@oscharko-dev/keiko 0.1.5 → 0.1.7

package/dist/ui/chat-handlers.js

@@ -1,295 +0,0 @@
-// Desktop chat BFF routes for the Keiko canvas UI. These routes intentionally keep the model call
-// behind the existing ModelPort/Gateway boundary: the browser sends only chat content and a registry
-// model id, while provider endpoints and keys remain resolved from the local gateway config/.env.
-import { basename } from "node:path";
-import { GatewayError, findCapability, findConfiguredCapability, listConfiguredCapabilities, } from "../gateway/index.js";
-import { UiStoreError, isProjectAvailable, } from "./store/index.js";
-import { validateProjectPath } from "./store/validation.js";
-import { currentGatewayConfig } from "./deps.js";
-import { errorBody } from "./routes.js";
-const DEFAULT_CHAT_MODEL = "example-chat-model";
-const DEFAULT_CHAT_TITLE = "New chat";
-const MAX_BODY_BYTES = 128_000;
-const MAX_CHAT_INPUT_CHARS = 16_000;
-const MAX_CONTEXT_MESSAGES = 24;
-class BodyTooLargeError extends Error {
-    constructor() {
-        super("request body too large");
-        this.name = "BodyTooLargeError";
-    }
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function readBody(req) {
-    return new Promise((resolveBody, reject) => {
-        const chunks = [];
-        let total = 0;
-        let capped = false;
-        req.on("data", (chunk) => {
-            total += chunk.length;
-            if (total > MAX_BODY_BYTES) {
-                if (!capped) {
-                    capped = true;
-                    chunks.length = 0;
-                    reject(new BodyTooLargeError());
-                    req.resume();
-                }
-                return;
-            }
-            chunks.push(chunk);
-        });
-        req.on("end", () => {
-            if (!capped) {
-                resolveBody(Buffer.concat(chunks).toString("utf8"));
-            }
-        });
-        req.on("error", reject);
-    });
-}
-async function readJsonObject(req) {
-    let raw;
-    try {
-        raw = await readBody(req);
-    }
-    catch (error) {
-        if (error instanceof BodyTooLargeError) {
-            return {
-                status: 413,
-                body: errorBody("PAYLOAD_TOO_LARGE", "Request body exceeds the size limit."),
-            };
-        }
-        throw error;
-    }
-    let parsed;
-    try {
-        parsed = raw.length === 0 ? {} : JSON.parse(raw);
-    }
-    catch {
-        return { status: 400, body: errorBody("BAD_REQUEST", "Request body is not valid JSON.") };
-    }
-    if (!isRecord(parsed)) {
-        return { status: 400, body: errorBody("BAD_REQUEST", "Request body must be a JSON object.") };
-    }
-    return parsed;
-}
-function isRouteResult(value) {
-    return isRecord(value) && typeof value.status === "number" && "body" in value;
-}
-function chatCapability(deps, modelId) {
-    const config = currentGatewayConfig(deps);
-    return config === undefined ? findCapability(modelId) : findConfiguredCapability(config, modelId);
-}
-function defaultChatModelId(deps) {
-    const config = currentGatewayConfig(deps);
-    if (config === undefined) {
-        return DEFAULT_CHAT_MODEL;
-    }
-    const configured = listConfiguredCapabilities(config);
-    return (configured.find((model) => model.id === DEFAULT_CHAT_MODEL && model.kind === "chat") ??
-        configured.find((model) => model.kind === "chat"))?.id ?? DEFAULT_CHAT_MODEL;
-}
-function modelFromBody(body, deps) {
-    const modelId = typeof body.modelId === "string" && body.modelId.length > 0
-        ? body.modelId
-        : defaultChatModelId(deps);
-    const capability = chatCapability(deps, modelId);
-    if (capability?.kind !== "chat") {
-        return { status: 400, body: errorBody("BAD_REQUEST", "modelId must be a configured chat model id.") };
-    }
-    return modelId;
-}
-function pickProjectPath(body, deps) {
-    const supplied = typeof body.projectPath === "string" && body.projectPath.length > 0
-        ? body.projectPath
-        : undefined;
-    if (supplied !== undefined) {
-        return validateProjectPath(supplied, { mustExist: true });
-    }
-    const available = deps.store
-        .listProjects()
-        .find((project) => isProjectAvailable(project));
-    if (available !== undefined) {
-        return available.path;
-    }
-    return validateProjectPath(process.cwd(), { mustExist: true });
-}
-function ensureProject(deps, path) {
-    const existing = deps.store.listProjects().find((project) => project.path === path);
-    if (existing !== undefined) {
-        deps.store.updateProject(path, {});
-        return existing;
-    }
-    const name = basename(path) || "Local workspace";
-    return deps.store.createProject(path, name);
-}
-function findChat(deps, projectPath, chatId) {
-    return deps.store.listChats(projectPath).find((chat) => chat.id === chatId);
-}
-function chatEnvelope(deps, project, chat) {
-    const projects = deps.store.listProjects().map((item) => ({
-        ...item,
-        available: isProjectAvailable(item),
-    }));
-    const chats = deps.store.listChats(project.path);
-    const messages = deps.store.listMessages(chat.id);
-    return {
-        project: { ...project, available: isProjectAvailable(project) },
-        chat,
-        messages,
-        projects,
-        chats,
-    };
-}
-function gatewayErrorResult(error) {
-    const status = error.code === "GATEWAY_AUTHENTICATION" ? 401 : error.retryable ? 503 : 502;
-    return { status, body: errorBody(error.code, error.message) };
-}
-function desktopChatErrorResult(error) {
-    if (error instanceof GatewayError) {
-        return gatewayErrorResult(error);
-    }
-    if (error instanceof UiStoreError) {
-        return { status: error.status, body: errorBody(error.code, error.message) };
-    }
-    throw error;
-}
-function messageForGateway(message) {
-    if (message.role !== "user" && message.role !== "assistant") {
-        return null;
-    }
-    return { role: message.role, content: message.content };
-}
-function conversationForGateway(messages) {
-    const usable = messages
-        .map(messageForGateway)
-        .filter((message) => message !== null)
-        .slice(-MAX_CONTEXT_MESSAGES);
-    return [
-        {
-            role: "system",
-            content: "You are Keiko, an enterprise developer-assist AI. Be concise, practical, and explicit about uncertainty. Do not claim tool access you do not have in this chat.",
-        },
-        ...usable,
-    ];
-}
-function sendRequestFromBody(body) {
-    const chatId = typeof body.chatId === "string" ? body.chatId : "";
-    const projectPath = typeof body.projectPath === "string" ? body.projectPath : "";
-    const content = typeof body.content === "string" ? body.content.trim() : "";
-    if (chatId.length === 0 || projectPath.length === 0) {
-        return { status: 400, body: errorBody("BAD_REQUEST", "chatId and projectPath are required.") };
-    }
-    if (content.length === 0 || content.length > MAX_CHAT_INPUT_CHARS) {
-        return { status: 400, body: errorBody("BAD_REQUEST", "content must be between 1 and 16000 characters.") };
-    }
-    return {
-        chatId,
-        projectPath,
-        content,
-        modelId: typeof body.modelId === "string" && body.modelId.length > 0 ? body.modelId : undefined,
-    };
-}
-function invalidChatModelResult(modelId, deps) {
-    const capability = chatCapability(deps, modelId);
-    if (capability?.kind === "chat") {
-        return undefined;
-    }
-    return { status: 400, body: errorBody("BAD_REQUEST", "modelId must be a configured chat model id.") };
-}
-function createUserMessage(deps, request) {
-    return deps.store.createMessage({
-        chatId: request.chatId,
-        role: "user",
-        content: request.content,
-        timestamp: Date.now(),
-        runId: undefined,
-        workflowId: undefined,
-        workflowStatus: undefined,
-        shortResult: undefined,
-        taskType: undefined,
-    });
-}
-function createAssistantMessage(deps, request, content) {
-    return deps.store.createMessage({
-        chatId: request.chatId,
-        role: "assistant",
-        content: content.length > 0 ? content : "The model returned an empty response.",
-        timestamp: Date.now(),
-        runId: undefined,
-        workflowId: undefined,
-        workflowStatus: undefined,
-        shortResult: undefined,
-        taskType: undefined,
-    });
-}
-async function persistModelChatTurn(deps, request, chat, modelId) {
-    const model = deps.modelPortFactory(modelId);
-    if (model === undefined) {
-        return { status: 400, body: errorBody("NO_MODEL", "No model provider is configured.") };
-    }
-    try {
-        const userMessage = createUserMessage(deps, request);
-        const response = await model.call({
-            modelId,
-            messages: conversationForGateway(deps.store.listMessages(request.chatId)),
-            stream: false,
-        }, new AbortController().signal);
-        const assistantMessage = createAssistantMessage(deps, request, response.content);
-        const chatPatch = chat.title === DEFAULT_CHAT_TITLE
-            ? { selectedModel: modelId, title: request.content.slice(0, 60) }
-            : { selectedModel: modelId };
-        return {
-            status: 200,
-            body: {
-                chat: deps.store.updateChat(request.chatId, chatPatch),
-                messages: [userMessage, assistantMessage],
-                usage: response.usage,
-            },
-        };
-    }
-    catch (error) {
-        return desktopChatErrorResult(error);
-    }
-}
-export async function handleCreateDesktopChat(ctx, deps) {
-    const body = await readJsonObject(ctx.req);
-    if (isRouteResult(body))
-        return body;
-    const modelId = modelFromBody(body, deps);
-    if (isRouteResult(modelId))
-        return modelId;
-    try {
-        const projectPath = pickProjectPath(body, deps);
-        const project = ensureProject(deps, projectPath);
-        const title = typeof body.title === "string" && body.title.trim().length > 0
-            ? body.title.trim()
-            : DEFAULT_CHAT_TITLE;
-        const chat = deps.store.createChat(project.path, title, modelId);
-        return { status: 201, body: chatEnvelope(deps, project, chat) };
-    }
-    catch (error) {
-        if (error instanceof UiStoreError) {
-            return { status: error.status, body: errorBody(error.code, error.message) };
-        }
-        throw error;
-    }
-}
-export async function handleSendDesktopChat(ctx, deps) {
-    const body = await readJsonObject(ctx.req);
-    if (isRouteResult(body))
-        return body;
-    const request = sendRequestFromBody(body);
-    if (isRouteResult(request))
-        return request;
-    const normalizedProjectPath = validateProjectPath(request.projectPath, { mustExist: false });
-    const chat = findChat(deps, normalizedProjectPath, request.chatId);
-    if (chat === undefined) {
-        return { status: 404, body: errorBody("NOT_FOUND", "Chat not found.") };
-    }
-    const modelId = request.modelId ?? chat.selectedModel;
-    const invalidModel = invalidChatModelResult(modelId, deps);
-    if (invalidModel !== undefined)
-        return invalidModel;
-    return persistModelChatTurn(deps, request, chat, modelId);
-}

package/dist/ui/csp.d.ts

@@ -1,2 +0,0 @@
-export declare function extractInlineScriptHashes(htmlDocuments: readonly string[]): readonly string[];
-export declare function buildCspHeader(scriptHashes: readonly string[]): string;

package/dist/ui/csp.js

@@ -1,66 +0,0 @@
-// Hash-based Content-Security-Policy support (ADR-0011 D5, risk #1). The Next static export emits
-// inline RSC-bootstrap `<script>` blocks (`self.__next_f.push(...)`). The BFF serves
-// `script-src 'self'` with NO `'unsafe-inline'`, so each distinct inline script must be allowed by
-// its SHA-256 hash. `extractInlineScriptHashes` computes those hashes from exported HTML at build
-// time; `buildCspHeader` folds them into the policy the BFF sets on every response.
-import { createHash } from "node:crypto";
-// `/\bsrc\s*=/i` matches an attribute key only — no `<`/`>` involved, so it does not trigger
-// CodeQL js/bad-tag-filter (which fires on regexes that structurally match HTML tags).
-const SRC_ATTRIBUTE_PATTERN = /\bsrc\s*=/i;
-function sha256Base64(body) {
-    return createHash("sha256").update(body, "utf8").digest("base64");
-}
-// Finds the next inline-script body starting at cursor `i`, using a case-insensitive indexOf scan
-// rather than a tag-matching regex (eliminates the CodeQL js/bad-tag-filter class entirely). Body
-// is sliced from original-case `html` so the SHA-256 matches what the browser executes.
-function nextInlineScript(html, lower, i) {
-    const open = lower.indexOf("<script", i);
-    if (open === -1)
-        return null;
-    const openEnd = lower.indexOf(">", open);
-    if (openEnd === -1)
-        return null;
-    const close = lower.indexOf("</script", openEnd + 1);
-    if (close === -1)
-        return null;
-    const closeEnd = lower.indexOf(">", close);
-    const next = closeEnd === -1 ? close + 8 : closeEnd + 1;
-    return { openTag: html.slice(open, openEnd + 1), body: html.slice(openEnd + 1, close), next };
-}
-// Returns the distinct `'sha256-...'` CSP source tokens for every inline script across the given
-// HTML documents, in stable sorted order so the generated policy is deterministic.
-export function extractInlineScriptHashes(htmlDocuments) {
-    const tokens = new Set();
-    for (const html of htmlDocuments) {
-        const lower = html.toLowerCase();
-        let i = 0;
-        for (;;) {
-            const found = nextInlineScript(html, lower, i);
-            if (found === null)
-                break;
-            const { openTag, body, next } = found;
-            if (!SRC_ATTRIBUTE_PATTERN.test(openTag) && body.length > 0) {
-                tokens.add(`'sha256-${sha256Base64(body)}'`);
-            }
-            i = next;
-        }
-    }
-    return [...tokens].sort();
-}
-// Builds the full CSP header value. `scriptHashes` are folded into `script-src` alongside `'self'`.
-// `style-src` keeps `'unsafe-inline'` for Tailwind's injected styles (the only permitted inline
-// source); `script-src` never receives `'unsafe-inline'` or `'unsafe-eval'`.
-export function buildCspHeader(scriptHashes) {
-    const scriptSrc = ["'self'", ...scriptHashes].join(" ");
-    return [
-        "default-src 'none'",
-        `script-src ${scriptSrc}`,
-        "style-src 'self' 'unsafe-inline'",
-        "img-src 'self' data:",
-        "connect-src 'self'",
-        "font-src 'self'",
-        "base-uri 'none'",
-        "form-action 'none'",
-        "frame-ancestors 'none'",
-    ].join("; ");
-}

package/dist/ui/deps.d.ts

@@ -1,48 +0,0 @@
-import { type EnvSource, type GatewayConfig } from "../gateway/index.js";
-import type { ModelPort } from "../harness/index.js";
-import type { EvidenceStore } from "../audit/index.js";
-import type { RunRegistry } from "./runs.js";
-import { type UiStore } from "./store/index.js";
-import { type TerminalExecutionManager } from "./terminal.js";
-import { type BrowserSessionManager } from "../tools/browser/index.js";
-export type Redactor = (value: unknown) => unknown;
-export type ModelPortFactory = (modelId: string) => ModelPort | undefined;
-export interface RuntimeGatewayConfig {
-    readonly storagePath: string;
-    current(): GatewayConfig | undefined;
-    present(): boolean;
-    set(config: GatewayConfig | undefined, present: boolean): void;
-}
-export interface UiHandlerDeps {
-    readonly config: GatewayConfig | undefined;
-    readonly configPresent: boolean;
-    readonly evidenceStore: EvidenceStore;
-    readonly env: EnvSource;
-    readonly redactor: Redactor;
-    readonly registry: RunRegistry;
-    readonly modelPortFactory: ModelPortFactory;
-    readonly redactionSecrets?: readonly string[] | undefined;
-    readonly store: UiStore;
-    readonly uiDbPath?: string | undefined;
-    readonly terminal?: TerminalExecutionManager | undefined;
-    readonly browser?: BrowserSessionManager | undefined;
-    readonly gatewayConfig?: RuntimeGatewayConfig | undefined;
-    readonly gatewaySetupTester?: ((config: GatewayConfig, candidateModelIds: readonly string[]) => Promise<readonly string[]>) | undefined;
-    readonly gatewayModelDiscovery?: ((baseUrl: string, apiKey: string, apiKeyHeaderName?: string) => Promise<readonly string[]>) | undefined;
-}
-export interface BuildHandlerDepsOptions {
-    readonly configPath: string | undefined;
-    readonly evidenceDir: string | undefined;
-    readonly env: EnvSource;
-    readonly registry?: RunRegistry | undefined;
-    readonly modelPortFactory?: ModelPortFactory | undefined;
-    readonly uiDbPath?: string | undefined;
-    readonly store?: UiStore | undefined;
-    readonly gatewaySetupTester?: ((config: GatewayConfig, candidateModelIds: readonly string[]) => Promise<readonly string[]>) | undefined;
-    readonly gatewayModelDiscovery?: ((baseUrl: string, apiKey: string, apiKeyHeaderName?: string) => Promise<readonly string[]>) | undefined;
-}
-export declare function currentGatewayConfig(deps: UiHandlerDeps): GatewayConfig | undefined;
-export declare function currentGatewayConfigPresent(deps: UiHandlerDeps): boolean;
-export declare function buildRedactor(env: EnvSource, config?: GatewayConfig): Redactor;
-export declare function currentRedactionSecrets(deps: UiHandlerDeps): readonly string[];
-export declare function buildUiHandlerDeps(options: BuildHandlerDepsOptions): UiHandlerDeps;

package/dist/ui/deps.js

@@ -1,209 +0,0 @@
-// Wave 2 BFF handler dependencies (ADR-0011 D5/D8/D9). The Wave 1 skeleton's `UiServerDeps` carried
-// only the static-serving + CSP + port fields; the JSON/SSE handlers additionally need the resolved
-// gateway config (for the config inspector and for building a ModelPort), an evidence store, a live
-// redactor, the process env, and the in-memory run registry. Every field here is OPTIONAL so the
-// 3-arg `createUiServer({ staticRoot, csp, port })` form still compiles and the Wave 1 server tests
-// pass unchanged; the handlers degrade gracefully (no config → 400 NO_MODEL on a run, null config on
-// the inspector; no store → an empty evidence list).
-import { createDefaultChatCapability, loadConfigFromFile, parseGatewayConfig, } from "../gateway/index.js";
-import { GatewayError, Gateway } from "../gateway/index.js";
-import { GatewayModelPort } from "../harness/index.js";
-import { createAuditRedactor } from "../audit/index.js";
-import { deepRedactStrings } from "../audit/redaction.js";
-import { createNodeEvidenceStore, resolveEvidenceDir } from "../audit/store.js";
-import { dirname, join } from "node:path";
-import { createRunRegistry } from "./runs.js";
-import { createNodeUiStore, resolveUiDbPath, } from "./store/index.js";
-import { createTerminalExecutionManager, } from "./terminal.js";
-import { createBrowserSessionManager, } from "../tools/browser/index.js";
-function envModelToken(modelId) {
-    return modelId.replace(/[^A-Za-z0-9]/g, "_").toUpperCase();
-}
-function envModelIdFromApiKeyName(name) {
-    const prefix = "KEIKO_MODEL_";
-    const suffix = "_API_KEY";
-    if (!name.startsWith(prefix) || !name.endsWith(suffix)) {
-        return undefined;
-    }
-    const token = name.slice(prefix.length, -suffix.length);
-    return token.length === 0 ? undefined : token.toLowerCase().replace(/_/g, "-");
-}
-function hasEnvProvider(modelId, env) {
-    const token = envModelToken(modelId);
-    const baseUrl = env[`KEIKO_MODEL_${token}_BASE_URL`];
-    const apiKey = env[`KEIKO_MODEL_${token}_API_KEY`];
-    return baseUrl !== undefined && baseUrl.length > 0 && apiKey !== undefined && apiKey.length > 0;
-}
-function envModelIds(env) {
-    const modelIds = [];
-    for (const key of Object.keys(env)) {
-        const modelId = envModelIdFromApiKeyName(key);
-        if (modelId !== undefined && hasEnvProvider(modelId, env)) {
-            modelIds.push(modelId);
-        }
-    }
-    return Array.from(new Set(modelIds));
-}
-function resolveEnvOnlyConfig(env) {
-    const providers = envModelIds(env).map((modelId) => ({
-        modelId,
-        baseUrl: "",
-        apiKey: "",
-        capability: createDefaultChatCapability(modelId),
-    }));
-    if (providers.length === 0) {
-        return undefined;
-    }
-    try {
-        return parseGatewayConfig({ providers }, env);
-    }
-    catch (error) {
-        if (error instanceof GatewayError) {
-            return undefined;
-        }
-        throw error;
-    }
-}
-function localGatewayConfigPath(uiDbPath) {
-    return join(dirname(uiDbPath), "keiko.config.json");
-}
-// Loads the config without leaking the path or any secret on failure: a missing/invalid config file
-// falls back to KEIKO_MODEL_* env wiring when present, otherwise it is a normal "no config" state.
-function resolveConfig(configPath, env, localConfigPath) {
-    if (configPath === undefined) {
-        let config;
-        try {
-            config = loadConfigFromFile(localConfigPath, env);
-        }
-        catch (error) {
-            if (error instanceof GatewayError) {
-                config = resolveEnvOnlyConfig(env);
-            }
-            else {
-                throw error;
-            }
-        }
-        return { config, configPresent: config !== undefined };
-    }
-    try {
-        return { config: loadConfigFromFile(configPath, env), configPresent: true };
-    }
-    catch (error) {
-        if (error instanceof GatewayError) {
-            const config = resolveEnvOnlyConfig(env);
-            return { config, configPresent: config !== undefined };
-        }
-        throw error;
-    }
-}
-function createRuntimeGatewayConfig(initial, initialPresent, storagePath) {
-    let config = initial;
-    let present = initialPresent;
-    return {
-        storagePath,
-        current: () => config,
-        present: () => present,
-        set(next, nextPresent) {
-            config = next;
-            present = nextPresent;
-        },
-    };
-}
-export function currentGatewayConfig(deps) {
-    return deps.gatewayConfig?.current() ?? deps.config;
-}
-export function currentGatewayConfigPresent(deps) {
-    return deps.gatewayConfig?.present() ?? deps.configPresent;
-}
-function isKeikoApiKeyEnvName(name) {
-    return (name === "KEIKO_DEFAULT_API_KEY" ||
-        (name.startsWith("KEIKO_MODEL_") && name.endsWith("_API_KEY")));
-}
-function envSecretValues(env) {
-    const values = [];
-    for (const [key, value] of Object.entries(env)) {
-        if (value !== undefined && isKeikoApiKeyEnvName(key)) {
-            values.push(value);
-        }
-    }
-    return values;
-}
-function configSecretValues(config) {
-    return config?.providers.map((provider) => provider.apiKey) ?? [];
-}
-function redactionSecrets(env, config) {
-    return [...envSecretValues(env), ...configSecretValues(config)];
-}
-// Builds the live-payload redactor from the configured redaction settings + env. No new regex: this
-// reuses `createAuditRedactor` (escaped literals + audited gateway patterns) wrapped by
-// `deepRedactStrings` so every string leaf of a serialized payload is scrubbed.
-export function buildRedactor(env, config) {
-    const redactString = createAuditRedactor({ additionalSecrets: redactionSecrets(env, config) }, env);
-    return (value) => deepRedactStrings(value, redactString);
-}
-export function currentRedactionSecrets(deps) {
-    return redactionSecrets(deps.env, currentGatewayConfig(deps));
-}
-// The production ModelPort factory: a GatewayModelPort over a Gateway built from the resolved
-// config (mirrors the CLI's `new GatewayModelPort(new Gateway(config))`). Returns undefined when no
-// config was resolved so the run route answers 400 NO_MODEL rather than constructing a broken port.
-function defaultModelPortFactory(runtimeConfig) {
-    return () => {
-        const config = runtimeConfig.current();
-        if (config === undefined) {
-            return undefined;
-        }
-        return new GatewayModelPort(new Gateway(config));
-    };
-}
-function buildTerminalManager(options) {
-    return createTerminalExecutionManager({
-        store: options.store,
-        evidenceStore: options.evidenceStore,
-        processEnv: options.env,
-        redactor: (value) => {
-            const redacted = options.liveRedactor(value);
-            return typeof redacted === "string" ? redacted : value;
-        },
-    });
-}
-// Assembles the handler deps for the real `keiko ui` process, mirroring the CLI config/evidence
-// wiring (loadConfigFromFile / resolveEvidenceDir / createNodeEvidenceStore). The UI store is
-// created at the resolved UI-DB path (explicit → KEIKO_UI_DATA_DIR → ~/.keiko/keiko-ui.db) unless
-// an injected store is supplied (tests).
-export function buildUiHandlerDeps(options) {
-    const resolvedUiDbPath = resolveUiDbPath(options.uiDbPath, options.env);
-    const runtimeConfigPath = localGatewayConfigPath(resolvedUiDbPath);
-    const { config, configPresent } = resolveConfig(options.configPath, options.env, runtimeConfigPath);
-    const runtimeConfig = createRuntimeGatewayConfig(config, configPresent, runtimeConfigPath);
-    const evidenceStore = createNodeEvidenceStore(resolveEvidenceDir(options.evidenceDir, options.env));
-    const redactString = (value) => createAuditRedactor({ additionalSecrets: redactionSecrets(options.env, runtimeConfig.current()) }, options.env)(value);
-    const liveRedactor = (value) => deepRedactStrings(value, redactString);
-    const uiStore = options.store ?? createNodeUiStore(resolvedUiDbPath, { redactString });
-    return {
-        config,
-        configPresent,
-        evidenceStore,
-        env: options.env,
-        redactor: liveRedactor,
-        registry: options.registry ?? createRunRegistry(),
-        modelPortFactory: options.modelPortFactory ?? defaultModelPortFactory(runtimeConfig),
-        redactionSecrets: redactionSecrets(options.env, runtimeConfig.current()),
-        store: uiStore,
-        uiDbPath: resolvedUiDbPath,
-        gatewayConfig: runtimeConfig,
-        gatewaySetupTester: options.gatewaySetupTester,
-        gatewayModelDiscovery: options.gatewayModelDiscovery,
-        terminal: buildTerminalManager({
-            store: uiStore,
-            evidenceStore,
-            env: options.env,
-            liveRedactor,
-        }),
-        browser: createBrowserSessionManager({
-            evidenceDir: resolveEvidenceDir(options.evidenceDir, options.env),
-            evidenceStore,
-            redactor: liveRedactor,
-        }),
-    };
-}

package/dist/ui/evidence.d.ts

@@ -1,27 +0,0 @@
-import { type EvidenceReport } from "../audit/index.js";
-import { type RunResult } from "../harness/index.js";
-import type { EnvSource } from "../gateway/index.js";
-import type { EvidenceStore } from "../audit/index.js";
-import type { StreamEvent } from "./sink.js";
-import type { RunKind } from "./run-request.js";
-import type { RunStatus } from "./runs.js";
-type TerminalStatus = Exclude<RunStatus, "running">;
-export interface EvidencePersistContext {
-    readonly store: EvidenceStore;
-    readonly env: EnvSource;
-    readonly additionalSecrets?: readonly string[] | undefined;
-}
-export interface RunIdentity {
-    readonly runId: string;
-    readonly fingerprint: string;
-    readonly modelId: string;
-    readonly kind: RunKind;
-    readonly status: TerminalStatus;
-    readonly startedAt: number;
-    readonly finishedAt: number;
-    readonly workspaceRoot?: string | undefined;
-}
-export declare function persistWorkflowEvidence(identity: RunIdentity, report: unknown, events: readonly StreamEvent[], ctx: EvidencePersistContext): EvidenceReport;
-export declare function persistExplainEvidence(identity: RunIdentity, result: RunResult, ctx: EvidencePersistContext): EvidenceReport;
-export declare function persistVerifyEvidence(identity: RunIdentity, ctx: EvidencePersistContext): EvidenceReport;
-export {};