@zihin/agent-client 0.1.0

package/dist/invoke.js

@@ -0,0 +1,233 @@
+"use strict";
+/**
+ * Caminho A — invocação direta de agente (POST /api/v2/agents/:id/stream).
+ * `streamAgent` emite deltas ao vivo; `invokeAgent` buffeia o stream e consolida
+ * o evento `response` (content/sources/session_id/blocks) com o `metrics` (usage/model).
+ *
+ * @module invoke
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.streamAgent = streamAgent;
+exports.invokeAgent = invokeAgent;
+const errors_1 = require("./errors");
+const http_1 = require("./http");
+const sse_1 = require("./sse");
+const internal_1 = require("./internal");
+const security_1 = require("./security");
+/** Mapeia um evento SSE bruto para o chunk normalizado do núcleo. */
+function mapEvent(e) {
+    const d = (0, internal_1.rec)(e.data);
+    switch (e.event) {
+        case 'metadata':
+            return {
+                type: 'metadata',
+                requestId: (0, internal_1.str)(d.request_id),
+                agentId: (0, internal_1.str)(d.agent_id),
+                sessionId: (0, internal_1.str)(d.session_id),
+                data: e.data,
+            };
+        case 'status':
+            return { type: 'status', phase: (0, internal_1.str)(d.phase), data: e.data };
+        case 'attachments':
+            return { type: 'attachments', data: e.data };
+        case 'phase':
+            return { type: 'phase', phase: (0, internal_1.str)(d.phase), data: e.data };
+        case 'thinking':
+            return { type: 'thinking', thought: (0, internal_1.str)(d.thought), data: e.data };
+        case 'tool':
+            return {
+                type: 'tool',
+                tool: (0, internal_1.str)(d.tool),
+                callId: (0, internal_1.str)(d.call_id),
+                success: typeof d.success === 'boolean' ? d.success : undefined,
+                data: e.data,
+            };
+        case 'action_proposed':
+            return { type: 'action_proposed', data: e.data };
+        case 'token':
+            return { type: 'token', content: (0, internal_1.str)(d.content) ?? '', data: e.data };
+        case 'warning':
+            return { type: 'warning', message: (0, internal_1.str)(d.message), data: e.data };
+        case 'response':
+            return {
+                type: 'response',
+                content: (0, internal_1.str)(d.content) ?? '',
+                sessionId: (0, internal_1.str)(d.session_id),
+                sources: Array.isArray(d.sources) ? d.sources : undefined,
+                blocks: Array.isArray(d.blocks)
+                    ? d.blocks
+                    : undefined,
+                data: e.data,
+            };
+        case 'metrics': {
+            const modelConfig = (0, internal_1.rec)(d.model_config);
+            return {
+                type: 'metrics',
+                usage: (0, internal_1.parseUsage)(d.usage),
+                model: (0, internal_1.str)(modelConfig.model) ?? (0, internal_1.str)(d.model),
+                iterations: (0, internal_1.num)(d.iterations),
+                executionTimeMs: (0, internal_1.num)(d.execution_time_ms),
+                data: e.data,
+            };
+        }
+        default:
+            return { type: 'unknown', event: e.event, data: e.data };
+    }
+}
+function buildRequestBody(params) {
+    const body = {};
+    if (params.message !== undefined)
+        body.message = params.message;
+    if (params.sessionId)
+        body.session_id = params.sessionId;
+    if (params.attachments?.length) {
+        body.attachments = params.attachments.map((a) => ({ url: a.url, type: a.type }));
+    }
+    if (params.options) {
+        const o = {};
+        if (params.options.temperature !== undefined)
+            o.temperature = params.options.temperature;
+        if (params.options.maxTokens !== undefined)
+            o.max_tokens = params.options.maxTokens;
+        if (params.options.timeoutMs !== undefined)
+            o.timeout_ms = params.options.timeoutMs;
+        if (params.options.jitMode !== undefined)
+            o.jit_mode = params.options.jitMode;
+        if (Object.keys(o).length)
+            body.options = o;
+    }
+    if (params.metadata) {
+        const m = { ...params.metadata };
+        if (params.metadata.traceId !== undefined) {
+            m.trace_id = params.metadata.traceId;
+            delete m.traceId;
+        }
+        if (params.metadata.correlationId !== undefined) {
+            m.correlation_id = params.metadata.correlationId;
+            delete m.correlationId;
+        }
+        body.metadata = m;
+    }
+    return body;
+}
+function validateParams(params) {
+    if (!params.agentId) {
+        throw new errors_1.ZihinAgentError('config', 'agentId is required.');
+    }
+    if (!params.message && !(params.attachments && params.attachments.length)) {
+        throw new errors_1.ZihinAgentError('config', 'Either `message` or `attachments` is required.');
+    }
+    if (params.message) {
+        const sizeCheck = (0, security_1.validatePromptSize)(params.message);
+        if (!sizeCheck.valid) {
+            throw new errors_1.ZihinAgentError('config', sizeCheck.error || 'Message too large.');
+        }
+    }
+    // Defense-in-depth: anexos vêm do usuário e o BE os busca (server-side fetch).
+    // Valida HTTPS + bloqueia IP privado (mesma regra da callbackUrl); domínio livre.
+    for (const att of params.attachments ?? []) {
+        const urlCheck = (0, security_1.validateBaseUrl)(att.url, { allowCustomDomains: true });
+        if (!urlCheck.valid) {
+            throw new errors_1.ZihinAgentError('config', `Invalid attachment URL: ${urlCheck.error}`);
+        }
+    }
+}
+/**
+ * Emite chunks normalizados do agente ao vivo. Para quem quer streaming (UI, logs).
+ * O deadline (timeout + abort do chamador) cobre toda a duração do stream e é liberado no fim.
+ */
+async function* streamAgent(cfg, params) {
+    validateParams(params);
+    const timeoutMs = params.options?.timeoutMs ?? cfg.timeoutMs;
+    const url = `${cfg.baseUrl}/api/v2/agents/${encodeURIComponent(params.agentId)}/stream`;
+    const { response, deadline, endpoint } = await (0, http_1.openStream)({
+        url,
+        headers: (0, http_1.buildHeaders)(cfg.apiKey),
+        body: JSON.stringify(buildRequestBody(params)),
+        timeoutMs,
+        maxRetries: cfg.maxRetries,
+        callerSignal: params.signal,
+        fetchImpl: cfg.fetchImpl,
+        onRetry: cfg.onRetry,
+    });
+    // dispose garantido aqui também (parseSse pode lançar "no body" antes do seu try/finally,
+    // o que deixaria o timer do deadline pendurado segurando o event loop / função serverless).
+    try {
+        if (!response.ok) {
+            let text = '';
+            try {
+                text = await response.text();
+            }
+            catch {
+                /* ignore */
+            }
+            throw (0, errors_1.errorFromResponse)(response.status, (0, http_1.parseBody)(text), { endpoint });
+        }
+        const onAbortError = () => deadline.timedOut()
+            ? new errors_1.ZihinAgentError('timeout', `Stream timed out after ${timeoutMs}ms.`, { endpoint })
+            : deadline.abortedByCaller()
+                ? new errors_1.ZihinAgentError('aborted', 'Stream aborted by the caller.', { endpoint })
+                : new errors_1.ZihinAgentError('network', 'Stream connection interrupted.', { endpoint });
+        for await (const e of (0, sse_1.parseSse)(response, {
+            signal: params.signal,
+            onAbortError,
+            maxEventBytes: cfg.maxStreamEventBytes,
+            maxTotalBytes: cfg.maxStreamTotalBytes,
+        })) {
+            yield mapEvent(e);
+        }
+    }
+    finally {
+        deadline.dispose();
+    }
+}
+/**
+ * Invoca o agente e retorna o resultado final consolidado. Buffeia o SSE até `response`+`metrics`.
+ */
+async function invokeAgent(cfg, params) {
+    const raw = [];
+    const keepRaw = params.includeRaw === true;
+    let responseChunk;
+    let metricsChunk;
+    let metadataSessionId;
+    let tokenBuffer = '';
+    for await (const chunk of streamAgent(cfg, params)) {
+        if (keepRaw)
+            raw.push(chunk);
+        if (chunk.type === 'response')
+            responseChunk = chunk;
+        else if (chunk.type === 'metrics')
+            metricsChunk = chunk;
+        else if (chunk.type === 'token')
+            tokenBuffer += chunk.content;
+        else if (chunk.type === 'metadata' && chunk.sessionId)
+            metadataSessionId = chunk.sessionId;
+    }
+    if (!responseChunk) {
+        // Stream terminou sem o evento final — fallback para tokens, ou erro de protocolo.
+        if (tokenBuffer) {
+            return {
+                content: tokenBuffer,
+                sessionId: metadataSessionId ?? params.sessionId,
+                usage: metricsChunk?.usage,
+                model: metricsChunk?.model,
+                iterations: metricsChunk?.iterations,
+                executionTimeMs: metricsChunk?.executionTimeMs,
+                raw,
+            };
+        }
+        throw new errors_1.ZihinAgentError('protocol', 'Stream ended without a `response` event.');
+    }
+    return {
+        content: responseChunk.content || tokenBuffer,
+        sessionId: responseChunk.sessionId ?? metadataSessionId ?? params.sessionId,
+        model: metricsChunk?.model,
+        usage: metricsChunk?.usage,
+        sources: responseChunk.sources,
+        blocks: responseChunk.blocks,
+        iterations: metricsChunk?.iterations,
+        executionTimeMs: metricsChunk?.executionTimeMs,
+        raw,
+    };
+}
+//# sourceMappingURL=invoke.js.map

package/dist/invoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invoke.js","sourceRoot":"","sources":["../src/invoke.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AA+HH,kCAkDC;AAKD,kCA8CC;AAlOD,qCAA8D;AAC9D,iCAAoG;AACpG,+BAAgD;AAChD,yCAAuD;AACvD,yCAAiE;AAGjE,qEAAqE;AACrE,SAAS,QAAQ,CAAC,CAAW;IAC5B,MAAM,CAAC,GAAG,IAAA,cAAG,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtB,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;QACjB,KAAK,UAAU;YACd,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,SAAS,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,UAAU,CAAC;gBAC5B,OAAO,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,QAAQ,CAAC;gBACxB,SAAS,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,UAAU,CAAC;gBAC5B,IAAI,EAAE,CAAC,CAAC,IAAI;aACZ,CAAC;QACH,KAAK,QAAQ;YACZ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,KAAK,aAAa;YACjB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,KAAK,OAAO;YACX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,KAAK,UAAU;YACd,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,KAAK,MAAM;YACV,OAAO;gBACN,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,IAAI,CAAC;gBACjB,MAAM,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,OAAO,CAAC;gBACtB,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC/D,IAAI,EAAE,CAAC,CAAC,IAAI;aACZ,CAAC;QACH,KAAK,iBAAiB;YACrB,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,KAAK,OAAO;YACX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACvE,KAAK,SAAS;YACb,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnE,KAAK,UAAU;YACd,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC7B,SAAS,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,UAAU,CAAC;gBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,OAAoB,CAAC,CAAC,CAAC,SAAS;gBACvE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;oBAC9B,CAAC,CAAE,CAAC,CAAC,MAAwD;oBAC7D,CAAC,CAAC,SAAS;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;aACZ,CAAC;QACH,KAAK,SAAS,CAAC,CAAC,CAAC;YAChB,MAAM,WAAW,GAAG,IAAA,cAAG,EAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YACxC,OAAO;gBACN,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,IAAA,qBAAU,EAAC,CAAC,CAAC,KAAK,CAAC;gBAC1B,KAAK,EAAE,IAAA,cAAG,EAAC,WAAW,CAAC,KAAK,CAAC,IAAI,IAAA,cAAG,EAAC,CAAC,CAAC,KAAK,CAAC;gBAC7C,UAAU,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,UAAU,CAAC;gBAC7B,eAAe,EAAE,IAAA,cAAG,EAAC,CAAC,CAAC,iBAAiB,CAAC;gBACzC,IAAI,EAAE,CAAC,CAAC,IAAI;aACZ,CAAC;QACH,CAAC;QACD;YACC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAyB;IAClD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAChE,IAAI,MAAM,CAAC,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC;IACzD,IAAI,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,GAA4B,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACzF,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpF,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpF,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;YAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,CAAC,GAA4B,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3C,CAAC,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YACrC,OAAO,CAAC,CAAC,OAAO,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACjD,CAAC,CAAC,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;YACjD,OAAO,CAAC,CAAC,aAAa,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,MAAyB;IAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,wBAAe,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,wBAAe,CAAC,QAAQ,EAAE,gDAAgD,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAA,6BAAkB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,wBAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC;QAC9E,CAAC;IACF,CAAC;IACD,+EAA+E;IAC/E,kFAAkF;IAClF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAA,0BAAe,EAAC,GAAG,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,wBAAe,CAAC,QAAQ,EAAE,2BAA2B,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;GAGG;AACI,KAAK,SAAS,CAAC,CAAC,WAAW,CACjC,GAAmB,EACnB,MAAyB;IAEzB,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,OAAO,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;IAExF,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAA,iBAAc,EAAC;QAC7D,GAAG;QACH,OAAO,EAAE,IAAA,mBAAY,EAAC,GAAG,CAAC,MAAM,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9C,SAAS;QACT,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;KACpB,CAAC,CAAC;IAEH,0FAA0F;IAC1F,4FAA4F;IAC5F,IAAI,CAAC;QACJ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,CAAC;gBACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACR,YAAY;YACb,CAAC;YACD,MAAM,IAAA,0BAAiB,EAAC,QAAQ,CAAC,MAAM,EAAE,IAAA,gBAAS,EAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,YAAY,GAAG,GAAU,EAAE,CAChC,QAAQ,CAAC,QAAQ,EAAE;YAClB,CAAC,CAAC,IAAI,wBAAe,CAAC,SAAS,EAAE,0BAA0B,SAAS,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC;YACxF,CAAC,CAAC,QAAQ,CAAC,eAAe,EAAE;gBAC3B,CAAC,CAAC,IAAI,wBAAe,CAAC,SAAS,EAAE,+BAA+B,EAAE,EAAE,QAAQ,EAAE,CAAC;gBAC/E,CAAC,CAAC,IAAI,wBAAe,CAAC,SAAS,EAAE,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEpF,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,IAAA,cAAQ,EAAC,QAAQ,EAAE;YACxC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,YAAY;YACZ,aAAa,EAAE,GAAG,CAAC,mBAAmB;YACtC,aAAa,EAAE,GAAG,CAAC,mBAAmB;SACtC,CAAC,EAAE,CAAC;YACJ,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;IACF,CAAC;YAAS,CAAC;QACV,QAAQ,CAAC,OAAO,EAAE,CAAC;IACpB,CAAC;AACF,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,WAAW,CAChC,GAAmB,EACnB,MAAyB;IAEzB,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC;IAC3C,IAAI,aAA0E,CAAC;IAC/E,IAAI,YAAwE,CAAC;IAC7E,IAAI,iBAAqC,CAAC;IAC1C,IAAI,WAAW,GAAG,EAAE,CAAC;IAErB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;YAAE,aAAa,GAAG,KAAK,CAAC;aAChD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,YAAY,GAAG,KAAK,CAAC;aACnD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YAAE,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC;aACzD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,SAAS;YAAE,iBAAiB,GAAG,KAAK,CAAC,SAAS,CAAC;IAC5F,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,mFAAmF;QACnF,IAAI,WAAW,EAAE,CAAC;YACjB,OAAO;gBACN,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,iBAAiB,IAAI,MAAM,CAAC,SAAS;gBAChD,KAAK,EAAE,YAAY,EAAE,KAAK;gBAC1B,KAAK,EAAE,YAAY,EAAE,KAAK;gBAC1B,UAAU,EAAE,YAAY,EAAE,UAAU;gBACpC,eAAe,EAAE,YAAY,EAAE,eAAe;gBAC9C,GAAG;aACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,wBAAe,CAAC,UAAU,EAAE,0CAA0C,CAAC,CAAC;IACnF,CAAC;IAED,OAAO;QACN,OAAO,EAAE,aAAa,CAAC,OAAO,IAAI,WAAW;QAC7C,SAAS,EAAE,aAAa,CAAC,SAAS,IAAI,iBAAiB,IAAI,MAAM,CAAC,SAAS;QAC3E,KAAK,EAAE,YAAY,EAAE,KAAK;QAC1B,KAAK,EAAE,YAAY,EAAE,KAAK;QAC1B,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,MAAM,EAAE,aAAa,CAAC,MAAM;QAC5B,UAAU,EAAE,YAAY,EAAE,UAAU;QACpC,eAAe,EAAE,YAAY,EAAE,eAAe;QAC9C,GAAG;KACH,CAAC;AACH,CAAC"}

package/dist/security.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Security utilities — portado de n8n-nodes-zihin/src/utils/security.ts (zero-dep).
+ * SSRF prevention, payload limits, error sanitization, API-key format, HMAC signing.
+ *
+ * Núcleo compartilhado: os shells (n8n, Paperclip) reusam estas primitivas via @zihin/agent-client.
+ *
+ * @module security
+ */
+export interface UrlValidationResult {
+    valid: boolean;
+    error?: string;
+    sanitizedUrl?: string;
+}
+export interface UrlValidationOptions {
+    allowCustomDomains?: boolean;
+    allowHttp?: boolean;
+    allowLocalhost?: boolean;
+}
+/**
+ * Validates a base URL for SSRF prevention.
+ *
+ * NOTA (S4): a checagem é por NOME de host, não pelo IP resolvido. Com `allowCustomDomains: true`,
+ * um host que resolve para IP privado (DNS rebinding) passa. Em ambiente sensível, mantenha o
+ * whitelist (default) ou faça a resolução/checagem de IP na borda de rede.
+ *
+ * @param url - The URL to validate
+ * @param options - Validation options
+ * @returns Validation result with sanitized URL or error
+ */
+export declare function validateBaseUrl(url: string, options?: UrlValidationOptions): UrlValidationResult;
+export interface PayloadLimits {
+    maxPromptBytes: number;
+    maxMessageCount: number;
+    maxSingleMessageBytes: number;
+    maxTotalPayloadBytes: number;
+}
+declare const DEFAULT_LIMITS: PayloadLimits;
+export interface PayloadValidationResult {
+    valid: boolean;
+    error?: string;
+    truncated?: boolean;
+    details?: {
+        promptBytes?: number;
+        messageCount?: number;
+        largestMessageBytes?: number;
+        totalBytes?: number;
+    };
+}
+/**
+ * Validates a single message/prompt size against configured limits.
+ */
+export declare function validatePromptSize(prompt: string, limits?: Partial<PayloadLimits>): PayloadValidationResult;
+export interface SanitizedError {
+    message: string;
+    code?: string;
+    retryable: boolean;
+    retryAfter?: number;
+}
+/**
+ * Sanitizes API errors to prevent information leakage (keys, request IDs, stack traces).
+ */
+export declare function sanitizeApiError(error: unknown): SanitizedError;
+export interface ApiKeyValidationResult {
+    valid: boolean;
+    error?: string;
+    environment?: 'live' | 'test' | 'dev';
+}
+/**
+ * Validates API key format (zhn_live_* | zhn_test_* | zhn_dev_*).
+ */
+export declare function validateApiKeyFormat(apiKey: string): ApiKeyValidationResult;
+export interface SignedRequestHeaders {
+    'X-Zihin-Signature': string;
+    'X-Zihin-Timestamp': string;
+    'X-Zihin-Nonce': string;
+}
+/**
+ * Signs a request payload with HMAC-SHA256 (timestamp + nonce + payload).
+ * Requer Node crypto — carregado sob demanda; lança em runtimes sem ele.
+ */
+export declare function signRequest(payload: string, secretKey: string, timestamp?: number): SignedRequestHeaders;
+export { DEFAULT_LIMITS };

package/dist/security.js

@@ -0,0 +1,251 @@
+"use strict";
+/**
+ * Security utilities — portado de n8n-nodes-zihin/src/utils/security.ts (zero-dep).
+ * SSRF prevention, payload limits, error sanitization, API-key format, HMAC signing.
+ *
+ * Núcleo compartilhado: os shells (n8n, Paperclip) reusam estas primitivas via @zihin/agent-client.
+ *
+ * @module security
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_LIMITS = void 0;
+exports.validateBaseUrl = validateBaseUrl;
+exports.validatePromptSize = validatePromptSize;
+exports.sanitizeApiError = sanitizeApiError;
+exports.validateApiKeyFormat = validateApiKeyFormat;
+exports.signRequest = signRequest;
+const internal_1 = require("./internal");
+// `node:crypto` é carregado SOB DEMANDA (só em signRequest) para não quebrar o load do módulo
+// em runtimes sem Node crypto (edge/browser), onde o resto do núcleo funciona via Web APIs.
+// ============================================
+// 1. URL Validation (SSRF Prevention)
+// ============================================
+const PRIVATE_IP_PATTERNS = [
+    /^127\./, // 127.0.0.0/8 (localhost)
+    /^10\./, // 10.0.0.0/8 (private)
+    /^172\.(1[6-9]|2[0-9]|3[0-1])\./, // 172.16.0.0/12 (private)
+    /^192\.168\./, // 192.168.0.0/16 (private)
+    /^169\.254\./, // 169.254.0.0/16 (link-local)
+    /^0\./, // 0.0.0.0/8
+    /^::1$/, // IPv6 localhost
+    /^fe80:/i, // IPv6 link-local
+    /^fc00:/i, // IPv6 unique local
+    /^fd00:/i, // IPv6 unique local
+];
+const BLOCKED_HOSTNAMES = [
+    'localhost',
+    'localtest.me',
+    'metadata.google.internal', // GCP metadata
+    '169.254.169.254', // AWS/Azure/GCP metadata
+    'metadata.azure.com',
+];
+const ALLOWED_ZIHIN_DOMAINS = [
+    'llm.zihin.ai',
+    'api.zihin.ai',
+    'staging.llm.zihin.ai',
+    'dev.llm.zihin.ai',
+];
+/**
+ * Validates a base URL for SSRF prevention.
+ *
+ * NOTA (S4): a checagem é por NOME de host, não pelo IP resolvido. Com `allowCustomDomains: true`,
+ * um host que resolve para IP privado (DNS rebinding) passa. Em ambiente sensível, mantenha o
+ * whitelist (default) ou faça a resolução/checagem de IP na borda de rede.
+ *
+ * @param url - The URL to validate
+ * @param options - Validation options
+ * @returns Validation result with sanitized URL or error
+ */
+function validateBaseUrl(url, options = {}) {
+    // Empty/default URL is allowed
+    if (!url || url.trim() === '') {
+        return { valid: true, sanitizedUrl: 'https://llm.zihin.ai' };
+    }
+    try {
+        const parsed = new URL(url);
+        const hostname = parsed.hostname;
+        // Check if this is localhost (for development)
+        const isLocalhost = hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';
+        // Allow localhost when explicitly enabled (development mode)
+        if (isLocalhost && options.allowLocalhost) {
+            const sanitizedUrl = parsed.origin + parsed.pathname.replace(/\/+$/, '');
+            return { valid: true, sanitizedUrl };
+        }
+        // 1. Protocol validation (HTTPS only by default)
+        if (!options.allowHttp && parsed.protocol !== 'https:') {
+            return {
+                valid: false,
+                error: 'Only HTTPS URLs are allowed for security reasons',
+            };
+        }
+        // 2. Block private IP ranges
+        for (const pattern of PRIVATE_IP_PATTERNS) {
+            if (pattern.test(hostname)) {
+                return { valid: false, error: 'Private IP addresses are not allowed' };
+            }
+        }
+        // 3. Block known dangerous hostnames
+        for (const blocked of BLOCKED_HOSTNAMES) {
+            if (blocked.startsWith('*')) {
+                const suffix = blocked.slice(1);
+                if (hostname.endsWith(suffix)) {
+                    return { valid: false, error: 'This hostname is not allowed' };
+                }
+            }
+            else if (hostname === blocked || hostname.endsWith('.' + blocked)) {
+                return { valid: false, error: 'This hostname is not allowed' };
+            }
+        }
+        // 4. Whitelist mode (only Zihin domains) unless custom domains allowed
+        if (!options.allowCustomDomains) {
+            const isAllowed = ALLOWED_ZIHIN_DOMAINS.some((domain) => hostname === domain || hostname.endsWith('.' + domain));
+            if (!isAllowed) {
+                return {
+                    valid: false,
+                    error: `Only Zihin domains are allowed. Use 'allowCustomBaseUrl' for custom endpoints.`,
+                };
+            }
+        }
+        // Remove trailing slash for consistency
+        const sanitizedUrl = parsed.origin + parsed.pathname.replace(/\/+$/, '');
+        return { valid: true, sanitizedUrl };
+    }
+    catch {
+        return { valid: false, error: 'Invalid URL format' };
+    }
+}
+const DEFAULT_LIMITS = {
+    maxPromptBytes: 100 * 1024, // 100KB
+    maxMessageCount: 100,
+    maxSingleMessageBytes: 50 * 1024, // 50KB
+    maxTotalPayloadBytes: 500 * 1024, // 500KB
+};
+exports.DEFAULT_LIMITS = DEFAULT_LIMITS;
+/**
+ * Validates a single message/prompt size against configured limits.
+ */
+function validatePromptSize(prompt, limits = {}) {
+    const effectiveLimits = { ...DEFAULT_LIMITS, ...limits };
+    const bytes = (0, internal_1.utf8Len)(prompt);
+    if (bytes > effectiveLimits.maxPromptBytes) {
+        return {
+            valid: false,
+            error: `Prompt size (${Math.round(bytes / 1024)}KB) exceeds maximum allowed (${Math.round(effectiveLimits.maxPromptBytes / 1024)}KB)`,
+            details: { promptBytes: bytes },
+        };
+    }
+    return { valid: true, details: { promptBytes: bytes } };
+}
+// ============================================
+// 3. Error Sanitization
+// ============================================
+// Redação SÓ de segredos reais. request_id/trace_id/correlation_id NÃO são redatados:
+// não são secretos e são exatamente o que o suporte/observabilidade precisa para correlacionar.
+const SENSITIVE_PATTERNS = [
+    /zhn_(?:live|test|dev)_[a-zA-Z0-9]+/g, // API keys
+    /Bearer\s+[a-zA-Z0-9._-]+/gi, // Bearer tokens
+    /at\s+[\w./<>]+\s*\(.*:\d+:\d+\)/g, // Stack trace lines
+    /^\s+at\s+.+$/gm, // Stack traces
+    /Error:\s*.*\n\s+at/g, // Error stack beginnings
+];
+const ERROR_CODE_MAP = {
+    RATE_LIMIT_EXCEEDED: 'Rate limit exceeded. Please wait before retrying.',
+    UNAUTHORIZED: 'Authentication failed. Please check your API credentials.',
+    FORBIDDEN: 'This API key lacks permission for this action. Use an admin/editor key (member keys cannot create triggers or read telemetry).',
+    INVALID_MODEL: 'The specified model is not available.',
+    INTERNAL_ERROR: 'An internal error occurred. Please try again later.',
+    TIMEOUT: 'Request timed out. Try increasing the timeout.',
+    INVALID_REQUEST: 'The request was malformed. Please check your input.',
+    INSUFFICIENT_CREDITS: 'Insufficient credits. Please check your account balance.',
+    CONTEXT_LENGTH_EXCEEDED: 'The input exceeds the model context length limit.',
+    AGENT_NOT_FOUND: 'Agent not found or not active for this tenant.',
+};
+/**
+ * Sanitizes API errors to prevent information leakage (keys, request IDs, stack traces).
+ */
+function sanitizeApiError(error) {
+    let message = 'An unexpected error occurred';
+    let code;
+    let retryable = false;
+    let retryAfter;
+    if (typeof error === 'object' && error !== null) {
+        const err = error;
+        // O BE usa o shape aninhado { error: { code, message } }; suporta também o plano
+        // { error|code: string, message }. (Antes, err.error objeto virava "código" e a msg sumia.)
+        const nested = err.error && typeof err.error === 'object' ? err.error : undefined;
+        const codeRaw = nested?.code ?? (typeof err.error === 'string' ? err.error : err.code);
+        code = typeof codeRaw === 'string' ? codeRaw : undefined;
+        const rawMessage = (nested?.message ?? err.message);
+        if (code && ERROR_CODE_MAP[code]) {
+            message = ERROR_CODE_MAP[code];
+        }
+        else if (typeof rawMessage === 'string' && rawMessage) {
+            message = rawMessage;
+        }
+        if (code === 'RATE_LIMIT_EXCEEDED' || code === 'TIMEOUT') {
+            retryable = true;
+            retryAfter = err.retryAfter || 60;
+        }
+        // S5: limita o tamanho ANTES das regex (bounda custo/ReDoS em mensagens grandes).
+        if (message.length > 2000)
+            message = message.slice(0, 2000);
+        for (const pattern of SENSITIVE_PATTERNS) {
+            message = message.replace(pattern, '[REDACTED]');
+        }
+    }
+    else if (typeof error === 'string') {
+        message = error;
+        if (message.length > 2000)
+            message = message.slice(0, 2000);
+        for (const pattern of SENSITIVE_PATTERNS) {
+            message = message.replace(pattern, '[REDACTED]');
+        }
+    }
+    if (message.length > 500) {
+        message = message.substring(0, 500) + '...';
+    }
+    return { message, code, retryable, retryAfter };
+}
+// ============================================
+// 4. API Key Validation
+// ============================================
+const API_KEY_PATTERN = /^zhn_(live|test|dev)_[a-zA-Z0-9]{20,}$/;
+/**
+ * Validates API key format (zhn_live_* | zhn_test_* | zhn_dev_*).
+ */
+function validateApiKeyFormat(apiKey) {
+    if (!apiKey || apiKey.trim() === '') {
+        return { valid: false, error: 'API key is required' };
+    }
+    const trimmed = apiKey.trim();
+    if (!API_KEY_PATTERN.test(trimmed)) {
+        return {
+            valid: false,
+            error: 'Invalid API key format. Expected: zhn_live_xxx, zhn_test_xxx or zhn_dev_xxx',
+        };
+    }
+    const environment = trimmed.startsWith('zhn_live_')
+        ? 'live'
+        : trimmed.startsWith('zhn_test_')
+            ? 'test'
+            : 'dev';
+    return { valid: true, environment };
+}
+/**
+ * Signs a request payload with HMAC-SHA256 (timestamp + nonce + payload).
+ * Requer Node crypto — carregado sob demanda; lança em runtimes sem ele.
+ */
+function signRequest(payload, secretKey, timestamp) {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const { createHmac, randomBytes } = require('node:crypto');
+    const ts = timestamp || Date.now();
+    const nonce = randomBytes(16).toString('hex');
+    const message = `${ts}.${nonce}.${payload}`;
+    const signature = createHmac('sha256', secretKey).update(message).digest('hex');
+    return {
+        'X-Zihin-Signature': `sha256=${signature}`,
+        'X-Zihin-Timestamp': ts.toString(),
+        'X-Zihin-Nonce': nonce,
+    };
+}
+//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AA8DH,0CAsEC;AAmCD,gDAkBC;AAwCD,4CA8CC;AAiBD,oDAqBC;AAgBD,kCAkBC;AArVD,yCAAqC;AAErC,8FAA8F;AAC9F,4FAA4F;AAE5F,+CAA+C;AAC/C,sCAAsC;AACtC,+CAA+C;AAE/C,MAAM,mBAAmB,GAAG;IAC3B,QAAQ,EAAE,0BAA0B;IACpC,OAAO,EAAE,uBAAuB;IAChC,gCAAgC,EAAE,0BAA0B;IAC5D,aAAa,EAAE,2BAA2B;IAC1C,aAAa,EAAE,8BAA8B;IAC7C,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,iBAAiB;IAC1B,SAAS,EAAE,kBAAkB;IAC7B,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,oBAAoB;CAC/B,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACzB,WAAW;IACX,cAAc;IACd,0BAA0B,EAAE,eAAe;IAC3C,iBAAiB,EAAE,yBAAyB;IAC5C,oBAAoB;CACpB,CAAC;AAEF,MAAM,qBAAqB,GAAG;IAC7B,cAAc;IACd,cAAc;IACd,sBAAsB;IACtB,kBAAkB;CAClB,CAAC;AAcF;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAC9B,GAAW,EACX,UAAgC,EAAE;IAElC,+BAA+B;IAC/B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,sBAAsB,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEjC,+CAA+C;QAC/C,MAAM,WAAW,GAChB,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,CAAC;QAE5E,6DAA6D;QAC7D,IAAI,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACtC,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO;gBACN,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,kDAAkD;aACzD,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;YACxE,CAAC;QACF,CAAC;QAED,qCAAqC;QACrC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;gBAChE,CAAC;YACF,CAAC;iBAAM,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;gBACrE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;YAChE,CAAC;QACF,CAAC;QAED,uEAAuE;QACvE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CAClE,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO;oBACN,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,gFAAgF;iBACvF,CAAC;YACH,CAAC;QACF,CAAC;QAED,wCAAwC;QACxC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACtD,CAAC;AACF,CAAC;AAaD,MAAM,cAAc,GAAkB;IACrC,cAAc,EAAE,GAAG,GAAG,IAAI,EAAE,QAAQ;IACpC,eAAe,EAAE,GAAG;IACpB,qBAAqB,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO;IACzC,oBAAoB,EAAE,GAAG,GAAG,IAAI,EAAE,QAAQ;CAC1C,CAAC;AAmMO,wCAAc;AArLvB;;GAEG;AACH,SAAgB,kBAAkB,CACjC,MAAc,EACd,SAAiC,EAAE;IAEnC,MAAM,eAAe,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,MAAM,CAAC,CAAC;IAE9B,IAAI,KAAK,GAAG,eAAe,CAAC,cAAc,EAAE,CAAC;QAC5C,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,gBAAgB,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,gCAAgC,IAAI,CAAC,KAAK,CACxF,eAAe,CAAC,cAAc,GAAG,IAAI,CACrC,KAAK;YACN,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;SAC/B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;AACzD,CAAC;AAED,+CAA+C;AAC/C,wBAAwB;AACxB,+CAA+C;AAE/C,sFAAsF;AACtF,gGAAgG;AAChG,MAAM,kBAAkB,GAAG;IAC1B,qCAAqC,EAAE,WAAW;IAClD,4BAA4B,EAAE,gBAAgB;IAC9C,kCAAkC,EAAE,oBAAoB;IACxD,gBAAgB,EAAE,eAAe;IACjC,qBAAqB,EAAE,yBAAyB;CAChD,CAAC;AAEF,MAAM,cAAc,GAA2B;IAC9C,mBAAmB,EAAE,mDAAmD;IACxE,YAAY,EAAE,2DAA2D;IACzE,SAAS,EACR,gIAAgI;IACjI,aAAa,EAAE,uCAAuC;IACtD,cAAc,EAAE,qDAAqD;IACrE,OAAO,EAAE,gDAAgD;IACzD,eAAe,EAAE,qDAAqD;IACtE,oBAAoB,EAAE,0DAA0D;IAChF,uBAAuB,EAAE,mDAAmD;IAC5E,eAAe,EAAE,gDAAgD;CACjE,CAAC;AASF;;GAEG;AACH,SAAgB,gBAAgB,CAAC,KAAc;IAC9C,IAAI,OAAO,GAAG,8BAA8B,CAAC;IAC7C,IAAI,IAAwB,CAAC;IAC7B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAA8B,CAAC;IAEnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAE7C,iFAAiF;QACjF,4FAA4F;QAC5F,MAAM,MAAM,GACX,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,KAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvF,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAY,CAAC;QAE/D,IAAI,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,EAAE,CAAC;YACzD,OAAO,GAAG,UAAU,CAAC;QACtB,CAAC;QAED,IAAI,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1D,SAAS,GAAG,IAAI,CAAC;YACjB,UAAU,GAAI,GAAG,CAAC,UAAqB,IAAI,EAAE,CAAC;QAC/C,CAAC;QAED,kFAAkF;QAClF,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAC1C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAC1C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1B,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,+CAA+C;AAC/C,wBAAwB;AACxB,+CAA+C;AAE/C,MAAM,eAAe,GAAG,wCAAwC,CAAC;AAQjE;;GAEG;AACH,SAAgB,oBAAoB,CAAC,MAAc;IAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAE9B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,6EAA6E;SACpF,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;QAClD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;YAChC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,KAAK,CAAC;IAEV,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACrC,CAAC;AAYD;;;GAGG;AACH,SAAgB,WAAW,CAC1B,OAAe,EACf,SAAiB,EACjB,SAAkB;IAElB,8DAA8D;IAC9D,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAC;IAC3F,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;IAE5C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhF,OAAO;QACN,mBAAmB,EAAE,UAAU,SAAS,EAAE;QAC1C,mBAAmB,EAAE,EAAE,CAAC,QAAQ,EAAE;QAClC,eAAe,EAAE,KAAK;KACtB,CAAC;AACH,CAAC"}

package/dist/sse.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Parser de Server-Sent Events. Converte o corpo (ReadableStream) num async iterator de
+ * eventos `{ event, data }`, com `data` já parseado de JSON quando possível.
+ *
+ * Robustez:
+ *  - limites de tamanho (maxEventBytes / maxTotalBytes) → aborta com `protocol` (anti-DoS de memória).
+ *  - parse incremental O(n) (sem replace global no buffer acumulado).
+ *  - `reader.cancel()` no finally → fecha a conexão mesmo em `break`/erro (sem socket vazado).
+ *
+ * @module sse
+ */
+export interface SseEvent {
+    event: string;
+    data: unknown;
+    rawData: string;
+}
+export interface ParseSseOptions {
+    /** Signal do chamador, para checagem de abort entre leituras. */
+    signal?: AbortSignal;
+    /** Traduz uma rejeição de read()/abort para o erro correto (timeout/aborted/network). */
+    onAbortError?: () => Error;
+    /** Chamado no finally (libera deadline/recursos). */
+    onEnd?: () => void;
+    maxEventBytes?: number;
+    maxTotalBytes?: number;
+}
+export declare function parseSse(response: Response, opts?: ParseSseOptions): AsyncGenerator<SseEvent>;