@namzu/sdk 0.4.3 → 0.4.4

package/dist/vault/instrumentation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumentation.js","sourceRoot":"","sources":["../../src/vault/instrumentation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAsB,KAAK,IAAI,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAWxF,MAAM,UAAU,mBAAmB,CAClC,KAAsB,EACtB,OAAoC,EAAE;IAEtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAA;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,CAAA;IACtD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAA;IAElC,OAAO;QACN,KAAK,CACJ,QAAkB,EAClB,WAAwB,EACxB,KAAa,EACb,IAAgB;YAEhB,OAAO,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QACvD,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,YAA0B;YACxC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;YACjD,MAAM,CAAC,QAAQ,CACd;gBACC,IAAI,EAAE,cAAc;gBACpB,OAAO;gBACP,YAAY;gBACZ,QAAQ,EAAE,YAAY;gBACtB,KAAK,EAAE,MAAM,KAAK,SAAS;gBAC3B,KAAK;aACL,EACD,iBAAiB,CAAC,EAAE,KAAK,EAAE,CAAC,CAC5B,CAAA;YACD,OAAO,MAAM,CAAA;QACd,CAAC;QAED,MAAM,CAAC,YAA0B;YAChC,OAAO,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAClC,CAAC;QAED,IAAI,CAAC,QAAkB,EAAE,WAAyB;YACjD,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;QACzC,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/vault/instrumentation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=instrumentation.test.d.ts.map

package/dist/vault/instrumentation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumentation.test.d.ts","sourceRoot":"","sources":["../../src/vault/instrumentation.test.ts"],"names":[],"mappings":""}

package/dist/vault/instrumentation.test.js

@@ -0,0 +1,80 @@
+import { describe, expect, it } from 'vitest';
+import { createProbeRegistry } from '../probe/registry.js';
+import { InMemoryCredentialVault } from './InMemoryCredentialVault.js';
+import { wrapVaultWithProbes } from './instrumentation.js';
+const tenant = 'tnt_acme';
+const connector = 'conn_x';
+describe('wrapVaultWithProbes', () => {
+    it('emits vault_lookup with found:true when retrieve hits', async () => {
+        const reg = createProbeRegistry();
+        const seen = [];
+        reg.onAny((event) => seen.push(event));
+        const inner = new InMemoryCredentialVault();
+        const ref = await inner.store(tenant, connector, 'k', { type: 'apiKey', apiKey: 's' });
+        const wrapped = wrapVaultWithProbes(inner, { probes: reg, vaultId: 'in-memory' });
+        const result = await wrapped.retrieve(ref.id);
+        expect(result).toBeDefined();
+        expect(seen.length).toBe(1);
+        const event = seen[0];
+        expect(event.type).toBe('vault_lookup');
+        expect(event.found).toBe(true);
+        expect(event.vaultId).toBe('in-memory');
+        expect(event.credentialId).toBe(ref.id);
+    });
+    it('emits vault_lookup with found:false when retrieve misses', async () => {
+        const reg = createProbeRegistry();
+        const seen = [];
+        reg.onAny((event) => seen.push(event));
+        const wrapped = wrapVaultWithProbes(new InMemoryCredentialVault(), {
+            probes: reg,
+            vaultId: 'in-memory',
+        });
+        const missing = 'cred_missing';
+        const result = await wrapped.retrieve(missing);
+        expect(result).toBeUndefined();
+        expect(seen.length).toBe(1);
+        const event = seen[0];
+        expect(event.found).toBe(false);
+        expect(event.credentialId).toBe(missing);
+    });
+    it('does not emit on store/revoke/list — retrieve is the audit point', async () => {
+        const reg = createProbeRegistry();
+        const seen = [];
+        reg.onAny((event) => seen.push(event));
+        const wrapped = wrapVaultWithProbes(new InMemoryCredentialVault(), { probes: reg });
+        const ref = await wrapped.store(tenant, connector, 'k', {
+            type: 'apiKey',
+            apiKey: 's',
+        });
+        await wrapped.list(tenant);
+        await wrapped.revoke(ref.id);
+        expect(seen.length).toBe(0);
+    });
+    it('does not leak the secret value in the emitted event', async () => {
+        const reg = createProbeRegistry();
+        const seen = [];
+        reg.onAny((event) => seen.push(event));
+        const inner = new InMemoryCredentialVault();
+        const ref = await inner.store(tenant, connector, 'k', {
+            type: 'apiKey',
+            apiKey: 'super-secret-value',
+        });
+        const wrapped = wrapVaultWithProbes(inner, { probes: reg });
+        await wrapped.retrieve(ref.id);
+        const event = seen[0];
+        const serialized = JSON.stringify(event);
+        expect(serialized).not.toContain('super-secret-value');
+    });
+    it('falls back to constructor.name as vaultId when not specified', async () => {
+        const reg = createProbeRegistry();
+        const seen = [];
+        reg.onAny((event) => seen.push(event));
+        const inner = new InMemoryCredentialVault();
+        const ref = await inner.store(tenant, connector, 'k', { type: 'apiKey', apiKey: 's' });
+        const wrapped = wrapVaultWithProbes(inner, { probes: reg });
+        await wrapped.retrieve(ref.id);
+        const event = seen[0];
+        expect(event.vaultId).toBe('InMemoryCredentialVault');
+    });
+});
+//# sourceMappingURL=instrumentation.test.js.map

package/dist/vault/instrumentation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instrumentation.test.js","sourceRoot":"","sources":["../../src/vault/instrumentation.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAI1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAE1D,MAAM,MAAM,GAAG,UAAsB,CAAA;AACrC,MAAM,SAAS,GAAG,QAAiB,CAAA;AAEnC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAA;QACjC,MAAM,IAAI,GAAoB,EAAE,CAAA;QAChC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAsB,CAAC,CAAC,CAAA;QAEvD,MAAM,KAAK,GAAG,IAAI,uBAAuB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAW,CAAC,CAAA;QAC/F,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;QAEjF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC7C,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAA6C,CAAA;QACjE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAA;QACjC,MAAM,IAAI,GAAoB,EAAE,CAAA;QAChC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAsB,CAAC,CAAC,CAAA;QAEvD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,uBAAuB,EAAE,EAAE;YAClE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,WAAW;SACpB,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,cAA8B,CAAA;QAC9C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QAE9C,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;QAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAA6C,CAAA;QACjE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAA;QACjC,MAAM,IAAI,GAAoB,EAAE,CAAA;QAChC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAsB,CAAC,CAAC,CAAA;QAEvD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,uBAAuB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE;YACvD,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG;SACF,CAAC,CAAA;QACX,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1B,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAA;QACjC,MAAM,IAAI,GAAoB,EAAE,CAAA;QAChC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAsB,CAAC,CAAC,CAAA;QAEvD,MAAM,KAAK,GAAG,IAAI,uBAAuB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE;YACrD,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,oBAAoB;SACnB,CAAC,CAAA;QACX,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3D,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAA;QACjC,MAAM,IAAI,GAAoB,EAAE,CAAA;QAChC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAsB,CAAC,CAAC,CAAA;QAEvD,MAAM,KAAK,GAAG,IAAI,uBAAuB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAW,CAAC,CAAA;QAC/F,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3D,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAE9B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAA6C,CAAA;QACjE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@namzu/sdk",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Open-source AI agent SDK with a built-in runtime. Nothing between you and your agents.",
   "license": "FSL-1.1-MIT",
   "type": "module",

package/src/bus/index.ts

@@ -5,6 +5,8 @@ import {
 	DEFAULT_LOCK_TIMEOUT_MS,
 	DEFAULT_MAX_LOCKS_PER_AGENT,
 } from '../constants/bus/index.js'
+import { buildProbeContext } from '../probe/context.js'
+import { type ProbeRegistry, probe as defaultProbeRegistry } from '../probe/registry.js'
 import type { AgentBusEvent, AgentBusEventListener } from '../types/bus/index.js'
 import type { RunId } from '../types/ids/index.js'
 import type { Logger } from '../utils/logger.js'
@@ -39,10 +41,17 @@ export class AgentBus {
 	private readonly listeners: Set<AgentBusEventListener> = new Set()
 	private readonly log: Logger
 	private readonly config: AgentBusConfig
+	private readonly probes: ProbeRegistry
 
-	constructor(log: Logger, config: Partial<AgentBusConfig> = {}) {
+	constructor(
+		log: Logger,
+		config: Partial<AgentBusConfig> = {},
+		probeRegistry: ProbeRegistry = defaultProbeRegistry,
+	) {
 		this.config = { ...DEFAULT_AGENT_BUS_CONFIG, ...config }
 		this.log = log.child({ component: 'AgentBus' })
+		this.probes = probeRegistry
+		this.probes.setLogger(log)
 
 		const emitFn = (event: AgentBusEvent): void => this.emit(event)
 
@@ -70,16 +79,18 @@ export class AgentBus {
 	}
 
 	private emit(event: AgentBusEvent): void {
-		for (const listener of this.listeners) {
-			try {
-				listener(event)
-			} catch (error) {
-				this.log.error('event listener threw', {
-					eventType: event.type,
-					error: error instanceof Error ? error.message : String(error),
-				})
+		this.probes.dispatch(event, buildProbeContext(), () => {
+			for (const listener of this.listeners) {
+				try {
+					listener(event)
+				} catch (error) {
+					this.log.error('event listener threw', {
+						eventType: event.type,
+						error: error instanceof Error ? error.message : String(error),
+					})
+				}
 			}
-		}
+		})
 	}
 
 	cleanupAgent(runId: RunId): void {

package/src/probe/context.ts

@@ -0,0 +1,14 @@
+import type { RunId } from '../types/ids/index.js'
+import type { ProbeContext } from '../types/probe/index.js'
+
+export interface ProbeContextInput {
+	readonly runId?: RunId
+	readonly isReplay?: boolean
+}
+
+export function buildProbeContext(input: ProbeContextInput = {}): ProbeContext {
+	return Object.freeze({
+		runId: input.runId,
+		isReplay: input.isReplay ?? false,
+	})
+}

package/src/probe/errors.ts

@@ -0,0 +1,27 @@
+import type { VetoableEventKind } from '../types/probe/index.js'
+
+export class ProbeNameCollisionError extends Error {
+	readonly probeName: string
+
+	constructor(probeName: string) {
+		super(
+			`Probe name "${probeName}" is already registered. Pass { override: true } to replace, or pick a different name.`,
+		)
+		this.name = 'ProbeNameCollisionError'
+		this.probeName = probeName
+	}
+}
+
+export class ProbeVetoError extends Error {
+	readonly probeName: string
+	readonly reason: string
+	readonly eventKind: VetoableEventKind
+
+	constructor(probeName: string, reason: string, eventKind: VetoableEventKind) {
+		super(`Operation denied by probe "${probeName}" on ${eventKind}: ${reason}`)
+		this.name = 'ProbeVetoError'
+		this.probeName = probeName
+		this.reason = reason
+		this.eventKind = eventKind
+	}
+}

package/src/probe/index.ts

@@ -0,0 +1,4 @@
+export { ProbeNameCollisionError, ProbeVetoError } from './errors.js'
+export { buildProbeContext } from './context.js'
+export type { ProbeContextInput } from './context.js'
+export { ProbeRegistry, createProbeRegistry, probe } from './registry.js'