@skaile/transform-proxy 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.6.0
+
+### Minor Changes
+
+- 84c02a9: Less detection work behind the transform proxy, with the same protection.
+  
+  forge-anon: an `AnonSession` caches each text's detection and no longer discards it when the mapping grows; earlier texts are finished again against the new mapping without a detector run. Detection of overlapping `anonymize` calls runs in parallel, placeholder allocation stays serialized. New `session.anonymize(text, { detectors })` restricts the detectors per call, and `session.remember(raw)` restores a model reply and lets its resend skip detection. The `onnx` and `llm` detectors cache model results per chunk text in memory. The proxy module restores through `remember` and takes an optional `leafDetectors` map (detectors per text leaf kind).
+  
+  transform-proxy: the walkers rewrite all text leaves of a request concurrently; refusals are raised before any transform call. Transforms must accept overlapping `outbound` calls.
+
+## 0.5.1
+
+### Patch Changes
+
+- 21bab3c: The bin installs its SIGINT, SIGTERM and `--exit-with-stdin` handlers before it prints `listening`. A parent that stopped the proxy right after that line could kill it with the default signal action (exit 143) instead of a clean shutdown (exit 0). `runCli` takes an optional `onStart` callback, called after the proxy listens and before the `listening` line.
+
 ## 0.5.0
 
 - Library: the anon trace records what the proxy sends to the provider **after** the pipeline and what the model answers **before** restore, so a reviewer can check that no clear-text personal data reached the provider. `TransformProxyOptions.trace?: TraceSink` (synchronous `record(event: TraceEvent)`) gets one `request` line per proxied request on the wire routes and exactly one `response` or `error` line for it, linked by `requestId`. Without `trace`, nothing is recorded or hashed. A sink that throws is logged (`transform proxy: trace sink failed: <msg>`) and never reaches the client.

package/README.md

@@ -197,6 +197,7 @@ A module default-exports a `TransformModule`:
 - It returns a `TransformFactory`, which runs once per `(session, pipeline)`: `(ctx: { sessionId, facts, log }) => Transform`.
 - A `Transform` has `instruction?`, `outbound(text, leaf)`, `inbound(text)`, `inboundStream()`, `dispose?()`, `inspect?()` (host-only state, read through `proxy.inspect`; the walkers never call it) and `knownOriginals?()`.
 - `knownOriginals?(): Iterable<{ kind, value }>` returns the originals the instance has already replaced in this session, each with its kind (forge-anon: its mapping). Only the [leak check](#leak-check) reads them, as source `pipeline`; the values are never sent or logged. `composeTransforms` returns the union of all stages that implement it; a stage that throws is logged and skipped.
+- The walkers first check the whole request (refusals such as attachments or malformed slots come before any `outbound` call), then call `outbound` for every text leaf of the request at once and assemble the body in its original order. A transform must therefore accept overlapping `outbound` calls of one session; a stage that needs ordering (forge-anon allocates placeholders one call at a time) serializes internally. One rejected `outbound` fails the request.
 
 The Anthropic walker appends the pipeline `instruction` after the host's system prompt: a string `system` gets it after a blank line, a block array gets it as one more text block at the end, and an absent `system` becomes the instruction. The host's leading blocks stay first, because Claude Code gateways (TeamClaude) refuse Sonnet requests with 429 `rate_limit_error` when the system prompt does not start with the Claude Code blocks. The OpenAI walkers still put the instruction first: a leading `system` message in chat completions, a prefix of `instructions` in responses.
 
@@ -214,3 +215,4 @@ Connectors publish facts through `proxy.session(id).publisher(source)`. Facts ar
 - Fields the walkers do not rewrite (`tools`, metadata, unknown fields) are forwarded as they are. The [leak check](#leak-check) warns when one of them carries a known original; it does not block the request.
 - Leak warnings carry kind, source and JSON path, never the value. Trace files and any other `TraceSink` get the clear text that leaked: keep them local, never commit them, delete them once reviewed.
 - Mappings, facts, the signature cache and the trace hashes are kept in memory and are lost on restart.
+- omp writes the request of every HTTP 400 answer to `~/.omp/logs/http-400-requests/<id>.json` (mode `0644`). That copy is what omp sent to the proxy, before anonymization, so it holds the personal data in clear text. It stays on the machine; delete it when anon is in use.

package/dist/cli.d.mts

@@ -1,4 +1,4 @@
-import { i as TransformProxy } from "./server-DdXMr4yF.mjs";
+import { i as TransformProxy } from "./server-BWc1mocm.mjs";
 /** Environment variable that supplies the client token when `--token` is absent. */
 export declare const TOKEN_ENV = "SKAILE_TRANSFORM_PROXY_TOKEN";
 /** Environment variable with the trace directory (relative to cwd); overrides `--trace-dir` and the config's `trace.dir`. */
@@ -9,6 +9,11 @@ export interface CliEnvironment {
   readonly env: Readonly<Record<string, string | undefined>>;
   readonly stdout: (line: string) => void;
   readonly stderr: (line: string) => void;
+  /**
+   * Called once the proxy listens, before the `listening` line: a parent reacts to that line (with SIGTERM, or by
+   * closing stdin), so the caller's shutdown handlers must be in place by then.
+   */
+  readonly onStart?: (run: Required<CliRun>) => void;
 }
 /** `proxy` is set only when the server started; the caller owns its shutdown. */
 export interface CliRun {

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { d as createTransformProxy, o as resolveProxyConfig, p as createFileTraceSink, x as errorMessage } from "./config-DHxYF3Tv.mjs";
+import { a as createTransformProxy, s as createFileTraceSink, x as errorMessage, y as resolveProxyConfig } from "./server-DTSaU_aK.mjs";
 import { realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -77,12 +77,14 @@ async function runCli(argv, io) {
 			}) }
 		});
 		if (traceDir !== void 0) io.stderr(format("info", `trace: ${traceDir}`, []));
-		io.stdout(`listening ${proxy.url}`);
-		return {
+		const run = {
 			code: 0,
 			proxy,
 			exitWithStdin: values["exit-with-stdin"] === true
 		};
+		io.onStart?.(run);
+		io.stdout(`listening ${proxy.url}`);
+		return run;
 	} catch (err) {
 		io.stderr(errorMessage(err));
 		return { code: 1 };
@@ -112,27 +114,26 @@ if (isEntryPoint()) {
 		home: homedir(),
 		env: process.env,
 		stdout: (line) => console.log(line),
-		stderr: (line) => console.error(line)
+		stderr: (line) => console.error(line),
+		onStart: ({ proxy, exitWithStdin }) => {
+			let stopping = false;
+			const stop = () => {
+				if (stopping) return;
+				stopping = true;
+				proxy.close().then(() => process.exit(0), (err) => {
+					console.error(errorMessage(err));
+					process.exit(1);
+				});
+			};
+			process.once("SIGINT", stop);
+			process.once("SIGTERM", stop);
+			if (exitWithStdin) {
+				process.stdin.once("end", stop);
+				process.stdin.once("close", stop);
+				process.stdin.resume();
+			}
+		}
 	});
 	if (run.proxy === void 0) process.exitCode = run.code;
-	else {
-		const proxy = run.proxy;
-		let stopping = false;
-		const stop = () => {
-			if (stopping) return;
-			stopping = true;
-			proxy.close().then(() => process.exit(0), (err) => {
-				console.error(errorMessage(err));
-				process.exit(1);
-			});
-		};
-		process.once("SIGINT", stop);
-		process.once("SIGTERM", stop);
-		if (run.exitWithStdin === true) {
-			process.stdin.once("end", stop);
-			process.stdin.once("close", stop);
-			process.stdin.resume();
-		}
-	}
 }
 export { TOKEN_ENV, TRACE_DIR_ENV, runCli };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { _ as TraceSink, a as TransformProxyOptions, b as TransformModule, c as TransformSpec, d as SessionFactPublisher, f as SessionFacts, g as TraceLeak, h as TraceEvent, i as TransformProxy, l as Logger, m as TextLeafKind, n as SESSION_HEADER, o as UPSTREAM_HEADER, p as TextLeaf, r as TOKEN_HEADER, s as createTransformProxy, t as PIPELINE_HEADER, u as SessionFact, v as Transform, x as TransformSessionContext, y as TransformFactory } from "./server-DdXMr4yF.mjs";
+import { _ as TraceSink, a as TransformProxyOptions, b as TransformModule, c as TransformSpec, d as SessionFactPublisher, f as SessionFacts, g as TraceLeak, h as TraceEvent, i as TransformProxy, l as Logger, m as TextLeafKind, n as SESSION_HEADER, o as UPSTREAM_HEADER, p as TextLeaf, r as TOKEN_HEADER, s as createTransformProxy, t as PIPELINE_HEADER, u as SessionFact, v as Transform, x as TransformSessionContext, y as TransformFactory } from "./server-BWc1mocm.mjs";
 /** One stage's streamed inbound transformer, as returned by `Transform.inboundStream()`. */
 interface InboundStream {
   push(chunk: string): string;
@@ -10,14 +10,6 @@ interface InboundStream {
  * The empty list is the identity.
  */
 export declare function composeTransforms(stages: readonly Transform[], log?: Logger): Transform;
-/** Default logger: drops everything. Hosts pass their own `Logger`. */
-export declare const silentLogger: Logger;
-/** One session's facts: the read side for transforms and the per-source publishers for connectors. */
-interface SessionFactStore {
-  readonly facts: SessionFacts;
-  publisher(source: string): SessionFactPublisher;
-}
-export declare function createSessionFacts(): SessionFactStore;
 export declare const CONFIG_FILE_NAME = "transform-proxy.yaml";
 /** The YAML-backed subset of the proxy options. `baseDir` is the config file's directory. */
 interface ProxyConfig {
@@ -55,6 +47,14 @@ export declare function resolveProxyConfig(lookup: ConfigLookup): ResolvedProxyC
 export declare function loadProxyConfig(path: string): ProxyConfig;
 /** Validates an already-parsed config object. Exported for hosts that load YAML themselves. */
 export declare function parseProxyConfig(source: unknown, baseDir: string): ProxyConfig;
+/** One session's facts: the read side for transforms and the per-source publishers for connectors. */
+interface SessionFactStore {
+  readonly facts: SessionFacts;
+  publisher(source: string): SessionFactPublisher;
+}
+export declare function createSessionFacts(): SessionFactStore;
+/** Default logger: drops everything. Hosts pass their own `Logger`. */
+export declare const silentLogger: Logger;
 export declare const DEFAULT_TRACE_MAX_CHARS = 262144;
 /**
  * One JSON line (no trailing newline). When the JSON of `content` is longer than `maxChars`,

package/dist/index.mjs

@@ -1 +1 @@
-export { t as CONFIG_FILE_NAME, f as DEFAULT_TRACE_MAX_CHARS, s as PIPELINE_HEADER, c as SESSION_HEADER, l as TOKEN_HEADER, u as UPSTREAM_HEADER, v as UnsupportedContentError, _ as anthropicWalker, b as composeTransforms, n as configCandidates, p as createFileTraceSink, y as createSessionFacts, d as createTransformProxy, r as findProxyConfig, i as loadProxyConfig, g as openaiChatWalker, h as openaiResponsesWalker, a as parseProxyConfig, o as resolveProxyConfig, m as serializeTraceEvent, S as silentLogger } from "./config-DHxYF3Tv.mjs";
+export { m as CONFIG_FILE_NAME, o as DEFAULT_TRACE_MAX_CHARS, t as PIPELINE_HEADER, n as SESSION_HEADER, r as TOKEN_HEADER, i as UPSTREAM_HEADER, f as UnsupportedContentError, d as anthropicWalker, b as composeTransforms, h as configCandidates, s as createFileTraceSink, p as createSessionFacts, a as createTransformProxy, g as findProxyConfig, _ as loadProxyConfig, u as openaiChatWalker, l as openaiResponsesWalker, v as parseProxyConfig, y as resolveProxyConfig, c as serializeTraceEvent, S as silentLogger } from "./server-DTSaU_aK.mjs";

package/dist/omp/index.mjs

@@ -1,7 +1,7 @@
-import { c as SESSION_HEADER, i as loadProxyConfig, l as TOKEN_HEADER, n as configCandidates, r as findProxyConfig, u as UPSTREAM_HEADER, x as errorMessage } from "../config-DHxYF3Tv.mjs";
-import { randomBytes, randomUUID } from "node:crypto";
+import { _ as loadProxyConfig, g as findProxyConfig, h as configCandidates, i as UPSTREAM_HEADER, n as SESSION_HEADER, r as TOKEN_HEADER, x as errorMessage } from "../server-DTSaU_aK.mjs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { randomBytes, randomUUID } from "node:crypto";
 import { fileURLToPath } from "node:url";
 import { homedir } from "node:os";
 import { spawn } from "node:child_process";

package/dist/{server-DdXMr4yF.d.mts → server-BWc1mocm.d.mts}

@@ -14,7 +14,10 @@ interface TextLeaf {
 interface Transform {
   /** Added to the system prompt by each wire walker (Anthropic: appended last; OpenAI: placed first); omit when the model needs no instruction. */
   readonly instruction?: string;
-  /** Host -> model, one text leaf. A throw refuses the request (502 `transform_failed`); nothing is sent. */
+  /**
+   * Host -> model, one text leaf. The leaves of one request are rewritten concurrently, so calls of one instance may
+   * overlap. A throw refuses the request (502 `transform_failed`); nothing is sent.
+   */
   outbound(text: string, leaf: TextLeaf): Promise<string>;
   /** Model -> host, one complete text. */
   inbound(text: string): string;
@@ -146,7 +149,7 @@ interface TransformProxy {
   /**
    * Host-only, in-process: each stage's `inspect()` result of the session's pipeline instance, keyed by transform id.
    * `{}` when the session or pipeline is unknown, the instance is not built, or its build failed.
-   * Never builds an instance or creates session state; there is no HTTP route for it.
+   * Never builds an instance or creates session state; there is no HTTP route for it. Rejects when a stage's `inspect()` throws.
    */
   inspect(sessionId: string, pipelineId?: string): Promise<Record<string, unknown>>;
   close(): Promise<void>;

package/dist/{config-DHxYF3Tv.mjs → server-DTSaU_aK.mjs}

@@ -1,10 +1,10 @@
 import { createRequire } from "node:module";
-import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
-import { createServer } from "node:http";
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
 import { parse } from "yaml";
+import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { pathToFileURL } from "node:url";
 // src/log.ts
 /** Default logger: drops everything. Hosts pass their own `Logger`. */
 const silentLogger = {
@@ -92,6 +92,112 @@ function composeStreams(streams) {
 		}
 	};
 }
+// src/config.ts
+const CONFIG_FILE_NAME = "transform-proxy.yaml";
+/** The implicit lookup locations, in order: `./.skaile/` then `~/.config/skaile/`. */
+function configCandidates(cwd, home) {
+	return [join(cwd, ".skaile", CONFIG_FILE_NAME), join(home, ".config", "skaile", CONFIG_FILE_NAME)];
+}
+/**
+* Finds the config file: the explicit path when given (it must exist), otherwise the first
+* existing implicit candidate. Returns `undefined` when no implicit candidate exists.
+*/
+function findProxyConfig(lookup) {
+	if (lookup.explicit !== void 0) {
+		const path = resolve(lookup.cwd, lookup.explicit);
+		if (!existsSync(path)) throw new Error(`transform proxy config not found: ${path}`);
+		return path;
+	}
+	return configCandidates(lookup.cwd, lookup.home).find((candidate) => existsSync(candidate));
+}
+/** Finds and loads the config. Throws, naming the searched paths, when none is found. */
+function resolveProxyConfig(lookup) {
+	const path = findProxyConfig(lookup);
+	if (path === void 0) {
+		const searched = configCandidates(lookup.cwd, lookup.home).join(", ");
+		throw new Error(`no transform proxy config found (pass --config, or create one at ${searched})`);
+	}
+	return {
+		path,
+		options: loadProxyConfig(path)
+	};
+}
+const TOP_LEVEL_KEYS = {
+	transforms: true,
+	pipelines: true,
+	defaultPipeline: true,
+	allowUpstreams: true,
+	trace: true
+};
+const TRACE_KEYS = {
+	dir: true,
+	maxChars: true
+};
+/** Reads and validates a YAML config file. Unknown keys are rejected so that typos fail loudly. */
+function loadProxyConfig(path) {
+	const source = parse(readFileSync(path, "utf8"));
+	try {
+		return parseProxyConfig(source ?? {}, dirname(path));
+	} catch (err) {
+		throw new Error(`invalid transform proxy config ${path}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+}
+/** Validates an already-parsed config object. Exported for hosts that load YAML themselves. */
+function parseProxyConfig(source, baseDir) {
+	if (!isRecord$1(source)) throw new Error("the document must be a mapping");
+	for (const key of Object.keys(source)) if (!Object.hasOwn(TOP_LEVEL_KEYS, key)) throw new Error(`unknown key "${key}"`);
+	return {
+		baseDir,
+		transforms: parseTransforms(source.transforms),
+		pipelines: parsePipelines(source.pipelines),
+		...source.defaultPipeline === void 0 ? {} : { defaultPipeline: requireString(source.defaultPipeline, "defaultPipeline") },
+		...source.allowUpstreams === void 0 ? {} : { allowUpstreams: requireStringList(source.allowUpstreams, "allowUpstreams") },
+		...source.trace === void 0 ? {} : { trace: parseTrace(source.trace, baseDir) }
+	};
+}
+function parseTransforms(value) {
+	if (value === void 0) return {};
+	if (!isRecord$1(value)) throw new Error("transforms must be a mapping of transform id to { module, config }");
+	const out = {};
+	for (const [id, spec] of Object.entries(value)) {
+		if (!isRecord$1(spec)) throw new Error(`transforms.${id} must be a mapping with a module`);
+		const module = requireString(spec.module, `transforms.${id}.module`);
+		out[id] = spec.config === void 0 ? { module } : {
+			module,
+			config: spec.config
+		};
+	}
+	return out;
+}
+function parsePipelines(value) {
+	if (value === void 0) return {};
+	if (!isRecord$1(value)) throw new Error("pipelines must be a mapping of pipeline id to a list of transform ids");
+	const out = {};
+	for (const [id, stages] of Object.entries(value)) out[id] = requireStringList(stages, `pipelines.${id}`);
+	return out;
+}
+function parseTrace(value, baseDir) {
+	if (!isRecord$1(value)) throw new Error("trace must be a mapping with a dir");
+	for (const key of Object.keys(value)) if (!Object.hasOwn(TRACE_KEYS, key)) throw new Error(`unknown key "trace.${key}"`);
+	const dir = resolve(baseDir, requireString(value.dir, "trace.dir"));
+	if (value.maxChars === void 0) return { dir };
+	if (typeof value.maxChars !== "number" || !Number.isInteger(value.maxChars) || value.maxChars <= 0) throw new Error("trace.maxChars must be a positive integer");
+	return {
+		dir,
+		maxChars: value.maxChars
+	};
+}
+function requireString(value, field) {
+	if (typeof value !== "string" || value === "") throw new Error(`${field} must be a non-empty string`);
+	return value;
+}
+function requireStringList(value, field) {
+	if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item === "")) throw new Error(`${field} must be a list of non-empty strings`);
+	return value;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 // src/facts.ts
 function createSessionFacts() {
 	const bySource = /* @__PURE__ */ new Map();
@@ -256,17 +362,17 @@ function resolveImportCondition(specifier, root) {
 	}
 }
 function exportTarget(exports, subpath) {
-	return conditionTarget((isRecord$1(exports) && Object.keys(exports).some((key) => key.startsWith(".")) ? exports : { ".": exports })[subpath]);
+	return conditionTarget((isRecord(exports) && Object.keys(exports).some((key) => key.startsWith(".")) ? exports : { ".": exports })[subpath]);
 }
 function conditionTarget(entry) {
 	if (typeof entry === "string") return entry;
-	if (!isRecord$1(entry)) return void 0;
+	if (!isRecord(entry)) return void 0;
 	return conditionTarget(entry.import) ?? conditionTarget(entry.default);
 }
 function isTransformModule(value) {
-	return isRecord$1(value) && typeof value.id === "string" && typeof value.open === "function";
+	return isRecord(value) && typeof value.id === "string" && typeof value.open === "function";
 }
-function isRecord$1(value) {
+function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 // src/wire/json-args.ts
@@ -410,28 +516,37 @@ function refuse$1(block) {
 function malformed$2(slot) {
 	throw new UnsupportedContentError(`Anthropic ${slot} has an unexpected shape`);
 }
-async function outbound$2(transform, text, leaf) {
-	return text === "" ? text : transform.outbound(text, leaf);
+/** Starts every queued rewrite at once; resolves when all results are written back, rejects on the first failure. */
+async function runAll$2(pending) {
+	await Promise.all(pending.map((run) => run()));
+}
+/** Queues the rewrite of one text leaf; `set` later replaces the original, which stays in place until then. */
+function queue$2(pending, transform, text, leaf, set) {
+	if (text !== "") pending.push(async () => set(await transform.outbound(text, leaf)));
 }
 /** A string, or an array of blocks whose `text` blocks are rewritten; anything else is refused. */
-async function rewriteText(content, slot, rewrite) {
-	if (typeof content === "string") return rewrite(content);
-	if (!Array.isArray(content)) return malformed$2(slot);
+function rewriteText(content, slot, rewrite, set) {
+	if (typeof content === "string") {
+		rewrite(content, set);
+		return;
+	}
+	if (!Array.isArray(content)) malformed$2(slot);
 	const out = [];
 	for (const block of content) {
-		if (!isObj$2(block)) return malformed$2(`${slot} block`);
+		if (!isObj$2(block)) malformed$2(`${slot} block`);
 		refuse$1(block);
 		if (block.type !== "text") {
 			out.push(block);
 			continue;
 		}
-		if (typeof block.text !== "string") return malformed$2(`${slot} text block`);
-		out.push({
-			...block,
-			text: await rewrite(block.text)
+		if (typeof block.text !== "string") malformed$2(`${slot} text block`);
+		const copy = { ...block };
+		out.push(copy);
+		rewrite(block.text, (text) => {
+			copy.text = text;
 		});
 	}
-	return out;
+	set(out);
 }
 /**
 * Host-written system text that Anthropic's Claude subscription (OAuth) check reads verbatim: the
@@ -448,24 +563,37 @@ function gatePrefix(text) {
 	const end = text.indexOf("\n");
 	return end === -1 ? text : text.slice(0, end);
 }
-async function rewriteSystemText(text, transform) {
+function rewriteSystemText(text, transform, pending, set) {
 	const kept = gatePrefix(text);
-	return kept + await outbound$2(transform, text.slice(kept.length), { kind: "system" });
+	queue$2(pending, transform, text.slice(kept.length), { kind: "system" }, (rest) => set(kept + rest));
 }
 /** Every string leaf of a JSON value (tool-call input); keys stay as they are. */
-async function rewriteStrings$2(value, leaf, transform) {
-	if (typeof value === "string") return outbound$2(transform, value, leaf);
+function rewriteStrings$2(value, leaf, transform, pending, set) {
+	if (typeof value === "string") {
+		queue$2(pending, transform, value, leaf, set);
+		return;
+	}
 	if (Array.isArray(value)) {
 		const out = [];
-		for (const item of value) out.push(await rewriteStrings$2(item, leaf, transform));
-		return out;
+		for (const item of value) {
+			const index = out.push(item) - 1;
+			rewriteStrings$2(item, leaf, transform, pending, (rewritten) => {
+				out[index] = rewritten;
+			});
+		}
+		set(out);
+		return;
 	}
 	if (isObj$2(value)) {
 		const out = {};
-		for (const [key, item] of Object.entries(value)) out[key] = await rewriteStrings$2(item, leaf, transform);
-		return out;
+		for (const [key, item] of Object.entries(value)) {
+			out[key] = item;
+			rewriteStrings$2(item, leaf, transform, pending, (rewritten) => {
+				out[key] = rewritten;
+			});
+		}
+		set(out);
 	}
-	return value;
 }
 /** Every string leaf of a JSON value, restored inbound. */
 function restoreStrings$1(value, transform) {
@@ -479,7 +607,7 @@ function restoreStrings$1(value, transform) {
 	return value;
 }
 /** A thinking block: swaps in the cached model text when its signature is known, else rewrites it. */
-async function rewriteThinking(block, ctx) {
+function rewriteThinking(block, ctx, pending) {
 	if (typeof block.thinking !== "string") return malformed$2("thinking block");
 	if (typeof block.signature === "string") {
 		const cached = ctx.signatures.get(signatureKey$1(block.signature));
@@ -488,38 +616,48 @@ async function rewriteThinking(block, ctx) {
 			thinking: cached
 		};
 	}
-	return {
-		...block,
-		thinking: await outbound$2(ctx.transform, block.thinking, { kind: "thinking" })
-	};
+	const copy = { ...block };
+	queue$2(pending, ctx.transform, block.thinking, { kind: "thinking" }, (text) => {
+		copy.thinking = text;
+	});
+	return copy;
 }
-async function rewriteContent$2(content, role, toolNames, ctx) {
+function rewriteContent$2(content, role, toolNames, ctx, pending, set) {
 	const textKind = role === "assistant" ? "assistant" : "user";
-	if (typeof content === "string") return outbound$2(ctx.transform, content, { kind: textKind });
-	if (!Array.isArray(content)) return malformed$2("message content");
+	if (typeof content === "string") {
+		queue$2(pending, ctx.transform, content, { kind: textKind }, set);
+		return;
+	}
+	if (!Array.isArray(content)) malformed$2("message content");
 	const out = [];
 	for (const block of content) {
-		if (!isObj$2(block)) return malformed$2("message content block");
+		if (!isObj$2(block)) malformed$2("message content block");
 		refuse$1(block);
 		switch (block.type) {
-			case "text":
-				if (typeof block.text !== "string") return malformed$2("text block");
-				out.push({
-					...block,
-					text: await outbound$2(ctx.transform, block.text, { kind: textKind })
+			case "text": {
+				if (typeof block.text !== "string") malformed$2("text block");
+				const copy = { ...block };
+				out.push(copy);
+				queue$2(pending, ctx.transform, block.text, { kind: textKind }, (text) => {
+					copy.text = text;
 				});
 				break;
+			}
 			case "thinking":
-				out.push(await rewriteThinking(block, ctx));
+				out.push(rewriteThinking(block, ctx, pending));
 				break;
 			case "tool_use": {
 				const toolName = typeof block.name === "string" ? block.name : void 0;
-				out.push({
+				const copy = {
 					...block,
-					input: await rewriteStrings$2(block.input, {
-						kind: "toolCall",
-						toolName
-					}, ctx.transform)
+					input: block.input
+				};
+				out.push(copy);
+				rewriteStrings$2(block.input, {
+					kind: "toolCall",
+					toolName
+				}, ctx.transform, pending, (input) => {
+					copy.input = input;
 				});
 				break;
 			}
@@ -529,19 +667,20 @@ async function rewriteContent$2(content, role, toolNames, ctx) {
 					break;
 				}
 				const toolName = typeof block.tool_use_id === "string" ? toolNames.get(block.tool_use_id) : void 0;
-				out.push({
-					...block,
-					content: await rewriteText(block.content, "tool_result content", (text) => outbound$2(ctx.transform, text, {
-						kind: "toolResult",
-						toolName
-					}))
+				const copy = { ...block };
+				out.push(copy);
+				rewriteText(block.content, "tool_result content", (text, setText) => queue$2(pending, ctx.transform, text, {
+					kind: "toolResult",
+					toolName
+				}, setText), (rewritten) => {
+					copy.content = rewritten;
 				});
 				break;
 			}
 			default: out.push(block);
 		}
 	}
-	return out;
+	set(out);
 }
 /** Maps each `tool_use` id to its tool name, so tool results can name their tool. */
 function toolNamesById(messages) {
@@ -752,21 +891,26 @@ const anthropicWalker = {
 	async request(body, ctx) {
 		if (!isObj$2(body)) return malformed$2("request body");
 		const out = { ...body };
-		if (body.system !== void 0) out.system = await rewriteText(body.system, "system", (text) => rewriteSystemText(text, ctx.transform));
-		if (ctx.transform.instruction !== void 0) out.system = withInstruction(out.system, ctx.transform.instruction);
+		const pending = [];
+		if (body.system !== void 0) rewriteText(body.system, "system", (text, set) => rewriteSystemText(text, ctx.transform, pending, set), (system) => {
+			out.system = system;
+		});
 		if (body.messages !== void 0) {
 			if (!Array.isArray(body.messages)) return malformed$2("messages");
 			const toolNames = toolNamesById(body.messages);
 			const messages = [];
 			for (const message of body.messages) {
 				if (!isObj$2(message)) return malformed$2("message");
-				messages.push({
-					...message,
-					content: await rewriteContent$2(message.content, message.role, toolNames, ctx)
+				const copy = { ...message };
+				messages.push(copy);
+				rewriteContent$2(message.content, message.role, toolNames, ctx, pending, (content) => {
+					copy.content = content;
 				});
 			}
 			out.messages = messages;
 		}
+		await runAll$2(pending);
+		if (ctx.transform.instruction !== void 0) out.system = withInstruction(out.system, ctx.transform.instruction);
 		return out;
 	},
 	response(body, ctx) {
@@ -809,47 +953,69 @@ const REFUSED_PARTS$1 = {
 };
 /** Reasoning fields used by OpenAI-compatible providers. */
 const REASONING_FIELDS = ["reasoning_content", "reasoning"];
-async function outbound$1(transform, text, leaf) {
-	return text === "" ? text : transform.outbound(text, leaf);
+/** Starts every queued rewrite at once; resolves when all results are written back, rejects on the first failure. */
+async function runAll$1(pending) {
+	await Promise.all(pending.map((run) => run()));
+}
+/** Queues the rewrite of one text leaf; `set` later replaces the original, which stays in place until then. */
+function queue$1(pending, transform, text, leaf, set) {
+	if (text !== "") pending.push(async () => set(await transform.outbound(text, leaf)));
 }
 /** A slot the walker reads holds a value it cannot classify: refused, never forwarded untransformed. */
 function malformed$1(slot) {
 	throw new UnsupportedContentError(`OpenAI chat ${slot} has an unexpected shape`);
 }
 /** A string, or an array of parts whose `text` parts are rewritten; `null`/absent carries no text; anything else is refused. */
-async function rewriteContent$1(content, leaf, transform) {
-	if (typeof content === "string") return outbound$1(transform, content, leaf);
-	if (content === void 0 || content === null) return content;
-	if (!Array.isArray(content)) return malformed$1("message content");
+function rewriteContent$1(content, leaf, transform, pending, set) {
+	if (typeof content === "string") {
+		queue$1(pending, transform, content, leaf, set);
+		return;
+	}
+	if (content === void 0 || content === null) return;
+	if (!Array.isArray(content)) malformed$1("message content");
 	const out = [];
 	for (const part of content) {
-		if (!isObj$1(part)) return malformed$1("content part");
+		if (!isObj$1(part)) malformed$1("content part");
 		if (typeof part.type === "string" && REFUSED_PARTS$1[part.type] === true) throw new UnsupportedContentError(`OpenAI chat ${part.type} content cannot be transformed`);
 		if (part.type !== "text") {
 			out.push(part);
 			continue;
 		}
-		if (typeof part.text !== "string") return malformed$1("text part");
-		out.push({
-			...part,
-			text: await outbound$1(transform, part.text, leaf)
+		if (typeof part.text !== "string") malformed$1("text part");
+		const copy = { ...part };
+		out.push(copy);
+		queue$1(pending, transform, part.text, leaf, (text) => {
+			copy.text = text;
 		});
 	}
-	return out;
+	set(out);
 }
-async function rewriteStrings$1(value, leaf, transform) {
-	if (typeof value === "string") return outbound$1(transform, value, leaf);
+function rewriteStrings$1(value, leaf, transform, pending, set) {
+	if (typeof value === "string") {
+		queue$1(pending, transform, value, leaf, set);
+		return;
+	}
 	if (Array.isArray(value)) {
 		const out = [];
-		for (const item of value) out.push(await rewriteStrings$1(item, leaf, transform));
-		return out;
+		for (const item of value) {
+			const index = out.push(item) - 1;
+			rewriteStrings$1(item, leaf, transform, pending, (rewritten) => {
+				out[index] = rewritten;
+			});
+		}
+		set(out);
+		return;
 	}
 	if (isObj$1(value)) {
 		const out = {};
-		for (const [key, item] of Object.entries(value)) out[key] = await rewriteStrings$1(item, leaf, transform);
-		return out;
+		for (const [key, item] of Object.entries(value)) {
+			out[key] = item;
+			rewriteStrings$1(item, leaf, transform, pending, (rewritten) => {
+				out[key] = rewritten;
+			});
+		}
+		set(out);
 	}
-	return value;
 }
 function restoreStrings(value, transform) {
 	if (typeof value === "string") return transform.inbound(value);
@@ -862,14 +1028,23 @@ function restoreStrings(value, transform) {
 	return value;
 }
 /** Tool-call arguments are a JSON string: rewrite its string leaves, or the raw text when it is not JSON. */
-async function rewriteArguments$1(args, leaf, transform) {
+function rewriteArguments$1(args, leaf, transform, pending, set) {
 	let parsed;
 	try {
 		parsed = JSON.parse(args);
 	} catch {
-		return outbound$1(transform, args, leaf);
+		queue$1(pending, transform, args, leaf, set);
+		return;
 	}
-	return JSON.stringify(await rewriteStrings$1(parsed, leaf, transform));
+	const leaves = [];
+	let rewritten = parsed;
+	rewriteStrings$1(parsed, leaf, transform, leaves, (value) => {
+		rewritten = value;
+	});
+	pending.push(async () => {
+		await runAll$1(leaves);
+		set(JSON.stringify(rewritten));
+	});
 }
 function restoreArguments$1(args, transform) {
 	let parsed;
@@ -880,7 +1055,7 @@ function restoreArguments$1(args, transform) {
 	}
 	return JSON.stringify(restoreStrings(parsed, transform));
 }
-async function rewriteToolCalls(calls, transform, names) {
+function rewriteToolCalls(calls, transform, names, pending) {
 	if (calls === void 0 || calls === null) return calls;
 	if (!Array.isArray(calls)) return malformed$1("tool_calls");
 	const out = [];
@@ -894,53 +1069,59 @@ async function rewriteToolCalls(calls, transform, names) {
 		if (!isObj$1(fn) || typeof fn.arguments !== "string") return malformed$1("function tool call");
 		const toolName = typeof fn.name === "string" ? fn.name : void 0;
 		if (typeof call.id === "string" && toolName !== void 0) names.set(call.id, toolName);
+		const fnCopy = { ...fn };
 		out.push({
 			...call,
-			function: {
-				...fn,
-				arguments: await rewriteArguments$1(fn.arguments, {
-					kind: "toolCall",
-					toolName
-				}, transform)
-			}
+			function: fnCopy
+		});
+		rewriteArguments$1(fn.arguments, {
+			kind: "toolCall",
+			toolName
+		}, transform, pending, (args) => {
+			fnCopy.arguments = args;
 		});
 	}
 	return out;
 }
-async function rewriteMessage(message, transform, names) {
+function rewriteMessage(message, transform, names, pending) {
 	const out = { ...message };
+	const setContent = (content) => {
+		out.content = content;
+	};
 	switch (message.role) {
 		case "system":
 		case "developer":
-			out.content = await rewriteContent$1(message.content, { kind: "system" }, transform);
+			rewriteContent$1(message.content, { kind: "system" }, transform, pending, setContent);
 			break;
 		case "user":
-			out.content = await rewriteContent$1(message.content, { kind: "user" }, transform);
+			rewriteContent$1(message.content, { kind: "user" }, transform, pending, setContent);
 			break;
 		case "assistant":
 			for (const field of REASONING_FIELDS) {
 				const value = message[field];
-				if (typeof value === "string") out[field] = await outbound$1(transform, value, { kind: "thinking" });
+				if (typeof value === "string") queue$1(pending, transform, value, { kind: "thinking" }, (text) => {
+					out[field] = text;
+				});
 				else if (value !== void 0 && value !== null) return malformed$1(`assistant ${field}`);
 			}
-			out.content = await rewriteContent$1(message.content, { kind: "assistant" }, transform);
-			out.tool_calls = await rewriteToolCalls(message.tool_calls, transform, names);
+			rewriteContent$1(message.content, { kind: "assistant" }, transform, pending, setContent);
+			out.tool_calls = rewriteToolCalls(message.tool_calls, transform, names, pending);
 			if (message.tool_calls === void 0) delete out.tool_calls;
 			break;
 		case "tool": {
 			const toolName = typeof message.tool_call_id === "string" ? names.get(message.tool_call_id) : void 0;
-			out.content = await rewriteContent$1(message.content, {
+			rewriteContent$1(message.content, {
 				kind: "toolResult",
 				toolName
-			}, transform);
+			}, transform, pending, setContent);
 			break;
 		}
 		case "function": {
 			const toolName = typeof message.name === "string" ? message.name : void 0;
-			out.content = await rewriteContent$1(message.content, {
+			rewriteContent$1(message.content, {
 				kind: "toolResult",
 				toolName
-			}, transform);
+			}, transform, pending, setContent);
 			break;
 		}
 		default: return malformed$1("message role");
@@ -1192,11 +1373,13 @@ const openaiChatWalker = {
 		if (body.messages !== void 0) {
 			if (!Array.isArray(body.messages)) return malformed$1("messages");
 			const names = /* @__PURE__ */ new Map();
+			const pending = [];
 			const messages = [];
 			for (const message of body.messages) {
 				if (!isObj$1(message)) return malformed$1("message");
-				messages.push(await rewriteMessage(message, ctx.transform, names));
+				messages.push(rewriteMessage(message, ctx.transform, names, pending));
 			}
+			await runAll$1(pending);
 			if (ctx.transform.instruction !== void 0) messages.unshift({
 				role: "system",
 				content: ctx.transform.instruction
@@ -1251,56 +1434,87 @@ const signatureKey = (itemId) => `responses:${itemId}`;
 function refuse(part) {
 	if (typeof part.type === "string" && REFUSED_PARTS[part.type] === true) throw new UnsupportedContentError(`OpenAI responses ${part.type} content cannot be transformed`);
 }
-async function outbound(transform, text, leaf) {
-	return text === "" ? text : transform.outbound(text, leaf);
+/** Starts every queued rewrite at once; resolves when all results are written back, rejects on the first failure. */
+async function runAll(pending) {
+	await Promise.all(pending.map((run) => run()));
+}
+/** Queues the rewrite of one text leaf; `set` later replaces the original, which stays in place until then. */
+function queue(pending, transform, text, leaf, set) {
+	if (text !== "") pending.push(async () => set(await transform.outbound(text, leaf)));
 }
 /** A slot the walker reads holds a value it cannot classify: refused, never forwarded untransformed. */
 function malformed(slot) {
 	throw new UnsupportedContentError(`OpenAI responses ${slot} has an unexpected shape`);
 }
 /** A string, or an array of parts whose `input_text`/`output_text` parts are rewritten; anything else is refused. */
-async function rewriteContent(content, slot, leaf, transform) {
-	if (typeof content === "string") return outbound(transform, content, leaf);
-	if (!Array.isArray(content)) return malformed(slot);
+function rewriteContent(content, slot, leaf, transform, pending, set) {
+	if (typeof content === "string") {
+		queue(pending, transform, content, leaf, set);
+		return;
+	}
+	if (!Array.isArray(content)) malformed(slot);
 	const out = [];
 	for (const part of content) {
-		if (!isObj(part)) return malformed(`${slot} part`);
+		if (!isObj(part)) malformed(`${slot} part`);
 		refuse(part);
 		if (part.type !== "input_text" && part.type !== "output_text") {
 			out.push(part);
 			continue;
 		}
-		if (typeof part.text !== "string") return malformed(`${slot} ${part.type} part`);
-		out.push({
-			...part,
-			text: await outbound(transform, part.text, leaf)
+		if (typeof part.text !== "string") malformed(`${slot} ${part.type} part`);
+		const copy = { ...part };
+		out.push(copy);
+		queue(pending, transform, part.text, leaf, (text) => {
+			copy.text = text;
 		});
 	}
-	return out;
+	set(out);
 }
-async function rewriteStrings(value, leaf, transform) {
-	if (typeof value === "string") return outbound(transform, value, leaf);
+function rewriteStrings(value, leaf, transform, pending, set) {
+	if (typeof value === "string") {
+		queue(pending, transform, value, leaf, set);
+		return;
+	}
 	if (Array.isArray(value)) {
 		const out = [];
-		for (const item of value) out.push(await rewriteStrings(item, leaf, transform));
-		return out;
+		for (const item of value) {
+			const index = out.push(item) - 1;
+			rewriteStrings(item, leaf, transform, pending, (rewritten) => {
+				out[index] = rewritten;
+			});
+		}
+		set(out);
+		return;
 	}
 	if (isObj(value)) {
 		const out = {};
-		for (const [key, item] of Object.entries(value)) out[key] = await rewriteStrings(item, leaf, transform);
-		return out;
+		for (const [key, item] of Object.entries(value)) {
+			out[key] = item;
+			rewriteStrings(item, leaf, transform, pending, (rewritten) => {
+				out[key] = rewritten;
+			});
+		}
+		set(out);
 	}
-	return value;
 }
 /** Tool-call arguments: a JSON string whose string leaves are rewritten; raw text when it is not JSON. */
-async function rewriteArguments(args, leaf, transform) {
+function rewriteArguments(args, leaf, transform, pending, set) {
 	let parsed;
 	try {
 		parsed = JSON.parse(args);
 	} catch {
-		return outbound(transform, args, leaf);
+		queue(pending, transform, args, leaf, set);
+		return;
 	}
-	return JSON.stringify(await rewriteStrings(parsed, leaf, transform));
+	const leaves = [];
+	let rewritten = parsed;
+	rewriteStrings(parsed, leaf, transform, leaves, (value) => {
+		rewritten = value;
+	});
+	pending.push(async () => {
+		await runAll(leaves);
+		set(JSON.stringify(rewritten));
+	});
 }
 /** Restores the string values of a JSON text, keeping its formatting; restored originals are JSON-escaped. */
 function restoreArguments(args, transform) {
@@ -1324,16 +1538,26 @@ function cachedSummary(item, ctx) {
 	if (!Array.isArray(texts) || !Array.isArray(item.summary) || texts.length !== item.summary.length) return void 0;
 	return texts;
 }
-async function rewriteReasoning(item, ctx) {
+function rewriteReasoning(item, ctx, pending) {
 	if (item.summary === void 0) return item;
 	if (!Array.isArray(item.summary)) return malformed("reasoning summary");
 	for (const part of item.summary) if (!isObj(part) || typeof part.text !== "string") return malformed("reasoning summary part");
 	const cached = cachedSummary(item, ctx);
 	const summary = [];
-	for (const [i, part] of item.summary.entries()) summary.push({
-		...part,
-		text: cached !== void 0 ? cached[i] : await outbound(ctx.transform, part.text, { kind: "thinking" })
-	});
+	for (const [i, part] of item.summary.entries()) {
+		if (cached !== void 0) {
+			summary.push({
+				...part,
+				text: cached[i]
+			});
+			continue;
+		}
+		const copy = { ...part };
+		summary.push(copy);
+		queue(pending, ctx.transform, part.text, { kind: "thinking" }, (text) => {
+			copy.text = text;
+		});
+	}
 	return {
 		...item,
 		summary
@@ -1349,38 +1573,39 @@ function toolNamesByCallId(items) {
 	for (const item of items) if (isObj(item) && item.type === "function_call" && typeof item.call_id === "string" && typeof item.name === "string") names.set(item.call_id, item.name);
 	return names;
 }
-async function rewriteItem(item, toolNames, ctx) {
+function rewriteItem(item, toolNames, ctx, pending) {
+	const out = { ...item };
 	if (item.type === "message" || item.type === void 0 && item.role !== void 0) {
 		const kind = roleKind(item.role);
 		if (kind === void 0) return malformed("message role");
-		return {
-			...item,
-			content: await rewriteContent(item.content, "message content", { kind }, ctx.transform)
-		};
+		rewriteContent(item.content, "message content", { kind }, ctx.transform, pending, (content) => {
+			out.content = content;
+		});
+		return out;
 	}
 	switch (item.type) {
 		case "function_call": {
 			if (typeof item.arguments !== "string") return malformed("function_call arguments");
 			const toolName = typeof item.name === "string" ? item.name : void 0;
-			return {
-				...item,
-				arguments: await rewriteArguments(item.arguments, {
-					kind: "toolCall",
-					toolName
-				}, ctx.transform)
-			};
+			rewriteArguments(item.arguments, {
+				kind: "toolCall",
+				toolName
+			}, ctx.transform, pending, (args) => {
+				out.arguments = args;
+			});
+			return out;
 		}
 		case "function_call_output": {
 			const toolName = typeof item.call_id === "string" ? toolNames.get(item.call_id) : void 0;
-			return {
-				...item,
-				output: await rewriteContent(item.output, "function_call_output output", {
-					kind: "toolResult",
-					toolName
-				}, ctx.transform)
-			};
+			rewriteContent(item.output, "function_call_output output", {
+				kind: "toolResult",
+				toolName
+			}, ctx.transform, pending, (output) => {
+				out.output = output;
+			});
+			return out;
 		}
-		case "reasoning": return rewriteReasoning(item, ctx);
+		case "reasoning": return rewriteReasoning(item, ctx, pending);
 		default: return item;
 	}
 }
@@ -1570,20 +1795,26 @@ const openaiResponsesWalker = {
 	async request(body, ctx) {
 		if (!isObj(body)) return malformed("request body");
 		const out = { ...body };
-		if (typeof body.instructions === "string") out.instructions = await outbound(ctx.transform, body.instructions, { kind: "system" });
+		const pending = [];
+		if (typeof body.instructions === "string") queue(pending, ctx.transform, body.instructions, { kind: "system" }, (text) => {
+			out.instructions = text;
+		});
 		else if (body.instructions !== void 0 && body.instructions !== null) return malformed("instructions");
-		const instruction = ctx.transform.instruction;
-		if (instruction !== void 0) out.instructions = typeof out.instructions === "string" && out.instructions !== "" ? `${instruction}\n\n${out.instructions}` : instruction;
-		if (typeof body.input === "string") out.input = await outbound(ctx.transform, body.input, { kind: "user" });
+		if (typeof body.input === "string") queue(pending, ctx.transform, body.input, { kind: "user" }, (text) => {
+			out.input = text;
+		});
 		else if (Array.isArray(body.input)) {
 			const toolNames = toolNamesByCallId(body.input);
 			const input = [];
 			for (const item of body.input) {
 				if (!isObj(item)) return malformed("input item");
-				input.push(await rewriteItem(item, toolNames, ctx));
+				input.push(rewriteItem(item, toolNames, ctx, pending));
 			}
 			out.input = input;
 		} else if (body.input !== void 0) return malformed("input");
+		await runAll(pending);
+		const instruction = ctx.transform.instruction;
+		if (instruction !== void 0) out.instructions = typeof out.instructions === "string" && out.instructions !== "" ? `${instruction}\n\n${out.instructions}` : instruction;
 		return out;
 	},
 	response(body, ctx) {
@@ -2160,110 +2391,4 @@ function sendError(res, status, type, message) {
 		message
 	} }));
 }
-// src/config.ts
-const CONFIG_FILE_NAME = "transform-proxy.yaml";
-/** The implicit lookup locations, in order: `./.skaile/` then `~/.config/skaile/`. */
-function configCandidates(cwd, home) {
-	return [join(cwd, ".skaile", CONFIG_FILE_NAME), join(home, ".config", "skaile", CONFIG_FILE_NAME)];
-}
-/**
-* Finds the config file: the explicit path when given (it must exist), otherwise the first
-* existing implicit candidate. Returns `undefined` when no implicit candidate exists.
-*/
-function findProxyConfig(lookup) {
-	if (lookup.explicit !== void 0) {
-		const path = resolve(lookup.cwd, lookup.explicit);
-		if (!existsSync(path)) throw new Error(`transform proxy config not found: ${path}`);
-		return path;
-	}
-	return configCandidates(lookup.cwd, lookup.home).find((candidate) => existsSync(candidate));
-}
-/** Finds and loads the config. Throws, naming the searched paths, when none is found. */
-function resolveProxyConfig(lookup) {
-	const path = findProxyConfig(lookup);
-	if (path === void 0) {
-		const searched = configCandidates(lookup.cwd, lookup.home).join(", ");
-		throw new Error(`no transform proxy config found (pass --config, or create one at ${searched})`);
-	}
-	return {
-		path,
-		options: loadProxyConfig(path)
-	};
-}
-const TOP_LEVEL_KEYS = {
-	transforms: true,
-	pipelines: true,
-	defaultPipeline: true,
-	allowUpstreams: true,
-	trace: true
-};
-const TRACE_KEYS = {
-	dir: true,
-	maxChars: true
-};
-/** Reads and validates a YAML config file. Unknown keys are rejected so that typos fail loudly. */
-function loadProxyConfig(path) {
-	const source = parse(readFileSync(path, "utf8"));
-	try {
-		return parseProxyConfig(source ?? {}, dirname(path));
-	} catch (err) {
-		throw new Error(`invalid transform proxy config ${path}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
-	}
-}
-/** Validates an already-parsed config object. Exported for hosts that load YAML themselves. */
-function parseProxyConfig(source, baseDir) {
-	if (!isRecord(source)) throw new Error("the document must be a mapping");
-	for (const key of Object.keys(source)) if (!Object.hasOwn(TOP_LEVEL_KEYS, key)) throw new Error(`unknown key "${key}"`);
-	return {
-		baseDir,
-		transforms: parseTransforms(source.transforms),
-		pipelines: parsePipelines(source.pipelines),
-		...source.defaultPipeline === void 0 ? {} : { defaultPipeline: requireString(source.defaultPipeline, "defaultPipeline") },
-		...source.allowUpstreams === void 0 ? {} : { allowUpstreams: requireStringList(source.allowUpstreams, "allowUpstreams") },
-		...source.trace === void 0 ? {} : { trace: parseTrace(source.trace, baseDir) }
-	};
-}
-function parseTransforms(value) {
-	if (value === void 0) return {};
-	if (!isRecord(value)) throw new Error("transforms must be a mapping of transform id to { module, config }");
-	const out = {};
-	for (const [id, spec] of Object.entries(value)) {
-		if (!isRecord(spec)) throw new Error(`transforms.${id} must be a mapping with a module`);
-		const module = requireString(spec.module, `transforms.${id}.module`);
-		out[id] = spec.config === void 0 ? { module } : {
-			module,
-			config: spec.config
-		};
-	}
-	return out;
-}
-function parsePipelines(value) {
-	if (value === void 0) return {};
-	if (!isRecord(value)) throw new Error("pipelines must be a mapping of pipeline id to a list of transform ids");
-	const out = {};
-	for (const [id, stages] of Object.entries(value)) out[id] = requireStringList(stages, `pipelines.${id}`);
-	return out;
-}
-function parseTrace(value, baseDir) {
-	if (!isRecord(value)) throw new Error("trace must be a mapping with a dir");
-	for (const key of Object.keys(value)) if (!Object.hasOwn(TRACE_KEYS, key)) throw new Error(`unknown key "trace.${key}"`);
-	const dir = resolve(baseDir, requireString(value.dir, "trace.dir"));
-	if (value.maxChars === void 0) return { dir };
-	if (typeof value.maxChars !== "number" || !Number.isInteger(value.maxChars) || value.maxChars <= 0) throw new Error("trace.maxChars must be a positive integer");
-	return {
-		dir,
-		maxChars: value.maxChars
-	};
-}
-function requireString(value, field) {
-	if (typeof value !== "string" || value === "") throw new Error(`${field} must be a non-empty string`);
-	return value;
-}
-function requireStringList(value, field) {
-	if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item === "")) throw new Error(`${field} must be a list of non-empty strings`);
-	return value;
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-export { silentLogger as S, anthropicWalker as _, parseProxyConfig as a, composeTransforms as b, SESSION_HEADER as c, createTransformProxy as d, DEFAULT_TRACE_MAX_CHARS as f, openaiChatWalker as g, openaiResponsesWalker as h, loadProxyConfig as i, TOKEN_HEADER as l, serializeTraceEvent as m, configCandidates as n, resolveProxyConfig as o, createFileTraceSink as p, findProxyConfig as r, PIPELINE_HEADER as s, CONFIG_FILE_NAME as t, UPSTREAM_HEADER as u, UnsupportedContentError as v, errorMessage as x, createSessionFacts as y };
+export { silentLogger as S, loadProxyConfig as _, createTransformProxy as a, composeTransforms as b, serializeTraceEvent as c, anthropicWalker as d, UnsupportedContentError as f, findProxyConfig as g, configCandidates as h, UPSTREAM_HEADER as i, openaiResponsesWalker as l, CONFIG_FILE_NAME as m, SESSION_HEADER as n, DEFAULT_TRACE_MAX_CHARS as o, createSessionFacts as p, TOKEN_HEADER as r, createFileTraceSink as s, PIPELINE_HEADER as t, openaiChatWalker as u, parseProxyConfig as v, errorMessage as x, resolveProxyConfig as y };

package/package.json

@@ -1,16 +1,17 @@
 {
   "name": "@skaile/transform-proxy",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "type": "module",
   "description": "Same-protocol passthrough proxy that runs model requests and replies through a chain of text transforms (Anthropic Messages, OpenAI chat, OpenAI responses)",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/skaile-ai/skaile-transform-proxy.git"
+    "url": "git+https://github.com/skaile-ai/forge.git",
+    "directory": "packages/transform-proxy"
   },
-  "homepage": "https://github.com/skaile-ai/skaile-transform-proxy#readme",
+  "homepage": "https://github.com/skaile-ai/forge/tree/main/packages/transform-proxy#readme",
   "bugs": {
-    "url": "https://github.com/skaile-ai/skaile-transform-proxy/issues"
+    "url": "https://github.com/skaile-ai/forge/issues"
   },
   "keywords": [
     "llm",
@@ -54,9 +55,10 @@
   "scripts": {
     "prebuild": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "tsdown",
-    "prepare": "npm run build",
-    "test": "bun test",
-    "typecheck": "tsc --noEmit"
+    "prepublishOnly": "npm run build",
+    "test": "bun --bun vitest run",
+    "typecheck": "tsc --noEmit",
+    "check": "bun ../../scripts/check-package.ts"
   },
   "dependencies": {
     "yaml": "^2.9.0"
@@ -64,7 +66,6 @@
   "devDependencies": {
     "@types/bun": "^1.3.0",
     "@types/node": "^22.0.0",
-    "tsdown": "^0.23.1",
     "typescript": "^5.9.3"
   }
 }