@jini-ai/agent-runtime 0.1.0

package/dist/providers/connection-guard.d.ts

@@ -0,0 +1,67 @@
+/**
+ * @module providers/connection-guard
+ *
+ * Minimal, self-contained SSRF-guard + secret-redaction utilities needed by
+ * this package's own `model-catalog.ts`. Vendored from the small generic
+ * subset of OD's `packages/contracts/src/api/connectionTest.ts` (the
+ * `isLoopbackApiHost`/`isBlockedExternalApiHostname`/`validateBaseUrl` triad)
+ * and `apps/daemon/src/connectionTest.ts` (`validateBaseUrlResolved`'s
+ * DNS-aware follow-up check, `redactSecrets`) — not the surrounding
+ * 2,600-line file, which is almost entirely OD's own agent-CLI
+ * connection-test orchestration (proxy dispatchers, product-specific
+ * executable-fallback copy and env-var names) and out of this task's
+ * scope; see `source-map.md` for the exact origin details. These four
+ * functions are pure security/text utilities with
+ * no product coupling in the origin — reject requests to loopback-disguised
+ * or RFC1918/link-local/CGNAT/metadata-service addresses, and strip bearer
+ * tokens / API-key headers / `?key=` query values out of free-form text
+ * before it is logged or surfaced to a caller.
+ */
+export interface BaseUrlValidationResult {
+    parsed?: URL;
+    error?: string;
+    forbidden?: boolean;
+}
+/** True for `localhost`, `::1`, `127.0.0.0/8`, and their IPv4-mapped-IPv6 forms. */
+export declare function isLoopbackApiHost(hostname: string): boolean;
+/** True for RFC1918/link-local/CGNAT/multicast/unspecified/unique-local-IPv6 addresses — private network space a public caller should never be steered into. */
+export declare function isBlockedExternalApiHostname(hostname: string): boolean;
+/** Synchronous base-URL check: scheme allow-list + literal-hostname block-list. Does not resolve DNS — see {@link validateBaseUrlResolved}. */
+export declare function validateBaseUrl(baseUrl: string): BaseUrlValidationResult;
+export type DnsLookupAddress = {
+    address: string;
+    family: number;
+};
+export type DnsLookupFn = (hostname: string) => Promise<DnsLookupAddress[]>;
+/**
+ * DNS-aware companion to {@link validateBaseUrl}. The synchronous check only
+ * inspects the literal hostname string, so a public DNS name pointing at
+ * internal infrastructure (`internal.example.com -> 10.0.0.5`) slips through
+ * and a caller ends up issuing a request to a private address on behalf of
+ * whoever supplied the base URL. Resolves the hostname and re-runs the
+ * block-list against every address the system would actually connect to.
+ *
+ * Loopback is intentionally allowed (for local LLM servers like Ollama); any
+ * hostname that resolves to a loopback address (including `*.localhost` per
+ * RFC 6761 and IPv4-mapped IPv6 loopback) follows the same carve-out.
+ *
+ * DNS lookup failures are not treated as a security signal — the caller is
+ * going to surface a connection error from `fetch` anyway, and turning a
+ * transient resolver hiccup into a rejection would just confuse callers. The
+ * synchronous hostname check still rejects the obvious literal-IP cases
+ * before DNS is ever consulted. `lookup` defaults to `node:dns`'s promise
+ * `lookup(hostname, { all: true, family: 0 })`, injectable for tests and for
+ * hosts that already own a resolver.
+ */
+export declare function validateBaseUrlResolved(baseUrl: string, lookup: DnsLookupFn): Promise<BaseUrlValidationResult>;
+/**
+ * Redacts bearer tokens, `x-api-key`/`api-key`/`x-goog-api-key` headers,
+ * `?key=` query values, and any exact secret strings supplied via
+ * `exactSecrets` out of free-form text — for logging or surfacing an
+ * upstream error message to a caller without leaking credentials embedded in
+ * it (some providers echo the key back in a 401 body).
+ */
+export declare function redactSecrets(text: string, exactSecrets?: ReadonlyArray<string | undefined | null>): string;
+/** Default DNS lookup for {@link validateBaseUrlResolved} — `node:dns/promises`' `lookup(hostname, { all: true, family: 0 })`. */
+export declare function defaultDnsLookup(hostname: string): Promise<DnsLookupAddress[]>;
+//# sourceMappingURL=connection-guard.d.ts.map

package/dist/providers/connection-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-guard.d.ts","sourceRoot":"","sources":["../../src/providers/connection-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,WAAW,uBAAuB;IACtC,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAsED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED,gKAAgK;AAChK,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQtE;AAED,+IAA+I;AAC/I,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,uBAAuB,CAexE;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AACnE,MAAM,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;AAU5E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,uBAAuB,CAAC,CAwBlC;AAMD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,YAAY,GAAE,aAAa,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,CAAM,GAC1D,MAAM,CAWR;AAED,kIAAkI;AAClI,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAIpF"}

package/dist/providers/connection-guard.js

@@ -0,0 +1,211 @@
+/**
+ * @module providers/connection-guard
+ *
+ * Minimal, self-contained SSRF-guard + secret-redaction utilities needed by
+ * this package's own `model-catalog.ts`. Vendored from the small generic
+ * subset of OD's `packages/contracts/src/api/connectionTest.ts` (the
+ * `isLoopbackApiHost`/`isBlockedExternalApiHostname`/`validateBaseUrl` triad)
+ * and `apps/daemon/src/connectionTest.ts` (`validateBaseUrlResolved`'s
+ * DNS-aware follow-up check, `redactSecrets`) — not the surrounding
+ * 2,600-line file, which is almost entirely OD's own agent-CLI
+ * connection-test orchestration (proxy dispatchers, product-specific
+ * executable-fallback copy and env-var names) and out of this task's
+ * scope; see `source-map.md` for the exact origin details. These four
+ * functions are pure security/text utilities with
+ * no product coupling in the origin — reject requests to loopback-disguised
+ * or RFC1918/link-local/CGNAT/metadata-service addresses, and strip bearer
+ * tokens / API-key headers / `?key=` query values out of free-form text
+ * before it is logged or surfaced to a caller.
+ */
+function normalizeBracketedIpv6(hostname) {
+    const stripped = hostname.startsWith('[') && hostname.endsWith(']')
+        ? hostname.slice(1, -1)
+        : hostname;
+    // FQDN trailing-dot form (RFC 1034) resolves identically to the dotless
+    // form, so `localhost.` must normalize to `localhost` before the equality
+    // check below — and `0.0.0.0.`, `10.0.0.1.`, etc. must normalize before
+    // isBlockedIpv4 parses them. Strips one or more trailing dots.
+    return stripped.toLowerCase().replace(/\.+$/, '');
+}
+function parseIpv4(hostname) {
+    const parts = hostname.split('.');
+    if (parts.length !== 4)
+        return null;
+    const parsed = parts.map((part) => {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const value = Number(part);
+        return value >= 0 && value <= 255 ? value : null;
+    });
+    if (parsed.some((part) => part === null))
+        return null;
+    return parsed;
+}
+function isLoopbackIpv4(hostname) {
+    const parts = parseIpv4(hostname);
+    return Boolean(parts && parts[0] === 127);
+}
+function isBlockedIpv4(hostname) {
+    const parts = parseIpv4(hostname);
+    if (!parts)
+        return false;
+    const [a, b] = parts;
+    return (a === 0 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) ||
+        a === 10 ||
+        (a === 192 && b === 168) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        a >= 224);
+}
+function ipv4MappedToDotted(hostname) {
+    const host = normalizeBracketedIpv6(hostname);
+    const mapped = /^::ffff:(.+)$/i.exec(host)?.[1];
+    if (!mapped)
+        return null;
+    if (parseIpv4(mapped.toLowerCase()))
+        return mapped.toLowerCase();
+    const hexParts = mapped.split(':');
+    if (hexParts.length !== 2 ||
+        !hexParts.every((part) => /^[0-9a-f]{1,4}$/i.test(part))) {
+        return null;
+    }
+    // Non-null assertions, not a runtime guard: the length/regex checks above
+    // already guarantee exactly two non-empty hex segments here.
+    const hi = hexParts[0];
+    const lo = hexParts[1];
+    const value = (Number.parseInt(hi, 16) << 16) | Number.parseInt(lo, 16);
+    return [
+        (value >>> 24) & 255,
+        (value >>> 16) & 255,
+        (value >>> 8) & 255,
+        value & 255,
+    ].join('.');
+}
+/** True for `localhost`, `::1`, `127.0.0.0/8`, and their IPv4-mapped-IPv6 forms. */
+export function isLoopbackApiHost(hostname) {
+    const host = normalizeBracketedIpv6(hostname);
+    if (host === 'localhost' || host === '::1')
+        return true;
+    if (isLoopbackIpv4(host))
+        return true;
+    const mapped = ipv4MappedToDotted(host);
+    return Boolean(mapped && isLoopbackIpv4(mapped));
+}
+/** True for RFC1918/link-local/CGNAT/multicast/unspecified/unique-local-IPv6 addresses — private network space a public caller should never be steered into. */
+export function isBlockedExternalApiHostname(hostname) {
+    const host = normalizeBracketedIpv6(hostname);
+    if (host === '::')
+        return true;
+    if (isBlockedIpv4(host))
+        return true;
+    if (/^f[cd][0-9a-f]{2}:/i.test(host))
+        return true;
+    if (/^fe[89ab][0-9a-f]:/i.test(host))
+        return true;
+    const mapped = ipv4MappedToDotted(host);
+    return Boolean(mapped && isBlockedIpv4(mapped));
+}
+/** Synchronous base-URL check: scheme allow-list + literal-hostname block-list. Does not resolve DNS — see {@link validateBaseUrlResolved}. */
+export function validateBaseUrl(baseUrl) {
+    let parsed;
+    try {
+        parsed = new URL(String(baseUrl).replace(/\/+$/, ''));
+    }
+    catch {
+        return { error: 'Invalid baseUrl' };
+    }
+    if (!['http:', 'https:'].includes(parsed.protocol)) {
+        return { error: 'Only http/https allowed' };
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    if (!isLoopbackApiHost(hostname) && isBlockedExternalApiHostname(hostname)) {
+        return { error: 'Internal IPs blocked', forbidden: true };
+    }
+    return { parsed };
+}
+function looksLikeIpLiteral(hostname) {
+    const host = hostname.startsWith('[') && hostname.endsWith(']')
+        ? hostname.slice(1, -1)
+        : hostname;
+    if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(host))
+        return true;
+    return host.includes(':');
+}
+/**
+ * DNS-aware companion to {@link validateBaseUrl}. The synchronous check only
+ * inspects the literal hostname string, so a public DNS name pointing at
+ * internal infrastructure (`internal.example.com -> 10.0.0.5`) slips through
+ * and a caller ends up issuing a request to a private address on behalf of
+ * whoever supplied the base URL. Resolves the hostname and re-runs the
+ * block-list against every address the system would actually connect to.
+ *
+ * Loopback is intentionally allowed (for local LLM servers like Ollama); any
+ * hostname that resolves to a loopback address (including `*.localhost` per
+ * RFC 6761 and IPv4-mapped IPv6 loopback) follows the same carve-out.
+ *
+ * DNS lookup failures are not treated as a security signal — the caller is
+ * going to surface a connection error from `fetch` anyway, and turning a
+ * transient resolver hiccup into a rejection would just confuse callers. The
+ * synchronous hostname check still rejects the obvious literal-IP cases
+ * before DNS is ever consulted. `lookup` defaults to `node:dns`'s promise
+ * `lookup(hostname, { all: true, family: 0 })`, injectable for tests and for
+ * hosts that already own a resolver.
+ */
+export async function validateBaseUrlResolved(baseUrl, lookup) {
+    const sync = validateBaseUrl(baseUrl);
+    if (sync.error || !sync.parsed)
+        return sync;
+    const hostname = sync.parsed.hostname.toLowerCase();
+    if (isLoopbackApiHost(hostname))
+        return sync;
+    if (looksLikeIpLiteral(hostname))
+        return sync;
+    let addresses;
+    try {
+        addresses = await lookup(hostname);
+    }
+    catch {
+        return sync;
+    }
+    for (const addr of addresses) {
+        const ip = String(addr.address).toLowerCase();
+        if (isLoopbackApiHost(ip))
+            continue;
+        if (isBlockedExternalApiHostname(ip)) {
+            return { error: 'Internal IPs blocked', forbidden: true };
+        }
+    }
+    return sync;
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Redacts bearer tokens, `x-api-key`/`api-key`/`x-goog-api-key` headers,
+ * `?key=` query values, and any exact secret strings supplied via
+ * `exactSecrets` out of free-form text — for logging or surfacing an
+ * upstream error message to a caller without leaking credentials embedded in
+ * it (some providers echo the key back in a 401 body).
+ */
+export function redactSecrets(text, exactSecrets = []) {
+    if (typeof text !== 'string' || text.length === 0)
+        return '';
+    let redacted = text
+        .replace(/Bearer\s+[A-Za-z0-9_\-.+/=]+/gi, 'Bearer [REDACTED]')
+        .replace(/(x-api-key|api-key|x-goog-api-key)\s*[:=]\s*[^\s,;"']+/gi, '$1: [REDACTED]')
+        .replace(/([?&]key=)[^&\s]+/gi, '$1[REDACTED]');
+    for (const secret of exactSecrets) {
+        if (typeof secret !== 'string' || secret.length === 0)
+            continue;
+        redacted = redacted.replace(new RegExp(escapeRegExp(secret), 'g'), '[REDACTED]');
+    }
+    return redacted;
+}
+/** Default DNS lookup for {@link validateBaseUrlResolved} — `node:dns/promises`' `lookup(hostname, { all: true, family: 0 })`. */
+export async function defaultDnsLookup(hostname) {
+    const { promises: dnsPromises } = await import('node:dns');
+    const result = await dnsPromises.lookup(hostname, { all: true, family: 0 });
+    return result.map(({ address, family }) => ({ address, family }));
+}
+//# sourceMappingURL=connection-guard.js.map

package/dist/providers/connection-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-guard.js","sourceRoot":"","sources":["../../src/providers/connection-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QACjE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC;IACb,wEAAwE;IACxE,0EAA0E;IAC1E,wEAAwE;IACxE,+DAA+D;IAC/D,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAChC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,MAA0C,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACrB,OAAO,CACL,CAAC,KAAK,CAAC;QACP,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC;QAClC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,KAAK,EAAE;QACR,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC;QACxB,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,IAAI,GAAG,CACT,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IACE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACxD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IACxB,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACxE,OAAO;QACL,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,GAAG;QACpB,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,GAAG;QACpB,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,GAAG;QACnB,KAAK,GAAG,GAAG;KACZ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,cAAc,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,gKAAgK;AAChK,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,+IAA+I;AAC/I,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAKD,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC7D,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC;IACb,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,MAAmB;IAEnB,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,kBAAkB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,iBAAiB,CAAC,EAAE,CAAC;YAAE,SAAS;QACpC,IAAI,4BAA4B,CAAC,EAAE,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,eAAyD,EAAE;IAE3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7D,IAAI,QAAQ,GAAG,IAAI;SAChB,OAAO,CAAC,gCAAgC,EAAE,mBAAmB,CAAC;SAC9D,OAAO,CAAC,0DAA0D,EAAE,gBAAgB,CAAC;SACrF,OAAO,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChE,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kIAAkI;AAClI,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/providers/elevenlabs.d.ts

@@ -0,0 +1,28 @@
+export interface ElevenLabsVoiceOption {
+    voiceId: string;
+    name: string;
+    category?: string;
+    labels?: Record<string, string>;
+    previewUrl?: string;
+}
+export interface ElevenLabsCredentials {
+    apiKey: string;
+    baseUrl?: string;
+}
+/** Host-supplied credential lookup — replaces OD's product-owned settings-store reader. */
+export type ElevenLabsCredentialResolver = (workspaceKey: string) => Promise<ElevenLabsCredentials>;
+/** Thrown when {@link ElevenLabsCredentialResolver} resolves no API key. */
+export declare class ElevenLabsCredentialMissingError extends Error {
+    constructor();
+}
+/**
+ * Lists the ElevenLabs voice catalog for a workspace, resolving credentials
+ * via the injected {@link ElevenLabsCredentialResolver} and caching the
+ * result for {@link ELEVENLABS_VOICE_CACHE_TTL_MS}. Throws
+ * {@link ElevenLabsCredentialMissingError} when no API key is configured.
+ */
+export declare function listElevenLabsVoiceOptions(workspaceKey: string, resolveCredentials: ElevenLabsCredentialResolver, options?: {
+    limit?: number;
+    requestInit?: Pick<RequestInit, 'dispatcher'>;
+}): Promise<ElevenLabsVoiceOption[]>;
+//# sourceMappingURL=elevenlabs.d.ts.map

package/dist/providers/elevenlabs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elevenlabs.d.ts","sourceRoot":"","sources":["../../src/providers/elevenlabs.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,2FAA2F;AAC3F,MAAM,MAAM,4BAA4B,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpG,4EAA4E;AAC5E,qBAAa,gCAAiC,SAAQ,KAAK;;CAK1D;AA+ED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,YAAY,EAAE,MAAM,EACpB,kBAAkB,EAAE,4BAA4B,EAChD,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;CAC1C,GACL,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAgDlC"}

package/dist/providers/elevenlabs.js

@@ -0,0 +1,138 @@
+/**
+ * @module providers/elevenlabs
+ *
+ * ElevenLabs voice-catalog listing (`GET /v2/voices`), with a short in-memory
+ * TTL cache keyed by workspace + base URL + page size + a credential
+ * fingerprint (never the raw key). Ported from OD's
+ * `integrations/elevenlabs-voices.ts`.
+ *
+ * De-branded: the origin resolved the API key/base URL via OD's own
+ * `resolveProviderConfig` (`../media/config.js`, a product-owned
+ * settings-store reader entirely out of this package's scope) and threw a
+ * hardcoded product-prefixed env-var hint (see `source-map.md` for the
+ * exact original string). Both are replaced by an
+ * injected {@link ElevenLabsCredentialResolver} port — a host supplies its
+ * own settings-store/env lookup; this package only knows how to call the
+ * ElevenLabs wire API once it has a key.
+ */
+import { createHash } from 'node:crypto';
+const ELEVENLABS_DEFAULT_BASE_URL = 'https://api.elevenlabs.io';
+const ELEVENLABS_DEFAULT_VOICE_LIMIT = 100;
+const ELEVENLABS_MAX_VOICE_LIMIT = 100;
+const ELEVENLABS_VOICE_CACHE_TTL_MS = 10 * 60 * 1000;
+/** Thrown when {@link ElevenLabsCredentialResolver} resolves no API key. */
+export class ElevenLabsCredentialMissingError extends Error {
+    constructor() {
+        super('no ElevenLabs API key configured for this workspace');
+        this.name = 'ElevenLabsCredentialMissingError';
+    }
+}
+const voiceOptionsCache = new Map();
+function isRecord(value) {
+    return value !== null && typeof value === 'object';
+}
+function readString(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : '';
+}
+function readLabels(value) {
+    if (!isRecord(value))
+        return undefined;
+    const labels = {};
+    for (const [key, raw] of Object.entries(value)) {
+        const normalized = readString(raw);
+        if (normalized)
+            labels[key] = normalized;
+    }
+    return Object.keys(labels).length > 0 ? labels : undefined;
+}
+function clampLimit(limit) {
+    if (typeof limit !== 'number' || !Number.isFinite(limit)) {
+        return ELEVENLABS_DEFAULT_VOICE_LIMIT;
+    }
+    return Math.min(ELEVENLABS_MAX_VOICE_LIMIT, Math.max(1, Math.floor(limit)));
+}
+function normalizeVoice(value) {
+    if (!isRecord(value))
+        return null;
+    const voiceId = readString(value.voice_id);
+    if (!voiceId)
+        return null;
+    const name = readString(value.name) || voiceId;
+    const category = readString(value.category);
+    const previewUrl = readString(value.preview_url);
+    const labels = readLabels(value.labels);
+    return {
+        voiceId,
+        name,
+        ...(category ? { category } : {}),
+        ...(labels ? { labels } : {}),
+        ...(previewUrl ? { previewUrl } : {}),
+    };
+}
+function cacheCredentialFingerprint(apiKey) {
+    return createHash('sha256').update(apiKey).digest('hex').slice(0, 16);
+}
+function voiceCacheKey(input) {
+    return [
+        input.workspaceKey,
+        input.baseUrl,
+        input.pageSize,
+        cacheCredentialFingerprint(input.apiKey),
+    ].join('\0');
+}
+function cloneVoiceOptions(voices) {
+    return voices.map((voice) => ({
+        ...voice,
+        ...(voice.labels ? { labels: { ...voice.labels } } : {}),
+    }));
+}
+/**
+ * Lists the ElevenLabs voice catalog for a workspace, resolving credentials
+ * via the injected {@link ElevenLabsCredentialResolver} and caching the
+ * result for {@link ELEVENLABS_VOICE_CACHE_TTL_MS}. Throws
+ * {@link ElevenLabsCredentialMissingError} when no API key is configured.
+ */
+export async function listElevenLabsVoiceOptions(workspaceKey, resolveCredentials, options = {}) {
+    const credentials = await resolveCredentials(workspaceKey);
+    if (!credentials.apiKey) {
+        throw new ElevenLabsCredentialMissingError();
+    }
+    const baseUrl = (credentials.baseUrl || ELEVENLABS_DEFAULT_BASE_URL).replace(/\/$/, '');
+    const pageSize = clampLimit(options.limit);
+    const cacheKey = voiceCacheKey({
+        workspaceKey,
+        baseUrl,
+        apiKey: credentials.apiKey,
+        pageSize,
+    });
+    const cached = voiceOptionsCache.get(cacheKey);
+    const now = Date.now();
+    if (cached && cached.expiresAt > now) {
+        return cloneVoiceOptions(cached.voices);
+    }
+    const resp = await fetch(`${baseUrl}/v2/voices?page_size=${pageSize}`, {
+        ...options.requestInit,
+        method: 'GET',
+        headers: {
+            'xi-api-key': credentials.apiKey,
+            accept: 'application/json',
+        },
+    });
+    if (!resp.ok) {
+        const errText = await resp.text();
+        throw new Error(`elevenlabs voices ${resp.status}: ${errText.slice(0, 240)}`);
+    }
+    const payload = await resp.json();
+    const rawVoices = isRecord(payload) && Array.isArray(payload.voices)
+        ? payload.voices
+        : [];
+    const voices = rawVoices
+        .map((voice) => normalizeVoice(voice))
+        .filter((voice) => voice !== null);
+    voiceOptionsCache.set(cacheKey, {
+        expiresAt: now + ELEVENLABS_VOICE_CACHE_TTL_MS,
+        voices: cloneVoiceOptions(voices),
+    });
+    return voices;
+}
+//# sourceMappingURL=elevenlabs.js.map

package/dist/providers/elevenlabs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"elevenlabs.js","sourceRoot":"","sources":["../../src/providers/elevenlabs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAChE,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAC3C,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAoBrD,4EAA4E;AAC5E,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IACzD;QACE,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAOD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE7D,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,OAAO,8BAA8B,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CACb,0BAA0B,EAC1B,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC;IAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO;QACP,IAAI;QACJ,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,aAAa,CAAC,KAKtB;IACC,OAAO;QACL,KAAK,CAAC,YAAY;QAClB,KAAK,CAAC,OAAO;QACb,KAAK,CAAC,QAAQ;QACd,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC;KACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA+B;IACxD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,GAAG,KAAK;QACR,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,YAAoB,EACpB,kBAAgD,EAChD,UAGI,EAAE;IAEN,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,gCAAgC,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,OAAO,IAAI,2BAA2B,CAAC,CAAC,OAAO,CAC1E,KAAK,EACL,EAAE,CACH,CAAC;IACF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC;QAC7B,YAAY;QACZ,OAAO;QACP,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACrC,OAAO,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,wBAAwB,QAAQ,EAAE,EAAE;QACrE,GAAG,OAAO,CAAC,WAAW;QACtB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,YAAY,EAAE,WAAW,CAAC,MAAM;YAChC,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAa,CAAC;IAC7C,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QAClE,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,SAAS;SACrB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;SACrC,MAAM,CAAC,CAAC,KAAK,EAAkC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IACrE,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE;QAC9B,SAAS,EAAE,GAAG,GAAG,6BAA6B;QAC9C,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/providers/google-messages.d.ts

@@ -0,0 +1,108 @@
+import { type TurnEndReason } from './turn-end-guard.js';
+export interface GoogleTextPart {
+    readonly text: string;
+}
+export interface GoogleFunctionCallPart {
+    readonly functionCall: {
+        readonly name: string;
+        readonly args: unknown;
+        readonly id?: string;
+    };
+}
+export interface GoogleFunctionResponsePart {
+    readonly functionResponse: {
+        readonly name: string;
+        readonly response: unknown;
+        readonly id?: string;
+    };
+}
+export type GooglePart = GoogleTextPart | GoogleFunctionCallPart | GoogleFunctionResponsePart;
+export interface GoogleContent {
+    readonly role: 'user' | 'model';
+    readonly parts: readonly GooglePart[];
+}
+export interface GoogleFunctionDeclaration {
+    readonly name: string;
+    readonly description?: string;
+    readonly parameters: Record<string, unknown>;
+}
+export interface GoogleToolDef {
+    readonly functionDeclarations: readonly GoogleFunctionDeclaration[];
+}
+export interface GoogleToolCall {
+    readonly id: string;
+    readonly name: string;
+    readonly input: unknown;
+}
+export interface GoogleToolResult {
+    readonly content: string;
+    readonly isError?: boolean;
+}
+/** Host-owned tool execution — same "the collaborator is always supplied" convention as `anthropic-messages.ts#AnthropicToolExecutor`. */
+export type GoogleToolExecutor = (call: GoogleToolCall) => Promise<GoogleToolResult>;
+/** Why a `runGoogleToolTurn` call ended its event stream. */
+export type GoogleTurnEndReason = TurnEndReason;
+export type GoogleTurnEvent = {
+    readonly type: 'status';
+    readonly label: string;
+} | {
+    readonly type: 'text_delta';
+    readonly delta: string;
+} | {
+    readonly type: 'tool_use';
+    readonly id: string;
+    readonly name: string;
+    readonly input: unknown;
+} | {
+    readonly type: 'tool_result';
+    readonly toolUseId: string;
+    readonly content: string;
+    readonly isError: boolean;
+} | {
+    readonly type: 'usage';
+    readonly usage: Record<string, unknown> | null;
+} | {
+    readonly type: 'fabricated_role_marker';
+    readonly marker: string;
+    readonly messageId: string;
+} | {
+    readonly type: 'error';
+    readonly message: string;
+    readonly code?: string;
+} | {
+    readonly type: 'end';
+    readonly reason: GoogleTurnEndReason;
+};
+export interface GoogleTurnOptions {
+    readonly apiKey: string;
+    /** Defaults to `https://generativelanguage.googleapis.com`. Overridable for BYOK-compatible gateways. */
+    readonly baseUrl?: string;
+    readonly model: string;
+    readonly system?: string;
+    readonly contents: readonly GoogleContent[];
+    readonly tools?: readonly GoogleToolDef[];
+    readonly temperature?: number;
+    readonly maxOutputTokens?: number;
+    /** Same bound and rationale as `AnthropicTurnOptions.maxToolTurns`. Defaults to 8. */
+    readonly maxToolTurns?: number;
+    readonly executeTool?: GoogleToolExecutor;
+    readonly onEvent: (event: GoogleTurnEvent) => void;
+    readonly signal?: AbortSignal;
+    /** Caller-supplied extra headers — see `anthropic-messages.ts#AnthropicTurnOptions.extraHeaders`'s doc for why this exists and what it fixes. */
+    readonly extraHeaders?: Record<string, string>;
+}
+export interface GoogleTurnResult {
+    readonly finishReason: string | null;
+    readonly toolTurns: number;
+}
+/**
+ * Runs a full Gemini `streamGenerateContent` turn, including the
+ * tool-execution loop when `options.executeTool` is supplied and the model
+ * requests a function call. See `anthropic-messages.ts#runAnthropicToolTurn`'s
+ * doc for the shared event-stream/`ended`-flag contract this mirrors — with
+ * one deliberate structural difference: the loop-continuation predicate is
+ * `toolCalls.length > 0`, not a `finishReason` comparison (see module doc,
+ * point 2, for why Gemini's `finishReason` enum cannot be used here).
+ */
+export declare function runGoogleToolTurn(options: GoogleTurnOptions): Promise<GoogleTurnResult>;
+//# sourceMappingURL=google-messages.d.ts.map

package/dist/providers/google-messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google-messages.d.ts","sourceRoot":"","sources":["../../src/providers/google-messages.ts"],"names":[],"mappings":"AAsDA,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,EAAE;QACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;QACvB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,gBAAgB,EAAE;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,sBAAsB,GAAG,0BAA0B,CAAC;AAE9F,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACrE;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,0IAA0I;AAC1I,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAErF,6DAA6D;AAC7D,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEhD,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAClG;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GACjH;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CAAE,GAC1E;IAAE,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAChG;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yGAAyG;IACzG,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,iJAAiJ;IACjJ,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAkMD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA0D7F"}