@vibesdotdev/secrets 0.0.2 → 1.0.0-rc.3

package/dist/surfaces/tui/state/secrets.tui-state.key.d.ts

@@ -0,0 +1,19 @@
+export { SecretDescriptorEntrySchema, SecretsListStateSchema, type SecretDescriptorEntry, type SecretsListState } from "../../../schemas/ui/tui/list.schema.ts";
+export declare const secretsListStateKey: import("@vibesdotdev/tui").TuiStateKey<{
+    environment: string;
+    tier: "local" | "dev" | "staging" | "production" | null;
+    secrets: readonly Readonly<{
+        id: string;
+        key: string;
+        source: string;
+        hasValue: boolean;
+        backend: string;
+        backendId: string;
+        tier: "local" | "dev" | "staging" | "production";
+    }>[];
+    loaded: boolean;
+    loading: boolean;
+    error: string | null;
+    lastUpdated: number | null;
+}>;
+//# sourceMappingURL=secrets.tui-state.key.d.ts.map

package/dist/surfaces/tui/state/secrets.tui-state.key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-state.key.d.ts","sourceRoot":"","sources":["../../../../src/surfaces/tui/state/secrets.tui-state.key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAC,sBAAsB,EAAC,KAAK,qBAAqB,EAAC,KAAK,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAQ7J,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;EAA4D,CAAC"}

package/dist/surfaces/tui/state/secrets.tui-state.key.js

@@ -0,0 +1,10 @@
+import { SecretsListStateSchema } from "../../../schemas/ui/tui/list.schema.js";
+export { SecretDescriptorEntrySchema, SecretsListStateSchema } from "../../../schemas/ui/tui/list.schema.js";
+/**
+ * The `secrets.list` tui/state key: the secret descriptors the secrets TUI
+ * lists (never their values), with the schema every value written to it is
+ * parsed by.
+ */
+import { defineTuiStateKey } from '@vibesdotdev/tui/kinds/tui-state';
+export const secretsListStateKey = defineTuiStateKey('secrets.list', SecretsListStateSchema);
+//# sourceMappingURL=secrets.tui-state.key.js.map

package/dist/surfaces/tui/state/secrets.tui-state.key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.tui-state.key.js","sourceRoot":"","sources":["../../../../src/surfaces/tui/state/secrets.tui-state.key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,2BAA2B,EAAC,sBAAsB,EAAmD,MAAM,wCAAwC,CAAC;AAC7J;;;;GAIG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC"}

package/dist/transport/bounded-body.d.ts

@@ -0,0 +1,17 @@
+import { type BoundedText } from "../schemas/transport/body.schema.ts";
+export { type BoundedText } from "../schemas/transport/body.schema.ts";
+/**
+ * Bounded reads of a response body and the deadline a request carries. A
+ * server that never stops sending, or never answers, must cost this process a
+ * bounded amount of memory and time.
+ */
+import type { CaughtFailure } from '@vibesdotdev/kernel';
+/**
+ * Read at most `maxBytes` BYTES of `response`'s body, then stop reading and
+ * release the connection. The cap is in bytes on the wire, not characters: a
+ * multi-byte body cannot exceed it by being clipped after the fact.
+ */
+export declare function readBoundedText(response: Response, maxBytes: number): Promise<BoundedText>;
+/** True for the failure an `AbortSignal.timeout` deadline raises. */
+export declare function isDeadlineFailure(failure: CaughtFailure): boolean;
+//# sourceMappingURL=bounded-body.d.ts.map

package/dist/transport/bounded-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-body.d.ts","sourceRoot":"","sources":["../../src/transport/bounded-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,qCAAqC,CAAC;AACvE;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA6BhG;AAaD,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAEjE"}

package/dist/transport/bounded-body.js

@@ -0,0 +1,56 @@
+import {} from "../schemas/transport/body.schema.js";
+export {} from "../schemas/transport/body.schema.js";
+/**
+ * Read at most `maxBytes` BYTES of `response`'s body, then stop reading and
+ * release the connection. The cap is in bytes on the wire, not characters: a
+ * multi-byte body cannot exceed it by being clipped after the fact.
+ */
+export async function readBoundedText(response, maxBytes) {
+    const body = response.body;
+    if (body === null)
+        return { text: '', truncated: false };
+    const reader = body.getReader();
+    const chunks = [];
+    let received = 0;
+    let truncated = false;
+    for (;;) {
+        const step = await reader.read();
+        if (step.done)
+            break;
+        const remaining = maxBytes - received;
+        if (step.value.byteLength > remaining) {
+            if (remaining > 0)
+                chunks.push(step.value.subarray(0, remaining));
+            received += Math.max(remaining, 0);
+            truncated = true;
+            await reader.cancel();
+            break;
+        }
+        chunks.push(step.value);
+        received += step.value.byteLength;
+    }
+    const joined = new Uint8Array(received);
+    let offset = 0;
+    for (const chunk of chunks) {
+        joined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    const end = truncated ? completeUtf8Length(joined) : joined.byteLength;
+    return { text: new TextDecoder().decode(joined.subarray(0, end)), truncated };
+}
+/** The length of `bytes` without a trailing, cut-off UTF-8 sequence (so no U+FFFD is invented at the cut). */
+function completeUtf8Length(bytes) {
+    for (let back = 1; back <= Math.min(3, bytes.byteLength); back += 1) {
+        const byte = bytes[bytes.byteLength - back];
+        if ((byte & 0b1100_0000) === 0b1000_0000)
+            continue; // a continuation byte: keep looking for its lead
+        const needed = byte >= 0b1111_0000 ? 4 : byte >= 0b1110_0000 ? 3 : byte >= 0b1100_0000 ? 2 : 1;
+        return needed > back ? bytes.byteLength - back : bytes.byteLength;
+    }
+    return bytes.byteLength;
+}
+/** True for the failure an `AbortSignal.timeout` deadline raises. */
+export function isDeadlineFailure(failure) {
+    return failure instanceof Error && (failure.name === 'TimeoutError' || failure.name === 'AbortError');
+}
+//# sourceMappingURL=bounded-body.js.map

package/dist/transport/bounded-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-body.js","sourceRoot":"","sources":["../../src/transport/bounded-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAoB,MAAM,qCAAqC,CAAC;AASvE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAkB,EAAE,QAAgB;IACzE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,SAAS,CAAC;QACT,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM;QACrB,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;QACtC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC;YACvC,IAAI,SAAS,GAAG,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;YAClE,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACnC,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM;QACP,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AAC/E,CAAC;AAED,8GAA8G;AAC9G,SAAS,kBAAkB,CAAC,KAAiB;IAC5C,KAAK,IAAI,IAAI,GAAG,CAAC,EAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,EAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC,KAAK,WAAW;YAAE,SAAS,CAAC,iDAAiD;QACrG,MAAM,MAAM,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,OAAO,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC;AACzB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACvD,OAAO,OAAO,YAAY,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;AACvG,CAAC"}

package/dist/transport/header-value.d.ts

@@ -0,0 +1,12 @@
+import { type HeaderSetOutcome } from "../schemas/transport/header.schema.ts";
+export { type HeaderSetOutcome } from "../schemas/transport/header.schema.ts";
+/** True when `value` is a header value that can be sent as is: no code unit above U+00FF, no control character but a tab. */
+export declare function isSendableHeaderValue(value: string): boolean;
+/**
+ * Set `name: value` on `headers`. A value that is not sendable is refused before
+ * `Headers` sees it; if `Headers` still throws, the outcome carries that failure
+ * value-free (see {@link HeaderSetOutcome}) instead of letting its value-quoting
+ * message escape.
+ */
+export declare function setHeaderValue(headers: Headers, name: string, value: string): HeaderSetOutcome;
+//# sourceMappingURL=header-value.d.ts.map

package/dist/transport/header-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-value.d.ts","sourceRoot":"","sources":["../../src/transport/header-value.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAiB9E,6HAA6H;AAC7H,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM5D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAQ9F"}

package/dist/transport/header-value.js

@@ -0,0 +1,43 @@
+import {} from "../schemas/transport/header.schema.js";
+export {} from "../schemas/transport/header.schema.js";
+/**
+ * Header values a credential rides in. The runtime's `Headers` and `fetch` throw
+ * a `TypeError` that QUOTES the offending value, so a credential that is not a
+ * legal header value must be refused here, by shape, before it reaches either:
+ * the refusal names the problem, never the value.
+ *
+ * A legal value is bytes (every code unit at most U+00FF) with no control
+ * character except the tab; anything else cannot be sent and would split or
+ * corrupt the message.
+ */
+import { CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { hasControlCharacter } from "./text.js";
+const LATIN1_MAX = 0xff;
+/** True when `value` is a header value that can be sent as is: no code unit above U+00FF, no control character but a tab. */
+export function isSendableHeaderValue(value) {
+    if (hasControlCharacter(value, true))
+        return false;
+    for (let index = 0; index < value.length; index += 1) {
+        if (value.charCodeAt(index) > LATIN1_MAX)
+            return false;
+    }
+    return true;
+}
+/**
+ * Set `name: value` on `headers`. A value that is not sendable is refused before
+ * `Headers` sees it; if `Headers` still throws, the outcome carries that failure
+ * value-free (see {@link HeaderSetOutcome}) instead of letting its value-quoting
+ * message escape.
+ */
+export function setHeaderValue(headers, name, value) {
+    if (!isSendableHeaderValue(value))
+        return { ok: false, problem: 'value-not-sendable' };
+    try {
+        headers.set(name, value);
+    }
+    catch (thrown) {
+        return { ok: false, problem: 'value-rejected', failure: valueFreeFailure(CaughtFailureSchema.parse(thrown)) };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=header-value.js.map

package/dist/transport/header-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"header-value.js","sourceRoot":"","sources":["../../src/transport/header-value.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAyB,MAAM,uCAAuC,CAAC;AAC9E;;;;;;;;;GASG;AAEH,OAAO,EAAE,mBAAmB,EAAC,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,6HAA6H;AAC7H,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,IAAI,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAC,KAAK,GAAG,KAAK,CAAC,MAAM,EAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,UAAU;YAAE,OAAO,KAAK,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB,EAAE,IAAY,EAAE,KAAa;IAC3E,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IACvF,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAC/G,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACrB,CAAC"}

package/dist/transport/host-file.d.ts

@@ -0,0 +1,14 @@
+import { type HostFileSubject } from "../schemas/transport/file.schema.ts";
+export { type HostFileSubject } from "../schemas/transport/file.schema.ts";
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+/**
+ * The text of `path`, at most `maxBytes` bytes, read ITSELF through the
+ * adapter's bounded read (never a size check followed by an unbounded read, so a
+ * file that grows or a FIFO cannot outrun the cap). A missing file is
+ * `NOT_FOUND host-file-missing`, a larger one `INVALID_INPUT host-file-too-large`,
+ * and any other read failure `UNAVAILABLE host-file-unreadable` carrying the
+ * cause; an adapter that cannot bound a read is `UNAVAILABLE
+ * filesystem-versioned-file-unavailable`. The path is never put in the message.
+ */
+export declare function readHostTextFile(runtime: Pick<RuntimeRef, 'hasKind' | 'query'>, path: string, subject: HostFileSubject, maxBytes: number): Promise<string>;
+//# sourceMappingURL=host-file.d.ts.map

package/dist/transport/host-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-file.d.ts","sourceRoot":"","sources":["../../src/transport/host-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAW3E,OAAO,EAAyD,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAiD7G;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,EAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAyBjB"}

package/dist/transport/host-file.js

@@ -0,0 +1,93 @@
+import {} from "../schemas/transport/file.schema.js";
+export {} from "../schemas/transport/file.schema.js";
+import { CapabilityError, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+const NativeFailureSchema = z.object({ code: z.string() });
+/** Confirmed absence: the host's `ENOENT`, or a typed `NOT_FOUND` from the adapter. */
+function isConfirmedAbsence(failure) {
+    if (failure instanceof CapabilityError)
+        return failure.code === 'NOT_FOUND';
+    const native = NativeFailureSchema.safeParse(failure);
+    return native.success && native.data.code === 'ENOENT';
+}
+async function resolveAdapter(runtime) {
+    if (!runtime.hasKind('filesystem/adapter')) {
+        throw new CapabilityError('No filesystem/adapter kind is registered on this runtime.', 'UNAVAILABLE', {
+            reason: 'filesystem-adapter-not-registered',
+            retryable: false
+        });
+    }
+    const adapter = await runtime
+        .query('filesystem/adapter')
+        .resolve();
+    if (!adapter) {
+        throw new CapabilityError('Failed to resolve filesystem/adapter.', 'UNAVAILABLE', {
+            reason: 'filesystem-adapter-unavailable',
+            retryable: false
+        });
+    }
+    return adapter;
+}
+/**
+ * The adapter's size-bounded read, or a typed refusal: a stat-then-read would
+ * read a growing file or a FIFO without limit, and an unbounded fallback would
+ * read a hostile file whole.
+ */
+function boundedReader(adapter) {
+    const read = adapter.readFileVersioned;
+    if (!adapter.descriptor.capabilities.includes('versioned-file') || !read) {
+        throw new CapabilityError('This filesystem adapter cannot bound a read, which reading a host file needs.', 'UNAVAILABLE', {
+            reason: 'filesystem-versioned-file-unavailable',
+            retryable: false,
+            details: { adapterId: adapter.descriptor.id, capability: 'versioned-file' },
+            recoveryHint: 'Select a filesystem adapter that advertises versioned-file.'
+        });
+    }
+    return (path, maxBytes) => read.call(adapter, path, { maxBytes });
+}
+/**
+ * The text of `path`, at most `maxBytes` bytes, read ITSELF through the
+ * adapter's bounded read (never a size check followed by an unbounded read, so a
+ * file that grows or a FIFO cannot outrun the cap). A missing file is
+ * `NOT_FOUND host-file-missing`, a larger one `INVALID_INPUT host-file-too-large`,
+ * and any other read failure `UNAVAILABLE host-file-unreadable` carrying the
+ * cause; an adapter that cannot bound a read is `UNAVAILABLE
+ * filesystem-versioned-file-unavailable`. The path is never put in the message.
+ */
+export async function readHostTextFile(runtime, path, subject, maxBytes) {
+    const adapter = await resolveAdapter(runtime);
+    const read = boundedReader(adapter);
+    let result;
+    try {
+        result = await read(path, maxBytes);
+    }
+    catch (raw) {
+        throw readFailure(CaughtFailureSchema.parse(raw), subject);
+    }
+    switch (result.status) {
+        case 'ok':
+            return new TextDecoder().decode(result.bytes);
+        case 'not-found':
+            throw readFailure(new Error(result.reason), subject, true);
+        case 'too-large':
+            throw new CapabilityError(`The ${subject.label} is larger than ${maxBytes} bytes.`, 'INVALID_INPUT', {
+                reason: 'host-file-too-large',
+                retryable: false,
+                details: { subject: subject.label, maxBytes }
+            });
+        case 'unavailable':
+            throw readFailure(result.cause ?? new Error(result.reason), subject);
+        default:
+            throw readFailure(new Error(result.reason), subject);
+    }
+}
+/** A failed read as its typed refusal: confirmed absence is `NOT_FOUND`, anything else `UNAVAILABLE`. */
+function readFailure(failure, subject, absent = isConfirmedAbsence(failure)) {
+    return new CapabilityError(absent ? `The ${subject.label} does not exist.` : `The ${subject.label} could not be read.`, absent ? 'NOT_FOUND' : 'UNAVAILABLE', {
+        reason: absent ? 'host-file-missing' : 'host-file-unreadable',
+        retryable: false,
+        details: { subject: subject.label },
+        cause: failure
+    });
+}
+//# sourceMappingURL=host-file.js.map

package/dist/transport/host-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-file.js","sourceRoot":"","sources":["../../src/transport/host-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAW3E,OAAO,EAAE,eAAe,EAAC,mBAAmB,EAAqC,MAAM,qBAAqB,CAAC;AAC7G,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE3D,uFAAuF;AACvF,SAAS,kBAAkB,CAAC,OAAsB;IACjD,IAAI,OAAO,YAAY,eAAe;QAAE,OAAO,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC;IAC5E,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAA8C;IAC3E,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,2DAA2D,EAAE,aAAa,EAAE;YACrG,MAAM,EAAE,mCAAmC;YAC3C,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,OAAO;SAC3B,KAAK,CAA0D,oBAAoB,CAAC;SACpF,OAAO,EAAE,CAAC;IACZ,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,aAAa,EAAE;YACjF,MAAM,EAAE,gCAAgC;YACxC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAmC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1E,MAAM,IAAI,eAAe,CAAC,+EAA+E,EAAE,aAAa,EAAE;YACzH,MAAM,EAAE,uCAAuC;YAC/C,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,EAAE,gBAAgB,EAAE;YAC3E,YAAY,EAAE,6DAA6D;SAC3E,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,OAA8C,EAC9C,IAAY,EACZ,OAAwB,EACxB,QAAgB;IAEhB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAA2B,CAAC;IAChC,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,IAAI;YACR,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/C,KAAK,WAAW;YACf,MAAM,WAAW,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5D,KAAK,WAAW;YACf,MAAM,IAAI,eAAe,CAAC,OAAO,OAAO,CAAC,KAAK,mBAAmB,QAAQ,SAAS,EAAE,eAAe,EAAE;gBACpG,MAAM,EAAE,qBAAqB;gBAC7B,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE;aAC7C,CAAC,CAAC;QACJ,KAAK,aAAa;YACjB,MAAM,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE;YACC,MAAM,WAAW,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;AACF,CAAC;AAED,yGAAyG;AACzG,SAAS,WAAW,CAAC,OAAsB,EAAE,OAAwB,EAAE,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC;IAC1G,OAAO,IAAI,eAAe,CACzB,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,qBAAqB,EAC3F,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EACpC;QACC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB;QAC7D,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE;QACnC,KAAK,EAAE,OAAO;KACd,CACD,CAAC;AACH,CAAC"}

package/dist/transport/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @vibesdotdev/secrets/transport
+ *
+ * The generic network/file guards every secrets backend — in this package or
+ * in a provider package composing it — parses targets and bounds I/O with.
+ * Named re-exports only (STANDING-PRINCIPLES §5: no `export *` barrels).
+ */
+export { isDeadlineFailure, readBoundedText, type BoundedText } from './bounded-body.ts';
+export { isSendableHeaderValue, setHeaderValue, type HeaderSetOutcome } from './header-value.ts';
+export { readHostTextFile, type HostFileSubject } from './host-file.ts';
+export { parseJsonBody, type JsonBodyOutcome } from './json-body.ts';
+export { isDevelopmentHost, isLoopbackHostname, parseSecureUrl, redactUrlForDisplay, scrubUrlFromText, type DevelopmentHostRuntime, type SecureUrlPolicy, type SecureUrlProblem, type SecureUrlResult } from './secure-url.ts';
+export { hasControlCharacter, printableLine } from './text.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/transport/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAC,eAAe,EAAC,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAC,cAAc,EAAC,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAC,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAC,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACP,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAC,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/transport/index.js

@@ -0,0 +1,14 @@
+/**
+ * @vibesdotdev/secrets/transport
+ *
+ * The generic network/file guards every secrets backend — in this package or
+ * in a provider package composing it — parses targets and bounds I/O with.
+ * Named re-exports only (STANDING-PRINCIPLES §5: no `export *` barrels).
+ */
+export { isDeadlineFailure, readBoundedText } from "./bounded-body.js";
+export { isSendableHeaderValue, setHeaderValue } from "./header-value.js";
+export { readHostTextFile } from "./host-file.js";
+export { parseJsonBody } from "./json-body.js";
+export { isDevelopmentHost, isLoopbackHostname, parseSecureUrl, redactUrlForDisplay, scrubUrlFromText } from "./secure-url.js";
+export { hasControlCharacter, printableLine } from "./text.js";
+//# sourceMappingURL=index.js.map

package/dist/transport/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transport/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAC,eAAe,EAAmB,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAC,cAAc,EAAwB,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAuB,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,aAAa,EAAuB,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACP,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAKf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAC,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/transport/json-body.d.ts

@@ -0,0 +1,5 @@
+import { type JsonBodyOutcome } from "../schemas/transport/json.schema.ts";
+export { type JsonBodyOutcome } from "../schemas/transport/json.schema.ts";
+import type * as z from 'zod/v4';
+export declare function parseJsonBody<S extends z.ZodType>(text: string, schema: S): JsonBodyOutcome<z.output<S>>;
+//# sourceMappingURL=json-body.d.ts.map

package/dist/transport/json-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-body.d.ts","sourceRoot":"","sources":["../../src/transport/json-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAQ3E,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,CAAC;AAEjC,wBAAgB,aAAa,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAUxG"}

package/dist/transport/json-body.js

@@ -0,0 +1,23 @@
+import {} from "../schemas/transport/json.schema.js";
+export {} from "../schemas/transport/json.schema.js";
+/**
+ * Untrusted JSON text, parsed once with a schema. A body is never `as`-cast, and
+ * the syntax error of a malformed body is carried to the caller as data rather
+ * than thrown: a body that held a secret must not have a parser quote it into a
+ * typed refusal, so the caller decides whether the failure travels on.
+ */
+import { CaughtFailureSchema } from '@vibesdotdev/kernel';
+export function parseJsonBody(text, schema) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (thrown) {
+        return { ok: false, problem: 'not-json', failure: CaughtFailureSchema.parse(thrown) };
+    }
+    const parsed = schema.safeParse(raw);
+    if (!parsed.success)
+        return { ok: false, problem: 'schema-mismatch' };
+    return { ok: true, data: parsed.data };
+}
+//# sourceMappingURL=json-body.js.map

package/dist/transport/json-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-body.js","sourceRoot":"","sources":["../../src/transport/json-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAwB,MAAM,qCAAqC,CAAC;AAC3E;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG1D,MAAM,UAAU,aAAa,CAAsB,IAAY,EAAE,MAAS;IACzE,IAAI,GAAqC,CAAC;IAC1C,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACtE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC"}

package/dist/transport/secure-url.d.ts

@@ -0,0 +1,24 @@
+import { type DevelopmentHostRuntime, type SecureUrlPolicy, type SecureUrlResult } from "../schemas/transport/url.schema.ts";
+export { type DevelopmentHostRuntime, type SecureUrlPolicy, type SecureUrlProblem, type SecureUrlResult } from "../schemas/transport/url.schema.ts";
+/** True when the handed runtime declares itself a development host. Absent or `false`: not. */
+export declare function isDevelopmentHost(runtime: DevelopmentHostRuntime): boolean;
+/** `localhost`, any `*.localhost`, `127.0.0.0/8` and `::1`: this machine's own interface. */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Parse `raw` as a URL a credential may be sent to. Never throws; the refusal
+ * names the problem, never the URL.
+ */
+export declare function parseSecureUrl(raw: string, policy: SecureUrlPolicy): SecureUrlResult;
+/**
+ * `text` (an error message a fetch raised) with every spelling of `rawUrl` it
+ * may echo replaced by the redacted form: the URL itself, its normalized href,
+ * its query string and its userinfo.
+ */
+export declare function scrubUrlFromText(text: string, rawUrl: string): string;
+/**
+ * `raw` as a log, audit or warning line may carry it: scheme, host and path
+ * only. Userinfo, query and fragment are removed (a token rides there), and
+ * text that is not a URL is not echoed at all.
+ */
+export declare function redactUrlForDisplay(raw: string): string;
+//# sourceMappingURL=secure-url.d.ts.map

package/dist/transport/secure-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-url.d.ts","sourceRoot":"","sources":["../../src/transport/secure-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAAC,KAAK,eAAe,EAAC,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAC3H,OAAO,EAAE,KAAK,sBAAsB,EAAC,KAAK,eAAe,EAAC,KAAK,gBAAgB,EAAC,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAGjJ,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAE1E;AAED,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAK5D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,eAAe,CAYpF;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAWrE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIvD"}

package/dist/transport/secure-url.js

@@ -0,0 +1,67 @@
+import {} from "../schemas/transport/url.schema.js";
+export {} from "../schemas/transport/url.schema.js";
+/** True when the handed runtime declares itself a development host. Absent or `false`: not. */
+export function isDevelopmentHost(runtime) {
+    return runtime.scope.qualifiers.dev === true;
+}
+/** `localhost`, any `*.localhost`, `127.0.0.0/8` and `::1`: this machine's own interface. */
+export function isLoopbackHostname(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, '').replace(/\.+$/, '');
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (host === '::1')
+        return true;
+    return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+/**
+ * Parse `raw` as a URL a credential may be sent to. Never throws; the refusal
+ * names the problem, never the URL.
+ */
+export function parseSecureUrl(raw, policy) {
+    if (!URL.canParse(raw))
+        return { ok: false, problem: 'unparseable' };
+    const url = new URL(raw);
+    if (url.hostname.length === 0)
+        return { ok: false, problem: 'host-missing' };
+    if (url.username.length > 0 || url.password.length > 0) {
+        return { ok: false, problem: 'userinfo-not-allowed' };
+    }
+    if (url.protocol === 'https:')
+        return { ok: true, url };
+    if (url.protocol === 'http:' && policy.allowLoopbackHttp && isLoopbackHostname(url.hostname)) {
+        return { ok: true, url };
+    }
+    return { ok: false, problem: 'scheme-not-allowed' };
+}
+/**
+ * `text` (an error message a fetch raised) with every spelling of `rawUrl` it
+ * may echo replaced by the redacted form: the URL itself, its normalized href,
+ * its query string and its userinfo.
+ */
+export function scrubUrlFromText(text, rawUrl) {
+    const shown = redactUrlForDisplay(rawUrl);
+    let out = text.split(rawUrl).join(shown);
+    if (URL.canParse(rawUrl)) {
+        const url = new URL(rawUrl);
+        out = out.split(url.href).join(shown);
+        if (url.search.length > 1)
+            out = out.split(url.search).join('');
+        if (url.password.length > 0)
+            out = out.split(url.password).join('[redacted]');
+        if (url.username.length > 0)
+            out = out.split(url.username).join('[redacted]');
+    }
+    return out;
+}
+/**
+ * `raw` as a log, audit or warning line may carry it: scheme, host and path
+ * only. Userinfo, query and fragment are removed (a token rides there), and
+ * text that is not a URL is not echoed at all.
+ */
+export function redactUrlForDisplay(raw) {
+    if (!URL.canParse(raw))
+        return '[unparseable-url]';
+    const url = new URL(raw);
+    return `${url.protocol}//${url.host}${url.pathname}`;
+}
+//# sourceMappingURL=secure-url.js.map

package/dist/transport/secure-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-url.js","sourceRoot":"","sources":["../../src/transport/secure-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyE,MAAM,oCAAoC,CAAC;AAC3H,OAAO,EAA+F,MAAM,oCAAoC,CAAC;AAGjJ,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,OAA+B;IAChE,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,IAAI,CAAC;AAC9C,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,MAAuB;IAClE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC7E,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,iBAAiB,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAc;IAC5D,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9E,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC9C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;AACtD,CAAC"}

package/dist/transport/text.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Text checks for values that become part of a protocol message (a header
+ * value) or of a line a user reads (a server message), written as code-point
+ * scans so no control character is spelled in a pattern.
+ */
+/** True when `text` holds NUL or any control character; a tab is allowed when `allowTab` (a header value). */
+export declare function hasControlCharacter(text: string, allowTab: boolean): boolean;
+/** `text` with every control character replaced by a space, runs of whitespace collapsed, and ends trimmed. */
+export declare function printableLine(text: string): string;
+//# sourceMappingURL=text.d.ts.map

package/dist/transport/text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../src/transport/text.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,8GAA8G;AAC9G,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAM5E;AAED,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMlD"}

package/dist/transport/text.js

@@ -0,0 +1,28 @@
+/**
+ * Text checks for values that become part of a protocol message (a header
+ * value) or of a line a user reads (a server message), written as code-point
+ * scans so no control character is spelled in a pattern.
+ */
+const TAB = 0x09;
+const DELETE = 0x7f;
+function isControl(code) {
+    return code < 0x20 || code === DELETE;
+}
+/** True when `text` holds NUL or any control character; a tab is allowed when `allowTab` (a header value). */
+export function hasControlCharacter(text, allowTab) {
+    for (let index = 0; index < text.length; index += 1) {
+        const code = text.charCodeAt(index);
+        if (isControl(code) && !(allowTab && code === TAB))
+            return true;
+    }
+    return false;
+}
+/** `text` with every control character replaced by a space, runs of whitespace collapsed, and ends trimmed. */
+export function printableLine(text) {
+    let out = '';
+    for (let index = 0; index < text.length; index += 1) {
+        out += isControl(text.charCodeAt(index)) ? ' ' : text[index];
+    }
+    return out.replace(/\s+/g, ' ').trim();
+}
+//# sourceMappingURL=text.js.map

package/dist/transport/text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../../src/transport/text.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,GAAG,GAAG,IAAI,CAAC;AACjB,MAAM,MAAM,GAAG,IAAI,CAAC;AAEpB,SAAS,SAAS,CAAC,IAAY;IAC9B,OAAO,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,MAAM,CAAC;AACvC,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAiB;IAClE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,aAAa,CAAC,IAAY;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAC,KAAK,GAAG,IAAI,CAAC,MAAM,EAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC"}