@kylecheng3146/agent-ops 0.0.1

package/dist/runtime/src/install/uninstall.js

@@ -0,0 +1,206 @@
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { sha256 } from "../fs/hash.js";
+import { removeManagedBlock } from "../fs/managed-block.js";
+import { parseInstallManifest } from "../fs/manifest.js";
+import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
+import { FileTransaction } from "../fs/transaction.js";
+import { assertExpectedManagedBlock, assertSupportedManifestOwnership } from "./ownership.js";
+const MANIFEST_PATH = ".agent-ops/manifest.json";
+const MAX_UNINSTALL_FILE_BYTES = 1024 * 1024;
+function isMissing(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === "ENOENT");
+}
+async function readCurrentFile(root, path) {
+    const resolvedPath = await resolveContainedPath(root, path);
+    let handle;
+    try {
+        const before = await lstat(resolvedPath, { bigint: true });
+        if (!before.isFile() ||
+            before.size > BigInt(MAX_UNINSTALL_FILE_BYTES)) {
+            throw new AgentOpsError("UNINSTALL_TARGET_INVALID", `Uninstall target must be a bounded regular file: ${path}`);
+        }
+        handle = await open(resolvedPath, constants.O_RDONLY |
+            constants.O_NOFOLLOW |
+            constants.O_NONBLOCK);
+        const opened = await handle.stat({ bigint: true });
+        const resolvedAgain = await resolveContainedPath(root, path);
+        const after = await lstat(resolvedAgain, { bigint: true });
+        if (!opened.isFile() ||
+            opened.size > BigInt(MAX_UNINSTALL_FILE_BYTES) ||
+            after.dev !== before.dev ||
+            after.ino !== before.ino) {
+            throw new AgentOpsError("UNINSTALL_TARGET_INVALID", `Uninstall target changed during inspection: ${path}`);
+        }
+        const chunks = [];
+        let totalBytes = 0;
+        while (totalBytes <= MAX_UNINSTALL_FILE_BYTES) {
+            const remaining = MAX_UNINSTALL_FILE_BYTES + 1 - totalBytes;
+            const chunk = Buffer.alloc(Math.min(64 * 1024, remaining));
+            const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+            if (bytesRead === 0) {
+                break;
+            }
+            chunks.push(chunk.subarray(0, bytesRead));
+            totalBytes += bytesRead;
+        }
+        if (totalBytes > MAX_UNINSTALL_FILE_BYTES) {
+            throw new AgentOpsError("UNINSTALL_TARGET_TOO_LARGE", `Uninstall target exceeds the planning limit: ${path}`);
+        }
+        const content = Buffer.concat(chunks, totalBytes).toString("utf8");
+        return { content, hash: sha256(content) };
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            return null;
+        }
+        throw error;
+    }
+    finally {
+        await handle?.close();
+    }
+}
+async function planMarkerFiles(root, markers, expectedMarkers) {
+    const grouped = new Map();
+    for (const marker of markers) {
+        const existing = grouped.get(marker.path) ?? [];
+        existing.push(marker);
+        grouped.set(marker.path, existing);
+    }
+    const operations = [];
+    for (const [path, pathMarkers] of grouped) {
+        const current = await readCurrentFile(root, path);
+        if (current === null) {
+            throw new AgentOpsError("MANAGED_BLOCK_CHANGED", `Managed block file is missing: ${path}`);
+        }
+        let content = current.content;
+        for (const marker of pathMarkers) {
+            const expected = expectedMarkers.get(marker.id);
+            if (expected === undefined) {
+                throw new AgentOpsError("MANIFEST_OWNERSHIP_INVALID", "The manifest contains an unsupported managed block.");
+            }
+            assertExpectedManagedBlock(content, marker, expected);
+            try {
+                content = removeManagedBlock(content, marker.id);
+            }
+            catch (error) {
+                throw new AgentOpsError("MANAGED_BLOCK_CHANGED", `Managed block cannot be removed safely: ${path}`, { cause: error });
+            }
+        }
+        operations.push(content.length === 0
+            ? {
+                kind: "remove",
+                path,
+                expectedHash: current.hash
+            }
+            : {
+                kind: "write",
+                path,
+                content,
+                expectedHash: current.hash
+            });
+    }
+    return operations;
+}
+export async function createUninstallPlan(root) {
+    const currentManifest = await readCurrentFile(root, MANIFEST_PATH);
+    if (currentManifest === null) {
+        return {
+            installed: false,
+            manifest: null,
+            manifestHash: null,
+            operations: []
+        };
+    }
+    const manifest = parseInstallManifest(currentManifest.content);
+    const expectedMarkers = assertSupportedManifestOwnership(manifest);
+    const operations = [];
+    for (const artifact of manifest.artifacts) {
+        const current = await readCurrentFile(root, artifact.path);
+        if (current === null || current.hash !== artifact.hash) {
+            throw new AgentOpsError("MANAGED_ARTIFACT_CHANGED", `Managed artifact changed after installation: ${artifact.path}`);
+        }
+        operations.push({
+            kind: "remove",
+            path: artifact.path,
+            expectedHash: current.hash
+        });
+    }
+    operations.push(...await planMarkerFiles(root, manifest.markers, expectedMarkers));
+    operations.push({
+        kind: "remove",
+        path: MANIFEST_PATH,
+        expectedHash: currentManifest.hash
+    });
+    return {
+        installed: true,
+        manifest,
+        manifestHash: currentManifest.hash,
+        operations
+    };
+}
+function allowedPaths(plan) {
+    if (plan.manifest === null) {
+        return new Set();
+    }
+    return new Set([
+        ...plan.manifest.artifacts.map(({ path }) => path.toLowerCase()),
+        ...plan.manifest.markers.map(({ path }) => path.toLowerCase()),
+        MANIFEST_PATH
+    ]);
+}
+function assertUninstallPlan(plan) {
+    if (!plan.installed) {
+        if (plan.manifest !== null ||
+            plan.manifestHash !== null ||
+            plan.operations.length !== 0) {
+            throw new AgentOpsError("INVALID_UNINSTALL_PLAN", "An absent installation must have an empty uninstall plan.");
+        }
+        return;
+    }
+    if (plan.manifest === null || plan.manifestHash === null) {
+        throw new AgentOpsError("INVALID_UNINSTALL_PLAN", "Installed uninstall plans require a manifest.");
+    }
+    const allowed = allowedPaths(plan);
+    const manifestRemovals = plan.operations.filter((operation) => operation.kind === "remove" &&
+        operation.path === MANIFEST_PATH &&
+        operation.expectedHash === plan.manifestHash);
+    if (manifestRemovals.length !== 1 ||
+        plan.operations.some(({ path }) => !allowed.has(path.toLowerCase()))) {
+        throw new AgentOpsError("INVALID_UNINSTALL_PLAN", "Uninstall plan contains an unowned path or manifest mutation.");
+    }
+}
+async function validateUninstalled(root, manifest) {
+    for (const artifact of manifest.artifacts) {
+        if (await readCurrentFile(root, artifact.path) !== null) {
+            throw new AgentOpsError("UNINSTALL_VALIDATION_FAILED", `Managed artifact still exists: ${artifact.path}`);
+        }
+    }
+    for (const marker of manifest.markers) {
+        const current = await readCurrentFile(root, marker.path);
+        if (current !== null &&
+            (current.content.includes(marker.startMarker) ||
+                current.content.includes(marker.endMarker))) {
+            throw new AgentOpsError("UNINSTALL_VALIDATION_FAILED", `Managed block still exists: ${marker.path}`);
+        }
+    }
+    if (await readCurrentFile(root, MANIFEST_PATH) !== null) {
+        throw new AgentOpsError("UNINSTALL_VALIDATION_FAILED", "Installation manifest still exists.");
+    }
+}
+export async function applyUninstallPlan(root, plan) {
+    assertUninstallPlan(plan);
+    const currentPlan = await createUninstallPlan(root);
+    if (JSON.stringify(currentPlan) !== JSON.stringify(plan)) {
+        throw new AgentOpsError("INVALID_UNINSTALL_PLAN", "Uninstall plan no longer matches the current managed installation.");
+    }
+    const manifest = plan.manifest;
+    if (!plan.installed || manifest === null) {
+        return;
+    }
+    const transaction = new FileTransaction(root);
+    await transaction.apply({ operations: plan.operations }, async () => await validateUninstalled(root, manifest));
+}

package/dist/runtime/src/install/update.js

@@ -0,0 +1,123 @@
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { previewConfigMigration } from "../config/migrate.js";
+import { sha256 } from "../fs/hash.js";
+import { AgentOpsError, resolveContainedPath } from "../fs/paths.js";
+import { applyInstallPlan } from "./apply.js";
+import { doctorInstallation } from "./doctor.js";
+import { createInstallPlan } from "./plan.js";
+const PACKAGE_NAME = "@kylecheng3146/agent-ops";
+const CONFIG_PATH = ".agent-ops/config.json";
+const MAX_UPDATE_CONFIG_BYTES = 1024 * 1024;
+async function readBoundedConfig(root) {
+    const resolvedPath = await resolveContainedPath(root, CONFIG_PATH);
+    const before = await lstat(resolvedPath, { bigint: true });
+    if (!before.isFile() ||
+        before.size > BigInt(MAX_UPDATE_CONFIG_BYTES)) {
+        throw new AgentOpsError("UPDATE_INSTALLATION_INVALID", "Update requires a bounded regular configuration file.");
+    }
+    const handle = await open(resolvedPath, constants.O_RDONLY |
+        constants.O_NOFOLLOW |
+        constants.O_NONBLOCK);
+    try {
+        const opened = await handle.stat({ bigint: true });
+        const resolvedAgain = await resolveContainedPath(root, CONFIG_PATH);
+        const after = await lstat(resolvedAgain, { bigint: true });
+        if (!opened.isFile() ||
+            opened.size > BigInt(MAX_UPDATE_CONFIG_BYTES) ||
+            after.dev !== before.dev ||
+            after.ino !== before.ino) {
+            throw new AgentOpsError("UPDATE_INSTALLATION_INVALID", "Configuration identity changed during update planning.");
+        }
+        const chunks = [];
+        let totalBytes = 0;
+        while (totalBytes <= MAX_UPDATE_CONFIG_BYTES) {
+            const remaining = MAX_UPDATE_CONFIG_BYTES + 1 - totalBytes;
+            const chunk = Buffer.alloc(Math.min(64 * 1024, remaining));
+            const { bytesRead } = await handle.read(chunk, 0, chunk.length, null);
+            if (bytesRead === 0) {
+                return Buffer.concat(chunks, totalBytes);
+            }
+            chunks.push(chunk.subarray(0, bytesRead));
+            totalBytes += bytesRead;
+        }
+        throw new AgentOpsError("UPDATE_INSTALLATION_INVALID", "Configuration exceeded the update planning limit.");
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function previewManagedConfig(root) {
+    let source;
+    let parsed;
+    try {
+        source = await readBoundedConfig(root);
+        parsed = JSON.parse(source.toString("utf8"));
+    }
+    catch (error) {
+        if (error instanceof AgentOpsError &&
+            error.code === "UPDATE_INSTALLATION_INVALID") {
+            throw error;
+        }
+        throw new AgentOpsError("UPDATE_INSTALLATION_INVALID", "Update requires valid configuration JSON.");
+    }
+    try {
+        return {
+            ...previewConfigMigration(parsed),
+            sourceHash: sha256(source)
+        };
+    }
+    catch {
+        throw new AgentOpsError("UPDATE_INSTALLATION_INVALID", "Update requires a valid or migratable configuration.");
+    }
+}
+function statusOf(report, id) {
+    return report.checks.find((candidate) => candidate.id === id)?.status;
+}
+export async function createUpdatePlan(options) {
+    const targetVersion = options.targetVersion ??
+        (options.registry === undefined
+            ? undefined
+            : await options.registry.latestVersion(options.packageName ?? PACKAGE_NAME));
+    if (targetVersion === undefined) {
+        throw new AgentOpsError("UPDATE_TARGET_REQUIRED", "Update requires a target version or an explicit registry client.");
+    }
+    const report = await doctorInstallation({ root: options.root });
+    for (const id of [
+        "node-version",
+        "manifest",
+        "markers"
+    ]) {
+        if (statusOf(report, id) !== "PASS") {
+            throw new AgentOpsError("UPDATE_INSTALLATION_INVALID", `Update requires a passing ${id} doctor check.`);
+        }
+    }
+    if (report.manifest === undefined) {
+        throw new AgentOpsError("UPDATE_INSTALLATION_INVALID", "Update requires a valid manifest.");
+    }
+    const configPreview = await previewManagedConfig(options.root);
+    if (statusOf(report, "config") !== "PASS" &&
+        configPreview.steps.length === 0) {
+        throw new AgentOpsError("UPDATE_INSTALLATION_INVALID", "Update requires a passing config doctor check.");
+    }
+    const installation = await createInstallPlan({
+        root: options.root,
+        scope: report.manifest.scope,
+        harness: report.manifest.harness,
+        profiles: configPreview.migrated.profiles,
+        adapters: options.adapters,
+        toolkitVersion: targetVersion,
+        existingConfig: {
+            value: configPreview.migrated,
+            sourceHash: configPreview.sourceHash
+        }
+    });
+    return {
+        targetVersion,
+        migrationSteps: configPreview.steps,
+        installation
+    };
+}
+export async function applyUpdatePlan(root, plan) {
+    await applyInstallPlan(root, plan.installation);
+}

package/dist/runtime/src/logging/local-log.js

@@ -0,0 +1,158 @@
+import { AgentOpsError } from "../fs/paths.js";
+import { readPrivateFile, withPrivateFileLock, writePrivateFile } from "../security/permissions.js";
+import { redactSecrets } from "../security/redact.js";
+const DEFAULT_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1_000;
+const DEFAULT_MAX_BYTES = 1024 * 1024;
+const ID_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,127}$/;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    return (actual.length === expected.length &&
+        [...expected]
+            .sort()
+            .every((key, index) => actual[index] === key));
+}
+function isBoundedString(value) {
+    return (typeof value === "string" &&
+        !value.includes("\0") &&
+        value.length > 0 &&
+        value.length <= 4096);
+}
+function invalidEvent() {
+    throw new AgentOpsError("LOG_EVENT_INVALID", "Local log event contains unsupported or invalid fields.");
+}
+function sanitizeEvent(value) {
+    if (!isRecord(value) || typeof value.type !== "string") {
+        return invalidEvent();
+    }
+    if (value.type === "diagnostic") {
+        if (!hasExactKeys(value, ["code", "type"]) ||
+            typeof value.code !== "string" ||
+            !ID_PATTERN.test(value.code)) {
+            return invalidEvent();
+        }
+        return {
+            type: "diagnostic",
+            code: value.code
+        };
+    }
+    if (value.type === "command-result") {
+        if (!hasExactKeys(value, [
+            "commandId",
+            "durationMs",
+            "exitCode",
+            "status",
+            "type"
+        ]) ||
+            typeof value.commandId !== "string" ||
+            !ID_PATTERN.test(value.commandId) ||
+            !["FAIL", "PASS", "UNKNOWN"].includes(String(value.status)) ||
+            (value.exitCode !== null &&
+                (!Number.isSafeInteger(value.exitCode) ||
+                    value.exitCode < 0)) ||
+            !Number.isSafeInteger(value.durationMs) ||
+            value.durationMs < 0) {
+            return invalidEvent();
+        }
+        return {
+            type: "command-result",
+            commandId: value.commandId,
+            status: value.status,
+            exitCode: value.exitCode,
+            durationMs: value.durationMs
+        };
+    }
+    if (value.type === "trust-change") {
+        if (!hasExactKeys(value, [
+            "action",
+            "remoteIdentity",
+            "result",
+            "type"
+        ]) ||
+            !["grant", "revoke"].includes(String(value.action)) ||
+            !isBoundedString(value.remoteIdentity) ||
+            !["changed", "unchanged"].includes(String(value.result))) {
+            return invalidEvent();
+        }
+        return {
+            type: "trust-change",
+            action: value.action,
+            remoteIdentity: redactSecrets(value.remoteIdentity),
+            result: value.result
+        };
+    }
+    return invalidEvent();
+}
+function serialize(stored) {
+    return `${JSON.stringify({
+        timestamp: stored.timestamp,
+        ...stored.event
+    })}\n`;
+}
+function parseStoredLine(line) {
+    let value;
+    try {
+        value = JSON.parse(line);
+    }
+    catch (error) {
+        throw new AgentOpsError("LOG_CORRUPT", "Local log contains invalid JSON.", { cause: error });
+    }
+    if (!isRecord(value) ||
+        typeof value.timestamp !== "string" ||
+        !Number.isFinite(Date.parse(value.timestamp))) {
+        throw new AgentOpsError("LOG_CORRUPT", "Local log contains an invalid timestamp.");
+    }
+    const { timestamp, ...event } = value;
+    return {
+        timestamp,
+        event: sanitizeEvent(event)
+    };
+}
+function positiveOption(value, fallback) {
+    if (value === undefined) {
+        return fallback;
+    }
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new AgentOpsError("LOG_RETENTION_INVALID", "Local log retention limits must be positive integers.");
+    }
+    return value;
+}
+export async function appendLocalLog(path, event, options) {
+    const now = options.now ?? new Date().toISOString();
+    const nowMs = Date.parse(now);
+    if (!Number.isFinite(nowMs)) {
+        throw new AgentOpsError("LOG_TIMESTAMP_INVALID", "Local log timestamp must be ISO-compatible.");
+    }
+    const maxAgeMs = positiveOption(options.maxAgeMs, DEFAULT_MAX_AGE_MS);
+    const maxBytes = positiveOption(options.maxBytes, DEFAULT_MAX_BYTES);
+    const storedEvent = {
+        timestamp: now,
+        event: sanitizeEvent(event)
+    };
+    const newLine = serialize(storedEvent);
+    if (Buffer.byteLength(newLine) > maxBytes) {
+        throw new AgentOpsError("LOG_EVENT_TOO_LARGE", "Local log event exceeds the configured byte limit.");
+    }
+    await withPrivateFileLock(path, options.anchorDirectory, async () => {
+        const source = await readPrivateFile(path, options.anchorDirectory);
+        const retained = source === null || source.length === 0
+            ? []
+            : source
+                .split("\n")
+                .filter((line) => line.length > 0)
+                .map(parseStoredLine)
+                .filter((entry) => nowMs - Date.parse(entry.timestamp) <= maxAgeMs);
+        retained.push(storedEvent);
+        const serialized = retained.map(serialize);
+        let totalBytes = serialized.reduce((total, line) => total + Buffer.byteLength(line), 0);
+        while (serialized.length > 1 && totalBytes > maxBytes) {
+            const removed = serialized.shift();
+            if (removed !== undefined) {
+                totalBytes -= Buffer.byteLength(removed);
+            }
+        }
+        await writePrivateFile(path, serialized.join(""), options.anchorDirectory);
+    });
+}

package/dist/runtime/src/registry/npm.js

@@ -0,0 +1,141 @@
+import { AgentOpsError } from "../fs/paths.js";
+const NPM_REGISTRY_URL = "https://registry.npmjs.org/";
+const DEFAULT_TIMEOUT_MS = 10_000;
+const DEFAULT_MAX_RESPONSE_BYTES = 1_048_576;
+const SEMVER_LIKE = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+function defaultFetch(url, init) {
+    return globalThis.fetch(url, init);
+}
+function positiveBound(value, name) {
+    if (!Number.isSafeInteger(value) || value < 1) {
+        throw new AgentOpsError("REGISTRY_OPTIONS_INVALID", `${name} must be a positive safe integer.`);
+    }
+    return value;
+}
+function responseTooLarge() {
+    return new AgentOpsError("REGISTRY_RESPONSE_TOO_LARGE", "The npm registry response exceeded the allowed size.");
+}
+async function readBoundedResponse(response, maxResponseBytes, controller) {
+    const declaredLength = response.headers.get("content-length");
+    if (declaredLength !== null &&
+        /^\d+$/.test(declaredLength) &&
+        BigInt(declaredLength) > BigInt(maxResponseBytes)) {
+        controller.abort();
+        throw responseTooLarge();
+    }
+    if (response.body === null) {
+        return new Uint8Array();
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let byteLength = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done) {
+                break;
+            }
+            if (value === undefined) {
+                continue;
+            }
+            byteLength += value.byteLength;
+            if (byteLength > maxResponseBytes) {
+                controller.abort();
+                throw responseTooLarge();
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const combined = new Uint8Array(byteLength);
+    let offset = 0;
+    for (const chunk of chunks) {
+        combined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return combined;
+}
+function isRecord(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value));
+}
+function parseLatestVersion(bytes) {
+    let parsed;
+    try {
+        const source = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        parsed = JSON.parse(source);
+    }
+    catch {
+        throw new AgentOpsError("REGISTRY_RESPONSE_INVALID", "The npm registry response is not valid JSON.");
+    }
+    if (!isRecord(parsed)) {
+        throw new AgentOpsError("REGISTRY_RESPONSE_INVALID", "The npm registry response must be a JSON object.");
+    }
+    const distTags = parsed["dist-tags"];
+    const latest = isRecord(distTags) ? distTags.latest : undefined;
+    if (typeof latest !== "string" || !SEMVER_LIKE.test(latest)) {
+        throw new AgentOpsError("REGISTRY_RESPONSE_INVALID", "The npm registry response has no valid latest version.");
+    }
+    return latest;
+}
+export class NpmRegistryClient {
+    #fetch;
+    #timeoutMs;
+    #maxResponseBytes;
+    constructor(options = {}) {
+        this.#fetch = options.fetch ?? defaultFetch;
+        this.#timeoutMs = positiveBound(options.timeoutMs ?? DEFAULT_TIMEOUT_MS, "timeoutMs");
+        this.#maxResponseBytes = positiveBound(options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES, "maxResponseBytes");
+    }
+    async #request(packageName, controller) {
+        const url = `${NPM_REGISTRY_URL}${encodeURIComponent(packageName)}`;
+        const response = await this.#fetch(url, {
+            method: "GET",
+            redirect: "error",
+            headers: { accept: "application/json" },
+            signal: controller.signal
+        });
+        if (response.status !== 200) {
+            throw new AgentOpsError("REGISTRY_HTTP_STATUS", `The npm registry returned HTTP ${response.status}.`);
+        }
+        return parseLatestVersion(await readBoundedResponse(response, this.#maxResponseBytes, controller));
+    }
+    async latestVersion(packageName) {
+        if (packageName.length === 0) {
+            throw new AgentOpsError("REGISTRY_PACKAGE_INVALID", "The npm package name must not be empty.");
+        }
+        const controller = new AbortController();
+        let timedOut = false;
+        let timeout;
+        const timeoutFailure = new Promise((_resolve, reject) => {
+            timeout = setTimeout(() => {
+                timedOut = true;
+                reject(new AgentOpsError("REGISTRY_TIMEOUT", "The npm registry request timed out."));
+                controller.abort();
+            }, this.#timeoutMs);
+        });
+        try {
+            return await Promise.race([
+                this.#request(packageName, controller),
+                timeoutFailure
+            ]);
+        }
+        catch (error) {
+            if (timedOut) {
+                throw new AgentOpsError("REGISTRY_TIMEOUT", "The npm registry request timed out.");
+            }
+            if (error instanceof AgentOpsError) {
+                throw error;
+            }
+            throw new AgentOpsError("REGISTRY_REQUEST_FAILED", "The npm registry request failed.");
+        }
+        finally {
+            if (timeout !== undefined) {
+                clearTimeout(timeout);
+            }
+        }
+    }
+}

package/dist/runtime/src/review/claude-runner.js

@@ -0,0 +1,4 @@
+import { runIndependentReview } from "./runner.js";
+export function runClaudeReview(options) {
+    return runIndependentReview(options);
+}

package/dist/runtime/src/review/codex-runner.js

@@ -0,0 +1,4 @@
+import { runIndependentReview } from "./runner.js";
+export function runCodexReview(options) {
+    return runIndependentReview(options);
+}

package/dist/runtime/src/review/packet.js

@@ -0,0 +1,10 @@
+export function buildReviewPacket(input) {
+    return {
+        request: input.request,
+        criteria: input.criteria.map((criterion) => ({ ...criterion })),
+        artifactRefs: [...input.artifactRefs],
+        evidenceRequirements: input.evidenceRequirements.map((requirement) => ({
+            ...requirement
+        }))
+    };
+}

package/dist/runtime/src/review/result.js

@@ -0,0 +1,24 @@
+export function aggregateReviewResults(requestedCriterionIds, results) {
+    const expected = new Set(requestedCriterionIds);
+    const seen = new Set();
+    let valid = requestedCriterionIds.length === expected.size;
+    for (const result of results) {
+        if (!expected.has(result.criterionId) ||
+            seen.has(result.criterionId) ||
+            result.evidence.length === 0 ||
+            result.evidence.some((reference) => reference.trim().length === 0)) {
+            valid = false;
+        }
+        seen.add(result.criterionId);
+    }
+    if (seen.size !== expected.size) {
+        valid = false;
+    }
+    const status = valid && results.every((result) => result.status === "PASS")
+        ? "PASS"
+        : "FAIL";
+    return { status, results: [...results] };
+}
+export function summarizeReview(request) {
+    return aggregateReviewResults(request.packet.criteria.map((criterion) => criterion.id), request.criterionResults);
+}

package/dist/runtime/src/review/roles.js

@@ -0,0 +1,3 @@
+export function resolveReviewRole(role, configured) {
+    return configured.find((item) => item.role === role);
+}