@pellux/goodvibes-sdk 0.21.29 → 0.21.33

package/dist/_internal/platform/providers/openai-compat.js

@@ -1,6 +1,7 @@
 import OpenAI from 'openai';
 import { ProviderError } from '../types/errors.js';
 import { withRetry } from '../utils/retry.js';
+import { instrumentedLlmCall } from '../runtime/llm-observability.js';
 import { toOpenAITools, toOpenAIMessages, fromOpenAIToolCalls, extractTextToolCalls, } from './tool-formats.js';
 import { getCacheCapability } from './cache-capability.js';
 import { extractOpenAIStreamTextDelta } from './openai-stream-delta.js';
@@ -235,7 +236,7 @@ export class OpenAICompatProvider {
     }
     async chat(params) {
         const { messages, tools, model, maxTokens, signal, systemPrompt, reasoningEffort, reasoningSummary, onDelta, } = params;
-        return withRetry(async () => {
+        return (await instrumentedLlmCall(() => withRetry(async () => {
             const allowReasoningStream = this.reasoningFormat !== 'none';
             let responseText = '';
             let inputTokens = 0;
@@ -419,7 +420,7 @@ export class OpenAICompatProvider {
                 cacheReadTokens,
             });
             return response;
-        });
+        }), { provider: this.name, model: model ?? this.defaultModel })).result;
     }
     async embed(request) {
         let response;

package/dist/_internal/platform/providers/provider-not-found-error.d.ts

@@ -1,3 +1,4 @@
+import { GoodVibesSdkError } from '../../errors/index.js';
 /**
  * Thrown by {@link ProviderRegistry.require} when no provider with the given ID
  * is registered.
@@ -6,7 +7,8 @@
  * so callers can quickly see what is available without having to inspect the
  * registry separately.
  */
-export declare class ProviderNotFoundError extends Error {
+export declare class ProviderNotFoundError extends GoodVibesSdkError {
+    readonly code: 'PROVIDER_NOT_FOUND';
     /** The provider ID that was requested. */
     readonly providerId: string;
     /** Sorted list of currently-registered provider IDs at the time of the error. */

package/dist/_internal/platform/providers/provider-not-found-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-not-found-error.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/providers/provider-not-found-error.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,0CAA0C;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;gBAE7B,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE;CAY7D"}
+{"version":3,"file":"provider-not-found-error.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/providers/provider-not-found-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;;GAOG;AACH,qBAAa,qBAAsB,SAAQ,iBAAiB;IAC1D,SAAiB,IAAI,EAAE,oBAAoB,CAAC;IAC5C,0CAA0C;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;gBAE7B,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE;CAW7D"}

package/dist/_internal/platform/providers/provider-not-found-error.js

@@ -1,3 +1,4 @@
+import { GoodVibesSdkError } from '../../errors/index.js';
 /**
  * Thrown by {@link ProviderRegistry.require} when no provider with the given ID
  * is registered.
@@ -6,7 +7,7 @@
  * so callers can quickly see what is available without having to inspect the
  * registry separately.
  */
-export class ProviderNotFoundError extends Error {
+export class ProviderNotFoundError extends GoodVibesSdkError {
     /** The provider ID that was requested. */
     providerId;
     /** Sorted list of currently-registered provider IDs at the time of the error. */
@@ -14,11 +15,9 @@ export class ProviderNotFoundError extends Error {
     constructor(providerId, available) {
         const ids = available.length > 0 ? available.join(', ') : '(none)';
         super(`Provider '${providerId}' is not registered. ` +
-            `Available providers: ${ids}`);
+            `Available providers: ${ids}`, { code: 'PROVIDER_NOT_FOUND', category: 'not_found', source: 'provider', recoverable: false });
         this.name = 'ProviderNotFoundError';
         this.providerId = providerId;
         this.availableIds = available;
-        // Maintains proper prototype chain for instanceof checks
-        Object.setPrototypeOf(this, new.target.prototype);
     }
 }

package/dist/_internal/platform/providers/well-known-endpoints.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Well-known local LLM service endpoints and ports.
+ *
+ * These are **fallback defaults** used for zero-config local LLM discovery when
+ * no explicit base URL has been provided by the user. They represent the
+ * conventional ports that popular local inference servers listen on out of the box.
+ *
+ * Usage:
+ * - Import the base URL when building a default `baseURL` string literal.
+ * - Import the port when doing port-based fingerprinting in the scanner.
+ * - Never use these to override a user-supplied config value.
+ *
+ * @module well-known-endpoints
+ */
+/**
+ * Frozen map of well-known local LLM service base URLs.
+ *
+ * Keys correspond to the canonical service identifier used across the codebase.
+ * Values are the bare origin (scheme + host + port, **no trailing slash**).
+ * Append a path suffix (e.g. `/v1`) at the call site where the full URL is built.
+ */
+export declare const WELL_KNOWN_LOCAL_ENDPOINTS: Readonly<{
+    /** Ollama — default listen address (loopback) */
+    readonly ollama: "http://127.0.0.1:11434";
+    /** LM Studio — default OpenAI-compat server */
+    readonly lmStudio: "http://127.0.0.1:1234";
+    /** llama.cpp — default HTTP server */
+    readonly llamaCpp: "http://localhost:8080";
+    /** LiteLLM — default proxy gateway */
+    readonly liteLLM: "http://localhost:4000";
+    /** Copilot Proxy — operator-managed local gateway */
+    readonly copilotProxy: "http://localhost:3000";
+}>;
+/**
+ * Frozen map of well-known local LLM service port numbers.
+ *
+ * Used by the scanner when fingerprinting discovered servers by port. The full
+ * `KNOWN_PORTS` scan list is derived from this plus additional ports for less
+ * common services.
+ */
+export declare const WELL_KNOWN_LOCAL_PORTS: Readonly<{
+    readonly ollama: 11434;
+    readonly lmStudio: 1234;
+    readonly llamaCpp: 8080;
+    readonly liteLLM: 4000;
+    readonly copilotProxy: 3000;
+    /** Oobabooga / Text Generation WebUI (common alt port) */
+    readonly jan: 1337;
+    readonly gpt4all: 4891;
+    readonly koboldCpp: 5001;
+    readonly aphrodite: 2242;
+}>;
+//# sourceMappingURL=well-known-endpoints.d.ts.map

package/dist/_internal/platform/providers/well-known-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known-endpoints.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/providers/well-known-endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B;IACrC,iDAAiD;;IAEjD,+CAA+C;;IAE/C,sCAAsC;;IAEtC,sCAAsC;;IAEtC,qDAAqD;;EAE5C,CAAC;AAEZ;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;IAMjC,0DAA0D;;;;;EAKjD,CAAC"}

package/dist/_internal/platform/providers/well-known-endpoints.js

@@ -0,0 +1,52 @@
+/**
+ * Well-known local LLM service endpoints and ports.
+ *
+ * These are **fallback defaults** used for zero-config local LLM discovery when
+ * no explicit base URL has been provided by the user. They represent the
+ * conventional ports that popular local inference servers listen on out of the box.
+ *
+ * Usage:
+ * - Import the base URL when building a default `baseURL` string literal.
+ * - Import the port when doing port-based fingerprinting in the scanner.
+ * - Never use these to override a user-supplied config value.
+ *
+ * @module well-known-endpoints
+ */
+/**
+ * Frozen map of well-known local LLM service base URLs.
+ *
+ * Keys correspond to the canonical service identifier used across the codebase.
+ * Values are the bare origin (scheme + host + port, **no trailing slash**).
+ * Append a path suffix (e.g. `/v1`) at the call site where the full URL is built.
+ */
+export const WELL_KNOWN_LOCAL_ENDPOINTS = Object.freeze({
+    /** Ollama — default listen address (loopback) */
+    ollama: 'http://127.0.0.1:11434',
+    /** LM Studio — default OpenAI-compat server */
+    lmStudio: 'http://127.0.0.1:1234',
+    /** llama.cpp — default HTTP server */
+    llamaCpp: 'http://localhost:8080',
+    /** LiteLLM — default proxy gateway */
+    liteLLM: 'http://localhost:4000',
+    /** Copilot Proxy — operator-managed local gateway */
+    copilotProxy: 'http://localhost:3000',
+});
+/**
+ * Frozen map of well-known local LLM service port numbers.
+ *
+ * Used by the scanner when fingerprinting discovered servers by port. The full
+ * `KNOWN_PORTS` scan list is derived from this plus additional ports for less
+ * common services.
+ */
+export const WELL_KNOWN_LOCAL_PORTS = Object.freeze({
+    ollama: 11434,
+    lmStudio: 1234,
+    llamaCpp: 8080,
+    liteLLM: 4000,
+    copilotProxy: 3000,
+    /** Oobabooga / Text Generation WebUI (common alt port) */
+    jan: 1337,
+    gpt4all: 4891,
+    koboldCpp: 5001,
+    aphrodite: 2242,
+});

package/dist/_internal/platform/runtime/auth/oauth-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-core.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/auth/oauth-core.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGzE,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACpF,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEpF,wBAAgB,gBAAgB,CAAC,KAAK,SAAK,GAAG,MAAM,CAEnD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,SAAK,GAAG,MAAM,CAErD;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAI5E;AAED,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,mBAAmB,EAC3B,KAAK,CAAC,EAAE;IACN,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,GACA,OAAO,CAAC,eAAe,CAAC,CA4B1B;AA4CD,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE;IACL,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,GACA,OAAO,CAAC,iBAAiB,CAAC,CAc5B;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,mBAAmB,EAC3B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAc5B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAa9E"}
+{"version":3,"file":"oauth-core.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/auth/oauth-core.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGzE,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEpF,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEpF,wBAAgB,gBAAgB,CAAC,KAAK,SAAK,GAAG,MAAM,CAEnD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,SAAK,GAAG,MAAM,CAErD;AAED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3E;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAI5E;AAED,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,mBAAmB,EAC3B,KAAK,CAAC,EAAE;IACN,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B,GACA,OAAO,CAAC,eAAe,CAAC,CA4B1B;AA4CD,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE;IACL,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,GACA,OAAO,CAAC,iBAAiB,CAAC,CAc5B;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,mBAAmB,EAC3B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAc5B;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAa9E"}

package/dist/_internal/platform/runtime/auth/oauth-core.js

@@ -1,4 +1,5 @@
 import { createSha256Hash, randomBytesBase64url } from './crypto-adapter.js';
+import { instrumentedFetch } from '../../utils/fetch-with-timeout.js';
 export function createOAuthState(bytes = 24) {
     return randomBytesBase64url(bytes);
 }
@@ -47,7 +48,7 @@ async function exchangeOAuthRequest(url, encoding, payload) {
     const body = encoding === 'json'
         ? JSON.stringify(payload)
         : new URLSearchParams(Object.entries(payload).map(([key, value]) => [key, String(value)])).toString();
-    const response = await fetch(url, {
+    const response = await instrumentedFetch(url, {
         method: 'POST',
         headers: {
             'Content-Type': encoding === 'json' ? 'application/json' : 'application/x-www-form-urlencoded',

package/dist/_internal/platform/runtime/bootstrap-runtime-events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap-runtime-events.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/runtime/bootstrap-runtime-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,KAAK,EAA6B,eAAe,EAAiB,MAAM,mBAAmB,CAAC;AACnG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAI5D,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;IACjE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IACvE,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,KAAK,IAAI,CAAC;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACzC;AAoED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,6BAA6B,GACrC;IAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IAAC,sBAAsB,EAAE;QAAE,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;CAAE,CAoKzG;AAED,MAAM,MAAM,kCAAkC,GAAG,6BAA6B,CAAC;AAC/E,eAAO,MAAM,8BAA8B,kCAA4B,CAAC"}
+{"version":3,"file":"bootstrap-runtime-events.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/runtime/bootstrap-runtime-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,KAAK,EAA6B,eAAe,EAAiB,MAAM,mBAAmB,CAAC;AACnG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAI5D,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;IACjE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IACvE,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,KAAK,IAAI,CAAC;IAC9E,QAAQ,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC;IACnC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACzC;AAoED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,6BAA6B,GACrC;IAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IAAC,sBAAsB,EAAE;QAAE,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,GAAG,IAAI,CAAA;KAAE,CAAA;CAAE,CAsKzG;AAED,MAAM,MAAM,kCAAkC,GAAG,6BAA6B,CAAC;AAC/E,eAAO,MAAM,8BAA8B,kCAA4B,CAAC"}

package/dist/_internal/platform/runtime/bootstrap-runtime-events.js

@@ -194,6 +194,8 @@ export function registerHostRuntimeEvents(options) {
         });
         requestRender();
     }, AGENT_STATUS_INTERVAL_MS);
+    // Don't block clean process exit (PERF-07).
+    agentStatusIntervalRef.value.unref?.();
     return { unsubs, agentStatusIntervalRef };
 }
 export const registerBootstrapRuntimeEvents = registerHostRuntimeEvents;

package/dist/_internal/platform/runtime/contracts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/contracts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAUjD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;CAC9C,CAsGA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/contracts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,uBAAuB,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAYjD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,IAAI;IACxC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;CAC9C,CAsGA"}

package/dist/_internal/platform/runtime/contracts/index.js

@@ -20,11 +20,7 @@ export * from './version.js';
 export * from './validators/index.js';
 import { MigrationRegistry } from './migrations/index.js';
 import { SCHEMA_VERSIONS, MIN_SUPPORTED_VERSIONS } from './version.js';
-import { getRuntimeStateMigrationSteps } from './migrations/runtime-state.js';
-import { getEventEnvelopeMigrationSteps } from './migrations/event-envelope.js';
-import { getSessionMigrationSteps } from './migrations/session.js';
-import { getPluginManifestMigrationSteps } from './migrations/plugin-manifest.js';
-import { getTaskRecordMigrationSteps } from './migrations/task-record.js';
+import { getRuntimeStateMigrationSteps, getEventEnvelopeMigrationSteps, getSessionMigrationSteps, getPluginManifestMigrationSteps, getTaskRecordMigrationSteps, } from './migrations/schemas.js';
 import { validateRuntimeState } from './validators/runtime-state.js';
 import { validateEventEnvelope } from './validators/event-envelope.js';
 import { validateSession } from './validators/session.js';

package/dist/_internal/platform/runtime/contracts/migrations/schemas.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Compatibility Contracts — Consolidated Migration Schemas
+ *
+ * All domain migration steps in one place. Each schema section:
+ *   - Declares a private `_STEPS` array (MigrationStep[])
+ *   - Exports a `_VERSION` constant (re-exported from SCHEMA_VERSIONS)
+ *   - Exports a `get…MigrationSteps()` function for the contract registry
+ *
+ * Previously split across 5 stub files; consolidated here for DRY.
+ * Split back out if any individual contract accumulates > 10 migration steps.
+ *
+ * All migration functions must be pure — no mutations, no side effects.
+ *
+ * @module contracts/migrations/schemas
+ */
+import type { MigrationStep } from '../types.js';
+/** The current EventEnvelope schema version (re-exported for convenience). */
+export declare const EVENT_ENVELOPE_VERSION: {
+    readonly major: 1;
+    readonly minor: 1;
+    readonly patch: 0;
+};
+/** Returns all EventEnvelope migration steps. Used by the contract registry. */
+export declare function getEventEnvelopeMigrationSteps(): MigrationStep[];
+/** The current PluginManifest schema version (re-exported for convenience). */
+export declare const PLUGIN_MANIFEST_VERSION: {
+    readonly major: 1;
+    readonly minor: 0;
+    readonly patch: 0;
+};
+/** Returns all PluginManifest migration steps. Used by the contract registry. */
+export declare function getPluginManifestMigrationSteps(): MigrationStep[];
+/** The current RuntimeState schema version (re-exported for convenience). */
+export declare const RUNTIME_STATE_VERSION: {
+    readonly major: 1;
+    readonly minor: 0;
+    readonly patch: 0;
+};
+/** Returns all RuntimeState migration steps. Used by the contract registry. */
+export declare function getRuntimeStateMigrationSteps(): MigrationStep[];
+/** The current Session schema version (re-exported for convenience). */
+export declare const SESSION_VERSION: {
+    readonly major: 1;
+    readonly minor: 0;
+    readonly patch: 0;
+};
+/** Returns all Session migration steps. Used by the contract registry. */
+export declare function getSessionMigrationSteps(): MigrationStep[];
+/** The current TaskRecord schema version (re-exported for convenience). */
+export declare const TASK_RECORD_VERSION: {
+    readonly major: 1;
+    readonly minor: 0;
+    readonly patch: 0;
+};
+/** Returns all TaskRecord migration steps. Used by the contract registry. */
+export declare function getTaskRecordMigrationSteps(): MigrationStep[];
+//# sourceMappingURL=schemas.d.ts.map

package/dist/_internal/platform/runtime/contracts/migrations/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/_internal/platform/runtime/contracts/migrations/schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA2BjD,8EAA8E;AAC9E,eAAO,MAAM,sBAAsB;;;;CAAgC,CAAC;AAEpE,gFAAgF;AAChF,wBAAgB,8BAA8B,IAAI,aAAa,EAAE,CAEhE;AA0BD,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB;;;;CAAiC,CAAC;AAEtE,iFAAiF;AACjF,wBAAgB,+BAA+B,IAAI,aAAa,EAAE,CAEjE;AA0BD,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB;;;;CAA+B,CAAC;AAElE,+EAA+E;AAC/E,wBAAgB,6BAA6B,IAAI,aAAa,EAAE,CAE/D;AA2BD,wEAAwE;AACxE,eAAO,MAAM,eAAe;;;;CAA0B,CAAC;AAEvD,0EAA0E;AAC1E,wBAAgB,wBAAwB,IAAI,aAAa,EAAE,CAE1D;AA0BD,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB;;;;CAA6B,CAAC;AAE9D,6EAA6E;AAC7E,wBAAgB,2BAA2B,IAAI,aAAa,EAAE,CAE7D"}

package/dist/_internal/platform/runtime/contracts/migrations/schemas.js

@@ -0,0 +1,157 @@
+/**
+ * Compatibility Contracts — Consolidated Migration Schemas
+ *
+ * All domain migration steps in one place. Each schema section:
+ *   - Declares a private `_STEPS` array (MigrationStep[])
+ *   - Exports a `_VERSION` constant (re-exported from SCHEMA_VERSIONS)
+ *   - Exports a `get…MigrationSteps()` function for the contract registry
+ *
+ * Previously split across 5 stub files; consolidated here for DRY.
+ * Split back out if any individual contract accumulates > 10 migration steps.
+ *
+ * All migration functions must be pure — no mutations, no side effects.
+ *
+ * @module contracts/migrations/schemas
+ */
+import { SCHEMA_VERSIONS } from '../version.js';
+// ─── EventEnvelope ────────────────────────────────────────────────────────────
+/**
+ * All registered EventEnvelope migration steps.
+ *
+ * Currently empty — the schema is at its initial version (1.0.0).
+ * Future steps must be appended here and registered via the contract registry.
+ *
+ * Example: if `agentId` becomes required in v1.1.0, a migration step would
+ * backfill it with a sentinel value for older persisted envelopes.
+ */
+const EVENT_ENVELOPE_STEPS = [
+// Example structure for future use:
+// {
+//   from: { major: 1, minor: 0, patch: 0 },
+//   to: { major: 1, minor: 1, patch: 0 },
+//   description: 'Backfill missing agentId with null sentinel',
+//   migrate: (data: unknown): unknown => {
+//     const d = data as Record<string, unknown>;
+//     return { ...d, agentId: d['agentId'] ?? null };
+//   },
+// },
+];
+/** The current EventEnvelope schema version (re-exported for convenience). */
+export const EVENT_ENVELOPE_VERSION = SCHEMA_VERSIONS.eventEnvelope;
+/** Returns all EventEnvelope migration steps. Used by the contract registry. */
+export function getEventEnvelopeMigrationSteps() {
+    return EVENT_ENVELOPE_STEPS;
+}
+// ─── PluginManifest ───────────────────────────────────────────────────────────
+/**
+ * All registered PluginManifest migration steps.
+ *
+ * Currently empty — the schema is at its initial version (1.0.0).
+ * Future steps must be appended here and registered via the contract registry.
+ *
+ * Example: if `capabilities` becomes an explicit array in v1.1.0, a migration
+ * step would synthesize it from `registerCommand`/`registerTool` declarations.
+ */
+const PLUGIN_MANIFEST_STEPS = [
+// Example structure for future use:
+// {
+//   from: { major: 1, minor: 0, patch: 0 },
+//   to: { major: 1, minor: 1, patch: 0 },
+//   description: 'Add capabilities array to plugin manifest',
+//   migrate: (data: unknown): unknown => {
+//     const d = data as Record<string, unknown>;
+//     return { ...d, capabilities: d['capabilities'] ?? [] };
+//   },
+// },
+];
+/** The current PluginManifest schema version (re-exported for convenience). */
+export const PLUGIN_MANIFEST_VERSION = SCHEMA_VERSIONS.pluginManifest;
+/** Returns all PluginManifest migration steps. Used by the contract registry. */
+export function getPluginManifestMigrationSteps() {
+    return PLUGIN_MANIFEST_STEPS;
+}
+// ─── RuntimeState ─────────────────────────────────────────────────────────────
+/**
+ * All registered RuntimeState migration steps.
+ *
+ * Currently empty — the schema is at its initial version (1.0.0).
+ * Future steps must be appended here and registered via the contract registry.
+ *
+ * Example: if `uiSettings` is added in v1.1.0, a step would backfill it with
+ * default values for existing persisted snapshots.
+ */
+const RUNTIME_STATE_STEPS = [
+// Example structure for future use:
+// {
+//   from: { major: 1, minor: 0, patch: 0 },
+//   to: { major: 1, minor: 1, patch: 0 },
+//   description: 'Add optional uiSettings field with defaults',
+//   migrate: (data: unknown): unknown => {
+//     const d = data as Record<string, unknown>;
+//     return { ...d, uiSettings: d['uiSettings'] ?? { theme: 'dark' } };
+//   },
+// },
+];
+/** The current RuntimeState schema version (re-exported for convenience). */
+export const RUNTIME_STATE_VERSION = SCHEMA_VERSIONS.runtimeState;
+/** Returns all RuntimeState migration steps. Used by the contract registry. */
+export function getRuntimeStateMigrationSteps() {
+    return RUNTIME_STATE_STEPS;
+}
+// ─── Session ──────────────────────────────────────────────────────────────────
+/**
+ * All registered Session migration steps.
+ *
+ * Currently empty — the schema is at its initial version (1.0.0).
+ * Future steps must be appended here and registered via the contract registry.
+ *
+ * Example: if session files gain a `tags` array in v1.1.0, a migration step
+ * would backfill it as an empty array for existing sessions.
+ */
+const SESSION_STEPS = [
+// Example structure for future use:
+// {
+//   from: { major: 1, minor: 0, patch: 0 },
+//   to: { major: 1, minor: 1, patch: 0 },
+//   description: 'Add empty tags array to session meta',
+//   migrate: (data: unknown): unknown => {
+//     const d = data as Record<string, unknown>;
+//     const meta = d['meta'] as Record<string, unknown>;
+//     return { ...d, meta: { ...meta, tags: meta['tags'] ?? [] } };
+//   },
+// },
+];
+/** The current Session schema version (re-exported for convenience). */
+export const SESSION_VERSION = SCHEMA_VERSIONS.session;
+/** Returns all Session migration steps. Used by the contract registry. */
+export function getSessionMigrationSteps() {
+    return SESSION_STEPS;
+}
+// ─── TaskRecord ───────────────────────────────────────────────────────────────
+/**
+ * All registered TaskRecord migration steps.
+ *
+ * Currently empty — the schema is at its initial version (1.0.0).
+ * Future steps must be appended here and registered via the contract registry.
+ *
+ * Example: if `metadata` map is added to RuntimeTask in v1.1.0, a migration
+ * step would backfill it as an empty object for existing persisted records.
+ */
+const TASK_RECORD_STEPS = [
+// Example structure for future use:
+// {
+//   from: { major: 1, minor: 0, patch: 0 },
+//   to: { major: 1, minor: 1, patch: 0 },
+//   description: 'Add metadata object to task records',
+//   migrate: (data: unknown): unknown => {
+//     const d = data as Record<string, unknown>;
+//     return { ...d, metadata: d['metadata'] ?? {} };
+//   },
+// },
+];
+/** The current TaskRecord schema version (re-exported for convenience). */
+export const TASK_RECORD_VERSION = SCHEMA_VERSIONS.taskRecord;
+/** Returns all TaskRecord migration steps. Used by the contract registry. */
+export function getTaskRecordMigrationSteps() {
+    return TASK_RECORD_STEPS;
+}

package/dist/_internal/platform/runtime/correlation.d.ts

@@ -0,0 +1,44 @@
+/**
+ * OBS-15: AsyncLocalStorage-based correlation context for request/session/turn/run scoping.
+ *
+ * Seed at HTTP entry points and session/turn creation so downstream events can
+ * automatically attach the correct IDs without explicit threading.
+ *
+ * Usage:
+ * ```ts
+ * // Seed at HTTP request entry:
+ * correlationCtx.run({ requestId: crypto.randomUUID() }, () => handler(req));
+ *
+ * // Read anywhere downstream:
+ * const { requestId, sessionId } = getCorrelationContext();
+ * ```
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+/** Correlation identifiers propagated via AsyncLocalStorage. */
+export interface CorrelationContext {
+    /** HTTP request ID — seeded by the HTTP listener on every inbound request. */
+    readonly requestId?: string;
+    /** Session ID — seeded when a session starts or resumes. */
+    readonly sessionId?: string;
+    /** Run ID — seeded when a run (multi-turn conversation) begins. */
+    readonly runId?: string;
+    /** Turn ID — seeded when a turn starts within a run. */
+    readonly turnId?: string;
+}
+/** The singleton AsyncLocalStorage instance for correlation context. */
+export declare const correlationCtx: AsyncLocalStorage<CorrelationContext>;
+/**
+ * Get the current correlation context, or an empty object if none is active.
+ * Safe to call from anywhere — returns {} when no context is running.
+ */
+export declare function getCorrelationContext(): Readonly<CorrelationContext>;
+/**
+ * Run a function within a new correlation context that inherits the current
+ * context and overrides the provided fields.
+ */
+export declare function withCorrelation<T>(overrides: Partial<CorrelationContext>, fn: () => T): T;
+/**
+ * Run an async function within a new correlation context.
+ */
+export declare function withCorrelationAsync<T>(overrides: Partial<CorrelationContext>, fn: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=correlation.d.ts.map

package/dist/_internal/platform/runtime/correlation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"correlation.d.ts","sourceRoot":"","sources":["../../../../src/_internal/platform/runtime/correlation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc,uCAA8C,CAAC;AAE1E;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,QAAQ,CAAC,kBAAkB,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAC/B,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,EACtC,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAGH;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,EACtC,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAGZ"}

package/dist/_internal/platform/runtime/correlation.js

@@ -0,0 +1,40 @@
+/**
+ * OBS-15: AsyncLocalStorage-based correlation context for request/session/turn/run scoping.
+ *
+ * Seed at HTTP entry points and session/turn creation so downstream events can
+ * automatically attach the correct IDs without explicit threading.
+ *
+ * Usage:
+ * ```ts
+ * // Seed at HTTP request entry:
+ * correlationCtx.run({ requestId: crypto.randomUUID() }, () => handler(req));
+ *
+ * // Read anywhere downstream:
+ * const { requestId, sessionId } = getCorrelationContext();
+ * ```
+ */
+import { AsyncLocalStorage } from 'node:async_hooks';
+/** The singleton AsyncLocalStorage instance for correlation context. */
+export const correlationCtx = new AsyncLocalStorage();
+/**
+ * Get the current correlation context, or an empty object if none is active.
+ * Safe to call from anywhere — returns {} when no context is running.
+ */
+export function getCorrelationContext() {
+    return correlationCtx.getStore() ?? {};
+}
+/**
+ * Run a function within a new correlation context that inherits the current
+ * context and overrides the provided fields.
+ */
+export function withCorrelation(overrides, fn) {
+    const current = correlationCtx.getStore() ?? {};
+    return correlationCtx.run({ ...current, ...overrides }, fn);
+}
+/**
+ * Run an async function within a new correlation context.
+ */
+export async function withCorrelationAsync(overrides, fn) {
+    const current = correlationCtx.getStore() ?? {};
+    return correlationCtx.run({ ...current, ...overrides }, fn);
+}

package/dist/_internal/platform/runtime/emitters/security.d.ts

@@ -28,4 +28,36 @@ export declare function emitTokenBlocked(bus: RuntimeEventBus, ctx: EmitterConte
     label: string;
     reason: 'scope_violation' | 'rotation_overdue' | 'scope_violation_and_rotation_overdue';
 }): void;
+/** Emit AUTH_SUCCEEDED when a user authenticates successfully. Never include credential values. */
+export declare function emitAuthSucceeded(bus: RuntimeEventBus, ctx: EmitterContext, data: {
+    username: string;
+    sessionId: string;
+    clientIp: string;
+    method: 'password' | 'cookie' | 'token';
+}): void;
+/** Emit AUTH_FAILED when an authentication attempt fails. Never include credential values. */
+export declare function emitAuthFailed(bus: RuntimeEventBus, ctx: EmitterContext, data: {
+    usernameAttempted: string;
+    clientIp: string;
+    reason: 'invalid_credentials' | 'rate_limited' | 'session_expired' | 'origin_denied' | 'unknown';
+}): void;
+/** Emit COMPANION_PAIR_REQUESTED when a pairing request is initiated. */
+export declare function emitCompanionPairRequested(bus: RuntimeEventBus, ctx: EmitterContext, data: {
+    clientIp: string;
+}): void;
+/** Emit COMPANION_PAIR_VERIFIED when a companion pairing is verified. */
+export declare function emitCompanionPairVerified(bus: RuntimeEventBus, ctx: EmitterContext, data: {
+    tokenId: string;
+    clientIp: string;
+}): void;
+/** Emit COMPANION_TOKEN_ROTATED when a companion token is rotated. */
+export declare function emitCompanionTokenRotated(bus: RuntimeEventBus, ctx: EmitterContext, data: {
+    newTokenId: string;
+    clientIp: string;
+}): void;
+/** Emit COMPANION_TOKEN_REVOKED when a companion token is revoked. */
+export declare function emitCompanionTokenRevoked(bus: RuntimeEventBus, ctx: EmitterContext, data: {
+    clientIp: string;
+    reason?: string;
+}): void;
 //# sourceMappingURL=security.d.ts.map

package/dist/_internal/platform/runtime/emitters/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/emitters/security.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAUjD,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,GACjF,IAAI,CAEN;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzF,IAAI,CAEN;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxF,IAAI,CAEN;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IACJ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,iBAAiB,GAAG,kBAAkB,GAAG,sCAAsC,CAAC;CACzF,GACA,IAAI,CAEN"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../../../src/_internal/platform/runtime/emitters/security.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAUjD,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,GACjF,IAAI,CAEN;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzF,IAAI,CAEN;AAED,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxF,IAAI,CAEN;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IACJ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,iBAAiB,GAAG,kBAAkB,GAAG,sCAAsC,CAAC;CACzF,GACA,IAAI,CAEN;AAID,mGAAmG;AACnG,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,OAAO,CAAA;CAAE,GACvG,IAAI,CAEN;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAC5B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IACJ,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,qBAAqB,GAAG,cAAc,GAAG,iBAAiB,GAAG,eAAe,GAAG,SAAS,CAAC;CAClG,GACA,IAAI,CAEN;AAID,yEAAyE;AACzE,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzB,IAAI,CAEN;AAED,yEAAyE;AACzE,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC1C,IAAI,CAEN;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC7C,IAAI,CAEN;AAED,sEAAsE;AACtE,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,IAAI,CAEN"}

package/dist/_internal/platform/runtime/emitters/security.js

@@ -17,3 +17,29 @@ export function emitTokenRotationExpired(bus, ctx, data) {
 export function emitTokenBlocked(bus, ctx, data) {
     bus.emit('security', securityEvent('TOKEN_BLOCKED', data, ctx));
 }
+// ── Auth audit emitters (OBS-02) ────────────────────────────────────────────
+/** Emit AUTH_SUCCEEDED when a user authenticates successfully. Never include credential values. */
+export function emitAuthSucceeded(bus, ctx, data) {
+    bus.emit('security', securityEvent('AUTH_SUCCEEDED', data, ctx));
+}
+/** Emit AUTH_FAILED when an authentication attempt fails. Never include credential values. */
+export function emitAuthFailed(bus, ctx, data) {
+    bus.emit('security', securityEvent('AUTH_FAILED', data, ctx));
+}
+// ── Companion pairing emitters (OBS-21) ──────────────────────────────────
+/** Emit COMPANION_PAIR_REQUESTED when a pairing request is initiated. */
+export function emitCompanionPairRequested(bus, ctx, data) {
+    bus.emit('security', securityEvent('COMPANION_PAIR_REQUESTED', data, ctx));
+}
+/** Emit COMPANION_PAIR_VERIFIED when a companion pairing is verified. */
+export function emitCompanionPairVerified(bus, ctx, data) {
+    bus.emit('security', securityEvent('COMPANION_PAIR_VERIFIED', data, ctx));
+}
+/** Emit COMPANION_TOKEN_ROTATED when a companion token is rotated. */
+export function emitCompanionTokenRotated(bus, ctx, data) {
+    bus.emit('security', securityEvent('COMPANION_TOKEN_ROTATED', data, ctx));
+}
+/** Emit COMPANION_TOKEN_REVOKED when a companion token is revoked. */
+export function emitCompanionTokenRevoked(bus, ctx, data) {
+    bus.emit('security', securityEvent('COMPANION_TOKEN_REVOKED', data, ctx));
+}