@oscharko-dev/keiko 0.1.6 → 0.1.7

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/gateway-setup.js

@@ -0,0 +1,501 @@
+// First-run gateway setup for non-technical UI users. The browser provides only a base URL and API
+// token; the loopback BFF builds the local provider config, performs a real chat-completions smoke
+// call, stores the resulting config on disk with private permissions, and updates the in-memory
+// runtime config without exposing credentials back to the browser.
+import { chmodSync, existsSync, lstatSync, mkdirSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+import { apiKeyHeaderValue, ConfigInvalidError, DEFAULT_API_KEY_HEADER_NAME, Gateway, createDefaultChatCapability, listConfiguredCapabilities, normalizeApiKeyHeaderName, parseGatewayConfig, toSafeObject, validateBaseUrl, } from "@oscharko-dev/keiko-model-gateway";
+import { gatewayFetch, readJsonCapped } from "@oscharko-dev/keiko-model-gateway/internal/http";
+import { redact } from "@oscharko-dev/keiko-security";
+import { errorBody } from "./routes.js";
+const MAX_BODY_BYTES = 64_000;
+const MAX_DISCOVERED_MODELS = 100;
+const MAX_DEPLOYMENT_NAMES = 100;
+const MAX_MODEL_ID_LENGTH = 160;
+const DISCOVERED_MODEL_SMOKE_TIMEOUT_MS = 15_000;
+const DEPLOYMENT_SMOKE_TIMEOUT_MS = 30_000;
+const SETUP_SMOKE_CONCURRENCY = 4;
+const CHAT_COMPATIBLE_MODES = new Set(["chat", "completion", "responses"]);
+class BodyTooLargeError extends Error {
+    constructor() {
+        super("request body too large");
+        this.name = "BodyTooLargeError";
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let total = 0;
+        let capped = false;
+        req.on("data", (chunk) => {
+            total += chunk.length;
+            if (total > MAX_BODY_BYTES) {
+                if (!capped) {
+                    capped = true;
+                    chunks.length = 0;
+                    reject(new BodyTooLargeError());
+                    req.resume();
+                }
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => {
+            if (!capped) {
+                resolve(Buffer.concat(chunks).toString("utf8"));
+            }
+        });
+        req.on("error", reject);
+    });
+}
+function normalizeBaseUrl(raw) {
+    let value = raw.trim().replace(/\/+$/u, "");
+    if (value.endsWith("/chat/completions")) {
+        value = value.slice(0, -"/chat/completions".length).replace(/\/+$/u, "");
+    }
+    return value;
+}
+function candidateBaseUrls(baseUrl) {
+    const primary = normalizeBaseUrl(baseUrl);
+    const candidates = [primary];
+    try {
+        const url = new URL(primary);
+        if (url.hostname.endsWith(".services.ai.azure.com")) {
+            if (url.pathname === "" || url.pathname === "/") {
+                candidates.push(`${url.origin}/openai/v1`);
+            }
+            else if (primary.endsWith("/openai")) {
+                candidates.push(`${primary}/v1`);
+            }
+        }
+        else if (!primary.endsWith("/v1")) {
+            candidates.push(`${primary}/v1`);
+        }
+    }
+    catch {
+        if (!primary.endsWith("/v1")) {
+            candidates.push(`${primary}/v1`);
+        }
+    }
+    return Array.from(new Set(candidates));
+}
+function isAzureFoundryBaseUrl(baseUrl) {
+    try {
+        const url = new URL(baseUrl);
+        return url.hostname.endsWith(".services.ai.azure.com");
+    }
+    catch {
+        return false;
+    }
+}
+function providerRaw(modelId, baseUrl, apiKey, options = {}) {
+    return {
+        modelId,
+        baseUrl,
+        apiKey,
+        apiKeyHeaderName: options.apiKeyHeaderName ?? DEFAULT_API_KEY_HEADER_NAME,
+        capability: createDefaultChatCapability(modelId),
+        timeoutMs: options.timeoutMs ?? 30_000,
+        maxRetries: options.maxRetries ?? 2,
+        retryBaseDelayMs: 500,
+    };
+}
+function buildRawConfig(baseUrl, apiKey, modelIds, options = {}) {
+    return {
+        providers: modelIds.map((modelId) => providerRaw(modelId, baseUrl, apiKey, options)),
+        circuitBreaker: { failureThreshold: 5, cooldownMs: 30_000, halfOpenProbes: 2 },
+    };
+}
+function modelsEndpoint(baseUrl) {
+    return `${baseUrl}/models`;
+}
+function modelInfoEndpointCandidates(baseUrl) {
+    const normalized = normalizeBaseUrl(baseUrl);
+    return [`${normalized}/model/info`];
+}
+function apiKeyHeaders(apiKey, apiKeyHeaderName) {
+    return { [apiKeyHeaderName]: apiKeyHeaderValue(apiKeyHeaderName, apiKey) };
+}
+function hasDisallowedModelIdCharacter(id) {
+    for (let index = 0; index < id.length; index += 1) {
+        const code = id.charCodeAt(index);
+        if (code <= 31 || code === 127) {
+            return true;
+        }
+    }
+    return false;
+}
+function isUsableModelId(id) {
+    return id.length > 0 && id.length <= MAX_MODEL_ID_LENGTH && !hasDisallowedModelIdCharacter(id);
+}
+function modelIdFromKnownFields(item) {
+    for (const field of ["id", "model_name", "model", "deployment_name", "deploymentName"]) {
+        const value = item[field];
+        if (typeof value === "string") {
+            const id = value.trim();
+            if (isUsableModelId(id)) {
+                return id;
+            }
+        }
+    }
+    return undefined;
+}
+function nestedRecord(value, key) {
+    const nested = value[key];
+    return isRecord(nested) ? nested : undefined;
+}
+function modelModeFromDiscoveryItem(item) {
+    const modelInfo = nestedRecord(item, "model_info");
+    const litellmParams = nestedRecord(item, "litellm_params");
+    const candidates = [item.mode, modelInfo?.mode, litellmParams?.mode];
+    for (const candidate of candidates) {
+        if (typeof candidate === "string" && candidate.trim().length > 0) {
+            return candidate.trim().toLowerCase();
+        }
+    }
+    return undefined;
+}
+function isExplicitlyNonChatModel(item) {
+    const capabilities = isRecord(item.capabilities) ? item.capabilities : undefined;
+    if (capabilities?.chat_completion === false) {
+        return true;
+    }
+    const mode = modelModeFromDiscoveryItem(item);
+    return mode !== undefined && !CHAT_COMPATIBLE_MODES.has(mode);
+}
+function modelIdFromDiscoveryItem(item) {
+    if (!isRecord(item) || isExplicitlyNonChatModel(item)) {
+        return undefined;
+    }
+    return modelIdFromKnownFields(item);
+}
+function parseModelList(payload) {
+    if (!isRecord(payload) || !Array.isArray(payload.data)) {
+        throw new Error("model discovery response must contain a data array");
+    }
+    const ids = [];
+    for (const item of payload.data) {
+        const id = modelIdFromDiscoveryItem(item);
+        if (id !== undefined) {
+            ids.push(id);
+        }
+    }
+    const unique = Array.from(new Set(ids));
+    if (unique.length === 0) {
+        throw new Error("model discovery returned no model ids");
+    }
+    return unique.slice(0, MAX_DISCOVERED_MODELS);
+}
+async function fetchDiscoveryJson(url, apiKey, apiKeyHeaderName) {
+    const response = await gatewayFetch(url, {
+        method: "GET",
+        headers: apiKeyHeaders(apiKey, apiKeyHeaderName),
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!response.ok) {
+        throw new Error(`model discovery returned HTTP ${String(response.status)}`);
+    }
+    try {
+        return await readJsonCapped(response);
+    }
+    catch {
+        throw new Error("model discovery response was not readable JSON");
+    }
+}
+async function discoverLiteLlmModelInfo(baseUrl, apiKey, apiKeyHeaderName) {
+    for (const endpoint of modelInfoEndpointCandidates(baseUrl)) {
+        try {
+            return parseModelList(await fetchDiscoveryJson(endpoint, apiKey, apiKeyHeaderName));
+        }
+        catch {
+            // /model/info is a LiteLLM-specific enrichment endpoint. If it is absent or blocked,
+            // continue with OpenAI-compatible /models discovery so customer gateways are not broken.
+        }
+    }
+    return undefined;
+}
+async function defaultGatewayModelDiscovery(baseUrl, apiKey, apiKeyHeaderName = DEFAULT_API_KEY_HEADER_NAME) {
+    const litellmModels = await discoverLiteLlmModelInfo(baseUrl, apiKey, apiKeyHeaderName);
+    if (litellmModels !== undefined) {
+        return litellmModels;
+    }
+    return parseModelList(await fetchDiscoveryJson(modelsEndpoint(baseUrl), apiKey, apiKeyHeaderName));
+}
+function deploymentNameValues(value) {
+    if (typeof value === "string") {
+        return value.split(/[\n,]/u);
+    }
+    if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+        return value;
+    }
+    return undefined;
+}
+function normalizeDeploymentNames(values) {
+    return Array.from(new Set(values.map((item) => item.trim()).filter((item) => item.length > 0)));
+}
+function parseDeploymentNames(value) {
+    if (value === undefined) {
+        return [];
+    }
+    const values = deploymentNameValues(value);
+    if (values === undefined) {
+        return {
+            status: 400,
+            body: errorBody("BAD_REQUEST", "deploymentNames must be a string or an array of strings."),
+        };
+    }
+    const names = normalizeDeploymentNames(values);
+    if (names.length > MAX_DEPLOYMENT_NAMES) {
+        return {
+            status: 400,
+            body: errorBody("BAD_REQUEST", "deploymentNames exceeds the model setup limit."),
+        };
+    }
+    if (names.some((name) => !isUsableModelId(name))) {
+        return {
+            status: 400,
+            body: errorBody("BAD_REQUEST", "deploymentNames contains an invalid model id."),
+        };
+    }
+    return names;
+}
+function validateSetupConnection(baseUrl, apiKey, apiKeyHeaderName) {
+    try {
+        parseGatewayConfig(buildRawConfig(baseUrl, apiKey, ["setup-validation"], { apiKeyHeaderName }));
+        return undefined;
+    }
+    catch (error) {
+        if (error instanceof ConfigInvalidError) {
+            return { status: 400, body: errorBody("BAD_REQUEST", error.message) };
+        }
+        throw error;
+    }
+}
+async function defaultGatewaySetupTester(config, candidateModelIds) {
+    const gateway = new Gateway(config);
+    const tested = Array(candidateModelIds.length).fill(undefined);
+    let next = 0;
+    async function worker() {
+        while (next < candidateModelIds.length) {
+            const index = next;
+            next += 1;
+            const modelId = candidateModelIds[index];
+            if (modelId === undefined) {
+                continue;
+            }
+            try {
+                await gateway.chat({
+                    modelId,
+                    messages: [{ role: "user", content: "Reply with exactly: OK" }],
+                });
+                tested[index] = modelId;
+            }
+            catch {
+                // Non-chat models can appear in OpenAI-compatible model discovery responses. They are
+                // intentionally ignored so only chat-callable models become selectable in the UI.
+            }
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(SETUP_SMOKE_CONCURRENCY, candidateModelIds.length) }, () => worker()));
+    const accepted = tested.filter((modelId) => modelId !== undefined);
+    if (accepted.length === 0) {
+        throw new Error("no discovered model accepted the chat-completions smoke test");
+    }
+    return accepted;
+}
+function savePrivateJson(path, raw) {
+    const resolvedPath = resolve(path);
+    const dir = dirname(resolvedPath);
+    assertNoSymlinkedPathSegments(resolvedPath);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    assertNoSymlinkedPathSegments(resolvedPath);
+    if (process.platform !== "win32") {
+        chmodSync(dir, 0o700);
+    }
+    const tempPath = join(dir, `.keiko-config.${String(process.pid)}.${Date.now().toString(36)}.${randomUUID()}.tmp`);
+    try {
+        writeFileSync(tempPath, `${JSON.stringify(raw, null, 2)}\n`, {
+            encoding: "utf8",
+            flag: "wx",
+            mode: 0o600,
+        });
+        if (process.platform !== "win32") {
+            chmodSync(tempPath, 0o600);
+        }
+        renameSync(tempPath, resolvedPath);
+    }
+    finally {
+        if (existsSync(tempPath)) {
+            try {
+                unlinkSync(tempPath);
+            }
+            catch {
+                // Best-effort cleanup only.
+            }
+        }
+    }
+}
+function assertNoSymlinkedPathSegments(resolvedPath) {
+    let current = resolvedPath;
+    while (current !== dirname(current)) {
+        if (isSymlink(current)) {
+            throw new Error("refusing to write gateway config through a symlinked path");
+        }
+        current = dirname(current);
+    }
+}
+function isSymlink(path) {
+    try {
+        return lstatSync(path).isSymbolicLink();
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return false;
+        }
+        throw error;
+    }
+}
+function readSetupRequest(raw) {
+    if (!isRecord(raw)) {
+        return { status: 400, body: errorBody("BAD_REQUEST", "Request body must be a JSON object.") };
+    }
+    const baseUrl = typeof raw.baseUrl === "string" ? raw.baseUrl.trim() : "";
+    const apiKey = typeof raw.apiKey === "string" ? raw.apiKey.trim() : "";
+    if (baseUrl.length === 0 || apiKey.length === 0) {
+        return { status: 400, body: errorBody("BAD_REQUEST", "baseUrl and apiKey are required.") };
+    }
+    let apiKeyHeaderName;
+    try {
+        apiKeyHeaderName = normalizeApiKeyHeaderName(raw.apiKeyHeaderName, "apiKeyHeaderName", DEFAULT_API_KEY_HEADER_NAME);
+    }
+    catch (error) {
+        if (error instanceof ConfigInvalidError) {
+            return { status: 400, body: errorBody("BAD_REQUEST", error.message) };
+        }
+        throw error;
+    }
+    const deploymentNames = parseDeploymentNames(raw.deploymentNames);
+    if ("status" in deploymentNames) {
+        return deploymentNames;
+    }
+    const invalidConnection = validateSetupConnection(baseUrl, apiKey, apiKeyHeaderName);
+    if (invalidConnection !== undefined) {
+        return invalidConnection;
+    }
+    return { baseUrl, apiKey, apiKeyHeaderName, deploymentNames };
+}
+function safeError(error, secrets) {
+    if (error instanceof Error) {
+        return redact(error.message, secrets);
+    }
+    return "Gateway setup failed.";
+}
+async function verifySetupCandidate(baseUrl, apiKey, apiKeyHeaderName, deploymentNames, tester, discovery) {
+    // Defence-in-depth: never send the credential to a candidate URL that has not passed the same
+    // scheme/credential/loopback validation as the originally submitted base URL.
+    validateBaseUrl(baseUrl, "candidate");
+    const candidateModelIds = deploymentNames.length > 0
+        ? deploymentNames
+        : await discovery(baseUrl, apiKey, apiKeyHeaderName);
+    const smokeTimeoutMs = deploymentNames.length > 0 ? DEPLOYMENT_SMOKE_TIMEOUT_MS : DISCOVERED_MODEL_SMOKE_TIMEOUT_MS;
+    const candidateRawConfig = buildRawConfig(baseUrl, apiKey, candidateModelIds, {
+        apiKeyHeaderName,
+        timeoutMs: smokeTimeoutMs,
+        maxRetries: 0,
+    });
+    const candidateConfig = parseGatewayConfig(candidateRawConfig);
+    const testedModelIds = await tester(candidateConfig, candidateModelIds);
+    const rawConfig = buildRawConfig(baseUrl, apiKey, testedModelIds, { apiKeyHeaderName });
+    const config = parseGatewayConfig(rawConfig);
+    return { rawConfig, config, testedModelIds };
+}
+function setupSuccessResult(config, testedModelIds) {
+    const testedModelId = testedModelIds[0] ?? "unknown";
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            testedModelId,
+            testedModelIds,
+            providerCount: config.providers.length,
+            models: listConfiguredCapabilities(config),
+            config: toSafeObject(config),
+        },
+    };
+}
+function setupFailureResult(errors) {
+    return {
+        status: 502,
+        body: errorBody("GATEWAY_SETUP_FAILED", `Credentials could not be verified. ${errors.join(" ")}`),
+    };
+}
+function deploymentNamesRequiredResult() {
+    return {
+        status: 400,
+        body: errorBody("GATEWAY_DEPLOYMENTS_REQUIRED", "Azure AI Foundry endpoints require deployment names from the Deployments tab."),
+    };
+}
+async function readJsonSetupBody(ctx) {
+    let bodyText;
+    try {
+        bodyText = await readBody(ctx.req);
+    }
+    catch (error) {
+        if (error instanceof BodyTooLargeError) {
+            return {
+                status: 413,
+                body: errorBody("PAYLOAD_TOO_LARGE", "Request body exceeds the size limit."),
+            };
+        }
+        throw error;
+    }
+    try {
+        return { parsed: JSON.parse(bodyText) };
+    }
+    catch {
+        return { status: 400, body: errorBody("BAD_REQUEST", "Request body is not valid JSON.") };
+    }
+}
+function gatewayUnavailableResult() {
+    return {
+        status: 500,
+        body: errorBody("GATEWAY_SETUP_UNAVAILABLE", "Gateway setup is unavailable."),
+    };
+}
+export async function handleGatewaySetup(ctx, deps) {
+    if (deps.gatewayConfig === undefined) {
+        return gatewayUnavailableResult();
+    }
+    const bodyResult = await readJsonSetupBody(ctx);
+    if ("status" in bodyResult) {
+        return bodyResult;
+    }
+    const request = readSetupRequest(bodyResult.parsed);
+    if ("status" in request) {
+        return request;
+    }
+    const tester = deps.gatewaySetupTester ?? defaultGatewaySetupTester;
+    const discovery = deps.gatewayModelDiscovery ?? defaultGatewayModelDiscovery;
+    const baseUrlCandidates = candidateBaseUrls(request.baseUrl);
+    if (request.deploymentNames.length === 0 &&
+        baseUrlCandidates.some((baseUrl) => isAzureFoundryBaseUrl(baseUrl))) {
+        return deploymentNamesRequiredResult();
+    }
+    const errors = [];
+    for (const baseUrl of baseUrlCandidates) {
+        try {
+            const verified = await verifySetupCandidate(baseUrl, request.apiKey, request.apiKeyHeaderName, request.deploymentNames, tester, discovery);
+            savePrivateJson(deps.gatewayConfig.storagePath, verified.rawConfig);
+            deps.gatewayConfig.set(verified.config, true);
+            return setupSuccessResult(verified.config, verified.testedModelIds);
+        }
+        catch (error) {
+            errors.push(`candidate ${String(errors.length + 1)}: ${safeError(error, [request.apiKey, request.baseUrl, baseUrl])}`);
+        }
+    }
+    return setupFailureResult(errors);
+}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/headers.d.ts

@@ -0,0 +1,3 @@
+import type { ServerResponse } from "node:http";
+export declare function applySecurityHeaders(res: ServerResponse, csp: string, isApiPath: boolean): void;
+//# sourceMappingURL=headers.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../../../src/headers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAahD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI,CAQ/F"}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/host-check.d.ts

@@ -0,0 +1,3 @@
+import type { IncomingMessage } from "node:http";
+export declare function isAllowedHost(req: IncomingMessage, expectedPort: number): boolean;
+//# sourceMappingURL=host-check.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/host-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-check.d.ts","sourceRoot":"","sources":["../../../../src/host-check.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AA+CjD,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAWjF"}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/index.d.ts

@@ -0,0 +1,21 @@
+export { createUiServer, DEFAULT_UI_PORT, UI_HOST, type UiServerDeps } from "./server.js";
+export { buildCspHeader, extractInlineScriptHashes } from "./csp.js";
+export { loadCspHeader } from "./load-csp.js";
+export { applySecurityHeaders } from "./headers.js";
+export { isAllowedHost } from "./host-check.js";
+export { resolveContainedPath, serveFile } from "./static.js";
+export { API_ROUTES, isApiPath, matchRoute, errorBody, STREAMING, type ApiError, type HandlerOutcome, type RouteContext, type RouteDefinition, type RouteHandler, type RouteMatch, type RouteResult, } from "./routes.js";
+export { buildUiHandlerDeps, buildRedactor, type UiHandlerDeps, type BuildHandlerDepsOptions, type Redactor, type ModelPortFactory, } from "./deps.js";
+export { createRunRegistry, ActiveRunLimitError, type RunRegistry, type RunRecord, type RunStatus, type AppliableSnapshot, } from "./runs.js";
+export { QueueEventSink, type StreamEvent, type SseWriter } from "./sink.js";
+export { parseRunRequest, type RunRequest, type RunKind } from "./run-request.js";
+export { startRun, applyRun, type StartRunResult } from "./run-engine.js";
+export { handleCreateRun, handleRunEvents, handleCancelRun, handleGetRun, handleApplyRun, } from "./run-handlers.js";
+export { persistWorkflowEvidence, persistExplainEvidence, type EvidencePersistContext, type RunIdentity, } from "./evidence.js";
+export { createInMemoryUiStore, createNodeUiStore, isProjectAvailable, resolveUiDbPath, runMigrations, SCHEMA_VERSION, UI_DB_DIRNAME, UI_DB_FILENAME, UiStoreError, validateProjectPath, type Chat, type ChatMessage, type ChatRole, type CreateChatOptions, type NewChatMessage, type Project, type UiStore, type UiStoreErrorCode, type UiStoreFactoryOptions, type UpdateChatPatch, type UpdateProjectPatch, type WorkflowStatus, } from "./store/index.js";
+export { handleListProjects, handleCreateProject, handleUpdateProject, handleDeleteProject, handleListChats, handleCreateChat, handleUpdateChat, handleDeleteChat, handleListMessages, handleCreateMessage, } from "./store-handlers.js";
+export { createTerminalExecutionManager, buildTerminalPolicySummary, listDirectories, type TerminalDirectoryListing, type TerminalExecutionInput, type TerminalExecutionManager, type TerminalExecutionResult, type TerminalEventEmitter, type TerminalEventEnvelope, type TerminalEventKind, type TerminalPolicySummary, } from "./terminal.js";
+export { TerminalToolError, type TerminalErrorCode } from "./terminal-errors.js";
+export { buildTerminalEvidenceEntry, appendTerminalEvidence, type TerminalEvidenceEntry, } from "./terminal-evidence.js";
+export { listFilesDirectories, readFilesPreview, readFilesTree, type FilesDirectoryEntry, type FilesDirectoryListing, type FilesDirectoryRoot, type FilesEntryKind, type FilesPreviewResponse, type FilesTreeEntry, type FilesTreeResponse, } from "./files.js";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,UAAU,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,QAAQ,EACb,KAAK,gBAAgB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,cAAc,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,YAAY,EACZ,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,GACjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,EACd,YAAY,EACZ,mBAAmB,EACnB,KAAK,IAAI,EACT,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,OAAO,EACZ,KAAK,OAAO,EACZ,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,8BAA8B,EAC9B,0BAA0B,EAC1B,eAAe,EACf,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC"}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/index.js

@@ -0,0 +1,30 @@
+// Public barrel for the local UI BFF runtime (ADR-0019 §"Target Package Topology"
+// row keiko-server). The browser tier stays presentation-only: model, filesystem,
+// PTY, and harness authority remain in the loopback Node process behind JSON, SSE,
+// and token-scoped WebSocket seams.
+//
+// After issue #166 the BFF runtime lives in `packages/keiko-server/`; the legacy
+// `src/ui/` directory now contains only an enumerated re-export shim so existing
+// consumers (`src/cli/ui.ts`, `src/cli/lifecycle.ts`, in-repo SDK callers) keep
+// resolving their `from "../ui/index.js"` imports unchanged.
+export { createUiServer, DEFAULT_UI_PORT, UI_HOST } from "./server.js";
+export { buildCspHeader, extractInlineScriptHashes } from "./csp.js";
+export { loadCspHeader } from "./load-csp.js";
+export { applySecurityHeaders } from "./headers.js";
+export { isAllowedHost } from "./host-check.js";
+export { resolveContainedPath, serveFile } from "./static.js";
+export { API_ROUTES, isApiPath, matchRoute, errorBody, STREAMING, } from "./routes.js";
+export { buildUiHandlerDeps, buildRedactor, } from "./deps.js";
+export { createRunRegistry, ActiveRunLimitError, } from "./runs.js";
+export { QueueEventSink } from "./sink.js";
+export { parseRunRequest } from "./run-request.js";
+export { startRun, applyRun } from "./run-engine.js";
+export { handleCreateRun, handleRunEvents, handleCancelRun, handleGetRun, handleApplyRun, } from "./run-handlers.js";
+export { persistWorkflowEvidence, persistExplainEvidence, } from "./evidence.js";
+// ADR-0013 — UI-local SQLite persistence: ports, factories, and route handlers.
+export { createInMemoryUiStore, createNodeUiStore, isProjectAvailable, resolveUiDbPath, runMigrations, SCHEMA_VERSION, UI_DB_DIRNAME, UI_DB_FILENAME, UiStoreError, validateProjectPath, } from "./store/index.js";
+export { handleListProjects, handleCreateProject, handleUpdateProject, handleDeleteProject, handleListChats, handleCreateChat, handleUpdateChat, handleDeleteChat, handleListMessages, handleCreateMessage, } from "./store-handlers.js";
+export { createTerminalExecutionManager, buildTerminalPolicySummary, listDirectories, } from "./terminal.js";
+export { TerminalToolError } from "./terminal-errors.js";
+export { buildTerminalEvidenceEntry, appendTerminalEvidence, } from "./terminal-evidence.js";
+export { listFilesDirectories, readFilesPreview, readFilesTree, } from "./files.js";

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/load-csp.d.ts

@@ -0,0 +1,2 @@
+export declare function loadCspHeader(hashesFile: string): Promise<string>;
+//# sourceMappingURL=load-csp.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/load-csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-csp.d.ts","sourceRoot":"","sources":["../../../../src/load-csp.ts"],"names":[],"mappings":"AAgBA,wBAAsB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYvE"}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/read-handlers.d.ts

@@ -0,0 +1,9 @@
+import type { RouteContext, RouteResult } from "./routes.js";
+import type { UiHandlerDeps } from "./deps.js";
+export declare function handleConfig(_ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleModels(_ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleWorkflows(): RouteResult;
+export declare function handleWorkspace(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleEvidenceList(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleEvidenceDetail(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+//# sourceMappingURL=read-handlers.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/read-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-handlers.d.ts","sourceRoot":"","sources":["../../../../src/read-handlers.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAK/C,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CASjF;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAIjF;AAKD,wBAAgB,eAAe,IAAI,WAAW,CAyC7C;AAkID,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAUnF;AA+CD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAMtF;AAKD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAsBxF"}