anantham-v2 2.0.0-alpha.1

package/dist/models/provider-adapter.d.ts

@@ -0,0 +1,17 @@
+import type { ModelRequest, ModelResponse, ModelStreamChunk } from "../domain/model.js";
+export interface ProviderCapabilities {
+    supportsStreaming: boolean;
+    supportsTools: boolean;
+    supportsVision: boolean;
+    supportsAudio: boolean;
+    maxContextTokens: number;
+    maxOutputTokens: number;
+}
+export interface ProviderAdapter {
+    readonly providerId: string;
+    readonly name: string;
+    getCapabilities(modelId: string): ProviderCapabilities;
+    send(request: ModelRequest): Promise<ModelResponse>;
+    stream(request: ModelRequest): AsyncIterable<ModelStreamChunk>;
+}
+//# sourceMappingURL=provider-adapter.d.ts.map

package/dist/models/provider-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adapter.d.ts","sourceRoot":"","sources":["../../src/models/provider-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAExF,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,oBAAoB,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,aAAa,CAAC,gBAAgB,CAAC,CAAC;CAChE"}

package/dist/models/provider-adapter.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provider-adapter.js.map

package/dist/models/provider-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adapter.js","sourceRoot":"","sources":["../../src/models/provider-adapter.ts"],"names":[],"mappings":""}

package/dist/models/provider-health-tracker.d.ts

@@ -0,0 +1,16 @@
+import { type HealthStatus, type ProviderHealthStatus, type ModelHealthStatus } from "../domain/auth.js";
+/**
+ * Independent health tracking for AI Providers and Models.
+ * PRD Part 3 Section 142.
+ */
+export declare class ProviderHealthTracker {
+    private providerHealth;
+    private modelHealth;
+    getProviderHealth(providerId: string): ProviderHealthStatus;
+    getModelHealth(providerId: string, modelId: string): ModelHealthStatus;
+    setProviderHealth(providerId: string, status: HealthStatus, reason?: string): void;
+    setModelHealth(providerId: string, modelId: string, status: HealthStatus, reason?: string): void;
+    recordSuccess(providerId: string, modelId?: string): void;
+    recordFailure(providerId: string, modelId: string | undefined, error: Error, failureThreshold?: number): void;
+}
+//# sourceMappingURL=provider-health-tracker.d.ts.map

package/dist/models/provider-health-tracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-health-tracker.d.ts","sourceRoot":"","sources":["../../src/models/provider-health-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EAGvB,MAAM,mBAAmB,CAAC;AAG3B;;;GAGG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,cAAc,CAAgD;IACtE,OAAO,CAAC,WAAW,CAA6C;IAEzD,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB;IAc3D,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,iBAAiB;IAgBtE,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAYlF,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAahG,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IA6BzD,aAAa,CAClB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,KAAK,EAAE,KAAK,EACZ,gBAAgB,SAAI,GACnB,IAAI;CAsCR"}

package/dist/models/provider-health-tracker.js

@@ -0,0 +1,112 @@
+import { ProviderHealthStatusSchema, ModelHealthStatusSchema, } from "../domain/auth.js";
+import { ProviderUnavailableError } from "./model-errors.js";
+/**
+ * Independent health tracking for AI Providers and Models.
+ * PRD Part 3 Section 142.
+ */
+export class ProviderHealthTracker {
+    providerHealth = new Map();
+    modelHealth = new Map();
+    getProviderHealth(providerId) {
+        const existing = this.providerHealth.get(providerId);
+        if (existing)
+            return existing;
+        const initial = {
+            providerId,
+            status: "healthy",
+            consecutiveFailures: 0,
+            lastCheckedAt: new Date().toISOString(),
+        };
+        this.providerHealth.set(providerId, initial);
+        return initial;
+    }
+    getModelHealth(providerId, modelId) {
+        const key = `${providerId}:${modelId}`;
+        const existing = this.modelHealth.get(key);
+        if (existing)
+            return existing;
+        const initial = {
+            providerId,
+            modelId,
+            status: "healthy",
+            consecutiveFailures: 0,
+            lastCheckedAt: new Date().toISOString(),
+        };
+        this.modelHealth.set(key, initial);
+        return initial;
+    }
+    setProviderHealth(providerId, status, reason) {
+        const current = this.getProviderHealth(providerId);
+        const updated = ProviderHealthStatusSchema.parse({
+            ...current,
+            status,
+            reason,
+            lastCheckedAt: new Date().toISOString(),
+            consecutiveFailures: status === "healthy" ? 0 : current.consecutiveFailures,
+        });
+        this.providerHealth.set(providerId, updated);
+    }
+    setModelHealth(providerId, modelId, status, reason) {
+        const key = `${providerId}:${modelId}`;
+        const current = this.getModelHealth(providerId, modelId);
+        const updated = ModelHealthStatusSchema.parse({
+            ...current,
+            status,
+            reason,
+            lastCheckedAt: new Date().toISOString(),
+            consecutiveFailures: status === "healthy" ? 0 : current.consecutiveFailures,
+        });
+        this.modelHealth.set(key, updated);
+    }
+    recordSuccess(providerId, modelId) {
+        const prov = this.getProviderHealth(providerId);
+        this.providerHealth.set(providerId, ProviderHealthStatusSchema.parse({
+            ...prov,
+            status: "healthy",
+            consecutiveFailures: 0,
+            lastCheckedAt: new Date().toISOString(),
+            reason: undefined,
+        }));
+        if (modelId) {
+            const mod = this.getModelHealth(providerId, modelId);
+            const key = `${providerId}:${modelId}`;
+            this.modelHealth.set(key, ModelHealthStatusSchema.parse({
+                ...mod,
+                status: "healthy",
+                consecutiveFailures: 0,
+                lastCheckedAt: new Date().toISOString(),
+                reason: undefined,
+            }));
+        }
+    }
+    recordFailure(providerId, modelId, error, failureThreshold = 3) {
+        const isOutage = error instanceof ProviderUnavailableError;
+        const prov = this.getProviderHealth(providerId);
+        const failures = prov.consecutiveFailures + 1;
+        let newStatus = prov.status;
+        if (isOutage || failures >= failureThreshold) {
+            newStatus = failures >= failureThreshold * 2 ? "unavailable" : "degraded";
+        }
+        this.providerHealth.set(providerId, ProviderHealthStatusSchema.parse({
+            ...prov,
+            status: newStatus,
+            consecutiveFailures: failures,
+            lastCheckedAt: new Date().toISOString(),
+            reason: error.message,
+        }));
+        if (modelId) {
+            const mod = this.getModelHealth(providerId, modelId);
+            const modFailures = mod.consecutiveFailures + 1;
+            const modStatus = modFailures >= failureThreshold ? "degraded" : "healthy";
+            const key = `${providerId}:${modelId}`;
+            this.modelHealth.set(key, ModelHealthStatusSchema.parse({
+                ...mod,
+                status: modStatus,
+                consecutiveFailures: modFailures,
+                lastCheckedAt: new Date().toISOString(),
+                reason: error.message,
+            }));
+        }
+    }
+}
+//# sourceMappingURL=provider-health-tracker.js.map

package/dist/models/provider-health-tracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-health-tracker.js","sourceRoot":"","sources":["../../src/models/provider-health-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IACxB,cAAc,GAAsC,IAAI,GAAG,EAAE,CAAC;IAC9D,WAAW,GAAmC,IAAI,GAAG,EAAE,CAAC;IAEzD,iBAAiB,CAAC,UAAkB;QACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAyB;YACpC,UAAU;YACV,MAAM,EAAE,SAAS;YACjB,mBAAmB,EAAE,CAAC;YACtB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACxC,CAAC;QACF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,cAAc,CAAC,UAAkB,EAAE,OAAe;QACvD,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAsB;YACjC,UAAU;YACV,OAAO;YACP,MAAM,EAAE,SAAS;YACjB,mBAAmB,EAAE,CAAC;YACtB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACxC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,iBAAiB,CAAC,UAAkB,EAAE,MAAoB,EAAE,MAAe;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC;YAC/C,GAAG,OAAO;YACV,MAAM;YACN,MAAM;YACN,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACvC,mBAAmB,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB;SAC5E,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAEM,cAAc,CAAC,UAAkB,EAAE,OAAe,EAAE,MAAoB,EAAE,MAAe;QAC9F,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC;YAC5C,GAAG,OAAO;YACV,MAAM;YACN,MAAM;YACN,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACvC,mBAAmB,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB;SAC5E,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAEM,aAAa,CAAC,UAAkB,EAAE,OAAgB;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CACrB,UAAU,EACV,0BAA0B,CAAC,KAAK,CAAC;YAC/B,GAAG,IAAI;YACP,MAAM,EAAE,SAAS;YACjB,mBAAmB,EAAE,CAAC;YACtB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACvC,MAAM,EAAE,SAAS;SAClB,CAAC,CACH,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,CAAC,GAAG,CAClB,GAAG,EACH,uBAAuB,CAAC,KAAK,CAAC;gBAC5B,GAAG,GAAG;gBACN,MAAM,EAAE,SAAS;gBACjB,mBAAmB,EAAE,CAAC;gBACtB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACvC,MAAM,EAAE,SAAS;aAClB,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAEM,aAAa,CAClB,UAAkB,EAClB,OAA2B,EAC3B,KAAY,EACZ,gBAAgB,GAAG,CAAC;QAEpB,MAAM,QAAQ,GAAG,KAAK,YAAY,wBAAwB,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC;QAE9C,IAAI,SAAS,GAAiB,IAAI,CAAC,MAAM,CAAC;QAC1C,IAAI,QAAQ,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YAC7C,SAAS,GAAG,QAAQ,IAAI,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,GAAG,CACrB,UAAU,EACV,0BAA0B,CAAC,KAAK,CAAC;YAC/B,GAAG,IAAI;YACP,MAAM,EAAE,SAAS;YACjB,mBAAmB,EAAE,QAAQ;YAC7B,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACvC,MAAM,EAAE,KAAK,CAAC,OAAO;SACtB,CAAC,CACH,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,WAAW,GAAG,GAAG,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAChD,MAAM,SAAS,GAAiB,WAAW,IAAI,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACzF,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,CAAC,GAAG,CAClB,GAAG,EACH,uBAAuB,CAAC,KAAK,CAAC;gBAC5B,GAAG,GAAG;gBACN,MAAM,EAAE,SAAS;gBACjB,mBAAmB,EAAE,WAAW;gBAChC,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACvC,MAAM,EAAE,KAAK,CAAC,OAAO;aACtB,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/models/provider-registry.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+/**
+ * Provider endpoint and protocol configuration schema.
+ * PRD Part 2 Section 42 & PRD Part 3 Section 142.
+ */
+export declare const ProviderProtocolSchema: z.ZodEnum<["openrouter", "openai", "anthropic", "gemini", "openai-compatible", "anthropic-compatible", "custom"]>;
+export type ProviderProtocol = z.infer<typeof ProviderProtocolSchema>;
+export declare const ProviderDefinitionSchema: z.ZodObject<{
+    providerId: z.ZodString;
+    name: z.ZodString;
+    protocol: z.ZodEnum<["openrouter", "openai", "anthropic", "gemini", "openai-compatible", "anthropic-compatible", "custom"]>;
+    baseUrl: z.ZodString;
+    supportedModels: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    authProfileId: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    providerId: string;
+    timeoutMs: number;
+    supportedModels: string[];
+    protocol: "custom" | "openai" | "anthropic" | "openrouter" | "gemini" | "openai-compatible" | "anthropic-compatible";
+    baseUrl: string;
+    authProfileId?: string | undefined;
+}, {
+    name: string;
+    providerId: string;
+    protocol: "custom" | "openai" | "anthropic" | "openrouter" | "gemini" | "openai-compatible" | "anthropic-compatible";
+    baseUrl: string;
+    authProfileId?: string | undefined;
+    timeoutMs?: number | undefined;
+    supportedModels?: string[] | undefined;
+}>;
+export type ProviderDefinition = z.infer<typeof ProviderDefinitionSchema>;
+/**
+ * Validates endpoint URL for SSRF protection (must be http or https).
+ */
+export declare function validateEndpointUrl(urlStr: string): string;
+/**
+ * Central registry of available AI providers, endpoints, and protocol adapters.
+ */
+export declare class ProviderRegistry {
+    private providers;
+    registerProvider(definition: ProviderDefinition): void;
+    getProvider(providerId: string): ProviderDefinition | undefined;
+    listProviders(): ProviderDefinition[];
+    removeProvider(providerId: string): boolean;
+}
+//# sourceMappingURL=provider-registry.d.ts.map

package/dist/models/provider-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.d.ts","sourceRoot":"","sources":["../../src/models/provider-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,sBAAsB,mHAQjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;EAQnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAa1D;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,SAAS,CAA8C;IAExD,gBAAgB,CAAC,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAMtD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAI/D,aAAa,IAAI,kBAAkB,EAAE;IAIrC,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;CAGnD"}

package/dist/models/provider-registry.js

@@ -0,0 +1,60 @@
+import { z } from "zod";
+/**
+ * Provider endpoint and protocol configuration schema.
+ * PRD Part 2 Section 42 & PRD Part 3 Section 142.
+ */
+export const ProviderProtocolSchema = z.enum([
+    "openrouter",
+    "openai",
+    "anthropic",
+    "gemini",
+    "openai-compatible",
+    "anthropic-compatible",
+    "custom",
+]);
+export const ProviderDefinitionSchema = z.object({
+    providerId: z.string().min(1),
+    name: z.string().min(1),
+    protocol: ProviderProtocolSchema,
+    baseUrl: z.string().url(),
+    supportedModels: z.array(z.string()).default([]),
+    authProfileId: z.string().optional(),
+    timeoutMs: z.number().int().positive().default(30000),
+});
+/**
+ * Validates endpoint URL for SSRF protection (must be http or https).
+ */
+export function validateEndpointUrl(urlStr) {
+    let parsed;
+    try {
+        parsed = new URL(urlStr);
+    }
+    catch (err) {
+        throw new Error(`Invalid provider endpoint URL: ${urlStr}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`Unsupported provider URL scheme '${parsed.protocol}'. Only http: and https: are allowed.`);
+    }
+    return urlStr;
+}
+/**
+ * Central registry of available AI providers, endpoints, and protocol adapters.
+ */
+export class ProviderRegistry {
+    providers = new Map();
+    registerProvider(definition) {
+        const validated = ProviderDefinitionSchema.parse(definition);
+        validateEndpointUrl(validated.baseUrl);
+        this.providers.set(validated.providerId, validated);
+    }
+    getProvider(providerId) {
+        return this.providers.get(providerId);
+    }
+    listProviders() {
+        return Array.from(this.providers.values());
+    }
+    removeProvider(providerId) {
+        return this.providers.delete(providerId);
+    }
+}
+//# sourceMappingURL=provider-registry.js.map

package/dist/models/provider-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-registry.js","sourceRoot":"","sources":["../../src/models/provider-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3C,YAAY;IACZ,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,mBAAmB;IACnB,sBAAsB;IACtB,QAAQ;CACT,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,sBAAsB;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAChD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACtD,CAAC,CAAC;AAGH;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,QAAQ,uCAAuC,CAAC,CAAC;IAC9G,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACnB,SAAS,GAAoC,IAAI,GAAG,EAAE,CAAC;IAExD,gBAAgB,CAAC,UAA8B;QACpD,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7D,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACtD,CAAC;IAEM,WAAW,CAAC,UAAkB;QACnC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAEM,aAAa;QAClB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEM,cAAc,CAAC,UAAkB;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;CACF"}

package/dist/models/secret-store.d.ts

@@ -0,0 +1,19 @@
+/**
+ * SecretStore abstraction for OS/in-memory encrypted key storage.
+ * Critical Invariant: Raw secrets must never leave this boundary except to the ProviderAdapter.
+ */
+export interface SecretStore {
+    getSecret(credentialId: string): Promise<string | undefined>;
+    setSecret(credentialId: string, secret: string): Promise<void>;
+    deleteSecret(credentialId: string): Promise<boolean>;
+    hasSecret(credentialId: string): Promise<boolean>;
+}
+export declare function maskSecret(secret: string): string;
+export declare class InMemorySecretStore implements SecretStore {
+    private secrets;
+    getSecret(credentialId: string): Promise<string | undefined>;
+    setSecret(credentialId: string, secret: string): Promise<void>;
+    deleteSecret(credentialId: string): Promise<boolean>;
+    hasSecret(credentialId: string): Promise<boolean>;
+}
+//# sourceMappingURL=secret-store.d.ts.map

package/dist/models/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../src/models/secret-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnD;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,OAAO,CAAkC;IAEpC,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAI5D,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9D,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIpD,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAG/D"}

package/dist/models/secret-store.js

@@ -0,0 +1,27 @@
+export function maskSecret(secret) {
+    if (!secret || secret.length < 8) {
+        return "****";
+    }
+    const prefix = secret.slice(0, 3);
+    const suffix = secret.slice(-4);
+    return `${prefix}...${suffix}`;
+}
+export class InMemorySecretStore {
+    secrets = new Map();
+    async getSecret(credentialId) {
+        return this.secrets.get(credentialId);
+    }
+    async setSecret(credentialId, secret) {
+        if (!secret || typeof secret !== "string") {
+            throw new Error("Secret must be a non-empty string");
+        }
+        this.secrets.set(credentialId, secret);
+    }
+    async deleteSecret(credentialId) {
+        return this.secrets.delete(credentialId);
+    }
+    async hasSecret(credentialId) {
+        return this.secrets.has(credentialId);
+    }
+}
+//# sourceMappingURL=secret-store.js.map

package/dist/models/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../src/models/secret-store.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,GAAG,MAAM,MAAM,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,mBAAmB;IACtB,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE1C,KAAK,CAAC,SAAS,CAAC,YAAoB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,YAAoB,EAAE,MAAc;QACzD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,YAAoB;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,YAAoB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/observability/audit-logger.d.ts

@@ -0,0 +1,48 @@
+import { type HarnessEvent } from "../domain/event.js";
+import { type SecurityAuditRecord, type SecurityEventClassification } from "../domain/observability.js";
+export interface AuditQueryOptions {
+    projectId?: string;
+    classification?: SecurityEventClassification;
+    decision?: "PERMIT" | "DENY" | "MONITOR" | "RETRY_EXHAUSTED" | "UNKNOWN";
+    limit?: number;
+}
+export interface VerificationResult {
+    valid: boolean;
+    tamperedIndex?: number;
+    message?: string;
+}
+/**
+ * Cryptographic Tamper-Evident Audit Logger.
+ * PRD Part 1 Section 40 / PRD Part 3 Section 85.
+ */
+export declare class AuditLogger {
+    private readonly records;
+    private lastDigest;
+    /**
+     * Deterministically compute SHA-256 hash over canonical JSON representation.
+     */
+    static computeDigest(obj: unknown): string;
+    /**
+     * Record a security/audit event with cryptographic digest chaining.
+     */
+    record(params: {
+        event: Partial<HarnessEvent>;
+        actor: string;
+        action: string;
+        classification: SecurityEventClassification;
+        decision: "PERMIT" | "DENY" | "MONITOR" | "RETRY_EXHAUSTED" | "UNKNOWN";
+        reasonCode: string;
+        metadata?: Record<string, unknown>;
+    }): SecurityAuditRecord;
+    /**
+     * Cryptographically verify the integrity of the audit chain.
+     */
+    static verifyChain(records: SecurityAuditRecord[]): VerificationResult;
+    /**
+     * Query audit records with project isolation.
+     */
+    query(options: AuditQueryOptions): SecurityAuditRecord[];
+    getHeadDigest(): string;
+    getAllRecords(): SecurityAuditRecord[];
+}
+//# sourceMappingURL=audit-logger.d.ts.map

package/dist/observability/audit-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/observability/audit-logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAEjC,MAAM,4BAA4B,CAAC;AAGpC,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,2BAA2B,CAAC;IAC7C,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,UAAU,CAA8E;IAEhG;;OAEG;WACW,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM;IAkBjD;;OAEG;IACI,MAAM,CAAC,MAAM,EAAE;QACpB,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,2BAA2B,CAAC;QAC5C,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAAC;QACxE,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACpC,GAAG,mBAAmB;IA+CvB;;OAEG;WACW,WAAW,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,kBAAkB;IAkD7E;;OAEG;IACI,KAAK,CAAC,OAAO,EAAE,iBAAiB,GAAG,mBAAmB,EAAE;IAiBxD,aAAa,IAAI,MAAM;IAIvB,aAAa,IAAI,mBAAmB,EAAE;CAG9C"}

package/dist/observability/audit-logger.js

@@ -0,0 +1,139 @@
+import { createHash, randomUUID } from "node:crypto";
+import { SecurityAuditRecordSchema, } from "../domain/observability.js";
+import { ContentSanitizer } from "../content/content-sanitizer.js";
+/**
+ * Cryptographic Tamper-Evident Audit Logger.
+ * PRD Part 1 Section 40 / PRD Part 3 Section 85.
+ */
+export class AuditLogger {
+    records = [];
+    lastDigest = "0000000000000000000000000000000000000000000000000000000000000000";
+    /**
+     * Deterministically compute SHA-256 hash over canonical JSON representation.
+     */
+    static computeDigest(obj) {
+        const canonicalJson = (value) => {
+            if (value === null || typeof value !== "object") {
+                return JSON.stringify(value);
+            }
+            if (Array.isArray(value)) {
+                return `[${value.map(canonicalJson).join(",")}]`;
+            }
+            const keys = Object.keys(value).sort();
+            const entries = keys.map((k) => `"${k}":${canonicalJson(value[k])}`);
+            return `{${entries.join(",")}}`;
+        };
+        return createHash("sha256").update(canonicalJson(obj)).digest("hex");
+    }
+    /**
+     * Record a security/audit event with cryptographic digest chaining.
+     */
+    record(params) {
+        const auditId = `audit_${randomUUID().slice(0, 8)}`;
+        const eventId = params.event.id ?? `evt_${randomUUID().slice(0, 8)}`;
+        const timestamp = params.event.timestamp ?? new Date().toISOString();
+        // 1. Sanitize payload to guarantee zero secret leakage
+        const sanitizedPayload = ContentSanitizer.sanitize((params.event.payload ?? {}));
+        const payloadDigest = AuditLogger.computeDigest(sanitizedPayload);
+        // 2. Compute canonical record digest including previousRecordDigest
+        const previousRecordDigest = this.lastDigest;
+        const recordContentForDigest = {
+            auditId,
+            eventId,
+            timestamp,
+            projectId: params.event.projectId,
+            sessionId: params.event.sessionId,
+            taskId: params.event.taskId,
+            agentId: params.event.agentId,
+            actor: params.actor,
+            action: params.action,
+            classification: params.classification,
+            decision: params.decision,
+            reasonCode: params.reasonCode,
+            correlationId: params.event.correlationId,
+            parentEventId: params.event.parentEventId,
+            payloadDigest,
+            previousRecordDigest,
+        };
+        const recordDigest = AuditLogger.computeDigest(recordContentForDigest);
+        const record = SecurityAuditRecordSchema.parse({
+            ...recordContentForDigest,
+            schemaVersion: 1,
+            metadata: params.metadata ?? {},
+            recordDigest,
+        });
+        this.records.push(record);
+        this.lastDigest = recordDigest;
+        return record;
+    }
+    /**
+     * Cryptographically verify the integrity of the audit chain.
+     */
+    static verifyChain(records) {
+        let expectedPrevious = "0000000000000000000000000000000000000000000000000000000000000000";
+        for (let i = 0; i < records.length; i++) {
+            const rec = records[i];
+            // 1. Verify previousRecordDigest links to previous record
+            if (rec.previousRecordDigest !== expectedPrevious) {
+                return {
+                    valid: false,
+                    tamperedIndex: i,
+                    message: `Digest chain broken at index ${i}: expected previous '${expectedPrevious}', found '${rec.previousRecordDigest}'`,
+                };
+            }
+            // 2. Recompute recordDigest over canonical fields
+            const content = {
+                auditId: rec.auditId,
+                eventId: rec.eventId,
+                timestamp: rec.timestamp,
+                projectId: rec.projectId,
+                sessionId: rec.sessionId,
+                taskId: rec.taskId,
+                agentId: rec.agentId,
+                actor: rec.actor,
+                action: rec.action,
+                classification: rec.classification,
+                decision: rec.decision,
+                reasonCode: rec.reasonCode,
+                correlationId: rec.correlationId,
+                parentEventId: rec.parentEventId,
+                payloadDigest: rec.payloadDigest,
+                previousRecordDigest: rec.previousRecordDigest,
+            };
+            const computed = AuditLogger.computeDigest(content);
+            if (computed !== rec.recordDigest) {
+                return {
+                    valid: false,
+                    tamperedIndex: i,
+                    message: `Record digest tampered at index ${i}: expected '${computed}', found '${rec.recordDigest}'`,
+                };
+            }
+            expectedPrevious = rec.recordDigest;
+        }
+        return { valid: true };
+    }
+    /**
+     * Query audit records with project isolation.
+     */
+    query(options) {
+        let results = this.records;
+        if (options.projectId) {
+            results = results.filter((r) => r.projectId === options.projectId);
+        }
+        if (options.classification) {
+            results = results.filter((r) => r.classification === options.classification);
+        }
+        if (options.decision) {
+            results = results.filter((r) => r.decision === options.decision);
+        }
+        const limit = options.limit ?? 100;
+        return results.slice(-limit);
+    }
+    getHeadDigest() {
+        return this.lastDigest;
+    }
+    getAllRecords() {
+        return [...this.records];
+    }
+}
+//# sourceMappingURL=audit-logger.js.map

package/dist/observability/audit-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/observability/audit-logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD,OAAO,EAGL,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAenE;;;GAGG;AACH,MAAM,OAAO,WAAW;IACL,OAAO,GAA0B,EAAE,CAAC;IAC7C,UAAU,GAAW,kEAAkE,CAAC;IAEhG;;OAEG;IACI,MAAM,CAAC,aAAa,CAAC,GAAY;QACtC,MAAM,aAAa,GAAG,CAAC,KAAc,EAAU,EAAE;YAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACnD,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACtB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,aAAa,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,EAAE,CACxE,CAAC;YACF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClC,CAAC,CAAC;QAEF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,MAQb;QACC,MAAM,OAAO,GAAG,SAAS,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErE,uDAAuD;QACvD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,QAAQ,CAChD,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAA4B,CACxD,CAAC;QACF,MAAM,aAAa,GAAG,WAAW,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC;QAElE,oEAAoE;QACpE,MAAM,oBAAoB,GAAG,IAAI,CAAC,UAAU,CAAC;QAC7C,MAAM,sBAAsB,GAAG;YAC7B,OAAO;YACP,OAAO;YACP,SAAS;YACT,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;YACjC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS;YACjC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;YAC3B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;YACzC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa;YACzC,aAAa;YACb,oBAAoB;SACrB,CAAC;QAEF,MAAM,YAAY,GAAG,WAAW,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC;QAEvE,MAAM,MAAM,GAAwB,yBAAyB,CAAC,KAAK,CAAC;YAClE,GAAG,sBAAsB;YACzB,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;YAC/B,YAAY;SACb,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC;QAE/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,WAAW,CAAC,OAA8B;QACtD,IAAI,gBAAgB,GAAG,kEAAkE,CAAC;QAE1F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;YAExB,0DAA0D;YAC1D,IAAI,GAAG,CAAC,oBAAoB,KAAK,gBAAgB,EAAE,CAAC;gBAClD,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,aAAa,EAAE,CAAC;oBAChB,OAAO,EAAE,gCAAgC,CAAC,wBAAwB,gBAAgB,aAAa,GAAG,CAAC,oBAAoB,GAAG;iBAC3H,CAAC;YACJ,CAAC;YAED,kDAAkD;YAClD,MAAM,OAAO,GAAG;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;aAC/C,CAAC;YAEF,MAAM,QAAQ,GAAG,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,QAAQ,KAAK,GAAG,CAAC,YAAY,EAAE,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,aAAa,EAAE,CAAC;oBAChB,OAAO,EAAE,mCAAmC,CAAC,eAAe,QAAQ,aAAa,GAAG,CAAC,YAAY,GAAG;iBACrG,CAAC;YACJ,CAAC;YAED,gBAAgB,GAAG,GAAG,CAAC,YAAY,CAAC;QACtC,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,OAA0B;QACrC,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAE3B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC;QACnC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEM,aAAa;QAClB,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEM,aAAa;QAClB,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;CACF"}

package/dist/observability/compliance-exporter.d.ts

@@ -0,0 +1,11 @@
+import { type AuditLogger } from "./audit-logger.js";
+import { type ComplianceReport } from "../domain/observability.js";
+export declare class ComplianceExporter {
+    private readonly auditLogger;
+    constructor(auditLogger: AuditLogger);
+    /**
+     * Export a verifiable compliance audit report for a project.
+     */
+    exportReport(projectId: string): ComplianceReport;
+}
+//# sourceMappingURL=compliance-exporter.d.ts.map

package/dist/observability/compliance-exporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-exporter.d.ts","sourceRoot":"","sources":["../../src/observability/compliance-exporter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,4BAA4B,CAAC;AAGpC,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;gBAE9B,WAAW,EAAE,WAAW;IAIpC;;OAEG;IACI,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB;CA+BzD"}

package/dist/observability/compliance-exporter.js

@@ -0,0 +1,35 @@
+import { randomUUID } from "node:crypto";
+import { ComplianceReportSchema, } from "../domain/observability.js";
+import { AuditLogger as AuditLoggerClass } from "./audit-logger.js";
+export class ComplianceExporter {
+    auditLogger;
+    constructor(auditLogger) {
+        this.auditLogger = auditLogger;
+    }
+    /**
+     * Export a verifiable compliance audit report for a project.
+     */
+    exportReport(projectId) {
+        const records = this.auditLogger.query({ projectId, limit: 10000 });
+        const verifyResult = AuditLoggerClass.verifyChain(records);
+        const policyDenials = records.filter((r) => r.decision === "DENY" || r.classification === "POLICY_DENIED" || r.classification === "TOOL_DENIED").length;
+        const securityAnomalies = records.filter((r) => r.classification === "PROMPT_INJECTION" ||
+            r.classification === "PROJECT_ISOLATION_VIOLATION" ||
+            r.classification === "SIGNATURE_FAILURE" ||
+            r.classification === "AUTHENTICATION_FAILURE" ||
+            r.classification === "REPLAY_ATTEMPT").length;
+        const headDigest = records.length > 0 ? records[records.length - 1].recordDigest : "0000000000000000000000000000000000000000000000000000000000000000";
+        return ComplianceReportSchema.parse({
+            reportId: `compliance_${randomUUID().slice(0, 8)}`,
+            generatedAt: new Date().toISOString(),
+            projectId,
+            totalAuditEvents: records.length,
+            chainIntegrityVerified: verifyResult.valid,
+            policyDenialsCount: policyDenials,
+            securityAnomaliesCount: securityAnomalies,
+            auditHeadDigest: headDigest,
+            records,
+        });
+    }
+}
+//# sourceMappingURL=compliance-exporter.js.map

package/dist/observability/compliance-exporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance-exporter.js","sourceRoot":"","sources":["../../src/observability/compliance-exporter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAEL,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,WAAW,IAAI,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEpE,MAAM,OAAO,kBAAkB;IACZ,WAAW,CAAc;IAE1C,YAAY,WAAwB;QAClC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED;;OAEG;IACI,YAAY,CAAC,SAAiB;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,gBAAgB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAE3D,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,cAAc,KAAK,eAAe,IAAI,CAAC,CAAC,cAAc,KAAK,aAAa,CAC3G,CAAC,MAAM,CAAC;QAET,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,cAAc,KAAK,kBAAkB;YACvC,CAAC,CAAC,cAAc,KAAK,6BAA6B;YAClD,CAAC,CAAC,cAAc,KAAK,mBAAmB;YACxC,CAAC,CAAC,cAAc,KAAK,wBAAwB;YAC7C,CAAC,CAAC,cAAc,KAAK,gBAAgB,CACxC,CAAC,MAAM,CAAC;QAET,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,YAAY,CAAC,CAAC,CAAC,kEAAkE,CAAC;QAEvJ,OAAO,sBAAsB,CAAC,KAAK,CAAC;YAClC,QAAQ,EAAE,cAAc,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YAClD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,SAAS;YACT,gBAAgB,EAAE,OAAO,CAAC,MAAM;YAChC,sBAAsB,EAAE,YAAY,CAAC,KAAK;YAC1C,kBAAkB,EAAE,aAAa;YACjC,sBAAsB,EAAE,iBAAiB;YACzC,eAAe,EAAE,UAAU;YAC3B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/observability/diagnostic-inspector.d.ts

@@ -0,0 +1,27 @@
+import { type SqliteEngine } from "../persistence/sqlite-engine.js";
+import { type TaskRepository } from "../persistence/repositories/task-repository.js";
+import { type LeaseRepository } from "../persistence/repositories/lease-repository.js";
+import { type JobRepository } from "../persistence/repositories/job-repository.js";
+import { type DiagnosticReport } from "../domain/observability.js";
+export interface DiagnosticInspectorOptions {
+    engine: SqliteEngine;
+    taskRepo?: TaskRepository;
+    leaseRepo?: LeaseRepository;
+    jobRepo?: JobRepository;
+}
+/**
+ * Diagnostic Inspector & System Doctor.
+ * PRD Part 2 Section 170.
+ */
+export declare class DiagnosticInspector {
+    private readonly engine;
+    private readonly taskRepo?;
+    private readonly leaseRepo?;
+    private readonly jobRepo?;
+    constructor(options: DiagnosticInspectorOptions);
+    /**
+     * Run full system diagnostic inspection.
+     */
+    inspect(): DiagnosticReport;
+}
+//# sourceMappingURL=diagnostic-inspector.d.ts.map

package/dist/observability/diagnostic-inspector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic-inspector.d.ts","sourceRoot":"","sources":["../../src/observability/diagnostic-inspector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,+CAA+C,CAAC;AACnF,OAAO,EACL,KAAK,gBAAgB,EAEtB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAgB;gBAE7B,OAAO,EAAE,0BAA0B;IAO/C;;OAEG;IACI,OAAO,IAAI,gBAAgB;CA2GnC"}