@fusengine/harness 0.1.43 → 0.1.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fusengine/harness",
-  "version": "0.1.43",
+  "version": "0.1.45",
   "description": "Harness-agnostic toolkit for AI coding agents: runtime harness detection (Claude Code, Codex, Cursor, Cline, Gemini, Aider...), pure policy core (env config, project/framework detection, SOLID/file-size limits, APEX freshness, guard patterns, portable prompts), cache, project memory, ref routing, state/locks, statusline, per-harness adapters (Claude/Cursor/Cline/Gemini) and a cli-mode harness-check binary. Bun-native, with a built dist for Node + bundlers.",
   "type": "module",
   "module": "src/index.ts",

package/dist/evaluate-CeivW6G0.mjs

@@ -1,477 +0,0 @@
-import { i as splitTarget, r as resolveMaxLines } from "./limits-CHn8AIL1.mjs";
-import { t as isCodeFile } from "./project-root-3kk7gCOp.mjs";
-//#region src/policy/detect-framework.ts
-/**
-* Detect the framework from a file path extension + content patterns.
-* Aligned with the fusengine require-solid-read detection (distinct from
-* {@link detectProjectType}, which scans config files on disk).
-*/
-function detectFramework(filePath, content) {
-	if (/\.(tsx?|jsx?|vue|svelte)$/.test(filePath) || /from ['"]react|useState|className=/.test(content)) {
-		if (/(page|layout|loading|error|route)\.(ts|tsx)$/.test(filePath) || /use client|use server/.test(content)) return "nextjs";
-		return "react";
-	}
-	if (/\.swift$/.test(filePath)) return "swift";
-	if (/\.php$/.test(filePath)) return "laravel";
-	if (/\.java$/.test(filePath)) return "java";
-	if (/\.go$/.test(filePath)) return "go";
-	if (/\.rb$/.test(filePath)) return "ruby";
-	if (/\.rs$/.test(filePath)) return "rust";
-	if (/\.css$/.test(filePath) || /@tailwind|@apply/.test(content)) return "tailwind";
-	return "generic";
-}
-//#endregion
-//#region src/policy/file-size.ts
-/**
-* Count physical lines — parity with the Python `enforce-file-size.py`
-* (`sum(1 for _ in f)`): every line counts (blanks and comments included), and a
-* single trailing newline does not add a phantom line. The SOLID ceiling is
-* measured on raw file length, not substantive code, to match the upstream plugin.
-*/
-function countLines(content) {
-	if (content === "") return 0;
-	return content.split("\n").length - (content.endsWith("\n") ? 1 : 0);
-}
-/**
-* Evaluate a file's line count against the SOLID limit.
-* @param lines - the file's line count
-* @param max - the limit (defaults to `resolveMaxLines()`)
-*/
-function evaluateFileSize(lines, max = resolveMaxLines()) {
-	if (lines <= max) return {
-		ok: true,
-		lines,
-		max,
-		message: null
-	};
-	return {
-		ok: false,
-		lines,
-		max,
-		message: `File has ${lines} lines (max: ${max}). Split into modules under ${splitTarget(max)} lines (Single Responsibility).`
-	};
-}
-//#endregion
-//#region src/policy/patterns.ts
-/**
-* Guard pattern data, ported verbatim from the fusengine git/install guards.
-* Note (faithful): `git push.*--force` also matches `--force-with-lease` —
-* preserved from the source guard.
-*/
-/** Destructive git operations to block outright. */
-const GIT_BLOCKED = [
-	/git push.*--force/,
-	/git push.*-f/,
-	/git reset.*--hard/,
-	/git clean.*-fd/,
-	/git branch.*-D/,
-	/git rebase.*--force/
-];
-/** Git operations that warrant a confirmation prompt. */
-const GIT_ASK = [
-	/git push/,
-	/git checkout/,
-	/git reset/,
-	/git rebase/,
-	/git merge/,
-	/git stash/,
-	/git clean/,
-	/git rm/,
-	/git mv/,
-	/git restore/,
-	/git revert/,
-	/git cherry-pick/,
-	/git commit/,
-	/git add/,
-	/git branch -d/
-];
-/** System-level package installs (need confirmation). */
-const SYSTEM_INSTALL = [
-	/brew install/,
-	/brew upgrade/,
-	/brew cask/,
-	/apt install/,
-	/apt-get install/,
-	/dnf install/,
-	/pacman -S/
-];
-/** Project-level package installs. */
-const PROJECT_INSTALL = [
-	/npm install/,
-	/npm i /,
-	/yarn add/,
-	/pnpm add/,
-	/pip install/,
-	/pip3 install/,
-	/composer require/,
-	/bun add/,
-	/bun install/,
-	/cargo install/,
-	/go install/,
-	/gem install/,
-	/pipx install/
-];
-/** True when `cmd` matches any pattern in `patterns`. */
-function matchPatterns(cmd, patterns) {
-	return patterns.some((re) => re.test(cmd));
-}
-//#endregion
-//#region src/policy/guards/security.ts
-/** Critical patterns that must always be blocked. */
-const CRITICAL_PATTERNS = [
-	/\brm\s+(?:-[a-z]*\s+)*-[a-z]*[rf][a-z]*\s+(?:-[a-z]+\s+)*(?:\/|~)(?:\s|$)/,
-	/:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/,
-	/\b(?:curl|wget)\b[^|]*\|\s*(?:sudo\s+)?(?:ba|z|da|k)?sh\b/,
-	/\bchmod\s+(?:-[a-zA-Z]+\s+)*777\s+\//,
-	/\bmkfs(?:\.[a-z0-9]+)?\b/,
-	/\bdd\b[^\n]*\bof=\/dev\/(?:r?disk|sd|hd|nvme|mmcblk|vd|xvd)/i,
-	/\bshred\b/,
-	/\bfdisk\b/,
-	/\bdiskutil\s+(?:erase|partitionDisk)/i,
-	/(?:>|>>)\s*\/dev\/(?:sda|hda|nvme)/,
-	/\brm\s+(?:-[a-z]*\s+)*-[a-z]*[rf][a-z]*\s+(?:-[a-z]+\s+)*\/(?:etc|usr|var|bin|sbin|boot|lib)\b/,
-	/(?:^|[\s;|&])sudo(?:[\s;|&]|$)/,
-	/(?:^|[\s;|&])su(?:[\s;|&]|$)/,
-	/(?:^|[\s;|&])doas(?:[\s;|&]|$)/,
-	/(?:^|[\s;|&])passwd(?:[\s;|&]|$)/,
-	/(?:^|[\s;|&])del(?:[\s;|&]|$)/
-];
-/** Patterns that warrant explicit confirmation before running. */
-const ASK_PATTERNS = [
-	/\bchmod\s+(?:-[a-zA-Z]+\s+)*777\b/,
-	/\bchown\s+-R\b/,
-	/\beval\s/,
-	/(?:>|>>|\btee\b)\s*\/etc\//,
-	/\brm\s/,
-	/\bunlink\s/
-];
-/**
-* Strip heredoc bodies so their content isn't matched as a command (false positives).
-* Two-phase scan: a backreference-free opener regex finds `<<[-]DELIM`, then the body
-* is cut up to the closing delimiter via `indexOf` — O(n), no catastrophic backtracking.
-*/
-function stripHeredoc(cmd) {
-	const opener = /<<-?\s*['"]?(\w+)['"]?/g;
-	let out = cmd;
-	let m;
-	while ((m = opener.exec(out)) !== null) {
-		const delim = m[1] ?? "";
-		const closer = new RegExp(`\\n[ \\t]*${delim}\\b`);
-		const rest = out.slice(m.index + m[0].length);
-		const hit = closer.exec(rest);
-		if (!hit || hit.index === void 0) break;
-		const end = m.index + m[0].length + hit.index + hit[0].length;
-		out = `${out.slice(0, m.index)} ${out.slice(end)}`;
-		opener.lastIndex = m.index;
-	}
-	return out;
-}
-/** Guards against dangerous Bash commands (critical → block, sensitive → ask). */
-function securityGuard(ctx) {
-	if (ctx.tool !== "Bash" || !ctx.command) return null;
-	const cmd = stripHeredoc(ctx.command);
-	for (const re of CRITICAL_PATTERNS) if (re.test(cmd)) return {
-		kind: "block",
-		title: "Dangerous command",
-		reason: "Command matches a destructive pattern (recursive root delete, fork bomb, remote-script piped to a shell, world-writable root, filesystem format, disk overwrite, or privilege escalation: sudo/su/doas/passwd).",
-		actions: ["Remove the destructive command", "Scope the operation to a specific safe path"]
-	};
-	for (const re of ASK_PATTERNS) if (re.test(cmd)) return {
-		kind: "ask",
-		title: "Dangerous command",
-		reason: "Command requests elevated privileges or alters sensitive targets (sudo, chmod 777, recursive chown, eval, or writing to /etc).",
-		actions: ["Confirm this command is intended", "Run with least privilege"]
-	};
-	return null;
-}
-//#endregion
-//#region src/policy/guards/protected-path.ts
-/**
-* Path fragments that mark a location as internal/generated state.
-*
-* Parity with safe_paths.py: `~/.fuse-harness/cache` is a *writable*
-* cache the harness owns (lessons, MCP cache, per-type state) — only the
-* `cache/sessions` subtree is protected, not the whole cache.
-*/
-const PROTECTED_FRAGMENTS = [
-	".claude/plugins/marketplaces",
-	".claude/plugins/cache",
-	".claude/logs/00-apex",
-	".fuse-harness/cache/sessions",
-	".claude/apex/",
-	".harness/track",
-	".harness/memory/state"
-];
-/**
-* Matches a real `.git` directory segment (`/.git/`, `~/.git`, leading or
-* trailing `.git`) without matching unrelated names like `foo.git/` or
-* `.github/`. Kept separate from the substring fragments for precise scoping.
-*/
-const PROTECTED_GIT_RE = /(?:^|[/~\s])\.git(?:\/|$)/;
-/** Standard block response for any protected-path violation. */
-const BLOCK = {
-	kind: "block",
-	title: "Protected path",
-	reason: "This is internal/generated enforcement state — do not edit it directly.",
-	actions: ["Edit the source, not the generated/cache/state copy"]
-};
-/** Returns true if `str` references a protected fragment or a real `.git` segment. */
-function containsProtected(str) {
-	return PROTECTED_FRAGMENTS.some((f) => str.includes(f)) || PROTECTED_GIT_RE.test(str);
-}
-/** Strips surrounding quotes from a captured shell token. */
-function unquote(t) {
-	return t.replace(/^['"]|['"]$/g, "");
-}
-/**
-* Extracts the genuine write *targets* of a shell command, so a protected path
-* appearing only as a *read source* (e.g. `grep x .claude/apex/ > out.txt`,
-* `cat .git/config > /dev/null`) is not mistaken for a write.
-*
-* Covers `>` / `>>` redirects (skipping `2>`, `&>`, `1>` fd-redirects and
-* `/dev/null`), `tee`, `dd of=`, and the destination / in-place file of
-* `cp` / `mv` / `sed -i` / `perl -i` (last path token of the segment).
-* Best-effort: obfuscated shell (base64, indirection, process substitution)
-* can still evade this — residual risk, mitigated by the freshness gate.
-*/
-function extractWriteTargets(cmd) {
-	const out = [];
-	const push = (t) => {
-		const v = unquote((t ?? "").trim());
-		if (v && v !== "/dev/null") out.push(v);
-	};
-	for (const m of cmd.matchAll(/(?<![2&\d])>{1,2}\s*('[^']+'|"[^"]+"|\S+)/g)) push(m[1]);
-	for (const m of cmd.matchAll(/\btee\b(?:\s+-\S+)*\s+('[^']+'|"[^"]+"|\S+)/g)) push(m[1]);
-	for (const m of cmd.matchAll(/\bdd\b[^|;&]*\bof=('[^']+'|"[^"]+"|\S+)/g)) push(m[1]);
-	for (const seg of cmd.split(/[;&|]+/)) {
-		if (!/\b(?:cp|mv)\b|\b(?:sed|perl)\b[^|;&]*\s-i/.test(seg)) continue;
-		const toks = (seg.split(/[<>]/)[0] ?? "").trim().split(/\s+/).filter((t) => Boolean(t) && !t.startsWith("-"));
-		push(toks[toks.length - 1]);
-	}
-	return out;
-}
-/**
-* Blocks direct edits to internal/generated state directories.
-*
-* Covers:
-*  - Write / Edit tool calls whose `filePath` targets a protected fragment.
-*  - Bash commands whose actual write *target* is a protected fragment
-*    (read sources are ignored; see `extractWriteTargets`).
-*
-* @param ctx - The guard context (tool, filePath, command).
-* @returns A blocking {@link Prompt}, or null to allow.
-*/
-function protectedPathGuard(ctx) {
-	if ((ctx.tool === "Write" || ctx.tool === "Edit") && ctx.filePath) {
-		if (containsProtected(ctx.filePath)) return BLOCK;
-	}
-	if (ctx.tool === "Bash" && ctx.command) {
-		if (extractWriteTargets(ctx.command).some(containsProtected)) return BLOCK;
-	}
-	return null;
-}
-//#endregion
-//#region src/policy/guards/bash-write.ts
-/** Redirect (`>`/`>>`) targeting a code-file extension. */
-const CODE_REDIRECT = /(?:>>?)\s*[^\s|;&]*\.(?:ts|tsx|js|jsx|py|go|rb|rs|java|kt|php|swift|vue|svelte|astro|css|c|cpp|h)\b/;
-/** Interpreters / tools that mutate source in place, plus heredoc-into-file.
-* `sed`/`perl`/`awk` allow intervening flags before `-i` (parity bash-write-guard.py). */
-const CODE_MUTATORS = /\bpython3?\s+-c\b|\bpython3?\s+-\s*<<|\bsed\b[^|]*\s-i|\bperl\b[^|]*\s-[pi]i?\b|\bawk\b[^|]*-i\s*inplace|\bpatch\b|<<[-~]?\s*['"]?\w+['"]?[\s\S]*?>/;
-/** File-mutating one-liners via `node -e` / `ruby -e` (parity NODE_WRITES/RUBY_WRITES). */
-const NODE_WRITES = /writeFile|appendFile|createWriteStream|fs\.(?:write|rename|unlink|mkdir|rmdir|copyFile)|execSync|spawnSync|child_process/;
-const RUBY_WRITES = /File\.(?:write|open|delete|rename)|IO\.write|FileUtils|\bsystem\b|\bexec\b|`[^`]/;
-/** Redirect to a non-code file. Excludes `/dev/null`, `2>`/`N>` and `>&N` fd
-* redirects via the `(?<![0-9&])` lookbehind + `(?!…|&)` (parity has_file_redirect). */
-const FILE_REDIRECT = /(?<![0-9&])\s*>>?\s*(?!\/dev\/null|&)[a-zA-Z./~$]/;
-/** Other ambiguous file writers (ASK): `tee <file>` (not `tee -a`/path) and `dd … of=`. */
-const ASK_WRITERS = /\btee\s+[^-/\s]|\bdd\b[^|]*\bof=/;
-/**
-* Blocks shell commands that mutate code files in place (and heredocs/redirects
-* to source files); asks before other file-writing shell commands. Forces use
-* of the Write/Edit tool so APEX/SOLID checks are not bypassed.
-*/
-function bashWriteGuard(ctx) {
-	if (ctx.tool !== "Bash" || !ctx.command) return null;
-	const cmd = ctx.command;
-	if (CODE_MUTATORS.test(cmd) || CODE_REDIRECT.test(cmd)) return {
-		kind: "block",
-		title: "Bash write to code file",
-		reason: "Shell in-place edits / redirects to source files bypass APEX/SOLID checks.",
-		actions: ["Use the Write/Edit tool instead"]
-	};
-	if (FILE_REDIRECT.test(cmd) || ASK_WRITERS.test(cmd) || /\bnode\s+-e\b/.test(cmd) && NODE_WRITES.test(cmd) || /\bruby\s+-e\b/.test(cmd) && RUBY_WRITES.test(cmd)) return {
-		kind: "ask",
-		title: "Bash file write",
-		reason: "This command writes a file from the shell; confirm it is intended.",
-		actions: ["Use the Write/Edit tool instead"]
-	};
-	return null;
-}
-//#endregion
-//#region src/policy/guards/interface-separation.ts
-/** TS/JS component files: top-level `interface`/`type Foo`. */
-const TS_DECL_RE = /^\s*(export\s+)?(interface|type)\s+[A-Z]/m;
-/** Python view models: class subclassing a schema/protocol base. */
-const PY_MODEL_RE = /^\s*class\s+\w+\((BaseModel|TypedDict|Protocol)\)/m;
-/**
-* PHP controllers: top-level `interface`, `abstract class`, or a concrete
-* `class …Interface/DTO/Request`. Union of the TS-only `abstract class` rule
-* and the Python rule (`class [A-Z].*(Interface|DTO|Request)`, enforce-interfaces.py:16).
-*/
-const PHP_DECL_RE = /^\s*(?:abstract\s+class\b|interface\b|class\s+[A-Z].*(?:Interface|DTO|Request))/m;
-/** Swift views: top-level `protocol Foo`. */
-const SWIFT_PROTO_RE = /^\s*protocol\s+[A-Z]/m;
-/** Go handlers/controllers: top-level `type Foo interface`. */
-const GO_DECL_RE = /^\s*type\s+[A-Z]\w*\s+interface\b/m;
-/** Java/Kotlin controllers/handlers: top-level `interface`/`record`. */
-const JAVA_DECL_RE = /^\s*(?:public\s+|private\s+|protected\s+|internal\s+)?(?:interface|record)\s+[A-Z]/m;
-/**
-* Blocks top-level interface/type/protocol declarations in component, view or
-* controller files (Interface Segregation). Fires only when BOTH the path
-* category AND the content pattern match.
-*
-* Parity note: enforce-interfaces.py only inspects `Write` (tool_input.content).
-* We deliberately also fire on `Edit` — an in-place edit can introduce the same
-* violation — and the path fragments accept singular *and* plural directory
-* names (`view/` + `views/`), mirroring the Python `s?` regexes.
-*/
-function interfaceSeparationGuard(ctx) {
-	if (ctx.tool !== "Write" && ctx.tool !== "Edit") return null;
-	const path = ctx.filePath;
-	const content = ctx.content;
-	if (!path || !content) return null;
-	const block = {
-		kind: "block",
-		title: "Separate the interface",
-		reason: "Top-level interface/type/protocol declarations belong in their own file, not in a component/view/controller.",
-		actions: ["Move the interface/type to its own file (Interface Segregation)"]
-	};
-	const inAny = (...frags) => frags.some((f) => path.includes(f));
-	if (/\.(tsx|jsx|vue|svelte)$/.test(path) && TS_DECL_RE.test(content)) return block;
-	if (/\.py$/.test(path) && inAny("view/", "views/", "controller/", "controllers/", "route/", "routes/") && PY_MODEL_RE.test(content)) return block;
-	if (/\.go$/.test(path) && inAny("handler/", "handlers/", "controller/", "controllers/") && GO_DECL_RE.test(content)) return block;
-	if (/\.(java|kt)$/.test(path) && inAny("controller/", "controllers/", "handler/", "handlers/") && JAVA_DECL_RE.test(content)) return block;
-	if (/\.php$/.test(path) && inAny("Controller/", "Controllers/", "Handler/", "Handlers/") && PHP_DECL_RE.test(content)) return block;
-	if (/\.swift$/.test(path) && inAny("View/", "Views/", "Component/", "Components/") && SWIFT_PROTO_RE.test(content)) return block;
-	return null;
-}
-//#endregion
-//#region src/policy/guards/install.ts
-/** Asks for confirmation before a dependency or system package install. */
-function installGuard(ctx) {
-	if (ctx.tool !== "Bash" || !ctx.command) return null;
-	if (matchPatterns(ctx.command, PROJECT_INSTALL) || matchPatterns(ctx.command, SYSTEM_INSTALL)) return {
-		kind: "ask",
-		title: "Dependency install",
-		reason: `This command installs packages: ${ctx.command.trim()}`,
-		actions: ["Confirm this install is intended"]
-	};
-	return null;
-}
-//#endregion
-//#region src/policy/guards/index.ts
-/** Ordered guard chain: critical/security + protected first, then writes/installs. */
-const GUARDS = [
-	securityGuard,
-	protectedPathGuard,
-	bashWriteGuard,
-	interfaceSeparationGuard,
-	installGuard
-];
-/** Block prompt returned when a guard or gate throws (fail-closed). */
-const FAIL_CLOSED = {
-	kind: "block",
-	title: "Policy error",
-	reason: "A policy check errored — blocked for safety (fail-closed).",
-	actions: ["Fix the failing guard/gate, then retry"]
-};
-const USER_GUARDS = [];
-/** Register a user guard — runs AFTER the privileged core chain (two-tier). */
-function registerGuard(guard) {
-	USER_GUARDS.push(guard);
-}
-/** Remove all registered user guards (mainly for tests). */
-function clearUserGuards() {
-	USER_GUARDS.length = 0;
-}
-/**
-* Run the guard chain — privileged core guards first, then user guards — and
-* return the first firing Prompt, else null. Fail-closed: a guard that throws
-* blocks (never silently passes).
-*/
-function runGuards(ctx) {
-	for (const guard of [...GUARDS, ...USER_GUARDS]) {
-		let hit;
-		try {
-			hit = guard(ctx);
-		} catch {
-			return FAIL_CLOSED;
-		}
-		if (hit) return hit;
-	}
-	return null;
-}
-//#endregion
-//#region src/policy/evaluate.ts
-/**
-* Evaluate a single tool-use against the bundled policies, returning a pure
-* decision plus a portable {@link Prompt}. Adapters translate the prompt into
-* their harness's native response (Claude `permissionDecision`, etc.).
-*/
-function evaluate(ctx) {
-	const guard = runGuards(ctx);
-	if (guard) return {
-		decision: "deny",
-		message: guard.reason,
-		prompt: guard
-	};
-	if (ctx.command && matchPatterns(ctx.command, GIT_BLOCKED)) {
-		const reason = `Destructive git command: ${ctx.command}`;
-		return {
-			decision: "deny",
-			message: reason,
-			prompt: {
-				kind: "block",
-				title: "Destructive git command",
-				reason,
-				actions: ["Use a non-destructive alternative (e.g. --force-with-lease; avoid --hard / -D)"]
-			}
-		};
-	}
-	if (ctx.command && matchPatterns(ctx.command, GIT_ASK)) return {
-		decision: "deny",
-		message: `Git operation requires confirmation: ${ctx.command}`,
-		prompt: {
-			kind: "ask",
-			title: "Confirm git operation",
-			reason: `Authorize: ${ctx.command.trim()}`,
-			actions: ["Approve if this git operation is intended"]
-		}
-	};
-	if (ctx.filePath && isCodeFile(ctx.filePath) && ctx.agentType !== "Explore" && ctx.agentType !== "Plan") {
-		const incoming = ctx.content !== void 0 ? countLines(ctx.content) : 0;
-		const lines = ctx.tool === "Edit" ? Math.max(incoming, ctx.existingLines ?? 0) : incoming || (ctx.existingLines ?? 0);
-		const verdict = evaluateFileSize(lines, ctx.maxLines);
-		if (lines > 0 && !verdict.ok) return {
-			decision: "deny",
-			message: verdict.message,
-			prompt: {
-				kind: "block",
-				title: "SOLID file-size limit",
-				reason: verdict.message ?? "",
-				actions: [`Split into modules under ${verdict.max} lines (Single Responsibility)`, "Then re-run the write"]
-			},
-			meta: {
-				framework: detectFramework(ctx.filePath, ctx.content ?? ""),
-				lines: verdict.lines,
-				max: verdict.max
-			}
-		};
-	}
-	return {
-		decision: "allow",
-		message: null
-	};
-}
-//#endregion
-export { matchPatterns as A, ASK_PATTERNS as C, GIT_BLOCKED as D, GIT_ASK as E, evaluateFileSize as M, detectFramework as N, PROJECT_INSTALL as O, protectedPathGuard as S, securityGuard as T, CODE_REDIRECT as _, registerGuard as a, PROTECTED_FRAGMENTS as b, GO_DECL_RE as c, PY_MODEL_RE as d, SWIFT_PROTO_RE as f, CODE_MUTATORS as g, ASK_WRITERS as h, clearUserGuards as i, countLines as j, SYSTEM_INSTALL as k, JAVA_DECL_RE as l, interfaceSeparationGuard as m, FAIL_CLOSED as n, runGuards as o, TS_DECL_RE as p, GUARDS as r, installGuard as s, evaluate as t, PHP_DECL_RE as u, FILE_REDIRECT as v, CRITICAL_PATTERNS as w, PROTECTED_GIT_RE as x, bashWriteGuard as y };

package/dist/ttl-BG55s6HZ.mjs

@@ -1,20 +0,0 @@
-import { a as parseEnvInt } from "./limits-CHn8AIL1.mjs";
-//#region src/config/ttl.ts
-/** Default enforcement-freshness window, in seconds (2 minutes). */
-const DEFAULT_TTL_SEC = 120;
-/** Default env var name carrying the TTL override. */
-const TTL_ENV_KEY = "FUSE_ENFORCE_TTL_SEC";
-/**
-* Resolve the enforcement TTL (seconds) from an env map.
-* @param env - environment map (defaults to `process.env`)
-* @param key - env var name (defaults to `FUSE_ENFORCE_TTL_SEC`)
-*/
-function resolveTtlSec(env = process.env, key = TTL_ENV_KEY) {
-	return parseEnvInt(env[key], 120);
-}
-/** Human label for a TTL: 120 -> "2min", 240 -> "4min", 90 -> "90s". */
-function ttlLabel(sec) {
-	return sec % 60 === 0 ? `${sec / 60}min` : `${sec}s`;
-}
-//#endregion
-export { ttlLabel as i, TTL_ENV_KEY as n, resolveTtlSec as r, DEFAULT_TTL_SEC as t };