@noodleseed/one 0.168.0 → 0.170.0

package/node_modules/@noodle-borg/control-plane/dist/delete-deployment.js

@@ -0,0 +1,105 @@
+const ERRORS = {
+    deployment_not_found: 'Deployment not found.',
+    version_not_found: 'Version not found.',
+    active_deployment: 'Roll back to another deployment before deleting the live deployment, or delete the whole version.',
+    deployment_locked: 'Unlock this version before deleting it.',
+    app_archived: 'Restore the archived app before deleting its deployments.',
+    deployment_delete_conflict: 'The deployment history changed. Refresh and review it before deleting.',
+};
+/** One owner-authorized deletion path for every host; stores commit the exact selection atomically. */
+export async function deleteDeploymentOperation(deps, input) {
+    const { actor: identity, scope: route } = input;
+    const org = route.kind === 'version' ? route.target.org : route.org;
+    const member = identity.superAdmin
+        ? undefined
+        : await deps.controlPlane.getOrgMember({ org, subject: identity.subject });
+    if (identity.developerGrantId !== undefined ||
+        (!identity.superAdmin && member?.role !== 'owner')) {
+        return {
+            ok: false,
+            status: 403,
+            code: 'organization_owner_required',
+            error: 'Only an organization owner can delete deployments or versions.',
+        };
+    }
+    let target;
+    let selection;
+    if (route.kind === 'deployment') {
+        const record = await deps.registry.getDeployment(route.org, route.deploymentId);
+        if (!record)
+            return {
+                ok: false,
+                status: 404,
+                code: 'deployment_not_found',
+                error: ERRORS.deployment_not_found,
+            };
+        target = { org: record.orgSlug, app: record.appSlug, env: record.environment };
+        selection = { kind: 'deployment', deploymentId: route.deploymentId };
+    }
+    else {
+        if (!input.expectedDeploymentIds?.length)
+            return {
+                ok: false,
+                status: 400,
+                code: 'invalid_deletion_confirmation',
+                error: 'Invalid version deletion confirmation.',
+            };
+        target = route.target;
+        selection = {
+            kind: 'version',
+            expectedDeploymentIds: input.expectedDeploymentIds,
+            ...(route.serverVersion === undefined ? {} : { serverVersion: route.serverVersion }),
+        };
+    }
+    const result = await deps.registry.deleteDeployments(target, selection);
+    const status = result.ok
+        ? 200
+        : result.code === 'deployment_not_found' || result.code === 'version_not_found'
+            ? 404
+            : 409;
+    let auditRecorded = true;
+    try {
+        await deps.audit.emit({
+            eventType: result.ok
+                ? route.kind === 'version'
+                    ? 'deployment.version.deleted'
+                    : 'deployment.deleted'
+                : 'deployment.delete.rejected',
+            org: target.org,
+            app: target.app,
+            env: target.env,
+            ...(route.kind === 'deployment' ? { deploymentId: route.deploymentId } : {}),
+            actorSubject: identity.subject,
+            ...(identity.email === undefined ? {} : { actorEmail: identity.email }),
+            decision: result.ok ? 'allow' : 'deny',
+            status,
+            ...(!result.ok ? { reasonCode: result.code } : {}),
+            details: {
+                scope: route.kind,
+                ...(route.kind === 'version' ? { serverVersion: route.serverVersion ?? 'legacy' } : {}),
+                ...(result.ok ? { deletedDeployments: result.deleted.length } : {}),
+            },
+        });
+    }
+    catch {
+        // Deletion has already committed. An audit outage must not claim the records still exist.
+        auditRecorded = false;
+    }
+    if (!result.ok)
+        return {
+            ok: false,
+            status: status,
+            code: result.code,
+            error: ERRORS[result.code],
+        };
+    return {
+        ok: true,
+        view: {
+            ok: true,
+            target,
+            deletedDeploymentIds: result.deleted.map((record) => record.deploymentId),
+            auditRecorded,
+        },
+    };
+}
+//# sourceMappingURL=delete-deployment.js.map

package/node_modules/@noodle-borg/control-plane/dist/deployment-deletion-contracts.d.ts

@@ -0,0 +1,20 @@
+export type DeploymentDeleteSelection = {
+    readonly kind: 'deployment';
+    readonly deploymentId: string;
+} | {
+    readonly kind: 'version';
+    readonly serverVersion?: string;
+    readonly expectedDeploymentIds: readonly string[];
+};
+export type DeploymentDeleteResult<Record extends {
+    readonly deploymentId: string;
+} = {
+    readonly deploymentId: string;
+}> = {
+    readonly ok: true;
+    readonly deleted: readonly Record[];
+} | {
+    readonly ok: false;
+    readonly code: 'deployment_not_found' | 'version_not_found' | 'active_deployment' | 'deployment_locked' | 'app_archived' | 'deployment_delete_conflict';
+};
+//# sourceMappingURL=deployment-deletion-contracts.d.ts.map

package/node_modules/@noodle-borg/control-plane/dist/portable.d.ts

@@ -1,8 +1,10 @@
 export { type AppPurgeReconciliationActor, type AppPurgeReconciliationConflictCode, AppPurgeReconciliationError, type AppPurgeReconciliationOperator, } from './app-purge-reconciliation-port.js';
 export type { ActiveMcpSubdomainClaim, ChangeMcpSubdomainInput, ControlPlaneIdentity, CreateOrgWithOwnerInput, McpSubdomainMutationResult, McpSubdomainSetting, OrganizationStore, OrgDomainRecord, OrgInvitationRecord, OrgMemberRecord, OrgOpenAIAppsChallengeRecord, OrgRecord, OrgRole, PersonalWorkspaceProvisionInput, PersonalWorkspaceProvisionResult, SignupAllowlistKind, SignupAllowlistRecord, WelcomeEmailRecord, } from './contracts.js';
 export { PersonalWorkspaceOwnerMutationError } from './contracts.js';
+export { type DeploymentDeleteOperationResult, type DeploymentDeleteScope, type DeploymentDeletionDependencies, type DeploymentDeletionRegistry, deleteDeploymentOperation, } from './delete-deployment.js';
 export { allowAllGate, bearerToken, type ControlPlaneAuthResult, type DeployAuthGate, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, type ControlPlaneSignupMode, GoogleControlPlaneGate, type GoogleControlPlaneGateOptions, type GoogleIdTokenVerifier, GoogleWorkloadControlPlaneGate, type GoogleWorkloadControlPlaneGateOptions, NoodleOAuthControlPlaneGate, type NoodleOAuthControlPlaneGateOptions, type SignupAuthorizer, } from './deploy-gates.js';
+export type { DeploymentDeleteResult, DeploymentDeleteSelection, } from './deployment-deletion-contracts.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';
 export { bindInMemoryOrganizationStore, type InMemoryOrganizationOperations, InMemoryOrganizationStore, } from './in-memory-organization-store.js';
 export { InMemoryMcpSubdomainClaimStore, McpSubdomainCooldownError, McpSubdomainIdempotencyConflictError, McpSubdomainOwnerRequiredError, type McpSubdomainRouteRef, McpSubdomainUnavailableError, mcpSubdomainEndpointOptions, type ResolvedMcpTenantRef, resolveMcpSubdomainTenant, } from './mcp-subdomain-claims.js';

package/node_modules/@noodle-borg/control-plane/dist/portable.js

@@ -1,5 +1,6 @@
 export { AppPurgeReconciliationError, } from './app-purge-reconciliation-port.js';
 export { PersonalWorkspaceOwnerMutationError } from './contracts.js';
+export { deleteDeploymentOperation, } from './delete-deployment.js';
 export { allowAllGate, bearerToken, } from './deploy-auth.js';
 export { CompositeControlPlaneGate, GoogleControlPlaneGate, GoogleWorkloadControlPlaneGate, NoodleOAuthControlPlaneGate, } from './deploy-gates.js';
 export { InMemoryControlPlaneStore } from './in-memory-control-plane-store.js';

package/node_modules/@noodle-borg/knowledge-crawl/dist/bounded-body.js

@@ -0,0 +1,38 @@
+/** Read decoded response bytes with bounded memory, cancellation and body cleanup on every path. */
+export async function readBoundedBody(response, maxBytes, signal) {
+    const reader = response.body?.getReader();
+    if (reader === undefined)
+        return new ArrayBuffer(0);
+    const chunks = [];
+    let size = 0;
+    const cancel = () => {
+        void reader.cancel().catch(() => { });
+    };
+    signal?.addEventListener('abort', cancel, { once: true });
+    try {
+        for (;;) {
+            signal?.throwIfAborted();
+            const next = await reader.read();
+            signal?.throwIfAborted();
+            if (next.done)
+                break;
+            size += next.value.byteLength;
+            if (size > maxBytes)
+                throw new Error('response_size_exceeded');
+            chunks.push(next.value);
+        }
+        const result = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            result.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return result.buffer;
+    }
+    finally {
+        signal?.removeEventListener('abort', cancel);
+        await reader.cancel().catch(() => { });
+        reader.releaseLock();
+    }
+}
+//# sourceMappingURL=bounded-body.js.map

package/node_modules/@noodle-borg/knowledge-crawl/dist/first-party.js

@@ -10,6 +10,7 @@
  */
 import { guardedFetch } from '@noodle-borg/connector-http';
 import { pathMatches } from '@noodle-borg/knowledge/portable';
+import { readBoundedBody } from './bounded-body.js';
 import { extractPageContent } from './html-text.js';
 import { parseOrigin, safeUrl } from './origin.js';
 import { parseRobots } from './robots.js';
@@ -95,9 +96,7 @@ export class FirstPartySiteFetcher {
             const response = await this.#fetch(url, { redirect: 'manual' });
             if (response.status !== 200)
                 return undefined;
-            const bytes = await response.arrayBuffer();
-            if (bytes.byteLength > maxPageBytes)
-                return undefined;
+            const bytes = await readBoundedBody(response, maxPageBytes);
             return extractPageContent(response.headers.get('content-type') ?? '', bytes);
         }
         catch {

package/node_modules/@noodle-borg/knowledge-crawl/dist/html-text.js

@@ -23,10 +23,18 @@ const NAMED_ENTITIES = {
 };
 function decodeEntities(text) {
     return text
-        .replace(/&#x([0-9a-f]+);/gi, (_, hex) => String.fromCodePoint(Number.parseInt(hex, 16)))
-        .replace(/&#(\d+);/g, (_, dec) => String.fromCodePoint(Number.parseInt(dec, 10)))
+        .replace(/&#x([0-9a-f]+);/gi, (_, hex) => safeCodePoint(Number.parseInt(hex, 16)))
+        .replace(/&#(\d+);/g, (_, dec) => safeCodePoint(Number.parseInt(dec, 10)))
         .replace(/&([a-z]+);/gi, (match, name) => NAMED_ENTITIES[name.toLowerCase()] ?? match);
 }
+function safeCodePoint(value) {
+    return Number.isSafeInteger(value) &&
+        value > 0 &&
+        value <= 0x10ffff &&
+        !(value >= 0xd800 && value <= 0xdfff)
+        ? String.fromCodePoint(value)
+        : '\uFFFD';
+}
 export function extractHtmlText(html) {
     const withoutBlocks = html.replace(NON_CONTENT_BLOCKS, ' ');
     const withBreaks = withoutBlocks.replace(BLOCK_BREAK, ' ');

package/node_modules/@noodle-borg/knowledge-crawl/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { FirecrawlSiteFetcher, type FirecrawlSiteFetcherOptions } from './firecrawl.js';
 export { FirstPartySiteFetcher, type FirstPartySiteFetcherOptions } from './first-party.js';
+export { type PageReadRequest, PublicPageReader, type ReadPublicPage } from './page-reader.js';
 export type { CrawlPage, SiteCrawlRequest, SiteFetcher } from './ports.js';
 export { TavilySiteFetcher, type TavilySiteFetcherOptions } from './tavily.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/knowledge-crawl/dist/index.js

@@ -1,4 +1,5 @@
 export { FirecrawlSiteFetcher } from './firecrawl.js';
 export { FirstPartySiteFetcher } from './first-party.js';
+export { PublicPageReader } from './page-reader.js';
 export { TavilySiteFetcher } from './tavily.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/knowledge-crawl/dist/page-reader.d.ts

@@ -0,0 +1,26 @@
+export interface PageReadRequest {
+    readonly url: string;
+    readonly domains?: readonly string[];
+    readonly signal: AbortSignal;
+    readonly beforeRequest: () => void;
+    readonly maxBytes: number;
+}
+export interface ReadPublicPage {
+    readonly url: string;
+    readonly title: string;
+    readonly text: string;
+    readonly links: readonly {
+        readonly url: string;
+        readonly label?: string;
+    }[];
+    readonly retrievedAt: string;
+}
+/** Single-page acquisition, not a crawler. All transport collaborators are deployment-owned. */
+export declare class PublicPageReader {
+    #private;
+    constructor(options?: {
+        readonly fetchImpl?: typeof fetch;
+    });
+    read(request: PageReadRequest): Promise<ReadPublicPage>;
+}
+//# sourceMappingURL=page-reader.d.ts.map

package/node_modules/@noodle-borg/knowledge-crawl/dist/page-reader.js

@@ -0,0 +1,127 @@
+import { guardedFetch } from '@noodle-borg/connector-http';
+import { CapabilityError, publicPageUrl, WEB_EXTRACT_LIMITS, } from '@noodle-borg/managed-capabilities';
+import { readBoundedBody } from './bounded-body.js';
+import { extractHtmlText, extractPageContent } from './html-text.js';
+import { parseRobots } from './robots.js';
+const PRODUCT_TOKEN = 'NoodleSeedBot';
+const HEADERS = {
+    'user-agent': `${PRODUCT_TOKEN}/1.0 (bounded public-page extraction)`,
+    accept: 'text/html,text/plain;q=0.9',
+    'accept-encoding': 'identity',
+};
+/** Single-page acquisition, not a crawler. All transport collaborators are deployment-owned. */
+export class PublicPageReader {
+    #fetch;
+    constructor(options = {}) {
+        this.#fetch = options.fetchImpl ?? ((url, init) => guardedFetch(new URL(String(url)), init));
+    }
+    async read(request) {
+        const signal = AbortSignal.any([
+            request.signal,
+            AbortSignal.timeout(WEB_EXTRACT_LIMITS.timeoutMs),
+        ]);
+        let url = publicPageUrl(request.url, request.domains);
+        const checked = new Map();
+        try {
+            for (let redirects = 0; redirects <= WEB_EXTRACT_LIMITS.maxRedirects; redirects += 1) {
+                signal.throwIfAborted();
+                let robots = checked.get(url.origin);
+                if (robots === undefined) {
+                    robots = await this.#robots(url, request, signal);
+                    checked.set(url.origin, robots);
+                }
+                if (!robots.isAllowed(url.pathname))
+                    throw new CapabilityError('capability_source_rejected');
+                const response = await this.#request(url, request, signal);
+                try {
+                    if ([301, 302, 303, 307, 308].includes(response.status)) {
+                        const location = response.headers.get('location');
+                        if (location === null || redirects === WEB_EXTRACT_LIMITS.maxRedirects) {
+                            throw new CapabilityError('capability_source_rejected');
+                        }
+                        url = publicPageUrl(new URL(location, url).href, request.domains);
+                        continue;
+                    }
+                    if (response.status !== 200)
+                        throw new CapabilityError('capability_source_rejected');
+                    const mime = response.headers.get('content-type')?.split(';')[0]?.trim().toLowerCase();
+                    if (mime !== 'text/html')
+                        throw new CapabilityError('capability_source_rejected');
+                    const bytes = await readBoundedBody(response, Math.min(request.maxBytes, WEB_EXTRACT_LIMITS.maxPageBytes), signal);
+                    signal.throwIfAborted();
+                    const content = extractPageContent(mime, bytes);
+                    if (content === undefined || content.text === '')
+                        throw new CapabilityError('capability_source_rejected');
+                    return {
+                        url: url.href,
+                        title: content.title.slice(0, 512),
+                        text: content.text,
+                        links: pageLinks(content.html, url, request.domains),
+                        retrievedAt: new Date().toISOString(),
+                    };
+                }
+                finally {
+                    await response.body?.cancel().catch(() => { });
+                }
+            }
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw new CapabilityError('capability_cancelled');
+            if (error instanceof CapabilityError)
+                throw error;
+            throw new CapabilityError('capability_source_rejected');
+        }
+        throw new CapabilityError('capability_source_rejected');
+    }
+    async #request(url, request, signal) {
+        signal.throwIfAborted();
+        request.beforeRequest();
+        return this.#fetch(url.href, {
+            method: 'GET',
+            redirect: 'manual',
+            credentials: 'omit',
+            headers: HEADERS,
+            signal,
+        });
+    }
+    async #robots(url, request, signal) {
+        const response = await this.#request(new URL('/robots.txt', url), request, signal);
+        try {
+            if (response.status === 404 || response.status === 410)
+                return parseRobots('', PRODUCT_TOKEN);
+            if (response.status !== 200)
+                throw new CapabilityError('capability_source_rejected');
+            const bytes = await readBoundedBody(response, WEB_EXTRACT_LIMITS.maxRobotsBytes, signal);
+            const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+            if (text.trimStart().startsWith('<') || text.includes('\0'))
+                throw new CapabilityError('capability_source_rejected');
+            return parseRobots(text, PRODUCT_TOKEN);
+        }
+        finally {
+            await response.body?.cancel().catch(() => { });
+        }
+    }
+}
+function pageLinks(html, base, domains) {
+    const links = [];
+    const seen = new Set();
+    // Bounded HTML has no evaluator. Link labels and destinations are untrusted and are not fetched here.
+    for (const match of html.matchAll(/<a\b[^>]*?href\s*=\s*["']([^"']{1,2048})["'][^>]*>([\s\S]*?)<\/a\s*>/gi)) {
+        try {
+            const url = publicPageUrl(new URL(match[1] ?? '', base).href, domains);
+            if (url.origin !== base.origin || seen.has(url.href))
+                continue;
+            seen.add(url.href);
+            const label = extractHtmlText(match[2] ?? '').slice(0, 200);
+            links.push({ url: url.href, ...(label === '' ? {} : { label }) });
+            if (links.length === WEB_EXTRACT_LIMITS.maxLinks)
+                break;
+        }
+        catch {
+            /* Unsafe or out-of-policy links do not become candidate sources. */
+        }
+    }
+    return links;
+}
+//# sourceMappingURL=page-reader.js.map

package/node_modules/@noodle-borg/knowledge-crawl/dist/robots.js

@@ -1,14 +1,14 @@
 /**
- * Minimal robots.txt evaluation for the managed crawler: `*` user-agent groups only, with the
- * de-facto longest-match precedence between Allow and Disallow (Allow wins an exact-length tie),
- * plus global `Sitemap:` collection. Deliberately dependency-free; if richer semantics are ever
- * needed, verify the dependency license first (root rules).
+ * Bounded robots groups and longest-match rules. An explicit product token selects its exact
+ * groups before wildcard groups; omitted token retains the crawler's wildcard-group behavior.
+ * Supports percent-normalized paths, wildcard and end-anchor matching without a backtracking regex.
  */
-export function parseRobots(text) {
-    const rules = [];
+export function parseRobots(text, productToken = '*') {
+    const groups = [];
     const sitemaps = [];
-    let inStarGroup = false;
-    let groupHasAgents = false;
+    let group = { agents: [], rules: [] };
+    groups.push(group);
+    let ruleCount = 0;
     for (const rawLine of text.split(/\r?\n/)) {
         const line = rawLine.replace(/#.*$/, '').trim();
         if (line === '')
@@ -24,32 +24,31 @@ export function parseRobots(text) {
             continue;
         }
         if (field === 'user-agent') {
-            // Consecutive user-agent lines share one group; a rule line closes the agent list, so a
-            // user-agent line after rules starts a fresh group.
-            if (groupHasAgents) {
-                inStarGroup = false;
-                groupHasAgents = false;
+            if (group.rules.length > 0) {
+                group = { agents: [], rules: [] };
+                groups.push(group);
             }
-            if (value === '*')
-                inStarGroup = true;
+            group.agents.push(value.toLowerCase());
             continue;
         }
         if (field === 'allow' || field === 'disallow') {
-            groupHasAgents = true;
-            if (!inStarGroup)
-                continue;
-            // A bare "Disallow:" means allow-all per the de-facto standard.
-            if (value === '')
-                continue;
-            rules.push({ allow: field === 'allow', path: value });
+            ruleCount += 1;
+            if (ruleCount > 4096 || value.length > 2048 || (value !== '' && !value.startsWith('/'))) {
+                throw new Error('robots_policy_invalid');
+            }
+            group.rules.push({ allow: field === 'allow', path: normalizePath(value) });
         }
     }
+    const exact = groups.filter((entry) => entry.agents.includes(productToken.toLowerCase()));
+    const selected = exact.length > 0 ? exact : groups.filter((entry) => entry.agents.includes('*'));
+    const rules = selected.flatMap((entry) => entry.rules).filter((rule) => rule.path !== '');
     return {
         sitemaps,
         isAllowed(path) {
+            const normalized = normalizePath(path);
             let best;
             for (const rule of rules) {
-                if (!path.startsWith(rule.path))
+                if (!matches(normalized, rule.path))
                     continue;
                 if (best === undefined ||
                     rule.path.length > best.path.length ||
@@ -61,4 +60,30 @@ export function parseRobots(text) {
         },
     };
 }
+function normalizePath(path) {
+    return path.replace(/%[0-9a-f]{2}|\P{ASCII}/giu, (part) => {
+        if (!part.startsWith('%'))
+            return encodeURIComponent(part);
+        const decoded = String.fromCharCode(Number.parseInt(part.slice(1), 16));
+        return /^[a-z0-9._~-]$/i.test(decoded) ? decoded : part.toUpperCase();
+    });
+}
+function matches(path, pattern) {
+    const anchored = pattern.endsWith('$');
+    const parts = (anchored ? pattern.slice(0, -1) : pattern).split('*');
+    const first = parts[0] ?? '';
+    if (!path.startsWith(first))
+        return false;
+    let position = first.length;
+    for (let i = 1; i < parts.length; i += 1) {
+        const part = parts[i] ?? '';
+        if (anchored && i === parts.length - 1)
+            return path.endsWith(part) && path.length - part.length >= position;
+        const next = path.indexOf(part, position);
+        if (next === -1)
+            return false;
+        position = next + part.length;
+    }
+    return !anchored || position === path.length;
+}
 //# sourceMappingURL=robots.js.map

package/node_modules/@noodle-borg/knowledge-crawl/package.json

@@ -22,6 +22,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
+    "@noodle-borg/managed-capabilities": "0.0.0",
     "@noodle-borg/connector-http": "0.0.0",
     "@noodle-borg/knowledge": "0.0.0"
   },

package/node_modules/@noodle-borg/managed-capabilities/dist/budget.d.ts

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+import type { WebPolicy } from './contracts.js';
+declare const snapshotSchema: z.ZodObject<{
+    startedAt: z.ZodNullable<z.ZodNumber>;
+    timeout: z.ZodNumber;
+    maxCalls: z.ZodNumber;
+    maxUrls: z.ZodNumber;
+    calls: z.ZodNumber;
+    attempts: z.ZodNumber;
+    bytes: z.ZodNumber;
+    urls: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type CapabilityBudgetSnapshot = z.infer<typeof snapshotSchema>;
+/** Trusted turn/invocation state. Never reconstructed from client arguments or stored in an artifact. */
+export declare class CapabilityBudget {
+    #private;
+    constructor(snapshot?: CapabilityBudgetSnapshot);
+    /** Only for server-held continuations; no source URLs or content are retained. */
+    snapshot(): CapabilityBudgetSnapshot;
+    reserve(urls: readonly string[], policy: WebPolicy): AbortSignal;
+    beforeRequest(): void;
+    text(value: string, maxBytes: number): {
+        text: string;
+        truncated: boolean;
+    };
+    withSlot<T>(signal: AbortSignal, run: () => Promise<T>): Promise<T>;
+}
+export {};
+//# sourceMappingURL=budget.d.ts.map

package/node_modules/@noodle-borg/managed-capabilities/dist/budget.js

@@ -0,0 +1,124 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { CapabilityError } from './errors.js';
+import { WEB_EXTRACT_LIMITS as limits } from './limits.js';
+const snapshotSchema = z
+    .object({
+    startedAt: z.number().int().nonnegative().nullable(),
+    timeout: z.number().int().min(100).max(limits.timeoutMs),
+    maxCalls: z.number().int().min(1).max(limits.maxCalls),
+    maxUrls: z.number().int().min(1).max(limits.maxUrls),
+    calls: z.number().int().min(0).max(limits.maxCalls),
+    attempts: z.number().int().min(0).max(limits.maxHttpAttempts),
+    bytes: z.number().int().min(0).max(limits.maxTurnTextBytes),
+    urls: z.array(z.string().regex(/^[a-f0-9]{64}$/)).max(limits.maxUrls),
+})
+    .strict();
+const urlKey = (url) => createHash('sha256').update(url).digest('hex');
+/** Trusted turn/invocation state. Never reconstructed from client arguments or stored in an artifact. */
+export class CapabilityBudget {
+    #startedAt;
+    #timeout = limits.timeoutMs;
+    #maxCalls = limits.maxCalls;
+    #maxUrls = limits.maxUrls;
+    #calls = 0;
+    #attempts = 0;
+    #bytes = 0;
+    #active = 0;
+    #urls = new Set();
+    #waiters = new Set();
+    constructor(snapshot) {
+        if (snapshot === undefined)
+            return;
+        const parsed = snapshotSchema.parse(snapshot);
+        this.#startedAt = parsed.startedAt ?? undefined;
+        this.#timeout = parsed.timeout;
+        this.#maxCalls = parsed.maxCalls;
+        this.#maxUrls = parsed.maxUrls;
+        this.#calls = parsed.calls;
+        this.#attempts = parsed.attempts;
+        this.#bytes = parsed.bytes;
+        for (const key of parsed.urls)
+            this.#urls.add(key);
+    }
+    /** Only for server-held continuations; no source URLs or content are retained. */
+    snapshot() {
+        return {
+            startedAt: this.#startedAt ?? null,
+            timeout: this.#timeout,
+            maxCalls: this.#maxCalls,
+            maxUrls: this.#maxUrls,
+            calls: this.#calls,
+            attempts: this.#attempts,
+            bytes: this.#bytes,
+            urls: [...this.#urls],
+        };
+    }
+    reserve(urls, policy) {
+        this.#startedAt ??= Date.now();
+        this.#timeout = Math.min(this.#timeout, policy.timeoutMs ?? limits.timeoutMs);
+        this.#maxCalls = Math.min(this.#maxCalls, policy.maxCalls ?? limits.maxCalls);
+        this.#maxUrls = Math.min(this.#maxUrls, policy.maxUrls ?? limits.maxUrls);
+        const next = new Set([...this.#urls, ...urls.map(urlKey)]);
+        if (this.#calls >= this.#maxCalls || next.size > this.#maxUrls)
+            this.#exhausted();
+        this.#checkTime();
+        this.#calls += 1;
+        for (const url of urls)
+            this.#urls.add(urlKey(url));
+        return AbortSignal.timeout(Math.max(1, this.#startedAt + this.#timeout - Date.now()));
+    }
+    beforeRequest() {
+        this.#checkTime();
+        if (this.#attempts >= limits.maxHttpAttempts)
+            this.#exhausted();
+        this.#attempts += 1;
+    }
+    text(value, maxBytes) {
+        const bytes = Buffer.from(value, 'utf8');
+        let length = Math.min(bytes.length, maxBytes, limits.maxTurnTextBytes - this.#bytes);
+        // Drop any incomplete final code point rather than introducing a replacement character.
+        if (length < bytes.length)
+            while (length > 0 && ((bytes[length] ?? 0) & 0xc0) === 0x80)
+                length -= 1;
+        if (length === 0)
+            this.#exhausted();
+        this.#bytes += length;
+        return { text: bytes.subarray(0, length).toString('utf8'), truncated: length < bytes.length };
+    }
+    async withSlot(signal, run) {
+        while (this.#active >= limits.maxConcurrency) {
+            signal.throwIfAborted();
+            await new Promise((resolve) => {
+                const wake = () => {
+                    this.#waiters.delete(wake);
+                    signal.removeEventListener('abort', wake);
+                    resolve();
+                };
+                this.#waiters.add(wake);
+                signal.addEventListener('abort', wake, { once: true });
+                if (signal.aborted)
+                    wake();
+            });
+        }
+        signal.throwIfAborted();
+        this.#checkTime();
+        this.#active += 1;
+        try {
+            return await run();
+        }
+        finally {
+            this.#active -= 1;
+            for (const wake of [...this.#waiters])
+                wake();
+        }
+    }
+    #checkTime() {
+        if (this.#startedAt !== undefined && Date.now() >= this.#startedAt + this.#timeout)
+            this.#exhausted();
+    }
+    #exhausted() {
+        throw new CapabilityError('capability_budget_exhausted');
+    }
+}
+//# sourceMappingURL=budget.js.map