@oharness/engine 0.1.0

package/dist/util/json.js

@@ -0,0 +1,100 @@
+/**
+ * Tolerant JSON helpers for streamed tool arguments.
+ *
+ * Providers emit tool inputs as a stream of JSON fragments. To render a
+ * live preview ("Bash(npm run bui…") we need to parse a prefix of a JSON
+ * document, so `parsePartialJson` closes any open strings/arrays/objects
+ * before handing the text to JSON.parse.
+ */
+export function parseJson(raw) {
+    try {
+        return { ok: true, value: JSON.parse(raw) };
+    }
+    catch (err) {
+        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+}
+export function parsePartialJson(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === "")
+        return undefined;
+    try {
+        return JSON.parse(trimmed);
+    }
+    catch {
+        // fall through to repair
+    }
+    const repaired = closeOpenStructures(trimmed);
+    if (repaired === undefined)
+        return undefined;
+    try {
+        return JSON.parse(repaired);
+    }
+    catch {
+        return undefined;
+    }
+}
+function closeOpenStructures(input) {
+    const stack = [];
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === "\\")
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        else if (ch === "{")
+            stack.push("}");
+        else if (ch === "[")
+            stack.push("]");
+        else if (ch === "}" || ch === "]")
+            stack.pop();
+    }
+    let out = input;
+    // A trailing escape would break the string we are about to close.
+    if (escaped)
+        out = out.slice(0, -1);
+    if (inString)
+        out += '"';
+    // Drop dangling separators like `{"a":1,` or `{"a":`
+    out = out.replace(/([,:])\s*$/, (_m, sep) => (sep === ":" ? ":null" : ""));
+    for (let i = stack.length - 1; i >= 0; i--)
+        out += stack[i];
+    return out;
+}
+/**
+ * Decode accumulated tool-argument JSON. Models occasionally emit a truncated
+ * or slightly malformed object; falling back to the partial parser keeps the
+ * turn alive, and an empty object lets the tool's own validation produce a
+ * useful error message instead of crashing the loop.
+ */
+export function decodeToolInput(raw) {
+    if (raw.trim() === "")
+        return {};
+    const direct = parseJson(raw);
+    if (direct.ok)
+        return direct.value;
+    const partial = parsePartialJson(raw);
+    return partial === undefined ? {} : partial;
+}
+/** Truncate deeply/hugely nested values before logging or previewing. */
+export function previewJson(value, maxLength = 120) {
+    let s;
+    try {
+        s = typeof value === "string" ? value : JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        s = String(value);
+    }
+    s = s.replaceAll(/\s+/g, " ");
+    return s.length > maxLength ? `${s.slice(0, maxLength - 1)}…` : s;
+}
+//# sourceMappingURL=json.js.map

package/dist/util/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../src/util/json.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,UAAU,SAAS,CAAc,GAAW;IAChD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,EAAE,CAAC;IACnD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAChC,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAChC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,kEAAkE;IAClE,IAAI,OAAO;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,QAAQ;QAAE,GAAG,IAAI,GAAG,CAAC;IACzB,qDAAqD;IACrD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACnF,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,SAAS,GAAG,GAAG;IACzD,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QACH,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/util/jwt.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Verifying a token the account system issued.
+ *
+ * The point is that no network call happens on the path of a request. A server
+ * that asks an auth service whether a token is good has put someone else's
+ * availability in front of every call it serves. A signature answers the same
+ * question from arithmetic.
+ *
+ * Lives in the engine because two services need it: the sync server, whose
+ * writes it authorises, and the metering gateway, which charges an account it
+ * has to identify first.
+ *
+ * Written by hand rather than pulled in, because the whole of what is needed
+ * is three signature checks and four claim checks, and this package has one
+ * dependency on purpose. The parts that are easy to get subtly wrong are
+ * called out where they happen.
+ */
+export interface JwtOptions {
+    /** Shared secret for HS256 — Supabase calls this the project's JWT secret. */
+    secret?: string;
+    /** Endpoint serving public keys, for projects signing asymmetrically. */
+    jwksUrl?: string;
+    /** Required `iss`. Unset accepts any, which is right only behind one issuer. */
+    issuer?: string;
+    /** Required `aud`. Supabase issues `authenticated` for a signed-in user. */
+    audience?: string;
+    /** Claim carrying team ids. A Supabase auth hook is what puts it there. */
+    teamsClaim?: string;
+    /** Tolerance for clock drift between here and the issuer. */
+    clockSkewSeconds?: number;
+    /** Overridable for tests. */
+    fetch?: typeof globalThis.fetch;
+}
+export interface VerifiedClaims {
+    /** The account id. Supabase puts the user's uuid here. */
+    sub: string;
+    teams: string[];
+    /**
+     * The address on the account, when the issuer put one in the token. Never
+     * an identifier — `sub` is — but it saves asking someone for an email a
+     * signed token already states.
+     */
+    email?: string;
+}
+export declare class JwtVerifier {
+    private readonly opts;
+    private readonly http;
+    private keys;
+    private lastFetch;
+    private fetching;
+    constructor(opts: JwtOptions);
+    /** Whether anything is configured to verify against. */
+    get enabled(): boolean;
+    /**
+     * Claims, or undefined for anything that does not check out.
+     *
+     * Every failure is the same answer on purpose. Telling a caller whether the
+     * signature or the expiry was the problem is telling them how to get closer.
+     */
+    verify(token: string): Promise<VerifiedClaims | undefined>;
+    /**
+     * Check the signature against a key chosen by *kind*, never by the token.
+     *
+     * The classic break here is algorithm confusion: a token arrives claiming
+     * HS256, the server reaches for "the key" and finds an RSA public key, and
+     * HMACs with a value the attacker also has. So a symmetric alg is only ever
+     * checked against the configured secret and an asymmetric one only ever
+     * against a JWKS key, and the two paths cannot borrow each other's material.
+     */
+    private signatureValid;
+    private publicKey;
+    private refresh;
+    private claims;
+}

package/dist/util/jwt.js

@@ -0,0 +1,177 @@
+import { createHmac, createPublicKey, timingSafeEqual, verify as verifySignature } from "node:crypto";
+import { parseJson } from "./json.js";
+const DEFAULT_SKEW_SECONDS = 60;
+/** Floor between JWKS fetches, so an unknown kid cannot be used to hammer it. */
+const JWKS_REFRESH_FLOOR_MS = 60_000;
+export class JwtVerifier {
+    opts;
+    http;
+    keys = new Map();
+    lastFetch = 0;
+    fetching;
+    constructor(opts) {
+        this.opts = opts;
+        this.http = opts.fetch ?? globalThis.fetch;
+    }
+    /** Whether anything is configured to verify against. */
+    get enabled() {
+        return Boolean(this.opts.secret || this.opts.jwksUrl);
+    }
+    /**
+     * Claims, or undefined for anything that does not check out.
+     *
+     * Every failure is the same answer on purpose. Telling a caller whether the
+     * signature or the expiry was the problem is telling them how to get closer.
+     */
+    async verify(token) {
+        const parts = token.split(".");
+        if (parts.length !== 3)
+            return undefined;
+        const [rawHeader, rawPayload, rawSignature] = parts;
+        const header = decodeJson(rawHeader);
+        const payload = decodeJson(rawPayload);
+        if (!header || !payload)
+            return undefined;
+        const alg = typeof header.alg === "string" ? header.alg : "";
+        // `none` is a real algorithm in the spec and an unconditional forgery in
+        // practice. It is rejected by not appearing below, and named here so that
+        // nobody adds it back as a convenience.
+        if (!SUPPORTED.has(alg))
+            return undefined;
+        const signed = Buffer.from(`${rawHeader}.${rawPayload}`, "utf8");
+        const signature = decodeBase64Url(rawSignature);
+        if (!signature)
+            return undefined;
+        if (!(await this.signatureValid(alg, header.kid, signed, signature)))
+            return undefined;
+        return this.claims(payload);
+    }
+    /**
+     * Check the signature against a key chosen by *kind*, never by the token.
+     *
+     * The classic break here is algorithm confusion: a token arrives claiming
+     * HS256, the server reaches for "the key" and finds an RSA public key, and
+     * HMACs with a value the attacker also has. So a symmetric alg is only ever
+     * checked against the configured secret and an asymmetric one only ever
+     * against a JWKS key, and the two paths cannot borrow each other's material.
+     */
+    async signatureValid(alg, kid, signed, signature) {
+        if (alg === "HS256") {
+            if (!this.opts.secret)
+                return false;
+            const expected = createHmac("sha256", this.opts.secret).update(signed).digest();
+            return expected.length === signature.length && timingSafeEqual(expected, signature);
+        }
+        if (!this.opts.jwksUrl)
+            return false;
+        const entry = await this.publicKey(kid);
+        // The key's own algorithm decides, not the header's claim about it.
+        if (!entry || entry.alg !== alg)
+            return false;
+        if (alg === "RS256") {
+            return verifySignature("RSA-SHA256", signed, entry.key, signature);
+        }
+        // JWS carries ECDSA signatures as raw r||s, while Node defaults to DER.
+        // Without this the check fails for every valid ES256 token, which reads as
+        // "the key is wrong" and sends you looking in the wrong place.
+        return verifySignature("SHA256", signed, { key: entry.key, dsaEncoding: "ieee-p1363" }, signature);
+    }
+    async publicKey(kid) {
+        const held = kid ? this.keys.get(kid) : [...this.keys.values()][0];
+        if (held)
+            return held;
+        // A kid nobody has seen means the issuer rotated, which is worth one
+        // refetch — but not one per request, or an invented kid becomes a way to
+        // make this server hammer the issuer on demand.
+        if (Date.now() - this.lastFetch < JWKS_REFRESH_FLOOR_MS)
+            return undefined;
+        await this.refresh();
+        return kid ? this.keys.get(kid) : [...this.keys.values()][0];
+    }
+    refresh() {
+        this.fetching ??= (async () => {
+            this.lastFetch = Date.now();
+            try {
+                const response = await this.http(this.opts.jwksUrl, { redirect: "error" });
+                if (!response.ok)
+                    return;
+                const body = parseJson(await response.text());
+                if (!body.ok || !Array.isArray(body.value.keys))
+                    return;
+                const next = new Map();
+                for (const entry of body.value.keys) {
+                    const jwk = entry;
+                    if (!jwk || typeof jwk.kid !== "string")
+                        continue;
+                    if (jwk.use && jwk.use !== "sig")
+                        continue;
+                    const alg = typeof jwk.alg === "string" ? jwk.alg : jwk.kty === "RSA" ? "RS256" : "ES256";
+                    if (!SUPPORTED.has(alg) || alg === "HS256")
+                        continue;
+                    try {
+                        next.set(jwk.kid, {
+                            key: createPublicKey({ key: jwk, format: "jwk" }),
+                            alg,
+                        });
+                    }
+                    catch {
+                        // One unusable key is not a reason to drop the rest.
+                    }
+                }
+                if (next.size > 0)
+                    this.keys = next;
+            }
+            catch {
+                // Keep whatever was already loaded. A JWKS endpoint being briefly
+                // unreachable should not invalidate every token in flight.
+            }
+            finally {
+                this.fetching = undefined;
+            }
+        })();
+        return this.fetching;
+    }
+    claims(payload) {
+        const now = Math.floor(Date.now() / 1000);
+        const skew = this.opts.clockSkewSeconds ?? DEFAULT_SKEW_SECONDS;
+        const exp = payload["exp"];
+        // Required, not merely checked when present: a token with no expiry is a
+        // token that outlives the account it names.
+        if (typeof exp !== "number" || now > exp + skew)
+            return undefined;
+        const nbf = payload["nbf"];
+        if (typeof nbf === "number" && now + skew < nbf)
+            return undefined;
+        if (this.opts.issuer && payload["iss"] !== this.opts.issuer)
+            return undefined;
+        if (this.opts.audience && !audienceAllows(payload["aud"], this.opts.audience))
+            return undefined;
+        const sub = payload["sub"];
+        if (typeof sub !== "string" || !sub)
+            return undefined;
+        const raw = payload[this.opts.teamsClaim ?? "teams"];
+        const teams = Array.isArray(raw) ? raw.filter((id) => typeof id === "string") : [];
+        const email = payload["email"];
+        return { sub, teams, ...(typeof email === "string" && email ? { email } : {}) };
+    }
+}
+const SUPPORTED = new Set(["HS256", "RS256", "ES256"]);
+/** `aud` is a string or an array of them, and either may be the match. */
+function audienceAllows(claim, required) {
+    if (typeof claim === "string")
+        return claim === required;
+    return Array.isArray(claim) && claim.includes(required);
+}
+function decodeBase64Url(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value))
+        return undefined;
+    return Buffer.from(value, "base64url");
+}
+function decodeJson(segment) {
+    const raw = decodeBase64Url(segment);
+    if (!raw)
+        return undefined;
+    const parsed = parseJson(raw.toString("utf8"));
+    return parsed.ok ? parsed.value : undefined;
+}
+//# sourceMappingURL=jwt.js.map

package/dist/util/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/util/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,IAAI,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtG,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAiDtC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC,MAAM,OAAO,WAAW;IACL,IAAI,CAAa;IACjB,IAAI,CAA0B;IACvC,IAAI,GAAG,IAAI,GAAG,EAA2C,CAAC;IAC1D,SAAS,GAAG,CAAC,CAAC;IACd,QAAQ,CAA4B;IAE5C,YAAY,IAAgB;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO;QACT,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,CAAC,GAAG,KAAiC,CAAC;QAEhF,MAAM,MAAM,GAAG,UAAU,CAA+C,SAAS,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,UAAU,CAA0B,UAAU,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAE1C,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,yEAAyE;QACzE,0EAA0E;QAC1E,wCAAwC;QACxC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAE1C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QAEjC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACvF,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,cAAc,CAC1B,GAAW,EACX,GAAuB,EACvB,MAAc,EACd,SAAiB;QAEjB,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACpC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;YAChF,OAAO,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACxC,oEAAoE;QACpE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAE9C,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,OAAO,eAAe,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrE,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,+DAA+D;QAC/D,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,SAAS,CAAC,CAAC;IACrG,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAuB;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAEtB,qEAAqE;QACrE,yEAAyE;QACzE,gDAAgD;QAChD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,qBAAqB;YAAE,OAAO,SAAS,CAAC;QAC1E,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAQ,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,OAAO;gBACzB,MAAM,IAAI,GAAG,SAAS,CAAuB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;gBACpE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;oBAAE,OAAO;gBAExD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA2C,CAAC;gBAChE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;oBACpC,MAAM,GAAG,GAAG,KAAmE,CAAC;oBAChF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;wBAAE,SAAS;oBAClD,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;wBAAE,SAAS;oBAC3C,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;oBAC1F,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,OAAO;wBAAE,SAAS;oBACrD,IAAI,CAAC;wBACH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;4BAChB,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,GAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;4BAC1D,GAAG;yBACJ,CAAC,CAAC;oBACL,CAAC;oBAAC,MAAM,CAAC;wBACP,qDAAqD;oBACvD,CAAC;gBACH,CAAC;gBACD,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;gBAClE,2DAA2D;YAC7D,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,MAAM,CAAC,OAAgC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,oBAAoB,CAAC;QAEhE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,yEAAyE;QACzE,4CAA4C;QAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI;YAAE,OAAO,SAAS,CAAC;QAElE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG;YAAE,OAAO,SAAS,CAAC;QAElE,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAC9E,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAEhG,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAEtD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAClF,CAAC;CACF;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvD,0EAA0E;AAC1E,SAAS,cAAc,CAAC,KAAc,EAAE,QAAgB;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,QAAQ,CAAC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAI,OAAe;IACpC,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,SAAS,CAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC"}

package/dist/util/logger.d.ts

@@ -0,0 +1,13 @@
+export type LogLevel = "debug" | "info" | "warn" | "error" | "silent";
+export interface Logger {
+    level: LogLevel;
+    debug(msg: string, data?: unknown): void;
+    info(msg: string, data?: unknown): void;
+    warn(msg: string, data?: unknown): void;
+    error(msg: string, data?: unknown): void;
+    child(scope: string): Logger;
+}
+/** Where log lines go. Injected so a non-terminal frontend can capture them. */
+export type LogSink = (line: string) => void;
+export declare function createLogger(scope?: string, level?: LogLevel, sink?: LogSink): Logger;
+export declare const noopLogger: Logger;

package/dist/util/logger.js

@@ -0,0 +1,59 @@
+const ORDER = {
+    debug: 10,
+    info: 20,
+    warn: 30,
+    error: 40,
+    silent: 100,
+};
+function envLevel() {
+    const raw = process.env.OHARNESS_LOG_LEVEL?.toLowerCase();
+    if (raw && raw in ORDER)
+        return raw;
+    return "warn";
+}
+/**
+ * Diagnostics go to stderr, never stdout.
+ *
+ * This is the one place in the engine that writes to a stream, and it is
+ * deliberately stderr: stdout belongs to whatever frontend is rendering, and
+ * a library that swallows its own warnings by default is worse than one that
+ * puts them on the conventional diagnostic channel. `test/layering.test.ts`
+ * enforces both halves of that sentence.
+ */
+const stderrSink = (line) => process.stderr.write(`${line}\n`);
+export function createLogger(scope = "harness", level = envLevel(), sink = stderrSink) {
+    const write = (lvl, msg, data) => {
+        if (ORDER[lvl] < ORDER[logger.level])
+            return;
+        const line = `[${new Date().toISOString()}] ${lvl.toUpperCase().padEnd(5)} ${scope}: ${msg}`;
+        sink(data === undefined ? line : `${line} ${safeJson(data)}`);
+    };
+    const logger = {
+        level,
+        debug: (m, d) => write("debug", m, d),
+        info: (m, d) => write("info", m, d),
+        warn: (m, d) => write("warn", m, d),
+        error: (m, d) => write("error", m, d),
+        child: (sub) => createLogger(`${scope}:${sub}`, logger.level, sink),
+    };
+    return logger;
+}
+function safeJson(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+export const noopLogger = {
+    level: "silent",
+    debug() { },
+    info() { },
+    warn() { },
+    error() { },
+    child() {
+        return noopLogger;
+    },
+};
+//# sourceMappingURL=logger.js.map

package/dist/util/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/util/logger.ts"],"names":[],"mappings":"AAEA,MAAM,KAAK,GAA6B;IACtC,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,EAAE;IACR,IAAI,EAAE,EAAE;IACR,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,GAAG;CACZ,CAAC;AAWF,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,WAAW,EAAE,CAAC;IAC1D,IAAI,GAAG,IAAI,GAAG,IAAI,KAAK;QAAE,OAAO,GAAe,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAKD;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAY,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAExE,MAAM,UAAU,YAAY,CAC1B,KAAK,GAAG,SAAS,EACjB,QAAkB,QAAQ,EAAE,EAC5B,OAAgB,UAAU;IAE1B,MAAM,KAAK,GAAG,CAAC,GAAa,EAAE,GAAW,EAAE,IAAc,EAAE,EAAE;QAC3D,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO;QAC7C,MAAM,IAAI,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAC7F,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,MAAM,MAAM,GAAW;QACrB,KAAK;QACL,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACnC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC;KACpE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAW;IAChC,KAAK,EAAE,QAAQ;IACf,KAAK,KAAI,CAAC;IACV,IAAI,KAAI,CAAC;IACT,IAAI,KAAI,CAAC;IACT,KAAK,KAAI,CAAC;IACV,KAAK;QACH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC"}

package/dist/util/queue.d.ts

@@ -0,0 +1,26 @@
+/**
+ * A push-driven async queue.
+ *
+ * Needed because several producers write events while one consumer reads them.
+ * The alternative — collecting into an array and yielding once everything
+ * finishes — turns "progress" into "a summary printed after the fact", and
+ * makes parallel work indistinguishable from serial work in a UI.
+ */
+export declare class AsyncQueue<T> {
+    private readonly items;
+    private readonly waiters;
+    private closed;
+    private failure?;
+    /** Enqueue an item, handing it straight to a waiting consumer if there is one. */
+    push(item: T): void;
+    /** No more items. Consumers drain what is queued, then finish. */
+    close(): void;
+    /** Fail the stream. Queued items are dropped — the consumer must see the error. */
+    fail(error: unknown): void;
+    [Symbol.asyncIterator](): AsyncGenerator<T, void, void>;
+}
+/**
+ * Run several async generators concurrently, yielding events in the order they
+ * are produced rather than grouped by producer.
+ */
+export declare function mergeStreams<T>(producers: Array<() => AsyncGenerator<T, void, void>>): AsyncGenerator<T, void, void>;

package/dist/util/queue.js

@@ -0,0 +1,106 @@
+/**
+ * A push-driven async queue.
+ *
+ * Needed because several producers write events while one consumer reads them.
+ * The alternative — collecting into an array and yielding once everything
+ * finishes — turns "progress" into "a summary printed after the fact", and
+ * makes parallel work indistinguishable from serial work in a UI.
+ */
+export class AsyncQueue {
+    items = [];
+    waiters = [];
+    closed = false;
+    failure;
+    /** Enqueue an item, handing it straight to a waiting consumer if there is one. */
+    push(item) {
+        if (this.closed)
+            return;
+        const waiter = this.waiters.shift();
+        if (waiter)
+            waiter({ value: item, done: false });
+        else
+            this.items.push(item);
+    }
+    /** No more items. Consumers drain what is queued, then finish. */
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        // Only waiters that arrived with an empty queue need waking; anything
+        // still buffered is delivered by the loop below first.
+        while (this.waiters.length > 0 && this.items.length === 0) {
+            this.waiters.shift()({ value: undefined, done: true });
+        }
+    }
+    /** Fail the stream. Queued items are dropped — the consumer must see the error. */
+    fail(error) {
+        if (this.closed)
+            return;
+        this.failure = error;
+        this.closed = true;
+        this.items.length = 0;
+        while (this.waiters.length > 0) {
+            this.waiters.shift()({ value: undefined, done: true });
+        }
+    }
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.failure !== undefined) {
+                const error = this.failure;
+                this.failure = undefined;
+                throw error;
+            }
+            if (this.items.length > 0) {
+                yield this.items.shift();
+                continue;
+            }
+            if (this.closed)
+                return;
+            const next = await new Promise((resolve) => {
+                this.waiters.push(resolve);
+            });
+            if (next.done) {
+                if (this.failure !== undefined) {
+                    const error = this.failure;
+                    this.failure = undefined;
+                    throw error;
+                }
+                return;
+            }
+            yield next.value;
+        }
+    }
+}
+/**
+ * Run several async generators concurrently, yielding events in the order they
+ * are produced rather than grouped by producer.
+ */
+export async function* mergeStreams(producers) {
+    if (producers.length === 0)
+        return;
+    if (producers.length === 1) {
+        yield* producers[0]();
+        return;
+    }
+    const queue = new AsyncQueue();
+    let running = producers.length;
+    for (const producer of producers) {
+        void (async () => {
+            try {
+                for await (const item of producer())
+                    queue.push(item);
+            }
+            catch (err) {
+                queue.fail(err);
+                return;
+            }
+            finally {
+                running--;
+                if (running === 0)
+                    queue.close();
+            }
+        })();
+    }
+    yield* queue;
+}
+//# sourceMappingURL=queue.js.map

package/dist/util/queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.js","sourceRoot":"","sources":["../../src/util/queue.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,OAAO,UAAU;IACJ,KAAK,GAAQ,EAAE,CAAC;IAChB,OAAO,GAA+C,EAAE,CAAC;IAClE,MAAM,GAAG,KAAK,CAAC;IACf,OAAO,CAAW;IAE1B,kFAAkF;IAClF,IAAI,CAAC,IAAO;QACV,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,MAAM;YAAE,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;;YAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,kEAAkE;IAClE,KAAK;QACH,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,sEAAsE;QACtE,uDAAuD;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAG,CAAC,EAAE,KAAK,EAAE,SAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,IAAI,CAAC,KAAc;QACjB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAG,CAAC,EAAE,KAAK,EAAE,SAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;QAC3B,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC3B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;gBACzB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAG,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YAExB,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE;gBAC5D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC;oBAC3B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;oBACzB,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,YAAY,CACjC,SAAqD;IAErD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACnC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,UAAU,EAAK,CAAC;IAClC,IAAI,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC;IAE/B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,QAAQ,EAAE;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;oBAAS,CAAC;gBACT,OAAO,EAAE,CAAC;gBACV,IAAI,OAAO,KAAK,CAAC;oBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACnC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,KAAK,CAAC,CAAC,KAAK,CAAC;AACf,CAAC"}

package/dist/util/schema.d.ts

@@ -0,0 +1,17 @@
+import { z } from "zod";
+import type { JSONSchema } from "../core/types.ts";
+/** Convert a zod schema to a JSON Schema object suitable for tool definitions. */
+export declare function zodToJsonSchema(schema: z.ZodType): JSONSchema;
+/**
+ * Every provider expects a top-level object schema for tool inputs, and every
+ * provider chokes on `$schema`/`$id` at the top level of a function parameter.
+ */
+export declare function normalizeObjectSchema(schema: JSONSchema): JSONSchema;
+export declare function sanitizeForGemini(schema: JSONSchema): JSONSchema;
+/**
+ * OpenAI strict function calling requires `additionalProperties: false` and
+ * every property listed in `required`. We only apply it when asked, because it
+ * also forbids optional fields.
+ */
+export declare function toStrictOpenAiSchema(schema: JSONSchema): JSONSchema;
+export type { z };