abtars 0.3.4-alpha.8 → 0.3.4

package/bundle/{chunk-LDUOOKQY.js → chunk-SJPUNDZ3.js}

@@ -5,21 +5,21 @@ import {
   readBridgeLockField,
   updateBridgeLockField,
   updateLastHeartbeat
-} from "./chunk-GRVWZO4C.js";
+} from "./chunk-KOSFXW2S.js";
 import {
   getEnv,
   init_env_schema
-} from "./chunk-65VCEC32.js";
+} from "./chunk-6PA5JBUU.js";
 import {
   init_log_and_swallow,
   logAndSwallow
-} from "./chunk-YSKCQH6E.js";
+} from "./chunk-2IYJ4I66.js";
 import {
   init_logger,
   logDebug,
   logInfo,
   logWarn
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 import {
   __esm,
   __export
@@ -260,4 +260,4 @@ export {
   heartbeat_system_exports,
   init_heartbeat_system
 };
-//# sourceMappingURL=chunk-LDUOOKQY.js.map
+//# sourceMappingURL=chunk-SJPUNDZ3.js.map

package/bundle/{chunk-LDUOOKQY.js.map → chunk-SJPUNDZ3.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/components/platform-detect.ts", "../src/components/heartbeat-system.ts"],
-  "sourcesContent": ["import { logAndSwallow } from \"./log-and-swallow.js\";\nimport { getEnv } from \"./env-schema.js\";\n/**\n * Platform-specific wake classification.\n * Detects whether a resume from sleep is a background wake (darkwake) or full user wake.\n *\n * Primary path: if bridge.lock.sleepStatus === \"hw_sleep\" (we put the machine to sleep),\n * use the sleep window to classify \u2014 inside window = dark (suppress), outside = full (morning restart).\n * No OS-specific parsing needed for the common case.\n *\n * Fallback: OS-specific detection for non-bridge-initiated sleeps (lid close, OS idle).\n */\nimport { execSync } from \"node:child_process\";\nimport { readFileSync } from \"node:fs\";\nimport { platform } from \"node:os\";\nimport { readBridgeLockField } from \"./transport/bridge-lock-transport.js\";\n\n/** #1265: WSL detection \u2014 cached at module load since the platform never changes at runtime.\n *  WSL kernels append \"microsoft\" or \"WSL\" to /proc/version. */\nlet _isWslCache: boolean | null = null;\nexport function isWsl(): boolean {\n  if (_isWslCache !== null) return _isWslCache;\n  try {\n    const version = readFileSync(\"/proc/version\", \"utf-8\").toLowerCase();\n    _isWslCache = version.includes(\"microsoft\") || version.includes(\"wsl\");\n  } catch {\n    _isWslCache = false;\n  }\n  return _isWslCache;\n}\n\n/** #1265: Standby gap threshold for WSL. Below 3h = host-sleep freeze (survived, no restart).\n *  Above 3h = network state likely stale (DNS, TCP keepalives), restart is justified. */\nexport const WSL_STANDBY_THRESHOLD_MS = 180 * 60 * 1000;\n\nexport type ResumeKind = \"dark\" | \"full\" | \"unknown\";\n\n/** Classify the current wake state. Fast, non-throwing. */\nexport function classifyResume(): ResumeKind {\n  // Primary: our own state \u2014 most reliable, no OS log parsing.\n  const status = readBridgeLockField<string>(\"sleepStatus\");\n  if (status === \"hw_sleep\") {\n    const hour = new Date().getHours();\n    const WAKE_HOUR = getEnv().wakeTime.hour;\n    const BED_HOUR = getEnv().bedTime.hour;\n    const inSleepWindow = (BED_HOUR < WAKE_HOUR)\n      ? (hour >= BED_HOUR && hour < WAKE_HOUR)\n      : (hour >= BED_HOUR || hour < WAKE_HOUR);\n    return inSleepWindow ? \"dark\" : \"full\";\n  }\n\n  // Fallback: OS-specific for non-bridge-initiated sleeps (lid close, idle).\n  const os = platform();\n  if (os === \"darwin\") return classifyMacOS();\n  if (os === \"linux\") return classifyLinux();\n  return \"unknown\";\n}\n\nfunction classifyMacOS(): ResumeKind {\n  try {\n    const out = execSync(\"pmset -g log 2>/dev/null\", { timeout: 3000, encoding: \"utf-8\" });\n    const lines = out.split(\"\\n\").filter(l => /\\bDarkWake\\b|\\bWake\\b/.test(l) && !l.includes(\"Notification\"));\n    const last = lines.at(-1) ?? \"\";\n    if (last.includes(\"DarkWake\")) return \"dark\";\n    if (last.includes(\"Wake\")) return \"full\";\n  } catch (err) { logAndSwallow(\"platform_detect\", \"op\", err); }\n  return \"unknown\";\n}\n\nfunction classifyLinux(): ResumeKind {\n  try {\n    // Check if systemd logged a suspend resume within the last 5 minutes.\n    // Linux has no darkwake \u2014 any suspend resume is a full wake.\n    const out = execSync(\n      \"journalctl -b -u systemd-suspend.service --since '5 min ago' --no-pager -q 2>/dev/null\",\n      { timeout: 3000, encoding: \"utf-8\" },\n    );\n    if (out.trim().length > 0) return \"full\";\n  } catch (err) { logAndSwallow(\"platform_detect\", \"op\", err); }\n  return \"unknown\";\n}\n", "import { logInfo, logWarn, logDebug } from \"./logger.js\";\nimport { isWsl, WSL_STANDBY_THRESHOLD_MS } from \"./platform-detect.js\";\nimport { updateLastHeartbeat, updateBridgeLockField } from \"./transport/bridge-lock-transport.js\";\nimport type { HeartbeatTask } from \"../types/index.js\";\n\nexport type HeartbeatConfig = {\n  enabled: boolean;\n  intervalMs: number;\n  bridgeLockPath: string;\n  /** When true, skip all heavy tasks (e.g. sleep in progress \u2014 avoid model rate limits). */\n  sleepActive?: () => boolean;\n  /** Called when standby resume detected (gap > interval\u00D73). Bridge should doctor + exit. */\n  onStandbyResume?: (gapMs: number) => void;\n  /** Called after every successful tick \u2014 used to kick the watchdog. */\n  onTick?: () => void;\n};\n\nconst TAG = \"heartbeat\";\nconst MIN_GUARD_MS = 3 * 60 * 1000; // 3 min minimum delay before first tick\n\nimport type { ITaskSlot } from \"./skeleton.js\";\n\nexport type TaskStatus = \"\u2713\" | \"\u2717\" | \"\u2014\" | \"?\";\n\nexport class HeartbeatSystem implements ITaskSlot {\n  private timer: ReturnType<typeof setInterval> | null = null;\n  private initTimeout: ReturnType<typeof setTimeout> | null = null;\n  private tasks: HeartbeatTask[] = [];\n  private running = false;\n  private lastTickAt = 0;\n  private tickCount = 0;\n  private readonly taskStatuses = new Map<string, TaskStatus>();\n  private _cronQueue: { enqueue: (entry: any, cb: any) => void } | null = null;\n  private _notify: ((chatId: string, text: string) => void) | null = null;\n\n  constructor(private config: HeartbeatConfig) {}\n\n  /** Late-bind: attach cronQueue after construction (used by graph boot). */\n  setCronQueue(queue: { enqueue: (entry: any, cb: any) => void }): void { this._cronQueue = queue; }\n  get cronQueue() { return this._cronQueue; }\n\n  /** Late-bind: attach notification sender after construction (used by graph boot). */\n  setNotify(fn: (chatId: string, text: string) => void): void { this._notify = fn; }\n  get notify() { return this._notify; }\n\n  /** Register a task to run on each heartbeat tick. */\n  registerTask(task: HeartbeatTask): void {\n    this.tasks.push(task);\n  }\n\n  /** Start the heartbeat loop, aligned to wall-clock boundaries. */\n  start(): void {\n    if (this.running) return;\n    if (!this.config.enabled) {\n      logInfo(TAG, \"Heartbeat disabled by configuration\");\n      return;\n    }\n\n    this.running = true;\n    const taskNames = this.tasks.map((t) => t.name).join(\", \");\n    const iv = this.config.intervalMs;\n\n    // Align to next clock boundary (ceil(now / interval) * interval)\n    const now = Date.now();\n    let nextBoundary = Math.ceil(now / iv) * iv;\n    let delay = nextBoundary - now;\n    if (delay < MIN_GUARD_MS) {\n      nextBoundary += iv;\n      delay += iv;\n    }\n\n    const firstTickAt = new Date(nextBoundary).toTimeString().slice(0, 8);\n    logInfo(TAG, `Starting heartbeat \u2014 interval=${iv}ms, first tick at ${firstTickAt} (${Math.round(delay / 1000)}s), tasks=[${taskNames}]`);\n\n    this.lastTickAt = now; // seed for standby detection\n    this.initTimeout = setTimeout(() => {\n      this.lastTickAt = Date.now();\n      void this.tick();\n      this.timer = setInterval(() => {\n        void this.tick();\n      }, iv);\n    }, delay);\n  }\n\n  /** Stop the heartbeat loop and clean up timers. */\n  stop(): void {\n    if (!this.running) return;\n    if (this.initTimeout !== null) { clearTimeout(this.initTimeout); this.initTimeout = null; }\n    if (this.timer !== null) { clearInterval(this.timer); this.timer = null; }\n    this.running = false;\n    logInfo(TAG, \"Heartbeat stopped\");\n  }\n\n  /** Whether the heartbeat loop is running. */\n  get isRunning(): boolean { return this.running; }\n\n  /** Configured interval in milliseconds. */\n  get intervalMs(): number { return this.config.intervalMs; }\n\n  /** Get registered task names. */\n  getTaskNames(): string[] {\n    return this.tasks.map(t => t.name);\n  }\n\n  /** Get last-run status for each task. */\n  getTaskStatuses(): ReadonlyMap<string, TaskStatus> {\n    return this.taskStatuses;\n  }\n\n  /** Execute all registered tasks with error isolation. */\n  private async tick(): Promise<void> {\n    const now = Date.now();\n    const gap = now - this.lastTickAt;\n    this.lastTickAt = now;\n\n    // Standby detection: gap > threshold means process was suspended\n    // #1265: on WSL, use 180min threshold (VM freeze from host sleep \u2260 real suspend).\n    // On real Linux/Mac, 3\u00D7 interval (180s) is sufficient.\n    const standbyThresholdMs = isWsl() ? WSL_STANDBY_THRESHOLD_MS : this.config.intervalMs * 3;\n    if (gap > standbyThresholdMs) {\n      const gapMin = Math.round(gap / 60000);\n      logInfo(TAG, `Standby resume detected \u2014 suspended ${gapMin}min`);\n      // Immediately update lastHeartbeat so external watchdog doesn't kill us\n      updateLastHeartbeat();\n      if (this.config.onStandbyResume) {\n        this.config.onStandbyResume(gap);\n        return; // skip all tasks this tick\n      }\n    }\n\n    logDebug(TAG, `Tick \u2014 executing ${this.tasks.length} task(s)`);\n    let heavyRan = false;\n    const sleepBlocking = this.config.sleepActive?.() ?? false;\n\n    for (const task of this.tasks) {\n      try {\n        if (task.heavy && (heavyRan || sleepBlocking)) {\n          logDebug(TAG, `Skipping heavy task \"${task.name}\" \u2014 ${sleepBlocking ? \"sleep in progress\" : \"another heavy task already ran\"}`);\n          this.taskStatuses.set(task.name, \"\u2014\");\n          continue;\n        }\n        const result = await task.execute();\n        if (task.heavy && result === true) heavyRan = true;\n        this.taskStatuses.set(task.name, \"\u2713\");\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : JSON.stringify(err);\n        logWarn(TAG, `Task \"${task.name}\" failed: ${msg}`);\n        this.taskStatuses.set(task.name, \"\u2717\");\n      }\n    }\n\n    // Update bridge.lock with lastHeartbeat\n    updateLastHeartbeat();\n\n    // Heap stats \u2014 once per hour (every 60 ticks)\n    this.tickCount++;\n    if (this.tickCount % 60 === 0) {\n      const heap = Math.round(process.memoryUsage().heapUsed / 1048576);\n      updateBridgeLockField(\"heapUsedMB\", heap);\n      if (heap > 820) {\n        logWarn(TAG, `Heap high: ${heap}MB / 1024MB (80%+)`);\n      } else {\n        logDebug(TAG, `Heap: ${heap}MB / 1024MB`);\n      }\n    }\n\n    // Kick the watchdog\n    this.config.onTick?.();\n  }\n}\n\n// #1181: Module-level singleton for local access (avoids circular dep via abmind)\nlet _instance: HeartbeatSystem | null = null;\nexport function setHeartbeatInstance(hb: HeartbeatSystem): void { _instance = hb; }\nexport function getHeartbeatInstance(): HeartbeatSystem | null { return _instance; }\n"],
+  "sourcesContent": ["import { logAndSwallow } from \"./log-and-swallow.js\";\nimport { getEnv } from \"./env-schema.js\";\n/**\n * Platform-specific wake classification.\n * Detects whether a resume from sleep is a background wake (darkwake) or full user wake.\n *\n * Primary path: if bridge.lock.sleepStatus === \"hw_sleep\" (we put the machine to sleep),\n * use the sleep window to classify \u2014 inside window = dark (suppress), outside = full (morning restart).\n * No OS-specific parsing needed for the common case.\n *\n * Fallback: OS-specific detection for non-bridge-initiated sleeps (lid close, OS idle).\n */\nimport { execSync } from \"node:child_process\";\nimport { readFileSync } from \"node:fs\";\nimport { platform } from \"node:os\";\nimport { readBridgeLockField } from \"./transport/bridge-lock-transport.js\";\n\n/** #1265: WSL detection \u2014 cached at module load since the platform never changes at runtime.\n *  WSL kernels append \"microsoft\" or \"WSL\" to /proc/version. */\nlet _isWslCache: boolean | null = null;\nexport function isWsl(): boolean {\n  if (_isWslCache !== null) return _isWslCache;\n  try {\n    const version = readFileSync(\"/proc/version\", \"utf-8\").toLowerCase();\n    _isWslCache = version.includes(\"microsoft\") || version.includes(\"wsl\");\n  } catch {\n    _isWslCache = false;\n  }\n  return _isWslCache;\n}\n\n/** #1265: Standby gap threshold for WSL. Below 3h = host-sleep freeze (survived, no restart).\n *  Above 3h = network state likely stale (DNS, TCP keepalives), restart is justified. */\nexport const WSL_STANDBY_THRESHOLD_MS = 180 * 60 * 1000;\n\nexport type ResumeKind = \"dark\" | \"full\" | \"unknown\";\n\n/** Classify the current wake state. Fast, non-throwing. */\nexport function classifyResume(): ResumeKind {\n  // Primary: our own state \u2014 most reliable, no OS log parsing.\n  const status = readBridgeLockField<string>(\"sleepStatus\");\n  if (status === \"hw_sleep\") {\n    const hour = new Date().getHours();\n    const WAKE_HOUR = getEnv().wakeTime.hour;\n    const BED_HOUR = getEnv().bedTime.hour;\n    const inSleepWindow = (BED_HOUR < WAKE_HOUR)\n      ? (hour >= BED_HOUR && hour < WAKE_HOUR)\n      : (hour >= BED_HOUR || hour < WAKE_HOUR);\n    return inSleepWindow ? \"dark\" : \"full\";\n  }\n\n  // Fallback: OS-specific for non-bridge-initiated sleeps (lid close, idle).\n  const os = platform();\n  if (os === \"darwin\") return classifyMacOS();\n  if (os === \"linux\") return classifyLinux();\n  return \"unknown\";\n}\n\nfunction classifyMacOS(): ResumeKind {\n  try {\n    const out = execSync(\"pmset -g log 2>/dev/null\", { timeout: 3000, encoding: \"utf-8\" });\n    const lines = out.split(\"\\n\").filter(l => /\\bDarkWake\\b|\\bWake\\b/.test(l) && !l.includes(\"Notification\"));\n    const last = lines.at(-1) ?? \"\";\n    if (last.includes(\"DarkWake\")) return \"dark\";\n    if (last.includes(\"Wake\")) return \"full\";\n  } catch (err) { logAndSwallow(\"platform_detect\", \"op\", err); }\n  return \"unknown\";\n}\n\nfunction classifyLinux(): ResumeKind {\n  try {\n    // Check if systemd logged a suspend resume within the last 5 minutes.\n    // Linux has no darkwake \u2014 any suspend resume is a full wake.\n    const out = execSync(\n      \"journalctl -b -u systemd-suspend.service --since '5 min ago' --no-pager -q 2>/dev/null\",\n      { timeout: 3000, encoding: \"utf-8\" },\n    );\n    if (out.trim().length > 0) return \"full\";\n  } catch (err) { logAndSwallow(\"platform_detect\", \"op\", err); }\n  return \"unknown\";\n}\n", "import { logInfo, logWarn, logDebug } from \"./logger.js\";\nimport { isWsl, WSL_STANDBY_THRESHOLD_MS } from \"./platform-detect.js\";\nimport { updateLastHeartbeat, updateBridgeLockField } from \"./transport/bridge-lock-transport.js\";\nimport type { HeartbeatTask } from \"../types/index.js\";\n\nexport type HeartbeatConfig = {\n  enabled: boolean;\n  intervalMs: number;\n  bridgeLockPath: string;\n  /** When true, skip all heavy tasks (e.g. sleep in progress \u2014 avoid model rate limits). */\n  sleepActive?: () => boolean;\n  /** Called when standby resume detected (gap > interval\u00D73). Bridge should exit (watchdog respawns). */\n  onStandbyResume?: (gapMs: number) => void;\n  /** Called after every successful tick \u2014 used to kick the watchdog. */\n  onTick?: () => void;\n};\n\nconst TAG = \"heartbeat\";\nconst MIN_GUARD_MS = 3 * 60 * 1000; // 3 min minimum delay before first tick\n\nimport type { ITaskSlot } from \"./skeleton.js\";\n\nexport type TaskStatus = \"\u2713\" | \"\u2717\" | \"\u2014\" | \"?\";\n\nexport class HeartbeatSystem implements ITaskSlot {\n  private timer: ReturnType<typeof setInterval> | null = null;\n  private initTimeout: ReturnType<typeof setTimeout> | null = null;\n  private tasks: HeartbeatTask[] = [];\n  private running = false;\n  private lastTickAt = 0;\n  private tickCount = 0;\n  private readonly taskStatuses = new Map<string, TaskStatus>();\n  private _cronQueue: { enqueue: (entry: any, cb: any) => void } | null = null;\n  private _notify: ((chatId: string, text: string) => void) | null = null;\n\n  constructor(private config: HeartbeatConfig) {}\n\n  /** Late-bind: attach cronQueue after construction (used by graph boot). */\n  setCronQueue(queue: { enqueue: (entry: any, cb: any) => void }): void { this._cronQueue = queue; }\n  get cronQueue() { return this._cronQueue; }\n\n  /** Late-bind: attach notification sender after construction (used by graph boot). */\n  setNotify(fn: (chatId: string, text: string) => void): void { this._notify = fn; }\n  get notify() { return this._notify; }\n\n  /** Register a task to run on each heartbeat tick. */\n  registerTask(task: HeartbeatTask): void {\n    this.tasks.push(task);\n  }\n\n  /** Start the heartbeat loop, aligned to wall-clock boundaries. */\n  start(): void {\n    if (this.running) return;\n    if (!this.config.enabled) {\n      logInfo(TAG, \"Heartbeat disabled by configuration\");\n      return;\n    }\n\n    this.running = true;\n    const taskNames = this.tasks.map((t) => t.name).join(\", \");\n    const iv = this.config.intervalMs;\n\n    // Align to next clock boundary (ceil(now / interval) * interval)\n    const now = Date.now();\n    let nextBoundary = Math.ceil(now / iv) * iv;\n    let delay = nextBoundary - now;\n    if (delay < MIN_GUARD_MS) {\n      nextBoundary += iv;\n      delay += iv;\n    }\n\n    const firstTickAt = new Date(nextBoundary).toTimeString().slice(0, 8);\n    logInfo(TAG, `Starting heartbeat \u2014 interval=${iv}ms, first tick at ${firstTickAt} (${Math.round(delay / 1000)}s), tasks=[${taskNames}]`);\n\n    this.lastTickAt = now; // seed for standby detection\n    this.initTimeout = setTimeout(() => {\n      this.lastTickAt = Date.now();\n      void this.tick();\n      this.timer = setInterval(() => {\n        void this.tick();\n      }, iv);\n    }, delay);\n  }\n\n  /** Stop the heartbeat loop and clean up timers. */\n  stop(): void {\n    if (!this.running) return;\n    if (this.initTimeout !== null) { clearTimeout(this.initTimeout); this.initTimeout = null; }\n    if (this.timer !== null) { clearInterval(this.timer); this.timer = null; }\n    this.running = false;\n    logInfo(TAG, \"Heartbeat stopped\");\n  }\n\n  /** Whether the heartbeat loop is running. */\n  get isRunning(): boolean { return this.running; }\n\n  /** Configured interval in milliseconds. */\n  get intervalMs(): number { return this.config.intervalMs; }\n\n  /** Get registered task names. */\n  getTaskNames(): string[] {\n    return this.tasks.map(t => t.name);\n  }\n\n  /** Get last-run status for each task. */\n  getTaskStatuses(): ReadonlyMap<string, TaskStatus> {\n    return this.taskStatuses;\n  }\n\n  /** Execute all registered tasks with error isolation. */\n  private async tick(): Promise<void> {\n    const now = Date.now();\n    const gap = now - this.lastTickAt;\n    this.lastTickAt = now;\n\n    // Standby detection: gap > threshold means process was suspended\n    // #1265: on WSL, use 180min threshold (VM freeze from host sleep \u2260 real suspend).\n    // On real Linux/Mac, 3\u00D7 interval (180s) is sufficient.\n    const standbyThresholdMs = isWsl() ? WSL_STANDBY_THRESHOLD_MS : this.config.intervalMs * 3;\n    if (gap > standbyThresholdMs) {\n      const gapMin = Math.round(gap / 60000);\n      logInfo(TAG, `Standby resume detected \u2014 suspended ${gapMin}min`);\n      // Immediately update lastHeartbeat so external watchdog doesn't kill us\n      updateLastHeartbeat();\n      if (this.config.onStandbyResume) {\n        this.config.onStandbyResume(gap);\n        return; // skip all tasks this tick\n      }\n    }\n\n    logDebug(TAG, `Tick \u2014 executing ${this.tasks.length} task(s)`);\n    let heavyRan = false;\n    const sleepBlocking = this.config.sleepActive?.() ?? false;\n\n    for (const task of this.tasks) {\n      try {\n        if (task.heavy && (heavyRan || sleepBlocking)) {\n          logDebug(TAG, `Skipping heavy task \"${task.name}\" \u2014 ${sleepBlocking ? \"sleep in progress\" : \"another heavy task already ran\"}`);\n          this.taskStatuses.set(task.name, \"\u2014\");\n          continue;\n        }\n        const result = await task.execute();\n        if (task.heavy && result === true) heavyRan = true;\n        this.taskStatuses.set(task.name, \"\u2713\");\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : JSON.stringify(err);\n        logWarn(TAG, `Task \"${task.name}\" failed: ${msg}`);\n        this.taskStatuses.set(task.name, \"\u2717\");\n      }\n    }\n\n    // Update bridge.lock with lastHeartbeat\n    updateLastHeartbeat();\n\n    // Heap stats \u2014 once per hour (every 60 ticks)\n    this.tickCount++;\n    if (this.tickCount % 60 === 0) {\n      const heap = Math.round(process.memoryUsage().heapUsed / 1048576);\n      updateBridgeLockField(\"heapUsedMB\", heap);\n      if (heap > 820) {\n        logWarn(TAG, `Heap high: ${heap}MB / 1024MB (80%+)`);\n      } else {\n        logDebug(TAG, `Heap: ${heap}MB / 1024MB`);\n      }\n    }\n\n    // Kick the watchdog\n    this.config.onTick?.();\n  }\n}\n\n// #1181: Module-level singleton for local access (avoids circular dep via abmind)\nlet _instance: HeartbeatSystem | null = null;\nexport function setHeartbeatInstance(hb: HeartbeatSystem): void { _instance = hb; }\nexport function getHeartbeatInstance(): HeartbeatSystem | null { return _instance; }\n"],
   "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,SAAS,gBAAgB;AACzB,SAAS,oBAAoB;AAC7B,SAAS,gBAAgB;AAMlB,SAAS,QAAiB;AAC/B,MAAI,gBAAgB,KAAM,QAAO;AACjC,MAAI;AACF,UAAM,UAAU,aAAa,iBAAiB,OAAO,EAAE,YAAY;AACnE,kBAAc,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,KAAK;AAAA,EACvE,QAAQ;AACN,kBAAc;AAAA,EAChB;AACA,SAAO;AACT;AASO,SAAS,iBAA6B;AAE3C,QAAM,SAAS,oBAA4B,aAAa;AACxD,MAAI,WAAW,YAAY;AACzB,UAAM,QAAO,oBAAI,KAAK,GAAE,SAAS;AACjC,UAAM,YAAY,OAAO,EAAE,SAAS;AACpC,UAAM,WAAW,OAAO,EAAE,QAAQ;AAClC,UAAM,gBAAiB,WAAW,YAC7B,QAAQ,YAAY,OAAO,YAC3B,QAAQ,YAAY,OAAO;AAChC,WAAO,gBAAgB,SAAS;AAAA,EAClC;AAGA,QAAM,KAAK,SAAS;AACpB,MAAI,OAAO,SAAU,QAAO,cAAc;AAC1C,MAAI,OAAO,QAAS,QAAO,cAAc;AACzC,SAAO;AACT;AAEA,SAAS,gBAA4B;AACnC,MAAI;AACF,UAAM,MAAM,SAAS,4BAA4B,EAAE,SAAS,KAAM,UAAU,QAAQ,CAAC;AACrF,UAAM,QAAQ,IAAI,MAAM,IAAI,EAAE,OAAO,OAAK,wBAAwB,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,CAAC;AACxG,UAAM,OAAO,MAAM,GAAG,EAAE,KAAK;AAC7B,QAAI,KAAK,SAAS,UAAU,EAAG,QAAO;AACtC,QAAI,KAAK,SAAS,MAAM,EAAG,QAAO;AAAA,EACpC,SAAS,KAAK;AAAE,kBAAc,mBAAmB,MAAM,GAAG;AAAA,EAAG;AAC7D,SAAO;AACT;AAEA,SAAS,gBAA4B;AACnC,MAAI;AAGF,UAAM,MAAM;AAAA,MACV;AAAA,MACA,EAAE,SAAS,KAAM,UAAU,QAAQ;AAAA,IACrC;AACA,QAAI,IAAI,KAAK,EAAE,SAAS,EAAG,QAAO;AAAA,EACpC,SAAS,KAAK;AAAE,kBAAc,mBAAmB,MAAM,GAAG;AAAA,EAAG;AAC7D,SAAO;AACT;AAhFA,IAmBI,aAcS;AAjCb;AAAA;AAAA;AAAA;AACA;AAcA;AAIA,IAAI,cAA8B;AAc3B,IAAM,2BAA2B,MAAM,KAAK;AAAA;AAAA;;;ACjCnD;AAAA;AAAA;AAAA;AAAA;AAAA;AA6KO,SAAS,qBAAqB,IAA2B;AAAE,cAAY;AAAI;AAC3E,SAAS,uBAA+C;AAAE,SAAO;AAAW;AA9KnF,IAiBM,KACA,cAMO,iBAoJT;AA5KJ;AAAA;AAAA;AACA;AACA;AAeA,IAAM,MAAM;AACZ,IAAM,eAAe,IAAI,KAAK;AAMvB,IAAM,kBAAN,MAA2C;AAAA,MAWhD,YAAoB,QAAyB;AAAzB;AAAA,MAA0B;AAAA,MAVtC,QAA+C;AAAA,MAC/C,cAAoD;AAAA,MACpD,QAAyB,CAAC;AAAA,MAC1B,UAAU;AAAA,MACV,aAAa;AAAA,MACb,YAAY;AAAA,MACH,eAAe,oBAAI,IAAwB;AAAA,MACpD,aAAgE;AAAA,MAChE,UAA2D;AAAA;AAAA,MAKnE,aAAa,OAAyD;AAAE,aAAK,aAAa;AAAA,MAAO;AAAA,MACjG,IAAI,YAAY;AAAE,eAAO,KAAK;AAAA,MAAY;AAAA;AAAA,MAG1C,UAAU,IAAkD;AAAE,aAAK,UAAU;AAAA,MAAI;AAAA,MACjF,IAAI,SAAS;AAAE,eAAO,KAAK;AAAA,MAAS;AAAA;AAAA,MAGpC,aAAa,MAA2B;AACtC,aAAK,MAAM,KAAK,IAAI;AAAA,MACtB;AAAA;AAAA,MAGA,QAAc;AACZ,YAAI,KAAK,QAAS;AAClB,YAAI,CAAC,KAAK,OAAO,SAAS;AACxB,kBAAQ,KAAK,qCAAqC;AAClD;AAAA,QACF;AAEA,aAAK,UAAU;AACf,cAAM,YAAY,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI;AACzD,cAAM,KAAK,KAAK,OAAO;AAGvB,cAAM,MAAM,KAAK,IAAI;AACrB,YAAI,eAAe,KAAK,KAAK,MAAM,EAAE,IAAI;AACzC,YAAI,QAAQ,eAAe;AAC3B,YAAI,QAAQ,cAAc;AACxB,0BAAgB;AAChB,mBAAS;AAAA,QACX;AAEA,cAAM,cAAc,IAAI,KAAK,YAAY,EAAE,aAAa,EAAE,MAAM,GAAG,CAAC;AACpE,gBAAQ,KAAK,sCAAiC,EAAE,qBAAqB,WAAW,KAAK,KAAK,MAAM,QAAQ,GAAI,CAAC,cAAc,SAAS,GAAG;AAEvI,aAAK,aAAa;AAClB,aAAK,cAAc,WAAW,MAAM;AAClC,eAAK,aAAa,KAAK,IAAI;AAC3B,eAAK,KAAK,KAAK;AACf,eAAK,QAAQ,YAAY,MAAM;AAC7B,iBAAK,KAAK,KAAK;AAAA,UACjB,GAAG,EAAE;AAAA,QACP,GAAG,KAAK;AAAA,MACV;AAAA;AAAA,MAGA,OAAa;AACX,YAAI,CAAC,KAAK,QAAS;AACnB,YAAI,KAAK,gBAAgB,MAAM;AAAE,uBAAa,KAAK,WAAW;AAAG,eAAK,cAAc;AAAA,QAAM;AAC1F,YAAI,KAAK,UAAU,MAAM;AAAE,wBAAc,KAAK,KAAK;AAAG,eAAK,QAAQ;AAAA,QAAM;AACzE,aAAK,UAAU;AACf,gBAAQ,KAAK,mBAAmB;AAAA,MAClC;AAAA;AAAA,MAGA,IAAI,YAAqB;AAAE,eAAO,KAAK;AAAA,MAAS;AAAA;AAAA,MAGhD,IAAI,aAAqB;AAAE,eAAO,KAAK,OAAO;AAAA,MAAY;AAAA;AAAA,MAG1D,eAAyB;AACvB,eAAO,KAAK,MAAM,IAAI,OAAK,EAAE,IAAI;AAAA,MACnC;AAAA;AAAA,MAGA,kBAAmD;AACjD,eAAO,KAAK;AAAA,MACd;AAAA;AAAA,MAGA,MAAc,OAAsB;AAClC,cAAM,MAAM,KAAK,IAAI;AACrB,cAAM,MAAM,MAAM,KAAK;AACvB,aAAK,aAAa;AAKlB,cAAM,qBAAqB,MAAM,IAAI,2BAA2B,KAAK,OAAO,aAAa;AACzF,YAAI,MAAM,oBAAoB;AAC5B,gBAAM,SAAS,KAAK,MAAM,MAAM,GAAK;AACrC,kBAAQ,KAAK,4CAAuC,MAAM,KAAK;AAE/D,8BAAoB;AACpB,cAAI,KAAK,OAAO,iBAAiB;AAC/B,iBAAK,OAAO,gBAAgB,GAAG;AAC/B;AAAA,UACF;AAAA,QACF;AAEA,iBAAS,KAAK,yBAAoB,KAAK,MAAM,MAAM,UAAU;AAC7D,YAAI,WAAW;AACf,cAAM,gBAAgB,KAAK,OAAO,cAAc,KAAK;AAErD,mBAAW,QAAQ,KAAK,OAAO;AAC7B,cAAI;AACF,gBAAI,KAAK,UAAU,YAAY,gBAAgB;AAC7C,uBAAS,KAAK,wBAAwB,KAAK,IAAI,YAAO,gBAAgB,sBAAsB,gCAAgC,EAAE;AAC9H,mBAAK,aAAa,IAAI,KAAK,MAAM,QAAG;AACpC;AAAA,YACF;AACA,kBAAM,SAAS,MAAM,KAAK,QAAQ;AAClC,gBAAI,KAAK,SAAS,WAAW,KAAM,YAAW;AAC9C,iBAAK,aAAa,IAAI,KAAK,MAAM,QAAG;AAAA,UACtC,SAAS,KAAK;AACZ,kBAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,KAAK,UAAU,GAAG;AACnE,oBAAQ,KAAK,SAAS,KAAK,IAAI,aAAa,GAAG,EAAE;AACjD,iBAAK,aAAa,IAAI,KAAK,MAAM,QAAG;AAAA,UACtC;AAAA,QACF;AAGA,4BAAoB;AAGpB,aAAK;AACL,YAAI,KAAK,YAAY,OAAO,GAAG;AAC7B,gBAAM,OAAO,KAAK,MAAM,QAAQ,YAAY,EAAE,WAAW,OAAO;AAChE,gCAAsB,cAAc,IAAI;AACxC,cAAI,OAAO,KAAK;AACd,oBAAQ,KAAK,cAAc,IAAI,oBAAoB;AAAA,UACrD,OAAO;AACL,qBAAS,KAAK,SAAS,IAAI,aAAa;AAAA,UAC1C;AAAA,QACF;AAGA,aAAK,OAAO,SAAS;AAAA,MACvB;AAAA,IACF;AAGA,IAAI,YAAoC;AAAA;AAAA;",
   "names": []
 }

package/bundle/{chunk-JQDJPUHM.js → chunk-TWB2ZGVH.js}

@@ -3,7 +3,7 @@
 import {
   init_log_and_swallow,
   logAndSwallow
-} from "./chunk-YSKCQH6E.js";
+} from "./chunk-2IYJ4I66.js";
 
 // src/boot/ctx-start.ts
 init_log_and_swallow();
@@ -48,4 +48,4 @@ export {
   updateCtxStart,
   resetAllCtxStarts
 };
-//# sourceMappingURL=chunk-JQDJPUHM.js.map
+//# sourceMappingURL=chunk-TWB2ZGVH.js.map

package/bundle/{chunk-IJT4KWXT.js → chunk-U4U47YE7.js}

@@ -4,7 +4,7 @@ import {
   init_logger,
   logDebug,
   logWarn
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 
 // src/components/sha-tracker.ts
 init_logger();
@@ -170,4 +170,4 @@ export {
   isPolicyCorrupt,
   reload
 };
-//# sourceMappingURL=chunk-IJT4KWXT.js.map
+//# sourceMappingURL=chunk-U4U47YE7.js.map

package/bundle/{chunk-2FAZIA37.js → chunk-W546CU3A.js}

@@ -2,10 +2,10 @@
  import { createRequire as __bundleCreateRequire } from 'node:module'; import { fileURLToPath as __bundleFileURLToPath } from 'node:url'; import { dirname as __bundleDirname } from 'node:path'; const require = __bundleCreateRequire(import.meta.url); const __chunk_filename = __bundleFileURLToPath(import.meta.url); const __chunk_dirname = __bundleDirname(__chunk_filename);
 import {
   init_log_and_swallow
-} from "./chunk-YSKCQH6E.js";
+} from "./chunk-2IYJ4I66.js";
 import {
   init_logger
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 
 // src/components/command-registry.ts
 var BOT_COMMANDS = [
@@ -279,4 +279,4 @@ export {
   emojiToScore,
   emojiToTag
 };
-//# sourceMappingURL=chunk-2FAZIA37.js.map
+//# sourceMappingURL=chunk-W546CU3A.js.map

package/bundle/chunk-WC5O5KOE.js

@@ -0,0 +1,211 @@
+#!/usr/bin/env node
+ import { createRequire as __bundleCreateRequire } from 'node:module'; import { fileURLToPath as __bundleFileURLToPath } from 'node:url'; import { dirname as __bundleDirname } from 'node:path'; const require = __bundleCreateRequire(import.meta.url); const __chunk_filename = __bundleFileURLToPath(import.meta.url); const __chunk_dirname = __bundleDirname(__chunk_filename);
+import {
+  __esm,
+  __export,
+  __require
+} from "./chunk-7K2YZTLD.js";
+
+// src/components/peer-transport/peer-auth.ts
+var peer_auth_exports = {};
+__export(peer_auth_exports, {
+  generateTlsCert: () => generateTlsCert,
+  isNonceSeen: () => isNonceSeen,
+  macTribe: () => macTribe,
+  recordNonce: () => recordNonce,
+  signAck: () => signAck,
+  signEnroll: () => signEnroll,
+  signRequest: () => signRequest,
+  verifyAck: () => verifyAck,
+  verifyEnroll: () => verifyEnroll,
+  verifyRequest: () => verifyRequest,
+  verifyServerCert: () => verifyServerCert
+});
+import {
+  createPrivateKey,
+  createPublicKey,
+  sign as cryptoSign,
+  verify as cryptoVerify,
+  createHmac,
+  createHash,
+  randomBytes,
+  timingSafeEqual
+} from "node:crypto";
+import { execSync } from "node:child_process";
+import { writeFileSync, readFileSync, unlinkSync, mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+function pruneNonces() {
+  const cutoff = Date.now() - NONCE_TTL_MS;
+  for (const [nonce, ts] of nonceCache) {
+    if (ts < cutoff) nonceCache.delete(nonce);
+  }
+}
+function isNonceSeen(nonce) {
+  pruneNonces();
+  return nonceCache.has(nonce);
+}
+function recordNonce(nonce) {
+  nonceCache.set(nonce, Date.now());
+}
+function importPrivKey(signingKey) {
+  return createPrivateKey({ key: Buffer.from(signingKey, "base64"), format: "der", type: "pkcs8" });
+}
+function importPubKey(verifyKey) {
+  return createPublicKey({ key: Buffer.from(verifyKey, "base64"), format: "der", type: "spki" });
+}
+function edSign(signingKey, message) {
+  return cryptoSign(null, Buffer.from(message, "utf-8"), importPrivKey(signingKey)).toString("base64");
+}
+function edVerify(verifyKey, message, sigBase64) {
+  try {
+    return cryptoVerify(null, Buffer.from(message, "utf-8"), importPubKey(verifyKey), Buffer.from(sigBase64, "base64"));
+  } catch {
+    return false;
+  }
+}
+function signRequest(method, path, body, signingKey, selfName) {
+  const ts = String(Math.floor(Date.now() / 1e3));
+  const nonce = randomBytes(16).toString("hex");
+  const bodyHash = createHash("sha256").update(body, "utf-8").digest("hex");
+  const canonical = `abtars-req-v1
+${method}
+${path}
+${ts}
+${nonce}
+${bodyHash}`;
+  const sig = edSign(signingKey, canonical);
+  return {
+    "X-Peer-Id": selfName,
+    "X-Peer-Ts": ts,
+    "X-Peer-Nonce": nonce,
+    "X-Peer-Sig": sig
+  };
+}
+function verifyRequest(headers, method, path, body, verifyKey) {
+  const h = {};
+  for (const [k, v] of Object.entries(headers)) h[k.toLowerCase()] = v;
+  const peerId = h["x-peer-id"];
+  const tsHeader = h["x-peer-ts"];
+  const nonce = h["x-peer-nonce"];
+  const sig = h["x-peer-sig"];
+  if (typeof peerId !== "string" || typeof tsHeader !== "string" || typeof nonce !== "string" || typeof sig !== "string") {
+    return { ok: false, reason: "missing_headers" };
+  }
+  const ts = parseInt(tsHeader, 10);
+  if (isNaN(ts)) return { ok: false, reason: "invalid_ts" };
+  const nowSec = Math.floor(Date.now() / 1e3);
+  if (Math.abs(nowSec - ts) > 30) return { ok: false, reason: "stale_ts" };
+  if (isNonceSeen(nonce)) return { ok: false, reason: "nonce_replay" };
+  const bodyHash = createHash("sha256").update(body, "utf-8").digest("hex");
+  const canonical = `abtars-req-v1
+${method}
+${path}
+${tsHeader}
+${nonce}
+${bodyHash}`;
+  if (!edVerify(verifyKey, canonical, sig)) return { ok: false, reason: "bad_sig" };
+  recordNonce(nonce);
+  return { ok: true };
+}
+function macTribe(tribeToken, ...parts) {
+  return createHmac("sha256", Buffer.from(tribeToken, "base64")).update(parts.join("")).digest("hex");
+}
+function signEnroll(signingKey, pubKeyI, nonceR, name) {
+  const canonical = `abtars-enroll-v1
+${pubKeyI}
+${nonceR}
+${name}`;
+  return edSign(signingKey, canonical);
+}
+function verifyEnroll(selfSig, verifyKey, pubKeyI, nonceR, name) {
+  const canonical = `abtars-enroll-v1
+${pubKeyI}
+${nonceR}
+${name}`;
+  return edVerify(verifyKey, canonical, selfSig);
+}
+function signAck(signingKey, nameR, pubKeyR, nonceR) {
+  const canonical = `abtars-enroll-v1
+ack
+${nameR}
+${pubKeyR}
+${nonceR}`;
+  return edSign(signingKey, canonical);
+}
+function verifyAck(ackSig, verifyKey, nameR, pubKeyR, nonceR) {
+  const canonical = `abtars-enroll-v1
+ack
+${nameR}
+${pubKeyR}
+${nonceR}`;
+  return edVerify(verifyKey, canonical, ackSig);
+}
+function generateTlsCert(signingKey, cn) {
+  const tmpDir = join(tmpdir(), `abtars-tls-${randomBytes(8).toString("hex")}`);
+  mkdirSync(tmpDir, { recursive: true });
+  const keyPemPath = join(tmpDir, "key.pem");
+  const certPath = join(tmpDir, "cert.pem");
+  try {
+    const privKeyObj = importPrivKey(signingKey);
+    const keyPem = privKeyObj.export({ type: "pkcs8", format: "pem" });
+    writeFileSync(keyPemPath, keyPem, { mode: 384 });
+    const safeCn = cn.replace(/[^A-Za-z0-9_\-.]/g, "_").slice(0, 64);
+    execSync(
+      `openssl req -x509 -key "${keyPemPath}" -out "${certPath}" -days 3650 -nodes -subj "/CN=${safeCn}"`,
+      { stdio: "pipe" }
+    );
+    const key = readFileSync(keyPemPath, "utf-8");
+    const cert = readFileSync(certPath, "utf-8");
+    return { key, cert };
+  } finally {
+    try {
+      unlinkSync(keyPemPath);
+    } catch {
+    }
+    try {
+      unlinkSync(certPath);
+    } catch {
+    }
+    try {
+      __require("node:fs").rmdirSync(tmpDir);
+    } catch {
+    }
+  }
+}
+function verifyServerCert(cert, verifyKey) {
+  try {
+    const keyObj = createPublicKey({ key: cert, format: "pem" });
+    const certSpki = keyObj.export({ type: "spki", format: "der" }).toString("base64");
+    const expected = Buffer.from(verifyKey, "base64");
+    const actual = Buffer.from(certSpki, "base64");
+    if (expected.length !== actual.length) return false;
+    return timingSafeEqual(expected, actual);
+  } catch {
+    return false;
+  }
+}
+var nonceCache, NONCE_TTL_MS;
+var init_peer_auth = __esm({
+  "src/components/peer-transport/peer-auth.ts"() {
+    nonceCache = /* @__PURE__ */ new Map();
+    NONCE_TTL_MS = 6e4;
+  }
+});
+
+export {
+  isNonceSeen,
+  recordNonce,
+  signRequest,
+  verifyRequest,
+  macTribe,
+  signEnroll,
+  verifyEnroll,
+  signAck,
+  verifyAck,
+  generateTlsCert,
+  verifyServerCert,
+  peer_auth_exports,
+  init_peer_auth
+};
+//# sourceMappingURL=chunk-WC5O5KOE.js.map

package/bundle/chunk-WC5O5KOE.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/components/peer-transport/peer-auth.ts"],
+  "sourcesContent": ["/**\n * peer-auth.ts \u2014 Ed25519 request signing, gossip, enrollment, and TLS helpers (#1293).\n *\n * Auth model (Option A): one Ed25519 keypair per host.\n * - Request signing: whole-request Ed25519 signature on every inbound/outbound peer route.\n * - TLS: self-signed cert whose key IS the identity key (confidentiality + server identity).\n * - Gossip: Ed25519-signed UDP packets.\n * - Enrollment: HMAC-SHA256 challenge-response using shared tribeToken.\n */\n\nimport {\n  createPrivateKey,\n  createPublicKey,\n  sign as cryptoSign,\n  verify as cryptoVerify,\n  createHmac,\n  createHash,\n  randomBytes,\n  timingSafeEqual,\n} from \"node:crypto\";\nimport { execSync } from \"node:child_process\";\nimport { writeFileSync, readFileSync, unlinkSync, mkdirSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\n\n// \u2500\u2500 Nonce cache (replay prevention) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst nonceCache = new Map<string, number>(); // nonce \u2192 timestamp (ms)\nconst NONCE_TTL_MS = 60_000; // 60s \u2014 must be >= 30s ts window\n\nfunction pruneNonces(): void {\n  const cutoff = Date.now() - NONCE_TTL_MS;\n  for (const [nonce, ts] of nonceCache) {\n    if (ts < cutoff) nonceCache.delete(nonce);\n  }\n}\n\nexport function isNonceSeen(nonce: string): boolean {\n  pruneNonces();\n  return nonceCache.has(nonce);\n}\n\nexport function recordNonce(nonce: string): void {\n  nonceCache.set(nonce, Date.now());\n}\n\n// \u2500\u2500 Key helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** Import a base64 PKCS8 DER private key into a KeyObject. */\nfunction importPrivKey(signingKey: string): ReturnType<typeof createPrivateKey> {\n  return createPrivateKey({ key: Buffer.from(signingKey, \"base64\"), format: \"der\", type: \"pkcs8\" });\n}\n\n/** Import a base64 SPKI DER public key into a KeyObject. */\nfunction importPubKey(verifyKey: string): ReturnType<typeof createPublicKey> {\n  return createPublicKey({ key: Buffer.from(verifyKey, \"base64\"), format: \"der\", type: \"spki\" });\n}\n\n/** Ed25519 sign: returns base64-encoded signature. */\nfunction edSign(signingKey: string, message: string): string {\n  // Ed25519 uses null algorithm (prehash-free)\n  return cryptoSign(null, Buffer.from(message, \"utf-8\"), importPrivKey(signingKey)).toString(\"base64\");\n}\n\n/** Ed25519 verify: returns true if signature is valid. */\nfunction edVerify(verifyKey: string, message: string, sigBase64: string): boolean {\n  try {\n    return cryptoVerify(null, Buffer.from(message, \"utf-8\"), importPubKey(verifyKey), Buffer.from(sigBase64, \"base64\"));\n  } catch {\n    return false;\n  }\n}\n\n// \u2500\u2500 Request signing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst TS_WINDOW_MS = 30_000; // reject requests older than 30s\n\n/**\n * Sign an outbound request. Returns headers to attach.\n *\n * Canonical string:\n *   \"abtars-req-v1\\n\" + method + \"\\n\" + path + \"\\n\" + ts + \"\\n\" + nonce + \"\\n\" + hex(sha256(body))\n */\nexport function signRequest(\n  method: string,\n  path: string,\n  body: string,\n  signingKey: string,\n  selfName: string,\n): Record<string, string> {\n  const ts = String(Math.floor(Date.now() / 1000));\n  const nonce = randomBytes(16).toString(\"hex\");\n  const bodyHash = createHash(\"sha256\").update(body, \"utf-8\").digest(\"hex\");\n  const canonical = `abtars-req-v1\\n${method}\\n${path}\\n${ts}\\n${nonce}\\n${bodyHash}`;\n  const sig = edSign(signingKey, canonical);\n  return {\n    \"X-Peer-Id\": selfName,\n    \"X-Peer-Ts\": ts,\n    \"X-Peer-Nonce\": nonce,\n    \"X-Peer-Sig\": sig,\n  };\n}\n\nexport interface VerifyRequestResult {\n  ok: boolean;\n  reason?: string;\n}\n\n/**\n * Verify an inbound request's Ed25519 signature.\n */\nexport function verifyRequest(\n  headers: Record<string, string | string[] | undefined>,\n  method: string,\n  path: string,\n  body: string,\n  verifyKey: string,\n): VerifyRequestResult {\n  // Normalize to lowercase for compatibility with Node.js HTTP (which lowercases headers)\n  const h: Record<string, string | string[] | undefined> = {};\n  for (const [k, v] of Object.entries(headers)) h[k.toLowerCase()] = v;\n\n  const peerId = h[\"x-peer-id\"];\n  const tsHeader = h[\"x-peer-ts\"];\n  const nonce = h[\"x-peer-nonce\"];\n  const sig = h[\"x-peer-sig\"];\n\n  if (\n    typeof peerId !== \"string\" ||\n    typeof tsHeader !== \"string\" ||\n    typeof nonce !== \"string\" ||\n    typeof sig !== \"string\"\n  ) {\n    return { ok: false, reason: \"missing_headers\" };\n  }\n\n  const ts = parseInt(tsHeader, 10);\n  if (isNaN(ts)) return { ok: false, reason: \"invalid_ts\" };\n\n  const nowSec = Math.floor(Date.now() / 1000);\n  if (Math.abs(nowSec - ts) > 30) return { ok: false, reason: \"stale_ts\" };\n\n  if (isNonceSeen(nonce)) return { ok: false, reason: \"nonce_replay\" };\n\n  const bodyHash = createHash(\"sha256\").update(body, \"utf-8\").digest(\"hex\");\n  const canonical = `abtars-req-v1\\n${method}\\n${path}\\n${tsHeader}\\n${nonce}\\n${bodyHash}`;\n\n  if (!edVerify(verifyKey, canonical, sig)) return { ok: false, reason: \"bad_sig\" };\n\n  recordNonce(nonce);\n  return { ok: true };\n}\n\n// \u2500\u2500 Tribe HMAC \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * HMAC-SHA256 for tribe enrollment authentication.\n * Returns lowercase hex digest.\n */\nexport function macTribe(tribeToken: string, ...parts: string[]): string {\n  return createHmac(\"sha256\", Buffer.from(tribeToken, \"base64\"))\n    .update(parts.join(\"\"))\n    .digest(\"hex\");\n}\n\n// \u2500\u2500 Enrollment signatures \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Sign enrollment message (initiator).\n * canonical: \"abtars-enroll-v1\\n\" + pubKey_i + \"\\n\" + nonce_r + \"\\n\" + name\n */\nexport function signEnroll(signingKey: string, pubKeyI: string, nonceR: string, name: string): string {\n  const canonical = `abtars-enroll-v1\\n${pubKeyI}\\n${nonceR}\\n${name}`;\n  return edSign(signingKey, canonical);\n}\n\n/** Verify enrollment signature (responder verifies initiator). */\nexport function verifyEnroll(selfSig: string, verifyKey: string, pubKeyI: string, nonceR: string, name: string): boolean {\n  const canonical = `abtars-enroll-v1\\n${pubKeyI}\\n${nonceR}\\n${name}`;\n  return edVerify(verifyKey, canonical, selfSig);\n}\n\n/**\n * Sign acknowledgment (responder).\n * canonical: \"abtars-enroll-v1\\n\" + \"ack\\n\" + name_r + \"\\n\" + pubKey_r + \"\\n\" + nonce_r\n */\nexport function signAck(signingKey: string, nameR: string, pubKeyR: string, nonceR: string): string {\n  const canonical = `abtars-enroll-v1\\nack\\n${nameR}\\n${pubKeyR}\\n${nonceR}`;\n  return edSign(signingKey, canonical);\n}\n\n/** Verify acknowledgment signature (initiator verifies responder). */\nexport function verifyAck(ackSig: string, verifyKey: string, nameR: string, pubKeyR: string, nonceR: string): boolean {\n  const canonical = `abtars-enroll-v1\\nack\\n${nameR}\\n${pubKeyR}\\n${nonceR}`;\n  return edVerify(verifyKey, canonical, ackSig);\n}\n\n// \u2500\u2500 TLS cert generation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface TlsCertResult {\n  key: string;   // PEM \u2014 PKCS8 private key\n  cert: string;  // PEM \u2014 self-signed X.509 cert\n}\n\n/**\n * Generate a self-signed Ed25519 TLS cert from the identity signing key.\n * The private key used in the cert IS the identity key \u2014 same keypair.\n */\nexport function generateTlsCert(signingKey: string, cn: string): TlsCertResult {\n  const tmpDir = join(tmpdir(), `abtars-tls-${randomBytes(8).toString(\"hex\")}`);\n  mkdirSync(tmpDir, { recursive: true });\n\n  const keyPemPath = join(tmpDir, \"key.pem\");\n  const certPath = join(tmpDir, \"cert.pem\");\n\n  try {\n    // Export private key as PKCS8 PEM\n    const privKeyObj = importPrivKey(signingKey);\n    const keyPem = privKeyObj.export({ type: \"pkcs8\", format: \"pem\" }) as string;\n    writeFileSync(keyPemPath, keyPem, { mode: 0o600 });\n\n    // Generate self-signed cert using the identity key\n    const safeCn = cn.replace(/[^A-Za-z0-9_\\-.]/g, \"_\").slice(0, 64);\n    execSync(\n      `openssl req -x509 -key \"${keyPemPath}\" -out \"${certPath}\" -days 3650 -nodes -subj \"/CN=${safeCn}\"`,\n      { stdio: \"pipe\" },\n    );\n\n    const key = readFileSync(keyPemPath, \"utf-8\");\n    const cert = readFileSync(certPath, \"utf-8\");\n    return { key, cert };\n  } finally {\n    try { unlinkSync(keyPemPath); } catch { /* best effort */ }\n    try { unlinkSync(certPath); } catch { /* best effort */ }\n    try { require(\"node:fs\").rmdirSync(tmpDir); } catch { /* best effort */ }\n  }\n}\n\n/**\n * Verify that the presented TLS cert's SPKI public key matches the enrolled verifyKey.\n * cert: PEM string. verifyKey: base64 SPKI DER.\n */\nexport function verifyServerCert(cert: string, verifyKey: string): boolean {\n  try {\n    const keyObj = createPublicKey({ key: cert, format: \"pem\" });\n    const certSpki = (keyObj.export({ type: \"spki\", format: \"der\" }) as Buffer).toString(\"base64\");\n    // Timing-safe comparison\n    const expected = Buffer.from(verifyKey, \"base64\");\n    const actual = Buffer.from(certSpki, \"base64\");\n    if (expected.length !== actual.length) return false;\n    return timingSafeEqual(expected, actual);\n  } catch {\n    return false;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA;AAAA,EACE;AAAA,EACA;AAAA,EACA,QAAQ;AAAA,EACR,UAAU;AAAA,EACV;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,gBAAgB;AACzB,SAAS,eAAe,cAAc,YAAY,iBAAiB;AACnE,SAAS,cAAc;AACvB,SAAS,YAAY;AAOrB,SAAS,cAAoB;AAC3B,QAAM,SAAS,KAAK,IAAI,IAAI;AAC5B,aAAW,CAAC,OAAO,EAAE,KAAK,YAAY;AACpC,QAAI,KAAK,OAAQ,YAAW,OAAO,KAAK;AAAA,EAC1C;AACF;AAEO,SAAS,YAAY,OAAwB;AAClD,cAAY;AACZ,SAAO,WAAW,IAAI,KAAK;AAC7B;AAEO,SAAS,YAAY,OAAqB;AAC/C,aAAW,IAAI,OAAO,KAAK,IAAI,CAAC;AAClC;AAKA,SAAS,cAAc,YAAyD;AAC9E,SAAO,iBAAiB,EAAE,KAAK,OAAO,KAAK,YAAY,QAAQ,GAAG,QAAQ,OAAO,MAAM,QAAQ,CAAC;AAClG;AAGA,SAAS,aAAa,WAAuD;AAC3E,SAAO,gBAAgB,EAAE,KAAK,OAAO,KAAK,WAAW,QAAQ,GAAG,QAAQ,OAAO,MAAM,OAAO,CAAC;AAC/F;AAGA,SAAS,OAAO,YAAoB,SAAyB;AAE3D,SAAO,WAAW,MAAM,OAAO,KAAK,SAAS,OAAO,GAAG,cAAc,UAAU,CAAC,EAAE,SAAS,QAAQ;AACrG;AAGA,SAAS,SAAS,WAAmB,SAAiB,WAA4B;AAChF,MAAI;AACF,WAAO,aAAa,MAAM,OAAO,KAAK,SAAS,OAAO,GAAG,aAAa,SAAS,GAAG,OAAO,KAAK,WAAW,QAAQ,CAAC;AAAA,EACpH,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYO,SAAS,YACd,QACA,MACA,MACA,YACA,UACwB;AACxB,QAAM,KAAK,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC;AAC/C,QAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,KAAK;AAC5C,QAAM,WAAW,WAAW,QAAQ,EAAE,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK;AACxE,QAAM,YAAY;AAAA,EAAkB,MAAM;AAAA,EAAK,IAAI;AAAA,EAAK,EAAE;AAAA,EAAK,KAAK;AAAA,EAAK,QAAQ;AACjF,QAAM,MAAM,OAAO,YAAY,SAAS;AACxC,SAAO;AAAA,IACL,aAAa;AAAA,IACb,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,cAAc;AAAA,EAChB;AACF;AAUO,SAAS,cACd,SACA,QACA,MACA,MACA,WACqB;AAErB,QAAM,IAAmD,CAAC;AAC1D,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,OAAO,EAAG,GAAE,EAAE,YAAY,CAAC,IAAI;AAEnE,QAAM,SAAS,EAAE,WAAW;AAC5B,QAAM,WAAW,EAAE,WAAW;AAC9B,QAAM,QAAQ,EAAE,cAAc;AAC9B,QAAM,MAAM,EAAE,YAAY;AAE1B,MACE,OAAO,WAAW,YAClB,OAAO,aAAa,YACpB,OAAO,UAAU,YACjB,OAAO,QAAQ,UACf;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,kBAAkB;AAAA,EAChD;AAEA,QAAM,KAAK,SAAS,UAAU,EAAE;AAChC,MAAI,MAAM,EAAE,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,aAAa;AAExD,QAAM,SAAS,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC3C,MAAI,KAAK,IAAI,SAAS,EAAE,IAAI,GAAI,QAAO,EAAE,IAAI,OAAO,QAAQ,WAAW;AAEvE,MAAI,YAAY,KAAK,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,eAAe;AAEnE,QAAM,WAAW,WAAW,QAAQ,EAAE,OAAO,MAAM,OAAO,EAAE,OAAO,KAAK;AACxE,QAAM,YAAY;AAAA,EAAkB,MAAM;AAAA,EAAK,IAAI;AAAA,EAAK,QAAQ;AAAA,EAAK,KAAK;AAAA,EAAK,QAAQ;AAEvF,MAAI,CAAC,SAAS,WAAW,WAAW,GAAG,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,UAAU;AAEhF,cAAY,KAAK;AACjB,SAAO,EAAE,IAAI,KAAK;AACpB;AAQO,SAAS,SAAS,eAAuB,OAAyB;AACvE,SAAO,WAAW,UAAU,OAAO,KAAK,YAAY,QAAQ,CAAC,EAC1D,OAAO,MAAM,KAAK,EAAE,CAAC,EACrB,OAAO,KAAK;AACjB;AAQO,SAAS,WAAW,YAAoB,SAAiB,QAAgB,MAAsB;AACpG,QAAM,YAAY;AAAA,EAAqB,OAAO;AAAA,EAAK,MAAM;AAAA,EAAK,IAAI;AAClE,SAAO,OAAO,YAAY,SAAS;AACrC;AAGO,SAAS,aAAa,SAAiB,WAAmB,SAAiB,QAAgB,MAAuB;AACvH,QAAM,YAAY;AAAA,EAAqB,OAAO;AAAA,EAAK,MAAM;AAAA,EAAK,IAAI;AAClE,SAAO,SAAS,WAAW,WAAW,OAAO;AAC/C;AAMO,SAAS,QAAQ,YAAoB,OAAe,SAAiB,QAAwB;AAClG,QAAM,YAAY;AAAA;AAAA,EAA0B,KAAK;AAAA,EAAK,OAAO;AAAA,EAAK,MAAM;AACxE,SAAO,OAAO,YAAY,SAAS;AACrC;AAGO,SAAS,UAAU,QAAgB,WAAmB,OAAe,SAAiB,QAAyB;AACpH,QAAM,YAAY;AAAA;AAAA,EAA0B,KAAK;AAAA,EAAK,OAAO;AAAA,EAAK,MAAM;AACxE,SAAO,SAAS,WAAW,WAAW,MAAM;AAC9C;AAaO,SAAS,gBAAgB,YAAoB,IAA2B;AAC7E,QAAM,SAAS,KAAK,OAAO,GAAG,cAAc,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC,EAAE;AAC5E,YAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;AAErC,QAAM,aAAa,KAAK,QAAQ,SAAS;AACzC,QAAM,WAAW,KAAK,QAAQ,UAAU;AAExC,MAAI;AAEF,UAAM,aAAa,cAAc,UAAU;AAC3C,UAAM,SAAS,WAAW,OAAO,EAAE,MAAM,SAAS,QAAQ,MAAM,CAAC;AACjE,kBAAc,YAAY,QAAQ,EAAE,MAAM,IAAM,CAAC;AAGjD,UAAM,SAAS,GAAG,QAAQ,qBAAqB,GAAG,EAAE,MAAM,GAAG,EAAE;AAC/D;AAAA,MACE,2BAA2B,UAAU,WAAW,QAAQ,kCAAkC,MAAM;AAAA,MAChG,EAAE,OAAO,OAAO;AAAA,IAClB;AAEA,UAAM,MAAM,aAAa,YAAY,OAAO;AAC5C,UAAM,OAAO,aAAa,UAAU,OAAO;AAC3C,WAAO,EAAE,KAAK,KAAK;AAAA,EACrB,UAAE;AACA,QAAI;AAAE,iBAAW,UAAU;AAAA,IAAG,QAAQ;AAAA,IAAoB;AAC1D,QAAI;AAAE,iBAAW,QAAQ;AAAA,IAAG,QAAQ;AAAA,IAAoB;AACxD,QAAI;AAAE,gBAAQ,SAAS,EAAE,UAAU,MAAM;AAAA,IAAG,QAAQ;AAAA,IAAoB;AAAA,EAC1E;AACF;AAMO,SAAS,iBAAiB,MAAc,WAA4B;AACzE,MAAI;AACF,UAAM,SAAS,gBAAgB,EAAE,KAAK,MAAM,QAAQ,MAAM,CAAC;AAC3D,UAAM,WAAY,OAAO,OAAO,EAAE,MAAM,QAAQ,QAAQ,MAAM,CAAC,EAAa,SAAS,QAAQ;AAE7F,UAAM,WAAW,OAAO,KAAK,WAAW,QAAQ;AAChD,UAAM,SAAS,OAAO,KAAK,UAAU,QAAQ;AAC7C,QAAI,SAAS,WAAW,OAAO,OAAQ,QAAO;AAC9C,WAAO,gBAAgB,UAAU,MAAM;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AA9PA,IA2BM,YACA;AA5BN;AAAA;AA2BA,IAAM,aAAa,oBAAI,IAAoB;AAC3C,IAAM,eAAe;AAAA;AAAA;",
+  "names": []
+}

package/bundle/{chunk-JNIHEDKF.js → chunk-XPWYDNWL.js}

@@ -3,7 +3,7 @@
 import {
   SkillWatcher,
   init_skill_watcher
-} from "./chunk-EUZDKV3C.js";
+} from "./chunk-J4RUFAPK.js";
 import {
   abtarsHome,
   init_paths
@@ -56,4 +56,4 @@ export {
   hotskills_exports,
   init_hotskills
 };
-//# sourceMappingURL=chunk-JNIHEDKF.js.map
+//# sourceMappingURL=chunk-XPWYDNWL.js.map

package/bundle/{chunk-GWILHZPT.js → chunk-XRTXYN66.js}

@@ -81,13 +81,13 @@ function formatLine(level, tag, msg) {
 function logInfo(tag, msg) {
   if (!shouldLog("low")) return;
   const line = formatLine("info", tag, msg);
-  console.log(`[${tag}] ${msg}`);
+  if (process.stdout.isTTY) console.log(`[${tag}] ${msg}`);
   writeToFile(line);
 }
 function logWarn(tag, msg) {
   if (!shouldLog("low")) return;
   const line = formatLine("warn", tag, msg);
-  console.warn(`[${tag}] ${msg}`);
+  if (process.stdout.isTTY) console.warn(`[${tag}] ${msg}`);
   writeToFile(line);
 }
 function logError(tag, msg, err) {
@@ -95,20 +95,23 @@ function logError(tag, msg, err) {
   const errStr = err instanceof Error ? err.message : typeof err === "object" && err !== null ? JSON.stringify(err) : String(err ?? "");
   const fullMsg = errStr ? `${msg} \u2014 ${errStr}` : msg;
   const line = formatLine("error", tag, fullMsg);
-  if (err) console.error(`[${tag}] ${msg}`, err);
-  else console.error(`[${tag}] ${msg}`);
+  if (err) {
+    if (process.stdout.isTTY) console.error(`[${tag}] ${msg}`, err);
+  } else {
+    if (process.stdout.isTTY) console.error(`[${tag}] ${msg}`);
+  }
   writeToFile(line);
 }
 function logDebug(tag, msg) {
   if (!shouldLog("debug")) return;
   const line = formatLine("debug", tag, msg);
-  console.log(`[${tag}] ${msg}`);
+  if (process.stdout.isTTY) console.log(`[${tag}] ${msg}`);
   writeToFile(line);
 }
 function logTrace(tag, msg) {
   if (!shouldLog("trace")) return;
   const line = formatLine("trace", tag, msg);
-  console.log(`[${tag}] ${msg}`);
+  if (process.stdout.isTTY) console.log(`[${tag}] ${msg}`);
   writeToFile(line);
 }
 var LEVEL_ORDER, LOG_DIR, currentLevel, isTest, fileLogging, buffer, flushTimer, SECRET_PATTERNS, logFormat;
@@ -162,4 +165,4 @@ export {
   logTrace,
   init_logger
 };
-//# sourceMappingURL=chunk-GWILHZPT.js.map
+//# sourceMappingURL=chunk-XRTXYN66.js.map

package/bundle/{chunk-GWILHZPT.js.map → chunk-XRTXYN66.js.map}

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/components/logger.ts"],
-  "sourcesContent": ["import { appendFileSync, mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { abtarsHome } from \"../paths.js\";\n\n/** Log levels: OFF = silent, LOW = operational info, DEBUG = verbose trace, TRACE = debug + anomaly diagnostics */\nexport type LogLevel = \"off\" | \"low\" | \"debug\" | \"trace\";\n\nconst LEVEL_ORDER: Record<LogLevel, number> = { off: 0, low: 1, debug: 2, trace: 3 };\nconst LOG_DIR = join(abtarsHome(), \"logs\");\n\n/** Get today's log filename: bridge-YYYY-MM-DD.log */\nexport function getLogFile(): string {\n  const d = new Date();\n  const date = `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, \"0\")}-${String(d.getDate()).padStart(2, \"0\")}`;\n  return join(LOG_DIR, `bridge-${date}.log`);\n}\n\nlet currentLevel: LogLevel = \"low\";\nconst isTest = process.env.NODE_ENV === \"test\" || process.env.VITEST === \"true\";\nlet fileLogging = !isTest;\n\nexport function setLogLevel(level: LogLevel): void {\n  currentLevel = level;\n}\n\n/** @internal \u2014 test-only override for file logging. */\nexport function setFileLogging(enabled: boolean): void {\n  fileLogging = enabled;\n}\n\nfunction shouldLog(minLevel: LogLevel): boolean {\n  return LEVEL_ORDER[currentLevel] >= LEVEL_ORDER[minLevel];\n}\n\nexport function isLogLevel(minLevel: LogLevel): boolean {\n  return LEVEL_ORDER[currentLevel] >= LEVEL_ORDER[minLevel];\n}\n\n// \u2500\u2500 Buffered file writer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nlet buffer: string[] = [];\nlet flushTimer: ReturnType<typeof setTimeout> | null = null;\n\nfunction writeToFile(line: string): void {\n  if (!fileLogging) return;\n  buffer.push(redactSecrets(line));\n  if (buffer.length >= 200) flush();\n  else if (!flushTimer) {\n    flushTimer = setTimeout(flush, 30000);\n    flushTimer.unref();\n  }\n}\n\nfunction flush(): void {\n  if (flushTimer) { clearTimeout(flushTimer); flushTimer = null; }\n  if (buffer.length === 0) return;\n  const lines = buffer;\n  buffer = [];\n  try {\n    mkdirSync(LOG_DIR, { recursive: true });\n    appendFileSync(getLogFile(), lines.join(\"\\n\") + \"\\n\");\n  } catch { /* silently ignore file write errors */ }\n}\n\n/** Flush buffered logs synchronously. Called on process exit. */\nexport function flushLogs(): void { flush(); }\n\nprocess.on(\"exit\", flush);\n\n// \u2500\u2500 Credential redaction \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// INTENTIONALLY DUPLICATED across abtars and abmind \u2014 they are\n// independent products that both need this utility. If you add or\n// modify a pattern here, also update the sibling file:\n//   abtars/src/components/logger.ts (SECRET_PATTERNS + redactSecrets)\n//   abmind/src/redact-secrets.ts          (SECRET_PATTERNS + redactSecrets)\n//\n// Do NOT create an import relationship between them. Each product stays\n// independent so the bridge can run against a different memory backend\n// and abmind can ship as a standalone npm package without pulling\n// abtars in for a utility function.\n\nconst SECRET_PATTERNS: ReadonlyArray<[RegExp, string]> = [\n  [/sk-[A-Za-z0-9_-]{20,}/g, \"sk-***REDACTED***\"],\n  [/sk-or-[A-Za-z0-9_-]{20,}/g, \"sk-or-***REDACTED***\"],\n  [/gsk_[A-Za-z0-9]{20,}/g, \"gsk_***REDACTED***\"],\n  [/ghp_[A-Za-z0-9]{36,}/g, \"ghp_***REDACTED***\"],\n  [/github_pat_[A-Za-z0-9_]{20,}/g, \"github_pat_***REDACTED***\"],\n  [/xox[baprs]-[A-Za-z0-9-]{10,}/g, \"xox_-***REDACTED***\"],\n  [/AIza[A-Za-z0-9_-]{30,}/g, \"AIza***REDACTED***\"],\n  [/AKIA[A-Z0-9]{16}/g, \"AKIA***REDACTED***\"],\n  [/\\d{8,12}:[A-Za-z0-9_-]{35,}/g, \"***BOT_TOKEN***\"],\n  [/Bearer [A-Za-z0-9._-]{20,}/g, \"Bearer ***REDACTED***\"],\n  [/eyJ[A-Za-z0-9_-]{20,}\\.eyJ[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}/g, \"***JWT_REDACTED***\"],\n  [/hf_[A-Za-z0-9]{20,}/g, \"hf_***REDACTED***\"],\n  [/npm_[A-Za-z0-9]{20,}/g, \"npm_***REDACTED***\"],\n  [/sk_live_[A-Za-z0-9]{20,}/g, \"sk_live_***REDACTED***\"],\n  [/sk_test_[A-Za-z0-9]{20,}/g, \"sk_test_***REDACTED***\"],\n  [/SG\\.[A-Za-z0-9_-]{20,}/g, \"SG.***REDACTED***\"],\n  [/(\"(?:api[_-]?key|token|secret|password|authorization|credential)\"\\s*:\\s*\")[^\"]{8,}\"/gi, '$1***REDACTED***\"'],\n  [/([A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD)=)[^\\s]{8,}/g, \"$1***REDACTED***\"],\n];\n\n/** Strip known secret patterns from a log line. */\nexport function redactSecrets(text: string): string {\n  let result = text;\n  for (const [pattern, replacement] of SECRET_PATTERNS) {\n    result = result.replace(pattern, replacement);\n  }\n  return result;\n}\n\n\nfunction ts(): string {\n  const d = new Date();\n  const pad2 = (n: number): string => String(n).padStart(2, \"0\");\n  const local = `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())}T${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}.${String(d.getMilliseconds()).padStart(3, \"0\")}`;\n  return isTest ? `${local} TEST` : local;\n}\n\n/** Local ISO-ish timestamp for user-facing messages. */\nexport function localIso(): string {\n  const d = new Date();\n  const pad2 = (n: number): string => String(n).padStart(2, \"0\");\n  return `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())}T${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}`;\n}\n\nlet logFormat: \"text\" | \"json\" = (process.env[\"LOG_FORMAT\"] as \"json\" | undefined) === \"json\" ? \"json\" : \"text\";\n\nfunction formatLine(level: string, tag: string, msg: string): string {\n  if (logFormat === \"json\") {\n    return JSON.stringify({ ts: ts(), level, tag, msg });\n  }\n  return `${ts()} ${level.toUpperCase().padEnd(5)} [${tag}] ${msg}`;\n}\n\n/** LOW: operational milestones \u2014 startup, connections, errors */\nexport function logInfo(tag: string, msg: string): void {\n  if (!shouldLog(\"low\")) return;\n  const line = formatLine(\"info\", tag, msg);\n  console.log(`[${tag}] ${msg}`);\n  writeToFile(line);\n}\n\n/** LOW: warnings */\nexport function logWarn(tag: string, msg: string): void {\n  if (!shouldLog(\"low\")) return;\n  const line = formatLine(\"warn\", tag, msg);\n  console.warn(`[${tag}] ${msg}`);\n  writeToFile(line);\n}\n\n/** LOW: errors (always shown unless OFF) */\nexport function logError(tag: string, msg: string, err?: unknown): void {\n  if (!shouldLog(\"low\")) return;\n  const errStr = err instanceof Error ? err.message : (typeof err === \"object\" && err !== null ? JSON.stringify(err) : String(err ?? \"\"));\n  const fullMsg = errStr ? `${msg} \u2014 ${errStr}` : msg;\n  const line = formatLine(\"error\", tag, fullMsg);\n  if (err) console.error(`[${tag}] ${msg}`, err);\n  else console.error(`[${tag}] ${msg}`);\n  writeToFile(line);\n}\n\n/** DEBUG: message content, full payloads, verbose tracing */\nexport function logDebug(tag: string, msg: string): void {\n  if (!shouldLog(\"debug\")) return;\n  const line = formatLine(\"debug\", tag, msg);\n  console.log(`[${tag}] ${msg}`);\n  writeToFile(line);\n}\n\n/** TRACE: debug + anomaly diagnostics (swallowed errors, catch-block traces) */\nexport function logTrace(tag: string, msg: string): void {\n  if (!shouldLog(\"trace\")) return;\n  const line = formatLine(\"trace\", tag, msg);\n  console.log(`[${tag}] ${msg}`);\n  writeToFile(line);\n}\n"],
-  "mappings": ";;;;;;;;;;;AAAA,SAAS,gBAAgB,iBAAiB;AAC1C,SAAS,YAAY;AAUd,SAAS,aAAqB;AACnC,QAAM,IAAI,oBAAI,KAAK;AACnB,QAAM,OAAO,GAAG,EAAE,YAAY,CAAC,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC,IAAI,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC;AACpH,SAAO,KAAK,SAAS,UAAU,IAAI,MAAM;AAC3C;AAMO,SAAS,YAAY,OAAuB;AACjD,iBAAe;AACjB;AAGO,SAAS,eAAe,SAAwB;AACrD,gBAAc;AAChB;AAEA,SAAS,UAAU,UAA6B;AAC9C,SAAO,YAAY,YAAY,KAAK,YAAY,QAAQ;AAC1D;AAEO,SAAS,WAAW,UAA6B;AACtD,SAAO,YAAY,YAAY,KAAK,YAAY,QAAQ;AAC1D;AAMA,SAAS,YAAY,MAAoB;AACvC,MAAI,CAAC,YAAa;AAClB,SAAO,KAAK,cAAc,IAAI,CAAC;AAC/B,MAAI,OAAO,UAAU,IAAK,OAAM;AAAA,WACvB,CAAC,YAAY;AACpB,iBAAa,WAAW,OAAO,GAAK;AACpC,eAAW,MAAM;AAAA,EACnB;AACF;AAEA,SAAS,QAAc;AACrB,MAAI,YAAY;AAAE,iBAAa,UAAU;AAAG,iBAAa;AAAA,EAAM;AAC/D,MAAI,OAAO,WAAW,EAAG;AACzB,QAAM,QAAQ;AACd,WAAS,CAAC;AACV,MAAI;AACF,cAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AACtC,mBAAe,WAAW,GAAG,MAAM,KAAK,IAAI,IAAI,IAAI;AAAA,EACtD,QAAQ;AAAA,EAA0C;AACpD;AAGO,SAAS,YAAkB;AAAE,QAAM;AAAG;AAuCtC,SAAS,cAAc,MAAsB;AAClD,MAAI,SAAS;AACb,aAAW,CAAC,SAAS,WAAW,KAAK,iBAAiB;AACpD,aAAS,OAAO,QAAQ,SAAS,WAAW;AAAA,EAC9C;AACA,SAAO;AACT;AAGA,SAAS,KAAa;AACpB,QAAM,IAAI,oBAAI,KAAK;AACnB,QAAM,OAAO,CAAC,MAAsB,OAAO,CAAC,EAAE,SAAS,GAAG,GAAG;AAC7D,QAAM,QAAQ,GAAG,EAAE,YAAY,CAAC,IAAI,KAAK,EAAE,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,OAAO,EAAE,gBAAgB,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC;AACrM,SAAO,SAAS,GAAG,KAAK,UAAU;AACpC;AAGO,SAAS,WAAmB;AACjC,QAAM,IAAI,oBAAI,KAAK;AACnB,QAAM,OAAO,CAAC,MAAsB,OAAO,CAAC,EAAE,SAAS,GAAG,GAAG;AAC7D,SAAO,GAAG,EAAE,YAAY,CAAC,IAAI,KAAK,EAAE,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,KAAK,EAAE,WAAW,CAAC,CAAC;AAChJ;AAIA,SAAS,WAAW,OAAe,KAAa,KAAqB;AACnE,MAAI,cAAc,QAAQ;AACxB,WAAO,KAAK,UAAU,EAAE,IAAI,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC;AAAA,EACrD;AACA,SAAO,GAAG,GAAG,CAAC,IAAI,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,GAAG,KAAK,GAAG;AACjE;AAGO,SAAS,QAAQ,KAAa,KAAmB;AACtD,MAAI,CAAC,UAAU,KAAK,EAAG;AACvB,QAAM,OAAO,WAAW,QAAQ,KAAK,GAAG;AACxC,UAAQ,IAAI,IAAI,GAAG,KAAK,GAAG,EAAE;AAC7B,cAAY,IAAI;AAClB;AAGO,SAAS,QAAQ,KAAa,KAAmB;AACtD,MAAI,CAAC,UAAU,KAAK,EAAG;AACvB,QAAM,OAAO,WAAW,QAAQ,KAAK,GAAG;AACxC,UAAQ,KAAK,IAAI,GAAG,KAAK,GAAG,EAAE;AAC9B,cAAY,IAAI;AAClB;AAGO,SAAS,SAAS,KAAa,KAAa,KAAqB;AACtE,MAAI,CAAC,UAAU,KAAK,EAAG;AACvB,QAAM,SAAS,eAAe,QAAQ,IAAI,UAAW,OAAO,QAAQ,YAAY,QAAQ,OAAO,KAAK,UAAU,GAAG,IAAI,OAAO,OAAO,EAAE;AACrI,QAAM,UAAU,SAAS,GAAG,GAAG,WAAM,MAAM,KAAK;AAChD,QAAM,OAAO,WAAW,SAAS,KAAK,OAAO;AAC7C,MAAI,IAAK,SAAQ,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG;AAAA,MACxC,SAAQ,MAAM,IAAI,GAAG,KAAK,GAAG,EAAE;AACpC,cAAY,IAAI;AAClB;AAGO,SAAS,SAAS,KAAa,KAAmB;AACvD,MAAI,CAAC,UAAU,OAAO,EAAG;AACzB,QAAM,OAAO,WAAW,SAAS,KAAK,GAAG;AACzC,UAAQ,IAAI,IAAI,GAAG,KAAK,GAAG,EAAE;AAC7B,cAAY,IAAI;AAClB;AAGO,SAAS,SAAS,KAAa,KAAmB;AACvD,MAAI,CAAC,UAAU,OAAO,EAAG;AACzB,QAAM,OAAO,WAAW,SAAS,KAAK,GAAG;AACzC,UAAQ,IAAI,IAAI,GAAG,KAAK,GAAG,EAAE;AAC7B,cAAY,IAAI;AAClB;AAhLA,IAOM,aACA,SASF,cACE,QACF,aAoBA,QACA,YAyCE,iBA6CF;AA9HJ;AAAA;AAEA;AAKA,IAAM,cAAwC,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,EAAE;AACnF,IAAM,UAAU,KAAK,WAAW,GAAG,MAAM;AASzC,IAAI,eAAyB;AAC7B,IAAM,SAA4C,QAAQ,IAAI,WAAW;AACzE,IAAI,cAAc,CAAC;AAoBnB,IAAI,SAAmB,CAAC;AACxB,IAAI,aAAmD;AA0BvD,YAAQ,GAAG,QAAQ,KAAK;AAexB,IAAM,kBAAmD;AAAA,MACvD,CAAC,0BAA0B,mBAAmB;AAAA,MAC9C,CAAC,6BAA6B,sBAAsB;AAAA,MACpD,CAAC,yBAAyB,oBAAoB;AAAA,MAC9C,CAAC,yBAAyB,oBAAoB;AAAA,MAC9C,CAAC,iCAAiC,2BAA2B;AAAA,MAC7D,CAAC,iCAAiC,qBAAqB;AAAA,MACvD,CAAC,2BAA2B,oBAAoB;AAAA,MAChD,CAAC,qBAAqB,oBAAoB;AAAA,MAC1C,CAAC,gCAAgC,iBAAiB;AAAA,MAClD,CAAC,+BAA+B,uBAAuB;AAAA,MACvD,CAAC,qEAAqE,oBAAoB;AAAA,MAC1F,CAAC,wBAAwB,mBAAmB;AAAA,MAC5C,CAAC,yBAAyB,oBAAoB;AAAA,MAC9C,CAAC,6BAA6B,wBAAwB;AAAA,MACtD,CAAC,6BAA6B,wBAAwB;AAAA,MACtD,CAAC,2BAA2B,mBAAmB;AAAA,MAC/C,CAAC,yFAAyF,mBAAmB;AAAA,MAC7G,CAAC,qDAAqD,kBAAkB;AAAA,IAC1E;AA0BA,IAAI,YAA8B,QAAQ,IAAI,YAAY,MAA6B,SAAS,SAAS;AAAA;AAAA;",
+  "sourcesContent": ["import { appendFileSync, mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { abtarsHome } from \"../paths.js\";\n\n/** Log levels: OFF = silent, LOW = operational info, DEBUG = verbose trace, TRACE = debug + anomaly diagnostics */\nexport type LogLevel = \"off\" | \"low\" | \"debug\" | \"trace\";\n\nconst LEVEL_ORDER: Record<LogLevel, number> = { off: 0, low: 1, debug: 2, trace: 3 };\nconst LOG_DIR = join(abtarsHome(), \"logs\");\n\n/** Get today's log filename: bridge-YYYY-MM-DD.log */\nexport function getLogFile(): string {\n  const d = new Date();\n  const date = `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, \"0\")}-${String(d.getDate()).padStart(2, \"0\")}`;\n  return join(LOG_DIR, `bridge-${date}.log`);\n}\n\nlet currentLevel: LogLevel = \"low\";\nconst isTest = process.env.NODE_ENV === \"test\" || process.env.VITEST === \"true\";\nlet fileLogging = !isTest;\n\nexport function setLogLevel(level: LogLevel): void {\n  currentLevel = level;\n}\n\n/** @internal \u2014 test-only override for file logging. */\nexport function setFileLogging(enabled: boolean): void {\n  fileLogging = enabled;\n}\n\nfunction shouldLog(minLevel: LogLevel): boolean {\n  return LEVEL_ORDER[currentLevel] >= LEVEL_ORDER[minLevel];\n}\n\nexport function isLogLevel(minLevel: LogLevel): boolean {\n  return LEVEL_ORDER[currentLevel] >= LEVEL_ORDER[minLevel];\n}\n\n// \u2500\u2500 Buffered file writer \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nlet buffer: string[] = [];\nlet flushTimer: ReturnType<typeof setTimeout> | null = null;\n\nfunction writeToFile(line: string): void {\n  if (!fileLogging) return;\n  buffer.push(redactSecrets(line));\n  if (buffer.length >= 200) flush();\n  else if (!flushTimer) {\n    flushTimer = setTimeout(flush, 30000);\n    flushTimer.unref();\n  }\n}\n\nfunction flush(): void {\n  if (flushTimer) { clearTimeout(flushTimer); flushTimer = null; }\n  if (buffer.length === 0) return;\n  const lines = buffer;\n  buffer = [];\n  try {\n    mkdirSync(LOG_DIR, { recursive: true });\n    appendFileSync(getLogFile(), lines.join(\"\\n\") + \"\\n\");\n  } catch { /* silently ignore file write errors */ }\n}\n\n/** Flush buffered logs synchronously. Called on process exit. */\nexport function flushLogs(): void { flush(); }\n\nprocess.on(\"exit\", flush);\n\n// \u2500\u2500 Credential redaction \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// INTENTIONALLY DUPLICATED across abtars and abmind \u2014 they are\n// independent products that both need this utility. If you add or\n// modify a pattern here, also update the sibling file:\n//   abtars/src/components/logger.ts (SECRET_PATTERNS + redactSecrets)\n//   abmind/src/redact-secrets.ts          (SECRET_PATTERNS + redactSecrets)\n//\n// Do NOT create an import relationship between them. Each product stays\n// independent so the bridge can run against a different memory backend\n// and abmind can ship as a standalone npm package without pulling\n// abtars in for a utility function.\n\nconst SECRET_PATTERNS: ReadonlyArray<[RegExp, string]> = [\n  [/sk-[A-Za-z0-9_-]{20,}/g, \"sk-***REDACTED***\"],\n  [/sk-or-[A-Za-z0-9_-]{20,}/g, \"sk-or-***REDACTED***\"],\n  [/gsk_[A-Za-z0-9]{20,}/g, \"gsk_***REDACTED***\"],\n  [/ghp_[A-Za-z0-9]{36,}/g, \"ghp_***REDACTED***\"],\n  [/github_pat_[A-Za-z0-9_]{20,}/g, \"github_pat_***REDACTED***\"],\n  [/xox[baprs]-[A-Za-z0-9-]{10,}/g, \"xox_-***REDACTED***\"],\n  [/AIza[A-Za-z0-9_-]{30,}/g, \"AIza***REDACTED***\"],\n  [/AKIA[A-Z0-9]{16}/g, \"AKIA***REDACTED***\"],\n  [/\\d{8,12}:[A-Za-z0-9_-]{35,}/g, \"***BOT_TOKEN***\"],\n  [/Bearer [A-Za-z0-9._-]{20,}/g, \"Bearer ***REDACTED***\"],\n  [/eyJ[A-Za-z0-9_-]{20,}\\.eyJ[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}/g, \"***JWT_REDACTED***\"],\n  [/hf_[A-Za-z0-9]{20,}/g, \"hf_***REDACTED***\"],\n  [/npm_[A-Za-z0-9]{20,}/g, \"npm_***REDACTED***\"],\n  [/sk_live_[A-Za-z0-9]{20,}/g, \"sk_live_***REDACTED***\"],\n  [/sk_test_[A-Za-z0-9]{20,}/g, \"sk_test_***REDACTED***\"],\n  [/SG\\.[A-Za-z0-9_-]{20,}/g, \"SG.***REDACTED***\"],\n  [/(\"(?:api[_-]?key|token|secret|password|authorization|credential)\"\\s*:\\s*\")[^\"]{8,}\"/gi, '$1***REDACTED***\"'],\n  [/([A-Z_]*(?:KEY|TOKEN|SECRET|PASSWORD)=)[^\\s]{8,}/g, \"$1***REDACTED***\"],\n];\n\n/** Strip known secret patterns from a log line. */\nexport function redactSecrets(text: string): string {\n  let result = text;\n  for (const [pattern, replacement] of SECRET_PATTERNS) {\n    result = result.replace(pattern, replacement);\n  }\n  return result;\n}\n\n\nfunction ts(): string {\n  const d = new Date();\n  const pad2 = (n: number): string => String(n).padStart(2, \"0\");\n  const local = `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())}T${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}.${String(d.getMilliseconds()).padStart(3, \"0\")}`;\n  return isTest ? `${local} TEST` : local;\n}\n\n/** Local ISO-ish timestamp for user-facing messages. */\nexport function localIso(): string {\n  const d = new Date();\n  const pad2 = (n: number): string => String(n).padStart(2, \"0\");\n  return `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())}T${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}`;\n}\n\nlet logFormat: \"text\" | \"json\" = (process.env[\"LOG_FORMAT\"] as \"json\" | undefined) === \"json\" ? \"json\" : \"text\";\n\nfunction formatLine(level: string, tag: string, msg: string): string {\n  if (logFormat === \"json\") {\n    return JSON.stringify({ ts: ts(), level, tag, msg });\n  }\n  return `${ts()} ${level.toUpperCase().padEnd(5)} [${tag}] ${msg}`;\n}\n\n/** LOW: operational milestones \u2014 startup, connections, errors */\nexport function logInfo(tag: string, msg: string): void {\n  if (!shouldLog(\"low\")) return;\n  const line = formatLine(\"info\", tag, msg);\n  if (process.stdout.isTTY) console.log(`[${tag}] ${msg}`);\n  writeToFile(line);\n}\n\n/** LOW: warnings */\nexport function logWarn(tag: string, msg: string): void {\n  if (!shouldLog(\"low\")) return;\n  const line = formatLine(\"warn\", tag, msg);\n  if (process.stdout.isTTY) console.warn(`[${tag}] ${msg}`);\n  writeToFile(line);\n}\n\n/** LOW: errors (always shown unless OFF) */\nexport function logError(tag: string, msg: string, err?: unknown): void {\n  if (!shouldLog(\"low\")) return;\n  const errStr = err instanceof Error ? err.message : (typeof err === \"object\" && err !== null ? JSON.stringify(err) : String(err ?? \"\"));\n  const fullMsg = errStr ? `${msg} \u2014 ${errStr}` : msg;\n  const line = formatLine(\"error\", tag, fullMsg);\n  if (err) { if (process.stdout.isTTY) console.error(`[${tag}] ${msg}`, err); }\n  else { if (process.stdout.isTTY) console.error(`[${tag}] ${msg}`); }\n  writeToFile(line);\n}\n\n/** DEBUG: message content, full payloads, verbose tracing */\nexport function logDebug(tag: string, msg: string): void {\n  if (!shouldLog(\"debug\")) return;\n  const line = formatLine(\"debug\", tag, msg);\n  if (process.stdout.isTTY) console.log(`[${tag}] ${msg}`);\n  writeToFile(line);\n}\n\n/** TRACE: debug + anomaly diagnostics (swallowed errors, catch-block traces) */\nexport function logTrace(tag: string, msg: string): void {\n  if (!shouldLog(\"trace\")) return;\n  const line = formatLine(\"trace\", tag, msg);\n  if (process.stdout.isTTY) console.log(`[${tag}] ${msg}`);\n  writeToFile(line);\n}\n"],
+  "mappings": ";;;;;;;;;;;AAAA,SAAS,gBAAgB,iBAAiB;AAC1C,SAAS,YAAY;AAUd,SAAS,aAAqB;AACnC,QAAM,IAAI,oBAAI,KAAK;AACnB,QAAM,OAAO,GAAG,EAAE,YAAY,CAAC,IAAI,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC,IAAI,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC;AACpH,SAAO,KAAK,SAAS,UAAU,IAAI,MAAM;AAC3C;AAMO,SAAS,YAAY,OAAuB;AACjD,iBAAe;AACjB;AAGO,SAAS,eAAe,SAAwB;AACrD,gBAAc;AAChB;AAEA,SAAS,UAAU,UAA6B;AAC9C,SAAO,YAAY,YAAY,KAAK,YAAY,QAAQ;AAC1D;AAEO,SAAS,WAAW,UAA6B;AACtD,SAAO,YAAY,YAAY,KAAK,YAAY,QAAQ;AAC1D;AAMA,SAAS,YAAY,MAAoB;AACvC,MAAI,CAAC,YAAa;AAClB,SAAO,KAAK,cAAc,IAAI,CAAC;AAC/B,MAAI,OAAO,UAAU,IAAK,OAAM;AAAA,WACvB,CAAC,YAAY;AACpB,iBAAa,WAAW,OAAO,GAAK;AACpC,eAAW,MAAM;AAAA,EACnB;AACF;AAEA,SAAS,QAAc;AACrB,MAAI,YAAY;AAAE,iBAAa,UAAU;AAAG,iBAAa;AAAA,EAAM;AAC/D,MAAI,OAAO,WAAW,EAAG;AACzB,QAAM,QAAQ;AACd,WAAS,CAAC;AACV,MAAI;AACF,cAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AACtC,mBAAe,WAAW,GAAG,MAAM,KAAK,IAAI,IAAI,IAAI;AAAA,EACtD,QAAQ;AAAA,EAA0C;AACpD;AAGO,SAAS,YAAkB;AAAE,QAAM;AAAG;AAuCtC,SAAS,cAAc,MAAsB;AAClD,MAAI,SAAS;AACb,aAAW,CAAC,SAAS,WAAW,KAAK,iBAAiB;AACpD,aAAS,OAAO,QAAQ,SAAS,WAAW;AAAA,EAC9C;AACA,SAAO;AACT;AAGA,SAAS,KAAa;AACpB,QAAM,IAAI,oBAAI,KAAK;AACnB,QAAM,OAAO,CAAC,MAAsB,OAAO,CAAC,EAAE,SAAS,GAAG,GAAG;AAC7D,QAAM,QAAQ,GAAG,EAAE,YAAY,CAAC,IAAI,KAAK,EAAE,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,OAAO,EAAE,gBAAgB,CAAC,EAAE,SAAS,GAAG,GAAG,CAAC;AACrM,SAAO,SAAS,GAAG,KAAK,UAAU;AACpC;AAGO,SAAS,WAAmB;AACjC,QAAM,IAAI,oBAAI,KAAK;AACnB,QAAM,OAAO,CAAC,MAAsB,OAAO,CAAC,EAAE,SAAS,GAAG,GAAG;AAC7D,SAAO,GAAG,EAAE,YAAY,CAAC,IAAI,KAAK,EAAE,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,KAAK,EAAE,WAAW,CAAC,CAAC;AAChJ;AAIA,SAAS,WAAW,OAAe,KAAa,KAAqB;AACnE,MAAI,cAAc,QAAQ;AACxB,WAAO,KAAK,UAAU,EAAE,IAAI,GAAG,GAAG,OAAO,KAAK,IAAI,CAAC;AAAA,EACrD;AACA,SAAO,GAAG,GAAG,CAAC,IAAI,MAAM,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,GAAG,KAAK,GAAG;AACjE;AAGO,SAAS,QAAQ,KAAa,KAAmB;AACtD,MAAI,CAAC,UAAU,KAAK,EAAG;AACvB,QAAM,OAAO,WAAW,QAAQ,KAAK,GAAG;AACxC,MAAI,QAAQ,OAAO,MAAO,SAAQ,IAAI,IAAI,GAAG,KAAK,GAAG,EAAE;AACvD,cAAY,IAAI;AAClB;AAGO,SAAS,QAAQ,KAAa,KAAmB;AACtD,MAAI,CAAC,UAAU,KAAK,EAAG;AACvB,QAAM,OAAO,WAAW,QAAQ,KAAK,GAAG;AACxC,MAAI,QAAQ,OAAO,MAAO,SAAQ,KAAK,IAAI,GAAG,KAAK,GAAG,EAAE;AACxD,cAAY,IAAI;AAClB;AAGO,SAAS,SAAS,KAAa,KAAa,KAAqB;AACtE,MAAI,CAAC,UAAU,KAAK,EAAG;AACvB,QAAM,SAAS,eAAe,QAAQ,IAAI,UAAW,OAAO,QAAQ,YAAY,QAAQ,OAAO,KAAK,UAAU,GAAG,IAAI,OAAO,OAAO,EAAE;AACrI,QAAM,UAAU,SAAS,GAAG,GAAG,WAAM,MAAM,KAAK;AAChD,QAAM,OAAO,WAAW,SAAS,KAAK,OAAO;AAC7C,MAAI,KAAK;AAAE,QAAI,QAAQ,OAAO,MAAO,SAAQ,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG;AAAA,EAAG,OACvE;AAAE,QAAI,QAAQ,OAAO,MAAO,SAAQ,MAAM,IAAI,GAAG,KAAK,GAAG,EAAE;AAAA,EAAG;AACnE,cAAY,IAAI;AAClB;AAGO,SAAS,SAAS,KAAa,KAAmB;AACvD,MAAI,CAAC,UAAU,OAAO,EAAG;AACzB,QAAM,OAAO,WAAW,SAAS,KAAK,GAAG;AACzC,MAAI,QAAQ,OAAO,MAAO,SAAQ,IAAI,IAAI,GAAG,KAAK,GAAG,EAAE;AACvD,cAAY,IAAI;AAClB;AAGO,SAAS,SAAS,KAAa,KAAmB;AACvD,MAAI,CAAC,UAAU,OAAO,EAAG;AACzB,QAAM,OAAO,WAAW,SAAS,KAAK,GAAG;AACzC,MAAI,QAAQ,OAAO,MAAO,SAAQ,IAAI,IAAI,GAAG,KAAK,GAAG,EAAE;AACvD,cAAY,IAAI;AAClB;AAhLA,IAOM,aACA,SASF,cACE,QACF,aAoBA,QACA,YAyCE,iBA6CF;AA9HJ;AAAA;AAEA;AAKA,IAAM,cAAwC,EAAE,KAAK,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,EAAE;AACnF,IAAM,UAAU,KAAK,WAAW,GAAG,MAAM;AASzC,IAAI,eAAyB;AAC7B,IAAM,SAA4C,QAAQ,IAAI,WAAW;AACzE,IAAI,cAAc,CAAC;AAoBnB,IAAI,SAAmB,CAAC;AACxB,IAAI,aAAmD;AA0BvD,YAAQ,GAAG,QAAQ,KAAK;AAexB,IAAM,kBAAmD;AAAA,MACvD,CAAC,0BAA0B,mBAAmB;AAAA,MAC9C,CAAC,6BAA6B,sBAAsB;AAAA,MACpD,CAAC,yBAAyB,oBAAoB;AAAA,MAC9C,CAAC,yBAAyB,oBAAoB;AAAA,MAC9C,CAAC,iCAAiC,2BAA2B;AAAA,MAC7D,CAAC,iCAAiC,qBAAqB;AAAA,MACvD,CAAC,2BAA2B,oBAAoB;AAAA,MAChD,CAAC,qBAAqB,oBAAoB;AAAA,MAC1C,CAAC,gCAAgC,iBAAiB;AAAA,MAClD,CAAC,+BAA+B,uBAAuB;AAAA,MACvD,CAAC,qEAAqE,oBAAoB;AAAA,MAC1F,CAAC,wBAAwB,mBAAmB;AAAA,MAC5C,CAAC,yBAAyB,oBAAoB;AAAA,MAC9C,CAAC,6BAA6B,wBAAwB;AAAA,MACtD,CAAC,6BAA6B,wBAAwB;AAAA,MACtD,CAAC,2BAA2B,mBAAmB;AAAA,MAC/C,CAAC,yFAAyF,mBAAmB;AAAA,MAC7G,CAAC,qDAAqD,kBAAkB;AAAA,IAC1E;AA0BA,IAAI,YAA8B,QAAQ,IAAI,YAAY,MAA6B,SAAS,SAAS;AAAA;AAAA;",
   "names": []
 }

package/bundle/{chunk-EFJVUJBE.js → chunk-Y5FEFKGM.js}

@@ -4,26 +4,26 @@ import {
   buildUsersBlock,
   init_user_registry,
   loadUsers
-} from "./chunk-ZV4IWKDJ.js";
+} from "./chunk-E7XD5UGB.js";
 import {
   init_peer_config,
   peer_config_exports
-} from "./chunk-4S554KLW.js";
+} from "./chunk-3BG3AIDP.js";
 import {
   getEnv,
   init_env_schema
-} from "./chunk-65VCEC32.js";
+} from "./chunk-6PA5JBUU.js";
 import {
   init_log_and_swallow,
   logAndSwallow
-} from "./chunk-YSKCQH6E.js";
+} from "./chunk-2IYJ4I66.js";
 import {
   init_logger,
   logDebug,
   logError,
   logInfo,
   logWarn
-} from "./chunk-GWILHZPT.js";
+} from "./chunk-XRTXYN66.js";
 import {
   abtarsHome,
   abtarsRoot,
@@ -175,4 +175,4 @@ export {
   getInstanceName,
   init_soul_bundle
 };
-//# sourceMappingURL=chunk-EFJVUJBE.js.map
+//# sourceMappingURL=chunk-Y5FEFKGM.js.map