@useconductor/conductor 1.0.0

package/dist/core/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/core/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA0BH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAE7B,MAAM,OAAO,aAAa;IAChB,UAAU,GAAgD,IAAI,GAAG,EAAE,CAAC;IACpE,eAAe,GAAgC,IAAI,GAAG,EAAE,CAAC;IACzD,OAAO,GAKX,EAAE,cAAc,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;IAEpF;;OAEG;IACH,QAAQ,CAAC,IAAY,EAAE,KAAqC;QAC1D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,IAAY,EAAE,OAAuB;QAC1D,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,OAAgB,EAAE,SAAiB;QAChD,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,SAAS,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAa;QAC3B,IAAI,CAAC,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAG,OAAO;QAC9B,MAAM,UAAU,GAAsB,EAAE,CAAC;QAEzC,+CAA+C;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE;YAC3E,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAe,EAAE,OAAO,EAAE,CAAC;YAC/D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACnD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;YACjC,IAAI,KAAK,KAAK,MAAM;gBAAE,YAAY,EAAE,CAAC;YACrC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,WAAW,IAAI,EAAE;gBACvB,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM;gBAC/E,OAAO,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,4CAA4C,CAAC,CAAC,CAAC,SAAS;aACrF,CAAC,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAElE,MAAM,UAAU,GACd,IAAI,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9G,OAAO;YACL,MAAM;YACN,OAAO;YACP,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;YACnD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU;YACV,OAAO,EAAE;gBACP,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;gBAC3C,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe;gBAC7C,YAAY,EAAE,UAAU;gBACxB,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;gBAC3C,YAAY;aACb;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAErC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;YAC5E,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC/G,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/core/interfaces.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Conductor Core Interfaces
+ *
+ * Narrow interfaces that break the God-object dependency.
+ * Consumers should depend on these interfaces, not on concrete classes.
+ */
+import { AIMessage } from '../ai/base.js';
+export interface IConfig {
+    /** Read a value by dot-notation key, e.g. "ai.provider" */
+    get<T>(key: string): T | undefined;
+    /** Persist a value by dot-notation key */
+    set(key: string, value: unknown): Promise<void>;
+    /** Absolute path to the config directory (~/.conductor by default) */
+    getConfigDir(): string;
+    /** The full config object as a plain record */
+    getConfig(): Record<string, unknown>;
+}
+export interface IDatabase {
+    /** Persist a full AIMessage for a user */
+    addMessage(userId: string, message: AIMessage): Promise<void>;
+    /** Retrieve conversation history for a user */
+    getHistory(userId: string, limit?: number): Promise<AIMessage[]>;
+    /** Full-text search across a user's messages */
+    searchMessages(userId: string, query: string, limit?: number): Promise<AIMessage[]>;
+    /** Record an activity log entry */
+    logActivity(userId: string, action: string, plugin?: string, details?: string, success?: boolean): Promise<void>;
+    /** Recent activity entries for the dashboard / proactive context */
+    getRecentActivity(limit?: number): Promise<any[]>;
+}
+import { Plugin } from '../plugins/manager.js';
+export interface IPluginRegistry {
+    getPlugin(name: string): Promise<Plugin | undefined>;
+    listPlugins(): Array<{
+        name: string;
+        enabled: boolean;
+        description: string;
+        version: string;
+    }>;
+    getEnabledTools(): Promise<import('../plugins/manager.js').PluginTool[]>;
+    isPluginEnabled(name: string): boolean;
+    enablePlugin(name: string): Promise<void>;
+    disablePlugin(name: string): Promise<void>;
+}
+export interface ToolContext {
+    /** User ID of the person running the conversation (Telegram ID, 'system', etc.) */
+    userId: string;
+    /** Channel the conversation is happening in: 'telegram', 'slack', 'cli', 'mcp' */
+    channel: string;
+    /** Config interface for tool handlers that need to read settings */
+    conductorConfig: IConfig;
+}
+/**
+ * Structured notification type for proactive cycle alerts.
+ * Replaces hard-coded Telegram Markdown strings so each runtime can format
+ * appropriately (Telegram Markdown, Slack Block Kit, plain text, etc.).
+ */
+export interface ConductorNotification {
+    title: string;
+    body: string;
+    codeBlock?: string;
+}
+//# sourceMappingURL=interfaces.d.ts.map

package/dist/core/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/core/interfaces.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAI1C,MAAM,WAAW,OAAO;IACtB,2DAA2D;IAC3D,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IACnC,0CAA0C;IAC1C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,sEAAsE;IACtE,YAAY,IAAI,MAAM,CAAC;IACvB,+CAA+C;IAC/C,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAID,MAAM,WAAW,SAAS;IACxB,0CAA0C;IAC1C,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACjE,gDAAgD;IAChD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACpF,mCAAmC;IAEnC,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjH,oEAAoE;IAEpE,iBAAiB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;CACnD;AAID,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACrD,WAAW,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/F,eAAe,IAAI,OAAO,CAAC,OAAO,uBAAuB,EAAE,UAAU,EAAE,CAAC,CAAC;IACzE,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAID,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,eAAe,EAAE,OAAO,CAAC;CAC1B;AAID;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/core/interfaces.js

@@ -0,0 +1,8 @@
+/**
+ * Conductor Core Interfaces
+ *
+ * Narrow interfaces that break the God-object dependency.
+ * Consumers should depend on these interfaces, not on concrete classes.
+ */
+export {};
+//# sourceMappingURL=interfaces.js.map

package/dist/core/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/core/interfaces.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/core/logger.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Structured logging with Pino.
+ *
+ * All logs go to stderr (stdout is reserved for MCP protocol).
+ * In production, logs are JSON-structured for ingestion by log aggregators.
+ * In development, logs are pretty-printed for readability.
+ */
+import pino from 'pino';
+export declare const logger: pino.Logger<never, boolean>;
+/**
+ * Create a child logger with a specific context.
+ * Use this for module-specific logging.
+ */
+export declare function childLogger(context: string): pino.Logger<never, boolean>;
+//# sourceMappingURL=logger.d.ts.map

package/dist/core/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAIxB,eAAO,MAAM,MAAM,6BAYjB,CAAC;AAEH;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,+BAE1C"}

package/dist/core/logger.js

@@ -0,0 +1,30 @@
+/**
+ * Structured logging with Pino.
+ *
+ * All logs go to stderr (stdout is reserved for MCP protocol).
+ * In production, logs are JSON-structured for ingestion by log aggregators.
+ * In development, logs are pretty-printed for readability.
+ */
+import pino from 'pino';
+const isDev = process.env.NODE_ENV !== 'production';
+export const logger = pino({
+    level: process.env.LOG_LEVEL ?? (isDev ? 'debug' : 'info'),
+    transport: isDev
+        ? {
+            target: 'pino-pretty',
+            options: {
+                colorize: true,
+                translateTime: 'SYS:standard',
+                ignore: 'pid,hostname',
+            },
+        }
+        : undefined,
+});
+/**
+ * Create a child logger with a specific context.
+ * Use this for module-specific logging.
+ */
+export function childLogger(context) {
+    return logger.child({ context });
+}
+//# sourceMappingURL=logger.js.map

package/dist/core/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/core/logger.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAEpD,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1D,SAAS,EAAE,KAAK;QACd,CAAC,CAAC;YACE,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE;gBACP,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,cAAc;gBAC7B,MAAM,EAAE,cAAc;aACvB;SACF;QACH,CAAC,CAAC,SAAS;CACd,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/dist/core/rbac.d.ts

@@ -0,0 +1,132 @@
+/**
+ * RBAC — Role-Based Access Control foundation for multi-user Conductor.
+ *
+ * Provides role definitions, permission checks, user management, and
+ * persistence. Designed to be plugged into the MCP server's tool routing
+ * so every tool call is authorized before execution.
+ *
+ * Default roles:
+ *   admin            — full access to all resources and actions
+ *   editor           — create / read / update / execute (no delete)
+ *   viewer           — read-only
+ *   service_account  — execute only (for automated tool calls)
+ */
+export declare enum Role {
+    ADMIN = "admin",
+    EDITOR = "editor",
+    VIEWER = "viewer",
+    SERVICE_ACCOUNT = "service_account"
+}
+export declare enum Action {
+    CREATE = "create",
+    READ = "read",
+    UPDATE = "update",
+    DELETE = "delete",
+    EXECUTE = "execute"
+}
+export interface Permission {
+    resource: string;
+    action: Action;
+}
+/**
+ * Maps each role to the set of (resource, action) pairs it is allowed to perform.
+ *
+ * The special resource '*' is a wildcard meaning "all resources".
+ */
+export type RolePermissions = Map<Role, Permission[]>;
+/**
+ * Default permission assignments for built-in roles.
+ */
+export declare function defaultRolePermissions(): RolePermissions;
+export interface User {
+    id: string;
+    email: string;
+    role: Role;
+    createdAt: Date;
+    lastLoginAt: Date | null;
+}
+export interface RBACAuditEntry {
+    timestamp: Date;
+    userId: string;
+    resource: string;
+    action: string;
+    granted: boolean;
+}
+export declare class RBACManager {
+    private users;
+    private permissions;
+    private auditLog;
+    constructor(permissions?: RolePermissions);
+    /**
+     * Add a user. Throws if the user id already exists.
+     */
+    addUser(user: User): void;
+    /**
+     * Remove a user by id. Returns true if the user existed and was removed.
+     */
+    removeUser(userId: string): boolean;
+    /**
+     * Retrieve a user by id, or undefined if not found.
+     */
+    getUser(userId: string): User | undefined;
+    /**
+     * Return a snapshot of all users.
+     */
+    listUsers(): User[];
+    /**
+     * Assign a new role to an existing user. Returns false if the user doesn't exist.
+     */
+    assignRole(userId: string, role: Role): boolean;
+    /**
+     * Record a login timestamp for a user. Returns false if the user doesn't exist.
+     */
+    recordLogin(userId: string): boolean;
+    /**
+     * Check whether a user has permission to perform `action` on `resource`.
+     *
+     * The check consults the user's role against the RolePermissions map.
+     * Wildcard resource '*' in the permission set grants access to all resources.
+     *
+     * Every check (granted or denied) is appended to the in-memory audit log.
+     */
+    checkPermission(userId: string, resource: string, action: string): boolean;
+    /**
+     * Check multiple permissions at once. Returns true only if ALL are granted.
+     */
+    checkPermissions(userId: string, checks: {
+        resource: string;
+        action: string;
+    }[]): boolean;
+    /**
+     * Add a custom permission entry for a specific role.
+     */
+    addPermission(role: Role, permission: Permission): void;
+    /**
+     * Remove a permission entry from a role.
+     */
+    removePermission(role: Role, resource: string, action: Action): void;
+    /**
+     * Get all permissions for a role.
+     */
+    getRolePermissions(role: Role): Permission[];
+    /**
+     * Return the in-memory audit log.
+     */
+    getAuditLog(): RBACAuditEntry[];
+    /**
+     * Clear the audit log (useful for tests or after flushing to persistent storage).
+     */
+    clearAuditLog(): void;
+    private audit;
+    /**
+     * Serialise the entire RBAC state (users + custom permissions) to a JSON string.
+     * The audit log is intentionally excluded — it should be flushed separately.
+     */
+    serialize(): string;
+    /**
+     * Restore RBAC state from a previously serialised JSON string.
+     * Replaces all existing users and permissions.
+     */
+    deserialize(data: string): void;
+}
+//# sourceMappingURL=rbac.d.ts.map

package/dist/core/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/core/rbac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,oBAAY,IAAI;IACd,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,eAAe,oBAAoB;CACpC;AAID,oBAAY,MAAM;IAChB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAID,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;AAEtD;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,eAAe,CA0BxD;AAID,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;IAChB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CAC1B;AAID,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB;AAmBD,qBAAa,WAAW;IACtB,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,QAAQ,CAAwB;gBAE5B,WAAW,CAAC,EAAE,eAAe;IAMzC;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAOzB;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAInC;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS;IAIzC;;OAEG;IACH,SAAS,IAAI,IAAI,EAAE;IAMnB;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO;IAO/C;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IASpC;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAmB1E;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO;IAMzF;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI;IASvD;;OAEG;IACH,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAOpE;;OAEG;IACH,kBAAkB,CAAC,IAAI,EAAE,IAAI,GAAG,UAAU,EAAE;IAM5C;;OAEG;IACH,WAAW,IAAI,cAAc,EAAE;IAI/B;;OAEG;IACH,aAAa,IAAI,IAAI;IAIrB,OAAO,CAAC,KAAK;IAMb;;;OAGG;IACH,SAAS,IAAI,MAAM;IAmBnB;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;CAuBhC"}

package/dist/core/rbac.js

@@ -0,0 +1,230 @@
+/**
+ * RBAC — Role-Based Access Control foundation for multi-user Conductor.
+ *
+ * Provides role definitions, permission checks, user management, and
+ * persistence. Designed to be plugged into the MCP server's tool routing
+ * so every tool call is authorized before execution.
+ *
+ * Default roles:
+ *   admin            — full access to all resources and actions
+ *   editor           — create / read / update / execute (no delete)
+ *   viewer           — read-only
+ *   service_account  — execute only (for automated tool calls)
+ */
+// ── Role ──────────────────────────────────────────────────────────────────────
+export var Role;
+(function (Role) {
+    Role["ADMIN"] = "admin";
+    Role["EDITOR"] = "editor";
+    Role["VIEWER"] = "viewer";
+    Role["SERVICE_ACCOUNT"] = "service_account";
+})(Role || (Role = {}));
+// ── Action ────────────────────────────────────────────────────────────────────
+export var Action;
+(function (Action) {
+    Action["CREATE"] = "create";
+    Action["READ"] = "read";
+    Action["UPDATE"] = "update";
+    Action["DELETE"] = "delete";
+    Action["EXECUTE"] = "execute";
+})(Action || (Action = {}));
+/**
+ * Default permission assignments for built-in roles.
+ */
+export function defaultRolePermissions() {
+    const perms = new Map();
+    perms.set(Role.ADMIN, [
+        { resource: '*', action: Action.CREATE },
+        { resource: '*', action: Action.READ },
+        { resource: '*', action: Action.UPDATE },
+        { resource: '*', action: Action.DELETE },
+        { resource: '*', action: Action.EXECUTE },
+    ]);
+    perms.set(Role.EDITOR, [
+        { resource: '*', action: Action.CREATE },
+        { resource: '*', action: Action.READ },
+        { resource: '*', action: Action.UPDATE },
+        { resource: '*', action: Action.EXECUTE },
+    ]);
+    perms.set(Role.VIEWER, [{ resource: '*', action: Action.READ }]);
+    perms.set(Role.SERVICE_ACCOUNT, [
+        { resource: '*', action: Action.EXECUTE },
+        { resource: '*', action: Action.READ },
+    ]);
+    return perms;
+}
+// ── RBACManager ───────────────────────────────────────────────────────────────
+export class RBACManager {
+    users = new Map();
+    permissions;
+    auditLog = [];
+    constructor(permissions) {
+        this.permissions = permissions ?? defaultRolePermissions();
+    }
+    // ── User CRUD ────────────────────────────────────────────────────────────
+    /**
+     * Add a user. Throws if the user id already exists.
+     */
+    addUser(user) {
+        if (this.users.has(user.id)) {
+            throw new Error(`User already exists: ${user.id}`);
+        }
+        this.users.set(user.id, { ...user });
+    }
+    /**
+     * Remove a user by id. Returns true if the user existed and was removed.
+     */
+    removeUser(userId) {
+        return this.users.delete(userId);
+    }
+    /**
+     * Retrieve a user by id, or undefined if not found.
+     */
+    getUser(userId) {
+        return this.users.get(userId);
+    }
+    /**
+     * Return a snapshot of all users.
+     */
+    listUsers() {
+        return Array.from(this.users.values());
+    }
+    // ── Role management ──────────────────────────────────────────────────────
+    /**
+     * Assign a new role to an existing user. Returns false if the user doesn't exist.
+     */
+    assignRole(userId, role) {
+        const user = this.users.get(userId);
+        if (!user)
+            return false;
+        user.role = role;
+        return true;
+    }
+    /**
+     * Record a login timestamp for a user. Returns false if the user doesn't exist.
+     */
+    recordLogin(userId) {
+        const user = this.users.get(userId);
+        if (!user)
+            return false;
+        user.lastLoginAt = new Date();
+        return true;
+    }
+    // ── Permission checks ────────────────────────────────────────────────────
+    /**
+     * Check whether a user has permission to perform `action` on `resource`.
+     *
+     * The check consults the user's role against the RolePermissions map.
+     * Wildcard resource '*' in the permission set grants access to all resources.
+     *
+     * Every check (granted or denied) is appended to the in-memory audit log.
+     */
+    checkPermission(userId, resource, action) {
+        const user = this.users.get(userId);
+        if (!user) {
+            this.audit({ userId, resource, action, granted: false });
+            return false;
+        }
+        const rolePerms = this.permissions.get(user.role);
+        if (!rolePerms || rolePerms.length === 0) {
+            this.audit({ userId, resource, action, granted: false });
+            return false;
+        }
+        const granted = rolePerms.some((p) => (p.resource === '*' || p.resource === resource) && p.action === action);
+        this.audit({ userId, resource, action, granted });
+        return granted;
+    }
+    /**
+     * Check multiple permissions at once. Returns true only if ALL are granted.
+     */
+    checkPermissions(userId, checks) {
+        return checks.every((c) => this.checkPermission(userId, c.resource, c.action));
+    }
+    // ── Custom permissions ───────────────────────────────────────────────────
+    /**
+     * Add a custom permission entry for a specific role.
+     */
+    addPermission(role, permission) {
+        const existing = this.permissions.get(role) ?? [];
+        // Avoid duplicates
+        if (!existing.some((p) => p.resource === permission.resource && p.action === permission.action)) {
+            existing.push(permission);
+            this.permissions.set(role, existing);
+        }
+    }
+    /**
+     * Remove a permission entry from a role.
+     */
+    removePermission(role, resource, action) {
+        const existing = this.permissions.get(role);
+        if (!existing)
+            return;
+        const filtered = existing.filter((p) => !(p.resource === resource && p.action === action));
+        this.permissions.set(role, filtered);
+    }
+    /**
+     * Get all permissions for a role.
+     */
+    getRolePermissions(role) {
+        return [...(this.permissions.get(role) ?? [])];
+    }
+    // ── Audit log ────────────────────────────────────────────────────────────
+    /**
+     * Return the in-memory audit log.
+     */
+    getAuditLog() {
+        return [...this.auditLog];
+    }
+    /**
+     * Clear the audit log (useful for tests or after flushing to persistent storage).
+     */
+    clearAuditLog() {
+        this.auditLog = [];
+    }
+    audit(entry) {
+        this.auditLog.push({ ...entry, timestamp: new Date() });
+    }
+    // ── Persistence ──────────────────────────────────────────────────────────
+    /**
+     * Serialise the entire RBAC state (users + custom permissions) to a JSON string.
+     * The audit log is intentionally excluded — it should be flushed separately.
+     */
+    serialize() {
+        const state = {
+            users: Array.from(this.users.values()).map((u) => ({
+                id: u.id,
+                email: u.email,
+                role: u.role,
+                createdAt: u.createdAt.toISOString(),
+                lastLoginAt: u.lastLoginAt?.toISOString() ?? null,
+            })),
+            permissions: Object.fromEntries(Array.from(this.permissions.entries()).map(([role, perms]) => [
+                role,
+                perms.map((p) => ({ resource: p.resource, action: p.action })),
+            ])),
+        };
+        return JSON.stringify(state);
+    }
+    /**
+     * Restore RBAC state from a previously serialised JSON string.
+     * Replaces all existing users and permissions.
+     */
+    deserialize(data) {
+        const state = JSON.parse(data);
+        this.users = new Map(state.users.map((u) => [
+            u.id,
+            {
+                id: u.id,
+                email: u.email,
+                role: u.role,
+                createdAt: new Date(u.createdAt),
+                lastLoginAt: u.lastLoginAt ? new Date(u.lastLoginAt) : null,
+            },
+        ]));
+        this.permissions = new Map(Object.entries(state.permissions).map(([roleStr, perms]) => [
+            roleStr,
+            perms.map((p) => ({ resource: p.resource, action: p.action })),
+        ]));
+    }
+}
+//# sourceMappingURL=rbac.js.map

package/dist/core/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/core/rbac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,iFAAiF;AAEjF,MAAM,CAAN,IAAY,IAKX;AALD,WAAY,IAAI;IACd,uBAAe,CAAA;IACf,yBAAiB,CAAA;IACjB,yBAAiB,CAAA;IACjB,2CAAmC,CAAA;AACrC,CAAC,EALW,IAAI,KAAJ,IAAI,QAKf;AAED,iFAAiF;AAEjF,MAAM,CAAN,IAAY,MAMX;AAND,WAAY,MAAM;IAChB,2BAAiB,CAAA;IACjB,uBAAa,CAAA;IACb,2BAAiB,CAAA;IACjB,2BAAiB,CAAA;IACjB,6BAAmB,CAAA;AACrB,CAAC,EANW,MAAM,KAAN,MAAM,QAMjB;AAkBD;;GAEG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE5C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE;QACpB,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;QACtC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE;KAC1C,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE;QACrB,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;QACtC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QACxC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE;KAC1C,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEjE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE;QAC9B,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE;QACzC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;KACvC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAqCD,iFAAiF;AAEjF,MAAM,OAAO,WAAW;IACd,KAAK,GAAsB,IAAI,GAAG,EAAE,CAAC;IACrC,WAAW,CAAkB;IAC7B,QAAQ,GAAqB,EAAE,CAAC;IAExC,YAAY,WAA6B;QACvC,IAAI,CAAC,WAAW,GAAG,WAAW,IAAI,sBAAsB,EAAE,CAAC;IAC7D,CAAC;IAED,4EAA4E;IAE5E;;OAEG;IACH,OAAO,CAAC,IAAU;QAChB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,4EAA4E;IAE5E;;OAEG;IACH,UAAU,CAAC,MAAc,EAAE,IAAU;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAc;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,IAAI,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAE5E;;;;;;;OAOG;IACH,eAAe,CAAC,MAAc,EAAE,QAAgB,EAAE,MAAc;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAE9G,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAc,EAAE,MAA8C;QAC7E,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,4EAA4E;IAE5E;;OAEG;IACH,aAAa,CAAC,IAAU,EAAE,UAAsB;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAClD,mBAAmB;QACnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAChG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,IAAU,EAAE,QAAgB,EAAE,MAAc;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,IAAU;QAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,4EAA4E;IAE5E;;OAEG;IACH,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,KAAwC;QACpD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,4EAA4E;IAE5E;;;OAGG;IACH,SAAS;QACP,MAAM,KAAK,GAAoB;YAC7B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjD,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;gBACpC,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;aAClD,CAAC,CAAC;YACH,WAAW,EAAE,MAAM,CAAC,WAAW,CAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC5D,IAAI;gBACJ,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;aAC/D,CAAC,CACH;SACF,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,IAAY;QACtB,MAAM,KAAK,GAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEhD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAClB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACrB,CAAC,CAAC,EAAE;YACJ;gBACE,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;aAC5D;SACF,CAAC,CACH,CAAC;QAEF,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CACxB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YAC1D,OAAe;YACf,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAC/D,CAAC,CACH,CAAC;IACJ,CAAC;CACF"}

package/dist/core/retry.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Retry with exponential backoff and jitter.
+ *
+ * Every tool call is automatically retried on transient failures.
+ * Backoff: baseDelay * 2^attempt + random jitter
+ *
+ * Designed for API rate limits, network blips, and temporary outages.
+ */
+export interface RetryOptions {
+    /** Maximum number of attempts (including the first) */
+    maxAttempts: number;
+    /** Base delay in ms */
+    baseDelay: number;
+    /** Maximum delay in ms */
+    maxDelay: number;
+    /** Retry only on these error codes/messages */
+    retryableErrors?: string[];
+    /** Callback for each retry attempt */
+    onRetry?: (attempt: number, error: Error, delay: number) => void;
+}
+export declare function withRetry<T>(fn: () => Promise<T>, options?: Partial<RetryOptions>): Promise<T>;
+//# sourceMappingURL=retry.d.ts.map

package/dist/core/retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../../src/core/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,sCAAsC;IACtC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAClE;AAQD,wBAAsB,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAgCpG"}

package/dist/core/retry.js

@@ -0,0 +1,41 @@
+/**
+ * Retry with exponential backoff and jitter.
+ *
+ * Every tool call is automatically retried on transient failures.
+ * Backoff: baseDelay * 2^attempt + random jitter
+ *
+ * Designed for API rate limits, network blips, and temporary outages.
+ */
+const DEFAULTS = {
+    maxAttempts: 3,
+    baseDelay: 1000,
+    maxDelay: 30000,
+};
+export async function withRetry(fn, options) {
+    const opts = { ...DEFAULTS, ...options };
+    let lastError;
+    for (let attempt = 1; attempt <= opts.maxAttempts; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastError = err instanceof Error ? err : new Error(String(err));
+            // Don't retry if error is not retryable
+            if (opts.retryableErrors && opts.retryableErrors.length > 0) {
+                if (!opts.retryableErrors.some((pattern) => lastError.message.includes(pattern))) {
+                    throw lastError;
+                }
+            }
+            // Don't retry on last attempt
+            if (attempt === opts.maxAttempts) {
+                throw lastError;
+            }
+            // Calculate delay with exponential backoff and jitter
+            const delay = Math.min(opts.baseDelay * Math.pow(2, attempt - 1) + Math.random() * 1000, opts.maxDelay);
+            opts.onRetry?.(attempt, lastError, delay);
+            await new Promise((resolve) => setTimeout(resolve, delay));
+        }
+    }
+    throw lastError;
+}
+//# sourceMappingURL=retry.js.map

package/dist/core/retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../../src/core/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH,MAAM,QAAQ,GAAiB;IAC7B,WAAW,EAAE,CAAC;IACd,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,KAAK;CAChB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,EAAoB,EAAE,OAA+B;IACtF,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;IACzC,IAAI,SAA4B,CAAC;IAEjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7D,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAEhE,wCAAwC;YACxC,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;oBAClF,MAAM,SAAS,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,8BAA8B;YAC9B,IAAI,OAAO,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjC,MAAM,SAAS,CAAC;YAClB,CAAC;YAED,sDAAsD;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAExG,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YAE1C,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,SAAU,CAAC;AACnB,CAAC"}