@xenosystem/agent-sdk 0.8.12

package/dist/session/metafile-cjs.json

@@ -0,0 +1 @@
+{"inputs":{"src/session/id-generator.ts":{"bytes":896,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/utils/fs.ts":{"bytes":10330,"imports":[{"path":"node:fs","kind":"import-statement","external":true},{"path":"node:fs","kind":"import-statement","external":true},{"path":"node:fs/promises","kind":"import-statement","external":true},{"path":"node:path","kind":"import-statement","external":true}],"format":"esm"},"src/utils/json.ts":{"bytes":842,"imports":[],"format":"esm"},"src/utils/logger.ts":{"bytes":3873,"imports":[],"format":"esm"},"src/session/direct-shell.ts":{"bytes":2385,"imports":[],"format":"esm"},"src/session/transcript.ts":{"bytes":15125,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"crypto","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"},{"path":"src/utils/logger.ts","kind":"import-statement","original":"../utils/logger.js"},{"path":"src/session/direct-shell.ts","kind":"import-statement","original":"./direct-shell.js"}],"format":"esm"},"src/tools/tool-names.ts":{"bytes":718,"imports":[],"format":"esm"},"src/session/checkpoint.ts":{"bytes":5976,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"crypto","kind":"import-statement","external":true},{"path":"fs/promises","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"},{"path":"src/tools/tool-names.ts","kind":"import-statement","original":"../tools/tool-names.js"}],"format":"esm"},"src/runtime/shutdown.ts":{"bytes":7459,"imports":[],"format":"esm"},"src/version.ts":{"bytes":38,"imports":[],"format":"esm"},"src/session/lock.ts":{"bytes":9317,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"os","kind":"import-statement","external":true},{"path":"fs","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"},{"path":"src/utils/logger.ts","kind":"import-statement","original":"../utils/logger.js"},{"path":"src/runtime/shutdown.ts","kind":"import-statement","original":"../runtime/shutdown.js"},{"path":"src/version.ts","kind":"import-statement","original":"../version.js"}],"format":"esm"},"src/types.ts":{"bytes":23628,"imports":[],"format":"esm"},"src/utils/path-security.ts":{"bytes":1024,"imports":[{"path":"path","kind":"import-statement","external":true}],"format":"esm"},"src/session/recent-sessions.ts":{"bytes":6982,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"os","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"}],"format":"esm"},"src/session/registry.ts":{"bytes":9935,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"os","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"},{"path":"src/types.ts","kind":"import-statement","original":"../types.js"},{"path":"src/utils/path-security.ts","kind":"import-statement","original":"../utils/path-security.js"},{"path":"src/session/recent-sessions.ts","kind":"import-statement","original":"./recent-sessions.js"}],"format":"esm"},"src/session/manager.ts":{"bytes":12288,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"},{"path":"src/session/transcript.ts","kind":"import-statement","original":"./transcript.js"},{"path":"src/session/checkpoint.ts","kind":"import-statement","original":"./checkpoint.js"},{"path":"src/session/lock.ts","kind":"import-statement","original":"./lock.js"},{"path":"src/session/registry.ts","kind":"import-statement","original":"./registry.js"},{"path":"src/session/id-generator.ts","kind":"import-statement","original":"./id-generator.js"},{"path":"src/types.ts","kind":"import-statement","original":"../types.js"},{"path":"src/session/direct-shell.ts","kind":"import-statement","original":"./direct-shell.js"},{"path":"src/utils/logger.ts","kind":"import-statement","original":"../utils/logger.js"}],"format":"esm"},"src/session/turn-restore.ts":{"bytes":31116,"imports":[{"path":"node:crypto","kind":"import-statement","external":true},{"path":"node:child_process","kind":"import-statement","external":true},{"path":"node:fs/promises","kind":"import-statement","external":true},{"path":"node:os","kind":"import-statement","external":true},{"path":"node:path","kind":"import-statement","external":true},{"path":"src/tools/tool-names.ts","kind":"import-statement","original":"../tools/tool-names.js"},{"path":"src/utils/path-security.ts","kind":"import-statement","original":"../utils/path-security.js"}],"format":"esm"},"src/session/index.ts":{"bytes":1220,"imports":[{"path":"src/session/id-generator.ts","kind":"import-statement","original":"./id-generator.js"},{"path":"src/session/transcript.ts","kind":"import-statement","original":"./transcript.js"},{"path":"src/session/checkpoint.ts","kind":"import-statement","original":"./checkpoint.js"},{"path":"src/session/lock.ts","kind":"import-statement","original":"./lock.js"},{"path":"src/session/registry.ts","kind":"import-statement","original":"./registry.js"},{"path":"src/session/manager.ts","kind":"import-statement","original":"./manager.js"},{"path":"src/session/direct-shell.ts","kind":"import-statement","original":"./direct-shell.js"},{"path":"src/session/recent-sessions.ts","kind":"import-statement","original":"./recent-sessions.js"},{"path":"src/session/turn-restore.ts","kind":"import-statement","original":"./turn-restore.js"}],"format":"esm"}},"outputs":{"dist/session/index.cjs":{"imports":[{"path":"node:crypto","kind":"require-call","external":true},{"path":"path","kind":"require-call","external":true},{"path":"crypto","kind":"require-call","external":true},{"path":"node:fs","kind":"require-call","external":true},{"path":"node:fs/promises","kind":"require-call","external":true},{"path":"node:path","kind":"require-call","external":true},{"path":"path","kind":"require-call","external":true},{"path":"crypto","kind":"require-call","external":true},{"path":"fs/promises","kind":"require-call","external":true},{"path":"path","kind":"require-call","external":true},{"path":"os","kind":"require-call","external":true},{"path":"fs","kind":"require-call","external":true},{"path":"path","kind":"require-call","external":true},{"path":"os","kind":"require-call","external":true},{"path":"path","kind":"require-call","external":true},{"path":"path","kind":"require-call","external":true},{"path":"os","kind":"require-call","external":true},{"path":"path","kind":"require-call","external":true},{"path":"node:crypto","kind":"require-call","external":true},{"path":"node:child_process","kind":"require-call","external":true},{"path":"node:fs/promises","kind":"require-call","external":true},{"path":"node:os","kind":"require-call","external":true},{"path":"node:path","kind":"require-call","external":true}],"exports":[],"entryPoint":"src/session/index.ts","inputs":{"src/session/index.ts":{"bytesInOutput":689},"src/session/id-generator.ts":{"bytesInOutput":340},"src/session/transcript.ts":{"bytesInOutput":6602},"src/utils/fs.ts":{"bytesInOutput":1172},"src/utils/json.ts":{"bytesInOutput":170},"src/utils/logger.ts":{"bytesInOutput":489},"src/session/direct-shell.ts":{"bytesInOutput":1071},"src/session/checkpoint.ts":{"bytesInOutput":2302},"src/tools/tool-names.ts":{"bytesInOutput":190},"src/session/lock.ts":{"bytesInOutput":3194},"src/runtime/shutdown.ts":{"bytesInOutput":400},"src/version.ts":{"bytesInOutput":16},"src/session/registry.ts":{"bytesInOutput":2785},"src/utils/path-security.ts":{"bytesInOutput":314},"src/session/recent-sessions.ts":{"bytesInOutput":1546},"src/session/manager.ts":{"bytesInOutput":4101},"src/session/turn-restore.ts":{"bytesInOutput":13491}},"bytes":39976}}}

package/dist/session/metafile-esm.json

@@ -0,0 +1 @@
+{"inputs":{"src/session/id-generator.ts":{"bytes":896,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/utils/fs.ts":{"bytes":10330,"imports":[{"path":"node:fs","kind":"import-statement","external":true},{"path":"node:fs","kind":"import-statement","external":true},{"path":"node:fs/promises","kind":"import-statement","external":true},{"path":"node:path","kind":"import-statement","external":true}],"format":"esm"},"src/utils/json.ts":{"bytes":842,"imports":[],"format":"esm"},"src/utils/logger.ts":{"bytes":3873,"imports":[],"format":"esm"},"src/session/direct-shell.ts":{"bytes":2385,"imports":[],"format":"esm"},"src/session/transcript.ts":{"bytes":15125,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"crypto","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"},{"path":"src/utils/logger.ts","kind":"import-statement","original":"../utils/logger.js"},{"path":"src/session/direct-shell.ts","kind":"import-statement","original":"./direct-shell.js"}],"format":"esm"},"src/tools/tool-names.ts":{"bytes":718,"imports":[],"format":"esm"},"src/session/checkpoint.ts":{"bytes":5976,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"crypto","kind":"import-statement","external":true},{"path":"fs/promises","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"},{"path":"src/tools/tool-names.ts","kind":"import-statement","original":"../tools/tool-names.js"}],"format":"esm"},"src/runtime/shutdown.ts":{"bytes":7459,"imports":[],"format":"esm"},"src/version.ts":{"bytes":38,"imports":[],"format":"esm"},"src/session/lock.ts":{"bytes":9317,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"os","kind":"import-statement","external":true},{"path":"fs","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"},{"path":"src/utils/logger.ts","kind":"import-statement","original":"../utils/logger.js"},{"path":"src/runtime/shutdown.ts","kind":"import-statement","original":"../runtime/shutdown.js"},{"path":"src/version.ts","kind":"import-statement","original":"../version.js"}],"format":"esm"},"src/types.ts":{"bytes":23628,"imports":[],"format":"esm"},"src/utils/path-security.ts":{"bytes":1024,"imports":[{"path":"path","kind":"import-statement","external":true}],"format":"esm"},"src/session/recent-sessions.ts":{"bytes":6982,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"os","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"}],"format":"esm"},"src/session/registry.ts":{"bytes":9935,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"os","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"},{"path":"src/types.ts","kind":"import-statement","original":"../types.js"},{"path":"src/utils/path-security.ts","kind":"import-statement","original":"../utils/path-security.js"},{"path":"src/session/recent-sessions.ts","kind":"import-statement","original":"./recent-sessions.js"}],"format":"esm"},"src/session/manager.ts":{"bytes":12288,"imports":[{"path":"path","kind":"import-statement","external":true},{"path":"src/utils/fs.ts","kind":"import-statement","original":"../utils/fs.js"},{"path":"src/utils/json.ts","kind":"import-statement","original":"../utils/json.js"},{"path":"src/session/transcript.ts","kind":"import-statement","original":"./transcript.js"},{"path":"src/session/checkpoint.ts","kind":"import-statement","original":"./checkpoint.js"},{"path":"src/session/lock.ts","kind":"import-statement","original":"./lock.js"},{"path":"src/session/registry.ts","kind":"import-statement","original":"./registry.js"},{"path":"src/session/id-generator.ts","kind":"import-statement","original":"./id-generator.js"},{"path":"src/types.ts","kind":"import-statement","original":"../types.js"},{"path":"src/session/direct-shell.ts","kind":"import-statement","original":"./direct-shell.js"},{"path":"src/utils/logger.ts","kind":"import-statement","original":"../utils/logger.js"}],"format":"esm"},"src/session/turn-restore.ts":{"bytes":31116,"imports":[{"path":"node:crypto","kind":"import-statement","external":true},{"path":"node:child_process","kind":"import-statement","external":true},{"path":"node:fs/promises","kind":"import-statement","external":true},{"path":"node:os","kind":"import-statement","external":true},{"path":"node:path","kind":"import-statement","external":true},{"path":"src/tools/tool-names.ts","kind":"import-statement","original":"../tools/tool-names.js"},{"path":"src/utils/path-security.ts","kind":"import-statement","original":"../utils/path-security.js"}],"format":"esm"},"src/session/index.ts":{"bytes":1220,"imports":[{"path":"src/session/id-generator.ts","kind":"import-statement","original":"./id-generator.js"},{"path":"src/session/transcript.ts","kind":"import-statement","original":"./transcript.js"},{"path":"src/session/checkpoint.ts","kind":"import-statement","original":"./checkpoint.js"},{"path":"src/session/lock.ts","kind":"import-statement","original":"./lock.js"},{"path":"src/session/registry.ts","kind":"import-statement","original":"./registry.js"},{"path":"src/session/manager.ts","kind":"import-statement","original":"./manager.js"},{"path":"src/session/direct-shell.ts","kind":"import-statement","original":"./direct-shell.js"},{"path":"src/session/recent-sessions.ts","kind":"import-statement","original":"./recent-sessions.js"},{"path":"src/session/turn-restore.ts","kind":"import-statement","original":"./turn-restore.js"}],"format":"esm"}},"outputs":{"dist/session/index.js":{"imports":[{"path":"node:crypto","kind":"import-statement","external":true},{"path":"path","kind":"import-statement","external":true},{"path":"crypto","kind":"import-statement","external":true},{"path":"node:fs","kind":"import-statement","external":true},{"path":"node:fs/promises","kind":"import-statement","external":true},{"path":"node:path","kind":"import-statement","external":true},{"path":"path","kind":"import-statement","external":true},{"path":"crypto","kind":"import-statement","external":true},{"path":"fs/promises","kind":"import-statement","external":true},{"path":"path","kind":"import-statement","external":true},{"path":"os","kind":"import-statement","external":true},{"path":"fs","kind":"import-statement","external":true},{"path":"path","kind":"import-statement","external":true},{"path":"os","kind":"import-statement","external":true},{"path":"path","kind":"import-statement","external":true},{"path":"path","kind":"import-statement","external":true},{"path":"os","kind":"import-statement","external":true},{"path":"path","kind":"import-statement","external":true},{"path":"node:crypto","kind":"import-statement","external":true},{"path":"node:child_process","kind":"import-statement","external":true},{"path":"node:fs/promises","kind":"import-statement","external":true},{"path":"node:os","kind":"import-statement","external":true},{"path":"node:path","kind":"import-statement","external":true}],"exports":["CheckpointManager","DIRECT_SHELL_CONTEXT_WARNING","MAX_DIRECT_SHELL_OUTPUT_CHARS","SessionLock","SessionManager","SessionRegistry","TranscriptWriter","TurnRestoreManager","createDirectShellMessage","forgetRecentSession","forgetRecentSessionById","formatDirectShellContext","generateSessionId","getRecentSessionsIndexPath","isDirectShellMessage","isValidSessionId","loadRecentSessionsIndex","lookupRecentSession","normalizeDirectShellResultRecord","normalizeWorkingDirectory","parseSessionId","readSessionFormatVersion","recordRecentSession"],"entryPoint":"src/session/index.ts","inputs":{"src/session/id-generator.ts":{"bytesInOutput":338},"src/session/index.ts":{"bytesInOutput":0},"src/session/transcript.ts":{"bytesInOutput":6599},"src/utils/fs.ts":{"bytesInOutput":1185},"src/utils/json.ts":{"bytesInOutput":170},"src/utils/logger.ts":{"bytesInOutput":484},"src/session/direct-shell.ts":{"bytesInOutput":1071},"src/session/checkpoint.ts":{"bytesInOutput":2300},"src/tools/tool-names.ts":{"bytesInOutput":189},"src/session/lock.ts":{"bytesInOutput":3190},"src/runtime/shutdown.ts":{"bytesInOutput":400},"src/version.ts":{"bytesInOutput":16},"src/session/registry.ts":{"bytesInOutput":2781},"src/utils/path-security.ts":{"bytesInOutput":310},"src/session/recent-sessions.ts":{"bytesInOutput":1542},"src/session/manager.ts":{"bytesInOutput":4098},"src/session/turn-restore.ts":{"bytesInOutput":13081}},"bytes":38389}}}

package/dist/sharing/index.cjs

@@ -0,0 +1,4 @@
+"use strict";var E=Object.defineProperty;var te=Object.getOwnPropertyDescriptor;var ne=Object.getOwnPropertyNames;var oe=Object.prototype.hasOwnProperty;var ie=(e,r)=>{for(var t in r)E(e,t,{get:r[t],enumerable:!0})},se=(e,r,t,n)=>{if(r&&typeof r=="object"||typeof r=="function")for(let o of ne(r))!oe.call(e,o)&&o!==t&&E(e,o,{get:()=>r[o],enumerable:!(n=te(r,o))||n.enumerable});return e};var ae=e=>se(E({},"__esModule",{value:!0}),e);var Le={};ie(Le,{FileXenoShareRegistry:()=>V,XENO_HANDOFF_SCHEMA_VERSION:()=>A,XENO_SHARE_REGISTRY_SCHEMA_VERSION:()=>I,XENO_SHARE_SCHEMA_VERSION:()=>x,createXenoSecureShare:()=>Xe,createXenoSessionHandoff:()=>be,createXenoShareSigningIdentity:()=>we,publicKeyFingerprint:()=>O,redactXenoShareValue:()=>v,signSharePayload:()=>J,verifyXenoSecureShare:()=>Re,verifyXenoSessionHandoff:()=>ke});module.exports=ae(Le);var x=2,A=1,I=1;var ce=/(?:^|[_-])(api[_-]?key|access[_-]?token|refresh[_-]?token|id[_-]?token|auth(?:orization)?|bearer|secret|password|passwd|credential|cookie|private[_-]?key|client[_-]?secret)(?:$|[_-])/i,de=/\b([A-Z][A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|CLIENT_SECRET)[A-Z0-9_]*)\s*=\s*([^\s"']+)/g,ue=/\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi,le=/\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{16,}|AKIA[0-9A-Z]{16})\b/g,fe=/-----BEGIN (?:RSA |EC |OPENSSH |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |)PRIVATE KEY-----/g,ge=/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi,he=/([?&#](?:access_token|refresh_token|token|key|secret|password|api[_-]?key|signature)=)[^&#\s]+/gi;function v(e,r={}){let t={options:{...r,redactEmails:r.redactEmails??!0,maxDepth:r.maxDepth??48,maxStringLength:r.maxStringLength??2e5,maxEvents:r.maxEvents??256},seen:new Set,events:[],byCategory:{},total:0};return{value:P(e,"$","",0,t),report:{schemaVersion:1,total:t.total,byCategory:t.byCategory,events:t.events,eventsTruncated:t.total>t.events.length}}}function h(e,r,t){e.total+=1,e.byCategory[t]=(e.byCategory[t]??0)+1,e.events.length<e.options.maxEvents&&e.events.push({path:r,category:t})}function P(e,r,t,n,o){if(ce.test(t))return e!=null&&e!==""&&h(o,r,"secret-field"),e==null||e===""?null:"[redacted]";if(n>o.options.maxDepth)return h(o,r,"truncated"),"[redacted:depth-limit]";if(e===null||typeof e=="boolean")return e;if(typeof e=="number")return Number.isFinite(e)?e:String(e);if(typeof e=="bigint")return e.toString();if(typeof e=="string")return pe(e,r,o);if(e instanceof Date)return e.toISOString();if(e instanceof Uint8Array)return h(o,r,"binary"),`[redacted:binary:${e.byteLength}-bytes]`;if(Array.isArray(e)){if(o.seen.has(e))return h(o,r,"cycle"),"[redacted:cycle]";o.seen.add(e);let i=e.map((s,a)=>P(s,`${r}[${a}]`,"",n+1,o));return o.seen.delete(e),i}if(e&&typeof e=="object"){if(o.seen.has(e))return h(o,r,"cycle"),"[redacted:cycle]";o.seen.add(e);let i={};for(let[s,a]of Object.entries(e))i[s]=P(a,`${r}.${me(s)}`,s,n+1,o);return o.seen.delete(e),i}return null}function pe(e,r,t){let n=e;return n=g(n,fe,"[redacted:private-key]",r,"private-key",t),n=g(n,ue,"$1[redacted]",r,"authorization",t),n=g(n,le,"[redacted:credential]",r,"credential-pattern",t),n=g(n,de,"$1=[redacted]",r,"environment-secret",t),n=g(n,he,"$1[redacted]",r,"url-secret",t),t.options.redactEmails&&(n=g(n,ge,"[redacted:email]",r,"email",t)),n=D(n,t.options.workspaceRoot,"<workspace>",r,"workspace-path",t),n=D(n,t.options.homeDirectory,"<home>",r,"home-path",t),n.length>t.options.maxStringLength&&(h(t,r,"truncated"),n=`${n.slice(0,t.options.maxStringLength)}
+[truncated]`),n}function g(e,r,t,n,o,i){r.lastIndex=0;let s=0,a=e.replace(r,(...d)=>(s+=1,t.includes("$1")?t.replace("$1",String(d[1]??"")):t));for(let d=0;d<s;d+=1)h(i,n,o);return r.lastIndex=0,a}function D(e,r,t,n,o,i){let s=r?.trim().replace(/[\\/]+$/,"");if(!s)return e;let a=new RegExp(ye(s).replace(/[\\/]+/g,"[\\\\/]"),process.platform==="win32"?"gi":"g");return g(e,a,t,n,o,i)}function ye(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function me(e){return e.replace(/[^A-Za-z0-9_-]/g,"_")}var c=require("node:crypto");function m(e){return JSON.stringify(C(e,new Set))}function C(e,r){if(e===null||typeof e!="object"){if(typeof e=="number"&&!Number.isFinite(e))throw new TypeError("Artifact JSON cannot contain non-finite numbers");return e}if(r.has(e))throw new TypeError("Artifact JSON cannot contain cycles");if(r.add(e),Array.isArray(e)){let n=e.map(o=>C(o,r));return r.delete(e),n}let t={};for(let n of Object.keys(e).sort((o,i)=>o.localeCompare(i))){let o=e[n];if(o===void 0)throw new TypeError(`Artifact JSON property ${n} is undefined`);t[n]=C(o,r)}return r.delete(e),t}function S(e,r={}){for(let t of e){let n=t.codePointAt(0);if(n===127)return!0;if(!(n>31)&&!(n===9&&r.allowTab===!0)&&!((n===10||n===13)&&r.allowLineBreaks===!0))return!0}return!1}var Se=10080*60*1e3,Ie=365*24*60*60*1e3;function we(){let{publicKey:e,privateKey:r}=(0,c.generateKeyPairSync)("ed25519"),t=e.export({type:"spki",format:"pem"}).toString(),n=r.export({type:"pkcs8",format:"pem"}).toString();return{keyId:O(t),publicKeyPem:t,privateKeyPem:n}}function O(e){let r=(0,c.createPublicKey)(e).export({type:"spki",format:"der"});return`ed25519:${(0,c.createHash)("sha256").update(r).digest("hex").slice(0,32)}`}function Xe(e){let r=e.now??new Date,t=r.toISOString(),n=q(r,e.expiresAt,e.ttlMs),o=(0,c.randomBytes)(32).toString("base64url"),i=v(e.content,e.redaction),s=e.visibility??"private";_e(s,e.workspaceId,e.teamId,e.allowedPrincipalIds);let a={schemaVersion:2,kind:"xeno-secure-share",shareId:u(e.shareId??`share_${(0,c.randomUUID)()}`,"shareId"),createdAt:t,expiresAt:n,issuer:M(e.issuer),session:U({...e.session,name:e.session.name??e.name}),access:{mode:"read-only",visibility:s,...e.workspaceId?{workspaceId:u(e.workspaceId,"workspaceId")}:{},...e.teamId?{teamId:u(e.teamId,"teamId")}:{},...e.allowedPrincipalIds?.length?{allowedPrincipalIds:X(e.allowedPrincipalIds,"allowedPrincipalIds")}:{},capabilityToken:{algorithm:"sha256",hash:z(o)}},content:i.value,references:j(e.references??[]),redaction:i.report};return{envelope:J(a,e.signingIdentity),capabilityToken:o,url:Ae(e.baseUrl,a.shareId,o)}}function J(e,r){if(r.keyId!==O(r.publicKeyPem))throw new Error("Signing identity keyId does not match public key");let t=K(e,r);return{payload:e,signature:t}}function Re(e,r={}){let t=[],n=!1,o=!1;if(e?.payload?.kind!=="xeno-secure-share"||e.payload.schemaVersion!==2)t.push("Unsupported secure-share envelope");else{let N=B(r.trustedPublicKeys,e.signature.keyId),$=N??(r.allowEmbeddedPublicKey===!1?void 0:e.signature.publicKeySpki);if(o=!!N,!$)t.push("No trusted or embedded issuer public key is available");else try{n=L(e.payload,e.signature,$),n||t.push("Share signature is invalid")}catch(k){t.push(k instanceof Error?k.message:String(k))}}let i=(r.now??new Date).getTime(),s=Date.parse(e?.payload?.expiresAt??""),d=r.revokedShareIds?.has(e?.payload?.shareId??"")??!1?"revoked":Number.isFinite(s)&&s<=i?"expired":"active";d==="revoked"&&t.push("Share has been revoked"),d==="expired"&&t.push("Share has expired");let y=Ee(e?.payload,r.capabilityToken);y||t.push("Capability token is missing or invalid");let b=xe(e?.payload,r.principal);return b||t.push("Principal is outside the share audience"),{valid:n&&y&&b&&d==="active",integrityValid:n,issuerTrusted:o,capabilityValid:y,audienceAllowed:b,status:d,errors:t}}function be(e){let r=e.now??new Date,t={schemaVersion:1,kind:"xeno-session-handoff",handoffId:u(e.handoffId??`handoff_${(0,c.randomUUID)()}`,"handoffId"),createdAt:r.toISOString(),expiresAt:q(r,e.expiresAt,e.ttlMs??1440*60*1e3),issuer:M(e.issuer),source:U(e.source),target:Pe(e.target),resume:ve(e.resume),authority:Ce(e.authority),references:j(e.references??[]),...e.shareId?{shareId:u(e.shareId,"shareId")}:{}};return{payload:t,signature:K(t,e.signingIdentity)}}function ke(e,r={}){let t=[];if(e?.payload?.kind!=="xeno-session-handoff"||e.payload.schemaVersion!==1)return{valid:!1,integrityValid:!1,issuerTrusted:!1,expired:!1,errors:["Unsupported handoff envelope"]};let n=B(r.trustedPublicKeys,e.signature.keyId),o=n??(r.allowEmbeddedPublicKey===!1?void 0:e.signature.publicKeySpki),i=!!n,s=!1;if(!o)t.push("No trusted or embedded issuer public key is available");else try{s=L(e.payload,e.signature,o),s||t.push("Handoff signature is invalid")}catch(d){t.push(d instanceof Error?d.message:String(d))}let a=Date.parse(e.payload.expiresAt)<=(r.now??new Date).getTime();return a&&t.push("Handoff has expired"),{valid:s&&!a,integrityValid:s,issuerTrusted:i,expired:a,errors:t}}function K(e,r){let t=m(e),n=(0,c.sign)(null,Buffer.from(t),(0,c.createPrivateKey)(r.privateKeyPem)).toString("base64");return{algorithm:"ed25519",keyId:r.keyId,value:n,publicKeySpki:r.publicKeyPem}}function L(e,r,t){if(r.algorithm!=="ed25519")return!1;let n=Buffer.from(r.value,"base64");if(n.toString("base64")!==r.value)throw new Error("Signature is not canonical base64");return(0,c.verify)(null,Buffer.from(m(e)),(0,c.createPublicKey)(t),n)}function Ee(e,r){if(!e||!r)return!1;let t=Buffer.from(e.access.capabilityToken.hash,"hex"),n=Buffer.from(z(r),"hex");return t.length===n.length&&(0,c.timingSafeEqual)(t,n)}function xe(e,r){if(!e)return!1;let t=e.access;return t.allowedPrincipalIds?.length&&(!r?.id||!t.allowedPrincipalIds.includes(r.id))?!1:t.visibility==="workspace"?!!(r?.workspaceId&&r.workspaceId===t.workspaceId):t.visibility==="team"?!!(t.teamId&&r?.teamIds?.includes(t.teamId)):t.visibility==="private"?!!(r?.id&&r.id===e.issuer.id):t.visibility==="link"}function Ae(e,r,t){let n=new URL(e??"xeno://share/");if(n.username||n.password)throw new Error("Share base URL cannot contain credentials");if(n.protocol!=="https:"&&n.protocol!=="xeno:")throw new Error("Share base URL must use https: or xeno:");return n.pathname=`${n.pathname.replace(/\/$/,"")}/${encodeURIComponent(r)}`,n.search="",n.hash=new URLSearchParams({access_token:t}).toString(),n.toString()}function q(e,r,t=Se){let n=r?new Date(r):new Date(e.getTime()+t);if(!Number.isFinite(n.getTime()))throw new Error("expiresAt must be a valid timestamp");let o=n.getTime()-e.getTime();if(o<=0)throw new Error("expiresAt must be in the future");if(o>Ie)throw new Error("Share and handoff expiry cannot exceed 365 days");return n.toISOString()}function M(e){return{id:u(e.id,"issuer.id"),...e.displayName?.trim()?{displayName:e.displayName.trim().slice(0,160)}:{},...e.workspaceId?{workspaceId:u(e.workspaceId,"issuer.workspaceId")}:{},...e.teamId?{teamId:u(e.teamId,"issuer.teamId")}:{}}}function U(e){let r={name:w(e.name,"session.name",200),surface:e.surface};for(let t of["sessionId","runId","hostedRunId","conversationId","parentSessionId","forkedFromSessionId","forkedAtEventId"])e[t]&&(r[t]=u(e[t],`session.${t}`));if(!r.sessionId&&!r.runId&&!r.hostedRunId&&!r.conversationId)throw new Error("Session identity requires sessionId, runId, hostedRunId, or conversationId");return e.git&&(r.git={...e.git.repositoryId?{repositoryId:u(e.git.repositoryId,"git.repositoryId")}:{},...e.git.remoteUrl?{remoteUrl:_(e.git.remoteUrl,"git.remoteUrl")}:{},...e.git.branch?{branch:w(e.git.branch,"git.branch",300)}:{},...e.git.commit?{commit:F(e.git.commit,"git.commit")}:{},...e.git.pullRequest?{pullRequest:{provider:e.git.pullRequest.provider,repository:w(e.git.pullRequest.repository,"git.pullRequest.repository",300),number:Oe(e.git.pullRequest.number,"git.pullRequest.number"),...e.git.pullRequest.url?{url:_(e.git.pullRequest.url,"git.pullRequest.url")}:{}}}:{}}),r}function j(e){let r=new Set;return e.map(t=>{let n=`${t.kind}:${t.id}`;if(r.has(n))throw new Error(`Duplicate share reference: ${n}`);return r.add(n),{kind:t.kind,id:u(t.id,"reference.id"),...t.title?.trim()?{title:t.title.trim().slice(0,300)}:{},...t.uri?{uri:_(t.uri,"reference.uri")}:{},...t.hash?{hash:F(t.hash,"reference.hash")}:{}}})}function Pe(e){return{surface:e.surface,...e.workspaceId?{workspaceId:u(e.workspaceId,"target.workspaceId")}:{},...e.teamId?{teamId:u(e.teamId,"target.teamId")}:{},...e.environmentId?{environmentId:u(e.environmentId,"target.environmentId")}:{},...e.repositoryId?{repositoryId:u(e.repositoryId,"target.repositoryId")}:{}}}function ve(e){let r={};for(let t of["sessionId","runId","hostedRunId","checkpointId","transcriptEventId"])e[t]&&(r[t]=u(e[t],`resume.${t}`));if(e.artifactIds?.length&&(r.artifactIds=X(e.artifactIds,"resume.artifactIds")),e.taskIds?.length&&(r.taskIds=X(e.taskIds,"resume.taskIds")),!Object.keys(r).length)throw new Error("Handoff resume point cannot be empty");return r}function Ce(e){return{filesystem:e.filesystem,network:e.network,externalActions:e.externalActions,secretRefs:X(e.secretRefs,"authority.secretRefs")}}function _e(e,r,t,n){if(e==="workspace"&&!r)throw new Error("workspace visibility requires workspaceId");if(e==="team"&&!t)throw new Error("team visibility requires teamId");if(e==="private"&&n?.length)throw new Error("private shares cannot add allowed principals; use link/workspace/team visibility")}function B(e,r){if(!e)return;let t=e;return typeof t.get=="function"?t.get(r):e[r]}function z(e){return(0,c.createHash)("sha256").update(e).digest("hex")}function X(e,r){return[...new Set(e.map(t=>u(t,r)))].sort()}function u(e,r){let t=e.trim();if(!t||t.length>500||S(t))throw new Error(`${r} is invalid`);return t}function F(e,r){let t=e.trim();if(!/^[A-Za-z0-9:+._-]{7,256}$/.test(t))throw new Error(`${r} is invalid`);return t}function w(e,r,t){let n=e.trim();if(!n||n.length>t||S(n,{allowTab:!0,allowLineBreaks:!0}))throw new Error(`${r} is invalid`);return n}function Oe(e,r){if(!Number.isSafeInteger(e)||e<=0)throw new Error(`${r} must be a positive integer`);return e}function _(e,r){let t=w(e,r,2e3),n=new URL(t);if(n.username||n.password)throw new Error(`${r} cannot contain credentials`);if(!["https:","xeno:","artifact:","urn:"].includes(n.protocol))throw new Error(`${r} uses an unsupported scheme`);return n.toString()}var H=require("node:crypto"),l=require("node:fs/promises"),p=require("node:path");var f=require("node:fs"),T=require("node:os"),Y=require("node:path");function Te(){return new Date().toISOString()}function Ve(){return new Date(Date.now()-Math.floor(process.uptime()*1e3)).toISOString()}function G(e){try{return JSON.parse((0,f.readFileSync)(e,"utf8"))}catch{return null}}function He(e){if(!e||e<=0)return!1;try{return process.kill(e,0),!0}catch{return!1}}function Ne(e){return e.hostname!==(0,T.hostname)()?!0:He(e.pid)}function Z(e,r){(0,f.mkdirSync)((0,Y.dirname)(e),{recursive:!0}),(0,f.writeFileSync)(e,JSON.stringify(r,null,2)+`
+`,{encoding:"utf8",flag:"wx"})}function $e(e,r){let t=G(e);t?.pid!==r.pid||t.hostname!==r.hostname||(0,f.rmSync)(e,{force:!0})}function W(e,r,t){let n=Te(),o={schemaVersion:1,name:r,pid:process.pid,hostname:(0,T.hostname)(),processStartedAt:Ve(),version:t,acquiredAt:n,updatedAt:n};try{Z(e,o)}catch(i){if(i.code!=="EEXIST")throw i;let a=G(e);if(a&&Ne(a))throw new Error(`${r} is already locked by PID ${a.pid} on ${a.hostname}.`);(0,f.rmSync)(e,{force:!0}),Z(e,o)}return{record:o,release:()=>{$e(e,o)}}}var V=class{directory;snapshotPath;lockPath;now;constructor(r){this.directory=(0,p.resolve)(r.directory),this.snapshotPath=(0,p.join)(this.directory,"registry.json"),this.lockPath=(0,p.join)(this.directory,"registry.lock"),this.now=r.now??(()=>new Date)}async register(r,t="created"){return this.mutate(n=>{let o=n.records.find(s=>s.shareId===r.payload.shareId);if(o){if(R(o.envelope)!==R(r))throw new Error(`Share ${r.payload.shareId} already exists with different content`);return{snapshot:n,result:o}}let i={shareId:r.payload.shareId,envelope:r,status:Date.parse(r.payload.expiresAt)<=this.now().getTime()?"expired":"active",registeredAt:this.now().toISOString(),origin:t};return{snapshot:Q(n,[...n.records,i],this.now()),result:i}})}async revoke(r,t,n){return this.mutate(o=>{let i=o.records.findIndex(y=>y.shareId===r);if(i<0)throw new Error(`Share not found: ${r}`);let s=o.records[i];if(s.status==="revoked")return{snapshot:o,result:s};let a={...s,status:"revoked",revokedAt:this.now().toISOString(),revokedBy:ee(t,"actor"),revocationReason:ee(n,"reason")},d=[...o.records];return d[i]=a,{snapshot:Q(o,d,this.now()),result:a}})}async get(r){return(await this.load()).records.find(t=>t.shareId===r)??null}async list(){let r=this.now().getTime();return(await this.load()).records.map(t=>t.status==="active"&&Date.parse(t.envelope.payload.expiresAt)<=r?{...t,status:"expired"}:t).sort((t,n)=>n.registeredAt.localeCompare(t.registeredAt))}async revokedIds(){return new Set((await this.list()).filter(r=>r.status==="revoked").map(r=>r.shareId))}async load(){try{let r=await(0,l.readFile)(this.snapshotPath,"utf8"),t=JSON.parse(r);return Je(t),t}catch(r){if(r.code==="ENOENT")return De(this.now());throw r}}async mutate(r){await(0,l.mkdir)(this.directory,{recursive:!0,mode:448});let t=W(this.lockPath,"xeno secure-share registry","1");try{let n=await this.load(),{snapshot:o,result:i}=r(n);return o!==n&&await Ke(this.snapshotPath,`${JSON.stringify(o,null,2)}
+`),i}finally{t.release()}}};function De(e){return re({schemaVersion:1,generation:0,updatedAt:e.toISOString(),records:[]})}function Q(e,r,t){return re({schemaVersion:1,generation:e.generation+1,updatedAt:t.toISOString(),records:[...r].sort((n,o)=>n.shareId.localeCompare(o.shareId))})}function re(e){return{...e,checksum:{algorithm:"sha256",value:(0,H.createHash)("sha256").update(R(e)).digest("hex")}}}function Je(e){if(e.schemaVersion!==1||!Array.isArray(e.records))throw new Error("Invalid secure-share registry snapshot");let{checksum:r,...t}=e,n=(0,H.createHash)("sha256").update(R(t)).digest("hex");if(r?.algorithm!=="sha256"||r.value!==n)throw new Error("Secure-share registry checksum mismatch");let o=new Set;for(let i of e.records){if(i.shareId!==i.envelope?.payload?.shareId)throw new Error("Secure-share registry identity mismatch");if(o.has(i.shareId))throw new Error(`Duplicate secure-share registry record: ${i.shareId}`);o.add(i.shareId)}}async function Ke(e,r){await(0,l.mkdir)((0,p.dirname)(e),{recursive:!0,mode:448});let t=`${e}.${process.pid}.${Date.now()}.tmp`,n;try{n=await(0,l.open)(t,"wx",384),await n.writeFile(r,"utf8"),await n.sync(),await n.close(),n=void 0,await(0,l.rename)(t,e),await(0,l.chmod)(e,384).catch(()=>{})}finally{n&&await n.close().catch(()=>{}),await(0,l.unlink)(t).catch(()=>{})}}function R(e){return m(e)}function ee(e,r){let t=e.trim();if(!t||t.length>500||S(t))throw new Error(`${r} is invalid`);return t}0&&(module.exports={FileXenoShareRegistry,XENO_HANDOFF_SCHEMA_VERSION,XENO_SHARE_REGISTRY_SCHEMA_VERSION,XENO_SHARE_SCHEMA_VERSION,createXenoSecureShare,createXenoSessionHandoff,createXenoShareSigningIdentity,publicKeyFingerprint,redactXenoShareValue,signSharePayload,verifyXenoSecureShare,verifyXenoSessionHandoff});

package/dist/sharing/index.d.cts

@@ -0,0 +1,272 @@
+type XenoJsonPrimitive = string | number | boolean | null;
+type XenoJsonValue = XenoJsonPrimitive | XenoJsonObject | XenoJsonValue[];
+interface XenoJsonObject {
+    [key: string]: XenoJsonValue;
+}
+declare const XENO_SHARE_SCHEMA_VERSION: 2;
+declare const XENO_HANDOFF_SCHEMA_VERSION: 1;
+declare const XENO_SHARE_REGISTRY_SCHEMA_VERSION: 1;
+type XenoShareVisibility = "private" | "workspace" | "team" | "link";
+type XenoShareSurface = "cli" | "hub" | "hosted" | "api" | `custom:${string}`;
+type XenoShareStatus = "active" | "revoked" | "expired";
+interface XenoShareIssuer {
+    id: string;
+    displayName?: string;
+    workspaceId?: string;
+    teamId?: string;
+}
+interface XenoShareGitContext {
+    repositoryId?: string;
+    remoteUrl?: string;
+    branch?: string;
+    commit?: string;
+    pullRequest?: {
+        provider: "github" | "gitlab" | "bitbucket" | `custom:${string}`;
+        repository: string;
+        number: number;
+        url?: string;
+    };
+}
+interface XenoShareSessionIdentity {
+    name: string;
+    sessionId?: string;
+    runId?: string;
+    hostedRunId?: string;
+    conversationId?: string;
+    parentSessionId?: string;
+    forkedFromSessionId?: string;
+    forkedAtEventId?: string;
+    surface: XenoShareSurface;
+    git?: XenoShareGitContext;
+}
+interface XenoShareReference {
+    kind: "artifact" | "finding" | "agent-session" | "task" | "commit" | "pull-request" | `custom:${string}`;
+    id: string;
+    title?: string;
+    uri?: string;
+    hash?: string;
+}
+type XenoRedactionCategory = "secret-field" | "credential-pattern" | "authorization" | "url-secret" | "environment-secret" | "private-key" | "email" | "home-path" | "workspace-path" | "binary" | "cycle" | "truncated";
+interface XenoRedactionEvent {
+    path: string;
+    category: XenoRedactionCategory;
+}
+interface XenoRedactionReport {
+    schemaVersion: 1;
+    total: number;
+    byCategory: Partial<Record<XenoRedactionCategory, number>>;
+    events: XenoRedactionEvent[];
+    eventsTruncated: boolean;
+}
+interface XenoShareContent {
+    summary?: string;
+    transcript?: XenoJsonValue[];
+    activity?: XenoJsonValue[];
+    metadata?: XenoJsonValue;
+    evidence?: XenoJsonValue[];
+}
+interface XenoShareAccessPolicy {
+    mode: "read-only";
+    visibility: XenoShareVisibility;
+    workspaceId?: string;
+    teamId?: string;
+    allowedPrincipalIds?: string[];
+    capabilityToken: {
+        algorithm: "sha256";
+        hash: string;
+    };
+}
+interface XenoSharePayload {
+    schemaVersion: typeof XENO_SHARE_SCHEMA_VERSION;
+    kind: "xeno-secure-share";
+    shareId: string;
+    createdAt: string;
+    expiresAt: string;
+    issuer: XenoShareIssuer;
+    session: XenoShareSessionIdentity;
+    access: XenoShareAccessPolicy;
+    content: XenoShareContent;
+    references: XenoShareReference[];
+    redaction: XenoRedactionReport;
+}
+interface XenoEd25519Signature {
+    algorithm: "ed25519";
+    keyId: string;
+    value: string;
+    publicKeySpki?: string;
+}
+interface XenoSignedShareEnvelope {
+    payload: XenoSharePayload;
+    signature: XenoEd25519Signature;
+}
+interface XenoShareSigningIdentity {
+    keyId: string;
+    publicKeyPem: string;
+    privateKeyPem: string;
+}
+interface XenoCreatedShare {
+    envelope: XenoSignedShareEnvelope;
+    capabilityToken: string;
+    url: string;
+}
+interface XenoSharePrincipal {
+    id?: string;
+    workspaceId?: string;
+    teamIds?: string[];
+}
+interface XenoShareVerificationResult {
+    valid: boolean;
+    integrityValid: boolean;
+    issuerTrusted: boolean;
+    capabilityValid: boolean;
+    audienceAllowed: boolean;
+    status: XenoShareStatus;
+    errors: string[];
+}
+interface XenoHandoffTarget {
+    surface: XenoShareSurface;
+    workspaceId?: string;
+    teamId?: string;
+    environmentId?: string;
+    repositoryId?: string;
+}
+interface XenoHandoffResumePoint {
+    sessionId?: string;
+    runId?: string;
+    hostedRunId?: string;
+    checkpointId?: string;
+    transcriptEventId?: string;
+    artifactIds?: string[];
+    taskIds?: string[];
+}
+interface XenoHandoffAuthority {
+    filesystem: "none" | "read" | "workspace-write";
+    network: "deny" | "allowlist" | "prompt";
+    externalActions: "deny" | "prompt";
+    secretRefs: string[];
+}
+interface XenoHandoffPayload {
+    schemaVersion: typeof XENO_HANDOFF_SCHEMA_VERSION;
+    kind: "xeno-session-handoff";
+    handoffId: string;
+    createdAt: string;
+    expiresAt: string;
+    issuer: XenoShareIssuer;
+    source: XenoShareSessionIdentity;
+    target: XenoHandoffTarget;
+    resume: XenoHandoffResumePoint;
+    authority: XenoHandoffAuthority;
+    references: XenoShareReference[];
+    shareId?: string;
+}
+interface XenoSignedHandoffEnvelope {
+    payload: XenoHandoffPayload;
+    signature: XenoEd25519Signature;
+}
+interface XenoShareRegistryRecord {
+    shareId: string;
+    envelope: XenoSignedShareEnvelope;
+    status: XenoShareStatus;
+    registeredAt: string;
+    origin: "created" | "imported";
+    revokedAt?: string;
+    revokedBy?: string;
+    revocationReason?: string;
+}
+interface XenoShareRegistrySnapshot {
+    schemaVersion: typeof XENO_SHARE_REGISTRY_SCHEMA_VERSION;
+    generation: number;
+    updatedAt: string;
+    records: XenoShareRegistryRecord[];
+    checksum: {
+        algorithm: "sha256";
+        value: string;
+    };
+}
+interface XenoRedactionOptions {
+    workspaceRoot?: string;
+    homeDirectory?: string;
+    redactEmails?: boolean;
+    maxDepth?: number;
+    maxStringLength?: number;
+    maxEvents?: number;
+}
+interface XenoRedactionResult<T extends XenoJsonValue = XenoJsonValue> {
+    value: T;
+    report: XenoRedactionReport;
+}
+declare function redactXenoShareValue<T extends XenoJsonValue = XenoJsonValue>(input: unknown, options?: XenoRedactionOptions): XenoRedactionResult<T>;
+interface CreateXenoShareOptions {
+    name: string;
+    issuer: XenoShareIssuer;
+    session: Omit<XenoShareSessionIdentity, "name"> & {
+        name?: string;
+    };
+    visibility?: XenoShareVisibility;
+    workspaceId?: string;
+    teamId?: string;
+    allowedPrincipalIds?: string[];
+    content: XenoShareContent;
+    references?: XenoShareReference[];
+    expiresAt?: string;
+    ttlMs?: number;
+    baseUrl?: string;
+    signingIdentity: XenoShareSigningIdentity;
+    redaction?: XenoRedactionOptions;
+    now?: Date;
+    shareId?: string;
+}
+interface VerifyXenoShareOptions {
+    capabilityToken?: string;
+    principal?: XenoSharePrincipal;
+    trustedPublicKeys?: ReadonlyMap<string, string> | Record<string, string>;
+    allowEmbeddedPublicKey?: boolean;
+    revokedShareIds?: ReadonlySet<string>;
+    now?: Date;
+}
+interface CreateXenoHandoffOptions {
+    issuer: XenoShareIssuer;
+    source: XenoShareSessionIdentity;
+    target: XenoHandoffTarget;
+    resume: XenoHandoffResumePoint;
+    authority: XenoHandoffAuthority;
+    references?: XenoShareReference[];
+    shareId?: string;
+    expiresAt?: string;
+    ttlMs?: number;
+    signingIdentity: XenoShareSigningIdentity;
+    now?: Date;
+    handoffId?: string;
+}
+declare function createXenoShareSigningIdentity(): XenoShareSigningIdentity;
+declare function publicKeyFingerprint(publicKeyPem: string): string;
+declare function createXenoSecureShare(options: CreateXenoShareOptions): XenoCreatedShare;
+declare function signSharePayload(payload: XenoSignedShareEnvelope["payload"], identity: XenoShareSigningIdentity): XenoSignedShareEnvelope;
+declare function verifyXenoSecureShare(envelope: XenoSignedShareEnvelope, options?: VerifyXenoShareOptions): XenoShareVerificationResult;
+declare function createXenoSessionHandoff(options: CreateXenoHandoffOptions): XenoSignedHandoffEnvelope;
+declare function verifyXenoSessionHandoff(envelope: XenoSignedHandoffEnvelope, options?: Pick<VerifyXenoShareOptions, "trustedPublicKeys" | "allowEmbeddedPublicKey" | "now">): {
+    valid: boolean;
+    integrityValid: boolean;
+    issuerTrusted: boolean;
+    expired: boolean;
+    errors: string[];
+};
+interface FileXenoShareRegistryOptions {
+    directory: string;
+    now?: () => Date;
+}
+declare class FileXenoShareRegistry {
+    readonly directory: string;
+    readonly snapshotPath: string;
+    readonly lockPath: string;
+    private readonly now;
+    constructor(options: FileXenoShareRegistryOptions);
+    register(envelope: XenoSignedShareEnvelope, origin?: "created" | "imported"): Promise<XenoShareRegistryRecord>;
+    revoke(shareId: string, actor: string, reason: string): Promise<XenoShareRegistryRecord>;
+    get(shareId: string): Promise<XenoShareRegistryRecord | null>;
+    list(): Promise<XenoShareRegistryRecord[]>;
+    revokedIds(): Promise<Set<string>>;
+    load(): Promise<XenoShareRegistrySnapshot>;
+    private mutate;
+}
+export { type CreateXenoHandoffOptions, type CreateXenoShareOptions, FileXenoShareRegistry, type FileXenoShareRegistryOptions, type VerifyXenoShareOptions, XENO_HANDOFF_SCHEMA_VERSION, XENO_SHARE_REGISTRY_SCHEMA_VERSION, XENO_SHARE_SCHEMA_VERSION, type XenoCreatedShare, type XenoEd25519Signature, type XenoHandoffAuthority, type XenoHandoffPayload, type XenoHandoffResumePoint, type XenoHandoffTarget, type XenoRedactionCategory, type XenoRedactionEvent, type XenoRedactionOptions, type XenoRedactionReport, type XenoRedactionResult, type XenoShareAccessPolicy, type XenoShareContent, type XenoShareGitContext, type XenoShareIssuer, type XenoSharePayload, type XenoSharePrincipal, type XenoShareReference, type XenoShareRegistryRecord, type XenoShareRegistrySnapshot, type XenoShareSessionIdentity, type XenoShareSigningIdentity, type XenoShareStatus, type XenoShareSurface, type XenoShareVerificationResult, type XenoShareVisibility, type XenoSignedHandoffEnvelope, type XenoSignedShareEnvelope, createXenoSecureShare, createXenoSessionHandoff, createXenoShareSigningIdentity, publicKeyFingerprint, redactXenoShareValue, signSharePayload, verifyXenoSecureShare, verifyXenoSessionHandoff };

package/dist/sharing/index.d.ts

@@ -0,0 +1,272 @@
+type XenoJsonPrimitive = string | number | boolean | null;
+type XenoJsonValue = XenoJsonPrimitive | XenoJsonObject | XenoJsonValue[];
+interface XenoJsonObject {
+    [key: string]: XenoJsonValue;
+}
+declare const XENO_SHARE_SCHEMA_VERSION: 2;
+declare const XENO_HANDOFF_SCHEMA_VERSION: 1;
+declare const XENO_SHARE_REGISTRY_SCHEMA_VERSION: 1;
+type XenoShareVisibility = "private" | "workspace" | "team" | "link";
+type XenoShareSurface = "cli" | "hub" | "hosted" | "api" | `custom:${string}`;
+type XenoShareStatus = "active" | "revoked" | "expired";
+interface XenoShareIssuer {
+    id: string;
+    displayName?: string;
+    workspaceId?: string;
+    teamId?: string;
+}
+interface XenoShareGitContext {
+    repositoryId?: string;
+    remoteUrl?: string;
+    branch?: string;
+    commit?: string;
+    pullRequest?: {
+        provider: "github" | "gitlab" | "bitbucket" | `custom:${string}`;
+        repository: string;
+        number: number;
+        url?: string;
+    };
+}
+interface XenoShareSessionIdentity {
+    name: string;
+    sessionId?: string;
+    runId?: string;
+    hostedRunId?: string;
+    conversationId?: string;
+    parentSessionId?: string;
+    forkedFromSessionId?: string;
+    forkedAtEventId?: string;
+    surface: XenoShareSurface;
+    git?: XenoShareGitContext;
+}
+interface XenoShareReference {
+    kind: "artifact" | "finding" | "agent-session" | "task" | "commit" | "pull-request" | `custom:${string}`;
+    id: string;
+    title?: string;
+    uri?: string;
+    hash?: string;
+}
+type XenoRedactionCategory = "secret-field" | "credential-pattern" | "authorization" | "url-secret" | "environment-secret" | "private-key" | "email" | "home-path" | "workspace-path" | "binary" | "cycle" | "truncated";
+interface XenoRedactionEvent {
+    path: string;
+    category: XenoRedactionCategory;
+}
+interface XenoRedactionReport {
+    schemaVersion: 1;
+    total: number;
+    byCategory: Partial<Record<XenoRedactionCategory, number>>;
+    events: XenoRedactionEvent[];
+    eventsTruncated: boolean;
+}
+interface XenoShareContent {
+    summary?: string;
+    transcript?: XenoJsonValue[];
+    activity?: XenoJsonValue[];
+    metadata?: XenoJsonValue;
+    evidence?: XenoJsonValue[];
+}
+interface XenoShareAccessPolicy {
+    mode: "read-only";
+    visibility: XenoShareVisibility;
+    workspaceId?: string;
+    teamId?: string;
+    allowedPrincipalIds?: string[];
+    capabilityToken: {
+        algorithm: "sha256";
+        hash: string;
+    };
+}
+interface XenoSharePayload {
+    schemaVersion: typeof XENO_SHARE_SCHEMA_VERSION;
+    kind: "xeno-secure-share";
+    shareId: string;
+    createdAt: string;
+    expiresAt: string;
+    issuer: XenoShareIssuer;
+    session: XenoShareSessionIdentity;
+    access: XenoShareAccessPolicy;
+    content: XenoShareContent;
+    references: XenoShareReference[];
+    redaction: XenoRedactionReport;
+}
+interface XenoEd25519Signature {
+    algorithm: "ed25519";
+    keyId: string;
+    value: string;
+    publicKeySpki?: string;
+}
+interface XenoSignedShareEnvelope {
+    payload: XenoSharePayload;
+    signature: XenoEd25519Signature;
+}
+interface XenoShareSigningIdentity {
+    keyId: string;
+    publicKeyPem: string;
+    privateKeyPem: string;
+}
+interface XenoCreatedShare {
+    envelope: XenoSignedShareEnvelope;
+    capabilityToken: string;
+    url: string;
+}
+interface XenoSharePrincipal {
+    id?: string;
+    workspaceId?: string;
+    teamIds?: string[];
+}
+interface XenoShareVerificationResult {
+    valid: boolean;
+    integrityValid: boolean;
+    issuerTrusted: boolean;
+    capabilityValid: boolean;
+    audienceAllowed: boolean;
+    status: XenoShareStatus;
+    errors: string[];
+}
+interface XenoHandoffTarget {
+    surface: XenoShareSurface;
+    workspaceId?: string;
+    teamId?: string;
+    environmentId?: string;
+    repositoryId?: string;
+}
+interface XenoHandoffResumePoint {
+    sessionId?: string;
+    runId?: string;
+    hostedRunId?: string;
+    checkpointId?: string;
+    transcriptEventId?: string;
+    artifactIds?: string[];
+    taskIds?: string[];
+}
+interface XenoHandoffAuthority {
+    filesystem: "none" | "read" | "workspace-write";
+    network: "deny" | "allowlist" | "prompt";
+    externalActions: "deny" | "prompt";
+    secretRefs: string[];
+}
+interface XenoHandoffPayload {
+    schemaVersion: typeof XENO_HANDOFF_SCHEMA_VERSION;
+    kind: "xeno-session-handoff";
+    handoffId: string;
+    createdAt: string;
+    expiresAt: string;
+    issuer: XenoShareIssuer;
+    source: XenoShareSessionIdentity;
+    target: XenoHandoffTarget;
+    resume: XenoHandoffResumePoint;
+    authority: XenoHandoffAuthority;
+    references: XenoShareReference[];
+    shareId?: string;
+}
+interface XenoSignedHandoffEnvelope {
+    payload: XenoHandoffPayload;
+    signature: XenoEd25519Signature;
+}
+interface XenoShareRegistryRecord {
+    shareId: string;
+    envelope: XenoSignedShareEnvelope;
+    status: XenoShareStatus;
+    registeredAt: string;
+    origin: "created" | "imported";
+    revokedAt?: string;
+    revokedBy?: string;
+    revocationReason?: string;
+}
+interface XenoShareRegistrySnapshot {
+    schemaVersion: typeof XENO_SHARE_REGISTRY_SCHEMA_VERSION;
+    generation: number;
+    updatedAt: string;
+    records: XenoShareRegistryRecord[];
+    checksum: {
+        algorithm: "sha256";
+        value: string;
+    };
+}
+interface XenoRedactionOptions {
+    workspaceRoot?: string;
+    homeDirectory?: string;
+    redactEmails?: boolean;
+    maxDepth?: number;
+    maxStringLength?: number;
+    maxEvents?: number;
+}
+interface XenoRedactionResult<T extends XenoJsonValue = XenoJsonValue> {
+    value: T;
+    report: XenoRedactionReport;
+}
+declare function redactXenoShareValue<T extends XenoJsonValue = XenoJsonValue>(input: unknown, options?: XenoRedactionOptions): XenoRedactionResult<T>;
+interface CreateXenoShareOptions {
+    name: string;
+    issuer: XenoShareIssuer;
+    session: Omit<XenoShareSessionIdentity, "name"> & {
+        name?: string;
+    };
+    visibility?: XenoShareVisibility;
+    workspaceId?: string;
+    teamId?: string;
+    allowedPrincipalIds?: string[];
+    content: XenoShareContent;
+    references?: XenoShareReference[];
+    expiresAt?: string;
+    ttlMs?: number;
+    baseUrl?: string;
+    signingIdentity: XenoShareSigningIdentity;
+    redaction?: XenoRedactionOptions;
+    now?: Date;
+    shareId?: string;
+}
+interface VerifyXenoShareOptions {
+    capabilityToken?: string;
+    principal?: XenoSharePrincipal;
+    trustedPublicKeys?: ReadonlyMap<string, string> | Record<string, string>;
+    allowEmbeddedPublicKey?: boolean;
+    revokedShareIds?: ReadonlySet<string>;
+    now?: Date;
+}
+interface CreateXenoHandoffOptions {
+    issuer: XenoShareIssuer;
+    source: XenoShareSessionIdentity;
+    target: XenoHandoffTarget;
+    resume: XenoHandoffResumePoint;
+    authority: XenoHandoffAuthority;
+    references?: XenoShareReference[];
+    shareId?: string;
+    expiresAt?: string;
+    ttlMs?: number;
+    signingIdentity: XenoShareSigningIdentity;
+    now?: Date;
+    handoffId?: string;
+}
+declare function createXenoShareSigningIdentity(): XenoShareSigningIdentity;
+declare function publicKeyFingerprint(publicKeyPem: string): string;
+declare function createXenoSecureShare(options: CreateXenoShareOptions): XenoCreatedShare;
+declare function signSharePayload(payload: XenoSignedShareEnvelope["payload"], identity: XenoShareSigningIdentity): XenoSignedShareEnvelope;
+declare function verifyXenoSecureShare(envelope: XenoSignedShareEnvelope, options?: VerifyXenoShareOptions): XenoShareVerificationResult;
+declare function createXenoSessionHandoff(options: CreateXenoHandoffOptions): XenoSignedHandoffEnvelope;
+declare function verifyXenoSessionHandoff(envelope: XenoSignedHandoffEnvelope, options?: Pick<VerifyXenoShareOptions, "trustedPublicKeys" | "allowEmbeddedPublicKey" | "now">): {
+    valid: boolean;
+    integrityValid: boolean;
+    issuerTrusted: boolean;
+    expired: boolean;
+    errors: string[];
+};
+interface FileXenoShareRegistryOptions {
+    directory: string;
+    now?: () => Date;
+}
+declare class FileXenoShareRegistry {
+    readonly directory: string;
+    readonly snapshotPath: string;
+    readonly lockPath: string;
+    private readonly now;
+    constructor(options: FileXenoShareRegistryOptions);
+    register(envelope: XenoSignedShareEnvelope, origin?: "created" | "imported"): Promise<XenoShareRegistryRecord>;
+    revoke(shareId: string, actor: string, reason: string): Promise<XenoShareRegistryRecord>;
+    get(shareId: string): Promise<XenoShareRegistryRecord | null>;
+    list(): Promise<XenoShareRegistryRecord[]>;
+    revokedIds(): Promise<Set<string>>;
+    load(): Promise<XenoShareRegistrySnapshot>;
+    private mutate;
+}
+export { type CreateXenoHandoffOptions, type CreateXenoShareOptions, FileXenoShareRegistry, type FileXenoShareRegistryOptions, type VerifyXenoShareOptions, XENO_HANDOFF_SCHEMA_VERSION, XENO_SHARE_REGISTRY_SCHEMA_VERSION, XENO_SHARE_SCHEMA_VERSION, type XenoCreatedShare, type XenoEd25519Signature, type XenoHandoffAuthority, type XenoHandoffPayload, type XenoHandoffResumePoint, type XenoHandoffTarget, type XenoRedactionCategory, type XenoRedactionEvent, type XenoRedactionOptions, type XenoRedactionReport, type XenoRedactionResult, type XenoShareAccessPolicy, type XenoShareContent, type XenoShareGitContext, type XenoShareIssuer, type XenoSharePayload, type XenoSharePrincipal, type XenoShareReference, type XenoShareRegistryRecord, type XenoShareRegistrySnapshot, type XenoShareSessionIdentity, type XenoShareSigningIdentity, type XenoShareStatus, type XenoShareSurface, type XenoShareVerificationResult, type XenoShareVisibility, type XenoSignedHandoffEnvelope, type XenoSignedShareEnvelope, createXenoSecureShare, createXenoSessionHandoff, createXenoShareSigningIdentity, publicKeyFingerprint, redactXenoShareValue, signSharePayload, verifyXenoSecureShare, verifyXenoSessionHandoff };