@xfey/tenso 0.1.130

package/node_modules/@tutti/shared/dist/schemas/internal/project-authority.d.ts

@@ -0,0 +1,130 @@
+import { type Static } from "@sinclair/typebox";
+export declare const ManagedCreationRefSchema: import("@sinclair/typebox").TString;
+export declare const HostInstallationRefSchema: import("@sinclair/typebox").TString;
+export declare const HostDelegationRefSchema: import("@sinclair/typebox").TString;
+export declare const ProjectModelGrantRefSchema: import("@sinclair/typebox").TString;
+export declare const AuthoritySecretSchema: import("@sinclair/typebox").TString;
+export declare const AuthoritySecretHashSchema: import("@sinclair/typebox").TString;
+export declare const AuthorityTimestampSchema: import("@sinclair/typebox").TString;
+export declare function isAuthorityTimestamp(value: string): boolean;
+export declare const PROJECT_TRIAL_POLICY = "trial-project-v1";
+export declare const PrepareProjectAuthoritySchema: import("@sinclair/typebox").TObject<{
+    request_ref: import("@sinclair/typebox").TString;
+    project_id: import("@sinclair/typebox").TString;
+    surface: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"standalone">, import("@sinclair/typebox").TLiteral<"feishu">]>;
+    existing_relay_project_ref: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    installation_ref: import("@sinclair/typebox").TString;
+    installation_secret_hash: import("@sinclair/typebox").TString;
+    handoff_token_hash: import("@sinclair/typebox").TString;
+    host_registration_secret_hash: import("@sinclair/typebox").TString;
+    trial_consent: import("@sinclair/typebox").TLiteral<"trial-project-v1">;
+    expires_before: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>;
+export type PrepareProjectAuthority = Static<typeof PrepareProjectAuthoritySchema>;
+export declare const ConsoleProjectAuthoritySchema: import("@sinclair/typebox").TObject<{
+    console_token: import("@sinclair/typebox").TString;
+    preparation: import("@sinclair/typebox").TObject<{
+        request_ref: import("@sinclair/typebox").TString;
+        project_id: import("@sinclair/typebox").TString;
+        surface: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"standalone">, import("@sinclair/typebox").TLiteral<"feishu">]>;
+        existing_relay_project_ref: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        installation_ref: import("@sinclair/typebox").TString;
+        installation_secret_hash: import("@sinclair/typebox").TString;
+        handoff_token_hash: import("@sinclair/typebox").TString;
+        host_registration_secret_hash: import("@sinclair/typebox").TString;
+        trial_consent: import("@sinclair/typebox").TLiteral<"trial-project-v1">;
+        expires_before: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    }>;
+}>;
+export type ConsoleProjectAuthority = Static<typeof ConsoleProjectAuthoritySchema>;
+export declare const ManagedProjectBootstrapSchema: import("@sinclair/typebox").TObject<{
+    kind: import("@sinclair/typebox").TLiteral<"managed_project_authority_v2">;
+    creation_ref: import("@sinclair/typebox").TString;
+    handoff_token: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+    installation_secret: import("@sinclair/typebox").TString;
+}>;
+export type ManagedProjectBootstrap = Static<typeof ManagedProjectBootstrapSchema>;
+export declare const HostDelegationStatusBodySchema: import("@sinclair/typebox").TObject<{
+    delegation_ref: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+    installation_secret: import("@sinclair/typebox").TString;
+    relay_project_ref: import("@sinclair/typebox").TString;
+    project_id: import("@sinclair/typebox").TString;
+    host_registration_secret: import("@sinclair/typebox").TString;
+}>;
+export type HostDelegationStatusBody = Static<typeof HostDelegationStatusBodySchema>;
+export declare const HostDelegationProjectionSchema: import("@sinclair/typebox").TObject<{
+    delegation_ref: import("@sinclair/typebox").TString;
+    grant_ref: import("@sinclair/typebox").TString;
+    relay_project_ref: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+    funding_kind: import("@sinclair/typebox").TLiteral<"trial">;
+    expires_at: import("@sinclair/typebox").TNull;
+    state: import("@sinclair/typebox").TLiteral<"active">;
+    model_access: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"runtime_authority_required">, import("@sinclair/typebox").TLiteral<"not_enabled">]>;
+}>;
+export type HostDelegationProjection = Static<typeof HostDelegationProjectionSchema>;
+export declare const ManagedCreationProjectionSchema: import("@sinclair/typebox").TObject<{
+    creation_ref: import("@sinclair/typebox").TString;
+    project_id: import("@sinclair/typebox").TString;
+    surface: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"standalone">, import("@sinclair/typebox").TLiteral<"feishu">]>;
+    installation_ref: import("@sinclair/typebox").TString;
+    expires_at: import("@sinclair/typebox").TString;
+    state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"prepared">, import("@sinclair/typebox").TLiteral<"activated">, import("@sinclair/typebox").TLiteral<"expired">, import("@sinclair/typebox").TLiteral<"revoked">]>;
+    relay_project_ref: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>;
+export type ManagedCreationProjection = Static<typeof ManagedCreationProjectionSchema>;
+export declare const NativeCreationProofSchema: import("@sinclair/typebox").TObject<{
+    request_ref: import("@sinclair/typebox").TString;
+    project_id: import("@sinclair/typebox").TString;
+    installation_ref: import("@sinclair/typebox").TString;
+    installation_secret: import("@sinclair/typebox").TString;
+    handoff_token: import("@sinclair/typebox").TString;
+    host_registration_secret: import("@sinclair/typebox").TString;
+}>;
+export type NativeCreationProof = Static<typeof NativeCreationProofSchema>;
+export declare const NativeCreationStatusSchema: import("@sinclair/typebox").TObject<{
+    request_ref: import("@sinclair/typebox").TString;
+    account_ref: import("@sinclair/typebox").TString;
+    creation: import("@sinclair/typebox").TObject<{
+        creation_ref: import("@sinclair/typebox").TString;
+        project_id: import("@sinclair/typebox").TString;
+        surface: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"standalone">, import("@sinclair/typebox").TLiteral<"feishu">]>;
+        installation_ref: import("@sinclair/typebox").TString;
+        expires_at: import("@sinclair/typebox").TString;
+        state: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"prepared">, import("@sinclair/typebox").TLiteral<"activated">, import("@sinclair/typebox").TLiteral<"expired">, import("@sinclair/typebox").TLiteral<"revoked">]>;
+        relay_project_ref: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    }>;
+    authority: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        delegation_ref: import("@sinclair/typebox").TString;
+        grant_ref: import("@sinclair/typebox").TString;
+        relay_project_ref: import("@sinclair/typebox").TString;
+        installation_ref: import("@sinclair/typebox").TString;
+        funding_kind: import("@sinclair/typebox").TLiteral<"trial">;
+        expires_at: import("@sinclair/typebox").TNull;
+        state: import("@sinclair/typebox").TLiteral<"active">;
+        model_access: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"runtime_authority_required">, import("@sinclair/typebox").TLiteral<"not_enabled">]>;
+    }>>;
+}>;
+export type NativeCreationStatus = Static<typeof NativeCreationStatusSchema>;
+export declare const isManagedProjectBootstrap: (value: unknown) => value is ManagedProjectBootstrap;
+export declare const isHostDelegationProjection: (value: unknown) => value is HostDelegationProjection;
+export declare const RevokeProjectAuthoritySchema: import("@sinclair/typebox").TObject<{
+    command_id: import("@sinclair/typebox").TString;
+    target: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TLiteral<"grant">;
+        ref: import("@sinclair/typebox").TString;
+    }>, import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TLiteral<"delegation">;
+        ref: import("@sinclair/typebox").TString;
+    }>, import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TLiteral<"installation">;
+        ref: import("@sinclair/typebox").TString;
+    }>, import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TLiteral<"creation">;
+        ref: import("@sinclair/typebox").TString;
+    }>]>;
+}>;
+export type RevokeProjectAuthority = Static<typeof RevokeProjectAuthoritySchema>;
+//# sourceMappingURL=project-authority.d.ts.map

package/node_modules/@tutti/shared/dist/schemas/internal/project-authority.js

@@ -0,0 +1,106 @@
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { ID_PREFIXES, ULID_BODY_PATTERN } from "../../ids/index.js";
+import { IdempotencyKeySchema, ProjectIdSchema, RelayProjectRefSchema, RelayAccountRefSchema, } from "../domain/index.js";
+const id = (prefix) => Type.String({ pattern: `^${prefix}${ULID_BODY_PATTERN}$` });
+export const ManagedCreationRefSchema = id(ID_PREFIXES.managedCreation);
+export const HostInstallationRefSchema = id(ID_PREFIXES.hostInstallation);
+export const HostDelegationRefSchema = id(ID_PREFIXES.hostDelegation);
+export const ProjectModelGrantRefSchema = id(ID_PREFIXES.projectModelGrant);
+export const AuthoritySecretSchema = Type.String({ pattern: "^[A-Za-z0-9_-]{43}$" });
+export const AuthoritySecretHashSchema = Type.String({ pattern: "^sha256:[a-f0-9]{64}$" });
+export const AuthorityTimestampSchema = Type.String({
+    pattern: "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$",
+});
+export function isAuthorityTimestamp(value) {
+    const time = Date.parse(value);
+    return Number.isFinite(time) && new Date(time).toISOString() === value;
+}
+export const PROJECT_TRIAL_POLICY = "trial-project-v1";
+// Preparation creates no model credential or project truth. Native secrets never go to Web.
+export const PrepareProjectAuthoritySchema = Type.Object({
+    request_ref: IdempotencyKeySchema,
+    project_id: ProjectIdSchema,
+    surface: Type.Union([Type.Literal("standalone"), Type.Literal("feishu")]),
+    existing_relay_project_ref: Type.Optional(RelayProjectRefSchema),
+    installation_ref: HostInstallationRefSchema,
+    installation_secret_hash: AuthoritySecretHashSchema,
+    handoff_token_hash: AuthoritySecretHashSchema,
+    host_registration_secret_hash: AuthoritySecretHashSchema,
+    trial_consent: Type.Literal(PROJECT_TRIAL_POLICY),
+    expires_before: Type.Optional(AuthorityTimestampSchema),
+}, { additionalProperties: false });
+export const ConsoleProjectAuthoritySchema = Type.Object({
+    console_token: AuthoritySecretSchema,
+    preparation: PrepareProjectAuthoritySchema,
+}, { additionalProperties: false });
+export const ManagedProjectBootstrapSchema = Type.Object({
+    kind: Type.Literal("managed_project_authority_v2"),
+    creation_ref: ManagedCreationRefSchema,
+    handoff_token: AuthoritySecretSchema,
+    installation_ref: HostInstallationRefSchema,
+    installation_secret: AuthoritySecretSchema,
+}, { additionalProperties: false });
+export const HostDelegationStatusBodySchema = Type.Object({
+    delegation_ref: HostDelegationRefSchema,
+    installation_ref: HostInstallationRefSchema,
+    installation_secret: AuthoritySecretSchema,
+    relay_project_ref: RelayProjectRefSchema,
+    project_id: ProjectIdSchema,
+    host_registration_secret: Type.String({ minLength: 32, maxLength: 256 }),
+}, { additionalProperties: false });
+export const HostDelegationProjectionSchema = Type.Object({
+    delegation_ref: HostDelegationRefSchema,
+    grant_ref: ProjectModelGrantRefSchema,
+    relay_project_ref: RelayProjectRefSchema,
+    installation_ref: HostInstallationRefSchema,
+    funding_kind: Type.Literal("trial"),
+    expires_at: Type.Null(),
+    state: Type.Literal("active"),
+    // not_enabled remains readable for pre-runtime private journals. Neither value
+    // is a health/quota promise; every invocation still needs live native authority.
+    model_access: Type.Union([
+        Type.Literal("runtime_authority_required"),
+        Type.Literal("not_enabled"),
+    ]),
+}, { additionalProperties: false });
+export const ManagedCreationProjectionSchema = Type.Object({
+    creation_ref: ManagedCreationRefSchema,
+    project_id: ProjectIdSchema,
+    surface: Type.Union([Type.Literal("standalone"), Type.Literal("feishu")]),
+    installation_ref: HostInstallationRefSchema,
+    expires_at: AuthorityTimestampSchema,
+    state: Type.Union([
+        Type.Literal("prepared"),
+        Type.Literal("activated"),
+        Type.Literal("expired"),
+        Type.Literal("revoked"),
+    ]),
+    relay_project_ref: Type.Optional(RelayProjectRefSchema),
+}, { additionalProperties: false });
+export const NativeCreationProofSchema = Type.Object({
+    request_ref: IdempotencyKeySchema,
+    project_id: ProjectIdSchema,
+    installation_ref: HostInstallationRefSchema,
+    installation_secret: AuthoritySecretSchema,
+    handoff_token: AuthoritySecretSchema,
+    host_registration_secret: Type.String({ minLength: 32, maxLength: 256 }),
+}, { additionalProperties: false });
+export const NativeCreationStatusSchema = Type.Object({
+    request_ref: IdempotencyKeySchema,
+    account_ref: RelayAccountRefSchema,
+    creation: ManagedCreationProjectionSchema,
+    authority: Type.Optional(HostDelegationProjectionSchema),
+}, { additionalProperties: false });
+export const isManagedProjectBootstrap = (value) => Value.Check(ManagedProjectBootstrapSchema, value);
+export const isHostDelegationProjection = (value) => Value.Check(HostDelegationProjectionSchema, value);
+export const RevokeProjectAuthoritySchema = Type.Object({
+    command_id: IdempotencyKeySchema,
+    target: Type.Union([
+        Type.Object({ kind: Type.Literal("grant"), ref: ProjectModelGrantRefSchema }, { additionalProperties: false }),
+        Type.Object({ kind: Type.Literal("delegation"), ref: HostDelegationRefSchema }, { additionalProperties: false }),
+        Type.Object({ kind: Type.Literal("installation"), ref: HostInstallationRefSchema }, { additionalProperties: false }),
+        Type.Object({ kind: Type.Literal("creation"), ref: ManagedCreationRefSchema }, { additionalProperties: false }),
+    ]),
+}, { additionalProperties: false });
+//# sourceMappingURL=project-authority.js.map

package/node_modules/@tutti/shared/dist/utils/clarification-participants.d.ts

@@ -0,0 +1,4 @@
+import type { MessageProjection } from "../schemas/api/index.js";
+/** Only explicit user input counts as an answer, never an ordinary system notice. */
+export declare function clarificationAnswerRole(message: Pick<MessageProjection, "author" | "message_kind" | "refs">): "human" | "operator" | null;
+//# sourceMappingURL=clarification-participants.d.ts.map

package/node_modules/@tutti/shared/dist/utils/clarification-participants.js

@@ -0,0 +1,11 @@
+/** Only explicit user input counts as an answer, never an ordinary system notice. */
+export function clarificationAnswerRole(message) {
+    if (message.message_kind !== "user_text")
+        return null;
+    if (message.author.kind === "human")
+        return "human";
+    return message.author.kind === "system" && message.refs?.development_operator === true
+        ? "operator"
+        : null;
+}
+//# sourceMappingURL=clarification-participants.js.map

package/node_modules/@tutti/shared/dist/utils/command-idempotency/index.d.ts

@@ -0,0 +1,40 @@
+export type JsonPrimitive = string | number | boolean | null;
+export type JsonValue = JsonPrimitive | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export type CommandIdempotencyStatus = "in_progress" | "completed" | "failed";
+export type CommandIdempotencyRecordLike = {
+    command_id: string;
+    command_name: string;
+    target_ref?: string | null;
+    request_hash: string;
+    status: CommandIdempotencyStatus;
+    disposition?: unknown;
+};
+export type CommandReplayDecision = {
+    kind: "start";
+} | {
+    kind: "replay";
+    status: Exclude<CommandIdempotencyStatus, "in_progress">;
+    disposition: unknown;
+} | {
+    kind: "in_progress";
+    disposition: InterruptedCommandDisposition;
+} | {
+    kind: "mismatch";
+    error_code: "command_replay_mismatch";
+};
+export type InterruptedCommandDisposition = {
+    kind: "interrupted";
+    retry_with_new_command_id: true;
+};
+export declare function canonicalJsonStringify(value: unknown): string;
+export declare function createCommandRequestCanonicalInput(input: {
+    command_name: string;
+    target_ref?: string | null;
+    payload: unknown;
+}): string;
+export declare function createInterruptedCommandDisposition(): InterruptedCommandDisposition;
+export declare function redactCommandDisposition<TDisposition>(disposition: TDisposition): unknown;
+export declare function decideCommandReplay(record: CommandIdempotencyRecordLike | null | undefined, requestHash: string): CommandReplayDecision;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/utils/command-idempotency/index.js

@@ -0,0 +1,100 @@
+import { redactValue } from "../redaction/index.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertJsonValue(value, path, seen) {
+    if (value === null || typeof value === "string" || typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "number") {
+        if (!Number.isFinite(value)) {
+            throw new TypeError(`Cannot canonicalize non-finite number at ${path}`);
+        }
+        return value;
+    }
+    if (Array.isArray(value)) {
+        if (seen.has(value)) {
+            throw new TypeError(`Cannot canonicalize circular JSON at ${path}`);
+        }
+        seen.add(value);
+        const items = value.map((item, index) => assertJsonValue(item, `${path}[${index}]`, seen));
+        seen.delete(value);
+        return items;
+    }
+    if (isRecord(value)) {
+        if (seen.has(value)) {
+            throw new TypeError(`Cannot canonicalize circular JSON at ${path}`);
+        }
+        seen.add(value);
+        const record = {};
+        for (const key of Object.keys(value).sort()) {
+            record[key] = assertJsonValue(value[key], `${path}.${key}`, seen);
+        }
+        seen.delete(value);
+        return record;
+    }
+    throw new TypeError(`Cannot canonicalize non-JSON value at ${path}`);
+}
+function stringifyCanonicalJson(value) {
+    if (value === null) {
+        return "null";
+    }
+    if (typeof value === "string") {
+        return JSON.stringify(value);
+    }
+    if (typeof value === "number" || typeof value === "boolean") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => stringifyCanonicalJson(item)).join(",")}]`;
+    }
+    return `{${Object.keys(value)
+        .sort()
+        .map((key) => {
+        const nested = value[key];
+        if (nested === undefined) {
+            throw new TypeError(`Cannot canonicalize non-JSON value at $.${key}`);
+        }
+        return `${JSON.stringify(key)}:${stringifyCanonicalJson(nested)}`;
+    })
+        .join(",")}}`;
+}
+export function canonicalJsonStringify(value) {
+    return stringifyCanonicalJson(assertJsonValue(value, "$", new WeakSet()));
+}
+export function createCommandRequestCanonicalInput(input) {
+    return canonicalJsonStringify({
+        command_name: input.command_name,
+        target_ref: input.target_ref ?? null,
+        payload: input.payload,
+    });
+}
+export function createInterruptedCommandDisposition() {
+    return {
+        kind: "interrupted",
+        retry_with_new_command_id: true,
+    };
+}
+export function redactCommandDisposition(disposition) {
+    return redactValue(disposition);
+}
+export function decideCommandReplay(record, requestHash) {
+    if (record === null || record === undefined) {
+        return { kind: "start" };
+    }
+    if (record.request_hash !== requestHash) {
+        return { kind: "mismatch", error_code: "command_replay_mismatch" };
+    }
+    if (record.status === "in_progress") {
+        return {
+            kind: "in_progress",
+            disposition: createInterruptedCommandDisposition(),
+        };
+    }
+    return {
+        kind: "replay",
+        status: record.status,
+        disposition: redactCommandDisposition(record.disposition),
+    };
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/utils/feishu-diagnostics/index.d.ts

@@ -0,0 +1,10 @@
+export declare const FEISHU_DIAGNOSTIC_ID_HEADER = "x-tutti-feishu-diagnostic-id";
+export declare const FEISHU_WEB_RELEASE_HEADER = "x-tutti-feishu-web-release";
+export type FeishuRequestDiagnostics = {
+    diagnosticId: string;
+    webRelease: string;
+};
+export declare function isFeishuDiagnosticId(value: unknown): value is string;
+export declare function isFeishuWebRelease(value: unknown): value is string;
+export declare function isFeishuRequestDiagnostics(value: unknown): value is FeishuRequestDiagnostics;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/utils/feishu-diagnostics/index.js

@@ -0,0 +1,19 @@
+export const FEISHU_DIAGNOSTIC_ID_HEADER = "x-tutti-feishu-diagnostic-id";
+export const FEISHU_WEB_RELEASE_HEADER = "x-tutti-feishu-web-release";
+const FEISHU_DIAGNOSTIC_ID_PATTERN = /^fdiag_[A-Za-z0-9_-]{16,64}$/u;
+const FEISHU_WEB_RELEASE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+export function isFeishuDiagnosticId(value) {
+    return typeof value === "string" && FEISHU_DIAGNOSTIC_ID_PATTERN.test(value);
+}
+export function isFeishuWebRelease(value) {
+    return typeof value === "string" && FEISHU_WEB_RELEASE_PATTERN.test(value);
+}
+export function isFeishuRequestDiagnostics(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "diagnosticId" in value &&
+        "webRelease" in value &&
+        isFeishuDiagnosticId(value.diagnosticId) &&
+        isFeishuWebRelease(value.webRelease));
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/utils/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./command-idempotency/index.js";
+export * from "./clarification-participants.js";
+export * from "./feishu-diagnostics/index.js";
+export * from "./logging/index.js";
+export * from "./path-policy/index.js";
+export * from "./redaction/index.js";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/utils/index.js

@@ -0,0 +1,7 @@
+export * from "./command-idempotency/index.js";
+export * from "./clarification-participants.js";
+export * from "./feishu-diagnostics/index.js";
+export * from "./logging/index.js";
+export * from "./path-policy/index.js";
+export * from "./redaction/index.js";
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/utils/logging/index.d.ts

@@ -0,0 +1,34 @@
+export type RuntimeLogLevel = "debug" | "info" | "warn" | "error";
+export type RuntimeLogFields = Record<string, unknown>;
+export type RuntimeLogger = {
+    debug?: (fields: RuntimeLogFields, message: string) => void;
+    info: (fields: RuntimeLogFields, message: string) => void;
+    warn?: (fields: RuntimeLogFields, message: string) => void;
+    error?: (fields: RuntimeLogFields, message: string) => void;
+};
+export type RuntimeLogEntry = {
+    level: RuntimeLogLevel;
+    time: string;
+    service: string;
+    component: string;
+    message: string;
+} & RuntimeLogFields;
+export type CreateRuntimeLogEntryInput = {
+    level: RuntimeLogLevel;
+    service: string;
+    component: string;
+    message: string;
+    fields?: RuntimeLogFields | undefined;
+    now: () => Date;
+};
+export type RuntimeSerializedErrorLog = Record<string, unknown> & {
+    type: string;
+    message: string;
+    stack: string;
+};
+export declare function createRuntimeLogEntry(input: CreateRuntimeLogEntryInput): RuntimeLogEntry;
+export declare function serializeRuntimeLogLine(input: CreateRuntimeLogEntryInput): string;
+export declare function serializeRuntimeRequestLog(request: unknown): Record<string, unknown>;
+export declare function serializeRuntimeResponseLog(response: unknown): Record<string, unknown>;
+export declare function serializeRuntimeErrorLog(error: unknown): RuntimeSerializedErrorLog;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/utils/logging/index.js

@@ -0,0 +1,130 @@
+import { redactError, redactText, redactValue } from "../redaction/index.js";
+const RESERVED_LOG_KEYS = new Set(["level", "time", "service", "component", "message"]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeLogValue(value, seen = new WeakSet()) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (value === null ||
+        typeof value === "string" ||
+        typeof value === "number" ||
+        typeof value === "boolean") {
+        return redactValue(value);
+    }
+    if (typeof value === "bigint") {
+        return value.toString();
+    }
+    if (value instanceof Error) {
+        return redactError(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => normalizeLogValue(item, seen));
+    }
+    if (isRecord(value)) {
+        if (seen.has(value)) {
+            return "[Circular]";
+        }
+        seen.add(value);
+        const normalized = {};
+        for (const [key, nested] of Object.entries(value)) {
+            const normalizedNested = normalizeLogValue(nested, seen);
+            if (normalizedNested !== undefined) {
+                normalized[key] = normalizedNested;
+            }
+        }
+        seen.delete(value);
+        return redactValue(normalized);
+    }
+    if (typeof value === "function") {
+        return value.name.trim().length === 0 ? "[Function]" : `[Function:${redactText(value.name)}]`;
+    }
+    if (typeof value === "symbol") {
+        return value.description === undefined
+            ? "[Symbol]"
+            : `[Symbol:${redactText(value.description)}]`;
+    }
+    return "[Unsupported]";
+}
+function normalizeLogFields(fields) {
+    if (fields === undefined) {
+        return {};
+    }
+    const normalized = {};
+    for (const [key, value] of Object.entries(fields)) {
+        const normalizedValue = normalizeLogValue(value);
+        if (normalizedValue === undefined) {
+            continue;
+        }
+        const logKey = RESERVED_LOG_KEYS.has(key) ? `field_${key}` : key;
+        normalized[logKey] = normalizedValue;
+    }
+    return normalized;
+}
+export function createRuntimeLogEntry(input) {
+    return {
+        ...normalizeLogFields(input.fields),
+        level: input.level,
+        time: input.now().toISOString(),
+        service: redactText(input.service),
+        component: redactText(input.component),
+        message: redactText(input.message),
+    };
+}
+export function serializeRuntimeLogLine(input) {
+    return redactText(JSON.stringify(createRuntimeLogEntry(input)));
+}
+function copyStringField(target, source, key) {
+    const value = source[key];
+    if (typeof value === "string") {
+        target[key] = redactText(value);
+    }
+}
+function copyNumberField(target, source, key) {
+    const value = source[key];
+    if (typeof value === "number") {
+        target[key] = value;
+    }
+}
+export function serializeRuntimeRequestLog(request) {
+    if (!isRecord(request)) {
+        return {};
+    }
+    const serialized = {};
+    copyStringField(serialized, request, "id");
+    copyStringField(serialized, request, "method");
+    copyStringField(serialized, request, "url");
+    copyStringField(serialized, request, "hostname");
+    copyStringField(serialized, request, "remoteAddress");
+    copyNumberField(serialized, request, "remotePort");
+    if (request.headers !== undefined) {
+        serialized.headers = redactValue(request.headers);
+    }
+    return serialized;
+}
+export function serializeRuntimeResponseLog(response) {
+    if (!isRecord(response)) {
+        return {};
+    }
+    const serialized = {};
+    copyNumberField(serialized, response, "statusCode");
+    return serialized;
+}
+export function serializeRuntimeErrorLog(error) {
+    const redacted = redactError(error);
+    if (isRecord(redacted)) {
+        return {
+            ...redacted,
+            type: typeof redacted.name === "string" ? redacted.name : "Error",
+            message: typeof redacted.message === "string" ? redacted.message : "Unknown error",
+            stack: typeof redacted.stack === "string" ? redacted.stack : "",
+        };
+    }
+    return {
+        type: "Error",
+        message: "Unknown error",
+        stack: "",
+    };
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/utils/path-policy/index.d.ts

@@ -0,0 +1,22 @@
+export type RepositoryPathMetadataRejectReason = "absolute_path" | "parent_traversal" | "private_tutti_path" | "git_path" | "control_character";
+export type RepositoryPathMetadataClassification = {
+    kind: "allowed";
+    normalized_path: string;
+    path_kind: "root" | "project_relative";
+} | {
+    kind: "rejected";
+    reason_code: RepositoryPathMetadataRejectReason;
+    normalized_path?: string;
+};
+export type ViewerPathRejectReason = RepositoryPathMetadataRejectReason | "secret_like_path";
+export type ViewerPathClassification = Extract<RepositoryPathMetadataClassification, {
+    kind: "allowed";
+}> | {
+    kind: "rejected";
+    reason_code: ViewerPathRejectReason;
+    normalized_path?: string;
+};
+export declare function classifyRepositoryPathMetadata(path: string): RepositoryPathMetadataClassification;
+export declare function classifyViewerPath(path: string): ViewerPathClassification;
+export declare function isViewerPathAllowed(path: string): boolean;
+//# sourceMappingURL=index.d.ts.map