@namzu/sdk 27.1.0 → 28.0.0

package/dist/connector/web/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/connector/web/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CACrC;AAED,0DAA0D;AAC1D,MAAM,MAAM,qBAAqB,GAC9B,QAAQ,GACR,iBAAiB,GACjB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,CAAA;AAEjB,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAA;KAAE,CAAA;gBAEpD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,qBAAqB,CAAA;KAAE;CAKpF;AAED,MAAM,WAAW,gBAAgB;IAChC,KAAK,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;CACxD;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAC7B;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAA;CACtC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IACjC,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;CAC3D"}

package/dist/connector/web/types.js

@@ -0,0 +1,25 @@
+/**
+ * Reaching the web, as a seam rather than as a bundled vendor.
+ *
+ * Two providers, and they are separated on purpose. **Fetching a URL is a
+ * capability this kernel can implement**: the rules are about the network
+ * and the same everywhere, so a wrong answer is a defect rather than a
+ * preference. **Searching is not.** Every search backend has its own
+ * account, its own terms, its own result shape and its own opinion about
+ * what a result even is, and picking one here would make that choice for
+ * every consumer while adding a dependency nobody asked for.
+ *
+ * So `WebFetchProvider` ships with a guarded implementation and
+ * `WebSearchProvider` ships with none. A host that wants search brings one.
+ * That asymmetry is the design, not an omission — see
+ * `GuardedFetchProvider` for what "guarded" is doing the work of.
+ */
+export class WebFetchRefusedError extends Error {
+    details;
+    constructor(message, details) {
+        super(message);
+        this.name = 'WebFetchRefusedError';
+        this.details = details;
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/connector/web/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/connector/web/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAmCH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACrC,OAAO,CAAgD;IAEhE,YAAY,OAAe,EAAE,OAAuD;QACnF,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACvB,CAAC;CACD"}

package/dist/constants/acp/index.d.ts

@@ -0,0 +1,97 @@
+/**
+ * The agent-client protocol's version and method set, pinned.
+ *
+ * A table rather than string literals scattered through the server, because
+ * the two things that go wrong with a wire protocol are a method spelled
+ * differently in one place and a method implemented but never advertised.
+ * Both are invisible at compile time and both present to a client as "that
+ * agent does not support this".
+ *
+ * `bridge/acp/server.ts` authors its handler map independently and a test
+ * compares the two SETS in both directions: a handler with no entry here
+ * fails, and an entry here with no handler fails. That is the only
+ * arrangement where the comparison can fail — deriving the handlers from
+ * this table would make the test a tautology, which is the shape
+ * `a-check-that-cannot-fail` names.
+ *
+ * Zero imports, deliberately: this is read by the types module, the server,
+ * and the CLI command, and a constant table that pulls in a dependency
+ * becomes a cycle the moment one of those three moves.
+ */
+/**
+ * The protocol revision this bridge speaks.
+ *
+ * A number, matching the wire field, and pinned rather than negotiated
+ * downward. A client asking for a version this does not implement is told
+ * what it does implement; guessing that an older client can be served by a
+ * newer agent is how a protocol bridge produces a session that half works.
+ */
+export declare const ACP_PROTOCOL_VERSION = 1;
+/** Methods a client calls on this agent. */
+export declare const ACP_METHODS: {
+    readonly INITIALIZE: "initialize";
+    readonly SESSION_NEW: "session/new";
+    readonly SESSION_PROMPT: "session/prompt";
+    readonly SESSION_CANCEL: "session/cancel";
+    readonly SESSION_LOAD: "session/load";
+};
+export type AcpMethod = (typeof ACP_METHODS)[keyof typeof ACP_METHODS];
+/**
+ * Notifications this agent sends the client.
+ *
+ * Separate from `ACP_METHODS` because the drift test is about what a client
+ * may CALL. Mixing the two directions into one table would make that test
+ * demand a handler for a message this side only ever sends.
+ */
+export declare const ACP_CLIENT_NOTIFICATIONS: {
+    readonly SESSION_UPDATE: "session/update";
+};
+/**
+ * REQUESTS this agent makes of the client, which it answers.
+ *
+ * Distinct from a notification: each carries an id and this side waits for
+ * the response. That direction is what makes a permission prompt possible at
+ * all — the agent has a question and cannot proceed until the human behind
+ * the client answers it.
+ */
+export declare const ACP_CLIENT_REQUESTS: {
+    readonly REQUEST_PERMISSION: "session/request_permission";
+    readonly FS_READ: "fs/read_text_file";
+    readonly FS_WRITE: "fs/write_text_file";
+};
+/**
+ * JSON-RPC error codes this bridge answers with.
+ *
+ * `METHOD_NOT_FOUND` is the one with a behavioural requirement attached: an
+ * unknown method is answered and the connection STAYS OPEN. A bridge that
+ * closed on an unrecognised call would make a client's feature probe fatal.
+ */
+export declare const ACP_ERROR_CODES: {
+    readonly PARSE_ERROR: -32700;
+    readonly INVALID_REQUEST: -32600;
+    readonly METHOD_NOT_FOUND: -32601;
+    readonly INVALID_PARAMS: -32602;
+    readonly INTERNAL_ERROR: -32603;
+};
+/**
+ * The capability a client must declare before a session is created.
+ *
+ * Approval routing is a later change, so a session that could not ask a
+ * human anything must not be created at all: it would run with every tool
+ * auto-approved, which is not a degraded version of asking — it is the
+ * opposite of it. The refusal names this string so a client author knows
+ * what to send.
+ */
+export declare const ACP_PERMISSION_CAPABILITY = "permission";
+/**
+ * The capability that lets the EDITOR's buffers be the source of truth.
+ *
+ * Optional, unlike `permission`. A client that does not declare it gets an
+ * agent reading and writing the disk, which is correct and is what every
+ * non-editor peer wants. A client that DOES declare it is telling this
+ * agent that the file on disk may be stale — the user has unsaved changes —
+ * and that reading disk anyway would show the model a version of the file
+ * nobody is looking at.
+ */
+export declare const ACP_FILESYSTEM_CAPABILITY = "fs";
+//# sourceMappingURL=index.d.ts.map

package/dist/constants/acp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/acp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAA;AAErC,4CAA4C;AAC5C,eAAO,MAAM,WAAW;;;;;;CAMd,CAAA;AAEV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB;;CAE3B,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB;;;;CAItB,CAAA;AAEV;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;;;;;;CAMlB,CAAA;AAEV;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,eAAe,CAAA;AAErD;;;;;;;;;GASG;AACH,eAAO,MAAM,yBAAyB,OAAO,CAAA"}

package/dist/constants/acp/index.js

@@ -0,0 +1,96 @@
+/**
+ * The agent-client protocol's version and method set, pinned.
+ *
+ * A table rather than string literals scattered through the server, because
+ * the two things that go wrong with a wire protocol are a method spelled
+ * differently in one place and a method implemented but never advertised.
+ * Both are invisible at compile time and both present to a client as "that
+ * agent does not support this".
+ *
+ * `bridge/acp/server.ts` authors its handler map independently and a test
+ * compares the two SETS in both directions: a handler with no entry here
+ * fails, and an entry here with no handler fails. That is the only
+ * arrangement where the comparison can fail — deriving the handlers from
+ * this table would make the test a tautology, which is the shape
+ * `a-check-that-cannot-fail` names.
+ *
+ * Zero imports, deliberately: this is read by the types module, the server,
+ * and the CLI command, and a constant table that pulls in a dependency
+ * becomes a cycle the moment one of those three moves.
+ */
+/**
+ * The protocol revision this bridge speaks.
+ *
+ * A number, matching the wire field, and pinned rather than negotiated
+ * downward. A client asking for a version this does not implement is told
+ * what it does implement; guessing that an older client can be served by a
+ * newer agent is how a protocol bridge produces a session that half works.
+ */
+export const ACP_PROTOCOL_VERSION = 1;
+/** Methods a client calls on this agent. */
+export const ACP_METHODS = {
+    INITIALIZE: 'initialize',
+    SESSION_NEW: 'session/new',
+    SESSION_PROMPT: 'session/prompt',
+    SESSION_CANCEL: 'session/cancel',
+    SESSION_LOAD: 'session/load',
+};
+/**
+ * Notifications this agent sends the client.
+ *
+ * Separate from `ACP_METHODS` because the drift test is about what a client
+ * may CALL. Mixing the two directions into one table would make that test
+ * demand a handler for a message this side only ever sends.
+ */
+export const ACP_CLIENT_NOTIFICATIONS = {
+    SESSION_UPDATE: 'session/update',
+};
+/**
+ * REQUESTS this agent makes of the client, which it answers.
+ *
+ * Distinct from a notification: each carries an id and this side waits for
+ * the response. That direction is what makes a permission prompt possible at
+ * all — the agent has a question and cannot proceed until the human behind
+ * the client answers it.
+ */
+export const ACP_CLIENT_REQUESTS = {
+    REQUEST_PERMISSION: 'session/request_permission',
+    FS_READ: 'fs/read_text_file',
+    FS_WRITE: 'fs/write_text_file',
+};
+/**
+ * JSON-RPC error codes this bridge answers with.
+ *
+ * `METHOD_NOT_FOUND` is the one with a behavioural requirement attached: an
+ * unknown method is answered and the connection STAYS OPEN. A bridge that
+ * closed on an unrecognised call would make a client's feature probe fatal.
+ */
+export const ACP_ERROR_CODES = {
+    PARSE_ERROR: -32700,
+    INVALID_REQUEST: -32600,
+    METHOD_NOT_FOUND: -32601,
+    INVALID_PARAMS: -32602,
+    INTERNAL_ERROR: -32603,
+};
+/**
+ * The capability a client must declare before a session is created.
+ *
+ * Approval routing is a later change, so a session that could not ask a
+ * human anything must not be created at all: it would run with every tool
+ * auto-approved, which is not a degraded version of asking — it is the
+ * opposite of it. The refusal names this string so a client author knows
+ * what to send.
+ */
+export const ACP_PERMISSION_CAPABILITY = 'permission';
+/**
+ * The capability that lets the EDITOR's buffers be the source of truth.
+ *
+ * Optional, unlike `permission`. A client that does not declare it gets an
+ * agent reading and writing the disk, which is correct and is what every
+ * non-editor peer wants. A client that DOES declare it is telling this
+ * agent that the file on disk may be stale — the user has unsaved changes —
+ * and that reading disk anyway would show the model a version of the file
+ * nobody is looking at.
+ */
+export const ACP_FILESYSTEM_CAPABILITY = 'fs';
+//# sourceMappingURL=index.js.map

package/dist/constants/acp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/acp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAA;AAErC,4CAA4C;AAC5C,MAAM,CAAC,MAAM,WAAW,GAAG;IAC1B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,aAAa;IAC1B,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,YAAY,EAAE,cAAc;CACnB,CAAA;AAIV;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACvC,cAAc,EAAE,gBAAgB;CACvB,CAAA;AAEV;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAClC,kBAAkB,EAAE,4BAA4B;IAChD,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,oBAAoB;CACrB,CAAA;AAEV;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC9B,WAAW,EAAE,CAAC,KAAK;IACnB,eAAe,EAAE,CAAC,KAAK;IACvB,gBAAgB,EAAE,CAAC,KAAK;IACxB,cAAc,EAAE,CAAC,KAAK;IACtB,cAAc,EAAE,CAAC,KAAK;CACb,CAAA;AAEV;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,YAAY,CAAA;AAErD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAA"}

package/dist/constants/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/authorization/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,MAAM,CAAA"}

package/dist/constants/authorization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/constants/authorization/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAA"}

package/dist/constants/credential-env-keys.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Credential-bearing environment variable KEY NAMES, in one place.
+ *
+ * A leaf with no imports, beside `secret-patterns.ts` and holding the
+ * complement of it: that file matches credential VALUES, this one matches
+ * the names variables carry them under. Neither re-declares the other's,
+ * because a value pattern and a key name answer different questions and a
+ * table that tried to do both would be wrong at whichever end it was not
+ * written for.
+ *
+ * Two readers, and that is the point of moving it here. The host-bash
+ * environment scrub uses it to decide what a shell command must not
+ * inherit, and `EnvCredentialProvider` uses it to decide what counts as a
+ * credential it can resolve. Those were about to become two tables — the
+ * CLI's provider registry already keeps a third, of `envVars` per provider
+ * — and a name in one and not another means a variable the CLI reads a
+ * credential from and the scrub happily hands to a shell.
+ */
+/**
+ * Key-name patterns that mark an inherited variable as credential-shaped.
+ *
+ * Matched case-insensitively against the whole key. Deliberately broad: a
+ * false positive costs a command one variable it can be handed back
+ * explicitly, while a false negative costs a leaked secret that cannot be
+ * recalled from a transcript.
+ */
+export declare const CREDENTIAL_KEY_PATTERNS: readonly RegExp[];
+/**
+ * Keys that are credential-bearing but whose names match none of the patterns
+ * above. Kept as an explicit list so each entry is a decision somebody can
+ * read, rather than a pattern nobody can evaluate.
+ */
+export declare const CREDENTIAL_KEY_EXACT: ReadonlySet<string>;
+/** True when an inherited variable's name marks it as credential-shaped. */
+export declare function isCredentialEnvKey(key: string): boolean;
+//# sourceMappingURL=credential-env-keys.d.ts.map

package/dist/constants/credential-env-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-env-keys.d.ts","sourceRoot":"","sources":["../../src/constants/credential-env-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAapD,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CASnD,CAAA;AAEF,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGvD"}

package/dist/constants/credential-env-keys.js

@@ -0,0 +1,62 @@
+/**
+ * Credential-bearing environment variable KEY NAMES, in one place.
+ *
+ * A leaf with no imports, beside `secret-patterns.ts` and holding the
+ * complement of it: that file matches credential VALUES, this one matches
+ * the names variables carry them under. Neither re-declares the other's,
+ * because a value pattern and a key name answer different questions and a
+ * table that tried to do both would be wrong at whichever end it was not
+ * written for.
+ *
+ * Two readers, and that is the point of moving it here. The host-bash
+ * environment scrub uses it to decide what a shell command must not
+ * inherit, and `EnvCredentialProvider` uses it to decide what counts as a
+ * credential it can resolve. Those were about to become two tables — the
+ * CLI's provider registry already keeps a third, of `envVars` per provider
+ * — and a name in one and not another means a variable the CLI reads a
+ * credential from and the scrub happily hands to a shell.
+ */
+/**
+ * Key-name patterns that mark an inherited variable as credential-shaped.
+ *
+ * Matched case-insensitively against the whole key. Deliberately broad: a
+ * false positive costs a command one variable it can be handed back
+ * explicitly, while a false negative costs a leaked secret that cannot be
+ * recalled from a transcript.
+ */
+export const CREDENTIAL_KEY_PATTERNS = [
+    /KEY/i,
+    /SECRET/i,
+    /TOKEN/i,
+    /PASSWORD/i,
+    /PASSWD/i,
+    /CREDENTIAL/i,
+    /(^|_)AUTH(_|$)/i,
+    /PRIVATE/i,
+    /SESSION_ID/i,
+    /COOKIE/i,
+    /SIGNATURE/i,
+    /(^|_)PAT(_|$)/i,
+];
+/**
+ * Keys that are credential-bearing but whose names match none of the patterns
+ * above. Kept as an explicit list so each entry is a decision somebody can
+ * read, rather than a pattern nobody can evaluate.
+ */
+export const CREDENTIAL_KEY_EXACT = new Set([
+    'AWS_SESSION_TOKEN',
+    'AWS_SECURITY_TOKEN',
+    'GOOGLE_APPLICATION_CREDENTIALS',
+    'NPM_CONFIG__AUTH',
+    'GH_ENTERPRISE_TOKEN',
+    'DOCKER_AUTH_CONFIG',
+    'KUBECONFIG',
+    'NETRC',
+]);
+/** True when an inherited variable's name marks it as credential-shaped. */
+export function isCredentialEnvKey(key) {
+    if (CREDENTIAL_KEY_EXACT.has(key.toUpperCase()))
+        return true;
+    return CREDENTIAL_KEY_PATTERNS.some((pattern) => pattern.test(key));
+}
+//# sourceMappingURL=credential-env-keys.js.map

package/dist/constants/credential-env-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-env-keys.js","sourceRoot":"","sources":["../../src/constants/credential-env-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACzD,MAAM;IACN,SAAS;IACT,QAAQ;IACR,WAAW;IACX,SAAS;IACT,aAAa;IACb,iBAAiB;IACjB,UAAU;IACV,aAAa;IACb,SAAS;IACT,YAAY;IACZ,gBAAgB;CAChB,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAChE,mBAAmB;IACnB,oBAAoB;IACpB,gCAAgC;IAChC,kBAAkB;IAClB,qBAAqB;IACrB,oBAAoB;IACpB,YAAY;IACZ,OAAO;CACP,CAAC,CAAA;AAEF,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC7C,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5D,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AACpE,CAAC"}

package/dist/constants/index.d.ts

@@ -1,3 +1,4 @@
+export * from './acp/index.js';
 export * from './a2a/index.js';
 export * from './advisory/index.js';
 export * from './compaction/index.js';
@@ -10,8 +11,9 @@ export * from './agent/index.js';
 export * from './continuation.js';
 export * from './limits.js';
 export * from './bus/index.js';
-export * from './verification/index.js';
+export * from './authorization/index.js';
 export * from './emergency.js';
 export * from './plugin/index.js';
 export * from './sandbox/index.js';
+export * from './secret-patterns.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/constants/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,yBAAyB,CAAA;AACvC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,0BAA0B,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,sBAAsB,CAAA"}

package/dist/constants/index.js

@@ -1,3 +1,4 @@
+export * from './acp/index.js';
 export * from './a2a/index.js';
 export * from './advisory/index.js';
 export * from './compaction/index.js';
@@ -10,8 +11,9 @@ export * from './agent/index.js';
 export * from './continuation.js';
 export * from './limits.js';
 export * from './bus/index.js';
-export * from './verification/index.js';
+export * from './authorization/index.js';
 export * from './emergency.js';
 export * from './plugin/index.js';
 export * from './sandbox/index.js';
+export * from './secret-patterns.js';
 //# sourceMappingURL=index.js.map

package/dist/constants/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,yBAAyB,CAAA;AACvC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAA;AAC9B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,uBAAuB,CAAA;AACrC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,sBAAsB,CAAA;AACpC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,0BAA0B,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,sBAAsB,CAAA"}

package/dist/constants/secret-patterns.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Credential shapes redacted before they leave this tree, in one place.
+ *
+ * Two tables evolved independently and disagreed:
+ *
+ *  - `runtime/query/guardrail-presets.ts` carried eight vendor-prefix-anchored
+ *    patterns, private and unexported, deliberately narrow — a loose
+ *    "looks like a secret" regex over model output produces false positives
+ *    on ordinary code, and a redactor that fires on the wrong thing gets
+ *    switched off, at which point it protects nothing.
+ *  - `provider/errors.ts` carried a broader, field-name-aware set (a
+ *    generic key-prefix pattern, a bearer-header pattern, and a JSON
+ *    field-name scrubber that catches a secret by the key it sits under
+ *    regardless of value shape) because the narrow approach had already
+ *    proven insufficient there: a vendor error body echoes the request,
+ *    and a request can carry a credential shape the narrow table never
+ *    anticipated.
+ *
+ * Both live here now, as two exported sets rather than one, because the
+ * cost of a false positive is not the same at the two call sites:
+ *
+ *  - `OUTPUT_SECRET_PATTERNS` (the original narrow eight) is what
+ *    `secretRedactionGuardrail` matches against MODEL OUTPUT. A false
+ *    positive there rewrites the answer the caller asked for, so it stays
+ *    narrow on purpose.
+ *  - `LOG_SECRET_PATTERNS` (the union of both tables) is for text that is
+ *    being logged or carried in an error's `detail`, never returned as the
+ *    answer itself. A false positive there redacts one word out of a
+ *    diagnostic line nobody was going to copy-paste as a credential, which
+ *    is a cost worth paying for the wider net.
+ *
+ * `SecretPattern` label strings are never returned to the caller verbatim —
+ * consumers replace a match with `[REDACTED:<label>]`, not the matched
+ * text, so a `label` here should never itself carry anything secret.
+ *
+ * Zero imports. This is a leaf module on purpose: `utils/logger.ts` is
+ * imported by most of `runtime/query/`, so pulling this table back out of
+ * `runtime/query` would have made it a same-package import cycle, and a
+ * cycle on a security-relevant table fails as a TDZ error or a
+ * partially-initialised module — quietly, in the worst possible place.
+ * Keeping this file leaf-only is what lets `runtime/query/guardrail-presets.ts`
+ * and `provider/errors.ts` both import from it without one importing the
+ * other.
+ */
+export type SecretPattern = readonly [label: string, pattern: RegExp];
+/**
+ * The narrow, prefix-anchored set. Unchanged from the table this replaces —
+ * same labels, same regexes, same order — because moving it was the whole
+ * point of this module and widening it was not: `secretRedactionGuardrail`
+ * still needs a redactor precise enough that it never gets switched off.
+ */
+export declare const OUTPUT_SECRET_PATTERNS: readonly SecretPattern[];
+/**
+ * The union: every pattern above, plus everything `provider/errors.ts`
+ * carried that the narrow set did not cover — a generic key-prefix catch,
+ * a bearer-header pattern, and a JSON field-name scrubber.
+ *
+ * Two adjustments over a plain concatenation, both required so that
+ * deleting any ONE entry changes behaviour for exactly the shape that
+ * entry names, which is what the test suite for this module pins:
+ *
+ *  - `github-token` uses the wider `{20,}` threshold `provider/errors.ts`
+ *    used, not the guardrail's `{36,}` — the union takes the broader of
+ *    two disagreeing thresholds for the same vendor, never the narrower.
+ *  - The two broad `sk-`-family entries each carry a negative lookahead
+ *    excluding the `sk-ant-` and `sk-proj-` shapes, which a plain
+ *    `sk-`/`pk-`/`rk-` prefix scan would otherwise ALSO match. Without the
+ *    lookaheads, deleting the narrower entry for one of those shapes leaves a
+ *    value of that shape still caught — by the broad entries, in array order —
+ *    so the redaction succeeds while the label names the wrong issuer.
+ *
+ *    A mislabelled redaction is not a cosmetic problem: the label is what an
+ *    operator greps for when rotating one credential and not another. That is
+ *    also why the mutation check deletes each entry in turn and asserts only
+ *    its own sample breaks.
+ */
+export declare const LOG_SECRET_PATTERNS: readonly SecretPattern[];
+//# sourceMappingURL=secret-patterns.d.ts.map

package/dist/constants/secret-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.d.ts","sourceRoot":"","sources":["../../src/constants/secret-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,MAAM,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;AAErE;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,aAAa,EAS1D,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,aAAa,EAavD,CAAA"}

package/dist/constants/secret-patterns.js

@@ -0,0 +1,99 @@
+/**
+ * Credential shapes redacted before they leave this tree, in one place.
+ *
+ * Two tables evolved independently and disagreed:
+ *
+ *  - `runtime/query/guardrail-presets.ts` carried eight vendor-prefix-anchored
+ *    patterns, private and unexported, deliberately narrow — a loose
+ *    "looks like a secret" regex over model output produces false positives
+ *    on ordinary code, and a redactor that fires on the wrong thing gets
+ *    switched off, at which point it protects nothing.
+ *  - `provider/errors.ts` carried a broader, field-name-aware set (a
+ *    generic key-prefix pattern, a bearer-header pattern, and a JSON
+ *    field-name scrubber that catches a secret by the key it sits under
+ *    regardless of value shape) because the narrow approach had already
+ *    proven insufficient there: a vendor error body echoes the request,
+ *    and a request can carry a credential shape the narrow table never
+ *    anticipated.
+ *
+ * Both live here now, as two exported sets rather than one, because the
+ * cost of a false positive is not the same at the two call sites:
+ *
+ *  - `OUTPUT_SECRET_PATTERNS` (the original narrow eight) is what
+ *    `secretRedactionGuardrail` matches against MODEL OUTPUT. A false
+ *    positive there rewrites the answer the caller asked for, so it stays
+ *    narrow on purpose.
+ *  - `LOG_SECRET_PATTERNS` (the union of both tables) is for text that is
+ *    being logged or carried in an error's `detail`, never returned as the
+ *    answer itself. A false positive there redacts one word out of a
+ *    diagnostic line nobody was going to copy-paste as a credential, which
+ *    is a cost worth paying for the wider net.
+ *
+ * `SecretPattern` label strings are never returned to the caller verbatim —
+ * consumers replace a match with `[REDACTED:<label>]`, not the matched
+ * text, so a `label` here should never itself carry anything secret.
+ *
+ * Zero imports. This is a leaf module on purpose: `utils/logger.ts` is
+ * imported by most of `runtime/query/`, so pulling this table back out of
+ * `runtime/query` would have made it a same-package import cycle, and a
+ * cycle on a security-relevant table fails as a TDZ error or a
+ * partially-initialised module — quietly, in the worst possible place.
+ * Keeping this file leaf-only is what lets `runtime/query/guardrail-presets.ts`
+ * and `provider/errors.ts` both import from it without one importing the
+ * other.
+ */
+/**
+ * The narrow, prefix-anchored set. Unchanged from the table this replaces —
+ * same labels, same regexes, same order — because moving it was the whole
+ * point of this module and widening it was not: `secretRedactionGuardrail`
+ * still needs a redactor precise enough that it never gets switched off.
+ */
+export const OUTPUT_SECRET_PATTERNS = [
+    ['aws-access-key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g],
+    ['github-token', /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g],
+    ['openai-key', /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/g],
+    ['anthropic-key', /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g],
+    ['slack-token', /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g],
+    ['google-api-key', /\bAIza[0-9A-Za-z_-]{35}\b/g],
+    ['private-key-block', /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/g],
+    ['jwt', /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g],
+];
+/**
+ * The union: every pattern above, plus everything `provider/errors.ts`
+ * carried that the narrow set did not cover — a generic key-prefix catch,
+ * a bearer-header pattern, and a JSON field-name scrubber.
+ *
+ * Two adjustments over a plain concatenation, both required so that
+ * deleting any ONE entry changes behaviour for exactly the shape that
+ * entry names, which is what the test suite for this module pins:
+ *
+ *  - `github-token` uses the wider `{20,}` threshold `provider/errors.ts`
+ *    used, not the guardrail's `{36,}` — the union takes the broader of
+ *    two disagreeing thresholds for the same vendor, never the narrower.
+ *  - The two broad `sk-`-family entries each carry a negative lookahead
+ *    excluding the `sk-ant-` and `sk-proj-` shapes, which a plain
+ *    `sk-`/`pk-`/`rk-` prefix scan would otherwise ALSO match. Without the
+ *    lookaheads, deleting the narrower entry for one of those shapes leaves a
+ *    value of that shape still caught — by the broad entries, in array order —
+ *    so the redaction succeeds while the label names the wrong issuer.
+ *
+ *    A mislabelled redaction is not a cosmetic problem: the label is what an
+ *    operator greps for when rotating one credential and not another. That is
+ *    also why the mutation check deletes each entry in turn and asserts only
+ *    its own sample breaks.
+ */
+export const LOG_SECRET_PATTERNS = [
+    ['aws-access-key', /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g],
+    ['github-token', /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g],
+    ['anthropic-key', /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g],
+    ['openai-key', /\bsk-(?!ant-)(?:proj-)?[A-Za-z0-9_-]{20,}\b/g],
+    ['slack-token', /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/g],
+    ['google-api-key', /\bAIza[0-9A-Za-z_-]{35}\b/g],
+    ['private-key-block', /-----BEGIN (?:RSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/g],
+    ['jwt', /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g],
+    ['npm-token', /\bnpm_[A-Za-z0-9]{20,}\b/g],
+    ['bearer-token', /\bBearer\s+[A-Za-z0-9._~+/-]{12,}=*/gi],
+    ['generic-key', /\b(?:sk[-_](?!ant-|proj-)|pk[-_]|rk[-_])[A-Za-z0-9_-]{12,}\b/g],
+    ['json-secret-field', /"(?:api[_-]?key|authorization|token|secret|password)"\s*:\s*"[^"]*"/gi],
+];
+//# sourceMappingURL=secret-patterns.js.map

package/dist/constants/secret-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.js","sourceRoot":"","sources":["../../src/constants/secret-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA6B;IAC/D,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;IACpD,CAAC,cAAc,EAAE,iCAAiC,CAAC;IACnD,CAAC,YAAY,EAAE,sCAAsC,CAAC;IACtD,CAAC,eAAe,EAAE,gCAAgC,CAAC;IACnD,CAAC,aAAa,EAAE,mCAAmC,CAAC;IACpD,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;IAChD,CAAC,mBAAmB,EAAE,yDAAyD,CAAC;IAChF,CAAC,KAAK,EAAE,uEAAuE,CAAC;CAChF,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAA6B;IAC5D,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;IACpD,CAAC,cAAc,EAAE,iCAAiC,CAAC;IACnD,CAAC,eAAe,EAAE,gCAAgC,CAAC;IACnD,CAAC,YAAY,EAAE,8CAA8C,CAAC;IAC9D,CAAC,aAAa,EAAE,mCAAmC,CAAC;IACpD,CAAC,gBAAgB,EAAE,4BAA4B,CAAC;IAChD,CAAC,mBAAmB,EAAE,yDAAyD,CAAC;IAChF,CAAC,KAAK,EAAE,uEAAuE,CAAC;IAChF,CAAC,WAAW,EAAE,2BAA2B,CAAC;IAC1C,CAAC,cAAc,EAAE,uCAAuC,CAAC;IACzD,CAAC,aAAa,EAAE,+DAA+D,CAAC;IAChF,CAAC,mBAAmB,EAAE,uEAAuE,CAAC;CAC9F,CAAA"}

package/dist/constants/telemetry/index.d.ts

@@ -46,5 +46,47 @@ export declare const NAMZU: {
     readonly CACHE_READ_TOKENS: "namzu.cache.read_tokens";
     readonly CACHE_WRITE_TOKENS: "namzu.cache.write_tokens";
     readonly CACHE_DISCOUNT: "namzu.cache.discount";
+    readonly SESSION_ID: "namzu.session.id";
+    readonly THREAD_ID: "namzu.thread.id";
+    readonly PROJECT_ID: "namzu.project.id";
+    readonly TENANT_ID: "namzu.tenant.id";
+    readonly RUN_PARENT_ID: "namzu.run.parent_id";
+    readonly AGENT_TYPE: "namzu.agent.type";
+    readonly REGISTRY_NAME: "namzu.registry.name";
+    readonly CREDENTIAL_ID: "namzu.credential.id";
+    readonly CREDENTIAL_LABEL: "namzu.credential.label";
+    readonly SERVER_ID: "namzu.connector.server.id";
+    readonly SERVER_NAME: "namzu.connector.server.name";
+    readonly MCP_SERVER_ID: "namzu.mcp.server.id";
+    readonly CONNECTOR_TYPE: "namzu.connector.type";
+    readonly EXECUTION_TYPE: "namzu.execution.type";
+    readonly SANDBOX_ID: "namzu.sandbox.id";
 };
+/**
+ * The boot narrative's closed event-name vocabulary — every `eventName` the
+ * SDK itself emits between process start and `namzu.boot.ready`. A call
+ * site spells `BOOT_EVENT_NAMES.X`, not the literal string, so a typo
+ * becomes a missing property at compile time rather than a name that
+ * silently never matches a host's filter.
+ *
+ * `BootEventName` is DERIVED from this record rather than declared beside
+ * it, so the two cannot drift — there is only one place a member is added.
+ * `LogRecord.eventName` itself stays `string`, not this union: widening it
+ * to a fixed union would make the field unusable for a future emitter
+ * naming events from a different vocabulary.
+ */
+export declare const BOOT_EVENT_NAMES: {
+    readonly BOOT_START: "namzu.boot.start";
+    readonly CONFIG_RESOLVED: "namzu.config.resolved";
+    readonly SANDBOX_RESOLVED: "namzu.sandbox.resolved";
+    readonly PROVIDER_RESOLVED: "namzu.provider.resolved";
+    readonly CAPABILITY_DETECTED: "namzu.capability.detected";
+    readonly CAPABILITY_BROKEN: "namzu.capability.broken";
+    readonly TELEMETRY_STATUS: "namzu.telemetry.status";
+    readonly MIGRATION_COMPLETED: "namzu.migration.completed";
+    readonly DISCOVERY_COMPLETED: "namzu.discovery.completed";
+    readonly BOOT_REFUSED: "namzu.boot.refused";
+    readonly BOOT_READY: "namzu.boot.ready";
+};
+export type BootEventName = (typeof BOOT_EVENT_NAMES)[keyof typeof BOOT_EVENT_NAMES];
 //# sourceMappingURL=index.d.ts.map

package/dist/constants/telemetry/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/telemetry/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,KAAK;;;;;;;;;;;IAejB;;;;;OAKG;;;;IAMH;;;;;;;;;;;;;OAaG;;;;CAKM,CAAA;AAEV,eAAO,MAAM,KAAK;;;;;;;;;;CAUR,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/constants/telemetry/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,KAAK;;;;;;;;;;;IAejB;;;;;OAKG;;;;IAMH;;;;;;;;;;;;;OAaG;;;;CAKM,CAAA;AAEV,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;CA+ER,CAAA;AAEV;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;CAYnB,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAA"}