@tangle-network/braid 0.1.0

package/dist/bin/state-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-path.d.ts","sourceRoot":"","sources":["../../src/bin/state-path.ts"],"names":[],"mappings":"AAIA,kFAAkF;AAClF,wBAAgB,yBAAyB,CAAC,WAAW,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAQ9F;AAED,4EAA4E;AAC5E,wBAAgB,iCAAiC,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAI/F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC3C,MAAM,CAQR"}

package/dist/bin/state-path.js

@@ -0,0 +1,34 @@
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+/** The platform Braid data directory is independent of the selected workspace. */
+export function defaultBraidDataDirectory(environment = process.env) {
+    if (process.platform === 'win32') {
+        return join(environment.APPDATA ?? join(homedir(), 'AppData', 'Roaming'), 'braid');
+    }
+    if (process.platform === 'darwin') {
+        return join(homedir(), 'Library', 'Application Support', 'braid');
+    }
+    return join(environment.XDG_DATA_HOME ?? join(homedir(), '.local', 'share'), 'braid');
+}
+/** The stable identity shared by durable state and headless credentials. */
+export function productionWorkspaceConfigIdentity(workspace, configPath) {
+    return createHash('sha256')
+        .update(`${resolve(workspace)}\u0000${resolve(configPath)}`, 'utf8')
+        .digest('hex');
+}
+/**
+ * The default durable database is isolated by canonical workspace/config identity.
+ *
+ * BRAID_STATE_PATH remains an explicit escape hatch for operators that need to
+ * point several processes at a deliberately shared state file.
+ */
+export function defaultStatePath(workspace, configPath, environment = process.env) {
+    if (environment.BRAID_STATE_PATH)
+        return environment.BRAID_STATE_PATH;
+    const canonicalWorkspace = resolve(workspace);
+    const canonicalConfigPath = resolve(configPath ?? join(canonicalWorkspace, '.braid', 'config.json'));
+    const identity = productionWorkspaceConfigIdentity(canonicalWorkspace, canonicalConfigPath);
+    return join(defaultBraidDataDirectory(environment), 'workspaces', identity, 'braid.sqlite');
+}
+//# sourceMappingURL=state-path.js.map

package/dist/bin/state-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-path.js","sourceRoot":"","sources":["../../src/bin/state-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEzC,kFAAkF;AAClF,MAAM,UAAU,yBAAyB,CAAC,WAAW,GAAsB,OAAO,CAAC,GAAG;IACpF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAA;IACnE,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,CAAC,aAAa,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;AACvF,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iCAAiC,CAAC,SAAiB,EAAE,UAAkB;IACrF,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC;SACnE,MAAM,CAAC,KAAK,CAAC,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,UAAmB,EACnB,WAAW,GAAsB,OAAO,CAAC,GAAG;IAE5C,IAAI,WAAW,CAAC,gBAAgB;QAAE,OAAO,WAAW,CAAC,gBAAgB,CAAA;IACrE,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IAC7C,MAAM,mBAAmB,GAAG,OAAO,CACjC,UAAU,IAAI,IAAI,CAAC,kBAAkB,EAAE,QAAQ,EAAE,aAAa,CAAC,CAChE,CAAA;IACD,MAAM,QAAQ,GAAG,iCAAiC,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAA;IAC3F,OAAO,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;AAC7F,CAAC"}

package/dist/domain/analysis-model-call.d.ts

@@ -0,0 +1,35 @@
+import type { IsoDateTime } from './entities-base.js';
+export type AnalysisModelCallOutcome = 'succeeded' | 'failed';
+export type AnalysisModelCallCostStatus = 'observed' | 'estimated' | 'unknown';
+export interface AnalysisModelCallCost {
+    readonly status: AnalysisModelCallCostStatus;
+    readonly usd?: number;
+}
+/**
+ * Sanitized model-call facts retained with one trace analysis.
+ *
+ * This shape is deliberately smaller than the Runtime and Agent Eval records.
+ * It contains no prompt, response body, endpoint host or query, credential, or arbitrary metadata.
+ */
+export interface AnalysisModelCallRecord {
+    readonly sequence: number;
+    readonly callId: string;
+    readonly callRef: string;
+    readonly path: '/v1/chat/completions' | '/v1/responses' | 'unknown-path';
+    readonly model: string;
+    readonly provider?: string;
+    readonly route?: string;
+    readonly inputTokens?: number;
+    readonly outputTokens?: number;
+    readonly cachedTokens?: number;
+    readonly cacheWriteTokens?: number;
+    readonly tokensKnown: boolean;
+    readonly cost: AnalysisModelCallCost;
+    readonly latencyMs?: number;
+    readonly outcome: AnalysisModelCallOutcome;
+    readonly responseStatus?: number;
+    readonly failureCode?: string;
+    readonly startedAt?: IsoDateTime;
+    readonly endedAt?: IsoDateTime;
+}
+//# sourceMappingURL=analysis-model-call.d.ts.map

package/dist/domain/analysis-model-call.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-model-call.d.ts","sourceRoot":"","sources":["../../src/domain/analysis-model-call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAErD,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,QAAQ,CAAA;AAE7D,MAAM,MAAM,2BAA2B,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAA;AAE9E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,CAAA;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,sBAAsB,GAAG,eAAe,GAAG,cAAc,CAAA;IACxE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAA;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAA;CAC/B"}

package/dist/domain/analysis-model-call.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=analysis-model-call.js.map

package/dist/domain/analysis-model-call.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-model-call.js","sourceRoot":"","sources":["../../src/domain/analysis-model-call.ts"],"names":[],"mappings":""}

package/dist/domain/bounded-structured.d.ts

@@ -0,0 +1,27 @@
+export declare const STRUCTURED_REDACTION_MARKER = "[redacted]";
+export declare function isSafeNumericTelemetryField(key: string, value: unknown): value is number;
+export declare function isSafeBooleanTelemetryField(key: string, value: unknown): value is boolean;
+/** Accept Runtime's exact aggregate token counter without accepting arbitrary token-shaped data. */
+export declare function isSafeTokenUsageRecord(key: string, value: unknown): value is SafeTokenUsageRecord;
+interface SafeTokenUsageRecord {
+    readonly input: number;
+    readonly output: number;
+    readonly tokensKnown?: false;
+    readonly freshInput?: number;
+    readonly cacheRead?: number;
+    readonly cacheWrite?: number;
+    readonly cacheBreakdownKnown?: false;
+}
+export declare function isSensitiveFieldName(value: string): boolean;
+export interface StructuredRedactionLimits {
+    readonly maxDepth?: number;
+    readonly maxItems?: number;
+    readonly maxBytes?: number;
+    readonly redactionMarker?: string;
+    readonly stringTransform?: (value: string) => string;
+}
+export declare function redactStructuredValue(value: unknown, key?: string, limits?: StructuredRedactionLimits): unknown;
+/** Preserve non-secret numeric usage/configuration while still masking string tokens. */
+export declare function redactStructuredValueWithNumericTelemetry(value: unknown, key?: string, limits?: StructuredRedactionLimits): unknown;
+export {};
+//# sourceMappingURL=bounded-structured.d.ts.map

package/dist/domain/bounded-structured.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-structured.d.ts","sourceRoot":"","sources":["../../src/domain/bounded-structured.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,2BAA2B,eAAe,CAAA;AA6BvD,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAQxF;AAED,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,OAAO,CAGzF;AAED,oGAAoG;AACpG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAEjG;AAED,UAAU,oBAAoB;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAA;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAA;CACrC;AA+ED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAG3D;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;CACrD;AA+ID,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,GAAG,CAAC,EAAE,MAAM,EACZ,MAAM,GAAE,yBAA8B,GACrC,OAAO,CAET;AAED,yFAAyF;AACzF,wBAAgB,yCAAyC,CACvD,KAAK,EAAE,OAAO,EACd,GAAG,CAAC,EAAE,MAAM,EACZ,MAAM,GAAE,yBAA8B,GACrC,OAAO,CAET"}

package/dist/domain/bounded-structured.js

@@ -0,0 +1,305 @@
+import { isCredentialRefId } from './ids.js';
+import { redactSensitiveText } from './secret-sanitizer.js';
+export const STRUCTURED_REDACTION_MARKER = '[redacted]';
+const MAX_DEPTH = 8;
+const MAX_ITEMS = 256;
+const MAX_TOTAL_BYTES = 64 * 1024;
+const MAX_ALLOWED_DEPTH = 32;
+const MAX_ALLOWED_ITEMS = 500_000;
+const MAX_ALLOWED_BYTES = 16 * 1024 * 1024;
+const MAX_KEY_BYTES = 128;
+const OPAQUE_REFERENCE = /^(?:cred:v1:|sha(?:256|512):)[A-Za-z0-9._:/-]{1,512}$/u;
+const SAFE_NUMERIC_FIELDS = new Set([
+    'inputtokens',
+    'outputtokens',
+    'reasoningtokens',
+    'prompttokens',
+    'completiontokens',
+    'totaltokens',
+    'cachedtokens',
+    'cachedprompttokens',
+    'cachewritetokens',
+    'tokensinput',
+    'tokensoutput',
+    'maxtokens',
+    'maxcompletiontokens',
+    'mintokens',
+    'tokencount',
+    'tokenestimate',
+]);
+const SAFE_BOOLEAN_FIELDS = new Set(['tokensknown']);
+export function isSafeNumericTelemetryField(key, value) {
+    const normalized = key.replace(/[^a-z0-9]/giu, '').toLowerCase();
+    return (SAFE_NUMERIC_FIELDS.has(normalized) &&
+        typeof value === 'number' &&
+        Number.isFinite(value) &&
+        value >= 0);
+}
+export function isSafeBooleanTelemetryField(key, value) {
+    const normalized = key.replace(/[^a-z0-9]/giu, '').toLowerCase();
+    return SAFE_BOOLEAN_FIELDS.has(normalized) && typeof value === 'boolean';
+}
+/** Accept Runtime's exact aggregate token counter without accepting arbitrary token-shaped data. */
+export function isSafeTokenUsageRecord(key, value) {
+    return safeTokenUsageRecord(key, value) !== undefined;
+}
+function safeTokenUsageRecord(key, value) {
+    const normalized = key.replace(/[^a-z0-9]/giu, '').toLowerCase();
+    if ((normalized !== 'tokens' && normalized !== 'tokenusage') || !isRecord(value)) {
+        return undefined;
+    }
+    try {
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null)
+            return undefined;
+        let fields = 0;
+        let input;
+        let output;
+        let tokensKnown;
+        let freshInput;
+        let cacheRead;
+        let cacheWrite;
+        let cacheBreakdownKnown;
+        for (const field in value) {
+            if (!Object.prototype.propertyIsEnumerable.call(value, field))
+                continue;
+            if (field !== 'input' &&
+                field !== 'output' &&
+                field !== 'tokensKnown' &&
+                field !== 'freshInput' &&
+                field !== 'cacheRead' &&
+                field !== 'cacheWrite' &&
+                field !== 'cacheBreakdownKnown')
+                return undefined;
+            fields += 1;
+            if (fields > 7)
+                return undefined;
+            const fieldValue = value[field];
+            if (field === 'tokensKnown') {
+                if (fieldValue !== false)
+                    return undefined;
+                tokensKnown = false;
+                continue;
+            }
+            if (field === 'cacheBreakdownKnown') {
+                if (fieldValue !== false)
+                    return undefined;
+                cacheBreakdownKnown = false;
+                continue;
+            }
+            const count = fieldValue;
+            if (typeof count !== 'number' || !Number.isFinite(count) || count < 0)
+                return undefined;
+            if (field === 'input')
+                input = count;
+            else if (field === 'output')
+                output = count;
+            else if (field === 'freshInput')
+                freshInput = count;
+            else if (field === 'cacheRead')
+                cacheRead = count;
+            else
+                cacheWrite = count;
+        }
+        if (input === undefined || output === undefined)
+            return undefined;
+        const cacheValues = [freshInput, cacheRead, cacheWrite];
+        const cacheFieldCount = cacheValues.filter((entry) => entry !== undefined).length;
+        if (input > 0 && cacheFieldCount > 0 && cacheFieldCount < 3 && cacheBreakdownKnown !== false)
+            return undefined;
+        if (cacheBreakdownKnown !== false &&
+            cacheFieldCount === 3 &&
+            (freshInput ?? 0) + (cacheRead ?? 0) + (cacheWrite ?? 0) !== input)
+            return undefined;
+        return {
+            input,
+            output,
+            ...(tokensKnown === false ? { tokensKnown } : {}),
+            ...(freshInput === undefined ? {} : { freshInput }),
+            ...(cacheRead === undefined ? {} : { cacheRead }),
+            ...(cacheWrite === undefined ? {} : { cacheWrite }),
+            ...(cacheBreakdownKnown === false ? { cacheBreakdownKnown } : {}),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+const sensitiveNamePattern = /(?:password|passwd|passphrase|token|secret|credential|authorization|auth(?:entication)?|key|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|signature|cookie|header|query|fragment|nonce|challenge)/iu;
+export function isSensitiveFieldName(value) {
+    const normalized = value.replace(/[^a-z0-9]/giu, '').toLowerCase();
+    return sensitiveNamePattern.test(value) || normalized === 'key' || normalized.endsWith('key');
+}
+function boundedString(value, context) {
+    const remaining = Math.max(0, context.maxBytes - context.usedBytes);
+    const sanitized = redactSensitiveText(value, context.maxBytes);
+    let output = context.stringTransform(sanitized);
+    if (Buffer.byteLength(output, 'utf8') > remaining) {
+        const marker = '… [truncated]';
+        const markerBytes = Buffer.byteLength(marker, 'utf8');
+        const prefixBytes = Math.max(0, remaining - markerBytes);
+        let used = 0;
+        let prefix = '';
+        for (const character of output) {
+            const size = Buffer.byteLength(character, 'utf8');
+            if (used + size > prefixBytes)
+                break;
+            prefix += character;
+            used += size;
+        }
+        const boundedMarker = takeUtf8Prefix(marker, Math.max(0, remaining - used));
+        output = prefix + boundedMarker;
+    }
+    context.usedBytes = Math.min(context.maxBytes, context.usedBytes + Buffer.byteLength(output, 'utf8'));
+    return output;
+}
+function takeUtf8Prefix(value, bytes) {
+    if (bytes <= 0)
+        return '';
+    if (Buffer.byteLength(value, 'utf8') <= bytes)
+        return value;
+    let used = 0;
+    let output = '';
+    for (const character of value) {
+        const size = Buffer.byteLength(character, 'utf8');
+        if (used + size > bytes)
+            break;
+        output += character;
+        used += size;
+    }
+    return output;
+}
+function boundedKey(value, context) {
+    const sanitized = redactSensitiveText(value, MAX_KEY_BYTES);
+    const transformed = context.stringTransform(sanitized);
+    const bounded = takeUtf8Prefix(transformed, MAX_KEY_BYTES);
+    return bounded.length === 0 ? context.redactionMarker : bounded;
+}
+function sanitize(value, key, depth, context) {
+    if (context.preserveNumericTelemetry && key && isSafeNumericTelemetryField(key, value)) {
+        return value;
+    }
+    if (key) {
+        const tokenUsage = safeTokenUsageRecord(key, value);
+        if (tokenUsage !== undefined)
+            return tokenUsage;
+    }
+    if (typeof value === 'string' &&
+        key &&
+        isSensitiveFieldName(key) &&
+        !isSafeOpaqueReference(key, value)) {
+        return context.redactionMarker;
+    }
+    if (typeof value === 'string') {
+        return boundedString(value, context);
+    }
+    if (key && isSensitiveFieldName(key)) {
+        if (typeof value === 'boolean' || value === null)
+            return value;
+        return context.redactionMarker;
+    }
+    if (value === null || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? value : '[unavailable: number]';
+    if (depth >= context.maxDepth)
+        return '[unavailable: depth limit]';
+    if (typeof value !== 'object')
+        return '[unavailable]';
+    if (value instanceof Uint8Array)
+        return '[unavailable: binary]';
+    if (context.seen.has(value))
+        return '[unavailable: cycle]';
+    context.seen.add(value);
+    try {
+        if (Array.isArray(value)) {
+            const output = [];
+            let index = 0;
+            for (; index < value.length; index += 1) {
+                if (context.remainingItems <= 0)
+                    break;
+                context.remainingItems -= 1;
+                output.push(sanitize(value[index], undefined, depth + 1, context));
+            }
+            if (index < value.length)
+                output.push('[unavailable: item limit]');
+            return output;
+        }
+        const output = {};
+        const keyCounts = new Map();
+        let truncated = false;
+        for (const childKey in value) {
+            if (!Object.prototype.propertyIsEnumerable.call(value, childKey))
+                continue;
+            if (context.remainingItems <= 0) {
+                truncated = true;
+                break;
+            }
+            context.remainingItems -= 1;
+            const safeKey = boundedKey(childKey, context);
+            const outputKey = uniqueKey(safeKey, keyCounts);
+            try {
+                setOwn(output, outputKey, sanitize(value[childKey], childKey, depth + 1, context));
+            }
+            catch {
+                setOwn(output, outputKey, '[unavailable]');
+            }
+        }
+        if (truncated)
+            setOwn(output, '__braidTruncated', true);
+        return output;
+    }
+    finally {
+        context.seen.delete(value);
+    }
+}
+function isSafeOpaqueReference(key, value) {
+    if (OPAQUE_REFERENCE.test(value))
+        return true;
+    return (key.replace(/[^a-z0-9]/giu, '').toLowerCase() === 'credentialref' && isCredentialRefId(value));
+}
+export function redactStructuredValue(value, key, limits = {}) {
+    return sanitize(value, key, 0, createContext(limits, false));
+}
+/** Preserve non-secret numeric usage/configuration while still masking string tokens. */
+export function redactStructuredValueWithNumericTelemetry(value, key, limits = {}) {
+    return sanitize(value, key, 0, createContext(limits, true));
+}
+function createContext(limits, preserveNumericTelemetry) {
+    const maxItems = boundedLimit(limits.maxItems, MAX_ITEMS, MAX_ALLOWED_ITEMS);
+    return {
+        maxDepth: boundedLimit(limits.maxDepth, MAX_DEPTH, MAX_ALLOWED_DEPTH),
+        maxBytes: boundedLimit(limits.maxBytes, MAX_TOTAL_BYTES, MAX_ALLOWED_BYTES),
+        preserveNumericTelemetry,
+        redactionMarker: limits.redactionMarker ?? STRUCTURED_REDACTION_MARKER,
+        stringTransform: limits.stringTransform ?? identity,
+        seen: new WeakSet(),
+        remainingItems: maxItems,
+        usedBytes: 0,
+    };
+}
+function boundedLimit(value, fallback, maximum) {
+    if (value === undefined || !Number.isFinite(value))
+        return fallback;
+    return Math.min(maximum, Math.max(0, Math.floor(value)));
+}
+function identity(value) {
+    return value;
+}
+function uniqueKey(value, counts) {
+    const count = (counts.get(value) ?? 0) + 1;
+    counts.set(value, count);
+    return count === 1 ? value : `${value}#${String(count)}`;
+}
+function setOwn(target, key, value) {
+    Object.defineProperty(target, key, {
+        value,
+        enumerable: true,
+        configurable: true,
+        writable: true,
+    });
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+//# sourceMappingURL=bounded-structured.js.map

package/dist/domain/bounded-structured.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-structured.js","sourceRoot":"","sources":["../../src/domain/bounded-structured.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAE3D,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAA;AACvD,MAAM,SAAS,GAAG,CAAC,CAAA;AACnB,MAAM,SAAS,GAAG,GAAG,CAAA;AACrB,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAA;AACjC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAC5B,MAAM,iBAAiB,GAAG,OAAO,CAAA;AACjC,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC1C,MAAM,aAAa,GAAG,GAAG,CAAA;AACzB,MAAM,gBAAgB,GAAG,wDAAwD,CAAA;AACjF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,cAAc;IACd,kBAAkB;IAClB,aAAa;IACb,cAAc;IACd,oBAAoB;IACpB,kBAAkB;IAClB,aAAa;IACb,cAAc;IACd,WAAW;IACX,qBAAqB;IACrB,WAAW;IACX,YAAY;IACZ,eAAe;CAChB,CAAC,CAAA;AACF,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;AAEpD,MAAM,UAAU,2BAA2B,CAAC,GAAW,EAAE,KAAc;IACrE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAChE,OAAO,CACL,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,KAAK,IAAI,CAAC,CACX,CAAA;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAW,EAAE,KAAc;IACrE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAChE,OAAO,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,KAAK,KAAK,SAAS,CAAA;AAC1E,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,KAAc;IAChE,OAAO,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,SAAS,CAAA;AACvD,CAAC;AAYD,SAAS,oBAAoB,CAAC,GAAW,EAAE,KAAc;IACvD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAChE,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAA;QAC1E,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,IAAI,KAAyB,CAAA;QAC7B,IAAI,MAA0B,CAAA;QAC9B,IAAI,WAA8B,CAAA;QAClC,IAAI,UAA8B,CAAA;QAClC,IAAI,SAA6B,CAAA;QACjC,IAAI,UAA8B,CAAA;QAClC,IAAI,mBAAsC,CAAA;QAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;gBAAE,SAAQ;YACvE,IACE,KAAK,KAAK,OAAO;gBACjB,KAAK,KAAK,QAAQ;gBAClB,KAAK,KAAK,aAAa;gBACvB,KAAK,KAAK,YAAY;gBACtB,KAAK,KAAK,WAAW;gBACrB,KAAK,KAAK,YAAY;gBACtB,KAAK,KAAK,qBAAqB;gBAE/B,OAAO,SAAS,CAAA;YAClB,MAAM,IAAI,CAAC,CAAA;YACX,IAAI,MAAM,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;YAChC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;YAC/B,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,IAAI,UAAU,KAAK,KAAK;oBAAE,OAAO,SAAS,CAAA;gBAC1C,WAAW,GAAG,KAAK,CAAA;gBACnB,SAAQ;YACV,CAAC;YACD,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;gBACpC,IAAI,UAAU,KAAK,KAAK;oBAAE,OAAO,SAAS,CAAA;gBAC1C,mBAAmB,GAAG,KAAK,CAAA;gBAC3B,SAAQ;YACV,CAAC;YACD,MAAM,KAAK,GAAG,UAAU,CAAA;YACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAA;YACvF,IAAI,KAAK,KAAK,OAAO;gBAAE,KAAK,GAAG,KAAK,CAAA;iBAC/B,IAAI,KAAK,KAAK,QAAQ;gBAAE,MAAM,GAAG,KAAK,CAAA;iBACtC,IAAI,KAAK,KAAK,YAAY;gBAAE,UAAU,GAAG,KAAK,CAAA;iBAC9C,IAAI,KAAK,KAAK,WAAW;gBAAE,SAAS,GAAG,KAAK,CAAA;;gBAC5C,UAAU,GAAG,KAAK,CAAA;QACzB,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACjE,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;QACvD,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,MAAM,CAAA;QACjF,IAAI,KAAK,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,IAAI,eAAe,GAAG,CAAC,IAAI,mBAAmB,KAAK,KAAK;YAC1F,OAAO,SAAS,CAAA;QAClB,IACE,mBAAmB,KAAK,KAAK;YAC7B,eAAe,KAAK,CAAC;YACrB,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK;YAElE,OAAO,SAAS,CAAA;QAClB,OAAO;YACL,KAAK;YACL,MAAM;YACN,GAAG,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;YACnD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YACjD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;YACnD,GAAG,CAAC,mBAAmB,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,MAAM,oBAAoB,GACxB,oNAAoN,CAAA;AAEtN,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAClE,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC/F,CAAC;AAqBD,SAAS,aAAa,CAAC,KAAa,EAAE,OAAyB;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;IACnE,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC9D,IAAI,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;IAC/C,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,eAAe,CAAA;QAC9B,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC,CAAA;QACxD,IAAI,IAAI,GAAG,CAAC,CAAA;QACZ,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;YACjD,IAAI,IAAI,GAAG,IAAI,GAAG,WAAW;gBAAE,MAAK;YACpC,MAAM,IAAI,SAAS,CAAA;YACnB,IAAI,IAAI,IAAI,CAAA;QACd,CAAC;QACD,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC,CAAA;QAC3E,MAAM,GAAG,MAAM,GAAG,aAAa,CAAA;IACjC,CAAC;IACD,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAC1B,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CACtD,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,KAAa;IAClD,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IACzB,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IAC3D,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QACjD,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;YAAE,MAAK;QAC9B,MAAM,IAAI,SAAS,CAAA;QACnB,IAAI,IAAI,IAAI,CAAA;IACd,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,OAAyB;IAC1D,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;IAC3D,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,EAAE,aAAa,CAAC,CAAA;IAC1D,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAA;AACjE,CAAC;AAED,SAAS,QAAQ,CACf,KAAc,EACd,GAAuB,EACvB,KAAa,EACb,OAAyB;IAEzB,IAAI,OAAO,CAAC,wBAAwB,IAAI,GAAG,IAAI,2BAA2B,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;QACvF,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACnD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,UAAU,CAAA;IACjD,CAAC;IACD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,GAAG;QACH,oBAAoB,CAAC,GAAG,CAAC;QACzB,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,EAClC,CAAC;QACD,OAAO,OAAO,CAAC,eAAe,CAAA;IAChC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACtC,CAAC;IACD,IAAI,GAAG,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QAC9D,OAAO,OAAO,CAAC,eAAe,CAAA;IAChC,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC9D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAA;IAC9F,IAAI,KAAK,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,4BAA4B,CAAA;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,eAAe,CAAA;IACrD,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,uBAAuB,CAAA;IAC/D,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,sBAAsB,CAAA;IAC1D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACvB,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,MAAM,GAAc,EAAE,CAAA;YAC5B,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;gBACxC,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC;oBAAE,MAAK;gBACtC,OAAO,CAAC,cAAc,IAAI,CAAC,CAAA;gBAC3B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;YACpE,CAAC;YACD,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;YAClE,OAAO,MAAM,CAAA;QACf,CAAC;QACD,MAAM,MAAM,GAA4B,EAAE,CAAA;QAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;QAC3C,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,KAAK,MAAM,QAAQ,IAAI,KAAgC,EAAE,CAAC;YACxD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,SAAQ;YAC1E,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC;gBAChC,SAAS,GAAG,IAAI,CAAA;gBAChB,MAAK;YACP,CAAC;YACD,OAAO,CAAC,cAAc,IAAI,CAAC,CAAA;YAC3B,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAC7C,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YAC/C,IAAI,CAAC;gBACH,MAAM,CACJ,MAAM,EACN,SAAS,EACT,QAAQ,CAAE,KAAiC,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,CACrF,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QACD,IAAI,SAAS;YAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAA;QACvD,OAAO,MAAM,CAAA;IACf,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,KAAa;IACvD,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,OAAO,CACL,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,eAAe,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAC9F,CAAA;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,GAAY,EACZ,MAAM,GAA8B,EAAE;IAEtC,OAAO,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yCAAyC,CACvD,KAAc,EACd,GAAY,EACZ,MAAM,GAA8B,EAAE;IAEtC,OAAO,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,aAAa,CACpB,MAAiC,EACjC,wBAAiC;IAEjC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAA;IAC5E,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,iBAAiB,CAAC;QACrE,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,EAAE,iBAAiB,CAAC;QAC3E,wBAAwB;QACxB,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,2BAA2B;QACtE,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,QAAQ;QACnD,IAAI,EAAE,IAAI,OAAO,EAAU;QAC3B,cAAc,EAAE,QAAQ;QACxB,SAAS,EAAE,CAAC;KACb,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB,EAAE,QAAgB,EAAE,OAAe;IAChF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IACnE,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,MAA2B;IAC3D,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACxB,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED,SAAS,MAAM,CAAC,MAA+B,EAAE,GAAW,EAAE,KAAc;IAC1E,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;QACjC,KAAK;QACL,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC"}

package/dist/domain/canonical.d.ts

@@ -0,0 +1,4 @@
+import { type Digest } from './ids.js';
+export declare function canonicalJson(value: unknown): string;
+export declare function canonicalDigest(value: unknown): Digest;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/domain/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/domain/canonical.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,UAAU,CAAA;AAyCpD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGpD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}

package/dist/domain/canonical.js

@@ -0,0 +1,50 @@
+import { createHash } from 'node:crypto';
+import { createDigest } from './ids.js';
+function compareCodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function canonicalValue(value, ancestors) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new TypeError('Canonical JSON requires finite numbers');
+        return Object.is(value, -0) ? 0 : value;
+    }
+    if (typeof value !== 'object') {
+        throw new TypeError(`Canonical JSON cannot represent ${typeof value}`);
+    }
+    if (ancestors.has(value))
+        throw new TypeError('Canonical JSON cannot represent cycles');
+    ancestors.add(value);
+    try {
+        if (Array.isArray(value)) {
+            return value.map((child) => {
+                if (child === undefined) {
+                    throw new TypeError('Canonical JSON cannot represent undefined array entries');
+                }
+                return canonicalValue(child, ancestors);
+            });
+        }
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new TypeError('Canonical JSON requires plain objects');
+        }
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, child]) => child !== undefined)
+            .sort(([left], [right]) => compareCodeUnits(left, right))
+            .map(([key, child]) => [key, canonicalValue(child, ancestors)]));
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
+export function canonicalJson(value) {
+    if (value === undefined)
+        throw new TypeError('Canonical JSON cannot represent undefined');
+    return JSON.stringify(canonicalValue(value, new Set()));
+}
+export function canonicalDigest(value) {
+    return createDigest(createHash('sha256').update(canonicalJson(value)).digest('hex'));
+}
+//# sourceMappingURL=canonical.js.map

package/dist/domain/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/domain/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAe,MAAM,UAAU,CAAA;AAEpD,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACnD,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,SAAsB;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAA;QAC1F,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IACzC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,mCAAmC,OAAO,KAAK,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAA;IACvF,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACpB,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAA;gBAChF,CAAC;gBACD,OAAO,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;YACzC,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QAC9C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAA;QAC9D,CAAC;QACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;aAClB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;aAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAClE,CAAA;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAA;IACzF,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;AACtF,CAAC"}

package/dist/domain/code-unit-order.d.ts

@@ -0,0 +1,3 @@
+/** Compares UTF-16 code units without locale or platform-dependent collation. */
+export declare function compareCodeUnits(left: string, right: string): number;
+//# sourceMappingURL=code-unit-order.d.ts.map

package/dist/domain/code-unit-order.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-unit-order.d.ts","sourceRoot":"","sources":["../../src/domain/code-unit-order.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQpE"}

package/dist/domain/code-unit-order.js

@@ -0,0 +1,12 @@
+/** Compares UTF-16 code units without locale or platform-dependent collation. */
+export function compareCodeUnits(left, right) {
+    const length = Math.min(left.length, right.length);
+    for (let index = 0; index < length; index += 1) {
+        const leftCode = left.charCodeAt(index);
+        const rightCode = right.charCodeAt(index);
+        if (leftCode !== rightCode)
+            return leftCode - rightCode;
+    }
+    return left.length - right.length;
+}
+//# sourceMappingURL=code-unit-order.js.map

package/dist/domain/code-unit-order.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-unit-order.js","sourceRoot":"","sources":["../../src/domain/code-unit-order.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAClD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,GAAG,SAAS,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;AACnC,CAAC"}

package/dist/domain/connection-removal.d.ts

@@ -0,0 +1,11 @@
+import type { ConnectionId } from './ids.js';
+import type { BraidState } from './state.js';
+export type ConnectionRemovalBlockerKind = 'selected' | 'branch' | 'run' | 'environment' | 'binding' | 'automation-rule';
+export interface ConnectionRemovalBlocker {
+    readonly kind: ConnectionRemovalBlockerKind;
+    readonly id: string;
+    readonly status?: string;
+    readonly action: string;
+}
+export declare function connectionRemovalBlockers(state: BraidState, connectionId: ConnectionId): readonly ConnectionRemovalBlocker[];
+//# sourceMappingURL=connection-removal.d.ts.map

package/dist/domain/connection-removal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-removal.d.ts","sourceRoot":"","sources":["../../src/domain/connection-removal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,MAAM,MAAM,4BAA4B,GACpC,UAAU,GACV,QAAQ,GACR,KAAK,GACL,aAAa,GACb,SAAS,GACT,iBAAiB,CAAA;AAErB,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,4BAA4B,CAAA;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,UAAU,EACjB,YAAY,EAAE,YAAY,GACzB,SAAS,wBAAwB,EAAE,CAqErC"}

package/dist/domain/connection-removal.js

@@ -0,0 +1,79 @@
+export function connectionRemovalBlockers(state, connectionId) {
+    const blockers = [];
+    if (state.selectedConnectionId === connectionId) {
+        blockers.push({
+            kind: 'selected',
+            id: connectionId,
+            action: 'Select a different connection before removing this one',
+        });
+    }
+    for (const branch of state.branches) {
+        if (branch.connectionId !== connectionId || branch.status === 'archived')
+            continue;
+        blockers.push({
+            kind: 'branch',
+            id: branch.id,
+            status: branch.status,
+            action: 'Rebind or archive the branch before removing this connection',
+        });
+    }
+    for (const run of state.runs) {
+        const runConnectionId = run.connectionId ?? run.receipt.requested.connectionId;
+        if (runConnectionId !== connectionId)
+            continue;
+        if (isProvenTerminal(run) && state.activeRunId !== run.id)
+            continue;
+        blockers.push({
+            kind: 'run',
+            id: run.id,
+            status: run.status,
+            action: state.activeRunId === run.id
+                ? 'Reconcile the active run before removing this connection'
+                : 'Wait for the run to reach a proven terminal status before removing this connection',
+        });
+    }
+    for (const environment of state.environments) {
+        if (environment.connectionId !== connectionId)
+            continue;
+        if (environment.lifecycle === 'expired' || environment.lifecycle === 'destroyed')
+            continue;
+        blockers.push({
+            kind: 'environment',
+            id: environment.id,
+            status: environment.lifecycle,
+            action: 'Finish environment cleanup so it is expired or destroyed before removing this connection',
+        });
+    }
+    for (const binding of state.bindings) {
+        if (binding.connectionId !== connectionId)
+            continue;
+        if (binding.status === 'expired' || binding.status === 'released')
+            continue;
+        blockers.push({
+            kind: 'binding',
+            id: binding.id,
+            status: binding.status,
+            action: 'Release or rebind the provider binding before removing this connection',
+        });
+    }
+    for (const rule of state.rules) {
+        if (!rule.enabled || rule.matcher.connectionId !== connectionId)
+            continue;
+        blockers.push({
+            kind: 'automation-rule',
+            id: rule.id,
+            action: 'Disable or remove the automation rule before removing this connection',
+        });
+    }
+    return blockers;
+}
+function isProvenTerminal(run) {
+    return (run.complete &&
+        (run.status === 'completed' ||
+            run.status === 'failed' ||
+            run.status === 'cancelled' ||
+            run.status === 'aborted' ||
+            run.status === 'blocked' ||
+            run.status === 'expired'));
+}
+//# sourceMappingURL=connection-removal.js.map

package/dist/domain/connection-removal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-removal.js","sourceRoot":"","sources":["../../src/domain/connection-removal.ts"],"names":[],"mappings":"AAkBA,MAAM,UAAU,yBAAyB,CACvC,KAAiB,EACjB,YAA0B;IAE1B,MAAM,QAAQ,GAA+B,EAAE,CAAA;IAE/C,IAAI,KAAK,CAAC,oBAAoB,KAAK,YAAY,EAAE,CAAC;QAChD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,UAAU;YAChB,EAAE,EAAE,YAAY;YAChB,MAAM,EAAE,wDAAwD;SACjE,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;YAAE,SAAQ;QAClF,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,QAAQ;YACd,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,8DAA8D;SACvE,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,eAAe,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAA;QAC9E,IAAI,eAAe,KAAK,YAAY;YAAE,SAAQ;QAC9C,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,WAAW,KAAK,GAAG,CAAC,EAAE;YAAE,SAAQ;QACnE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,KAAK;YACX,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EACJ,KAAK,CAAC,WAAW,KAAK,GAAG,CAAC,EAAE;gBAC1B,CAAC,CAAC,0DAA0D;gBAC5D,CAAC,CAAC,oFAAoF;SAC3F,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,WAAW,CAAC,YAAY,KAAK,YAAY;YAAE,SAAQ;QACvD,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,KAAK,WAAW;YAAE,SAAQ;QAC1F,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,aAAa;YACnB,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,MAAM,EAAE,WAAW,CAAC,SAAS;YAC7B,MAAM,EACJ,0FAA0F;SAC7F,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,YAAY,KAAK,YAAY;YAAE,SAAQ;QACnD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;YAAE,SAAQ;QAC3E,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,wEAAwE;SACjF,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,YAAY;YAAE,SAAQ;QACzE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,uEAAuE;SAChF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAA+B;IACvD,OAAO,CACL,GAAG,CAAC,QAAQ;QACZ,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW;YACzB,GAAG,CAAC,MAAM,KAAK,QAAQ;YACvB,GAAG,CAAC,MAAM,KAAK,WAAW;YAC1B,GAAG,CAAC,MAAM,KAAK,SAAS;YACxB,GAAG,CAAC,MAAM,KAAK,SAAS;YACxB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAC5B,CAAA;AACH,CAAC"}