@verevoir/review 0.3.1 → 0.3.2

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/run.mjs

@@ -0,0 +1,91 @@
+import { APIUserAbortError } from "../../../core/error.mjs";
+import { ToolError } from "../../tools/ToolError.mjs";
+import { ToolsetContractError, ToolsetUsageError } from "./errors.mjs";
+import { errorText, errorTextContent, thrownErrorText, wellFormed } from "./sanitize.mjs";
+import { toolsetFamily } from "./family.mjs";
+/**
+ * What the runner answers for a toolset member it did not run because an earlier member of the same toolset failed
+ * in the same assistant turn: the model planned those actions as a sequence, and a later one rarely makes sense once
+ * an earlier one did not happen. The browser toolset's text; `notExecutedText` gives each family its own.
+ */
+export const NOT_EXECUTED = 'Not executed: an earlier action in this turn failed.';
+const NOT_EXECUTED_BY_FAMILY = {
+    browser: NOT_EXECUTED,
+    computer: 'Not executed: an earlier computer action in this turn failed.',
+};
+/** The not-executed text for `family` (a `tool_use.toolset_name`), or the browser's for a family the SDK doesn't know. */
+export function notExecutedText(family) {
+    return Object.prototype.hasOwnProperty.call(NOT_EXECUTED_BY_FAMILY, family) ?
+        NOT_EXECUTED_BY_FAMILY[family]
+        : NOT_EXECUTED;
+}
+/**
+ * The `tool_result` answering a member `tool_use`. `toolset_name` is required on a member result (the API rejects a
+ * mismatch), so it is echoed on error paths too.
+ */
+export function toolsetResultBlock(toolUse, content, isError = false) {
+    if (isError && (content === '' || (Array.isArray(content) && content.length === 0))) {
+        // Deliberate: an empty ToolError (`throw new ToolError('')`, or one whose non-text blocks were dropped) would be
+        // an is_error result with empty content, which the API rejects with a 400, ending the whole run over a refusal
+        // the model could have recovered from. The model still learns the call failed, and the developer loses nothing
+        // they wrote.
+        content = 'The tool call failed with an empty error message.';
+    }
+    return {
+        type: 'tool_result',
+        tool_use_id: toolUse.id,
+        toolset_name: toolUse.toolset_name ?? null,
+        content,
+        ...(isError ? { is_error: true } : {}),
+    };
+}
+/**
+ * What never becomes a tool result: a `ToolsetUsageError` propagates as it is, and once the call's own `AbortSignal`
+ * has aborted the cancellation propagates as `APIUserAbortError`, whatever was thrown after it. An error named
+ * `AbortError` that a driver throws while that signal has not aborted (a page-aborted request, a driver's own timeout)
+ * is the driver's failure, not a cancellation.
+ */
+export function throwIfPropagates(error, ctx) {
+    if (error instanceof ToolsetUsageError)
+        throw error;
+    throwIfAborted(ctx.signal);
+}
+/** Once `signal` has aborted, throws the `APIUserAbortError` an aborted request throws, so one `catch` covers both. */
+export function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw new APIUserAbortError();
+}
+/**
+ * How an exception out of a member call is classified, at the `execute` boundary and in the runner alike: what
+ * `throwIfPropagates` covers propagates, a `ToolError` is the member's own refusal, and anything else a driver throws
+ * (its `TypeError` included) becomes a refusal the model reads, so the loop continues.
+ */
+export function classify(error, ctx) {
+    throwIfPropagates(error, ctx);
+    if (error instanceof ToolError)
+        return error;
+    // Not cut here: the toolset cuts the text to the field limit when it builds the result.
+    return new ToolError(wellFormed(thrownErrorText(error)));
+}
+/**
+ * Runs one member `tool_use` against `toolset` and builds its `tool_result`. Throws if `toolUse`
+ * is not a member call of this family: a block without `toolset_name` is a plain tool (possibly a
+ * custom tool sharing a member name) and must never be routed here.
+ */
+export async function runToolsetMember(toolset, toolUse, options = {}) {
+    const family = toolsetFamily(toolset);
+    if (toolUse.toolset_name !== family) {
+        // a caller's routing mistake, like every other misuse of the toolset's API
+        throw new ToolsetContractError(`tool_use ${JSON.stringify(toolUse.id)} (toolset_name=${JSON.stringify(toolUse.toolset_name ?? null)}, name=${JSON.stringify(toolUse.name)}) is not a member call of the ${JSON.stringify(family)} toolset`);
+    }
+    const ctx = { ...options, toolUse, toolUseBlock: toolUse };
+    try {
+        return toolsetResultBlock(toolUse, await toolset.run(ctx, toolUse));
+    }
+    catch (e) {
+        // `classify`, as an is_error result: a converted exception is cut to the field limit here
+        throwIfPropagates(e, ctx);
+        return toolsetResultBlock(toolUse, errorTextContent(e instanceof ToolError ? e.content : errorText(e)), true);
+    }
+}
+//# sourceMappingURL=run.mjs.map

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/run.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.mjs","sourceRoot":"","sources":["../../../src/lib/internal/toolsets/run.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAE,gCAA4B;AAExD,OAAO,EAAE,SAAS,EAAE,kCAA8B;AAClD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,qBAAiB;AACnE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,UAAU,EAAE,uBAAmB;AACtF,OAAO,EAAE,aAAa,EAAsB,qBAAiB;AAG7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,sDAAsD,CAAC;AAEnF,MAAM,sBAAsB,GAAkC;IAC5D,OAAO,EAAE,YAAY;IACrB,QAAQ,EAAE,+DAA+D;CAC1E,CAAC;AAEF,0HAA0H;AAC1H,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,CAAC;QACzE,sBAAsB,CAAC,MAAuB,CAAC;QACjD,CAAC,CAAC,YAAY,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAyB,EACzB,OAAoC,EACpC,OAAO,GAAG,KAAK;IAEf,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,iHAAiH;QACjH,+GAA+G;QAC/G,+GAA+G;QAC/G,cAAc;QACd,OAAO,GAAG,mDAAmD,CAAC;IAChE,CAAC;IAED,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,OAAO,CAAC,EAAE;QACvB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC1C,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,GAAgD;IAChG,IAAI,KAAK,YAAY,iBAAiB;QAAE,MAAM,KAAK,CAAC;IACpD,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,cAAc,CAAC,MAAsC;IACnE,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAc,EAAE,GAAgD;IACvF,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,YAAY,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,wFAAwF;IACxF,OAAO,IAAI,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA4B,EAC5B,OAAyB,EACzB,UAAgE,EAAE;IAElE,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACpC,2EAA2E;QAC3E,MAAM,IAAI,oBAAoB,CAC5B,YAAY,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,kBAAkB,IAAI,CAAC,SAAS,CACpE,OAAO,CAAC,YAAY,IAAI,IAAI,CAC7B,UAAU,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,SAAS,CACpF,MAAM,CACP,UAAU,CACZ,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAuB,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IAE/E,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,0FAA0F;QAC1F,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1B,OAAO,kBAAkB,CACvB,OAAO,EACP,gBAAgB,CAAC,CAAC,YAAY,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EACnE,IAAI,CACL,CAAC;IACJ,CAAC;AACH,CAAC"}

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/sanitize.d.mts

@@ -0,0 +1,59 @@
+/**
+ * Every place a page- or model-supplied string is normalised or cut before it reaches the model, a log, or an
+ * SDK-written line: one file, so what each does and how they differ can be read side by side.
+ *
+ * - `oneLine`: any page- or model-supplied value that goes into one line of text (a title, a download error, a field
+ *   of a confirmation line): line breaks, controls and bidi characters folded to a space, a lone surrogate to U+FFFD,
+ *   trimmed, cut to the API's field limit. `logSafe` and `quotedName` are the same, cut short, for a log record or a
+ *   name echoed inside quotes.
+ * - `errorText` / `errorTextContent`: an exception's text as an `is_error` result holds it (as a function tool's
+ *   does), cut to the field limit, and the text-only content such a result may hold.
+ * - `boundedTabURL`: a tab's or download's reported URL folded to one line and held to the field limit.
+ * - `wellFormed`: lone surrogates replaced, used by all of the above.
+ * - `cutPoints`: the code-point-safe cut the others use.
+ */
+import type { BetaTextBlockParam } from "../../../resources/beta.mjs";
+import type { BetaToolsetContent } from "../../tools/BetaRunnableToolset.mjs";
+/**
+ * C0 and C1 controls, the line separators and the bidi controls: anything that would break or reorder the one line a
+ * page- or model-supplied value goes into.
+ */
+export declare const LINE_UNSAFE = "\\x00-\\x1f\\x7f-\\x9f\\u061c\\u200e\\u200f\\u2028\\u2029\\u202a-\\u202e\\u2066-\\u2069";
+/** `text` with each unpaired surrogate replaced by U+FFFD, so it can be sent. */
+export declare function wellFormed(text: string): string;
+/**
+ * The API's limit for a text field of the block, for a URL, and the most of an exception's text an `is_error` result
+ * holds.
+ */
+export declare const FIELD_MAX = 4096;
+/**
+ * A page- or model-supplied text on one line the model or an operator reads: a tab's title, a download's
+ * error, a field of a member's confirmation line. Line breaks, control and bidi characters are folded to
+ * spaces, a lone surrogate to U+FFFD, the ends trimmed, and the whole cut to `limit`.
+ */
+export declare function oneLine(text: string, limit?: number): string;
+/** `Error: <message>` for a thrown value other than a `ToolError`: an `Error`'s message, else it as a string. */
+export declare function thrownErrorText(e: unknown): string;
+/**
+ * A caught exception's text as the `is_error` result the model reads (the same `Error: <message>` a failing function
+ * tool produces), made well-formed and cut to the field limit: a driver's exception can embed a page-sized payload.
+ */
+export declare function errorText(error: unknown): string;
+/**
+ * The first `limit` code points of `text`: a cut by UTF-16 units could split a surrogate pair, and a lone surrogate
+ * fails the request.
+ */
+export declare function cutPoints(text: string, limit: number): string;
+/**
+ * A tab's or download's URL as the model reads it: the driver's string folded to one line (line breaks, control and
+ * bidi characters a space, a lone surrogate U+FFFD) and held to the API's limit (`FIELD_MAX`, counted in code points).
+ * Nothing is parsed. A longer one becomes `…` and its first 4,095 code points, so that the cut text parses to no site.
+ */
+export declare function boundedTabURL(url: string): string;
+/**
+ * The text blocks of a `ToolError`'s content. Deliberate, like the empty-content placeholder: the API accepts only
+ * text on an is_error result and answers anything else with a 400 that ends the run, so an image a member attached to
+ * its refusal is dropped here rather than ending the whole loop. The refusal's text still reaches the model.
+ */
+export declare function errorTextContent(content: string | BetaToolsetContent): string | BetaTextBlockParam[];
+//# sourceMappingURL=sanitize.d.mts.map

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/sanitize.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.mts","sourceRoot":"","sources":["../../../src/lib/internal/toolsets/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,oCAAgC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,4CAAwC;AAE1E;;;GAGG;AACH,eAAO,MAAM,WAAW,4FACmE,CAAC;AAM5F,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AACD;;;GAGG;AACH,eAAO,MAAM,SAAS,OAAO,CAAC;AAG9B;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAAkB,GAAG,MAAM,CAEvE;AAgBD,iHAAiH;AACjH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAElD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAU7D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,GAAG,MAAM,GAAG,kBAAkB,EAAE,CAOpG"}

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/sanitize.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Every place a page- or model-supplied string is normalised or cut before it reaches the model, a log, or an
+ * SDK-written line: one file, so what each does and how they differ can be read side by side.
+ *
+ * - `oneLine`: any page- or model-supplied value that goes into one line of text (a title, a download error, a field
+ *   of a confirmation line): line breaks, controls and bidi characters folded to a space, a lone surrogate to U+FFFD,
+ *   trimmed, cut to the API's field limit. `logSafe` and `quotedName` are the same, cut short, for a log record or a
+ *   name echoed inside quotes.
+ * - `errorText` / `errorTextContent`: an exception's text as an `is_error` result holds it (as a function tool's
+ *   does), cut to the field limit, and the text-only content such a result may hold.
+ * - `boundedTabURL`: a tab's or download's reported URL folded to one line and held to the field limit.
+ * - `wellFormed`: lone surrogates replaced, used by all of the above.
+ * - `cutPoints`: the code-point-safe cut the others use.
+ */
+import type { BetaTextBlockParam } from "../../../resources/beta.js";
+import type { BetaToolsetContent } from "../../tools/BetaRunnableToolset.js";
+/**
+ * C0 and C1 controls, the line separators and the bidi controls: anything that would break or reorder the one line a
+ * page- or model-supplied value goes into.
+ */
+export declare const LINE_UNSAFE = "\\x00-\\x1f\\x7f-\\x9f\\u061c\\u200e\\u200f\\u2028\\u2029\\u202a-\\u202e\\u2066-\\u2069";
+/** `text` with each unpaired surrogate replaced by U+FFFD, so it can be sent. */
+export declare function wellFormed(text: string): string;
+/**
+ * The API's limit for a text field of the block, for a URL, and the most of an exception's text an `is_error` result
+ * holds.
+ */
+export declare const FIELD_MAX = 4096;
+/**
+ * A page- or model-supplied text on one line the model or an operator reads: a tab's title, a download's
+ * error, a field of a member's confirmation line. Line breaks, control and bidi characters are folded to
+ * spaces, a lone surrogate to U+FFFD, the ends trimmed, and the whole cut to `limit`.
+ */
+export declare function oneLine(text: string, limit?: number): string;
+/** `Error: <message>` for a thrown value other than a `ToolError`: an `Error`'s message, else it as a string. */
+export declare function thrownErrorText(e: unknown): string;
+/**
+ * A caught exception's text as the `is_error` result the model reads (the same `Error: <message>` a failing function
+ * tool produces), made well-formed and cut to the field limit: a driver's exception can embed a page-sized payload.
+ */
+export declare function errorText(error: unknown): string;
+/**
+ * The first `limit` code points of `text`: a cut by UTF-16 units could split a surrogate pair, and a lone surrogate
+ * fails the request.
+ */
+export declare function cutPoints(text: string, limit: number): string;
+/**
+ * A tab's or download's URL as the model reads it: the driver's string folded to one line (line breaks, control and
+ * bidi characters a space, a lone surrogate U+FFFD) and held to the API's limit (`FIELD_MAX`, counted in code points).
+ * Nothing is parsed. A longer one becomes `…` and its first 4,095 code points, so that the cut text parses to no site.
+ */
+export declare function boundedTabURL(url: string): string;
+/**
+ * The text blocks of a `ToolError`'s content. Deliberate, like the empty-content placeholder: the API accepts only
+ * text on an is_error result and answers anything else with a 400 that ends the run, so an image a member attached to
+ * its refusal is dropped here rather than ending the whole loop. The refusal's text still reaches the model.
+ */
+export declare function errorTextContent(content: string | BetaToolsetContent): string | BetaTextBlockParam[];
+//# sourceMappingURL=sanitize.d.ts.map

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/lib/internal/toolsets/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,kBAAkB,EAAE,mCAAgC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,2CAAwC;AAE1E;;;GAGG;AACH,eAAO,MAAM,WAAW,4FACmE,CAAC;AAM5F,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AACD;;;GAGG;AACH,eAAO,MAAM,SAAS,OAAO,CAAC;AAG9B;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAE,MAAkB,GAAG,MAAM,CAEvE;AAgBD,iHAAiH;AACjH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAElD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAU7D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,GAAG,MAAM,GAAG,kBAAkB,EAAE,CAOpG"}

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/sanitize.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FIELD_MAX = exports.LINE_UNSAFE = void 0;
+exports.wellFormed = wellFormed;
+exports.oneLine = oneLine;
+exports.logSafe = logSafe;
+exports.quotedName = quotedName;
+exports.thrownErrorText = thrownErrorText;
+exports.errorText = errorText;
+exports.cutPoints = cutPoints;
+exports.boundedTabURL = boundedTabURL;
+exports.errorTextContent = errorTextContent;
+/**
+ * C0 and C1 controls, the line separators and the bidi controls: anything that would break or reorder the one line a
+ * page- or model-supplied value goes into.
+ */
+exports.LINE_UNSAFE = '\\x00-\\x1f\\x7f-\\x9f\\u061c\\u200e\\u200f\\u2028\\u2029\\u202a-\\u202e\\u2066-\\u2069';
+const CONTROL_RE = /* @__PURE__ */ (() => new RegExp(`[${exports.LINE_UNSAFE}]+`, 'g'))();
+// An unpaired surrogate cannot be encoded as UTF-8: in a page-chosen string it would fail every request for as long
+// as the driver keeps reporting it. Folded to U+FFFD wherever page text is normalised (with the `u` flag the class
+// matches a surrogate only when it stands alone).
+const LONE_SURROGATE_RE = /[\uD800-\uDFFF]/gu;
+/** `text` with each unpaired surrogate replaced by U+FFFD, so it can be sent. */
+function wellFormed(text) {
+    return text.replace(LONE_SURROGATE_RE, '\uFFFD');
+}
+/**
+ * The API's limit for a text field of the block, for a URL, and the most of an exception's text an `is_error` result
+ * holds.
+ */
+exports.FIELD_MAX = 4096;
+const LOG_MAX = 200;
+/**
+ * A page- or model-supplied text on one line the model or an operator reads: a tab's title, a download's
+ * error, a field of a member's confirmation line. Line breaks, control and bidi characters are folded to
+ * spaces, a lone surrogate to U+FFFD, the ends trimmed, and the whole cut to `limit`.
+ */
+function oneLine(text, limit = exports.FIELD_MAX) {
+    return cutPoints(wellFormed(text).replace(CONTROL_RE, ' ').trim(), limit);
+}
+/** A model- or page-supplied name for a log record or an SDK-written error text: `oneLine`, cut short. @internal */
+function logSafe(name) {
+    return oneLine(name, LOG_MAX);
+}
+/**
+ * A model-chosen name as it is echoed inside single quotes in a text the model reads: one line, cut short, and without
+ * the quotes and runs of spaces that could make it read as part of the text around it.
+ * @internal
+ */
+function quotedName(name) {
+    return logSafe(name).replace(/[' ]+/g, ' ').trim();
+}
+/** `Error: <message>` for a thrown value other than a `ToolError`: an `Error`'s message, else it as a string. */
+function thrownErrorText(e) {
+    return `Error: ${e instanceof Error ? e.message : String(e)}`;
+}
+/**
+ * A caught exception's text as the `is_error` result the model reads (the same `Error: <message>` a failing function
+ * tool produces), made well-formed and cut to the field limit: a driver's exception can embed a page-sized payload.
+ */
+function errorText(error) {
+    return cutPoints(wellFormed(thrownErrorText(error)), exports.FIELD_MAX);
+}
+/**
+ * The first `limit` code points of `text`: a cut by UTF-16 units could split a surrogate pair, and a lone surrogate
+ * fails the request.
+ */
+function cutPoints(text, limit) {
+    if (text.length <= limit)
+        return text; // no more UTF-16 units than the limit: no more code points either
+    let end = 0;
+    let points = 0;
+    for (const ch of text) {
+        if (points === limit)
+            break;
+        points += 1;
+        end += ch.length;
+    }
+    return text.slice(0, end);
+}
+/**
+ * A tab's or download's URL as the model reads it: the driver's string folded to one line (line breaks, control and
+ * bidi characters a space, a lone surrogate U+FFFD) and held to the API's limit (`FIELD_MAX`, counted in code points).
+ * Nothing is parsed. A longer one becomes `…` and its first 4,095 code points, so that the cut text parses to no site.
+ */
+function boundedTabURL(url) {
+    const line = oneLine(url, Infinity);
+    return cutPoints(line, exports.FIELD_MAX) === line ? line : '\u2026' + cutPoints(line, exports.FIELD_MAX - 1);
+}
+/**
+ * The text blocks of a `ToolError`'s content. Deliberate, like the empty-content placeholder: the API accepts only
+ * text on an is_error result and answers anything else with a 400 that ends the run, so an image a member attached to
+ * its refusal is dropped here rather than ending the whole loop. The refusal's text still reaches the model.
+ */
+function errorTextContent(content) {
+    // The API rejects an `is_error` result whose content is empty or holds a non-text block. Empty text blocks are
+    // dropped too, so an error with no text left gets the placeholder from `toolsetResultBlock`.
+    if (typeof content === 'string')
+        return wellFormed(content);
+    return content
+        .filter((block) => block.type === 'text' && block.text !== '')
+        .map((block) => ({ ...block, text: wellFormed(block.text) }));
+}
+//# sourceMappingURL=sanitize.js.map

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/lib/internal/toolsets/sanitize.ts"],"names":[],"mappings":";;;AA6BA,gCAEC;AAaD,0BAEC;AAGD,0BAEC;AAOD,gCAEC;AAGD,0CAEC;AAMD,8BAEC;AAMD,8BAUC;AAOD,sCAGC;AAOD,4CAOC;AAhGD;;;GAGG;AACU,QAAA,WAAW,GACtB,yFAAyF,CAAC;AAC5F,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,mBAAW,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAClF,oHAAoH;AACpH,mHAAmH;AACnH,kDAAkD;AAClD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,iFAAiF;AACjF,SAAgB,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AACD;;;GAGG;AACU,QAAA,SAAS,GAAG,IAAI,CAAC;AAC9B,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB;;;;GAIG;AACH,SAAgB,OAAO,CAAC,IAAY,EAAE,QAAgB,iBAAS;IAC7D,OAAO,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,oHAAoH;AACpH,SAAgB,OAAO,CAAC,IAAY;IAClC,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,IAAY;IACrC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,iHAAiH;AACjH,SAAgB,eAAe,CAAC,CAAU;IACxC,OAAO,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,KAAc;IACtC,OAAO,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAS,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,kEAAkE;IACzG,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,MAAM,KAAK,KAAK;YAAE,MAAM;QAC5B,MAAM,IAAI,CAAC,CAAC;QACZ,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,GAAW;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC,IAAI,EAAE,iBAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,iBAAS,GAAG,CAAC,CAAC,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,OAAoC;IACnE,+GAA+G;IAC/G,6FAA6F;IAC7F,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,KAAK,EAA+B,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;SAC1F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/sanitize.mjs

@@ -0,0 +1,92 @@
+/**
+ * C0 and C1 controls, the line separators and the bidi controls: anything that would break or reorder the one line a
+ * page- or model-supplied value goes into.
+ */
+export const LINE_UNSAFE = '\\x00-\\x1f\\x7f-\\x9f\\u061c\\u200e\\u200f\\u2028\\u2029\\u202a-\\u202e\\u2066-\\u2069';
+const CONTROL_RE = /* @__PURE__ */ (() => new RegExp(`[${LINE_UNSAFE}]+`, 'g'))();
+// An unpaired surrogate cannot be encoded as UTF-8: in a page-chosen string it would fail every request for as long
+// as the driver keeps reporting it. Folded to U+FFFD wherever page text is normalised (with the `u` flag the class
+// matches a surrogate only when it stands alone).
+const LONE_SURROGATE_RE = /[\uD800-\uDFFF]/gu;
+/** `text` with each unpaired surrogate replaced by U+FFFD, so it can be sent. */
+export function wellFormed(text) {
+    return text.replace(LONE_SURROGATE_RE, '\uFFFD');
+}
+/**
+ * The API's limit for a text field of the block, for a URL, and the most of an exception's text an `is_error` result
+ * holds.
+ */
+export const FIELD_MAX = 4096;
+const LOG_MAX = 200;
+/**
+ * A page- or model-supplied text on one line the model or an operator reads: a tab's title, a download's
+ * error, a field of a member's confirmation line. Line breaks, control and bidi characters are folded to
+ * spaces, a lone surrogate to U+FFFD, the ends trimmed, and the whole cut to `limit`.
+ */
+export function oneLine(text, limit = FIELD_MAX) {
+    return cutPoints(wellFormed(text).replace(CONTROL_RE, ' ').trim(), limit);
+}
+/** A model- or page-supplied name for a log record or an SDK-written error text: `oneLine`, cut short. @internal */
+export function logSafe(name) {
+    return oneLine(name, LOG_MAX);
+}
+/**
+ * A model-chosen name as it is echoed inside single quotes in a text the model reads: one line, cut short, and without
+ * the quotes and runs of spaces that could make it read as part of the text around it.
+ * @internal
+ */
+export function quotedName(name) {
+    return logSafe(name).replace(/[' ]+/g, ' ').trim();
+}
+/** `Error: <message>` for a thrown value other than a `ToolError`: an `Error`'s message, else it as a string. */
+export function thrownErrorText(e) {
+    return `Error: ${e instanceof Error ? e.message : String(e)}`;
+}
+/**
+ * A caught exception's text as the `is_error` result the model reads (the same `Error: <message>` a failing function
+ * tool produces), made well-formed and cut to the field limit: a driver's exception can embed a page-sized payload.
+ */
+export function errorText(error) {
+    return cutPoints(wellFormed(thrownErrorText(error)), FIELD_MAX);
+}
+/**
+ * The first `limit` code points of `text`: a cut by UTF-16 units could split a surrogate pair, and a lone surrogate
+ * fails the request.
+ */
+export function cutPoints(text, limit) {
+    if (text.length <= limit)
+        return text; // no more UTF-16 units than the limit: no more code points either
+    let end = 0;
+    let points = 0;
+    for (const ch of text) {
+        if (points === limit)
+            break;
+        points += 1;
+        end += ch.length;
+    }
+    return text.slice(0, end);
+}
+/**
+ * A tab's or download's URL as the model reads it: the driver's string folded to one line (line breaks, control and
+ * bidi characters a space, a lone surrogate U+FFFD) and held to the API's limit (`FIELD_MAX`, counted in code points).
+ * Nothing is parsed. A longer one becomes `…` and its first 4,095 code points, so that the cut text parses to no site.
+ */
+export function boundedTabURL(url) {
+    const line = oneLine(url, Infinity);
+    return cutPoints(line, FIELD_MAX) === line ? line : '\u2026' + cutPoints(line, FIELD_MAX - 1);
+}
+/**
+ * The text blocks of a `ToolError`'s content. Deliberate, like the empty-content placeholder: the API accepts only
+ * text on an is_error result and answers anything else with a 400 that ends the run, so an image a member attached to
+ * its refusal is dropped here rather than ending the whole loop. The refusal's text still reaches the model.
+ */
+export function errorTextContent(content) {
+    // The API rejects an `is_error` result whose content is empty or holds a non-text block. Empty text blocks are
+    // dropped too, so an error with no text left gets the placeholder from `toolsetResultBlock`.
+    if (typeof content === 'string')
+        return wellFormed(content);
+    return content
+        .filter((block) => block.type === 'text' && block.text !== '')
+        .map((block) => ({ ...block, text: wellFormed(block.text) }));
+}
+//# sourceMappingURL=sanitize.mjs.map

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/sanitize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.mjs","sourceRoot":"","sources":["../../../src/lib/internal/toolsets/sanitize.ts"],"names":[],"mappings":"AAiBA;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GACtB,yFAAyF,CAAC;AAC5F,MAAM,UAAU,GAAG,eAAe,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,WAAW,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAClF,oHAAoH;AACpH,mHAAmH;AACnH,kDAAkD;AAClD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AACD;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC;AAC9B,MAAM,OAAO,GAAG,GAAG,CAAC;AAEpB;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,QAAgB,SAAS;IAC7D,OAAO,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;AAC5E,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAO,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,kEAAkE;IACzG,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,MAAM,KAAK,KAAK;YAAE,MAAM;QAC5B,MAAM,IAAI,CAAC,CAAC;QACZ,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,OAAO,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAoC;IACnE,+GAA+G;IAC/G,6FAA6F;IAC7F,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5D,OAAO,OAAO;SACX,MAAM,CAAC,CAAC,KAAK,EAA+B,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;SAC1F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/security-node.d.mts

@@ -0,0 +1,48 @@
+import type { BetaFilePolicy, BetaURLContext } from "./hooks.mjs";
+/** Whether `candidate` resolves to `root` or a descendant of it. Both sides may be not-yet-existing. */
+export declare function resolvesUnder(candidate: string, root: string): Promise<boolean>;
+/**
+ * Default-deny upload allowlist: resolves to the real path when it is one of `roots` or below one by whole path
+ * components, with symlinks resolved on both sides, and rejects with `UploadRefusedError` otherwise. The refusal
+ * never lists the roots. Empty `roots` refuses everything. A root that does not exist on disk grants
+ * nothing. A `..` component (and, on Windows, a UNC path or a DOS device name) is refused outright, before the
+ * filesystem is touched. A dangling symlink or a symlink cycle under a root is refused rather than judged by its
+ * target. Upload the returned path, not the argument.
+ */
+export declare function betaCheckUploadPath(candidate: string, roots: Iterable<string>): Promise<string>;
+export interface BetaNodeFilePolicyOptions {
+    /** `file_upload` may read paths under these directories. Empty (the default) refuses every path. */
+    uploadRoots?: readonly string[] | undefined;
+    /**
+     * Where the driver writes downloads. Exposed paths must resolve under it. Its overlap with the upload roots is
+     * compared on the paths as written, ignoring letter case, so a `downloadDir` that is, or sits under, a working
+     * symlink into an upload root is not caught, nor is an upload root that links into `downloadDir`. A link that
+     * does not resolve is refused.
+     */
+    downloadDir?: string | undefined;
+    /** Default false: download paths never reach the model. Has no effect without `downloadDir`. */
+    exposeDownloadPaths?: boolean | undefined;
+    /** Document ids (files staged with the Files API) `file_upload` may name. Empty (the default) refuses every id. */
+    uploadDocumentIds?: readonly string[] | undefined;
+}
+/**
+ * The file policy the SDK ships: `file_upload` may read paths under `uploadRoots` (symlinks resolved,
+ * whole components compared, a `..` component refused outright) and may name the document ids listed in
+ * `uploadDocumentIds` (none by default), and a `download_completed` path reaches the model only with
+ * `exposeDownloadPaths: true` and only when it lies inside `downloadDir`.
+ *
+ * Keep the roots to one dedicated directory holding only the task's files, and put `downloadDir`
+ * outside every upload root and outside anything another tool can reach. The driver decides where
+ * downloads are written, and this object only decides what the model may see.
+ */
+export declare class BetaNodeFilePolicy implements BetaFilePolicy {
+    readonly uploadRoots: readonly string[];
+    readonly downloadDir: string | undefined;
+    readonly exposeDownloadPaths: boolean;
+    readonly uploadDocumentIds: ReadonlySet<string>;
+    constructor(options?: BetaNodeFilePolicyOptions);
+    resolveUploadPaths(_ctx: BetaURLContext, paths: string[]): Promise<string[]>;
+    resolveUploadDocuments(_ctx: BetaURLContext, documentIds: string[]): string[];
+    isPathVisible(candidate: string): Promise<boolean>;
+}
+//# sourceMappingURL=security-node.d.mts.map

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/security-node.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-node.d.mts","sourceRoot":"","sources":["../../../src/lib/internal/toolsets/security-node.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAgB;AA+F9D,wGAAwG;AACxG,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUrF;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CA8DrG;AAqCD,MAAM,WAAW,yBAAyB;IACxC,oGAAoG;IACpG,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C,mHAAmH;IACnH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,cAAc;IACvD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAEpC,OAAO,GAAE,yBAA8B;IA8B7C,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAMlF,sBAAsB,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;IASvE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUzD"}

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/security-node.d.ts

@@ -0,0 +1,48 @@
+import type { BetaFilePolicy, BetaURLContext } from "./hooks.js";
+/** Whether `candidate` resolves to `root` or a descendant of it. Both sides may be not-yet-existing. */
+export declare function resolvesUnder(candidate: string, root: string): Promise<boolean>;
+/**
+ * Default-deny upload allowlist: resolves to the real path when it is one of `roots` or below one by whole path
+ * components, with symlinks resolved on both sides, and rejects with `UploadRefusedError` otherwise. The refusal
+ * never lists the roots. Empty `roots` refuses everything. A root that does not exist on disk grants
+ * nothing. A `..` component (and, on Windows, a UNC path or a DOS device name) is refused outright, before the
+ * filesystem is touched. A dangling symlink or a symlink cycle under a root is refused rather than judged by its
+ * target. Upload the returned path, not the argument.
+ */
+export declare function betaCheckUploadPath(candidate: string, roots: Iterable<string>): Promise<string>;
+export interface BetaNodeFilePolicyOptions {
+    /** `file_upload` may read paths under these directories. Empty (the default) refuses every path. */
+    uploadRoots?: readonly string[] | undefined;
+    /**
+     * Where the driver writes downloads. Exposed paths must resolve under it. Its overlap with the upload roots is
+     * compared on the paths as written, ignoring letter case, so a `downloadDir` that is, or sits under, a working
+     * symlink into an upload root is not caught, nor is an upload root that links into `downloadDir`. A link that
+     * does not resolve is refused.
+     */
+    downloadDir?: string | undefined;
+    /** Default false: download paths never reach the model. Has no effect without `downloadDir`. */
+    exposeDownloadPaths?: boolean | undefined;
+    /** Document ids (files staged with the Files API) `file_upload` may name. Empty (the default) refuses every id. */
+    uploadDocumentIds?: readonly string[] | undefined;
+}
+/**
+ * The file policy the SDK ships: `file_upload` may read paths under `uploadRoots` (symlinks resolved,
+ * whole components compared, a `..` component refused outright) and may name the document ids listed in
+ * `uploadDocumentIds` (none by default), and a `download_completed` path reaches the model only with
+ * `exposeDownloadPaths: true` and only when it lies inside `downloadDir`.
+ *
+ * Keep the roots to one dedicated directory holding only the task's files, and put `downloadDir`
+ * outside every upload root and outside anything another tool can reach. The driver decides where
+ * downloads are written, and this object only decides what the model may see.
+ */
+export declare class BetaNodeFilePolicy implements BetaFilePolicy {
+    readonly uploadRoots: readonly string[];
+    readonly downloadDir: string | undefined;
+    readonly exposeDownloadPaths: boolean;
+    readonly uploadDocumentIds: ReadonlySet<string>;
+    constructor(options?: BetaNodeFilePolicyOptions);
+    resolveUploadPaths(_ctx: BetaURLContext, paths: string[]): Promise<string[]>;
+    resolveUploadDocuments(_ctx: BetaURLContext, documentIds: string[]): string[];
+    isPathVisible(candidate: string): Promise<boolean>;
+}
+//# sourceMappingURL=security-node.d.ts.map

package/node_modules/@anthropic-ai/sdk/lib/internal/toolsets/security-node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-node.d.ts","sourceRoot":"","sources":["../../../src/lib/internal/toolsets/security-node.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,mBAAgB;AA+F9D,wGAAwG;AACxG,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUrF;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CA8DrG;AAqCD,MAAM,WAAW,yBAAyB;IACxC,oGAAoG;IACpG,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,gGAAgG;IAChG,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C,mHAAmH;IACnH,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACnD;AAED;;;;;;;;;GASG;AACH,qBAAa,kBAAmB,YAAW,cAAc;IACvD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;gBAEpC,OAAO,GAAE,yBAA8B;IA8B7C,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAMlF,sBAAsB,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;IASvE,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAUzD"}