@felan-ai/daemon 0.0.0-stage → 0.1.0

package/dist/remote/text.js

@@ -0,0 +1,188 @@
+import { redact } from '../logger.js';
+const alphabet = /[A-Za-z0-9_-]/u;
+const patterns = [
+    { prefix: 'fln_pat_', minimum: 1 },
+    { prefix: 'AIza', minimum: 20 },
+    ...['sk-', 'pk-', 'rk-', 'ghp_', 'gho_', 'ghu_', 'ghs_', 'ghr_', 'github_pat_', 'xoxb-', 'xoxa-', 'xoxp-', 'xoxr-', 'AKIA'].map(prefix => ({ prefix, minimum: 8 })),
+];
+export class RemoteTextSanitizer {
+    streams = new Map();
+    push(event) {
+        const key = JSON.stringify([event.session, event.stream.id, event.stream.message, event.stream.kind]);
+        let state = this.streams.get(key);
+        if (!state) {
+            if (event.stream.offset !== 0 || this.streams.size >= 64)
+                return;
+            state = { event: structuredClone(event), pending: '', nextOffset: 0, previous: '',
+                assignment: { key: '', sensitive: false, separated: false, query: false } };
+            this.streams.set(key, state);
+        }
+        if (state.dropped)
+            return;
+        if (event.stream.offset !== state.nextOffset) {
+            state.pending = '';
+            state.dropped = true;
+            return;
+        }
+        state.nextOffset += Array.from(event.text).length;
+        return this.drain(state, state.pending + this.maskAssignments(state.assignment, event.text));
+    }
+    maskAssignments(state, input) {
+        let output = '';
+        for (const point of input) {
+            if (state.value === 'waiting') {
+                if (/\s/u.test(point)) {
+                    output += point;
+                    continue;
+                }
+                state.value = point === '"' || point === "'" ? point : state.header ? 'header' : 'unquoted';
+                if (state.value === '"' || state.value === "'") {
+                    output += point;
+                    continue;
+                }
+            }
+            if (state.value) {
+                const terminator = state.value === 'header' ? /[\r\n,;}&]/u.test(point)
+                    : state.value === 'unquoted' ? /[\s,;}&]/u.test(point) : point === state.value;
+                if (!terminator) {
+                    output += '*';
+                    continue;
+                }
+                const quoted = state.value === '"' || state.value === "'";
+                delete state.value;
+                state.key = '';
+                state.sensitive = false;
+                state.separated = false;
+                state.query = false;
+                if (quoted) {
+                    output += point;
+                    continue;
+                }
+            }
+            if (/[\w-]/u.test(point)) {
+                if (state.separated) {
+                    state.key = '';
+                    state.sensitive = false;
+                    state.query = false;
+                }
+                state.separated = false;
+                state.key = (state.key + point).slice(-32);
+                state.sensitive ||= /api[_-]?key|token|secret|password|authorization|credential/iu.test(state.key);
+            }
+            else if (/\s/u.test(point) || point === '"' || point === "'") {
+                state.separated = true;
+            }
+            else {
+                if ((point === ':' || point === '=') && (state.sensitive || state.query && /^(?:code|state|key)$/iu.test(state.key))) {
+                    state.value = 'waiting';
+                    state.header = /authorization/iu.test(state.key);
+                }
+                state.key = '';
+                state.sensitive = false;
+                state.separated = false;
+                state.query = point === '?' || point === '&';
+            }
+            output += point;
+        }
+        return output;
+    }
+    drain(state, input, final = false) {
+        state.pending = '';
+        const previous = state.previous;
+        let output = '';
+        let index = 0;
+        for (; index < input.length;) {
+            const point = String.fromCodePoint(input.codePointAt(index));
+            if (state.bearer && /\s/u.test(point)) {
+                output += point;
+                index += point.length;
+                continue;
+            }
+            if (state.bearer) {
+                state.bearer = false;
+                state.mask = /[^\s,;]/u;
+            }
+            if (state.mask?.test(point)) {
+                output += '*';
+                index += point.length;
+                continue;
+            }
+            state.mask = undefined;
+            const rest = input.slice(index);
+            if (/\w/u.test(index ? input[index - 1] : previous)) {
+                output += point;
+                index += point.length;
+                continue;
+            }
+            if (/^bearer\s/iu.test(rest)) {
+                const prefix = rest.slice(0, 7);
+                output += prefix;
+                index += prefix.length;
+                state.bearer = true;
+                continue;
+            }
+            const pattern = patterns.find(pattern => rest.startsWith(pattern.prefix));
+            if (pattern) {
+                let end = pattern.prefix.length;
+                while (end < rest.length && end < pattern.prefix.length + pattern.minimum && alphabet.test(rest[end]))
+                    end++;
+                if (end === pattern.prefix.length + pattern.minimum) {
+                    output += '*'.repeat(end);
+                    index += end;
+                    state.mask = alphabet;
+                    continue;
+                }
+                if (end === rest.length && !final) {
+                    state.pending = rest;
+                    break;
+                }
+                output += rest.slice(0, end);
+                index += end;
+                continue;
+            }
+            const jwt = /^eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u.exec(rest);
+            if (jwt) {
+                output += '*'.repeat(jwt[0].length);
+                index += jwt[0].length;
+                state.mask = alphabet;
+                continue;
+            }
+            const possibleJwt = /^eyJ[A-Za-z0-9_-]*$/u.test(rest)
+                || /^eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*$/u.test(rest)
+                || /^eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+\.$/u.test(rest);
+            if (!final && (possibleJwt || 'eyJ'.startsWith(rest) || patterns.some(pattern => pattern.prefix.startsWith(rest)) || 'bearer'.startsWith(rest.toLowerCase()))) {
+                // Withhold possible credentials until their minimum length and shape can be decided.
+                state.pending = rest;
+                break;
+            }
+            output += point;
+            index += point.length;
+        }
+        if (index)
+            state.previous = input[index - 1];
+        if (!output)
+            return;
+        // A carried word character must not gain a false boundary at the chunk start.
+        const contextual = (/\w/u.test(previous) ? '_' : '') + previous + output;
+        const result = { ...state.event, stream: { ...state.event.stream }, text: redact(contextual) === contextual ? output : '*'.repeat(Array.from(output).length) };
+        state.event.stream.offset += Array.from(output).length;
+        return result;
+    }
+    discard(session) { for (const [key, state] of this.streams)
+        if (state.event.session === session)
+            this.streams.delete(key); }
+    clear() { this.streams.clear(); }
+    finish(session, message) {
+        const result = [];
+        for (const [key, state] of this.streams) {
+            if (state.event.session !== session || state.event.stream.message !== message)
+                continue;
+            const event = this.drain(state, state.pending, true);
+            if (event)
+                result.push(event);
+            this.streams.delete(key);
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=text.js.map

package/dist/remote/text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../../src/remote/text.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC;AAClC,MAAM,QAAQ,GAAG;IACf,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE;IAClC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;IAC/B,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;CACpK,CAAC;AAoBF,MAAM,OAAO,mBAAmB;IACb,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,IAAI,CAAC,KAAsB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACtG,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE;gBAAE,OAAO;YACjE,KAAK,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE;gBAC/E,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9G,CAAC;QACD,IAAI,KAAK,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;YAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;YAAC,OAAO;QAAC,CAAC;QACnG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/F,CAAC;IACO,eAAe,CAAC,KAAiB,EAAE,KAAa;QACtD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAAC,MAAM,IAAI,KAAK,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACrD,KAAK,CAAC,KAAK,GAAG,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;gBAC5F,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,EAAE,CAAC;oBAAC,MAAM,IAAI,KAAK,CAAC;oBAAC,SAAS;gBAAC,CAAC;YAChF,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;oBACrE,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;gBACjF,IAAI,CAAC,UAAU,EAAE,CAAC;oBAAC,MAAM,IAAI,GAAG,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC;gBAC1D,OAAO,KAAK,CAAC,KAAK,CAAC;gBACnB,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;gBAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;gBAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;gBAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;gBACtF,IAAI,MAAM,EAAE,CAAC;oBAAC,MAAM,IAAI,KAAK,CAAC;oBAAC,SAAS;gBAAC,CAAC;YAC5C,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;oBAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;oBAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;oBAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;gBAAC,CAAC;gBACtF,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;gBACxB,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3C,KAAK,CAAC,SAAS,KAAK,8DAA8D,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrG,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;gBAC/D,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACrH,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;oBAAC,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC5E,CAAC;gBACD,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;gBAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;gBAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;gBAAC,KAAK,CAAC,KAAK,GAAG,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC;YACjH,CAAC;YACD,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACO,KAAK,CAAC,KAAa,EAAE,KAAa,EAAE,KAAK,GAAG,KAAK;QACvD,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAE,CAAC,CAAC;YAC9D,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC;gBAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC5F,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;gBAAC,KAAK,CAAC,IAAI,GAAG,UAAU,CAAC;YAAC,CAAC;YACpE,IAAI,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAC,MAAM,IAAI,GAAG,CAAC;gBAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC;YAChF,KAAK,CAAC,IAAI,GAAG,SAAS,CAAC;YACvB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC;gBAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAC,SAAS;YACnD,CAAC;YACD,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAAC,MAAM,IAAI,MAAM,CAAC;gBAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC;gBAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;gBAAC,SAAS;YAC3G,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1E,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBAChC,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAE,CAAC;oBAAE,GAAG,EAAE,CAAC;gBAC9G,IAAI,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;oBACpD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAAC,KAAK,IAAI,GAAG,CAAC;oBAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC;oBAAC,SAAS;gBAC3E,CAAC;gBACD,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;oBAAC,MAAM;gBAAC,CAAC;gBACnE,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAAC,KAAK,IAAI,GAAG,CAAC;gBAAC,SAAS;YACvD,CAAC;YACD,MAAM,GAAG,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChF,IAAI,GAAG,EAAE,CAAC;gBAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1G,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;mBAChD,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;mBACpD,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC9J,qFAAqF;gBACrF,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;gBAAC,MAAM;YAC9B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC;YAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACzC,CAAC;QACD,IAAI,KAAK;YAAE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,8EAA8E;QAC9E,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,GAAG,MAAM,CAAC;QACzE,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/J,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACvD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,OAAe,IAAU,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1I,KAAK,KAAW,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,OAAe,EAAE,OAAe;QACrC,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO;gBAAE,SAAS;YACxF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACrD,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/remote/token.d.ts

@@ -0,0 +1,39 @@
+import { type HostTokenError, type HostTokenResponse } from '@felan-ai/session-protocol';
+import { type RemoteClock, type RetryOptions } from './backoff.js';
+export type HostTokenFailureKind = 'invalid_pat' | 'not_a_member' | 'host_revoked' | 'unsupported_schema' | 'unavailable' | 'retry';
+export declare class HostTokenExchangeError extends Error {
+    readonly kind: HostTokenFailureKind;
+    readonly supported?: HostTokenError['supported'];
+    readonly retryAfterMs?: number | undefined;
+    readonly rateLimited: boolean;
+    readonly retryable: boolean;
+    constructor(kind: HostTokenFailureKind, message: string, supported?: HostTokenError['supported'], retryAfterMs?: number | undefined, rateLimited?: boolean);
+}
+export type HostTokenInfo = Omit<HostTokenResponse, 'token'>;
+export interface HostTokenProvider {
+    token(): Promise<string>;
+    cachedToken(): string | null;
+    current(): HostTokenInfo | undefined;
+    onChange(listener: (token: string, info: HostTokenInfo) => void): () => void;
+}
+export interface HostTokenSourceOptions extends RetryOptions {
+    apiUrl: string;
+    pat: string;
+    installId: string;
+    daemonVersion: string;
+    name?: string;
+    fetch?: typeof fetch;
+    clock?: RemoteClock;
+    requestTimeoutMs?: number;
+}
+export declare class HostTokenSource implements HostTokenProvider {
+    #private;
+    constructor(options: HostTokenSourceOptions);
+    current(): HostTokenInfo | undefined;
+    cachedToken(): string | null;
+    onChange(listener: (token: string, info: HostTokenInfo) => void): () => void;
+    token(): Promise<string>;
+    invalidate(): void;
+    stop(): void;
+}
+//# sourceMappingURL=token.d.ts.map

package/dist/remote/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/remote/token.ts"],"names":[],"mappings":"AACA,OAAO,EAEiB,KAAK,cAAc,EAAE,KAAK,iBAAiB,EAClE,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAqC,KAAK,WAAW,EAAE,KAAK,YAAY,EAAoB,MAAM,cAAc,CAAC;AAExH,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,cAAc,GAAG,cAAc,GAAG,oBAAoB,GAAG,aAAa,GAAG,OAAO,CAAC;AACpI,qBAAa,sBAAuB,SAAQ,KAAK;IAG7C,QAAQ,CAAC,IAAI,EAAE,oBAAoB;IAEnC,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW,CAAC;IAChD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM;IAC9B,QAAQ,CAAC,WAAW;IANtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEjB,IAAI,EAAE,oBAAoB,EACnC,OAAO,EAAE,MAAM,EACN,SAAS,CAAC,EAAE,cAAc,CAAC,WAAW,CAAC,EACvC,YAAY,CAAC,EAAE,MAAM,YAAA,EACrB,WAAW,UAAQ;CAM/B;AAED,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;AAC7D,MAAM,WAAW,iBAAiB;IAChC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,WAAW,IAAI,MAAM,GAAG,IAAI,CAAC;IAC7B,OAAO,IAAI,aAAa,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;CAC9E;AACD,MAAM,WAAW,sBAAuB,SAAQ,YAAY;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAgCD,qBAAa,eAAgB,YAAW,iBAAiB;;gBAgB3C,OAAO,EAAE,sBAAsB;IAM3C,OAAO,IAAI,aAAa,GAAG,SAAS;IAMpC,WAAW,IAAI,MAAM,GAAG,IAAI;IAK5B,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,KAAK,IAAI,GAAG,MAAM,IAAI;IAKtE,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAiB9B,UAAU,IAAI,IAAI;IAclB,IAAI,IAAI,IAAI;CAuFb"}

package/dist/remote/token.js

@@ -0,0 +1,238 @@
+import { hostname } from 'node:os';
+import { PROTOCOL_VERSION, ROW_SCHEMA_VERSION, parseHostTokenRequest, parseHostTokenResponse, parseSchema, HostTokenErrorSchema, } from '@felan-ai/session-protocol';
+import { redact } from '../logger.js';
+import { retryDelay, schedule, systemClock } from './backoff.js';
+export class HostTokenExchangeError extends Error {
+    kind;
+    supported;
+    retryAfterMs;
+    rateLimited;
+    retryable;
+    constructor(kind, message, supported, retryAfterMs, rateLimited = false) {
+        super(redact(message));
+        this.kind = kind;
+        this.supported = supported;
+        this.retryAfterMs = retryAfterMs;
+        this.rateLimited = rateLimited;
+        this.name = 'HostTokenExchangeError';
+        this.retryable = !['invalid_pat', 'not_a_member', 'host_revoked', 'unsupported_schema'].includes(kind);
+    }
+}
+function endpoint(value) {
+    try {
+        const url = new URL(value);
+        if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+            throw new Error();
+        if (url.protocol !== 'https:' && !['localhost', '127.0.0.1', '[::1]', '::1'].includes(url.hostname))
+            throw new Error();
+        return url.toString().replace(/\/$/u, '');
+    }
+    catch {
+        throw new HostTokenExchangeError('unavailable', 'Remote API URL must use HTTPS (HTTP is allowed only on loopback).');
+    }
+}
+function hostName(value) {
+    let result = '';
+    let bytes = 0;
+    for (const point of value) {
+        const size = Buffer.byteLength(point);
+        if (bytes + size > 128)
+            break;
+        result += point;
+        bytes += size;
+    }
+    return result;
+}
+function retryAfter(value, now, cap) {
+    if (!value)
+        return undefined;
+    const seconds = /^\d+(?:\.\d+)?$/u.test(value.trim()) ? Number(value) : NaN;
+    const delay = Number.isFinite(seconds) ? seconds * 1_000 : Date.parse(value) - now;
+    return Number.isFinite(delay) ? Math.min(cap, Math.max(0, delay)) : undefined;
+}
+export class HostTokenSource {
+    #options;
+    #url;
+    #clock;
+    #response;
+    #inflight;
+    #abort;
+    #timer;
+    #deadline;
+    #listeners = new Set();
+    #failure;
+    #retryAt = 0;
+    #attempt = 0;
+    #generation = 0;
+    #stopped = false;
+    constructor(options) {
+        this.#options = options;
+        this.#url = endpoint(options.apiUrl);
+        this.#clock = options.clock ?? systemClock;
+    }
+    current() {
+        if (!this.#response)
+            return undefined;
+        const { token: _, ...info } = this.#response;
+        return structuredClone(info);
+    }
+    cachedToken() {
+        if (this.#stopped || (this.#failure && !this.#failure.retryable))
+            return null;
+        return this.#response && this.#clock.now() < this.#response.expiresAt ? this.#response.token : null;
+    }
+    onChange(listener) {
+        this.#listeners.add(listener);
+        return () => { this.#listeners.delete(listener); };
+    }
+    async token() {
+        if (this.#stopped)
+            throw new HostTokenExchangeError('unavailable', 'Host token source is stopped.');
+        if (this.#failure && !this.#failure.retryable)
+            throw this.#failure;
+        if (this.#response && this.#clock.now() < this.#response.refreshAt)
+            return this.#response.token;
+        if (this.#clock.now() < this.#retryAt && this.#failure) {
+            const cached = this.cachedToken();
+            if (cached)
+                return cached;
+            throw this.#failure;
+        }
+        if (this.#inflight)
+            return this.#inflight;
+        const generation = this.#generation;
+        const pending = this.#exchange(generation);
+        this.#inflight = pending;
+        try {
+            return await pending;
+        }
+        finally {
+            if (this.#inflight === pending)
+                this.#inflight = undefined;
+        }
+    }
+    invalidate() {
+        this.#generation++;
+        this.#abort?.abort();
+        this.#abort = undefined;
+        if (this.#deadline)
+            this.#clock.clearTimeout(this.#deadline);
+        this.#deadline = undefined;
+        this.#inflight = undefined;
+        this.#response = undefined;
+        this.#failure = undefined;
+        this.#retryAt = 0;
+        this.#attempt = 0;
+        this.#clearTimer();
+    }
+    stop() {
+        this.#stopped = true;
+        this.invalidate();
+        this.#listeners.clear();
+    }
+    #clearTimer() {
+        if (this.#timer)
+            this.#clock.clearTimeout(this.#timer);
+        this.#timer = undefined;
+    }
+    #renewAt(at) {
+        this.#clearTimer();
+        if (!this.#stopped)
+            this.#timer = schedule(this.#clock, () => {
+                this.#timer = undefined;
+                void this.token().catch(() => { });
+            }, Math.max(1, at - this.#clock.now()));
+    }
+    async #exchange(generation) {
+        const controller = new AbortController();
+        this.#abort = controller;
+        const timeout = schedule(this.#clock, () => controller.abort(), this.#options.requestTimeoutMs ?? 15_000);
+        this.#deadline = timeout;
+        try {
+            let request;
+            try {
+                request = parseHostTokenRequest({
+                    installId: this.#options.installId, name: hostName(this.#options.name ?? hostname()),
+                    daemonVersion: this.#options.daemonVersion, protocol: PROTOCOL_VERSION, rowSchemaVersion: ROW_SCHEMA_VERSION,
+                });
+            }
+            catch {
+                throw new HostTokenExchangeError('unavailable', 'Invalid host token request.');
+            }
+            const response = await (this.#options.fetch ?? fetch)(`${this.#url}/api/v1/hosts/token`, {
+                method: 'POST', headers: { Authorization: `Bearer ${this.#options.pat}`, 'Content-Type': 'application/json' },
+                body: JSON.stringify(request), signal: controller.signal, redirect: 'error',
+            });
+            const body = await response.json().catch(() => undefined);
+            if (response.status !== 200)
+                throw this.#httpError(response, body);
+            let parsed;
+            try {
+                parsed = parseHostTokenResponse(body);
+                endpoint(parsed.supabase.url);
+                if (parsed.expiresAt <= this.#clock.now())
+                    throw new Error();
+            }
+            catch {
+                throw new HostTokenExchangeError('unavailable', 'Invalid host token response.');
+            }
+            if (generation !== this.#generation || this.#stopped)
+                throw new HostTokenExchangeError('unavailable', 'Host token exchange was cancelled.');
+            this.#response = parsed;
+            this.#failure = undefined;
+            this.#attempt = 0;
+            this.#retryAt = 0;
+            this.#renewAt(parsed.refreshAt);
+            const info = this.current();
+            for (const listener of this.#listeners) {
+                try {
+                    listener(parsed.token, info);
+                }
+                catch { /* observers cannot invalidate a successful exchange */ }
+            }
+            return parsed.token;
+        }
+        catch (error) {
+            const failure = error instanceof HostTokenExchangeError ? error : new HostTokenExchangeError('retry', 'Host token exchange is temporarily unavailable.');
+            if (generation !== this.#generation || this.#stopped)
+                throw new HostTokenExchangeError('unavailable', 'Host token exchange was cancelled.');
+            this.#failure = failure;
+            if (failure.retryable) {
+                this.#retryAt = this.#clock.now() + Math.max(retryDelay(this.#attempt++, this.#options), failure.retryAfterMs ?? 0);
+                this.#renewAt(this.#retryAt);
+                const cached = this.cachedToken();
+                if (cached)
+                    return cached;
+            }
+            else
+                this.#clearTimer();
+            throw failure;
+        }
+        finally {
+            this.#clock.clearTimeout(timeout);
+            if (this.#deadline === timeout)
+                this.#deadline = undefined;
+            if (this.#abort === controller)
+                this.#abort = undefined;
+        }
+    }
+    #httpError(response, body) {
+        let parsed;
+        try {
+            parsed = parseSchema(HostTokenErrorSchema, body);
+        }
+        catch { /* error bodies are not a trusted diagnostic source */ }
+        if (response.status === 401)
+            return new HostTokenExchangeError('invalid_pat', 'Personal access token is invalid or revoked.');
+        if (response.status === 403 && parsed?.code === 'not_a_member')
+            return new HostTokenExchangeError('not_a_member', 'Host owner is no longer a team member.');
+        if (response.status === 403 && parsed?.code === 'host_revoked')
+            return new HostTokenExchangeError('host_revoked', 'Host has been revoked.');
+        if (response.status === 426)
+            return new HostTokenExchangeError('unsupported_schema', 'Remote publication requires a supported schema version.', parsed?.supported);
+        if (response.status === 429 || response.status >= 500)
+            return new HostTokenExchangeError('retry', 'Host token exchange is temporarily unavailable.', undefined, retryAfter(response.headers.get('Retry-After'), this.#clock.now(), this.#options.capMs ?? 60_000), response.status === 429);
+        return new HostTokenExchangeError('unavailable', 'Host token exchange was refused.');
+    }
+}
+//# sourceMappingURL=token.js.map

package/dist/remote/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/remote/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EACL,gBAAgB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,WAAW,EAChG,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAyD,MAAM,cAAc,CAAC;AAGxH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGpC;IAEA;IACA;IACA;IANF,SAAS,CAAU;IAC5B,YACW,IAA0B,EACnC,OAAe,EACN,SAAuC,EACvC,YAAqB,EACrB,cAAc,KAAK;QAE5B,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QANd,SAAI,GAAJ,IAAI,CAAsB;QAE1B,cAAS,GAAT,SAAS,CAA8B;QACvC,iBAAY,GAAZ,YAAY,CAAS;QACrB,gBAAW,GAAX,WAAW,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzG,CAAC;CACF;AAoBD,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC7H,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QACvH,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,sBAAsB,CAAC,aAAa,EAAE,mEAAmE,CAAC,CAAC;IACvH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,IAAI,GAAG,GAAG;YAAE,MAAM;QAC9B,MAAM,IAAI,KAAK,CAAC;QAChB,KAAK,IAAI,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB,EAAE,GAAW,EAAE,GAAW;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;IACnF,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,MAAM,OAAO,eAAe;IAC1B,QAAQ,CAAyB;IACjC,IAAI,CAAS;IACb,MAAM,CAAc;IACpB,SAAS,CAAgC;IACzC,SAAS,CAA8B;IACvC,MAAM,CAA8B;IACpC,MAAM,CAA0B;IAChC,SAAS,CAA0B;IACnC,UAAU,GAAG,IAAI,GAAG,EAAgD,CAAC;IACrE,QAAQ,CAAqC;IAC7C,QAAQ,GAAG,CAAC,CAAC;IACb,QAAQ,GAAG,CAAC,CAAC;IACb,WAAW,GAAG,CAAC,CAAC;IAChB,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,OAA+B;QACzC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC;IAC7C,CAAC;IAED,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9E,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,CAAC;IAED,QAAQ,CAAC,QAAsD;QAC7D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;QACpG,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;QACnE,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAChG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,MAAM,IAAI,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC;QACzB,IAAI,CAAC;YAAC,OAAO,MAAM,OAAO,CAAC;QAAC,CAAC;gBACrB,CAAC;YAAC,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO;gBAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAAC,CAAC;IACzE,CAAC;IAED,UAAU;QACR,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAED,QAAQ,CAAC,EAAU;QACjB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;gBAC3D,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;gBACxB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACpC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB;QAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,MAAM,CAAC,CAAC;QAC1G,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,qBAAqB,CAAC;oBAC9B,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;oBACpF,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB;iBAC7G,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,sBAAsB,CAAC,aAAa,EAAE,6BAA6B,CAAC,CAAC;YAAC,CAAC;YAC3F,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,qBAAqB,EAAE;gBACvF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC7G,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO;aAC5E,CAAC,CAAC;YACH,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACnE,IAAI,MAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBACtC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC9B,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,sBAAsB,CAAC,aAAa,EAAE,8BAA8B,CAAC,CAAC;YAAC,CAAC;YAC5F,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,sBAAsB,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;YAC5I,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;YACxB,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAClB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAG,CAAC;YAC7B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACvC,IAAI,CAAC;oBAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACzG,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC,OAAO,EAAE,iDAAiD,CAAC,CAAC;YACzJ,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,sBAAsB,CAAC,aAAa,EAAE,oCAAoC,CAAC,CAAC;YAC5I,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;YACxB,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC;gBACpH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClC,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;YAC5B,CAAC;;gBAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1B,MAAM,OAAO,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO;gBAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;YAC3D,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;gBAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,UAAU,CAAC,QAAkB,EAAE,IAAa;QAC1C,IAAI,MAAkC,CAAC;QACvC,IAAI,CAAC;YAAC,MAAM,GAAG,WAAW,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sDAAsD,CAAC,CAAC;QAC1H,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,sBAAsB,CAAC,aAAa,EAAE,8CAA8C,CAAC,CAAC;QAC9H,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,EAAE,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,sBAAsB,CAAC,cAAc,EAAE,wCAAwC,CAAC,CAAC;QAC5J,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,EAAE,IAAI,KAAK,cAAc;YAAE,OAAO,IAAI,sBAAsB,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;QAC5I,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,sBAAsB,CAAC,oBAAoB,EAAE,yDAAyD,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACnK,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,IAAI,sBAAsB,CACtF,OAAO,EAAE,iDAAiD,EAAE,SAAS,EACrE,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,EACjG,QAAQ,CAAC,MAAM,KAAK,GAAG,CACxB,CAAC;QACF,OAAO,IAAI,sBAAsB,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAC;IACvF,CAAC;CACF"}

package/dist/runtime-factory.d.ts

@@ -0,0 +1,12 @@
+import type { AgentRuntime } from '@felan-ai/agent-core';
+export interface RuntimeStorageRequest {
+    readonly cwd: string;
+    readonly agentDir: string;
+    readonly rootSessionId: string;
+    readonly sessionStorageRoot: string;
+    readonly agentStorageRoot: string;
+    readonly pathAccess: 'host';
+}
+export type RuntimeFactory = (request: RuntimeStorageRequest) => AgentRuntime;
+export declare function createRuntimeStorageRequest(cwd: string, agentDir: string, rootSessionId: string): RuntimeStorageRequest;
+//# sourceMappingURL=runtime-factory.d.ts.map

package/dist/runtime-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-factory.d.ts","sourceRoot":"","sources":["../src/runtime-factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,cAAc,GAAG,CAC3B,OAAO,EAAE,qBAAqB,KAC3B,YAAY,CAAC;AAElB,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,qBAAqB,CAcvB"}

package/dist/runtime-factory.js

@@ -0,0 +1,12 @@
+import { join } from 'node:path';
+export function createRuntimeStorageRequest(cwd, agentDir, rootSessionId) {
+    return {
+        cwd,
+        agentDir,
+        rootSessionId,
+        pathAccess: 'host',
+        sessionStorageRoot: join(agentDir, 'storage', 'sessions', encodeURIComponent(rootSessionId)),
+        agentStorageRoot: join(agentDir, 'storage', 'agent'),
+    };
+}
+//# sourceMappingURL=runtime-factory.js.map

package/dist/runtime-factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-factory.js","sourceRoot":"","sources":["../src/runtime-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAgBjC,MAAM,UAAU,2BAA2B,CACzC,GAAW,EACX,QAAgB,EAChB,aAAqB;IAErB,OAAO;QACL,GAAG;QACH,QAAQ;QACR,aAAa;QACb,UAAU,EAAE,MAAM;QAClB,kBAAkB,EAAE,IAAI,CACtB,QAAQ,EACR,SAAS,EACT,UAAU,EACV,kBAAkB,CAAC,aAAa,CAAC,CAClC;QACD,gBAAgB,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/session-history.d.ts

@@ -0,0 +1,29 @@
+import { type SessionHistoryInfo, type SessionRef, type SessionsHistory, type SessionsRequestOptions } from '@felan-ai/agent-core';
+export interface SessionHistorySource {
+    /** Private locator, resolved only by the injected reader. Never returned to consumers. */
+    readonly key: string;
+    readonly sessionId: string;
+    readonly id?: string;
+    readonly root?: string;
+    readonly parent?: string;
+    readonly cwd: string;
+    readonly title: string;
+    readonly updatedAt: number;
+    readonly state: 'open' | 'closed';
+    readonly bytes?: number;
+    readonly fingerprint?: string;
+    readonly diagnostic?: SessionHistoryInfo['diagnostic'];
+}
+export interface CreateSessionHistoryBackendOptions {
+    readonly current: SessionRef;
+    readonly project: string;
+    /** Must include only sources visible to this session under current host policy. */
+    readonly inventory: (options: SessionsRequestOptions) => Promise<readonly SessionHistorySource[]>;
+    /** Must verify source ownership/identity and return one consistent, bounded byte snapshot. */
+    readonly read: (source: SessionHistorySource, options: {
+        readonly maxBytes: number;
+        readonly signal?: AbortSignal;
+    }) => Promise<Uint8Array>;
+}
+export declare function createSessionHistoryBackend(options: CreateSessionHistoryBackendOptions): SessionsHistory;
+//# sourceMappingURL=session-history.d.ts.map

package/dist/session-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-history.d.ts","sourceRoot":"","sources":["../src/session-history.ts"],"names":[],"mappings":"AAGA,OAAO,EAKL,KAAK,kBAAkB,EAEvB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC5B,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,oBAAoB;IACnC,0FAA0F;IAC1F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,sBAAsB,KAAK,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;IAClG,8FAA8F;IAC9F,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7I;AAyBD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,eAAe,CAgIxG"}