@intentface/latch-core 0.9.1

package/dist/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,gBAAgB,GAAG,WAAW,GAAG,SAAS,CAAC;AAE9E;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,mBAAmB;gBACpB,MAAM,EAAE,MAAM;CAI3B;AAED;;;;;;;GAOG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAGpC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,gGAAgG;IAChG,QAAQ,CAAC,YAAY,EAAE,MAAM;IAJ/B,QAAQ,CAAC,IAAI,eAAe;gBAEjB,MAAM,EAAE,MAAM;IACvB,gGAAgG;IACvF,YAAY,EAAE,MAAM;CAKhC;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,aAAa,CAE9D;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,SAAS,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+EAA+E;IAC/E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc,CAAC,CAAC;IAE/B,UAAU,CACR,SAAS,EAAE,CAAC,EACZ,KAAK,EAAE;QACL,6EAA6E;QAC7E,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,+DAA+D;QAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GACA,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,2DAA2D;IAC3D,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC9D;;;;OAIG;IACH,SAAS,CACP,SAAS,EAAE,CAAC,EACZ,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACvC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAGzB,qDAAqD;IACrD,YAAY,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAClE,2EAA2E;IAC3E,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGtE,8EAA8E;IAC9E;;;;;OAKG;IACH,SAAS,CACP,SAAS,EAAE,CAAC,EACZ,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACtD,OAAO,CAAC,SAAS,CAAC,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE;QACd,SAAS,EAAE,CAAC,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,CACP,SAAS,EAAE,CAAC,EACZ,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,UAAU,EAAE,CAAC;QACvB,KAAK,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;KAC1C,GACA,OAAO,CAAC,SAAS,CAAC,CAAC;IAMtB;;;;;OAKG;IACH,YAAY,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB;;;;;;;;OAQG;IACH,UAAU,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAG7B;;;;;;OAMG;IACH,SAAS,CACP,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,EACzB,KAAK,CAAC,EAAE,QAAQ,GACf,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC9C,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACxE;;;;;OAKG;IACH,eAAe,CACb,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAGxB,WAAW,CACT,SAAS,EAAE,CAAC,EACZ,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,CAAC,GACrD,OAAO,CAAC,IAAI,CAAC,CAAC;IAGjB,qFAAqF;IACrF,cAAc,CACZ,SAAS,EAAE,CAAC,EACZ,KAAK,EAAE;QACL,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,qFAAqF;QACrF,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,oFAAoF;QACpF,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KAC5B,GACA,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,2DAA2D;IAC3D,aAAa,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvD,4CAA4C;IAC5C,cAAc,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD;;;;;;;;;OASG;IACH,YAAY,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACxF;;;;;;;OAOG;IACH,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EACjE,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,CAAC,CACf,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/storage.js

@@ -0,0 +1,38 @@
+/**
+ * Thrown by `createChat` when the requested chat id already exists (typically a
+ * client-supplied id colliding with a chat the caller doesn't own — the scoped
+ * `getChat` missed, so the create raced into the PK). Carries a stable `code`
+ * so the server layer can map it to a 409 instead of a 500.
+ */
+export class ChatConflictError extends Error {
+    code = "chat_conflict";
+    constructor(chatId) {
+        super(`Chat id is not available: ${chatId}`);
+        this.name = "ChatConflictError";
+    }
+}
+/**
+ * Thrown by `createRun` / `claimRun` when the chat already has a LIVE active
+ * run — one turn per conversation is a storage-level invariant (a partial
+ * unique index in the shipped adapters), so two tabs, a webhook retry racing a
+ * reply, or a schedule firing mid-conversation can never interleave one
+ * history. `retryAfterMs` is the live run's remaining lease (or the stale
+ * timeout for a non-durable run). Stable `code` → the server maps it to 409.
+ */
+export class ChatBusyError extends Error {
+    chatId;
+    retryAfterMs;
+    code = "chat_busy";
+    constructor(chatId, 
+    /** Milliseconds until the live run's lease expires — when a retry can succeed at the latest. */
+    retryAfterMs) {
+        super(`A turn is already running in this chat; try again in ${Math.ceil(retryAfterMs / 1000)}s.`);
+        this.chatId = chatId;
+        this.retryAfterMs = retryAfterMs;
+        this.name = "ChatBusyError";
+    }
+}
+export function isChatBusyError(e) {
+    return e?.code === "chat_busy";
+}
+//# sourceMappingURL=storage.js.map

package/dist/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AA8BA;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,GAAG,eAAe,CAAC;IAChC,YAAY,MAAc;QACxB,KAAK,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAG3B;IAEA;IAJF,IAAI,GAAG,WAAW,CAAC;IAC5B,YACW,MAAc;IACvB,gGAAgG;IACvF,YAAoB;QAE7B,KAAK,CAAC,wDAAwD,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAJzF,WAAM,GAAN,MAAM,CAAQ;QAEd,iBAAY,GAAZ,YAAY,CAAQ;QAG7B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAQ,CAA8B,EAAE,IAAI,KAAK,WAAW,CAAC;AAC/D,CAAC"}

package/dist/telemetry.d.ts

@@ -0,0 +1,155 @@
+import type { TelemetryOptions } from "ai";
+/**
+ * The telemetry seam — THE observation point for a turn, kept out of core so it
+ * carries no OTEL/vendor dep. A host supplies an implementation via
+ * `RuntimeConfig.telemetry`: a full tracer (`@intentface/latch-langfuse`), or
+ * just the hooks it wants (`onRunFinished` for a usage ledger or an
+ * operational notification, `onStep` for per-tool analytics). Without one,
+ * nothing changes.
+ *
+ * The runtime calls it around the single model-call choke-point in
+ * `buildTurn`: per-run settings feed the AI SDK's `telemetry` option, the run
+ * span wrapper lets a tracer root all spans in one trace, `onStep` fires after
+ * each generation step, and `onRunFinished` fires after the turn is persisted
+ * (scores, judges, flush). Every hook is guarded: a throwing or rejecting hook
+ * is swallowed, so telemetry can never fail a turn.
+ *
+ * Opting a run out: an impl that defines `telemetryFor` and returns undefined
+ * for a run silences ALL hooks for that run (not just the AI SDK settings).
+ */
+/**
+ * What started a turn — and, in practice, whether a human is at the other end
+ * of it:
+ *
+ * - `"chat"` — a user message (`handleChat`). Someone is watching the stream.
+ * - `"decision"` — a human answered a pending request: an approval decision or
+ *   a client-handled tool result. Someone is watching.
+ * - `"schedule"` — a cron/one-shot fire (`runDue`). NOBODY is watching.
+ * - `"programmatic"` — the host called `runAgent` directly (a background job, a
+ *   webhook handler, a test run). There is no client stream, and only the host
+ *   knows whether a person is waiting on the result — so `runAgent` takes a
+ *   `trigger` to say when it does.
+ * - `"resume"` — the durability sweep recovered a crashed run and drove it to
+ *   completion server-side. Nobody is watching.
+ *
+ * That distinction is what makes `onRunFinished` usable as an operational
+ * notification channel and not just an analytics feed: a turn that finishes
+ * `awaiting_input` under `"schedule"` or `"resume"` is a person who needs to
+ * be told, while the same status under `"chat"` or `"decision"` is just a gate
+ * rendering in front of someone who can answer it.
+ *
+ * A subagent turn inherits its parent's trigger (like `rootChatId`), so a
+ * whole delegation tree is attributable to what set it off.
+ */
+export type TurnTrigger = "chat" | "decision" | "programmatic" | "schedule" | "resume";
+/** Identity of one run/turn, known before the model call starts. */
+export interface TelemetryRunMeta<P = unknown> {
+    /** Per-turn run id (`latch_runs.id`) — the natural trace correlation key. */
+    runId: string;
+    /** The conversation id — the natural session id. */
+    chatId: string;
+    /** Registered agent name. */
+    agent: string;
+    /** Display model id for the turn. */
+    modelId: string;
+    /** The caller the run is scoped to (tenant/user isolation flows from this). */
+    principal: P;
+    /**
+     * Run start time (epoch ms, `latch_runs.startedAt`). A stable per-run clock:
+     * out-of-band score writers (judge verdicts, user feedback, human
+     * corrections) pin their Langfuse score timestamp to it so repeated writes
+     * for the same run+rubric upsert one score instead of duplicating across days.
+     */
+    startedAt: number;
+    /** Delegation depth: 0 = top-level turn, >0 = a subagent turn. */
+    depth: number;
+    /** What started this turn — see {@link TurnTrigger}. */
+    trigger: TurnTrigger;
+    /**
+     * The run that spawned this subagent turn, when applicable. Absent at the top
+     * level. Lets a tracer link a helper's trace back to the agent it ran for.
+     */
+    parentRunId?: string;
+    /**
+     * The top-level conversation id — stable across a turn AND its subagent
+     * turns (a subagent's own `chatId` is an internal `sub_…` thread). A tracer
+     * can use it as the session id so a whole delegation tree groups together.
+     * Falls back to `chatId` when unset (top-level turns).
+     */
+    rootChatId?: string;
+}
+/** Outcome of one finished turn, delivered after persistence. */
+export interface TelemetryRunOutcome {
+    status: "completed" | "awaiting_input" | "errored";
+    /** Present when status is "errored". */
+    error?: string;
+    /** Plain text of the incoming user message for this turn, if any. */
+    inputText?: string;
+    /**
+     * The turn's persisted messages (assistant message last). Typed loosely so
+     * implementations stay decoupled from the message shape; cast to
+     * `AppMessage[]` to walk parts.
+     */
+    messages: unknown[];
+    usage: {
+        inputTokens: number;
+        outputTokens: number;
+        cacheReadTokens?: number;
+        cacheWriteTokens?: number;
+    };
+    /** Cost for the turn (0 without a pricing config). */
+    cost: number;
+    endedAt?: number;
+}
+/** One completed generation step (model output + the step's tool calls/results). */
+export interface TelemetryStep {
+    text?: string;
+    finishReason?: string;
+    usage?: {
+        inputTokens?: number;
+        outputTokens?: number;
+        cacheReadTokens?: number;
+        cacheWriteTokens?: number;
+    };
+    toolCalls?: Array<{
+        toolCallId: string;
+        toolName: string;
+        input?: unknown;
+    }>;
+    toolResults?: Array<{
+        toolCallId: string;
+        toolName: string;
+        output?: unknown;
+    }>;
+}
+export interface LatchTelemetry<P = unknown> {
+    /**
+     * Per-run AI SDK telemetry options (integrations, functionId, …), passed as
+     * `telemetry` on the turn's agent. Return undefined to skip this run — every
+     * other hook goes silent for it too.
+     */
+    telemetryFor?(run: TelemetryRunMeta<P>): TelemetryOptions | undefined;
+    /**
+     * After each generation step (model output + that step's tool calls and
+     * results). Fire-and-forget: not awaited, never fails the turn. For per-tool
+     * analytics and step-level metrics.
+     */
+    onStep?(run: TelemetryRunMeta<P>, step: TelemetryStep): void | Promise<void>;
+    /**
+     * Wrap the model call so the impl can root it in a trace context (seeded
+     * trace id, session/user/tags). Identity when absent.
+     */
+    withRunSpan?<T>(run: TelemetryRunMeta<P>, fn: () => Promise<T>): Promise<T>;
+    /**
+     * Post-turn hook, fired after messages/run/usage are persisted (and on
+     * error/abort with status "errored", carrying the error message). Awaited,
+     * errors swallowed — telemetry must never fail a turn. With `run.trigger`
+     * this doubles as the operational notification seam: `status:
+     * "awaiting_input"` under `"schedule"`/`"resume"` is a fire nobody can
+     * answer.
+     */
+    onRunFinished?(run: TelemetryRunMeta<P>, outcome: TelemetryRunOutcome): void | Promise<void>;
+    /** Flush exporters (serverless). Awaited after onRunFinished. */
+    flush?(): Promise<void>;
+}
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,IAAI,CAAC;AAE3C;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,cAAc,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEvF,oEAAoE;AACpE,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,OAAO;IAC3C,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,SAAS,EAAE,CAAC,CAAC;IACb;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,OAAO,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACnD,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,KAAK,EAAE;QACL,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE;QACN,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC7E,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACjF;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,OAAO;IACzC;;;;OAIG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACtE;;;;OAIG;IACH,MAAM,CAAC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;;;OAGG;IACH,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E;;;;;;;OAOG;IACH,aAAa,CAAC,CACZ,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,EACxB,OAAO,EAAE,mBAAmB,GAC3B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,iEAAiE;IACjE,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB"}

package/dist/telemetry.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=telemetry.js.map

package/dist/telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":""}

package/dist/vault-node.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Derive a base64 32-byte `masterKey` from a free-form passphrase via scrypt.
+ *
+ * NOTE — Node-only entry point (`@intentface/latch-core/node`): the vault
+ * itself is pure Web Crypto (`crypto.subtle`) so the package root stays
+ * portable to edge/serverless. `scryptSync` is a Node-only KDF and is used
+ * deliberately here: it's a convenience for the common case where the KEK
+ * comes from a human passphrase env var rather than a raw base64 key, and key
+ * derivation happens once at startup on the server (never in an edge request
+ * path). Consumers on non-Node runtimes should supply a raw base64 32-byte
+ * `masterKey` to `createVault` directly and skip this helper.
+ *
+ * `salt` is required and must be a stable per-deployment value (deployment
+ * config/KMS — it need not be secret): a shared default salt would make the
+ * same passphrase yield the same KEK on every deployment.
+ */
+export declare function deriveMasterKey(passphrase: string, opts: {
+    salt: string;
+}): string;
+//# sourceMappingURL=vault-node.d.ts.map

package/dist/vault-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-node.d.ts","sourceRoot":"","sources":["../src/vault-node.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GACrB,MAAM,CAaR"}

package/dist/vault-node.js

@@ -0,0 +1,30 @@
+import { scryptSync } from "node:crypto";
+/**
+ * Derive a base64 32-byte `masterKey` from a free-form passphrase via scrypt.
+ *
+ * NOTE — Node-only entry point (`@intentface/latch-core/node`): the vault
+ * itself is pure Web Crypto (`crypto.subtle`) so the package root stays
+ * portable to edge/serverless. `scryptSync` is a Node-only KDF and is used
+ * deliberately here: it's a convenience for the common case where the KEK
+ * comes from a human passphrase env var rather than a raw base64 key, and key
+ * derivation happens once at startup on the server (never in an edge request
+ * path). Consumers on non-Node runtimes should supply a raw base64 32-byte
+ * `masterKey` to `createVault` directly and skip this helper.
+ *
+ * `salt` is required and must be a stable per-deployment value (deployment
+ * config/KMS — it need not be secret): a shared default salt would make the
+ * same passphrase yield the same KEK on every deployment.
+ */
+export function deriveMasterKey(passphrase, opts) {
+    // Fail closed: a missing/blank passphrase or salt (an unset env var) must not
+    // silently derive a valid-looking key — that would encrypt the vault under a
+    // predictable KEK.
+    if (!passphrase || passphrase.trim() === "") {
+        throw new Error("deriveMasterKey: passphrase must be a non-empty string");
+    }
+    if (!opts?.salt || opts.salt.trim() === "") {
+        throw new Error("deriveMasterKey: salt must be a non-empty, deployment-stable string");
+    }
+    return scryptSync(passphrase, opts.salt, 32).toString("base64");
+}
+//# sourceMappingURL=vault-node.js.map

package/dist/vault-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-node.js","sourceRoot":"","sources":["../src/vault-node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAC7B,UAAkB,EAClB,IAAsB;IAEtB,8EAA8E;IAC9E,6EAA6E;IAC7E,mBAAmB;IACnB,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC"}

package/dist/vault.d.ts

@@ -0,0 +1,62 @@
+import type { SecretResolver } from "./context.js";
+/**
+ * The Vault — server-side, envelope-encrypted secret storage.
+ *
+ * Connection credentials (API keys, OAuth tokens) live here, encrypted at rest
+ * in the customer's own database and scoped per tenant. The decrypted value is
+ * brokered server-side only: it reaches a tool's egress (fetch/MCP) but never
+ * the model, logs, or telemetry. The read-side is a `SecretResolver`, so the
+ * existing context/tools plumbing consumes it without knowing it's encrypted.
+ *
+ * Envelope encryption: each secret gets a random data key (DEK) that encrypts
+ * the value (AES-256-GCM); the DEK itself is wrapped by a master key (KEK) held
+ * in config/env/KMS. Rotating the KEK only requires re-wrapping DEKs, not
+ * re-encrypting values. Crypto is Web Crypto (`crypto.subtle`) — portable to
+ * Node and edge/serverless, no native deps.
+ */
+/** The opaque encrypted record persisted by a `SecretStore`. Never holds plaintext. */
+export interface SecretRecord {
+    key: string;
+    /** base64 AES-GCM ciphertext of the value (auth tag appended by Web Crypto). */
+    ciphertext: string;
+    /** base64 nonce used to encrypt the value. */
+    iv: string;
+    /** base64 AES-GCM ciphertext of the raw DEK, wrapped under the KEK. */
+    wrappedDek: string;
+    /** base64 nonce used to wrap the DEK. */
+    dekIv: string;
+    createdAt: number;
+    updatedAt: number;
+}
+/**
+ * Persistence seam for encrypted secret records (Drizzle impl in latch-drizzle).
+ * Isolation lives here: each method receives the opaque `Principal` and the store
+ * scopes by it (the default derives an `owner` key). The framework never reads `P`.
+ */
+export interface SecretStore<P> {
+    put(principal: P, record: SecretRecord): Promise<void>;
+    get(principal: P, key: string): Promise<SecretRecord | null>;
+    delete(principal: P, key: string): Promise<void>;
+    /** Keys only — never values — for the caller. */
+    list(principal: P): Promise<string[]>;
+}
+/** The Vault operations. `get` returns decrypted plaintext; storage stays opaque. */
+export interface Vault<P> {
+    set(principal: P, key: string, value: string): Promise<void>;
+    get(principal: P, key: string): Promise<string | undefined>;
+    has(principal: P, key: string): Promise<boolean>;
+    delete(principal: P, key: string): Promise<void>;
+    list(principal: P): Promise<string[]>;
+    /** Read-side adapter for context/tools (a `SecretResolver`). */
+    readonly resolver: SecretResolver<P>;
+}
+/**
+ * Build a Vault over a `SecretStore`. `masterKey` is a base64-encoded 32-byte
+ * (256-bit) key — generate with `crypto.getRandomValues(new Uint8Array(32))`
+ * and keep it in env/KMS, never in the database.
+ */
+export declare function createVault<P>(opts: {
+    store: SecretStore<P>;
+    masterKey: string;
+}): Vault<P>;
+//# sourceMappingURL=vault.d.ts.map

package/dist/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;;;;;;;;;;;;GAcG;AAEH,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,iDAAiD;IACjD,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACvC;AAED,qFAAqF;AACrF,MAAM,WAAW,KAAK,CAAC,CAAC;IACtB,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5D,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;CACtC;AA2BD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE;IACnC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,KAAK,CAAC,CAAC,CAAC,CA+FX"}

package/dist/vault.js

@@ -0,0 +1,88 @@
+// --- base64 <-> bytes (no Buffer; works in Node + browsers/edge) ------------
+function toB64(bytes) {
+    const u8 = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    let s = "";
+    for (const b of u8)
+        s += String.fromCharCode(b);
+    return btoa(s);
+}
+function fromB64(b64) {
+    const s = atob(b64);
+    const u8 = new Uint8Array(s.length);
+    for (let i = 0; i < s.length; i++)
+        u8[i] = s.charCodeAt(i);
+    return u8;
+}
+const enc = new TextEncoder();
+const dec = new TextDecoder();
+// `deriveMasterKey` (passphrase → KEK via scrypt) lives in
+// `@intentface/latch-core/node` — it needs `node:crypto`, and importing it here
+// would make the package root unusable on edge/serverless runtimes.
+// Web Crypto's lib types narrow BufferSource to ArrayBuffer-backed views; our
+// Uint8Arrays are structurally fine, so coerce at the crypto call boundary.
+const bs = (u) => u;
+/**
+ * Build a Vault over a `SecretStore`. `masterKey` is a base64-encoded 32-byte
+ * (256-bit) key — generate with `crypto.getRandomValues(new Uint8Array(32))`
+ * and keep it in env/KMS, never in the database.
+ */
+export function createVault(opts) {
+    const { store } = opts;
+    const rawKek = fromB64(opts.masterKey);
+    if (rawKek.length !== 32) {
+        throw new Error("Vault masterKey must be base64 of 32 bytes (256-bit)");
+    }
+    // Import the KEK once; reused to wrap/unwrap per-secret DEKs.
+    const kekPromise = crypto.subtle.importKey("raw", bs(rawKek), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+    async function encryptValue(value) {
+        const kek = await kekPromise;
+        const dek = await crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, ["encrypt", "decrypt"]);
+        const iv = crypto.getRandomValues(new Uint8Array(12));
+        const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv: bs(iv) }, dek, bs(enc.encode(value)));
+        const rawDek = await crypto.subtle.exportKey("raw", dek);
+        const dekIv = crypto.getRandomValues(new Uint8Array(12));
+        const wrappedDek = await crypto.subtle.encrypt({ name: "AES-GCM", iv: bs(dekIv) }, kek, rawDek);
+        return {
+            ciphertext: toB64(ciphertext),
+            iv: toB64(iv),
+            wrappedDek: toB64(wrappedDek),
+            dekIv: toB64(dekIv),
+        };
+    }
+    async function decryptValue(record) {
+        const kek = await kekPromise;
+        const rawDek = await crypto.subtle.decrypt({ name: "AES-GCM", iv: bs(fromB64(record.dekIv)) }, kek, bs(fromB64(record.wrappedDek)));
+        const dek = await crypto.subtle.importKey("raw", rawDek, { name: "AES-GCM" }, false, ["decrypt"]);
+        const plaintext = await crypto.subtle.decrypt({ name: "AES-GCM", iv: bs(fromB64(record.iv)) }, dek, bs(fromB64(record.ciphertext)));
+        return dec.decode(plaintext);
+    }
+    const get = async (principal, key) => {
+        const record = await store.get(principal, key);
+        if (!record)
+            return undefined;
+        return decryptValue(record);
+    };
+    return {
+        async set(principal, key, value) {
+            const now = Date.now();
+            await store.put(principal, {
+                key,
+                ...(await encryptValue(value)),
+                createdAt: now,
+                updatedAt: now,
+            });
+        },
+        get,
+        async has(principal, key) {
+            return (await store.get(principal, key)) != null;
+        },
+        async delete(principal, key) {
+            await store.delete(principal, key);
+        },
+        list(principal) {
+            return store.list(principal);
+        },
+        resolver: (principal, key) => get(principal, key),
+    };
+}
+//# sourceMappingURL=vault.js.map

package/dist/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAyDA,+EAA+E;AAC/E,SAAS,KAAK,CAAC,KAA+B;IAC5C,MAAM,EAAE,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,EAAE;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AACD,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,2DAA2D;AAC3D,gFAAgF;AAChF,oEAAoE;AAEpE,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,EAAE,GAAG,CAAC,CAAa,EAAgB,EAAE,CAAC,CAA4B,CAAC;AAEzE;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAI,IAG9B;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,8DAA8D;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,EAAE,CAAC,MAAM,CAAC,EACV,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;IAEF,KAAK,UAAU,YAAY,CAAC,KAAa;QAGvC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CACzC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAC/B,GAAG,EACH,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACtB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAClC,GAAG,EACH,MAAM,CACP,CAAC;QACF,OAAO;YACL,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC;YAC7B,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;YACb,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC;YAC7B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;SACpB,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,MAAoB;QAC9C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAClD,GAAG,EACH,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAC/B,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,MAAM,EACN,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,EAC/C,GAAG,EACH,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAC/B,CAAC;QACF,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,GAAG,GAAoB,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE;gBACzB,GAAG;gBACH,GAAG,CAAC,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC9B,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC,CAAC;QACL,CAAC;QACD,GAAG;QACH,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG;YACtB,OAAO,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QACnD,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG;YACzB,MAAM,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,SAAS;YACZ,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QACD,QAAQ,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,95 @@
+{
+  "name": "@intentface/latch-core",
+  "version": "0.9.1",
+  "description": "Latch core — runtime, types, and seams for building agents on the AI SDK. Subpaths: /models (models.dev catalog + provider hooks) and /harness (default sandbox/app tools); their extra deps are optional peers, loaded lazily.",
+  "keywords": [
+    "ai",
+    "ai-sdk",
+    "agents",
+    "llm",
+    "agent-runtime",
+    "durable-execution",
+    "tool-calling"
+  ],
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./node": {
+      "types": "./dist/vault-node.d.ts",
+      "import": "./dist/vault-node.js"
+    },
+    "./models": {
+      "types": "./dist/models/index.d.ts",
+      "import": "./dist/models/index.js"
+    },
+    "./harness": {
+      "types": "./dist/harness/index.d.ts",
+      "import": "./dist/harness/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "dependencies": {
+    "zod": "^4.0.0"
+  },
+  "peerDependencies": {
+    "ai": ">=7.0.0",
+    "@ai-sdk/anthropic": ">=4.0.0",
+    "@ai-sdk/google": ">=4.0.0",
+    "@ai-sdk/openai": ">=4.0.0",
+    "turndown": ">=7.0.0",
+    "@intentface/latch-net": "^0.9.1"
+  },
+  "devDependencies": {
+    "@ai-sdk/anthropic": "^4.0.0",
+    "@ai-sdk/google": "^4.0.0",
+    "@ai-sdk/openai": "^4.0.0",
+    "@types/node": "^22",
+    "@types/turndown": "^5.0.6",
+    "ai": "^7.0.2",
+    "turndown": "^7.2.4",
+    "typescript": "^5.7.0",
+    "vitest": "^4",
+    "@intentface/latch-net": "^0.9.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Intentface/intentface-latch.git",
+    "directory": "packages/core"
+  },
+  "peerDependenciesMeta": {
+    "@ai-sdk/anthropic": {
+      "optional": true
+    },
+    "@ai-sdk/google": {
+      "optional": true
+    },
+    "@ai-sdk/openai": {
+      "optional": true
+    },
+    "turndown": {
+      "optional": true
+    },
+    "@intentface/latch-net": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json",
+    "test": "vitest run"
+  }
+}