@xfey/tutti 0.1.47 → 0.1.49

package/node_modules/@tutti/shared/dist/schemas/domain/index.d.ts

@@ -0,0 +1,31 @@
+import type { Static, TString } from "@sinclair/typebox";
+import type { IdPrefix } from "../../ids/index.js";
+export declare function prefixedIdSchema(prefix: IdPrefix, description?: string): TString;
+export declare const IsoDateTimeStringSchema: TString;
+export declare const CursorSchema: TString;
+export declare const ProjectIdSchema: TString;
+export declare const MessageIdSchema: TString;
+export declare const TaskModuleIdSchema: TString;
+export declare const TaskIdSchema: TString;
+export declare const RunResultIdSchema: TString;
+export declare const RecoverySummaryIdSchema: TString;
+export declare const ActivityRefSchema: TString;
+export declare const EventRefSchema: TString;
+export declare const WorkflowInvocationRefSchema: TString;
+export declare const ClarificationThreadRefSchema: TString;
+export declare const ClarificationRoundRefSchema: TString;
+export declare const ClarificationInteractionResponseIdSchema: TString;
+export declare const ApprovalRequestIdSchema: TString;
+export declare const IdempotencyKeySchema: TString;
+export declare const RelayProjectRefSchema: TString;
+export declare const RelayAccountRefSchema: TString;
+export declare const RelayMembershipRefSchema: TString;
+export declare const RelayAccountSessionRefSchema: TString;
+export declare const RelayClientSessionIdSchema: TString;
+export declare const RelayUploadRefSchema: TString;
+export declare const RelayAuthChallengeRefSchema: TString;
+export declare const HostConnectionRefSchema: TString;
+export declare const JoinTokenRefSchema: TString;
+export declare const WorkflowKindSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"project_context_bootstrap">, import("@sinclair/typebox").TLiteral<"scratchpad_refresh">, import("@sinclair/typebox").TLiteral<"task_compile">, import("@sinclair/typebox").TLiteral<"context_sync">, import("@sinclair/typebox").TLiteral<"reference_summary_refresh">, import("@sinclair/typebox").TLiteral<"recovery_check">, import("@sinclair/typebox").TLiteral<"follow_up_check">]>;
+export type WorkflowKindFromSchema = Static<typeof WorkflowKindSchema>;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/schemas/domain/index.js

@@ -0,0 +1,49 @@
+import { Type } from "@sinclair/typebox";
+import { ID_PREFIXES, ULID_BODY_PATTERN } from "../../ids/index.js";
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+export function prefixedIdSchema(prefix, description) {
+    return Type.String({
+        pattern: `^${escapeRegExp(prefix)}${ULID_BODY_PATTERN}$`,
+        ...(description === undefined ? {} : { description }),
+    });
+}
+export const IsoDateTimeStringSchema = Type.String({
+    minLength: 1,
+    description: "ISO 8601 date-time string",
+});
+export const CursorSchema = Type.String({ minLength: 1 });
+export const ProjectIdSchema = prefixedIdSchema(ID_PREFIXES.project, "ProjectId");
+export const MessageIdSchema = prefixedIdSchema(ID_PREFIXES.message, "MessageId");
+export const TaskModuleIdSchema = prefixedIdSchema(ID_PREFIXES.taskModule, "TaskModuleId");
+export const TaskIdSchema = prefixedIdSchema(ID_PREFIXES.task, "TaskId");
+export const RunResultIdSchema = prefixedIdSchema(ID_PREFIXES.runResult, "RunResultId");
+export const RecoverySummaryIdSchema = prefixedIdSchema(ID_PREFIXES.recoverySummary, "RecoverySummaryId");
+export const ActivityRefSchema = prefixedIdSchema(ID_PREFIXES.activity, "ActivityRef");
+export const EventRefSchema = prefixedIdSchema(ID_PREFIXES.event, "EventRef");
+export const WorkflowInvocationRefSchema = prefixedIdSchema(ID_PREFIXES.workflowInvocation, "WorkflowInvocationRef");
+export const ClarificationThreadRefSchema = prefixedIdSchema(ID_PREFIXES.clarificationThread, "ClarificationThreadRef");
+export const ClarificationRoundRefSchema = prefixedIdSchema(ID_PREFIXES.clarificationRound, "ClarificationRoundRef");
+export const ClarificationInteractionResponseIdSchema = prefixedIdSchema(ID_PREFIXES.clarificationInteractionResponse, "ClarificationInteractionResponseId");
+export const ApprovalRequestIdSchema = prefixedIdSchema(ID_PREFIXES.approvalRequest, "ApprovalRequestId");
+export const IdempotencyKeySchema = prefixedIdSchema(ID_PREFIXES.idempotency, "IdempotencyKey");
+export const RelayProjectRefSchema = prefixedIdSchema(ID_PREFIXES.relayProject, "RelayProjectRef");
+export const RelayAccountRefSchema = prefixedIdSchema(ID_PREFIXES.relayAccount, "RelayAccountRef");
+export const RelayMembershipRefSchema = prefixedIdSchema(ID_PREFIXES.relayMembership, "RelayMembershipRef");
+export const RelayAccountSessionRefSchema = prefixedIdSchema(ID_PREFIXES.relayAccountSession, "RelayAccountSessionRef");
+export const RelayClientSessionIdSchema = prefixedIdSchema(ID_PREFIXES.relayClientSession, "RelayClientSessionId");
+export const RelayUploadRefSchema = prefixedIdSchema(ID_PREFIXES.relayUpload, "RelayUploadRef");
+export const RelayAuthChallengeRefSchema = prefixedIdSchema(ID_PREFIXES.relayAuthChallenge, "RelayAuthChallengeRef");
+export const HostConnectionRefSchema = prefixedIdSchema(ID_PREFIXES.hostConnection, "HostConnectionRef");
+export const JoinTokenRefSchema = prefixedIdSchema(ID_PREFIXES.joinToken, "JoinTokenRef");
+export const WorkflowKindSchema = Type.Union([
+    Type.Literal("project_context_bootstrap"),
+    Type.Literal("scratchpad_refresh"),
+    Type.Literal("task_compile"),
+    Type.Literal("context_sync"),
+    Type.Literal("reference_summary_refresh"),
+    Type.Literal("recovery_check"),
+    Type.Literal("follow_up_check"),
+]);
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/schemas/internal/index.d.ts

@@ -0,0 +1,46 @@
+import type { Static } from "@sinclair/typebox";
+export declare const CommandIdempotencyStatusSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"in_progress">, import("@sinclair/typebox").TLiteral<"completed">, import("@sinclair/typebox").TLiteral<"failed">]>;
+export declare const InterruptedCommandDispositionSchema: import("@sinclair/typebox").TObject<{
+    kind: import("@sinclair/typebox").TLiteral<"interrupted">;
+    retry_with_new_command_id: import("@sinclair/typebox").TBoolean;
+}>;
+export declare const AccountAvatarColorSchema: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+export declare const AccountAvatarProjectionSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+    kind: import("@sinclair/typebox").TLiteral<"initials">;
+    initials: import("@sinclair/typebox").TString;
+    color: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+}>, import("@sinclair/typebox").TObject<{
+    kind: import("@sinclair/typebox").TLiteral<"image">;
+    image_url: import("@sinclair/typebox").TString;
+    initials: import("@sinclair/typebox").TString;
+    color: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+}>]>;
+export declare const RelaySessionContextSchema: import("@sinclair/typebox").TObject<{
+    account_ref: import("@sinclair/typebox").TString;
+    display_name: import("@sinclair/typebox").TString;
+    avatar: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TLiteral<"initials">;
+        initials: import("@sinclair/typebox").TString;
+        color: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+    }>, import("@sinclair/typebox").TObject<{
+        kind: import("@sinclair/typebox").TLiteral<"image">;
+        image_url: import("@sinclair/typebox").TString;
+        initials: import("@sinclair/typebox").TString;
+        color: import("@sinclair/typebox").TUnion<import("@sinclair/typebox").TLiteral<"green" | "blue" | "yellow" | "neutral">[]>;
+    }>]>;
+    membership: import("@sinclair/typebox").TObject<{
+        label: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"owner">, import("@sinclair/typebox").TLiteral<"member">]>;
+        relay_project_ref: import("@sinclair/typebox").TString;
+        joined_at: import("@sinclair/typebox").TString;
+    }>;
+    client_session_id: import("@sinclair/typebox").TString;
+    client_session_created_at: import("@sinclair/typebox").TString;
+}>;
+export type CommandIdempotencyStatus = Static<typeof CommandIdempotencyStatusSchema>;
+export type InterruptedCommandDisposition = Static<typeof InterruptedCommandDispositionSchema>;
+export type AccountAvatarColor = Static<typeof AccountAvatarColorSchema>;
+export type AccountAvatarProjection = Static<typeof AccountAvatarProjectionSchema>;
+export type RelaySessionContext = Static<typeof RelaySessionContextSchema>;
+export declare function isRelaySessionContext(value: unknown): value is RelaySessionContext;
+export declare function parseRelaySessionContext(value: unknown): RelaySessionContext | null;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/schemas/internal/index.js

@@ -0,0 +1,46 @@
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { ACCOUNT_AVATAR_COLORS } from "../../domain/index.js";
+import { IsoDateTimeStringSchema, RelayAccountRefSchema, RelayClientSessionIdSchema, RelayProjectRefSchema, } from "../domain/index.js";
+export const CommandIdempotencyStatusSchema = Type.Union([
+    Type.Literal("in_progress"),
+    Type.Literal("completed"),
+    Type.Literal("failed"),
+]);
+export const InterruptedCommandDispositionSchema = Type.Object({
+    kind: Type.Literal("interrupted"),
+    retry_with_new_command_id: Type.Boolean(),
+}, { additionalProperties: false });
+export const AccountAvatarColorSchema = Type.Union(ACCOUNT_AVATAR_COLORS.map((color) => Type.Literal(color)));
+export const AccountAvatarProjectionSchema = Type.Union([
+    Type.Object({
+        kind: Type.Literal("initials"),
+        initials: Type.String({ minLength: 1 }),
+        color: AccountAvatarColorSchema,
+    }, { additionalProperties: false }),
+    Type.Object({
+        kind: Type.Literal("image"),
+        image_url: Type.String({ minLength: 1 }),
+        initials: Type.String({ minLength: 1 }),
+        color: AccountAvatarColorSchema,
+    }, { additionalProperties: false }),
+]);
+export const RelaySessionContextSchema = Type.Object({
+    account_ref: RelayAccountRefSchema,
+    display_name: Type.String({ minLength: 1 }),
+    avatar: AccountAvatarProjectionSchema,
+    membership: Type.Object({
+        label: Type.Union([Type.Literal("owner"), Type.Literal("member")]),
+        relay_project_ref: RelayProjectRefSchema,
+        joined_at: IsoDateTimeStringSchema,
+    }, { additionalProperties: false }),
+    client_session_id: RelayClientSessionIdSchema,
+    client_session_created_at: IsoDateTimeStringSchema,
+}, { additionalProperties: false });
+export function isRelaySessionContext(value) {
+    return Value.Check(RelaySessionContextSchema, value);
+}
+export function parseRelaySessionContext(value) {
+    return isRelaySessionContext(value) ? value : null;
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/utils/command-idempotency/index.d.ts

@@ -0,0 +1,40 @@
+export type JsonPrimitive = string | number | boolean | null;
+export type JsonValue = JsonPrimitive | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export type CommandIdempotencyStatus = "in_progress" | "completed" | "failed";
+export type CommandIdempotencyRecordLike = {
+    command_id: string;
+    command_name: string;
+    target_ref?: string | null;
+    request_hash: string;
+    status: CommandIdempotencyStatus;
+    disposition?: unknown;
+};
+export type CommandReplayDecision = {
+    kind: "start";
+} | {
+    kind: "replay";
+    status: Exclude<CommandIdempotencyStatus, "in_progress">;
+    disposition: unknown;
+} | {
+    kind: "in_progress";
+    disposition: InterruptedCommandDisposition;
+} | {
+    kind: "mismatch";
+    error_code: "command_replay_mismatch";
+};
+export type InterruptedCommandDisposition = {
+    kind: "interrupted";
+    retry_with_new_command_id: true;
+};
+export declare function canonicalJsonStringify(value: unknown): string;
+export declare function createCommandRequestCanonicalInput(input: {
+    command_name: string;
+    target_ref?: string | null;
+    payload: unknown;
+}): string;
+export declare function createInterruptedCommandDisposition(): InterruptedCommandDisposition;
+export declare function redactCommandDisposition<TDisposition>(disposition: TDisposition): unknown;
+export declare function decideCommandReplay(record: CommandIdempotencyRecordLike | null | undefined, requestHash: string): CommandReplayDecision;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/utils/command-idempotency/index.js

@@ -0,0 +1,100 @@
+import { redactValue } from "../redaction/index.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertJsonValue(value, path, seen) {
+    if (value === null || typeof value === "string" || typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "number") {
+        if (!Number.isFinite(value)) {
+            throw new TypeError(`Cannot canonicalize non-finite number at ${path}`);
+        }
+        return value;
+    }
+    if (Array.isArray(value)) {
+        if (seen.has(value)) {
+            throw new TypeError(`Cannot canonicalize circular JSON at ${path}`);
+        }
+        seen.add(value);
+        const items = value.map((item, index) => assertJsonValue(item, `${path}[${index}]`, seen));
+        seen.delete(value);
+        return items;
+    }
+    if (isRecord(value)) {
+        if (seen.has(value)) {
+            throw new TypeError(`Cannot canonicalize circular JSON at ${path}`);
+        }
+        seen.add(value);
+        const record = {};
+        for (const key of Object.keys(value).sort()) {
+            record[key] = assertJsonValue(value[key], `${path}.${key}`, seen);
+        }
+        seen.delete(value);
+        return record;
+    }
+    throw new TypeError(`Cannot canonicalize non-JSON value at ${path}`);
+}
+function stringifyCanonicalJson(value) {
+    if (value === null) {
+        return "null";
+    }
+    if (typeof value === "string") {
+        return JSON.stringify(value);
+    }
+    if (typeof value === "number" || typeof value === "boolean") {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => stringifyCanonicalJson(item)).join(",")}]`;
+    }
+    return `{${Object.keys(value)
+        .sort()
+        .map((key) => {
+        const nested = value[key];
+        if (nested === undefined) {
+            throw new TypeError(`Cannot canonicalize non-JSON value at $.${key}`);
+        }
+        return `${JSON.stringify(key)}:${stringifyCanonicalJson(nested)}`;
+    })
+        .join(",")}}`;
+}
+export function canonicalJsonStringify(value) {
+    return stringifyCanonicalJson(assertJsonValue(value, "$", new WeakSet()));
+}
+export function createCommandRequestCanonicalInput(input) {
+    return canonicalJsonStringify({
+        command_name: input.command_name,
+        target_ref: input.target_ref ?? null,
+        payload: input.payload,
+    });
+}
+export function createInterruptedCommandDisposition() {
+    return {
+        kind: "interrupted",
+        retry_with_new_command_id: true,
+    };
+}
+export function redactCommandDisposition(disposition) {
+    return redactValue(disposition);
+}
+export function decideCommandReplay(record, requestHash) {
+    if (record === null || record === undefined) {
+        return { kind: "start" };
+    }
+    if (record.request_hash !== requestHash) {
+        return { kind: "mismatch", error_code: "command_replay_mismatch" };
+    }
+    if (record.status === "in_progress") {
+        return {
+            kind: "in_progress",
+            disposition: createInterruptedCommandDisposition(),
+        };
+    }
+    return {
+        kind: "replay",
+        status: record.status,
+        disposition: redactCommandDisposition(record.disposition),
+    };
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/utils/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./command-idempotency/index.js";
+export * from "./logging/index.js";
+export * from "./path-policy/index.js";
+export * from "./redaction/index.js";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/utils/index.js

@@ -0,0 +1,5 @@
+export * from "./command-idempotency/index.js";
+export * from "./logging/index.js";
+export * from "./path-policy/index.js";
+export * from "./redaction/index.js";
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/utils/logging/index.d.ts

@@ -0,0 +1,34 @@
+export type RuntimeLogLevel = "debug" | "info" | "warn" | "error";
+export type RuntimeLogFields = Record<string, unknown>;
+export type RuntimeLogger = {
+    debug?: (fields: RuntimeLogFields, message: string) => void;
+    info: (fields: RuntimeLogFields, message: string) => void;
+    warn?: (fields: RuntimeLogFields, message: string) => void;
+    error?: (fields: RuntimeLogFields, message: string) => void;
+};
+export type RuntimeLogEntry = {
+    level: RuntimeLogLevel;
+    time: string;
+    service: string;
+    component: string;
+    message: string;
+} & RuntimeLogFields;
+export type CreateRuntimeLogEntryInput = {
+    level: RuntimeLogLevel;
+    service: string;
+    component: string;
+    message: string;
+    fields?: RuntimeLogFields | undefined;
+    now: () => Date;
+};
+export type RuntimeSerializedErrorLog = Record<string, unknown> & {
+    type: string;
+    message: string;
+    stack: string;
+};
+export declare function createRuntimeLogEntry(input: CreateRuntimeLogEntryInput): RuntimeLogEntry;
+export declare function serializeRuntimeLogLine(input: CreateRuntimeLogEntryInput): string;
+export declare function serializeRuntimeRequestLog(request: unknown): Record<string, unknown>;
+export declare function serializeRuntimeResponseLog(response: unknown): Record<string, unknown>;
+export declare function serializeRuntimeErrorLog(error: unknown): RuntimeSerializedErrorLog;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/utils/logging/index.js

@@ -0,0 +1,130 @@
+import { redactError, redactText, redactValue } from "../redaction/index.js";
+const RESERVED_LOG_KEYS = new Set(["level", "time", "service", "component", "message"]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeLogValue(value, seen = new WeakSet()) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (value === null ||
+        typeof value === "string" ||
+        typeof value === "number" ||
+        typeof value === "boolean") {
+        return redactValue(value);
+    }
+    if (typeof value === "bigint") {
+        return value.toString();
+    }
+    if (value instanceof Error) {
+        return redactError(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => normalizeLogValue(item, seen));
+    }
+    if (isRecord(value)) {
+        if (seen.has(value)) {
+            return "[Circular]";
+        }
+        seen.add(value);
+        const normalized = {};
+        for (const [key, nested] of Object.entries(value)) {
+            const normalizedNested = normalizeLogValue(nested, seen);
+            if (normalizedNested !== undefined) {
+                normalized[key] = normalizedNested;
+            }
+        }
+        seen.delete(value);
+        return redactValue(normalized);
+    }
+    if (typeof value === "function") {
+        return value.name.trim().length === 0 ? "[Function]" : `[Function:${redactText(value.name)}]`;
+    }
+    if (typeof value === "symbol") {
+        return value.description === undefined
+            ? "[Symbol]"
+            : `[Symbol:${redactText(value.description)}]`;
+    }
+    return "[Unsupported]";
+}
+function normalizeLogFields(fields) {
+    if (fields === undefined) {
+        return {};
+    }
+    const normalized = {};
+    for (const [key, value] of Object.entries(fields)) {
+        const normalizedValue = normalizeLogValue(value);
+        if (normalizedValue === undefined) {
+            continue;
+        }
+        const logKey = RESERVED_LOG_KEYS.has(key) ? `field_${key}` : key;
+        normalized[logKey] = normalizedValue;
+    }
+    return normalized;
+}
+export function createRuntimeLogEntry(input) {
+    return {
+        ...normalizeLogFields(input.fields),
+        level: input.level,
+        time: input.now().toISOString(),
+        service: redactText(input.service),
+        component: redactText(input.component),
+        message: redactText(input.message),
+    };
+}
+export function serializeRuntimeLogLine(input) {
+    return redactText(JSON.stringify(createRuntimeLogEntry(input)));
+}
+function copyStringField(target, source, key) {
+    const value = source[key];
+    if (typeof value === "string") {
+        target[key] = redactText(value);
+    }
+}
+function copyNumberField(target, source, key) {
+    const value = source[key];
+    if (typeof value === "number") {
+        target[key] = value;
+    }
+}
+export function serializeRuntimeRequestLog(request) {
+    if (!isRecord(request)) {
+        return {};
+    }
+    const serialized = {};
+    copyStringField(serialized, request, "id");
+    copyStringField(serialized, request, "method");
+    copyStringField(serialized, request, "url");
+    copyStringField(serialized, request, "hostname");
+    copyStringField(serialized, request, "remoteAddress");
+    copyNumberField(serialized, request, "remotePort");
+    if (request.headers !== undefined) {
+        serialized.headers = redactValue(request.headers);
+    }
+    return serialized;
+}
+export function serializeRuntimeResponseLog(response) {
+    if (!isRecord(response)) {
+        return {};
+    }
+    const serialized = {};
+    copyNumberField(serialized, response, "statusCode");
+    return serialized;
+}
+export function serializeRuntimeErrorLog(error) {
+    const redacted = redactError(error);
+    if (isRecord(redacted)) {
+        return {
+            ...redacted,
+            type: typeof redacted.name === "string" ? redacted.name : "Error",
+            message: typeof redacted.message === "string" ? redacted.message : "Unknown error",
+            stack: typeof redacted.stack === "string" ? redacted.stack : "",
+        };
+    }
+    return {
+        type: "Error",
+        message: "Unknown error",
+        stack: "",
+    };
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/utils/path-policy/index.d.ts

@@ -0,0 +1,22 @@
+export type RepositoryPathMetadataRejectReason = "absolute_path" | "parent_traversal" | "private_tutti_path" | "git_path" | "control_character";
+export type RepositoryPathMetadataClassification = {
+    kind: "allowed";
+    normalized_path: string;
+    path_kind: "root" | "project_relative";
+} | {
+    kind: "rejected";
+    reason_code: RepositoryPathMetadataRejectReason;
+    normalized_path?: string;
+};
+export type ViewerPathRejectReason = RepositoryPathMetadataRejectReason | "secret_like_path";
+export type ViewerPathClassification = Extract<RepositoryPathMetadataClassification, {
+    kind: "allowed";
+}> | {
+    kind: "rejected";
+    reason_code: ViewerPathRejectReason;
+    normalized_path?: string;
+};
+export declare function classifyRepositoryPathMetadata(path: string): RepositoryPathMetadataClassification;
+export declare function classifyViewerPath(path: string): ViewerPathClassification;
+export declare function isViewerPathAllowed(path: string): boolean;
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@tutti/shared/dist/utils/path-policy/index.js

@@ -0,0 +1,92 @@
+const WINDOWS_ABSOLUTE_PATH_PATTERN = /^[A-Za-z]:[\\/]/u;
+const SECRET_FILE_NAMES = new Set([
+    ".env",
+    ".npmrc",
+    ".pypirc",
+    ".netrc",
+    ".ssh",
+    "credentials.json",
+    "credential.json",
+    "secrets.json",
+    "secret.json",
+    "id_rsa",
+    "id_dsa",
+    "id_ecdsa",
+    "id_ed25519",
+]);
+const SECRET_FILE_EXTENSIONS = [".pem", ".key", ".p12", ".pfx", ".kdbx"];
+function isAbsolutePath(path) {
+    return (path.startsWith("/") ||
+        path.startsWith("\\\\") ||
+        path.startsWith("//") ||
+        WINDOWS_ABSOLUTE_PATH_PATTERN.test(path));
+}
+function isSecretLikeSegment(segment) {
+    const lower = segment.toLowerCase();
+    return (SECRET_FILE_NAMES.has(lower) ||
+        lower.startsWith(".env.") ||
+        SECRET_FILE_EXTENSIONS.some((extension) => lower.endsWith(extension)));
+}
+function hasControlCharacter(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 31 || code === 127) {
+            return true;
+        }
+    }
+    return false;
+}
+export function classifyRepositoryPathMetadata(path) {
+    if (hasControlCharacter(path)) {
+        return { kind: "rejected", reason_code: "control_character" };
+    }
+    if (path === "" || path === ".") {
+        return { kind: "allowed", normalized_path: "", path_kind: "root" };
+    }
+    if (isAbsolutePath(path)) {
+        return { kind: "rejected", reason_code: "absolute_path" };
+    }
+    const segments = [];
+    for (const segment of path.replaceAll("\\", "/").split("/")) {
+        if (segment === "" || segment === ".") {
+            continue;
+        }
+        if (segment === "..") {
+            return { kind: "rejected", reason_code: "parent_traversal" };
+        }
+        const lower = segment.toLowerCase();
+        if (lower === ".git") {
+            return { kind: "rejected", reason_code: "git_path" };
+        }
+        if (lower === ".tutti") {
+            return { kind: "rejected", reason_code: "private_tutti_path" };
+        }
+        segments.push(segment);
+    }
+    const normalizedPath = segments.join("/");
+    return {
+        kind: "allowed",
+        normalized_path: normalizedPath,
+        path_kind: normalizedPath === "" ? "root" : "project_relative",
+    };
+}
+export function classifyViewerPath(path) {
+    if (hasControlCharacter(path)) {
+        return { kind: "rejected", reason_code: "control_character" };
+    }
+    const classification = classifyRepositoryPathMetadata(path.trim());
+    if (classification.kind === "rejected") {
+        return classification;
+    }
+    if (classification.normalized_path.split("/").some(isSecretLikeSegment)) {
+        return {
+            kind: "rejected",
+            reason_code: "secret_like_path",
+        };
+    }
+    return classification;
+}
+export function isViewerPathAllowed(path) {
+    return classifyViewerPath(path).kind === "allowed";
+}
+//# sourceMappingURL=index.js.map

package/node_modules/@tutti/shared/dist/utils/redaction/index.d.ts

@@ -0,0 +1,20 @@
+export declare const REDACTION_LABELS: {
+    readonly providerApiKey: "[REDACTED:provider_api_key]";
+    readonly bearerToken: "[REDACTED:bearer_token]";
+    readonly cookie: "[REDACTED:cookie]";
+    readonly joinToken: "[REDACTED:join_token]";
+    readonly runtimeToken: "[REDACTED:runtime_token]";
+    readonly hostSecret: "[REDACTED:host_secret]";
+    readonly localPath: "[REDACTED:local_path]";
+};
+export declare const REDACTION_FIXTURES: readonly ["sk-proj-example-secret", "Authorization: Bearer example-token", "Cookie: tutti_session=example-session", "Cookie: tutti_preview_session=example-preview-session", "https://opaque.preview.tutti.now/__tutti_preview_bootstrap#token=example-preview-token", "http://127.0.0.1:4370/join/example-join-token", "http://127.0.0.1:4370/api/v1/join/example-join-token/accept", "http://127.0.0.1:4371/setup?token=example-runtime-token", "host_connection_token=example-host-token", "host_registration_secret=example-host-secret", "/Users/example/.tutti/auth.json", "/Users/example/project/.git/config", "/Users/example/.tutti/projects/proj_123/runs/act_123", "OPENAI_API_KEY=example"];
+export declare function redactText(value: string): string;
+export declare function redactValue(value: unknown): unknown;
+export type RedactedError = {
+    name: string;
+    message: string;
+    stack?: string;
+};
+export declare function redactError(error: unknown): unknown;
+export declare function redactAndTruncateText(value: string, maxLength: number): string;
+//# sourceMappingURL=index.d.ts.map