1':
-        case 'true':
-        case 'yes':
-        case 'on': return true;
-        case '0':
-        case 'false':
-        case 'no':
-        case 'off': return false;
-        default: throw new Error(`Invalid boolean env var ${key}: ${raw}`);
-    }
-}
-// resolveFileSecrets reads `${KEY}_FILE` for each given key and, when set,
-// loads the file contents into `process.env[KEY]`. The `_FILE` variable is
-// cleared so secrets do not appear in the process environment beyond what is
-// actually needed at runtime. Existing values for `KEY` are preserved.
-export function resolveFileSecrets(keys) {
-    for (const key of keys) {
-        if (process.env[key])
-            continue;
-        const fileVar = `${key}_FILE`;
-        const path = process.env[fileVar];
-        if (!path)
-            continue;
-        const value = readFileSync(path, 'utf8').replace(/\s+$/, '');
-        if (!value)
-            throw new Error(`Secret file empty: ${fileVar}=${path}`);
-        process.env[key] = value;
-        delete process.env[fileVar];
-    }
-}
-//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,QAAgB;IAClD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,GAAG,GAAG,CAAC;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,QAAiB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrD,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,GAAG,CAAC;QAAC,KAAK,MAAM,CAAC;QAAC,KAAK,KAAK,CAAC;QAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC;QAC1D,KAAK,GAAG,CAAC;QAAC,KAAK,OAAO,CAAC;QAAC,KAAK,IAAI,CAAC;QAAC,KAAK,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC;QAC5D,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAAC,IAAuB;IACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}

package/dist/consoleToken.d.ts

@@ -1,3 +0,0 @@
-export declare function deriveConsoleReadToken(adminToken: string): string;
-export declare function deriveConsoleWriteToken(adminToken: string): string;
-//# sourceMappingURL=consoleToken.d.ts.map

package/dist/consoleToken.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"consoleToken.d.ts","sourceRoot":"","sources":["../src/consoleToken.ts"],"names":[],"mappings":"AAyBA,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjE;AAOD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE"}

package/dist/consoleToken.js

@@ -1,33 +0,0 @@
-// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
-// Caracal, a product of Garudex Labs
-//
-// Deterministic derivation of the Console BFF's operational admin tokens from the deployment admin token.
-import { createHmac } from 'node:crypto';
-// The reserved domain-separation labels for the Console BFF's derived operational tokens. Each
-// is derived from the deployment's admin (god) token so the BFF and the API agree on its value
-// with no shared secret file to manage and no minting round-trip. Distinct labels keep the read
-// and write credentials independent; versioned so a derivation can be rotated without ambiguity.
-const CONSOLE_READ_TOKEN_LABEL = 'caracal:console:read-only:v1';
-const CONSOLE_WRITE_TOKEN_LABEL = 'caracal:console:write:v1';
-function deriveConsoleToken(adminToken, label) {
-    const mac = createHmac('sha256', adminToken).update(label).digest('base64url');
-    return `cat_${mac}`;
-}
-// Derives the Console BFF's read-only admin token deterministically from the deployment admin
-// token. The result is HMAC-SHA256(adminToken, label) rendered in the cat_ admin-token format,
-// so both the API (which provisions the read-capability row) and the BFF (which presents it on
-// read traffic) compute the identical value independently. The derived token is strictly weaker
-// than the admin token it comes from, so deriving it discloses nothing the holder of the admin
-// token did not already have.
-export function deriveConsoleReadToken(adminToken) {
-    return deriveConsoleToken(adminToken, CONSOLE_READ_TOKEN_LABEL);
-}
-// Derives the Console BFF's write admin token, the credential it presents on mutating traffic so
-// the deployment admin token is reserved as a break-glass fallback rather than the everyday
-// operational credential. It is independently revocable from the bootstrap admin token (rotating
-// the admin token rotates it), yet derivable only by a holder of the admin token, who already
-// has full authority - so its existence grants nothing new.
-export function deriveConsoleWriteToken(adminToken) {
-    return deriveConsoleToken(adminToken, CONSOLE_WRITE_TOKEN_LABEL);
-}
-//# sourceMappingURL=consoleToken.js.map

package/dist/consoleToken.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"consoleToken.js","sourceRoot":"","sources":["../src/consoleToken.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,0GAA0G;AAE1G,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,+FAA+F;AAC/F,+FAA+F;AAC/F,gGAAgG;AAChG,iGAAiG;AACjG,MAAM,wBAAwB,GAAG,8BAA8B,CAAA;AAC/D,MAAM,yBAAyB,GAAG,0BAA0B,CAAA;AAE5D,SAAS,kBAAkB,CAAC,UAAkB,EAAE,KAAa;IAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC9E,OAAO,OAAO,GAAG,EAAE,CAAA;AACrB,CAAC;AAED,8FAA8F;AAC9F,+FAA+F;AAC/F,+FAA+F;AAC/F,gGAAgG;AAChG,+FAA+F;AAC/F,8BAA8B;AAC9B,MAAM,UAAU,sBAAsB,CAAC,UAAkB;IACvD,OAAO,kBAAkB,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAA;AACjE,CAAC;AAED,iGAAiG;AACjG,4FAA4F;AAC5F,iGAAiG;AACjG,8FAA8F;AAC9F,4DAA4D;AAC5D,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,OAAO,kBAAkB,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAA;AAClE,CAAC"}

package/dist/env.d.ts

@@ -1,5 +0,0 @@
-export type CaracalMode = 'dev' | 'rc' | 'stable';
-export declare function caracalMode(): CaracalMode;
-export declare function isPublished(): boolean;
-export declare function assertPublishedSafe(): void;
-//# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,IAAI,GAAG,QAAQ,CAAC;AAElD,wBAAgB,WAAW,IAAI,WAAW,CAKzC;AAED,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAU1C"}

package/dist/env.js

@@ -1,28 +0,0 @@
-// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
-// Caracal, a product of Garudex Labs
-//
-// Shared environment classification for TypeScript services.
-export function caracalMode() {
-    const raw = (process.env.CARACAL_MODE ?? '').trim().toLowerCase();
-    if (raw === '')
-        return 'stable';
-    if (raw === 'dev' || raw === 'rc' || raw === 'stable')
-        return raw;
-    throw new Error(`CARACAL_MODE must be 'dev', 'rc', or 'stable' (got '${raw}')`);
-}
-export function isPublished() {
-    return caracalMode() !== 'dev';
-}
-export function assertPublishedSafe() {
-    if (!isPublished())
-        return;
-    const forbidden = ['INSECURE_STS', 'INSECURE_HTTP'];
-    const set = forbidden.filter((k) => {
-        const v = (process.env[k] ?? '').toLowerCase();
-        return v === 'true' || v === '1' || v === 'yes';
-    });
-    if (set.length > 0) {
-        throw new Error(`CARACAL_MODE=rc or CARACAL_MODE=stable forbids: ${set.join(', ')}`);
-    }
-}
-//# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,6DAA6D;AAI7D,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAClE,MAAM,IAAI,KAAK,CAAC,uDAAuD,GAAG,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,EAAE,KAAK,KAAK,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO;IAC3B,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/envfile.d.ts

@@ -1,19 +0,0 @@
-export declare function readEnvFile(path: string): Record<string, string>;
-/**
- * Resolve the installed home written to by `caracal up`.
- * Mirrors the layout in packages/engine/src/runtime.ts.
- */
-export declare function installedHome(): string;
-export declare function devSecretsHome(): string;
-export interface DiscoverTokenOptions {
-    preferGenerated?: boolean;
-}
-export declare function discoverRepoRoot(): string | undefined;
-export interface ManagedSecretDirOptions {
-    preferDev?: boolean;
-}
-export declare function managedSecretDirs(opts?: ManagedSecretDirOptions): string[];
-export declare function discoverAdminToken(explicit?: string, opts?: DiscoverTokenOptions): string | undefined;
-export declare function discoverCoordinatorToken(explicit?: string, opts?: DiscoverTokenOptions): string | undefined;
-export declare function discoverMetricsBearer(explicit?: string, opts?: DiscoverTokenOptions): string | undefined;
-//# sourceMappingURL=envfile.d.ts.map

package/dist/envfile.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"envfile.d.ts","sourceRoot":"","sources":["../src/envfile.ts"],"names":[],"mappings":"AASA,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAahE;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAWtC;AAED,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAQD,MAAM,WAAW,oBAAoB;IACnC,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAWrD;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,uBAA4B,GAAG,MAAM,EAAE,CAQ9E;AAYD,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB,GAAG,MAAM,GAAG,SAAS,CAoBzG;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB,GAAG,MAAM,GAAG,SAAS,CAoB/G;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB,GAAG,MAAM,GAAG,SAAS,CAoB5G"}

package/dist/envfile.js

@@ -1,167 +0,0 @@
-// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
-// Caracal, a product of Garudex Labs
-//
-// Helpers for reading dotenv files and discovering Caracal managed secrets.
-import { existsSync, readFileSync } from 'node:fs';
-import { homedir, platform } from 'node:os';
-import { dirname, join } from 'node:path';
-export function readEnvFile(path) {
-    if (!existsSync(path))
-        return {};
-    const out = {};
-    for (const line of readFileSync(path, 'utf8').split(/\r?\n/)) {
-        const m = line.match(/^\s*([A-Z_][A-Z0-9_]*)\s*=\s*(.*)\s*$/);
-        if (!m)
-            continue;
-        let value = m[2];
-        if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
-            value = value.slice(1, -1);
-        }
-        out[m[1]] = value;
-    }
-    return out;
-}
-/**
- * Resolve the installed home written to by `caracal up`.
- * Mirrors the layout in packages/engine/src/runtime.ts.
- */
-export function installedHome() {
-    if (process.env.CARACAL_HOME)
-        return process.env.CARACAL_HOME;
-    const xdg = process.env.XDG_DATA_HOME;
-    if (xdg && xdg.length > 0)
-        return join(xdg, 'caracal');
-    if (platform() === 'darwin') {
-        return join(homedir(), 'Library', 'Application Support', 'caracal');
-    }
-    if (platform() === 'win32') {
-        return join(process.env.LOCALAPPDATA || join(homedir(), 'AppData', 'Local'), 'caracal');
-    }
-    return join(homedir(), '.local', 'share', 'caracal');
-}
-export function devSecretsHome() {
-    if (process.env.CARACAL_DEV_SECRETS_DIR)
-        return process.env.CARACAL_DEV_SECRETS_DIR;
-    return join(installedHome(), 'dev-secrets');
-}
-function readSecretFile(path) {
-    if (!existsSync(path))
-        return undefined;
-    const value = readFileSync(path, 'utf8').trim();
-    return value.length > 0 ? value : undefined;
-}
-export function discoverRepoRoot() {
-    if (process.env.CARACAL_REPO_ROOT)
-        return process.env.CARACAL_REPO_ROOT;
-    let dir = process.cwd();
-    while (true) {
-        if (existsSync(join(dir, 'pnpm-workspace.yaml')) && existsSync(join(dir, 'package.json'))) {
-            return dir;
-        }
-        const parent = dirname(dir);
-        if (parent === dir)
-            return undefined;
-        dir = parent;
-    }
-}
-export function managedSecretDirs(opts = {}) {
-    const root = discoverRepoRoot();
-    const explicit = process.env.CARACAL_SECRETS_DIR;
-    const installedPath = join(installedHome(), 'secrets');
-    const devPath = devSecretsHome();
-    const workspacePath = process.env.CARACAL_ALLOW_WORKSPACE_SECRETS === 'true' && root ? join(root, 'infra', 'secrets', 'files') : undefined;
-    const generated = opts.preferDev ? [devPath, installedPath] : [installedPath, devPath];
-    return [...new Set([explicit, ...generated, workspacePath].filter((path) => Boolean(path)))];
-}
-function readGeneratedSecret(fileName) {
-    const root = discoverRepoRoot();
-    const preferDev = process.env.CARACAL_MODE === 'dev' || (!process.env.CARACAL_HOME && root !== undefined);
-    for (const dir of managedSecretDirs({ preferDev })) {
-        const value = readSecretFile(join(dir, fileName));
-        if (value)
-            return value;
-    }
-    return undefined;
-}
-export function discoverAdminToken(explicit, opts = {}) {
-    if (explicit)
-        return explicit;
-    if (opts.preferGenerated) {
-        const generated = readGeneratedSecret('caracalAdminToken');
-        if (generated)
-            return generated;
-    }
-    if (process.env.CARACAL_ADMIN_TOKEN)
-        return process.env.CARACAL_ADMIN_TOKEN;
-    if (process.env.CARACAL_ADMIN_TOKEN_FILE) {
-        const value = readSecretFile(process.env.CARACAL_ADMIN_TOKEN_FILE);
-        if (value)
-            return value;
-    }
-    if (!opts.preferGenerated) {
-        const generated = readGeneratedSecret('caracalAdminToken');
-        if (generated)
-            return generated;
-    }
-    if (process.env.CARACAL_ENV_FILE) {
-        const env = readEnvFile(process.env.CARACAL_ENV_FILE);
-        if (env.CARACAL_ADMIN_TOKEN)
-            return env.CARACAL_ADMIN_TOKEN;
-    }
-    return undefined;
-}
-export function discoverCoordinatorToken(explicit, opts = {}) {
-    if (explicit)
-        return explicit;
-    if (opts.preferGenerated) {
-        const generated = readGeneratedSecret('caracalCoordinatorToken');
-        if (generated)
-            return generated;
-    }
-    if (process.env.CARACAL_COORDINATOR_TOKEN)
-        return process.env.CARACAL_COORDINATOR_TOKEN;
-    if (process.env.CARACAL_COORDINATOR_TOKEN_FILE) {
-        const value = readSecretFile(process.env.CARACAL_COORDINATOR_TOKEN_FILE);
-        if (value)
-            return value;
-    }
-    if (!opts.preferGenerated) {
-        const generated = readGeneratedSecret('caracalCoordinatorToken');
-        if (generated)
-            return generated;
-    }
-    if (process.env.CARACAL_ENV_FILE) {
-        const env = readEnvFile(process.env.CARACAL_ENV_FILE);
-        if (env.CARACAL_COORDINATOR_TOKEN)
-            return env.CARACAL_COORDINATOR_TOKEN;
-    }
-    return undefined;
-}
-export function discoverMetricsBearer(explicit, opts = {}) {
-    if (explicit)
-        return explicit;
-    if (opts.preferGenerated) {
-        const generated = readGeneratedSecret('metricsBearer');
-        if (generated)
-            return generated;
-    }
-    if (process.env.METRICS_BEARER)
-        return process.env.METRICS_BEARER;
-    if (process.env.METRICS_BEARER_FILE) {
-        const value = readSecretFile(process.env.METRICS_BEARER_FILE);
-        if (value)
-            return value;
-    }
-    if (!opts.preferGenerated) {
-        const generated = readGeneratedSecret('metricsBearer');
-        if (generated)
-            return generated;
-    }
-    if (process.env.CARACAL_ENV_FILE) {
-        const env = readEnvFile(process.env.CARACAL_ENV_FILE);
-        if (env.METRICS_BEARER)
-            return env.METRICS_BEARER;
-    }
-    return undefined;
-}
-//# sourceMappingURL=envfile.js.map

package/dist/envfile.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"envfile.js","sourceRoot":"","sources":["../src/envfile.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,4EAA4E;AAE5E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IAChC,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC7D,IAAI,CAAC,CAAC;YAAE,SAAQ;QAChB,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;QACjB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5B,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,CAAA;IACpB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAA;IACrC,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IACtD,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAA;IACnF,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,aAAa,CAAC,CAAA;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IAC/C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7C,CAAC;AAMD,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAA;IACvE,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAA;IACvB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,GAAG,CAAA;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAA;QACpC,GAAG,GAAG,MAAM,CAAA;IACd,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,iBAAiB,CAAC,OAAgC,EAAE;IAClE,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAA;IAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;IAChD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,CAAC,CAAA;IACtD,MAAM,OAAO,GAAG,cAAc,EAAE,CAAA;IAChC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1I,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACtF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,SAAS,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9G,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAA;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,KAAK,SAAS,CAAC,CAAA;IACzG,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;QACjD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAiB,EAAE,OAA6B,EAAE;IACnF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QAC1D,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAA;IAC3E,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;QAClE,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAA;QAC1D,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QACrD,IAAI,GAAG,CAAC,mBAAmB;YAAE,OAAO,GAAG,CAAC,mBAAmB,CAAA;IAC7D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAiB,EAAE,OAA6B,EAAE;IACzF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,mBAAmB,CAAC,yBAAyB,CAAC,CAAA;QAChE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAA;IACvF,IAAI,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAA;QACxE,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,mBAAmB,CAAC,yBAAyB,CAAC,CAAA;QAChE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QACrD,IAAI,GAAG,CAAC,yBAAyB;YAAE,OAAO,GAAG,CAAC,yBAAyB,CAAA;IACzE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAiB,EAAE,OAA6B,EAAE;IACtF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAA;QACtD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IACjE,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;QAC7D,IAAI,KAAK;YAAE,OAAO,KAAK,CAAA;IACzB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAA;QACtD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAA;IACjC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QACrD,IAAI,GAAG,CAAC,cAAc;YAAE,OAAO,GAAG,CAAC,cAAc,CAAA;IACnD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/lifecycle.d.ts

@@ -1,17 +0,0 @@
-export type ShutdownFn = () => Promise<void> | void;
-export declare class ShutdownRegistry {
-    private readonly opts;
-    private entries;
-    private installed;
-    private firing;
-    constructor(opts: {
-        timeoutMs: number;
-        log: (level: 'info' | 'warn' | 'error', msg: string, meta?: Record<string, unknown>) => void;
-        exit?: (code: number) => void;
-    });
-    register(name: string, fn: ShutdownFn): void;
-    get draining(): boolean;
-    install(signals?: NodeJS.Signals[]): void;
-    fire(reason: string, code?: number): Promise<void>;
-}
-//# sourceMappingURL=lifecycle.d.ts.map

package/dist/lifecycle.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAOpD,qBAAa,gBAAgB;IAMzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IALvB,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAS;gBAGJ,IAAI,EAAE;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;QAC7F,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;KAC/B;IAGH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,GAAG,IAAI;IAI5C,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,OAAO,CAAC,OAAO,GAAE,MAAM,CAAC,OAAO,EAA0B,GAAG,IAAI;IAU1D,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,SAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAuCpD"}

package/dist/lifecycle.js

@@ -1,66 +0,0 @@
-// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
-// Caracal, a product of Garudex Labs
-//
-// Shared graceful shutdown registry for TypeScript services.
-import { withTimeout } from './async.js';
-export class ShutdownRegistry {
-    opts;
-    entries = [];
-    installed = false;
-    firing = false;
-    constructor(opts) {
-        this.opts = opts;
-    }
-    register(name, fn) {
-        this.entries.push({ name, fn });
-    }
-    get draining() {
-        return this.firing;
-    }
-    install(signals = ['SIGTERM', 'SIGINT']) {
-        if (this.installed)
-            return;
-        this.installed = true;
-        for (const sig of signals) {
-            process.once(sig, () => {
-                void this.fire(sig, 0);
-            });
-        }
-    }
-    async fire(reason, code = 0) {
-        if (this.firing)
-            return;
-        this.firing = true;
-        this.opts.log('info', 'shutdown initiated', { reason, entries: this.entries.length });
-        const exit = this.opts.exit ?? ((exitCode) => process.exit(exitCode));
-        const deadline = Date.now() + this.opts.timeoutMs;
-        const timeout = setTimeout(() => {
-            this.opts.log('error', 'shutdown timed out; forcing exit', { timeoutMs: this.opts.timeoutMs });
-            exit(1);
-        }, this.opts.timeoutMs);
-        timeout.unref();
-        let exitCode = code;
-        for (const entry of [...this.entries].reverse()) {
-            const remaining = deadline - Date.now();
-            if (remaining <= 0) {
-                this.opts.log('error', 'shutdown deadline exceeded; skipping remaining', { skipped: entry.name });
-                exitCode = 1;
-                break;
-            }
-            try {
-                await withTimeout(Promise.resolve(entry.fn()), remaining, `shutdown step ${entry.name} did not complete within ${remaining}ms`);
-                this.opts.log('info', 'shutdown step completed', { entry: entry.name });
-            }
-            catch (err) {
-                this.opts.log('error', 'shutdown step failed', {
-                    entry: entry.name,
-                    err: err.message,
-                });
-                exitCode = 1;
-            }
-        }
-        clearTimeout(timeout);
-        exit(exitCode);
-    }
-}
-//# sourceMappingURL=lifecycle.js.map

package/dist/lifecycle.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,6DAA6D;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AASzC,MAAM,OAAO,gBAAgB;IAMR;IALX,OAAO,GAAY,EAAE,CAAC;IACtB,SAAS,GAAG,KAAK,CAAC;IAClB,MAAM,GAAG,KAAK,CAAC;IAEvB,YACmB,IAIhB;QAJgB,SAAI,GAAJ,IAAI,CAIpB;IACA,CAAC;IAEJ,QAAQ,CAAC,IAAY,EAAE,EAAc;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,UAA4B,CAAC,SAAS,EAAE,QAAQ,CAAC;QACvD,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACrB,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,IAAI,GAAG,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QAElD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,kCAAkC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/F,IAAI,CAAC,CAAC,CAAC,CAAC;QACV,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,CAAC,KAAK,EAAE,CAAC;QAEhB,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,gDAAgD,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClG,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,WAAW,CACf,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAC3B,SAAS,EACT,iBAAiB,KAAK,CAAC,IAAI,4BAA4B,SAAS,IAAI,CACrE,CAAC;gBACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,yBAAyB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,EAAE;oBAC7C,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,GAAG,EAAG,GAAa,CAAC,OAAO;iBAC5B,CAAC,CAAC;gBACH,QAAQ,GAAG,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjB,CAAC;CACF"}

package/dist/metrics.d.ts

@@ -1,4 +0,0 @@
-import type { AuditClient } from './audit.js';
-/** Render dev-log + (optional) audit counters in Prometheus text format. */
-export declare function renderObservabilityMetrics(audit?: AuditClient): string;
-//# sourceMappingURL=metrics.d.ts.map

package/dist/metrics.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../src/metrics.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAwB9C,4EAA4E;AAC5E,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,MAAM,CAuBtE"}

package/dist/metrics.js

@@ -1,43 +0,0 @@
-// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
-// Caracal, a product of Garudex Labs
-//
-// Prometheus text-format renderer for Caracal counter snapshots.
-import { devLogMetrics } from './logging.js';
-function renderCounters(counters) {
-    const lines = [];
-    for (const c of counters) {
-        lines.push(`# HELP ${c.name} ${c.help}`);
-        lines.push(`# TYPE ${c.name} counter`);
-        lines.push(`${c.name} ${c.value}`);
-    }
-    return lines.join('\n') + '\n';
-}
-function renderGauges(gauges) {
-    const lines = [];
-    for (const g of gauges) {
-        lines.push(`# HELP ${g.name} ${g.help}`);
-        lines.push(`# TYPE ${g.name} gauge`);
-        lines.push(`${g.name} ${g.value}`);
-    }
-    return lines.join('\n') + '\n';
-}
-/** Render dev-log + (optional) audit counters in Prometheus text format. */
-export function renderObservabilityMetrics(audit) {
-    const log = devLogMetrics();
-    const counters = [
-        { name: 'caracal_log_emitted_total', help: 'Dev log records emitted', value: log.emitted },
-        { name: 'caracal_log_dropped_total', help: 'Dev log records dropped due to backpressure', value: log.dropped },
-        { name: 'caracal_log_sampled_total', help: 'Debug log records dropped by sampler', value: log.sampled },
-    ];
-    if (audit) {
-        const a = audit.snapshot();
-        counters.push({ name: 'caracal_audit_emitted_total', help: 'Audit events accepted into buffer', value: a.emitted }, { name: 'caracal_audit_dropped_total', help: 'Audit events dropped due to full buffer', value: a.dropped }, { name: 'caracal_audit_persisted_total', help: 'Audit events spilled to disk for later replay', value: a.persisted }, { name: 'caracal_audit_drained_total', help: 'Audit events replayed from disk', value: a.drained }, { name: 'caracal_audit_sink_errors_total', help: 'Audit sink (XADD) errors', value: a.sink_errors });
-        const gauges = [
-            { name: 'caracal_audit_queue_depth', help: 'Audit buffer depth', value: a.queue_depth },
-            { name: 'caracal_audit_queue_cap', help: 'Audit buffer capacity', value: a.queue_cap },
-        ];
-        return renderCounters(counters) + renderGauges(gauges);
-    }
-    return renderCounters(counters);
-}
-//# sourceMappingURL=metrics.js.map

package/dist/metrics.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../src/metrics.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAK7C,SAAS,cAAc,CAAC,QAAmB;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,MAAiB;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B,CAAC,KAAmB;IAC5D,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAc;QAC1B,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE;QAC1F,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,6CAA6C,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE;QAC9G,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,sCAAsC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE;KACxG,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CACX,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EACpG,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,yCAAyC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAC1G,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,+CAA+C,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,EACpH,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAClG,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,CACpG,CAAC;QACF,MAAM,MAAM,GAAc;YACxB,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;YACvF,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE;SACvF,CAAC;QACF,OAAO,cAAc,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC"}

package/dist/operatorAssertion.d.ts

@@ -1,8 +0,0 @@
-export interface OperatorIdentity {
-    id: string;
-    name: string;
-    email: string;
-}
-export declare function signOperatorAssertion(adminToken: string, identity: OperatorIdentity, exp: number): string;
-export declare function verifyOperatorAssertion(adminToken: string, assertion: string, now: number): OperatorIdentity | null;
-//# sourceMappingURL=operatorAssertion.d.ts.map

package/dist/operatorAssertion.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"operatorAssertion.d.ts","sourceRoot":"","sources":["../src/operatorAssertion.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;CACd;AAsBD,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAGzG;AAMD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAqBnH"}

package/dist/operatorAssertion.js

@@ -1,70 +0,0 @@
-// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
-// Caracal, a product of Garudex Labs
-//
-// Deterministic signing and verification of the Console BFF's operator-identity assertion that carries the authenticated operator's display name and email to the API for creator attribution.
-import { createHmac, timingSafeEqual } from 'node:crypto';
-// The domain-separation label for the operator-identity MAC, versioned and distinct from the
-// account assertion so the two signals can never be confused for one another. It is keyed by the
-// deployment admin token both the BFF and API hold, so forging it needs a credential whose holder
-// already has full deployment authority - it grants nothing new, exactly like the account assertion.
-const OPERATOR_ASSERTION_LABEL = 'caracal:operator:v1';
-const OPERATOR_ASSERTION_PREFIX = 'v1';
-// A defensive ceiling on the serialized identity so a malformed or hostile header cannot blow up
-// the MAC computation. A name and email pair is well within this.
-const MAX_IDENTITY_BYTES = 1024;
-function b64url(value) {
-    return Buffer.from(value, 'utf8').toString('base64url');
-}
-function fromB64url(value) {
-    try {
-        return Buffer.from(value, 'base64url').toString('utf8');
-    }
-    catch {
-        return null;
-    }
-}
-function mac(adminToken, payload, exp) {
-    return createHmac('sha256', adminToken).update(`${OPERATOR_ASSERTION_LABEL}:${payload}:${exp}`).digest('base64url');
-}
-// Signs an assertion binding the operator's identity to an expiry. The result is a compact dotted
-// token `v1.<b64url(json)>.<exp>.<mac>` the BFF attaches to each proxied request; the API recomputes
-// the MAC with the same admin token to verify it. exp is an absolute Unix time in seconds, kept short
-// by the caller so a captured assertion is only briefly replayable.
-export function signOperatorAssertion(adminToken, identity, exp) {
-    const payload = b64url(JSON.stringify({ id: identity.id, name: identity.name, email: identity.email }));
-    return `${OPERATOR_ASSERTION_PREFIX}.${payload}.${exp}.${mac(adminToken, payload, exp)}`;
-}
-// Verifies an assertion and returns the bound identity, or null if it is malformed, expired, or its
-// MAC does not match - so the caller attributes to the operator only on a positively verified
-// assertion and otherwise falls back to the admin token's own name. The MAC comparison is
-// constant-time. now is an injectable Unix time in seconds.
-export function verifyOperatorAssertion(adminToken, assertion, now) {
-    const parts = assertion.split('.');
-    if (parts.length !== 4 || parts[0] !== OPERATOR_ASSERTION_PREFIX)
-        return null;
-    const payload = parts[1];
-    if (payload.length === 0 || Buffer.byteLength(payload, 'utf8') > MAX_IDENTITY_BYTES)
-        return null;
-    const exp = Number(parts[2]);
-    if (!Number.isInteger(exp) || exp <= now)
-        return null;
-    const expected = mac(adminToken, payload, exp);
-    const got = parts[3];
-    const expectedBuf = Buffer.from(expected, 'utf8');
-    const gotBuf = Buffer.from(got, 'utf8');
-    if (expectedBuf.length !== gotBuf.length || !timingSafeEqual(expectedBuf, gotBuf))
-        return null;
-    const json = fromB64url(payload);
-    if (json === null)
-        return null;
-    try {
-        const parsed = JSON.parse(json);
-        if (typeof parsed.id !== 'string' || typeof parsed.name !== 'string' || typeof parsed.email !== 'string')
-            return null;
-        return { id: parsed.id, name: parsed.name, email: parsed.email };
-    }
-    catch {
-        return null;
-    }
-}
-//# sourceMappingURL=operatorAssertion.js.map

package/dist/operatorAssertion.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"operatorAssertion.js","sourceRoot":"","sources":["../src/operatorAssertion.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,+LAA+L;AAE/L,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEzD,6FAA6F;AAC7F,iGAAiG;AACjG,kGAAkG;AAClG,qGAAqG;AACrG,MAAM,wBAAwB,GAAG,qBAAqB,CAAA;AACtD,MAAM,yBAAyB,GAAG,IAAI,CAAA;AAEtC,iGAAiG;AACjG,kEAAkE;AAClE,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAQ/B,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,UAAkB,EAAE,OAAe,EAAE,GAAW;IAC3D,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,GAAG,wBAAwB,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;AACrH,CAAC;AAED,kGAAkG;AAClG,qGAAqG;AACrG,sGAAsG;AACtG,oEAAoE;AACpE,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,QAA0B,EAAE,GAAW;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACvG,OAAO,GAAG,yBAAyB,IAAI,OAAO,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,CAAA;AAC1F,CAAC;AAED,oGAAoG;AACpG,8FAA8F;AAC9F,0FAA0F;AAC1F,4DAA4D;AAC5D,MAAM,UAAU,uBAAuB,CAAC,UAAkB,EAAE,SAAiB,EAAE,GAAW;IACxF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,yBAAyB;QAAE,OAAO,IAAI,CAAA;IAC7E,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACxB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,kBAAkB;QAAE,OAAO,IAAI,CAAA;IAChG,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG;QAAE,OAAO,IAAI,CAAA;IACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACpB,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACvC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9F,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IAChC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA8B,CAAA;QAC5D,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACrH,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/telemetry.d.ts

@@ -1,10 +0,0 @@
-type Log = {
-    error?: (msg: string, meta?: Record<string, unknown>) => void;
-};
-type FastifyLike = {
-    addHook: (name: string, handler: (...args: unknown[]) => unknown) => void;
-};
-export declare function initNodeTelemetry(serviceName: string, log?: Log): () => Promise<void>;
-export declare function instrumentFastifyApp(app: FastifyLike, serviceName: string): void;
-export {};
-//# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAWA,KAAK,GAAG,GAAG;IAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CAAE,CAAA;AAC5E,KAAK,WAAW,GAAG;IACjB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,KAAK,IAAI,CAAA;CAC1E,CAAA;AAID,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAmBrF;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAyChF"}