@warlock.js/core 4.8.0 → 4.8.1

package/esm/ai/src/rag/store/pg-vector-store.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"pg-vector-store.mjs","names":[],"sources":["../../../../../../../../../../@warlock.js/ai/src/rag/store/pg-vector-store.ts"],"sourcesContent":["import type { VectorStore } from \"./vector-store.contract\";\n\n/**\n * Minimal `pg`-compatible client surface the Postgres {@link VectorStore}\n * depends on. Both `pg.Pool` and `pg.Client` satisfy it — the store only\n * ever calls `query`.\n *\n * `@warlock.js/ai` takes **no** hard dependency on `pg`; the dev installs\n * it (an optional peer) and passes the client in. Structurally identical\n * to the snapshot / human-interrupt stores' `PgClientLike`, so a single\n * pool can back the orchestrator checkpoint/snapshot tables, the\n * interrupt table, and this vectors table alike.\n */\nexport interface PgClientLike {\n  query(text: string, params?: unknown[]): Promise<{ rows: unknown[] }>;\n}\n\n/**\n * Options for the Postgres {@link VectorStore}.\n *\n * Two mutually-supportive ways to supply the connection (mirroring\n * `ai.human.interrupt.pg`):\n * - **`client`** — pass an already-built `pg.Pool` / `pg.Client` (anything\n *   satisfying {@link PgClientLike}). The store only ever calls `query`\n *   and never opens or closes it; one pool can back several stores.\n * - **`connectionString`** — let the store lazily `import(\"pg\")` and build\n *   its own `Pool`. `@warlock.js/ai` takes **no** hard dependency on\n *   `pg` (an optional peer); when it is absent the store throws a curated\n *   install string at first use, never a raw module-resolution stack trace\n *   at import.\n *\n * Exactly one of the two must be present.\n */\nexport interface PgVectorStoreOptions {\n  /** An already-built `pg.Pool` / `pg.Client` — anything matching {@link PgClientLike}. */\n  client?: PgClientLike;\n\n  /** Connection string the store passes to a lazily-imported `pg.Pool`. */\n  connectionString?: string;\n\n  /**\n   * Backing table name. Defaults to `warlock_ai_rag_vectors`. Must be a\n   * safe SQL identifier — it is interpolated into DDL/DML.\n   */\n  table?: string;\n\n  /**\n   * Embedding dimensionality used in the `CREATE TABLE` DDL emitted by\n   * {@link VectorStore.schema | ensureSchema}. Defaults to `1536`\n   * (OpenAI `text-embedding-3-small`). The column is declared\n   * `vector(N)`; queries and upserts never re-state it, so an existing\n   * table provisioned at a different size is unaffected — only the DDL\n   * helper reads this.\n   */\n  dimensions?: number;\n\n  /**\n   * Approximate-nearest-neighbour index strategy baked into the DDL\n   * emitted by {@link VectorStore.schema | ensureSchema}. Defaults to\n   * `\"hnsw\"` (better recall/latency on modern pgvector). Use `\"ivfflat\"`\n   * for the classic list-partitioned index, or `\"none\"` to emit no ANN\n   * index (exact scan — correct, but linear in row count).\n   */\n  index?: \"hnsw\" | \"ivfflat\" | \"none\";\n\n  /**\n   * `lists` parameter for an `ivfflat` index (ignored for `hnsw` / `none`).\n   * Defaults to `100`. Tune toward `rows / 1000` for large tables.\n   */\n  ivfflatLists?: number;\n}\n\n/**\n * Default backing table — provisions the store with no extra config when\n * the dev runs {@link VectorStore.schema | ensureSchema} through their\n * migration tool.\n */\nconst DEFAULT_TABLE = \"warlock_ai_rag_vectors\";\n\n/** Default embedding width baked into the DDL (OpenAI `text-embedding-3-small`). */\nconst DEFAULT_DIMENSIONS = 1536;\n\n/** Default `ivfflat` list count when that index strategy is chosen. */\nconst DEFAULT_IVFFLAT_LISTS = 100;\n\n/**\n * Allowed characters in a Postgres identifier (table name). The table name\n * is interpolated into DDL/DML, so anything outside this conservative\n * ASCII subset is rejected — interpolating an arbitrary string would be a\n * SQL-injection footgun (mirrors the snapshot / human-interrupt pg stores\n * and `@warlock.js/cache`'s `PgCacheDriver`).\n */\nconst SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\n/**\n * Module specifier for the optional `pg` driver. Held in a `string`\n * variable so the dynamic `import()` is not statically resolved at compile\n * time — `pg` is an optional peer that need not be installed for this\n * package to type-check or for a cache-only consumer to run.\n */\nconst PG_MODULE = \"pg\";\n\n/**\n * Curated install string surfaced (at use time) when a `connectionString`\n * is configured but the optional `pg` driver is absent. Never thrown at\n * import — a cache-only consumer must be able to load this module.\n */\nconst PG_INSTALL_INSTRUCTIONS = `\nThe @warlock.js/ai Postgres vector store requires the pg package and a\nPostgres database with the pgvector extension. Install the driver with:\n\n  npm install pg\n\nOr with your preferred package manager:\n\n  pnpm add pg\n  yarn add pg\n`.trim();\n\n/**\n * Minimal structural view of a `pg.Pool` constructor — just enough of the\n * `pg` module surface for the store to build a client when handed a\n * `connectionString`. Declared locally (rather than `typeof import(\"pg\")`)\n * so this module type-checks even when `pg` is not installed.\n */\ninterface PgModuleLike {\n  Pool: new (config: { connectionString: string }) => PgClientLike;\n}\n\n/**\n * Lazily import `pg` and return a `Pool` built from `connectionString`. A\n * bare `catch` rethrows the curated install string — a missing optional\n * peer surfaces as actionable guidance, never a raw resolution error.\n */\nasync function buildPgClient(connectionString: string): Promise<PgClientLike> {\n  let sdk: PgModuleLike;\n\n  try {\n    sdk = (await import(PG_MODULE)) as unknown as PgModuleLike;\n  } catch {\n    throw new Error(PG_INSTALL_INSTRUCTIONS);\n  }\n\n  return new sdk.Pool({ connectionString });\n}\n\n/**\n * Serialize a JS `number[]` to the pgvector text literal: `[1,2,3]`.\n * pgvector accepts a vector either as this bracketed literal or via a\n * typed parameter; passing the literal string + an explicit `::vector`\n * cast keeps the store driver-agnostic (no dependency on a registered\n * `pg` type parser).\n *\n * Non-finite components (`NaN` / `±Infinity`) are rejected — pgvector\n * stores only finite floats, and silently coercing them would corrupt the\n * index. The check is cheap relative to the embed call that produced the\n * vector.\n *\n * @example\n * vectorLiteral([1, 0.5, -2]); // \"[1,0.5,-2]\"\n */\nexport function vectorLiteral(vector: number[]): string {\n  let literal = \"[\";\n\n  for (let index = 0; index < vector.length; index++) {\n    const component = vector[index];\n\n    if (!Number.isFinite(component)) {\n      throw new TypeError(\n        `pgVectorStore: embedding component at index ${index} is not finite (${component}); pgvector stores only finite floats.`,\n      );\n    }\n\n    if (index > 0) {\n      literal += \",\";\n    }\n\n    literal += String(component);\n  }\n\n  return literal + \"]\";\n}\n\n/**\n * Coerce a `value` JSONB column back into the stored payload. node-postgres\n * parses `JSONB` into a JS value already, but some pool wrappers hand back\n * the raw string — be defensive across both (mirrors the snapshot store's\n * `parsePayload`).\n */\nfunction parseValue<T>(value: unknown): T {\n  if (typeof value === \"string\") {\n    return JSON.parse(value) as T;\n  }\n\n  return value as T;\n}\n\n/**\n * Coerce a pgvector cosine **distance** (`<=>`, in `[0, 2]`, 0 = identical)\n * into the cosine **similarity** score the {@link VectorStore} contract\n * declares (`[0, 1]`, 1 = identical). `pg` returns the computed distance\n * column as a string for `double precision`; parse then map `1 - distance`,\n * clamped to `[0, 1]` so a tiny floating-point overshoot never yields a\n * score just outside the contract's range.\n */\nfunction distanceToScore(distance: unknown): number {\n  const value = typeof distance === \"string\" ? Number(distance) : (distance as number);\n  const score = 1 - value;\n\n  if (score < 0) {\n    return 0;\n  }\n\n  if (score > 1) {\n    return 1;\n  }\n\n  return score;\n}\n\n/**\n * Postgres + pgvector-backed {@link VectorStore} — one durable row per\n * indexed chunk, keyed by the RAG pipeline's dotted `key`\n * (`ai.rag.<name>.<sourceId>.<chunkIndex>`), with the chunk payload in a\n * `value` JSONB column and the embedding in a `vector` column.\n *\n * Owns: the three RAG vector operations against a pgvector index —\n * `upsert` (INSERT … ON CONFLICT DO UPDATE), `query` (cosine\n * `ORDER BY embedding <=> $vec` with a `threshold` floor + optional `tags`\n * overlap filter, capped at `topK`), and `removeNamespace` (prefix DELETE).\n * Also emits the reference DDL via {@link PgVectorStore.schema} (alias\n * {@link PgVectorStore.ensureSchema}).\n *\n * Does NOT own: the connection lifecycle (a dev-supplied `client` is never\n * closed; a store-built `Pool` from a `connectionString` is also left open\n * for the process to reuse) or schema migration — the dev runs the DDL\n * through their own tool; the framework never auto-migrates.\n *\n * Front it with the {@link pgVectorStore} factory — callers never `new` it.\n */\nclass PgVectorStore implements VectorStore {\n  /** Validated backing table name, safe to interpolate into SQL. */\n  private readonly table: string;\n\n  /** Embedding width baked into the DDL. */\n  private readonly dimensions: number;\n\n  /** ANN index strategy baked into the DDL. */\n  private readonly index: \"hnsw\" | \"ivfflat\" | \"none\";\n\n  /** `lists` parameter for an `ivfflat` index. */\n  private readonly ivfflatLists: number;\n\n  /**\n   * A ready client, or a promise resolving to one the store builds lazily\n   * from a `connectionString`. Resolved once and memoized so the optional\n   * `pg` import happens at most once.\n   */\n  private readonly clientPromise: Promise<PgClientLike>;\n\n  public constructor(options: PgVectorStoreOptions) {\n    const table = options.table ?? DEFAULT_TABLE;\n\n    if (!SAFE_IDENTIFIER.test(table)) {\n      throw new TypeError(\n        `pgVectorStore: invalid table name '${table}'. Allowed: [A-Za-z_][A-Za-z0-9_]*.`,\n      );\n    }\n\n    this.table = table;\n    this.dimensions = options.dimensions ?? DEFAULT_DIMENSIONS;\n    this.index = options.index ?? \"hnsw\";\n    this.ivfflatLists = options.ivfflatLists ?? DEFAULT_IVFFLAT_LISTS;\n\n    if (options.client) {\n      if (typeof options.client.query !== \"function\") {\n        throw new TypeError(\n          \"pgVectorStore requires a 'client' option implementing { query(text, params) } — pass a pg.Pool or pg.Client.\",\n        );\n      }\n\n      this.clientPromise = Promise.resolve(options.client);\n\n      return;\n    }\n\n    if (options.connectionString) {\n      // Defer the optional `pg` import to first use — a curated install\n      // string surfaces from `buildPgClient`, not at construction.\n      this.clientPromise = buildPgClient(options.connectionString);\n\n      return;\n    }\n\n    throw new TypeError(\n      \"pgVectorStore requires either a 'client' or a 'connectionString' option.\",\n    );\n  }\n\n  /**\n   * Resolve the backing client, surfacing the lazy `pg` import's curated\n   * install string on the first call that needs it.\n   */\n  private client(): Promise<PgClientLike> {\n    return this.clientPromise;\n  }\n\n  /**\n   * Index `value` under `key` with its embedding `vector`. Upserts on the\n   * `key` primary key — re-indexing the same chunk overwrites its payload,\n   * embedding, and tags rather than appending a duplicate row. Optional\n   * `tags` ride a `text[]` column so {@link query} can restrict the\n   * candidate set with an array-overlap filter.\n   *\n   * The embedding is sent as a pgvector text literal (`$3`) cast to\n   * `::vector`, so the store needs no registered `pg` type parser. `tags`\n   * defaults to an empty array (never `NULL`) to keep the overlap filter's\n   * `&&` semantics simple.\n   */\n  public async upsert(\n    key: string,\n    value: unknown,\n    vector: number[],\n    tags?: string[],\n  ): Promise<void> {\n    const client = await this.client();\n\n    await client.query(\n      `INSERT INTO ${this.table} (key, value, embedding, tags)\n       VALUES ($1, $2::jsonb, $3::vector, $4::text[])\n       ON CONFLICT (key) DO UPDATE\n         SET value = EXCLUDED.value,\n             embedding = EXCLUDED.embedding,\n             tags = EXCLUDED.tags`,\n      [key, JSON.stringify(value), vectorLiteral(vector), tags ?? []],\n    );\n  }\n\n  /**\n   * Return the cosine-nearest rows to `vector`, mapped to the contract's\n   * `{ key, value, score }` shape. The SQL:\n   *\n   * - computes `embedding <=> $1::vector` (cosine **distance**) once, aliased\n   *   `distance`, and `ORDER BY` it ascending (nearest first);\n   * - applies the `threshold` floor as `distance <= 1 - threshold`\n   *   (similarity `>=` threshold), so the default `0.5` floor maps to a\n   *   `<= 0.5` distance bound — the filter runs in SQL, not in JS, so a\n   *   below-floor row never crosses the wire;\n   * - when `tags` are given, restricts to rows whose `tags` array overlaps\n   *   the requested set via `tags && $tags::text[]` (one-of semantics,\n   *   matching the cache store);\n   * - caps the result at `topK` with `LIMIT`.\n   *\n   * The returned `score` is `1 - distance`, clamped to `[0, 1]`, so callers\n   * see the same cosine-similarity scale the cache store emits.\n   */\n  public async query<T>(\n    vector: number[],\n    options: { topK: number; threshold?: number; tags?: string[] },\n  ): Promise<{ key: string; value: T; score: number }[]> {\n    const client = await this.client();\n    const queryVector = vectorLiteral(vector);\n\n    // $1 = query vector, $2 = topK. Optional threshold + tags are appended\n    // as $3 / $4 only when present, so the prepared statement carries no\n    // unused placeholders.\n    const params: unknown[] = [queryVector, options.topK];\n    const conditions: string[] = [];\n\n    if (options.threshold !== undefined) {\n      params.push(1 - options.threshold);\n      conditions.push(`(embedding <=> $1::vector) <= $${params.length}`);\n    }\n\n    if (options.tags !== undefined && options.tags.length > 0) {\n      params.push(options.tags);\n      conditions.push(`tags && $${params.length}::text[]`);\n    }\n\n    const where = conditions.length > 0 ? `WHERE ${conditions.join(\" AND \")}` : \"\";\n\n    const { rows } = await client.query(\n      `SELECT key, value, (embedding <=> $1::vector) AS distance\n       FROM ${this.table}\n       ${where}\n       ORDER BY embedding <=> $1::vector\n       LIMIT $2`,\n      params,\n    );\n\n    return (rows as Record<string, unknown>[]).map((row) => ({\n      key: row.key as string,\n      value: parseValue<T>(row.value),\n      score: distanceToScore(row.distance),\n    }));\n  }\n\n  /**\n   * Drop every entry written under `namespace`. The RAG pipeline keys\n   * chunks as `<namespace>.<sourceId>.<chunkIndex>`, so a row belongs to\n   * the namespace when its `key` equals it OR begins with `<namespace>.`\n   * — deleting `ai.rag.docs` must not also catch `ai.rag.docs2`. The `_`\n   * and `%` LIKE wildcards in the namespace are escaped so a namespace\n   * that happens to contain them is matched literally.\n   */\n  public async removeNamespace(namespace: string): Promise<void> {\n    const client = await this.client();\n\n    const escaped = namespace\n      .replace(/\\\\/g, \"\\\\\\\\\")\n      .replace(/_/g, \"\\\\_\")\n      .replace(/%/g, \"\\\\%\");\n\n    await client.query(\n      `DELETE FROM ${this.table}\n       WHERE key = $1 OR key LIKE $2 ESCAPE '\\\\'`,\n      [namespace, `${escaped}.%`],\n    );\n  }\n\n  /**\n   * Return the reference migration DDL for this store's backing table,\n   * interpolating the configured table name, embedding width, and ANN\n   * index strategy. The dev runs it once through their migration tool —\n   * the framework never auto-migrates.\n   *\n   * The emitted statements:\n   * 1. `CREATE EXTENSION IF NOT EXISTS vector;` — enables pgvector (needs\n   *    a superuser or a role with `CREATE` on the database the first time).\n   * 2. `CREATE TABLE IF NOT EXISTS <table> (key TEXT PRIMARY KEY, value\n   *    JSONB NOT NULL, embedding vector(<dimensions>) NOT NULL, tags\n   *    text[] NOT NULL DEFAULT '{}');`\n   * 3. A GIN index on `tags` so the array-overlap filter stays sargable.\n   * 4. The chosen ANN index over `embedding` using `vector_cosine_ops`:\n   *    - `\"hnsw\"` → `USING hnsw (embedding vector_cosine_ops)`;\n   *    - `\"ivfflat\"` → `USING ivfflat (embedding vector_cosine_ops)\n   *      WITH (lists = <ivfflatLists>)`;\n   *    - `\"none\"` → emitted as a comment (exact scan, no ANN index).\n   *\n   * @example\n   * const store = pgVectorStore({ client: pool, dimensions: 1536 });\n   * await pool.query(store.ensureSchema());\n   */\n  public schema(): string {\n    const lines = [\n      `CREATE EXTENSION IF NOT EXISTS vector;`,\n      `CREATE TABLE IF NOT EXISTS ${this.table} (`,\n      `  key        TEXT PRIMARY KEY,`,\n      `  value      JSONB NOT NULL,`,\n      `  embedding  vector(${this.dimensions}) NOT NULL,`,\n      `  tags       TEXT[] NOT NULL DEFAULT '{}'`,\n      `);`,\n      `CREATE INDEX IF NOT EXISTS idx_${this.table}_tags`,\n      `  ON ${this.table} USING gin (tags);`,\n    ];\n\n    if (this.index === \"hnsw\") {\n      lines.push(\n        `CREATE INDEX IF NOT EXISTS idx_${this.table}_embedding`,\n        `  ON ${this.table} USING hnsw (embedding vector_cosine_ops);`,\n      );\n    } else if (this.index === \"ivfflat\") {\n      lines.push(\n        `CREATE INDEX IF NOT EXISTS idx_${this.table}_embedding`,\n        `  ON ${this.table} USING ivfflat (embedding vector_cosine_ops)`,\n        `  WITH (lists = ${this.ivfflatLists});`,\n      );\n    } else {\n      lines.push(\n        `-- No ANN index requested (index: \"none\"): cosine queries fall back`,\n        `-- to an exact sequential scan, which is correct but linear in rows.`,\n      );\n    }\n\n    return lines.join(\"\\n\");\n  }\n\n  /**\n   * Alias for {@link PgVectorStore.schema} — reads more naturally in a\n   * migration script (`await pool.query(store.ensureSchema())`). Returns\n   * the identical DDL string; it does NOT execute anything against the\n   * database (the store never auto-migrates).\n   */\n  public ensureSchema(): string {\n    return this.schema();\n  }\n}\n\n/**\n * The {@link VectorStore} surface plus the pg store's extra DDL helpers.\n * `schema()` / `ensureSchema()` are not part of the base contract (the\n * cache store has no backing table), so the factory's return type widens\n * it for callers that want the migration SQL.\n */\nexport interface PgVectorStoreInstance extends VectorStore {\n  /** Reference migration DDL (extension + table + indexes). Never executed. */\n  schema(): string;\n  /** Alias for {@link PgVectorStoreInstance.schema} — reads better in a migration script. */\n  ensureSchema(): string;\n}\n\n/**\n * Create a Postgres + pgvector-backed {@link VectorStore} for the RAG\n * pipeline. Either pass a live `pg.Pool` / `pg.Client` (`{ client }`) —\n * `@warlock.js/ai` never imports `pg` in that case — or a\n * `{ connectionString }` and let the store lazily `import(\"pg\")` to build\n * its own pool. When `pg` is not installed, a curated install string\n * surfaces on first use, never at import.\n *\n * Run {@link PgVectorStoreInstance.ensureSchema} through your migration\n * tool once before use (it enables the `vector` extension, creates the\n * table, and builds the tag + ANN indexes); the store never auto-migrates.\n *\n * Index and query MUST use the same embedding model — the `vector(N)`\n * column width is fixed at table-creation time from `dimensions`.\n *\n * @example\n * import { Pool } from \"pg\";\n * import { ai } from \"@warlock.js/ai\";\n *\n * const pool = new Pool({ connectionString: process.env.DATABASE_URL });\n * const store = ai.rag.pgVectorStore({ client: pool, dimensions: 1536 });\n *\n * // Once, via your migration tooling:\n * // await pool.query(store.ensureSchema());\n *\n * const kb = ai.rag({\n *   name: \"docs\",\n *   embedder: openai.embedder({ name: \"text-embedding-3-small\" }),\n *   store,\n * });\n *\n * @example\n * // Let the store build its own pool from a connection string:\n * const store = ai.rag.pgVectorStore({\n *   connectionString: process.env.DATABASE_URL,\n *   index: \"ivfflat\",\n *   ivfflatLists: 200,\n * });\n */\nexport function pgVectorStore(options: PgVectorStoreOptions): PgVectorStoreInstance {\n  return new PgVectorStore(options);\n}\n"],"mappings":";;;;;;AA6EA,MAAM,gBAAgB;;AAGtB,MAAM,qBAAqB;;AAG3B,MAAM,wBAAwB;;;;;;;;AAS9B,MAAM,kBAAkB;;;;;;;AAQxB,MAAM,YAAY;;;;;;AAOlB,MAAM,0BAA0B;;;;;;;;;;EAU9B,KAAK;;;;;;AAiBP,eAAe,cAAc,kBAAiD;CAC5E,IAAI;CAEJ,IAAI;EACF,MAAO,MAAM,OAAO;CACtB,QAAQ;EACN,MAAM,IAAI,MAAM,uBAAuB;CACzC;CAEA,OAAO,IAAI,IAAI,KAAK,EAAE,iBAAiB,CAAC;AAC1C;;;;;;;;;;;;;;;;AAiBA,SAAgB,cAAc,QAA0B;CACtD,IAAI,UAAU;CAEd,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;EAClD,MAAM,YAAY,OAAO;EAEzB,IAAI,CAAC,OAAO,SAAS,SAAS,GAC5B,MAAM,IAAI,UACR,+CAA+C,MAAM,kBAAkB,UAAU,uCACnF;EAGF,IAAI,QAAQ,GACV,WAAW;EAGb,WAAW,OAAO,SAAS;CAC7B;CAEA,OAAO,UAAU;AACnB;;;;;;;AAQA,SAAS,WAAc,OAAmB;CACxC,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,MAAM,KAAK;CAGzB,OAAO;AACT;;;;;;;;;AAUA,SAAS,gBAAgB,UAA2B;CAElD,MAAM,QAAQ,KADA,OAAO,aAAa,WAAW,OAAO,QAAQ,IAAK;CAGjE,IAAI,QAAQ,GACV,OAAO;CAGT,IAAI,QAAQ,GACV,OAAO;CAGT,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;AAsBA,IAAM,gBAAN,MAA2C;CAoBzC,AAAO,YAAY,SAA+B;EAChD,MAAM,QAAQ,QAAQ,SAAS;EAE/B,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAC7B,MAAM,IAAI,UACR,sCAAsC,MAAM,oCAC9C;EAGF,KAAK,QAAQ;EACb,KAAK,aAAa,QAAQ,cAAc;EACxC,KAAK,QAAQ,QAAQ,SAAS;EAC9B,KAAK,eAAe,QAAQ,gBAAgB;EAE5C,IAAI,QAAQ,QAAQ;GAClB,IAAI,OAAO,QAAQ,OAAO,UAAU,YAClC,MAAM,IAAI,UACR,8GACF;GAGF,KAAK,gBAAgB,QAAQ,QAAQ,QAAQ,MAAM;GAEnD;EACF;EAEA,IAAI,QAAQ,kBAAkB;GAG5B,KAAK,gBAAgB,cAAc,QAAQ,gBAAgB;GAE3D;EACF;EAEA,MAAM,IAAI,UACR,0EACF;CACF;;;;;CAMA,AAAQ,SAAgC;EACtC,OAAO,KAAK;CACd;;;;;;;;;;;;;CAcA,MAAa,OACX,KACA,OACA,QACA,MACe;EAGf,OAAM,MAFe,KAAK,OAAO,EAErB,CAAC,MACX,eAAe,KAAK,MAAM;;;;;oCAM1B;GAAC;GAAK,KAAK,UAAU,KAAK;GAAG,cAAc,MAAM;GAAG,QAAQ,CAAC;EAAC,CAChE;CACF;;;;;;;;;;;;;;;;;;;CAoBA,MAAa,MACX,QACA,SACqD;EACrD,MAAM,SAAS,MAAM,KAAK,OAAO;EAMjC,MAAM,SAAoB,CALN,cAAc,MAKG,GAAG,QAAQ,IAAI;EACpD,MAAM,aAAuB,CAAC;EAE9B,IAAI,QAAQ,cAAc,QAAW;GACnC,OAAO,KAAK,IAAI,QAAQ,SAAS;GACjC,WAAW,KAAK,kCAAkC,OAAO,QAAQ;EACnE;EAEA,IAAI,QAAQ,SAAS,UAAa,QAAQ,KAAK,SAAS,GAAG;GACzD,OAAO,KAAK,QAAQ,IAAI;GACxB,WAAW,KAAK,YAAY,OAAO,OAAO,SAAS;EACrD;EAEA,MAAM,QAAQ,WAAW,SAAS,IAAI,SAAS,WAAW,KAAK,OAAO,MAAM;EAE5E,MAAM,EAAE,SAAS,MAAM,OAAO,MAC5B;cACQ,KAAK,MAAM;SAChB,MAAM;;kBAGT,MACF;EAEA,OAAQ,KAAmC,KAAK,SAAS;GACvD,KAAK,IAAI;GACT,OAAO,WAAc,IAAI,KAAK;GAC9B,OAAO,gBAAgB,IAAI,QAAQ;EACrC,EAAE;CACJ;;;;;;;;;CAUA,MAAa,gBAAgB,WAAkC;EAC7D,MAAM,SAAS,MAAM,KAAK,OAAO;EAEjC,MAAM,UAAU,UACb,QAAQ,OAAO,MAAM,CAAC,CACtB,QAAQ,MAAM,KAAK,CAAC,CACpB,QAAQ,MAAM,KAAK;EAEtB,MAAM,OAAO,MACX,eAAe,KAAK,MAAM;mDAE1B,CAAC,WAAW,GAAG,QAAQ,GAAG,CAC5B;CACF;;;;;;;;;;;;;;;;;;;;;;;;CAyBA,AAAO,SAAiB;EACtB,MAAM,QAAQ;GACZ;GACA,8BAA8B,KAAK,MAAM;GACzC;GACA;GACA,uBAAuB,KAAK,WAAW;GACvC;GACA;GACA,kCAAkC,KAAK,MAAM;GAC7C,QAAQ,KAAK,MAAM;EACrB;EAEA,IAAI,KAAK,UAAU,QACjB,MAAM,KACJ,kCAAkC,KAAK,MAAM,aAC7C,QAAQ,KAAK,MAAM,2CACrB;OACK,IAAI,KAAK,UAAU,WACxB,MAAM,KACJ,kCAAkC,KAAK,MAAM,aAC7C,QAAQ,KAAK,MAAM,+CACnB,mBAAmB,KAAK,aAAa,GACvC;OAEA,MAAM,KACJ,uEACA,sEACF;EAGF,OAAO,MAAM,KAAK,IAAI;CACxB;;;;;;;CAQA,AAAO,eAAuB;EAC5B,OAAO,KAAK,OAAO;CACrB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,SAAgB,cAAc,SAAsD;CAClF,OAAO,IAAI,cAAc,OAAO;AAClC"}

package/esm/ai/src/rag/transforms/multi-query.mjs

@@ -1,41 +0,0 @@
-//#region ../@warlock.js/ai/src/rag/transforms/multi-query.ts
-/**
-* Multi-query expansion (A4) — ask a model for several alternative
-* phrasings of `query`, so retrieval covers vocabulary the original
-* wording missed (synonyms, specificity, rephrasings). Pair the variants
-* with {@link hybridRank} / a vector search and fuse the per-variant hits.
-*
-* Deterministic, dependency-light parsing: the model is asked for one
-* query per line; bullets / numbering are stripped, blanks dropped, and
-* the set is de-duplicated. Returns the original (unless opted out) plus
-* up to `n` variants.
-*
-* @example
-* const queries = await multiQuery(model, "how do I cancel?", { n: 3 });
-* // → ["how do I cancel?", "cancel my subscription", "end my plan", ...]
-*/
-async function multiQuery(model, query, options = {}) {
-	const n = options.n ?? 3;
-	const includeOriginal = options.includeOriginal ?? true;
-	const prompt = `Rewrite the following search query into ${n} alternative phrasings that would retrieve relevant documents. Output ONE query per line, no numbering or commentary.\n\nQuery: ${query}`;
-	const variants = (await model.complete([{
-		role: "user",
-		content: prompt
-	}])).content.split("\n").map((line) => line.replace(/^\s*(?:[-*•]|\d+[.)])\s*/, "").trim()).filter(Boolean);
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	const add = (q) => {
-		const key = q.toLowerCase();
-		if (!seen.has(key)) {
-			seen.add(key);
-			out.push(q);
-		}
-	};
-	if (includeOriginal) add(query);
-	for (const variant of variants.slice(0, n)) add(variant);
-	return out;
-}
-
-//#endregion
-export { multiQuery };
-//# sourceMappingURL=multi-query.mjs.map

package/esm/ai/src/rag/transforms/multi-query.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"multi-query.mjs","names":[],"sources":["../../../../../../../../../../@warlock.js/ai/src/rag/transforms/multi-query.ts"],"sourcesContent":["import type { ModelContract } from \"../../contracts/model.contract\";\n\n/** Options for {@link multiQuery}. */\nexport type MultiQueryOptions = {\n  /** How many alternative phrasings to request. Default 3. */\n  n?: number;\n  /** Include the original query in the returned list. Default true. */\n  includeOriginal?: boolean;\n};\n\n/**\n * Multi-query expansion (A4) — ask a model for several alternative\n * phrasings of `query`, so retrieval covers vocabulary the original\n * wording missed (synonyms, specificity, rephrasings). Pair the variants\n * with {@link hybridRank} / a vector search and fuse the per-variant hits.\n *\n * Deterministic, dependency-light parsing: the model is asked for one\n * query per line; bullets / numbering are stripped, blanks dropped, and\n * the set is de-duplicated. Returns the original (unless opted out) plus\n * up to `n` variants.\n *\n * @example\n * const queries = await multiQuery(model, \"how do I cancel?\", { n: 3 });\n * // → [\"how do I cancel?\", \"cancel my subscription\", \"end my plan\", ...]\n */\nexport async function multiQuery(\n  model: ModelContract,\n  query: string,\n  options: MultiQueryOptions = {},\n): Promise<string[]> {\n  const n = options.n ?? 3;\n  const includeOriginal = options.includeOriginal ?? true;\n\n  const prompt =\n    `Rewrite the following search query into ${n} alternative phrasings that would ` +\n    `retrieve relevant documents. Output ONE query per line, no numbering or commentary.\\n\\n` +\n    `Query: ${query}`;\n\n  const response = await model.complete([{ role: \"user\", content: prompt }]);\n\n  const variants = response.content\n    .split(\"\\n\")\n    .map(line => line.replace(/^\\s*(?:[-*•]|\\d+[.)])\\s*/, \"\").trim())\n    .filter(Boolean);\n\n  const seen = new Set<string>();\n  const out: string[] = [];\n\n  const add = (q: string) => {\n    const key = q.toLowerCase();\n    if (!seen.has(key)) {\n      seen.add(key);\n      out.push(q);\n    }\n  };\n\n  if (includeOriginal) add(query);\n  for (const variant of variants.slice(0, n)) add(variant);\n\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAyBA,eAAsB,WACpB,OACA,OACA,UAA6B,CAAC,GACX;CACnB,MAAM,IAAI,QAAQ,KAAK;CACvB,MAAM,kBAAkB,QAAQ,mBAAmB;CAEnD,MAAM,SACJ,2CAA2C,EAAE,kIAEnC;CAIZ,MAAM,YAAW,MAFM,MAAM,SAAS,CAAC;EAAE,MAAM;EAAQ,SAAS;CAAO,CAAC,CAAC,EAEhD,CAAC,QACvB,MAAM,IAAI,CAAC,CACX,KAAI,SAAQ,KAAK,QAAQ,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAChE,OAAO,OAAO;CAEjB,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,MAAgB,CAAC;CAEvB,MAAM,OAAO,MAAc;EACzB,MAAM,MAAM,EAAE,YAAY;EAC1B,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG;GAClB,KAAK,IAAI,GAAG;GACZ,IAAI,KAAK,CAAC;EACZ;CACF;CAEA,IAAI,iBAAiB,IAAI,KAAK;CAC9B,KAAK,MAAM,WAAW,SAAS,MAAM,GAAG,CAAC,GAAG,IAAI,OAAO;CAEvD,OAAO;AACT"}

package/esm/ai/src/security/index.mjs

@@ -1,5 +0,0 @@
-import { isPrivateOrReservedIp } from "./private-ip.mjs";
-import { assertUrlAllowed, fetchTextWithPolicy, guardedFetch, readTextCapped, resolveOutboundPolicy } from "./outbound-policy.mjs";
-import { DEFAULT_SENSITIVE_KEYS, redact } from "./redact.mjs";
-
-export {  };

package/esm/ai/src/security/outbound-policy.mjs

@@ -1,187 +0,0 @@
-import { OutboundPolicyError } from "../errors/outbound-policy-error.mjs";
-import "../errors/index.mjs";
-import { isPrivateOrReservedIp } from "./private-ip.mjs";
-import { lookup } from "node:dns/promises";
-import { isIP } from "node:net";
-
-//#region ../@warlock.js/ai/src/security/outbound-policy.ts
-/** 5 MiB — default cap on an outbound response body. */
-const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
-/** 10s — default per-request timeout. */
-const DEFAULT_TIMEOUT_MS = 1e4;
-/**
-* Fill an {@link OutboundPolicy} with strict defaults: https-only,
-* private-IP deny on, 10s timeout, 5 MiB cap, global `fetch`. Idempotent
-* — resolving an already-resolved policy yields the same shape.
-*/
-function resolveOutboundPolicy(policy = {}) {
-	return {
-		allowedSchemes: policy.allowedSchemes ?? ["https"],
-		hostAllowlist: policy.hostAllowlist,
-		denyPrivateIPsAfterDNS: policy.denyPrivateIPsAfterDNS ?? true,
-		maxBytes: policy.maxBytes ?? DEFAULT_MAX_BYTES,
-		timeoutMs: policy.timeoutMs ?? DEFAULT_TIMEOUT_MS,
-		signal: policy.signal,
-		fetch: policy.fetch ?? globalThis.fetch
-	};
-}
-/** Strip the `[ ]` IPv6 brackets `URL.hostname` keeps. */
-function stripBrackets(host) {
-	return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-}
-/** Whether `host` equals or is a subdomain of any allowlist entry. */
-function hostAllowed(host, allowlist) {
-	const lower = host.toLowerCase();
-	return allowlist.some((entry) => {
-		const e = entry.toLowerCase();
-		return lower === e || lower.endsWith(`.${e}`);
-	});
-}
-/**
-* Validate a URL against the policy BEFORE any network call: scheme
-* allowlist, host allowlist, and (when enabled) a DNS resolution that
-* rejects private / loopback / link-local / metadata addresses — the SSRF
-* guard. Returns the parsed `URL` on success; throws
-* {@link OutboundPolicyError} otherwise.
-*/
-async function assertUrlAllowed(rawUrl, policy) {
-	let url;
-	try {
-		url = new URL(rawUrl);
-	} catch {
-		throw new OutboundPolicyError(`outbound request blocked — invalid URL: ${rawUrl}`, { context: { url: rawUrl } });
-	}
-	const scheme = url.protocol.replace(/:$/, "").toLowerCase();
-	if (!policy.allowedSchemes.some((s) => s.toLowerCase() === scheme)) throw new OutboundPolicyError(`outbound request blocked — scheme "${scheme}" is not allowed (allowed: ${policy.allowedSchemes.join(", ")})`, { context: {
-		url: rawUrl,
-		scheme
-	} });
-	const host = stripBrackets(url.hostname);
-	if (policy.hostAllowlist && !hostAllowed(host, policy.hostAllowlist)) throw new OutboundPolicyError(`outbound request blocked — host "${host}" is not in the allowlist`, { context: {
-		url: rawUrl,
-		host
-	} });
-	if (policy.denyPrivateIPsAfterDNS) await assertHostNotPrivate(host, rawUrl);
-	return url;
-}
-/**
-* Reject when `host` is — or resolves to — a private / reserved address.
-* IP literals are checked directly; hostnames are resolved via DNS and
-* every returned address is checked (a public name pointing inward is
-* caught). A resolution failure fails closed.
-*/
-async function assertHostNotPrivate(host, rawUrl) {
-	if (isIP(host) !== 0) {
-		if (isPrivateOrReservedIp(host)) throw new OutboundPolicyError(`outbound request blocked — "${host}" is a private/reserved address`, { context: {
-			url: rawUrl,
-			address: host
-		} });
-		return;
-	}
-	let addresses;
-	try {
-		addresses = await lookup(host, { all: true });
-	} catch (cause) {
-		throw new OutboundPolicyError(`outbound request blocked — could not resolve host "${host}" to verify it is public`, {
-			cause,
-			context: {
-				url: rawUrl,
-				host
-			}
-		});
-	}
-	for (const { address } of addresses) if (isPrivateOrReservedIp(address)) throw new OutboundPolicyError(`outbound request blocked — host "${host}" resolves to a private/reserved address (${address})`, { context: {
-		url: rawUrl,
-		host,
-		address
-	} });
-}
-/** Merge the internal timeout signal with an optional caller signal. */
-function mergeSignals(timeout, external) {
-	if (!external) return timeout;
-	const controller = new AbortController();
-	const abort = (from) => controller.abort(from.reason);
-	if (timeout.aborted) abort(timeout);
-	else timeout.addEventListener("abort", () => abort(timeout), { once: true });
-	if (external.aborted) abort(external);
-	else external.addEventListener("abort", () => abort(external), { once: true });
-	return controller.signal;
-}
-/**
-* Policy-guarded `fetch`: validates the URL ({@link assertUrlAllowed}),
-* then performs the request with the policy's timeout and (optional)
-* caller signal merged. Returns the raw `Response` — read its body via
-* {@link readTextCapped} to enforce `maxBytes`. Throws
-* {@link OutboundPolicyError} on a policy violation or timeout.
-*/
-async function guardedFetch(rawUrl, policyInput, init) {
-	const policy = resolveOutboundPolicy(policyInput);
-	const url = await assertUrlAllowed(rawUrl, policy);
-	const timeoutController = new AbortController();
-	const timer = setTimeout(() => {
-		timeoutController.abort(new OutboundPolicyError(`outbound request timed out after ${policy.timeoutMs}ms`, { context: {
-			url: rawUrl,
-			timeoutMs: policy.timeoutMs
-		} }));
-	}, policy.timeoutMs);
-	try {
-		return await policy.fetch(url, {
-			...init,
-			signal: mergeSignals(timeoutController.signal, policy.signal)
-		});
-	} finally {
-		clearTimeout(timer);
-	}
-}
-/**
-* Read a response body as UTF-8 text with a hard byte cap. A declared
-* `content-length` over the cap fails fast; otherwise the stream is read
-* chunk-by-chunk and aborted the moment the running total exceeds
-* `maxBytes`. Throws {@link OutboundPolicyError} on overflow.
-*/
-async function readTextCapped(response, maxBytes) {
-	const declared = Number(response.headers.get("content-length"));
-	if (Number.isFinite(declared) && declared > maxBytes) throw new OutboundPolicyError(`outbound response body too large — declared ${declared} bytes exceeds the ${maxBytes}-byte cap`, { context: {
-		declared,
-		maxBytes
-	} });
-	if (!response.body) {
-		const text = await response.text();
-		if (Buffer.byteLength(text) > maxBytes) throw new OutboundPolicyError(`outbound response body exceeded the ${maxBytes}-byte cap`, { context: { maxBytes } });
-		return text;
-	}
-	const reader = response.body.getReader();
-	const chunks = [];
-	let total = 0;
-	for (;;) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		if (!value) continue;
-		total += value.byteLength;
-		if (total > maxBytes) {
-			await reader.cancel();
-			throw new OutboundPolicyError(`outbound response body exceeded the ${maxBytes}-byte cap`, { context: { maxBytes } });
-		}
-		chunks.push(value);
-	}
-	return Buffer.concat(chunks).toString("utf8");
-}
-/**
-* Convenience: {@link guardedFetch} + {@link readTextCapped}. Returns the
-* response status alongside the (capped) body text so callers can shape
-* their own not-OK error. The body is only read when the response is OK.
-*/
-async function fetchTextWithPolicy(rawUrl, policyInput, init) {
-	const policy = resolveOutboundPolicy(policyInput);
-	const response = await guardedFetch(rawUrl, policy, init);
-	return {
-		ok: response.ok,
-		status: response.status,
-		statusText: response.statusText,
-		text: response.ok ? await readTextCapped(response, policy.maxBytes) : ""
-	};
-}
-
-//#endregion
-export { assertUrlAllowed, fetchTextWithPolicy, guardedFetch, readTextCapped, resolveOutboundPolicy };
-//# sourceMappingURL=outbound-policy.mjs.map

package/esm/ai/src/security/outbound-policy.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"outbound-policy.mjs","names":[],"sources":["../../../../../../../../../@warlock.js/ai/src/security/outbound-policy.ts"],"sourcesContent":["import { lookup } from \"node:dns/promises\";\nimport { isIP } from \"node:net\";\nimport { OutboundPolicyError } from \"../errors\";\nimport { isPrivateOrReservedIp } from \"./private-ip\";\nimport type {\n  OutboundPolicy,\n  ResolvedOutboundPolicy,\n} from \"./outbound-policy.type\";\n\n/** 5 MiB — default cap on an outbound response body. */\nconst DEFAULT_MAX_BYTES = 5 * 1024 * 1024;\n/** 10s — default per-request timeout. */\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\n/**\n * Fill an {@link OutboundPolicy} with strict defaults: https-only,\n * private-IP deny on, 10s timeout, 5 MiB cap, global `fetch`. Idempotent\n * — resolving an already-resolved policy yields the same shape.\n */\nexport function resolveOutboundPolicy(\n  policy: OutboundPolicy = {},\n): ResolvedOutboundPolicy {\n  return {\n    allowedSchemes: policy.allowedSchemes ?? [\"https\"],\n    hostAllowlist: policy.hostAllowlist,\n    denyPrivateIPsAfterDNS: policy.denyPrivateIPsAfterDNS ?? true,\n    maxBytes: policy.maxBytes ?? DEFAULT_MAX_BYTES,\n    timeoutMs: policy.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n    signal: policy.signal,\n    fetch: policy.fetch ?? globalThis.fetch,\n  };\n}\n\n/** Strip the `[ ]` IPv6 brackets `URL.hostname` keeps. */\nfunction stripBrackets(host: string): string {\n  return host.startsWith(\"[\") && host.endsWith(\"]\") ? host.slice(1, -1) : host;\n}\n\n/** Whether `host` equals or is a subdomain of any allowlist entry. */\nfunction hostAllowed(host: string, allowlist: string[]): boolean {\n  const lower = host.toLowerCase();\n  return allowlist.some(entry => {\n    const e = entry.toLowerCase();\n    return lower === e || lower.endsWith(`.${e}`);\n  });\n}\n\n/**\n * Validate a URL against the policy BEFORE any network call: scheme\n * allowlist, host allowlist, and (when enabled) a DNS resolution that\n * rejects private / loopback / link-local / metadata addresses — the SSRF\n * guard. Returns the parsed `URL` on success; throws\n * {@link OutboundPolicyError} otherwise.\n */\nexport async function assertUrlAllowed(\n  rawUrl: string,\n  policy: ResolvedOutboundPolicy,\n): Promise<URL> {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new OutboundPolicyError(`outbound request blocked — invalid URL: ${rawUrl}`, {\n      context: { url: rawUrl },\n    });\n  }\n\n  const scheme = url.protocol.replace(/:$/, \"\").toLowerCase();\n  if (!policy.allowedSchemes.some(s => s.toLowerCase() === scheme)) {\n    throw new OutboundPolicyError(\n      `outbound request blocked — scheme \"${scheme}\" is not allowed (allowed: ${policy.allowedSchemes.join(\", \")})`,\n      { context: { url: rawUrl, scheme } },\n    );\n  }\n\n  const host = stripBrackets(url.hostname);\n\n  if (policy.hostAllowlist && !hostAllowed(host, policy.hostAllowlist)) {\n    throw new OutboundPolicyError(\n      `outbound request blocked — host \"${host}\" is not in the allowlist`,\n      { context: { url: rawUrl, host } },\n    );\n  }\n\n  if (policy.denyPrivateIPsAfterDNS) {\n    await assertHostNotPrivate(host, rawUrl);\n  }\n\n  return url;\n}\n\n/**\n * Reject when `host` is — or resolves to — a private / reserved address.\n * IP literals are checked directly; hostnames are resolved via DNS and\n * every returned address is checked (a public name pointing inward is\n * caught). A resolution failure fails closed.\n */\nasync function assertHostNotPrivate(host: string, rawUrl: string): Promise<void> {\n  if (isIP(host) !== 0) {\n    if (isPrivateOrReservedIp(host)) {\n      throw new OutboundPolicyError(\n        `outbound request blocked — \"${host}\" is a private/reserved address`,\n        { context: { url: rawUrl, address: host } },\n      );\n    }\n    return;\n  }\n\n  let addresses: Array<{ address: string }>;\n  try {\n    addresses = await lookup(host, { all: true });\n  } catch (cause) {\n    throw new OutboundPolicyError(\n      `outbound request blocked — could not resolve host \"${host}\" to verify it is public`,\n      { cause, context: { url: rawUrl, host } },\n    );\n  }\n\n  for (const { address } of addresses) {\n    if (isPrivateOrReservedIp(address)) {\n      throw new OutboundPolicyError(\n        `outbound request blocked — host \"${host}\" resolves to a private/reserved address (${address})`,\n        { context: { url: rawUrl, host, address } },\n      );\n    }\n  }\n}\n\n/** Merge the internal timeout signal with an optional caller signal. */\nfunction mergeSignals(\n  timeout: AbortSignal,\n  external?: AbortSignal,\n): AbortSignal {\n  if (!external) return timeout;\n\n  const controller = new AbortController();\n  const abort = (from: AbortSignal) => controller.abort(from.reason);\n\n  if (timeout.aborted) abort(timeout);\n  else timeout.addEventListener(\"abort\", () => abort(timeout), { once: true });\n\n  if (external.aborted) abort(external);\n  else external.addEventListener(\"abort\", () => abort(external), { once: true });\n\n  return controller.signal;\n}\n\n/**\n * Policy-guarded `fetch`: validates the URL ({@link assertUrlAllowed}),\n * then performs the request with the policy's timeout and (optional)\n * caller signal merged. Returns the raw `Response` — read its body via\n * {@link readTextCapped} to enforce `maxBytes`. Throws\n * {@link OutboundPolicyError} on a policy violation or timeout.\n */\nexport async function guardedFetch(\n  rawUrl: string,\n  policyInput: OutboundPolicy,\n  init?: RequestInit,\n): Promise<Response> {\n  const policy = resolveOutboundPolicy(policyInput);\n  const url = await assertUrlAllowed(rawUrl, policy);\n\n  const timeoutController = new AbortController();\n  const timer = setTimeout(() => {\n    timeoutController.abort(\n      new OutboundPolicyError(\n        `outbound request timed out after ${policy.timeoutMs}ms`,\n        { context: { url: rawUrl, timeoutMs: policy.timeoutMs } },\n      ),\n    );\n  }, policy.timeoutMs);\n\n  try {\n    return await policy.fetch(url, {\n      ...init,\n      signal: mergeSignals(timeoutController.signal, policy.signal),\n    });\n  } finally {\n    clearTimeout(timer);\n  }\n}\n\n/**\n * Read a response body as UTF-8 text with a hard byte cap. A declared\n * `content-length` over the cap fails fast; otherwise the stream is read\n * chunk-by-chunk and aborted the moment the running total exceeds\n * `maxBytes`. Throws {@link OutboundPolicyError} on overflow.\n */\nexport async function readTextCapped(\n  response: Response,\n  maxBytes: number,\n): Promise<string> {\n  const declared = Number(response.headers.get(\"content-length\"));\n  if (Number.isFinite(declared) && declared > maxBytes) {\n    throw new OutboundPolicyError(\n      `outbound response body too large — declared ${declared} bytes exceeds the ${maxBytes}-byte cap`,\n      { context: { declared, maxBytes } },\n    );\n  }\n\n  if (!response.body) {\n    const text = await response.text();\n    if (Buffer.byteLength(text) > maxBytes) {\n      throw new OutboundPolicyError(\n        `outbound response body exceeded the ${maxBytes}-byte cap`,\n        { context: { maxBytes } },\n      );\n    }\n    return text;\n  }\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    if (!value) continue;\n\n    total += value.byteLength;\n    if (total > maxBytes) {\n      await reader.cancel();\n      throw new OutboundPolicyError(\n        `outbound response body exceeded the ${maxBytes}-byte cap`,\n        { context: { maxBytes } },\n      );\n    }\n    chunks.push(value);\n  }\n\n  return Buffer.concat(chunks).toString(\"utf8\");\n}\n\n/**\n * Convenience: {@link guardedFetch} + {@link readTextCapped}. Returns the\n * response status alongside the (capped) body text so callers can shape\n * their own not-OK error. The body is only read when the response is OK.\n */\nexport async function fetchTextWithPolicy(\n  rawUrl: string,\n  policyInput: OutboundPolicy,\n  init?: RequestInit,\n): Promise<{ ok: boolean; status: number; statusText: string; text: string }> {\n  const policy = resolveOutboundPolicy(policyInput);\n  const response = await guardedFetch(rawUrl, policy, init);\n\n  return {\n    ok: response.ok,\n    status: response.status,\n    statusText: response.statusText,\n    text: response.ok ? await readTextCapped(response, policy.maxBytes) : \"\",\n  };\n}\n"],"mappings":";;;;;;;;AAUA,MAAM,oBAAoB,IAAI,OAAO;;AAErC,MAAM,qBAAqB;;;;;;AAO3B,SAAgB,sBACd,SAAyB,CAAC,GACF;CACxB,OAAO;EACL,gBAAgB,OAAO,kBAAkB,CAAC,OAAO;EACjD,eAAe,OAAO;EACtB,wBAAwB,OAAO,0BAA0B;EACzD,UAAU,OAAO,YAAY;EAC7B,WAAW,OAAO,aAAa;EAC/B,QAAQ,OAAO;EACf,OAAO,OAAO,SAAS,WAAW;CACpC;AACF;;AAGA,SAAS,cAAc,MAAsB;CAC3C,OAAO,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;AAC1E;;AAGA,SAAS,YAAY,MAAc,WAA8B;CAC/D,MAAM,QAAQ,KAAK,YAAY;CAC/B,OAAO,UAAU,MAAK,UAAS;EAC7B,MAAM,IAAI,MAAM,YAAY;EAC5B,OAAO,UAAU,KAAK,MAAM,SAAS,IAAI,GAAG;CAC9C,CAAC;AACH;;;;;;;;AASA,eAAsB,iBACpB,QACA,QACc;CACd,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,MAAM;CACtB,QAAQ;EACN,MAAM,IAAI,oBAAoB,2CAA2C,UAAU,EACjF,SAAS,EAAE,KAAK,OAAO,EACzB,CAAC;CACH;CAEA,MAAM,SAAS,IAAI,SAAS,QAAQ,MAAM,EAAE,CAAC,CAAC,YAAY;CAC1D,IAAI,CAAC,OAAO,eAAe,MAAK,MAAK,EAAE,YAAY,MAAM,MAAM,GAC7D,MAAM,IAAI,oBACR,sCAAsC,OAAO,6BAA6B,OAAO,eAAe,KAAK,IAAI,EAAE,IAC3G,EAAE,SAAS;EAAE,KAAK;EAAQ;CAAO,EAAE,CACrC;CAGF,MAAM,OAAO,cAAc,IAAI,QAAQ;CAEvC,IAAI,OAAO,iBAAiB,CAAC,YAAY,MAAM,OAAO,aAAa,GACjE,MAAM,IAAI,oBACR,oCAAoC,KAAK,4BACzC,EAAE,SAAS;EAAE,KAAK;EAAQ;CAAK,EAAE,CACnC;CAGF,IAAI,OAAO,wBACT,MAAM,qBAAqB,MAAM,MAAM;CAGzC,OAAO;AACT;;;;;;;AAQA,eAAe,qBAAqB,MAAc,QAA+B;CAC/E,IAAI,KAAK,IAAI,MAAM,GAAG;EACpB,IAAI,sBAAsB,IAAI,GAC5B,MAAM,IAAI,oBACR,+BAA+B,KAAK,kCACpC,EAAE,SAAS;GAAE,KAAK;GAAQ,SAAS;EAAK,EAAE,CAC5C;EAEF;CACF;CAEA,IAAI;CACJ,IAAI;EACF,YAAY,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;CAC9C,SAAS,OAAO;EACd,MAAM,IAAI,oBACR,sDAAsD,KAAK,2BAC3D;GAAE;GAAO,SAAS;IAAE,KAAK;IAAQ;GAAK;EAAE,CAC1C;CACF;CAEA,KAAK,MAAM,EAAE,aAAa,WACxB,IAAI,sBAAsB,OAAO,GAC/B,MAAM,IAAI,oBACR,oCAAoC,KAAK,4CAA4C,QAAQ,IAC7F,EAAE,SAAS;EAAE,KAAK;EAAQ;EAAM;CAAQ,EAAE,CAC5C;AAGN;;AAGA,SAAS,aACP,SACA,UACa;CACb,IAAI,CAAC,UAAU,OAAO;CAEtB,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,SAAS,SAAsB,WAAW,MAAM,KAAK,MAAM;CAEjE,IAAI,QAAQ,SAAS,MAAM,OAAO;MAC7B,QAAQ,iBAAiB,eAAe,MAAM,OAAO,GAAG,EAAE,MAAM,KAAK,CAAC;CAE3E,IAAI,SAAS,SAAS,MAAM,QAAQ;MAC/B,SAAS,iBAAiB,eAAe,MAAM,QAAQ,GAAG,EAAE,MAAM,KAAK,CAAC;CAE7E,OAAO,WAAW;AACpB;;;;;;;;AASA,eAAsB,aACpB,QACA,aACA,MACmB;CACnB,MAAM,SAAS,sBAAsB,WAAW;CAChD,MAAM,MAAM,MAAM,iBAAiB,QAAQ,MAAM;CAEjD,MAAM,oBAAoB,IAAI,gBAAgB;CAC9C,MAAM,QAAQ,iBAAiB;EAC7B,kBAAkB,MAChB,IAAI,oBACF,oCAAoC,OAAO,UAAU,KACrD,EAAE,SAAS;GAAE,KAAK;GAAQ,WAAW,OAAO;EAAU,EAAE,CAC1D,CACF;CACF,GAAG,OAAO,SAAS;CAEnB,IAAI;EACF,OAAO,MAAM,OAAO,MAAM,KAAK;GAC7B,GAAG;GACH,QAAQ,aAAa,kBAAkB,QAAQ,OAAO,MAAM;EAC9D,CAAC;CACH,UAAU;EACR,aAAa,KAAK;CACpB;AACF;;;;;;;AAQA,eAAsB,eACpB,UACA,UACiB;CACjB,MAAM,WAAW,OAAO,SAAS,QAAQ,IAAI,gBAAgB,CAAC;CAC9D,IAAI,OAAO,SAAS,QAAQ,KAAK,WAAW,UAC1C,MAAM,IAAI,oBACR,+CAA+C,SAAS,qBAAqB,SAAS,YACtF,EAAE,SAAS;EAAE;EAAU;CAAS,EAAE,CACpC;CAGF,IAAI,CAAC,SAAS,MAAM;EAClB,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI,OAAO,WAAW,IAAI,IAAI,UAC5B,MAAM,IAAI,oBACR,uCAAuC,SAAS,YAChD,EAAE,SAAS,EAAE,SAAS,EAAE,CAC1B;EAEF,OAAO;CACT;CAEA,MAAM,SAAS,SAAS,KAAK,UAAU;CACvC,MAAM,SAAuB,CAAC;CAC9B,IAAI,QAAQ;CAEZ,SAAS;EACP,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;EAC1C,IAAI,MAAM;EACV,IAAI,CAAC,OAAO;EAEZ,SAAS,MAAM;EACf,IAAI,QAAQ,UAAU;GACpB,MAAM,OAAO,OAAO;GACpB,MAAM,IAAI,oBACR,uCAAuC,SAAS,YAChD,EAAE,SAAS,EAAE,SAAS,EAAE,CAC1B;EACF;EACA,OAAO,KAAK,KAAK;CACnB;CAEA,OAAO,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,MAAM;AAC9C;;;;;;AAOA,eAAsB,oBACpB,QACA,aACA,MAC4E;CAC5E,MAAM,SAAS,sBAAsB,WAAW;CAChD,MAAM,WAAW,MAAM,aAAa,QAAQ,QAAQ,IAAI;CAExD,OAAO;EACL,IAAI,SAAS;EACb,QAAQ,SAAS;EACjB,YAAY,SAAS;EACrB,MAAM,SAAS,KAAK,MAAM,eAAe,UAAU,OAAO,QAAQ,IAAI;CACxE;AACF"}

package/esm/ai/src/security/private-ip.mjs

@@ -1,48 +0,0 @@
-import { isIP } from "node:net";
-
-//#region ../@warlock.js/ai/src/security/private-ip.ts
-/**
-* True when `ip` is a private, loopback, link-local, unique-local,
-* carrier-grade-NAT, unspecified, or otherwise non-public address — the
-* set an SSRF guard must refuse. Accepts IPv4 and IPv6 literals (including
-* IPv4-mapped IPv6 like `::ffff:169.254.169.254`). A non-IP string returns
-* `false` (the caller resolves hostnames via DNS first).
-*
-* The cloud-metadata endpoint `169.254.169.254` is covered by the IPv4
-* link-local range `169.254.0.0/16`.
-*/
-function isPrivateOrReservedIp(ip) {
-	const family = isIP(ip);
-	if (family === 4) return isPrivateIpv4(ip);
-	if (family === 6) return isPrivateIpv6(ip);
-	return false;
-}
-/** Parse a dotted-quad into four octets, or `null` if malformed. */
-function parseIpv4(ip) {
-	const parts = ip.split(".");
-	if (parts.length !== 4) return null;
-	const octets = parts.map((part) => Number(part));
-	if (octets.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) return null;
-	return octets;
-}
-function isPrivateIpv4(ip) {
-	const octets = parseIpv4(ip);
-	if (!octets) return true;
-	const [a, b] = octets;
-	return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 192 && b === 0 || a === 198 && (b === 18 || b === 19) || a === 198 && b === 51 || a === 203 && b === 0 || a >= 224;
-}
-function isPrivateIpv6(ip) {
-	const normalized = ip.toLowerCase().split("%")[0];
-	const v4 = normalized.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
-	if (v4) return isPrivateIpv4(v4[1]);
-	if (normalized === "::1" || normalized === "::") return true;
-	const firstGroup = normalized.split(":")[0];
-	const head = firstGroup === "" ? 0 : Number.parseInt(firstGroup, 16);
-	if ((head & 65024) === 64512) return true;
-	if ((head & 65472) === 65152) return true;
-	return false;
-}
-
-//#endregion
-export { isPrivateOrReservedIp };
-//# sourceMappingURL=private-ip.mjs.map

package/esm/ai/src/security/private-ip.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"private-ip.mjs","names":[],"sources":["../../../../../../../../../@warlock.js/ai/src/security/private-ip.ts"],"sourcesContent":["import { isIP } from \"node:net\";\n\n/**\n * True when `ip` is a private, loopback, link-local, unique-local,\n * carrier-grade-NAT, unspecified, or otherwise non-public address — the\n * set an SSRF guard must refuse. Accepts IPv4 and IPv6 literals (including\n * IPv4-mapped IPv6 like `::ffff:169.254.169.254`). A non-IP string returns\n * `false` (the caller resolves hostnames via DNS first).\n *\n * The cloud-metadata endpoint `169.254.169.254` is covered by the IPv4\n * link-local range `169.254.0.0/16`.\n */\nexport function isPrivateOrReservedIp(ip: string): boolean {\n  const family = isIP(ip);\n  if (family === 4) return isPrivateIpv4(ip);\n  if (family === 6) return isPrivateIpv6(ip);\n  return false;\n}\n\n/** Parse a dotted-quad into four octets, or `null` if malformed. */\nfunction parseIpv4(ip: string): [number, number, number, number] | null {\n  const parts = ip.split(\".\");\n  if (parts.length !== 4) return null;\n\n  const octets = parts.map(part => Number(part));\n  if (octets.some(n => !Number.isInteger(n) || n < 0 || n > 255)) return null;\n\n  return octets as [number, number, number, number];\n}\n\nfunction isPrivateIpv4(ip: string): boolean {\n  const octets = parseIpv4(ip);\n  if (!octets) return true; // unparseable → refuse, fail closed\n\n  const [a, b] = octets;\n\n  return (\n    a === 0 || // 0.0.0.0/8 \"this network\"\n    a === 10 || // 10.0.0.0/8 private\n    a === 127 || // 127.0.0.0/8 loopback\n    (a === 100 && b >= 64 && b <= 127) || // 100.64.0.0/10 CGNAT\n    (a === 169 && b === 254) || // 169.254.0.0/16 link-local + metadata\n    (a === 172 && b >= 16 && b <= 31) || // 172.16.0.0/12 private\n    (a === 192 && b === 168) || // 192.168.0.0/16 private\n    (a === 192 && b === 0) || // 192.0.0.0/24 + 192.0.2.0/24 (IETF/test)\n    (a === 198 && (b === 18 || b === 19)) || // 198.18.0.0/15 benchmarking\n    (a === 198 && b === 51) || // 198.51.100.0/24 test-net-2\n    (a === 203 && b === 0) || // 203.0.113.0/24 test-net-3\n    a >= 224 // 224.0.0.0/4 multicast + 240.0.0.0/4 reserved + 255.255.255.255\n  );\n}\n\nfunction isPrivateIpv6(ip: string): boolean {\n  const normalized = ip.toLowerCase().split(\"%\")[0]; // drop zone id\n\n  // IPv4-mapped / -embedded (::ffff:a.b.c.d, ::a.b.c.d) — defer to the v4\n  // check on the trailing dotted-quad so an inward-mapped address is caught.\n  const v4 = normalized.match(/(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})$/);\n  if (v4) {\n    return isPrivateIpv4(v4[1]);\n  }\n\n  if (normalized === \"::1\" || normalized === \"::\") {\n    return true; // loopback / unspecified\n  }\n\n  // Expand only the leading group enough to classify the reserved blocks.\n  const firstGroup = normalized.split(\":\")[0];\n  const head = firstGroup === \"\" ? 0 : Number.parseInt(firstGroup, 16);\n\n  // fc00::/7 unique-local (fc.. / fd..)\n  if ((head & 0xfe00) === 0xfc00) return true;\n  // fe80::/10 link-local\n  if ((head & 0xffc0) === 0xfe80) return true;\n\n  return false;\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,SAAgB,sBAAsB,IAAqB;CACzD,MAAM,SAAS,KAAK,EAAE;CACtB,IAAI,WAAW,GAAG,OAAO,cAAc,EAAE;CACzC,IAAI,WAAW,GAAG,OAAO,cAAc,EAAE;CACzC,OAAO;AACT;;AAGA,SAAS,UAAU,IAAqD;CACtE,MAAM,QAAQ,GAAG,MAAM,GAAG;CAC1B,IAAI,MAAM,WAAW,GAAG,OAAO;CAE/B,MAAM,SAAS,MAAM,KAAI,SAAQ,OAAO,IAAI,CAAC;CAC7C,IAAI,OAAO,MAAK,MAAK,CAAC,OAAO,UAAU,CAAC,KAAK,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;CAEvE,OAAO;AACT;AAEA,SAAS,cAAc,IAAqB;CAC1C,MAAM,SAAS,UAAU,EAAE;CAC3B,IAAI,CAAC,QAAQ,OAAO;CAEpB,MAAM,CAAC,GAAG,KAAK;CAEf,OACE,MAAM,KACN,MAAM,MACN,MAAM,OACL,MAAM,OAAO,KAAK,MAAM,KAAK,OAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,KAAK,MAAM,KAAK,MAC7B,MAAM,OAAO,MAAM,OACnB,MAAM,OAAO,MAAM,KACnB,MAAM,QAAQ,MAAM,MAAM,MAAM,OAChC,MAAM,OAAO,MAAM,MACnB,MAAM,OAAO,MAAM,KACpB,KAAK;AAET;AAEA,SAAS,cAAc,IAAqB;CAC1C,MAAM,aAAa,GAAG,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;CAI/C,MAAM,KAAK,WAAW,MAAM,uCAAuC;CACnE,IAAI,IACF,OAAO,cAAc,GAAG,EAAE;CAG5B,IAAI,eAAe,SAAS,eAAe,MACzC,OAAO;CAIT,MAAM,aAAa,WAAW,MAAM,GAAG,CAAC,CAAC;CACzC,MAAM,OAAO,eAAe,KAAK,IAAI,OAAO,SAAS,YAAY,EAAE;CAGnE,KAAK,OAAO,WAAY,OAAQ,OAAO;CAEvC,KAAK,OAAO,WAAY,OAAQ,OAAO;CAEvC,OAAO;AACT"}

package/esm/ai/src/security/redact.mjs

@@ -1,60 +0,0 @@
-//#region ../@warlock.js/ai/src/security/redact.ts
-/**
-* Default set of sensitive key fragments (matched case-insensitively as
-* substrings of an object key). Covers the secrets that leak through
-* recorded requests, error causes, and trace payloads: auth headers, API
-* keys, cookies, tokens, passwords, and private keys.
-*/
-const DEFAULT_SENSITIVE_KEYS = [
-	"authorization",
-	"x-api-key",
-	"api-key",
-	"apikey",
-	"cookie",
-	"set-cookie",
-	"password",
-	"passwd",
-	"secret",
-	"token",
-	"access_token",
-	"refresh_token",
-	"client_secret",
-	"private_key",
-	"session"
-];
-const DEFAULT_PLACEHOLDER = "[redacted]";
-const DEFAULT_MAX_DEPTH = 8;
-function keyIsSensitive(key, fragments) {
-	const lower = key.toLowerCase();
-	return fragments.some((fragment) => lower.includes(fragment));
-}
-/**
-* Deep-copy `value` with any property whose KEY matches a sensitive
-* fragment replaced by the placeholder. Arrays are walked element-wise;
-* circular references and over-deep trees collapse to the placeholder.
-* Primitives pass through untouched (redaction is key-driven, not
-* value-driven — it never guesses at a bare string being a secret).
-*
-* Shared by VCR cassettes (S2), Panoptic content capture, and the error /
-* cause serializer (S4) so there is ONE redaction policy, not three.
-*/
-function redact(value, options = {}) {
-	const fragments = [...DEFAULT_SENSITIVE_KEYS, ...options.keys ?? []].map((k) => k.toLowerCase());
-	const placeholder = options.placeholder ?? DEFAULT_PLACEHOLDER;
-	const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
-	const seen = /* @__PURE__ */ new WeakSet();
-	const walk = (input, depth) => {
-		if (input === null || typeof input !== "object") return input;
-		if (depth >= maxDepth || seen.has(input)) return placeholder;
-		seen.add(input);
-		if (Array.isArray(input)) return input.map((item) => walk(item, depth + 1));
-		const out = {};
-		for (const [key, val] of Object.entries(input)) out[key] = keyIsSensitive(key, fragments) ? placeholder : walk(val, depth + 1);
-		return out;
-	};
-	return walk(value, 0);
-}
-
-//#endregion
-export { DEFAULT_SENSITIVE_KEYS, redact };
-//# sourceMappingURL=redact.mjs.map

package/esm/ai/src/security/redact.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"redact.mjs","names":[],"sources":["../../../../../../../../../@warlock.js/ai/src/security/redact.ts"],"sourcesContent":["/**\n * Default set of sensitive key fragments (matched case-insensitively as\n * substrings of an object key). Covers the secrets that leak through\n * recorded requests, error causes, and trace payloads: auth headers, API\n * keys, cookies, tokens, passwords, and private keys.\n */\nexport const DEFAULT_SENSITIVE_KEYS: readonly string[] = [\n  \"authorization\",\n  \"x-api-key\",\n  \"api-key\",\n  \"apikey\",\n  \"cookie\",\n  \"set-cookie\",\n  \"password\",\n  \"passwd\",\n  \"secret\",\n  \"token\",\n  \"access_token\",\n  \"refresh_token\",\n  \"client_secret\",\n  \"private_key\",\n  \"session\",\n];\n\n/** HTTP header names always stripped from a serialized error/cause. */\nexport const SENSITIVE_HEADERS: readonly string[] = [\n  \"authorization\",\n  \"x-api-key\",\n  \"api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n];\n\nexport type RedactOptions = {\n  /** Extra key fragments to redact, merged with {@link DEFAULT_SENSITIVE_KEYS}. */\n  keys?: string[];\n  /** Replacement for a redacted value. Default `\"[redacted]\"`. */\n  placeholder?: string;\n  /** Maximum recursion depth before bailing out. Default `8`. */\n  maxDepth?: number;\n};\n\nconst DEFAULT_PLACEHOLDER = \"[redacted]\";\nconst DEFAULT_MAX_DEPTH = 8;\n\nfunction keyIsSensitive(key: string, fragments: string[]): boolean {\n  const lower = key.toLowerCase();\n  return fragments.some(fragment => lower.includes(fragment));\n}\n\n/**\n * Deep-copy `value` with any property whose KEY matches a sensitive\n * fragment replaced by the placeholder. Arrays are walked element-wise;\n * circular references and over-deep trees collapse to the placeholder.\n * Primitives pass through untouched (redaction is key-driven, not\n * value-driven — it never guesses at a bare string being a secret).\n *\n * Shared by VCR cassettes (S2), Panoptic content capture, and the error /\n * cause serializer (S4) so there is ONE redaction policy, not three.\n */\nexport function redact<T>(value: T, options: RedactOptions = {}): T {\n  const fragments = [...DEFAULT_SENSITIVE_KEYS, ...(options.keys ?? [])].map(k =>\n    k.toLowerCase(),\n  );\n  const placeholder = options.placeholder ?? DEFAULT_PLACEHOLDER;\n  const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;\n  const seen = new WeakSet<object>();\n\n  const walk = (input: unknown, depth: number): unknown => {\n    if (input === null || typeof input !== \"object\") {\n      return input;\n    }\n    if (depth >= maxDepth || seen.has(input)) {\n      return placeholder;\n    }\n    seen.add(input as object);\n\n    if (Array.isArray(input)) {\n      return input.map(item => walk(item, depth + 1));\n    }\n\n    const out: Record<string, unknown> = {};\n    for (const [key, val] of Object.entries(input as Record<string, unknown>)) {\n      out[key] = keyIsSensitive(key, fragments)\n        ? placeholder\n        : walk(val, depth + 1);\n    }\n    return out;\n  };\n\n  return walk(value, 0) as T;\n}\n\n/**\n * Strip sensitive HTTP headers from a `Headers` instance or a plain\n * header record, returning a redacted plain object. Header names are\n * matched case-insensitively against {@link SENSITIVE_HEADERS}.\n */\nexport function redactHeaders(\n  headers: Headers | Record<string, unknown> | undefined,\n  placeholder: string = DEFAULT_PLACEHOLDER,\n): Record<string, unknown> {\n  if (!headers) return {};\n\n  const entries: Array<[string, unknown]> =\n    headers instanceof Headers\n      ? [...headers.entries()]\n      : Object.entries(headers);\n\n  const out: Record<string, unknown> = {};\n  for (const [key, val] of entries) {\n    out[key] = SENSITIVE_HEADERS.includes(key.toLowerCase()) ? placeholder : val;\n  }\n  return out;\n}\n\n/**\n * Patterns for secrets that hide in FREE TEXT (error messages, stack\n * traces, log lines) where the key-based {@link redact} can't reach them.\n * Each entry replaces the secret with `[redacted]` while keeping\n * surrounding context.\n */\nconst SECRET_PATTERNS: ReadonlyArray<readonly [RegExp, string]> = [\n  [/\\bBearer\\s+[A-Za-z0-9._~+/-]+=*/gi, \"Bearer [redacted]\"],\n  [/\\b(authorization|x-api-key|api[_-]?key|cookie)(\"?\\s*[:=]\\s*\"?)[^\\s\",}]+/gi, \"$1$2[redacted]\"],\n  [/\\bsk-[A-Za-z0-9]{16,}\\b/g, \"[redacted]\"], // OpenAI-style keys\n  [/\\bxox[baprs]-[A-Za-z0-9-]{8,}\\b/g, \"[redacted]\"], // Slack tokens\n  [/\\bgh[pousr]_[A-Za-z0-9]{20,}\\b/g, \"[redacted]\"], // GitHub tokens\n  [/\\bAKIA[0-9A-Z]{16}\\b/g, \"[redacted]\"], // AWS access key ids\n];\n\n/**\n * Scrub secrets that appear in free-form text — error messages, stack\n * traces, exported log lines. Complements {@link redact} (which is key-\n * driven and can't see a token embedded in a string). Used by the trace /\n * error serializer (S4) before a message or stack is stored or exported.\n */\nexport function scrubSecrets(text: string): string {\n  let out = text;\n  for (const [pattern, replacement] of SECRET_PATTERNS) {\n    out = out.replace(pattern, replacement);\n  }\n  return out;\n}\n\n/**\n * Serialized, secret-free view of an error. `stack` is omitted by default\n * (it can embed local paths, endpoints, and tokens); pass\n * `includeStack: true` only for a trusted local sink. The retained\n * `cause` is deep-redacted via {@link redact}, so a raw provider SDK error\n * carrying `Authorization` / `x-api-key` on `cause.headers` is sanitized.\n */\nexport type RedactedError = {\n  name: string;\n  message: string;\n  code?: string;\n  cause?: unknown;\n  stack?: string;\n};\n\nexport function redactError(\n  error: unknown,\n  options: { includeStack?: boolean } & RedactOptions = {},\n): RedactedError {\n  const { includeStack, ...redactOptions } = options;\n\n  if (error === null || typeof error !== \"object\") {\n    return { name: \"Error\", message: String(error) };\n  }\n\n  const err = error as {\n    name?: unknown;\n    message?: unknown;\n    code?: unknown;\n    cause?: unknown;\n    stack?: unknown;\n  };\n\n  const result: RedactedError = {\n    name: typeof err.name === \"string\" ? err.name : \"Error\",\n    message: typeof err.message === \"string\" ? err.message : String(error),\n  };\n\n  if (typeof err.code === \"string\") {\n    result.code = err.code;\n  }\n  if (err.cause !== undefined) {\n    result.cause =\n      err.cause !== null && typeof err.cause === \"object\"\n        ? redact(err.cause, redactOptions)\n        : err.cause;\n  }\n  if (includeStack && typeof err.stack === \"string\") {\n    result.stack = err.stack;\n  }\n\n  return result;\n}\n"],"mappings":";;;;;;;AAMA,MAAa,yBAA4C;CACvD;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAqBA,MAAM,sBAAsB;AAC5B,MAAM,oBAAoB;AAE1B,SAAS,eAAe,KAAa,WAA8B;CACjE,MAAM,QAAQ,IAAI,YAAY;CAC9B,OAAO,UAAU,MAAK,aAAY,MAAM,SAAS,QAAQ,CAAC;AAC5D;;;;;;;;;;;AAYA,SAAgB,OAAU,OAAU,UAAyB,CAAC,GAAM;CAClE,MAAM,YAAY,CAAC,GAAG,wBAAwB,GAAI,QAAQ,QAAQ,CAAC,CAAE,CAAC,CAAC,KAAI,MACzE,EAAE,YAAY,CAChB;CACA,MAAM,cAAc,QAAQ,eAAe;CAC3C,MAAM,WAAW,QAAQ,YAAY;CACrC,MAAM,uBAAO,IAAI,QAAgB;CAEjC,MAAM,QAAQ,OAAgB,UAA2B;EACvD,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,OAAO;EAET,IAAI,SAAS,YAAY,KAAK,IAAI,KAAK,GACrC,OAAO;EAET,KAAK,IAAI,KAAe;EAExB,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAI,SAAQ,KAAK,MAAM,QAAQ,CAAC,CAAC;EAGhD,MAAM,MAA+B,CAAC;EACtC,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,KAAgC,GACtE,IAAI,OAAO,eAAe,KAAK,SAAS,IACpC,cACA,KAAK,KAAK,QAAQ,CAAC;EAEzB,OAAO;CACT;CAEA,OAAO,KAAK,OAAO,CAAC;AACtB"}

package/esm/ai/src/serve/serve.mjs

@@ -1,90 +0,0 @@
-import { streamToSSE } from "./stream-to-sse.mjs";
-
-//#region ../@warlock.js/ai/src/serve/serve.ts
-const SECURITY_HEADERS = {
-	"x-content-type-options": "nosniff",
-	"x-frame-options": "DENY",
-	"referrer-policy": "no-referrer"
-};
-/**
-* Turn an executable into a `node:http` request handler that streams its
-* run to the client as Server-Sent Events (A3) — the production-serving
-* primitive. POST a JSON body (`{ input, sessionId?, history? }`); the
-* response is an `text/event-stream` of the primitive's events, the final
-* `result`, then `[DONE]`. Absorbs the auth-token control; pair with a
-* `sessionLock` + an orchestrator for durable multi-turn serving.
-*
-* @example
-* import { createServer } from "node:http";
-* createServer(ai.serve(myAgent, { authToken: process.env.TOKEN })).listen(8787);
-*/
-function serve(executable, options = {}) {
-	const toInput = options.toInput ?? ((body) => body.input);
-	const toOptions = options.toOptions ?? ((body) => {
-		const opts = {};
-		if (body.sessionId !== void 0) opts.sessionId = body.sessionId;
-		if (body.history !== void 0) opts.history = body.history;
-		return opts;
-	});
-	return function handle(req, res) {
-		(async () => {
-			if (req.method !== "POST") {
-				sendJson(res, 405, { error: "method_not_allowed" });
-				return;
-			}
-			if (options.authToken && req.headers.authorization !== `Bearer ${options.authToken}`) {
-				sendJson(res, 401, { error: "unauthorized" });
-				return;
-			}
-			let body;
-			try {
-				body = await readJsonBody(req);
-			} catch {
-				sendJson(res, 400, { error: "invalid_json" });
-				return;
-			}
-			res.writeHead(200, {
-				"content-type": "text/event-stream; charset=utf-8",
-				"cache-control": "no-cache",
-				connection: "keep-alive",
-				...SECURITY_HEADERS
-			});
-			try {
-				const stream = executable.stream(toInput(body), toOptions(body));
-				for await (const frame of streamToSSE(stream)) res.write(frame);
-			} catch (error) {
-				res.write(`event: error\ndata: ${JSON.stringify({ message: error instanceof Error ? error.message : String(error) })}\n\n`);
-			} finally {
-				res.end();
-			}
-		})();
-	};
-}
-/** Read and JSON-parse a request body. */
-function readJsonBody(req) {
-	return new Promise((resolve, reject) => {
-		let raw = "";
-		req.on("data", (chunk) => {
-			raw += chunk.toString();
-		});
-		req.on("end", () => {
-			try {
-				resolve(raw ? JSON.parse(raw) : {});
-			} catch (error) {
-				reject(error);
-			}
-		});
-		req.on("error", reject);
-	});
-}
-function sendJson(res, status, body) {
-	res.writeHead(status, {
-		"content-type": "application/json; charset=utf-8",
-		...SECURITY_HEADERS
-	});
-	res.end(JSON.stringify(body));
-}
-
-//#endregion
-export { serve };
-//# sourceMappingURL=serve.mjs.map

package/esm/ai/src/serve/serve.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"serve.mjs","names":[],"sources":["../../../../../../../../../@warlock.js/ai/src/serve/serve.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { streamToSSE, type StreamLike } from \"./stream-to-sse\";\n\n/**\n * Anything `serve` can expose: a primitive whose `stream(input, options)`\n * returns a {@link StreamLike}. Agents, supervisors, and orchestrators all\n * satisfy it.\n */\nexport type ServableExecutable<TInput = unknown> = {\n  stream(input: TInput, options?: Record<string, unknown>): StreamLike<{ type: string }, unknown>;\n};\n\n/** Options for {@link serve}. */\nexport type ServeOptions<TInput = unknown> = {\n  /**\n   * Bearer token required on every request. When set, a request must send\n   * `Authorization: Bearer <token>`, else `401` (S4-style auth, the same\n   * control the dashboard uses — fold this in for a production deploy).\n   */\n  authToken?: string;\n  /**\n   * Map the parsed JSON request body to the executable's input. Default:\n   * `body.input`. Override to accept a different request shape.\n   */\n  toInput?: (body: Record<string, unknown>) => TInput;\n  /**\n   * Map the parsed body to per-call stream options (e.g. an orchestrator\n   * `{ sessionId, history }` so a turn resumes the right session — A3\n   * wiring). Default: pass `sessionId` / `history` straight through.\n   */\n  toOptions?: (body: Record<string, unknown>) => Record<string, unknown>;\n};\n\nconst SECURITY_HEADERS: Record<string, string> = {\n  \"x-content-type-options\": \"nosniff\",\n  \"x-frame-options\": \"DENY\",\n  \"referrer-policy\": \"no-referrer\",\n};\n\n/**\n * Turn an executable into a `node:http` request handler that streams its\n * run to the client as Server-Sent Events (A3) — the production-serving\n * primitive. POST a JSON body (`{ input, sessionId?, history? }`); the\n * response is an `text/event-stream` of the primitive's events, the final\n * `result`, then `[DONE]`. Absorbs the auth-token control; pair with a\n * `sessionLock` + an orchestrator for durable multi-turn serving.\n *\n * @example\n * import { createServer } from \"node:http\";\n * createServer(ai.serve(myAgent, { authToken: process.env.TOKEN })).listen(8787);\n */\nexport function serve<TInput = unknown>(\n  executable: ServableExecutable<TInput>,\n  options: ServeOptions<TInput> = {},\n): (req: IncomingMessage, res: ServerResponse) => void {\n  const toInput = options.toInput ?? ((body) => body.input as TInput);\n  const toOptions =\n    options.toOptions ??\n    ((body) => {\n      const opts: Record<string, unknown> = {};\n      if (body.sessionId !== undefined) opts.sessionId = body.sessionId;\n      if (body.history !== undefined) opts.history = body.history;\n      return opts;\n    });\n\n  return function handle(req: IncomingMessage, res: ServerResponse): void {\n    void (async () => {\n      if (req.method !== \"POST\") {\n        sendJson(res, 405, { error: \"method_not_allowed\" });\n        return;\n      }\n\n      if (options.authToken && req.headers.authorization !== `Bearer ${options.authToken}`) {\n        sendJson(res, 401, { error: \"unauthorized\" });\n        return;\n      }\n\n      let body: Record<string, unknown>;\n      try {\n        body = await readJsonBody(req);\n      } catch {\n        sendJson(res, 400, { error: \"invalid_json\" });\n        return;\n      }\n\n      res.writeHead(200, {\n        \"content-type\": \"text/event-stream; charset=utf-8\",\n        \"cache-control\": \"no-cache\",\n        connection: \"keep-alive\",\n        ...SECURITY_HEADERS,\n      });\n\n      try {\n        const stream = executable.stream(toInput(body), toOptions(body));\n        for await (const frame of streamToSSE(stream)) {\n          res.write(frame);\n        }\n      } catch (error) {\n        res.write(\n          `event: error\\ndata: ${JSON.stringify({\n            message: error instanceof Error ? error.message : String(error),\n          })}\\n\\n`,\n        );\n      } finally {\n        res.end();\n      }\n    })();\n  };\n}\n\n/** Read and JSON-parse a request body. */\nfunction readJsonBody(req: IncomingMessage): Promise<Record<string, unknown>> {\n  return new Promise((resolve, reject) => {\n    let raw = \"\";\n    req.on(\"data\", (chunk: Buffer | string) => {\n      raw += chunk.toString();\n    });\n    req.on(\"end\", () => {\n      try {\n        resolve(raw ? (JSON.parse(raw) as Record<string, unknown>) : {});\n      } catch (error) {\n        reject(error);\n      }\n    });\n    req.on(\"error\", reject);\n  });\n}\n\nfunction sendJson(res: ServerResponse, status: number, body: unknown): void {\n  res.writeHead(status, { \"content-type\": \"application/json; charset=utf-8\", ...SECURITY_HEADERS });\n  res.end(JSON.stringify(body));\n}\n"],"mappings":";;;AAiCA,MAAM,mBAA2C;CAC/C,0BAA0B;CAC1B,mBAAmB;CACnB,mBAAmB;AACrB;;;;;;;;;;;;;AAcA,SAAgB,MACd,YACA,UAAgC,CAAC,GACoB;CACrD,MAAM,UAAU,QAAQ,aAAa,SAAS,KAAK;CACnD,MAAM,YACJ,QAAQ,eACN,SAAS;EACT,MAAM,OAAgC,CAAC;EACvC,IAAI,KAAK,cAAc,QAAW,KAAK,YAAY,KAAK;EACxD,IAAI,KAAK,YAAY,QAAW,KAAK,UAAU,KAAK;EACpD,OAAO;CACT;CAEF,OAAO,SAAS,OAAO,KAAsB,KAA2B;EACtE,CAAM,YAAY;GAChB,IAAI,IAAI,WAAW,QAAQ;IACzB,SAAS,KAAK,KAAK,EAAE,OAAO,qBAAqB,CAAC;IAClD;GACF;GAEA,IAAI,QAAQ,aAAa,IAAI,QAAQ,kBAAkB,UAAU,QAAQ,aAAa;IACpF,SAAS,KAAK,KAAK,EAAE,OAAO,eAAe,CAAC;IAC5C;GACF;GAEA,IAAI;GACJ,IAAI;IACF,OAAO,MAAM,aAAa,GAAG;GAC/B,QAAQ;IACN,SAAS,KAAK,KAAK,EAAE,OAAO,eAAe,CAAC;IAC5C;GACF;GAEA,IAAI,UAAU,KAAK;IACjB,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;IACZ,GAAG;GACL,CAAC;GAED,IAAI;IACF,MAAM,SAAS,WAAW,OAAO,QAAQ,IAAI,GAAG,UAAU,IAAI,CAAC;IAC/D,WAAW,MAAM,SAAS,YAAY,MAAM,GAC1C,IAAI,MAAM,KAAK;GAEnB,SAAS,OAAO;IACd,IAAI,MACF,uBAAuB,KAAK,UAAU,EACpC,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAChE,CAAC,EAAE,KACL;GACF,UAAU;IACR,IAAI,IAAI;GACV;EACF,EAAC,CAAE;CACL;AACF;;AAGA,SAAS,aAAa,KAAwD;CAC5E,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,IAAI,MAAM;EACV,IAAI,GAAG,SAAS,UAA2B;GACzC,OAAO,MAAM,SAAS;EACxB,CAAC;EACD,IAAI,GAAG,aAAa;GAClB,IAAI;IACF,QAAQ,MAAO,KAAK,MAAM,GAAG,IAAgC,CAAC,CAAC;GACjE,SAAS,OAAO;IACd,OAAO,KAAK;GACd;EACF,CAAC;EACD,IAAI,GAAG,SAAS,MAAM;CACxB,CAAC;AACH;AAEA,SAAS,SAAS,KAAqB,QAAgB,MAAqB;CAC1E,IAAI,UAAU,QAAQ;EAAE,gBAAgB;EAAmC,GAAG;CAAiB,CAAC;CAChG,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC;AAC9B"}

package/esm/ai/src/serve/sse.mjs

@@ -1,25 +0,0 @@
-//#region ../@warlock.js/ai/src/serve/sse.ts
-/**
-* Encode one Server-Sent-Events frame. Multi-line `data` is split into
-* multiple `data:` lines per the SSE spec, so JSON with embedded newlines
-* still parses on the client.
-*
-* @example
-* encodeSSE({ event: "agent.trip.streaming", data: { delta: "Hi" } });
-* // "event: agent.trip.streaming\ndata: {\"delta\":\"Hi\"}\n\n"
-*/
-function encodeSSE(frame) {
-	let out = "";
-	if (frame.id) out += `id: ${frame.id}\n`;
-	if (frame.event) out += `event: ${frame.event}\n`;
-	const data = typeof frame.data === "string" ? frame.data : JSON.stringify(frame.data);
-	for (const line of data.split("\n")) out += `data: ${line}\n`;
-	out += "\n";
-	return out;
-}
-/** The terminal SSE frame a client watches for to stop reading. */
-const SSE_DONE = "data: [DONE]\n\n";
-
-//#endregion
-export { SSE_DONE, encodeSSE };
-//# sourceMappingURL=sse.mjs.map

package/esm/ai/src/serve/sse.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"sse.mjs","names":[],"sources":["../../../../../../../../../@warlock.js/ai/src/serve/sse.ts"],"sourcesContent":["/**\n * Encode one Server-Sent-Events frame. Multi-line `data` is split into\n * multiple `data:` lines per the SSE spec, so JSON with embedded newlines\n * still parses on the client.\n *\n * @example\n * encodeSSE({ event: \"agent.trip.streaming\", data: { delta: \"Hi\" } });\n * // \"event: agent.trip.streaming\\ndata: {\\\"delta\\\":\\\"Hi\\\"}\\n\\n\"\n */\nexport function encodeSSE(frame: { event?: string; data: unknown; id?: string }): string {\n  let out = \"\";\n  if (frame.id) out += `id: ${frame.id}\\n`;\n  if (frame.event) out += `event: ${frame.event}\\n`;\n\n  const data =\n    typeof frame.data === \"string\" ? frame.data : JSON.stringify(frame.data);\n  for (const line of data.split(\"\\n\")) {\n    out += `data: ${line}\\n`;\n  }\n\n  out += \"\\n\";\n  return out;\n}\n\n/** The terminal SSE frame a client watches for to stop reading. */\nexport const SSE_DONE = \"data: [DONE]\\n\\n\";\n"],"mappings":";;;;;;;;;;AASA,SAAgB,UAAU,OAA+D;CACvF,IAAI,MAAM;CACV,IAAI,MAAM,IAAI,OAAO,OAAO,MAAM,GAAG;CACrC,IAAI,MAAM,OAAO,OAAO,UAAU,MAAM,MAAM;CAE9C,MAAM,OACJ,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,KAAK,UAAU,MAAM,IAAI;CACzE,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,GAChC,OAAO,SAAS,KAAK;CAGvB,OAAO;CACP,OAAO;AACT;;AAGA,MAAa,WAAW"}