@jxburros/ai-nugget 0.4.1 → 0.7.0

package/nugget/dist/json.d.ts

@@ -0,0 +1,7 @@
+export declare function extractJson(text: string): unknown | null;
+export declare function extractJsonWithSchema<T>(text: string, parse: (value: unknown) => T): T;
+export declare function requireString(record: Record<string, unknown>, key: string): string;
+export declare function requireNumber(record: Record<string, unknown>, key: string): number;
+export declare function requireStringArray(record: Record<string, unknown>, key: string): string[];
+export declare function requireOptionalString(record: Record<string, unknown>, key: string): string | undefined;
+//# sourceMappingURL=json.d.ts.map

package/nugget/dist/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AAEA,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAmBxD;AA0CD,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAStF;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAIlF;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAIlF;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAMzF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKtG"}

package/nugget/dist/json.js

@@ -0,0 +1,114 @@
+import { AIError } from './errors.js';
+export function extractJson(text) {
+    const trimmed = text.trim();
+    if (!trimmed)
+        return null;
+    const direct = tryParse(trimmed);
+    if (direct.ok)
+        return direct.value;
+    const fenced = /```(?:json)?\s*([\s\S]*?)```/i.exec(text);
+    if (fenced?.[1]) {
+        const parsed = tryParse(fenced[1].trim());
+        if (parsed.ok)
+            return parsed.value;
+    }
+    for (const [open, close] of [['{', '}'], ['[', ']']]) {
+        for (const span of balancedSpans(text, open, close)) {
+            const parsed = tryParse(span);
+            if (parsed.ok)
+                return parsed.value;
+        }
+    }
+    return null;
+}
+/**
+ * Yields each top-level `open`/`close` balanced substring of `text`, tracking
+ * nesting depth and skipping over string-literal content (including escapes)
+ * so a stray brace inside a string or trailing prose can't prematurely close
+ * or extend a span. Used instead of first-`indexOf`/last-`lastIndexOf` so
+ * multiple JSON regions (or JSON followed by unrelated braces) don't get
+ * spliced into one bogus span.
+ */
+function* balancedSpans(text, open, close) {
+    let depth = 0;
+    let spanStart = -1;
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < text.length; i += 1) {
+        const ch = text[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === '\\')
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            continue;
+        }
+        if (ch === open) {
+            if (depth === 0)
+                spanStart = i;
+            depth += 1;
+            continue;
+        }
+        if (ch === close && depth > 0) {
+            depth -= 1;
+            if (depth === 0 && spanStart >= 0) {
+                yield text.slice(spanStart, i + 1);
+                spanStart = -1;
+            }
+        }
+    }
+}
+export function extractJsonWithSchema(text, parse) {
+    const value = extractJson(text);
+    if (value === null)
+        throw new AIError('No JSON object or array found in model output', { kind: 'invalid_response' });
+    try {
+        return parse(value);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'JSON did not match expected schema';
+        throw new AIError(message, { kind: 'invalid_response', cause: error });
+    }
+}
+export function requireString(record, key) {
+    const value = record[key];
+    if (typeof value !== 'string')
+        throw new Error(`Expected ${key} to be a string`);
+    return value;
+}
+export function requireNumber(record, key) {
+    const value = record[key];
+    if (typeof value !== 'number' || !Number.isFinite(value))
+        throw new Error(`Expected ${key} to be a number`);
+    return value;
+}
+export function requireStringArray(record, key) {
+    const value = record[key];
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== 'string')) {
+        throw new Error(`Expected ${key} to be a string array`);
+    }
+    return value;
+}
+export function requireOptionalString(record, key) {
+    const value = record[key];
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'string')
+        throw new Error(`Expected ${key} to be a string when present`);
+    return value;
+}
+function tryParse(text) {
+    try {
+        return { ok: true, value: JSON.parse(text) };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+//# sourceMappingURL=json.js.map

package/nugget/dist/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAEnC,MAAM,MAAM,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACrC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAU,EAAE,CAAC;QAC9D,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,QAAQ,CAAC,CAAC,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,KAAa;IAC/D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;IACnB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,IAAI,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,IAAI,KAAK,KAAK,CAAC;gBAAE,SAAS,GAAG,CAAC,CAAC;YAC/B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,KAAK,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBACnC,SAAS,GAAG,CAAC,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAI,IAAY,EAAE,KAA4B;IACjF,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,IAAI;QAAE,MAAM,IAAI,OAAO,CAAC,+CAA+C,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACrH,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC,CAAC;QAC9F,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAA+B,EAAE,GAAW;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,iBAAiB,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAA+B,EAAE,GAAW;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,iBAAiB,CAAC,CAAC;IAC5G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA+B,EAAE,GAAW;IAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,uBAAuB,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA+B,EAAE,GAAW;IAChF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,8BAA8B,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/nugget/dist/keys.d.ts

@@ -0,0 +1,7 @@
+import type { KeyRef, KeySource } from './types.js';
+export declare function parseKeyRef(value?: string | null): KeyRef;
+export declare function envKeySource(env?: Record<string, string | undefined>): KeySource;
+export declare function literalKeySource(): KeySource;
+export declare function memoryKeySource(values: Record<string, string | null | undefined>): KeySource;
+export declare function chainKeySources(...sources: KeySource[]): KeySource;
+//# sourceMappingURL=keys.d.ts.map

package/nugget/dist/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGpD,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAWzD;AAED,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,SAAS,CAS7F;AAED,wBAAgB,gBAAgB,IAAI,SAAS,CAQ5C;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,SAAS,CAU5F;AAED,wBAAgB,eAAe,CAAC,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,CAgBlE"}

package/nugget/dist/keys.js

@@ -0,0 +1,75 @@
+import { globalEnv } from './util.js';
+export function parseKeyRef(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return { kind: 'none' };
+    const braced = /^\$\{([A-Z0-9_]+)\}$/.exec(trimmed);
+    if (braced?.[1])
+        return { kind: 'env', name: braced[1] };
+    const dollar = /^\$([A-Z0-9_]+)$/.exec(trimmed);
+    if (dollar?.[1])
+        return { kind: 'env', name: dollar[1] };
+    if (/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed))
+        return { kind: 'env', name: trimmed };
+    if (trimmed.startsWith('secret://'))
+        return { kind: 'brokered', ref: trimmed };
+    if (trimmed.startsWith('stored://'))
+        return { kind: 'stored', ref: trimmed.slice('stored://'.length) };
+    return { kind: 'literal', value: trimmed };
+}
+export function envKeySource(env = globalEnv()) {
+    return {
+        async resolve(ref) {
+            if (ref.kind === 'none')
+                return { ok: true, apiKey: null };
+            if (ref.kind !== 'env')
+                return { ok: false, reason: 'denied' };
+            const apiKey = env[ref.name]?.trim();
+            return apiKey ? { ok: true, apiKey } : { ok: false, reason: 'missing' };
+        },
+    };
+}
+export function literalKeySource() {
+    return {
+        async resolve(ref) {
+            if (ref.kind === 'none')
+                return { ok: true, apiKey: null };
+            if (ref.kind === 'literal')
+                return { ok: true, apiKey: ref.value };
+            return { ok: false, reason: 'denied' };
+        },
+    };
+}
+export function memoryKeySource(values) {
+    return {
+        async resolve(ref) {
+            if (ref.kind === 'none')
+                return { ok: true, apiKey: null };
+            if (ref.kind === 'literal')
+                return { ok: true, apiKey: ref.value };
+            const key = ref.kind === 'env' ? ref.name : ref.ref;
+            const value = values[key]?.trim();
+            return value ? { ok: true, apiKey: value } : { ok: false, reason: 'missing' };
+        },
+    };
+}
+export function chainKeySources(...sources) {
+    return {
+        async resolve(ref) {
+            let missing = false;
+            for (const source of sources) {
+                const result = await source.resolve(ref);
+                if (result.ok)
+                    return result;
+                if (result.reason === 'locked')
+                    return result;
+                if (result.reason === 'missing') {
+                    missing = true;
+                    continue;
+                }
+            }
+            return missing ? { ok: false, reason: 'missing' } : { ok: false, reason: 'denied' };
+        },
+    };
+}
+//# sourceMappingURL=keys.js.map

package/nugget/dist/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,UAAU,WAAW,CAAC,KAAqB;IAC/C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChF,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC/E,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;IACvG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAA0C,SAAS,EAAE;IAChF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC3D,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC3D,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;YACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAiD;IAC/E,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC3D,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;YACnE,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YACpD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAG,OAAoB;IACrD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACzC,IAAI,MAAM,CAAC,EAAE;oBAAE,OAAO,MAAM,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;oBAAE,OAAO,MAAM,CAAC;gBAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAChC,OAAO,GAAG,IAAI,CAAC;oBACf,SAAS;gBACX,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/nugget/dist/policy.d.ts

@@ -0,0 +1,6 @@
+import type { GovernancePolicy } from './types.js';
+export declare function allowAllPolicy(): GovernancePolicy;
+export declare function blocklistPolicy(patterns: RegExp[]): GovernancePolicy;
+export declare function allowlistPolicy(prefixesByProvider: Record<string, string[]>): GovernancePolicy;
+export declare function composePolicies(...policies: GovernancePolicy[]): GovernancePolicy;
+//# sourceMappingURL=policy.d.ts.map

package/nugget/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,wBAAgB,cAAc,IAAI,gBAAgB,CAEjD;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAQpE;AAED,wBAAgB,eAAe,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,gBAAgB,CAU9F;AAED,wBAAgB,eAAe,CAAC,GAAG,QAAQ,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAUjF"}

package/nugget/dist/policy.js

@@ -0,0 +1,37 @@
+export function allowAllPolicy() {
+    return { checkModel: () => ({ allowed: true }) };
+}
+export function blocklistPolicy(patterns) {
+    return {
+        checkModel(provider, model) {
+            const target = `${provider}/${model}`;
+            const blocked = patterns.find((pattern) => pattern.test(target));
+            return blocked ? { allowed: false, reason: `Model blocked by policy: ${blocked}` } : { allowed: true };
+        },
+    };
+}
+export function allowlistPolicy(prefixesByProvider) {
+    return {
+        checkModel(provider, model) {
+            const prefixes = prefixesByProvider[provider];
+            if (!prefixes || prefixes.length === 0)
+                return { allowed: false, reason: `No models are allowed for provider ${provider}` };
+            return prefixes.some((prefix) => prefix === '*' || model.startsWith(prefix))
+                ? { allowed: true }
+                : { allowed: false, reason: `Model is not allowed for provider ${provider}` };
+        },
+    };
+}
+export function composePolicies(...policies) {
+    return {
+        checkModel(provider, model) {
+            for (const policy of policies) {
+                const result = policy.checkModel(provider, model);
+                if (!result.allowed)
+                    return result;
+            }
+            return { allowed: true };
+        },
+    };
+}
+//# sourceMappingURL=policy.js.map

package/nugget/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,cAAc;IAC5B,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAkB;IAChD,OAAO;QACL,UAAU,CAAC,QAAQ,EAAE,KAAK;YACxB,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,kBAA4C;IAC1E,OAAO;QACL,UAAU,CAAC,QAAQ,EAAE,KAAK;YACxB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,QAAQ,EAAE,EAAE,CAAC;YAC5H,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC1E,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;gBACnB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,QAAQ,EAAE,EAAE,CAAC;QAClF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAG,QAA4B;IAC7D,OAAO;QACL,UAAU,CAAC,QAAQ,EAAE,KAAK;YACxB,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,MAAM,CAAC;YACrC,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/nugget/dist/reasoning.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Inline reasoning stripper — keeps a reasoning model's chain of thought out of `delta` events
+ * and `ChatResult.text`, routing it to the `reasoning` stream event instead.
+ *
+ * Reasoning models (deepseek-r1, phi4-reasoning, qwq, …) emit their thinking either in the
+ * provider's dedicated field — which every engine already maps to `{ type: 'reasoning' }` — or
+ * INLINE in the answer as `<think>…</think>`-style blocks. Inline reasoning routinely quotes the
+ * system prompt and tool instructions back verbatim, so an app that streams `delta` straight to
+ * a screen, a database or a JSON parser leaks it. Every consumer would otherwise write this
+ * state machine, and most would get the split-tag and template-opened cases wrong; the handler
+ * runs it once, on every engine, unless `HandlerOptions.stripInlineReasoning` is `false`.
+ *
+ * Ported from AI Server Studio's `services/reasoningFilter.ts` (2026-09-05), which had to exist
+ * because the nugget did not do this.
+ *
+ * Two subtleties the tests pin:
+ *   - Tags may be split across chunks, so a trailing partial `<thi` is held back until the next
+ *     chunk decides whether it opens a tag. An unterminated block is reasoning to the end.
+ *   - The **orphan close**: a closing tag with no opening one at the head of the stream, because
+ *     the runtime's chat template emitted `<think>` itself. Handled once per stream, only before
+ *     any visible text has gone out, and only when the closing tag starts its own line — a
+ *     `</think>` quoted mid-sentence in a real answer is left alone.
+ */
+export interface ReasoningStripResult {
+    /** Text safe to show from this chunk (may be empty). */
+    visible: string;
+    /** Reasoning text removed from this chunk (may be empty). */
+    reasoning: string;
+}
+export interface ReasoningStripper {
+    /** Feed the next raw delta; returns what may be shown and what was reasoning. */
+    push(chunk: string): ReasoningStripResult;
+    /** End of stream: flushes any held-back prefix that never became a tag. */
+    end(): ReasoningStripResult;
+    /** True while inside an unterminated reasoning block. */
+    readonly inReasoning: boolean;
+}
+export declare function createReasoningStripper(): ReasoningStripper;
+/** Whole-string form: `{ visible, reasoning }` for already-buffered text. */
+export declare function stripReasoningBlocksDetailed(text: string): ReasoningStripResult;
+/** Whole-string form returning only the visible text. */
+export declare function stripReasoningBlocks(text: string): string;
+/** Cheap pre-check: does `text` carry any inline reasoning tag (open or close)? */
+export declare function containsReasoningBlock(text: string): boolean;
+//# sourceMappingURL=reasoning.d.ts.map

package/nugget/dist/reasoning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reasoning.d.ts","sourceRoot":"","sources":["../src/reasoning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAWH,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,CAAC;IAC1C,2EAA2E;IAC3E,GAAG,IAAI,oBAAoB,CAAC;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAqBD,wBAAgB,uBAAuB,IAAI,iBAAiB,CAqF3D;AAED,6EAA6E;AAC7E,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAM/E;AAED,yDAAyD;AACzD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG5D"}

package/nugget/dist/reasoning.js

@@ -0,0 +1,154 @@
+/**
+ * Inline reasoning stripper — keeps a reasoning model's chain of thought out of `delta` events
+ * and `ChatResult.text`, routing it to the `reasoning` stream event instead.
+ *
+ * Reasoning models (deepseek-r1, phi4-reasoning, qwq, …) emit their thinking either in the
+ * provider's dedicated field — which every engine already maps to `{ type: 'reasoning' }` — or
+ * INLINE in the answer as `<think>…</think>`-style blocks. Inline reasoning routinely quotes the
+ * system prompt and tool instructions back verbatim, so an app that streams `delta` straight to
+ * a screen, a database or a JSON parser leaks it. Every consumer would otherwise write this
+ * state machine, and most would get the split-tag and template-opened cases wrong; the handler
+ * runs it once, on every engine, unless `HandlerOptions.stripInlineReasoning` is `false`.
+ *
+ * Ported from AI Server Studio's `services/reasoningFilter.ts` (2026-09-05), which had to exist
+ * because the nugget did not do this.
+ *
+ * Two subtleties the tests pin:
+ *   - Tags may be split across chunks, so a trailing partial `<thi` is held back until the next
+ *     chunk decides whether it opens a tag. An unterminated block is reasoning to the end.
+ *   - The **orphan close**: a closing tag with no opening one at the head of the stream, because
+ *     the runtime's chat template emitted `<think>` itself. Handled once per stream, only before
+ *     any visible text has gone out, and only when the closing tag starts its own line — a
+ *     `</think>` quoted mid-sentence in a real answer is left alone.
+ */
+const TAG_PAIRS = [
+    { open: '<think>', close: '</think>' },
+    { open: '<thinking>', close: '</thinking>' },
+    { open: '<reasoning>', close: '</reasoning>' },
+    { open: '<|begin_of_thought|>', close: '<|end_of_thought|>' },
+];
+const LONGEST_TAG = Math.max(...TAG_PAIRS.flatMap((p) => [p.open.length, p.close.length]));
+function partialTagSuffixLength(text) {
+    const lower = text.toLowerCase();
+    const maxLen = Math.min(LONGEST_TAG - 1, lower.length);
+    for (let len = maxLen; len >= 1; len -= 1) {
+        const tail = lower.slice(lower.length - len);
+        if (tail[0] !== '<')
+            continue;
+        for (const pair of TAG_PAIRS) {
+            if (pair.open.startsWith(tail) || pair.close.startsWith(tail))
+                return len;
+        }
+    }
+    return 0;
+}
+function closesOwnLine(text, idx) {
+    let i = idx - 1;
+    while (i >= 0 && (text[i] === ' ' || text[i] === '\t' || text[i] === '\r'))
+        i -= 1;
+    return i < 0 || text[i] === '\n';
+}
+export function createReasoningStripper() {
+    let pending = '';
+    let inReasoning = false;
+    let closeTag = '';
+    let emittedVisible = false;
+    let orphanConsumed = false;
+    function process(input, flushAll) {
+        let text = pending + input;
+        pending = '';
+        let visible = '';
+        let reasoning = '';
+        while (text.length > 0) {
+            const lower = text.toLowerCase();
+            if (inReasoning) {
+                const idx = lower.indexOf(closeTag);
+                if (idx === -1) {
+                    const hold = flushAll ? 0 : partialTagSuffixLength(text);
+                    const consumed = text.length - hold;
+                    reasoning += text.slice(0, consumed);
+                    pending = text.slice(consumed);
+                    text = '';
+                    if (flushAll) {
+                        reasoning += pending;
+                        pending = '';
+                    }
+                    break;
+                }
+                reasoning += text.slice(0, idx);
+                text = text.slice(idx + closeTag.length);
+                inReasoning = false;
+                closeTag = '';
+                if (text.startsWith('\n'))
+                    text = text.slice(1);
+                continue;
+            }
+            let openIdx = -1;
+            let pair = null;
+            for (const p of TAG_PAIRS) {
+                const i = lower.indexOf(p.open);
+                if (i !== -1 && (openIdx === -1 || i < openIdx)) {
+                    openIdx = i;
+                    pair = p;
+                }
+            }
+            let orphanCloseIdx = -1;
+            let orphanCloseLen = 0;
+            if (!emittedVisible && !orphanConsumed) {
+                for (const p of TAG_PAIRS) {
+                    const i = lower.indexOf(p.close);
+                    if (i !== -1 && (orphanCloseIdx === -1 || i < orphanCloseIdx) && closesOwnLine(text, i)) {
+                        orphanCloseIdx = i;
+                        orphanCloseLen = p.close.length;
+                    }
+                }
+            }
+            if (orphanCloseIdx !== -1 && (openIdx === -1 || orphanCloseIdx < openIdx)) {
+                orphanConsumed = true;
+                reasoning += text.slice(0, orphanCloseIdx);
+                text = text.slice(orphanCloseIdx + orphanCloseLen).replace(/^\n+/, '');
+                continue;
+            }
+            if (openIdx === -1 || !pair) {
+                const hold = flushAll ? 0 : partialTagSuffixLength(text);
+                visible += text.slice(0, text.length - hold);
+                pending = text.slice(text.length - hold);
+                text = '';
+                break;
+            }
+            visible += text.slice(0, openIdx);
+            text = text.slice(openIdx + pair.open.length);
+            inReasoning = true;
+            closeTag = pair.close;
+        }
+        if (visible.trim().length > 0)
+            emittedVisible = true;
+        return { visible, reasoning };
+    }
+    return {
+        push: (chunk) => process(chunk, false),
+        end: () => process('', true),
+        get inReasoning() {
+            return inReasoning;
+        },
+    };
+}
+/** Whole-string form: `{ visible, reasoning }` for already-buffered text. */
+export function stripReasoningBlocksDetailed(text) {
+    if (!text)
+        return { visible: '', reasoning: '' };
+    const stripper = createReasoningStripper();
+    const a = stripper.push(text);
+    const b = stripper.end();
+    return { visible: (a.visible + b.visible).trim(), reasoning: a.reasoning + b.reasoning };
+}
+/** Whole-string form returning only the visible text. */
+export function stripReasoningBlocks(text) {
+    return stripReasoningBlocksDetailed(text).visible;
+}
+/** Cheap pre-check: does `text` carry any inline reasoning tag (open or close)? */
+export function containsReasoningBlock(text) {
+    const lower = text.toLowerCase();
+    return TAG_PAIRS.some((p) => lower.includes(p.open) || lower.includes(p.close));
+}
+//# sourceMappingURL=reasoning.js.map

package/nugget/dist/reasoning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reasoning.js","sourceRoot":"","sources":["../src/reasoning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,SAAS,GAAsC;IACnD,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE;IACtC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE;IAC5C,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE;IAC9C,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,oBAAoB,EAAE;CAC9D,CAAC;AAEF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAkB3F,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvD,KAAK,IAAI,GAAG,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,SAAS;QAC9B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,GAAW;IAC9C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAChB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,SAAS,OAAO,CAAC,KAAa,EAAE,QAAiB;QAC/C,IAAI,IAAI,GAAG,OAAO,GAAG,KAAK,CAAC;QAC3B,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,SAAS,GAAG,EAAE,CAAC;QAEnB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACf,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;oBACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;oBACpC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;oBACrC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;oBAC/B,IAAI,GAAG,EAAE,CAAC;oBACV,IAAI,QAAQ,EAAE,CAAC;wBACb,SAAS,IAAI,OAAO,CAAC;wBACrB,OAAO,GAAG,EAAE,CAAC;oBACf,CAAC;oBACD,MAAM;gBACR,CAAC;gBACD,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAChC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACzC,WAAW,GAAG,KAAK,CAAC;gBACpB,QAAQ,GAAG,EAAE,CAAC;gBACd,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAChD,SAAS;YACX,CAAC;YACD,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;YACjB,IAAI,IAAI,GAA2C,IAAI,CAAC;YACxD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;oBAChD,OAAO,GAAG,CAAC,CAAC;oBACZ,IAAI,GAAG,CAAC,CAAC;gBACX,CAAC;YACH,CAAC;YACD,IAAI,cAAc,GAAG,CAAC,CAAC,CAAC;YACxB,IAAI,cAAc,GAAG,CAAC,CAAC;YACvB,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,EAAE,CAAC;gBACvC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBACjC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;wBACxF,cAAc,GAAG,CAAC,CAAC;wBACnB,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;oBAClC,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,cAAc,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,cAAc,GAAG,OAAO,CAAC,EAAE,CAAC;gBAC1E,cAAc,GAAG,IAAI,CAAC;gBACtB,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;gBAC3C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,cAAc,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACvE,SAAS;YACX,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;gBACzD,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;gBACzC,IAAI,GAAG,EAAE,CAAC;gBACV,MAAM;YACR,CAAC;YACD,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAClC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9C,WAAW,GAAG,IAAI,CAAC;YACnB,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,cAAc,GAAG,IAAI,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,OAAO;QACL,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACtC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC;QAC5B,IAAI,WAAW;YACb,OAAO,WAAW,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,4BAA4B,CAAC,IAAY;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;IACzB,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;AAC3F,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;AACpD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAClF,CAAC"}

package/nugget/dist/redact.d.ts

@@ -0,0 +1,26 @@
+import type { Redactor } from './types.js';
+/**
+ * Prefixed secret formats. Each pattern is anchored on a vendor prefix that is
+ * distinctive enough that a match is a secret, not a coincidence.
+ */
+export declare const SECRET_PATTERNS: RegExp[];
+/**
+ * Unprefixed/opaque secrets — Azure OpenAI `api-key` values, AWS *secret*
+ * access keys, generic bearer/session tokens — carry no distinctive prefix, so
+ * matching them on shape alone would redact commit SHAs, content hashes, and
+ * base64 payloads. These patterns instead anchor on the *label* that precedes
+ * the value (`api-key: …`, `"aws_secret_access_key": "…"`, `password=…`) and
+ * redact only the value, keeping the label readable in logs.
+ *
+ * Exact-match registration (`SessionRedactor.addSecret`, which the handler does
+ * for every resolved key) remains the only guaranteed catch for a bare,
+ * unlabeled, unprefixed secret.
+ */
+export declare const LABELED_SECRET_PATTERNS: RegExp[];
+export declare function createDefaultRedactor(extraSecrets?: Iterable<string>): Redactor;
+export declare class SessionRedactor implements Redactor {
+    private secrets;
+    addSecret(value: string | null | undefined): void;
+    redact(text: string): string;
+}
+//# sourceMappingURL=redact.d.ts.map

package/nugget/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,EAqBnC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,EAU3C,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,YAAY,GAAE,QAAQ,CAAC,MAAM,CAAM,GAAG,QAAQ,CAanF;AAED,qBAAa,eAAgB,YAAW,QAAQ;IAC9C,OAAO,CAAC,OAAO,CAAqB;IAEpC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAIjD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAG7B"}

package/nugget/dist/redact.js

@@ -0,0 +1,74 @@
+/**
+ * Prefixed secret formats. Each pattern is anchored on a vendor prefix that is
+ * distinctive enough that a match is a secret, not a coincidence.
+ */
+export const SECRET_PATTERNS = [
+    /sk-[A-Za-z0-9_-]{20,}/g,
+    /sk-proj-[A-Za-z0-9_-]{20,}/g,
+    /sk-ant-[A-Za-z0-9_-]{20,}/g,
+    /AIza[0-9A-Za-z_-]{20,}/g,
+    /gsk_[0-9A-Za-z_-]{20,}/g,
+    /xai-[0-9A-Za-z_-]{20,}/g,
+    /hf_[0-9A-Za-z]{20,}/g,
+    /nvapi-[0-9A-Za-z_-]{20,}/g,
+    /ghp_[0-9A-Za-z_]{20,}/g,
+    /github_pat_[0-9A-Za-z_]{20,}/g,
+    /glpat-[0-9A-Za-z_-]{20,}/g,
+    /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/gi,
+    /xox[baprs]-[0-9A-Za-z-]{10,}/g,
+    /AKIA[0-9A-Z]{16}/g,
+    /ASIA[0-9A-Z]{16}/g,
+    /SG\.[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{10,}/g,
+    /rk_live_[0-9A-Za-z]{20,}/g,
+    /pk_live_[0-9A-Za-z]{20,}/g,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+];
+/**
+ * Unprefixed/opaque secrets — Azure OpenAI `api-key` values, AWS *secret*
+ * access keys, generic bearer/session tokens — carry no distinctive prefix, so
+ * matching them on shape alone would redact commit SHAs, content hashes, and
+ * base64 payloads. These patterns instead anchor on the *label* that precedes
+ * the value (`api-key: …`, `"aws_secret_access_key": "…"`, `password=…`) and
+ * redact only the value, keeping the label readable in logs.
+ *
+ * Exact-match registration (`SessionRedactor.addSecret`, which the handler does
+ * for every resolved key) remains the only guaranteed catch for a bare,
+ * unlabeled, unprefixed secret.
+ */
+export const LABELED_SECRET_PATTERNS = [
+    new RegExp(
+    // Lookbehind rather than `\b` so an underscore-joined prefix still matches
+    // the label (`aws_secret_access_key`, `azure_api_key`).
+    String.raw `(?<![A-Za-z0-9])(api[_-]?key|apikey|secret[_-]?access[_-]?key|access[_-]?token|auth[_-]?token|session[_-]?token|client[_-]?secret|refresh[_-]?token|private[_-]?key|password|passwd)` +
+        // Optional closing quote handles JSON keys (`"api_key": "…"`).
+        String.raw `(["']?\s*[:=]\s*|\s+)` +
+        String.raw `(["']?)([A-Za-z0-9/+_.~-]{16,}={0,2})\3`, 'gi'),
+];
+export function createDefaultRedactor(extraSecrets = []) {
+    const secrets = new Set([...extraSecrets].filter((value) => value.length >= 6));
+    return {
+        redact(text) {
+            let output = text;
+            for (const pattern of SECRET_PATTERNS)
+                output = output.replace(pattern, '[REDACTED]');
+            for (const pattern of LABELED_SECRET_PATTERNS) {
+                output = output.replace(pattern, (_match, label, separator, quote) => `${label}${separator}${quote}[REDACTED]${quote}`);
+            }
+            for (const secret of secrets)
+                output = output.split(secret).join('[REDACTED]');
+            return output;
+        },
+    };
+}
+export class SessionRedactor {
+    secrets = new Set();
+    addSecret(value) {
+        if (value && value.length >= 6)
+            this.secrets.add(value);
+    }
+    redact(text) {
+        return createDefaultRedactor(this.secrets).redact(text);
+    }
+}
+//# sourceMappingURL=redact.js.map

package/nugget/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,wBAAwB;IACxB,6BAA6B;IAC7B,4BAA4B;IAC5B,yBAAyB;IACzB,yBAAyB;IACzB,yBAAyB;IACzB,sBAAsB;IACtB,2BAA2B;IAC3B,wBAAwB;IACxB,+BAA+B;IAC/B,2BAA2B;IAC3B,sCAAsC;IACtC,+BAA+B;IAC/B,mBAAmB;IACnB,mBAAmB;IACnB,6CAA6C;IAC7C,2BAA2B;IAC3B,2BAA2B;IAC3B,6EAA6E;IAC7E,oDAAoD;CACrD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAa;IAC/C,IAAI,MAAM;IACR,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,CAAC,GAAG,CAAA,sLAAsL;QAC9L,+DAA+D;QAC/D,MAAM,CAAC,GAAG,CAAA,uBAAuB;QACjC,MAAM,CAAC,GAAG,CAAA,yCAAyC,EACrD,IAAI,CACL;CACF,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,eAAiC,EAAE;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO;QACL,MAAM,CAAC,IAAY;YACjB,IAAI,MAAM,GAAG,IAAI,CAAC;YAClB,KAAK,MAAM,OAAO,IAAI,eAAe;gBAAE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YACtF,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;gBAC9C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,KAAa,EAAE,SAAiB,EAAE,KAAa,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,aAAa,KAAK,EAAE,CAAC,CAAC;YAClJ,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,eAAe;IAClB,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,SAAS,CAAC,KAAgC;QACxC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,CAAC,IAAY;QACjB,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;CACF"}

package/nugget/dist/tokens.d.ts

@@ -0,0 +1,5 @@
+import type { Usage } from './types.js';
+export declare function estimateTokens(text: string): number;
+export declare function estimatedUsage(inputText: string, outputText: string): Usage;
+export declare function mergeUsage(a: Usage, b: Usage): Usage;
+//# sourceMappingURL=tokens.d.ts.map

package/nugget/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,KAAK,CAM3E;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,GAAG,KAAK,CAMpD"}

package/nugget/dist/tokens.js

@@ -0,0 +1,18 @@
+export function estimateTokens(text) {
+    return Math.ceil(text.length / 4);
+}
+export function estimatedUsage(inputText, outputText) {
+    return {
+        inputTokens: estimateTokens(inputText),
+        outputTokens: estimateTokens(outputText),
+        estimated: true,
+    };
+}
+export function mergeUsage(a, b) {
+    return {
+        inputTokens: (a.inputTokens ?? 0) + (b.inputTokens ?? 0),
+        outputTokens: (a.outputTokens ?? 0) + (b.outputTokens ?? 0),
+        estimated: a.estimated || b.estimated,
+    };
+}
+//# sourceMappingURL=tokens.js.map