bulkhead-runtime 0.1.0 → 2026.4.5-beta.2

package/dist/memory/simple-manager.js

@@ -1,16 +1,16 @@
-// Simple memory manager that wraps OpenClaw's search/indexing components
-// with a user-friendly store/search/delete/list API.
 import * as fs from "node:fs";
 import * as path from "node:path";
+import * as crypto from "node:crypto";
 import { requireNodeSqlite } from "./sqlite.js";
 import { cosineSimilarity, parseEmbedding, hashText } from "./internal.js";
 import { extractKeywords } from "./query-expansion.js";
-import { buildFtsQuery, bm25RankToScore } from "./hybrid.js";
-import { mergeHybridResults } from "./hybrid.js";
+import { buildFtsQuery, bm25RankToScore, mergeHybridResults } from "./hybrid.js";
 import { debugEmbeddingsLog } from "./embeddings-debug.js";
+import { createEmbeddingCache, hashContent } from "./embedding-cache.js";
 const SNIPPET_MAX_CHARS = 700;
+const MAX_VECTOR_SEARCH_CHUNKS = 10_000;
 function generateId() {
-    return `mem_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+    return `mem_${Date.now()}_${crypto.randomBytes(4).toString("hex")}`;
 }
 export function createSimpleMemoryManager(options) {
     fs.mkdirSync(options.dbDir, { recursive: true });
@@ -36,11 +36,15 @@ export function createSimpleMemoryManager(options) {
     )
   `);
     let ftsAvailable = false;
+    let stmtFtsInsert = null;
+    let stmtFtsDelete = null;
     try {
         db.exec(`
       CREATE VIRTUAL TABLE IF NOT EXISTS chunks_fts
       USING fts5(id, content, source, model)
     `);
+        stmtFtsInsert = db.prepare("INSERT INTO chunks_fts(id, content, source, model) VALUES (?, ?, ?, ?)");
+        stmtFtsDelete = db.prepare("DELETE FROM chunks_fts WHERE id = ?");
         ftsAvailable = true;
     }
     catch {
@@ -48,6 +52,10 @@ export function createSimpleMemoryManager(options) {
     }
     const provider = options.embeddingProvider ?? null;
     const providerModel = provider ? `${provider.id}/${provider.model}` : "none";
+    const embeddingCache = (options.enableEmbeddingCache !== false && provider)
+        ? createEmbeddingCache(db)
+        : null;
+    const maxCacheEntries = options.maxCacheEntries ?? 50_000;
     const stmtInsert = db.prepare(`
     INSERT OR REPLACE INTO chunks (id, content, embedding, metadata, source, path, model, start_line, end_line, hash, created_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
@@ -63,18 +71,28 @@ export function createSimpleMemoryManager(options) {
             let embeddingJson = null;
             if (provider) {
                 try {
-                    const vec = await provider.embedQuery(content);
+                    const contentHash = hashContent(content);
+                    const cached = embeddingCache?.get(provider.id, provider.model, contentHash);
+                    let vec;
+                    if (cached) {
+                        vec = cached;
+                        debugEmbeddingsLog("embedding from cache", { id, dims: vec.length });
+                    }
+                    else {
+                        vec = await provider.embedQuery(content);
+                        embeddingCache?.set(provider.id, provider.model, "", contentHash, vec, vec.length);
+                        debugEmbeddingsLog("embedded chunk", { id, dims: vec.length });
+                    }
                     embeddingJson = JSON.stringify(vec);
-                    debugEmbeddingsLog("embedded chunk", { id, dims: vec.length });
                 }
                 catch (err) {
                     debugEmbeddingsLog("embedding failed", { id, error: String(err) });
                 }
             }
             stmtInsert.run(id, content, embeddingJson, metadata ? JSON.stringify(metadata) : null, "memory", null, providerModel, 1, 1, hash, now);
-            if (ftsAvailable) {
+            if (stmtFtsInsert) {
                 try {
-                    db.exec(`INSERT INTO chunks_fts(id, content, source, model) VALUES ('${id}', '${content.replaceAll("'", "''")}', 'memory', '${providerModel}')`);
+                    stmtFtsInsert.run(id, content, "memory", providerModel);
                 }
                 catch {
                     // FTS insert failed, keyword search won't find this chunk
@@ -91,7 +109,7 @@ export function createSimpleMemoryManager(options) {
             if (provider) {
                 try {
                     const queryVec = await provider.embedQuery(query);
-                    const rows = db.prepare("SELECT * FROM chunks WHERE embedding IS NOT NULL AND model = ?").all(providerModel);
+                    const rows = db.prepare("SELECT * FROM chunks WHERE embedding IS NOT NULL AND model = ? LIMIT ?").all(providerModel, MAX_VECTOR_SEARCH_CHUNKS);
                     const scored = [];
                     for (const row of rows) {
                         const embedding = parseEmbedding(row.embedding);
@@ -168,9 +186,9 @@ export function createSimpleMemoryManager(options) {
             if (!row)
                 return false;
             stmtDelete.run(id);
-            if (ftsAvailable) {
+            if (stmtFtsDelete) {
                 try {
-                    db.exec(`DELETE FROM chunks_fts WHERE id = '${id}'`);
+                    stmtFtsDelete.run(id);
                 }
                 catch { }
             }
@@ -186,8 +204,13 @@ export function createSimpleMemoryManager(options) {
             }));
         },
         async close() {
+            if (embeddingCache) {
+                embeddingCache.prune(maxCacheEntries);
+            }
             db.close();
         },
+        get db() { return db; },
+        get embeddingCache() { return embeddingCache; },
     };
 }
 //# sourceMappingURL=simple-manager.js.map

package/dist/memory/simple-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"simple-manager.js","sourceRoot":"","sources":["../../src/memory/simple-manager.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,qDAAqD;AAErD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAiB,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAe9B,SAAS,UAAU;IACjB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAmC;IAC3E,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACrD,MAAM,EAAE,YAAY,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAC7C,MAAM,EAAE,GAAiB,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IAElD,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAEtC,+CAA+C;IAC/C,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;GAcP,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC;;;KAGP,CAAC,CAAC;QACH,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC;IACnD,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAE7E,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAG7B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,+EAA+E,CAAC,CAAC;IAChH,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAEhE,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ;YAC3B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAE/B,IAAI,aAAa,GAAkB,IAAI,CAAC;YACxC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBAC/C,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACpC,kBAAkB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAED,UAAU,CAAC,GAAG,CACZ,EAAE,EAAE,OAAO,EAAE,aAAa,EAC1B,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAC1C,QAAQ,EAAE,IAAI,EAAE,aAAa,EAC7B,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAChB,CAAC;YAEF,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,EAAE,CAAC,IAAI,CACL,+DAA+D,EAAE,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,aAAa,IAAI,CACxI,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,0DAA0D;gBAC5D,CAAC;YACH,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI;YACtB,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC;YACrC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;YAEnD,gBAAgB;YAChB,IAAI,aAAa,GAAkI,EAAE,CAAC;YACtJ,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;oBAClD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC,GAAG,CAAC,aAAa,CAAmC,CAAC;oBAE/I,MAAM,MAAM,GAA2D,EAAE,CAAC;oBAC1E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,SAAmB,CAAC,CAAC;wBAC1D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;4BAAE,SAAS;wBACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;wBACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;4BAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC1D,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;oBAEzC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;wBACvE,EAAE,EAAE,GAAG,CAAC,EAAY;wBACpB,IAAI,EAAG,GAAG,CAAC,IAAe,IAAI,EAAE;wBAChC,SAAS,EAAG,GAAG,CAAC,UAAqB,IAAI,CAAC;wBAC1C,OAAO,EAAG,GAAG,CAAC,QAAmB,IAAI,CAAC;wBACtC,MAAM,EAAG,GAAG,CAAC,MAAiB,IAAI,QAAQ;wBAC1C,OAAO,EAAE,CAAE,GAAG,CAAC,OAAkB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC;wBACpE,WAAW,EAAE,KAAK;qBACnB,CAAC,CAAC,CAAC;gBACN,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;YAED,kDAAkD;YAClD,IAAI,cAAc,GAAgI,EAAE,CAAC;YAErJ,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAE7D,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;oBAC/B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;oBACrC,IAAI,CAAC,QAAQ;wBAAE,SAAS;oBACxB,IAAI,CAAC;wBACH,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,yHAAyH,CAC1H,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAyE,CAAC;wBAExG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;4BACvB,cAAc,CAAC,IAAI,CAAC;gCAClB,EAAE,EAAE,GAAG,CAAC,EAAE;gCACV,IAAI,EAAE,EAAE;gCACR,SAAS,EAAE,CAAC;gCACZ,OAAO,EAAE,CAAC;gCACV,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,QAAQ;gCAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC;gCAChD,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;6BACrC,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,mBAAmB;oBACrB,CAAC;gBACH,CAAC;gBAED,8BAA8B;gBAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsC,CAAC;gBAC3D,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;oBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS;wBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBACvE,CAAC;gBACD,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,sCAAsC;YACtC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;gBACtC,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,cAAc;gBACvB,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAChC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aAC/B,CAAC,CAAC;YAEH,OAAO,MAAM;iBACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;iBAClC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAyB,CAAC;QAClD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAwC,CAAC;YACnE,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnB,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,EAAE,CAAC,IAAI,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAyF,CAAC;YACtH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAA6B,CAAC,CAAC,CAAC,SAAS;gBACtF,SAAS,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC,CAAC,CAAC;QACN,CAAC;QAED,KAAK,CAAC,KAAK;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"simple-manager.js","sourceRoot":"","sources":["../../src/memory/simple-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAiB,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AAE9F,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAmBxC,SAAS,UAAU;IACjB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAmC;IAC3E,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACrD,MAAM,EAAE,YAAY,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAC7C,MAAM,EAAE,GAAiB,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IAElD,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACrC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAEtC,+CAA+C;IAC/C,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;GAcP,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,aAAa,GAAyC,IAAI,CAAC;IAC/D,IAAI,aAAa,GAAyC,IAAI,CAAC;IAC/D,IAAI,CAAC;QACH,EAAE,CAAC,IAAI,CAAC;;;KAGP,CAAC,CAAC;QACH,aAAa,GAAG,EAAE,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC;QACrG,aAAa,GAAG,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAClE,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC;IACnD,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAE7E,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,KAAK,IAAI,QAAQ,CAAC;QACzE,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,MAAM,CAAC;IAE1D,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC;;;GAG7B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,EAAE,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,EAAE,CAAC,OAAO,CAAC,+EAA+E,CAAC,CAAC;IAChH,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAEhE,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ;YAC3B,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAE/B,IAAI,aAAa,GAAkB,IAAI,CAAC;YACxC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;oBACzC,MAAM,MAAM,GAAG,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;oBAC7E,IAAI,GAAa,CAAC;oBAClB,IAAI,MAAM,EAAE,CAAC;wBACX,GAAG,GAAG,MAAM,CAAC;wBACb,kBAAkB,CAAC,sBAAsB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBACvE,CAAC;yBAAM,CAAC;wBACN,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;wBACzC,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;wBACnF,kBAAkB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBACjE,CAAC;oBACD,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAED,UAAU,CAAC,GAAG,CACZ,EAAE,EAAE,OAAO,EAAE,aAAa,EAC1B,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAC1C,QAAQ,EAAE,IAAI,EAAE,aAAa,EAC7B,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAChB,CAAC;YAEF,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;gBAC1D,CAAC;gBAAC,MAAM,CAAC;oBACP,0DAA0D;gBAC5D,CAAC;YACH,CAAC;YAED,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI;YACtB,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,CAAC,CAAC;YACrC,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;YAEnD,gBAAgB;YAChB,IAAI,aAAa,GAAkI,EAAE,CAAC;YACtJ,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;oBAClD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,wEAAwE,CACzE,CAAC,GAAG,CAAC,aAAa,EAAE,wBAAwB,CAAmC,CAAC;oBAEjF,MAAM,MAAM,GAA2D,EAAE,CAAC;oBAC1E,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;wBACvB,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,SAAmB,CAAC,CAAC;wBAC1D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;4BAAE,SAAS;wBACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;wBACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;4BAAE,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC1D,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;oBAEzC,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;wBACvE,EAAE,EAAE,GAAG,CAAC,EAAY;wBACpB,IAAI,EAAG,GAAG,CAAC,IAAe,IAAI,EAAE;wBAChC,SAAS,EAAG,GAAG,CAAC,UAAqB,IAAI,CAAC;wBAC1C,OAAO,EAAG,GAAG,CAAC,QAAmB,IAAI,CAAC;wBACtC,MAAM,EAAG,GAAG,CAAC,MAAiB,IAAI,QAAQ;wBAC1C,OAAO,EAAE,CAAE,GAAG,CAAC,OAAkB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC;wBACpE,WAAW,EAAE,KAAK;qBACnB,CAAC,CAAC,CAAC;gBACN,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;YAED,kDAAkD;YAClD,IAAI,cAAc,GAAgI,EAAE,CAAC;YAErJ,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;gBACxC,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAE7D,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;oBAC/B,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;oBACrC,IAAI,CAAC,QAAQ;wBAAE,SAAS;oBACxB,IAAI,CAAC;wBACH,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,yHAAyH,CAC1H,CAAC,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAyE,CAAC;wBAExG,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;4BACvB,cAAc,CAAC,IAAI,CAAC;gCAClB,EAAE,EAAE,GAAG,CAAC,EAAE;gCACV,IAAI,EAAE,EAAE;gCACR,SAAS,EAAE,CAAC;gCACZ,OAAO,EAAE,CAAC;gCACV,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,QAAQ;gCAC9B,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC;gCAChD,SAAS,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;6BACrC,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,mBAAmB;oBACrB,CAAC;gBACH,CAAC;gBAED,8BAA8B;gBAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsC,CAAC;gBAC3D,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;oBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAChC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS;wBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBACvE,CAAC;gBACD,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7C,CAAC;YAED,sCAAsC;YACtC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;gBACtC,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,cAAc;gBACvB,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAChC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aAC/B,CAAC,CAAC;YAEH,OAAO,MAAM;iBACV,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;iBAClC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAyB,CAAC;QAClD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE;YACb,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAwC,CAAC;YACnE,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YACvB,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnB,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAyF,CAAC;YACtH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAA6B,CAAC,CAAC,CAAC,SAAS;gBACtF,SAAS,EAAE,CAAC,CAAC,UAAU;aACxB,CAAC,CAAC,CAAC;QACN,CAAC;QAED,KAAK,CAAC,KAAK;YACT,IAAI,cAAc,EAAE,CAAC;gBACnB,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACxC,CAAC;YACD,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;QAED,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC;QACvB,IAAI,cAAc,KAAK,OAAO,cAAc,CAAC,CAAC,CAAC;KAChD,CAAC;AACJ,CAAC"}

package/dist/memory/ssrf.d.ts

@@ -0,0 +1,18 @@
+export declare class SsrFBlockedError extends Error {
+    constructor(message: string);
+}
+export type SsrfPolicy = {
+    allowPrivateNetwork?: boolean;
+    allowedHostnames?: string[];
+    hostnameAllowlist?: string[];
+};
+export declare function isBlockedHostname(hostname: string): boolean;
+export declare function isPrivateIpAddress(address: string): boolean;
+export declare function isBlockedHostnameOrIp(hostname: string): boolean;
+export declare function buildBaseUrlPolicy(baseUrl: string): SsrfPolicy | undefined;
+export interface ValidateUrlResult {
+    resolvedAddresses: string[];
+}
+export declare function validateUrl(url: string, policy?: SsrfPolicy): Promise<ValidateUrlResult>;
+export declare function fetchWithSsrfGuard(url: string, init: RequestInit, policy?: SsrfPolicy): Promise<Response>;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/memory/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../src/memory/ssrf.ts"],"names":[],"mappings":"AAaA,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B,CAAC;AA6BF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI3D;AA8DD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAgB3D;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI/D;AAyBD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAU1E;AAOD,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4D9F;AAuBD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,QAAQ,CAAC,CAgDnB"}

package/dist/memory/ssrf.js

@@ -0,0 +1,305 @@
+// Ported from OpenClaw src/infra/net/ssrf.ts + fetch-guard.ts
+// DNS validation: we resolve DNS ourselves, validate ALL resolved IPs against
+// the private/special-use blocklist, then let fetch() connect using the
+// original hostname (required for TLS/SNI to work).
+// Without undici dispatchers we cannot pin the TCP socket to our resolved IP,
+// so a small TOCTOU window exists between our DNS check and fetch()'s own
+// resolution. This is acceptable: an attacker would need to poison DNS
+// between our check and fetch's connect, which is a very narrow window.
+// Mitigation: fail-closed on DNS failure or empty results.
+import * as dns from "node:dns/promises";
+import * as net from "node:net";
+export class SsrFBlockedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "SsrFBlockedError";
+    }
+}
+// --- Hostname normalization ---
+function normalizeHostname(hostname) {
+    const trimmed = hostname.trim().toLowerCase();
+    if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+        return trimmed.slice(1, -1);
+    }
+    return trimmed.replace(/\.+$/, "");
+}
+// --- Blocked hostnames (from OpenClaw) ---
+const BLOCKED_HOSTNAMES = new Set([
+    "localhost",
+    "localhost.localdomain",
+    "metadata.google.internal",
+]);
+function isBlockedHostnameNormalized(normalized) {
+    if (BLOCKED_HOSTNAMES.has(normalized))
+        return true;
+    return (normalized.endsWith(".localhost") ||
+        normalized.endsWith(".local") ||
+        normalized.endsWith(".internal"));
+}
+export function isBlockedHostname(hostname) {
+    const normalized = normalizeHostname(hostname);
+    if (!normalized)
+        return false;
+    return isBlockedHostnameNormalized(normalized);
+}
+// --- IP validation (from OpenClaw) ---
+function isCanonicalDottedDecimalIPv4(address) {
+    const parts = address.split(".");
+    if (parts.length !== 4)
+        return false;
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return false;
+        const num = Number(part);
+        if (num < 0 || num > 255)
+            return false;
+        if (part.length > 1 && part.startsWith("0"))
+            return false;
+    }
+    return true;
+}
+function isLegacyIpv4Literal(address) {
+    return /^(?:0x[\da-f]+|\d+)(?:\.(?:0x[\da-f]+|\d+)){0,3}$/i.test(address);
+}
+function looksLikeUnsupportedIpv4Literal(address) {
+    const parts = address.split(".");
+    if (parts.length === 0 || parts.length > 4)
+        return false;
+    if (parts.some((part) => part.length === 0))
+        return true;
+    return parts.every((part) => /^[0-9]+$/.test(part) || /^0x/i.test(part));
+}
+function isBlockedSpecialUseIpv4(ip) {
+    if (!net.isIPv4(ip))
+        return false;
+    const parts = ip.split(".").map(Number);
+    const [a, b] = parts;
+    if (a === 0)
+        return true; // 0.0.0.0/8 "this network"
+    if (a === 10)
+        return true; // 10.0.0.0/8 RFC 1918
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // 100.64.0.0/10 CGN
+    if (a === 127)
+        return true; // 127.0.0.0/8 loopback
+    if (a === 169 && b === 254)
+        return true; // 169.254.0.0/16 link-local
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // 172.16.0.0/12 RFC 1918
+    if (a === 192 && b === 0 && parts[2] === 0)
+        return true; // 192.0.0.0/24 IETF protocol
+    if (a === 192 && b === 0 && parts[2] === 2)
+        return true; // 192.0.2.0/24 TEST-NET-1
+    if (a === 192 && b === 88 && parts[2] === 99)
+        return true; // 192.88.99.0/24 6to4 relay
+    if (a === 192 && b === 168)
+        return true; // 192.168.0.0/16 RFC 1918
+    if (a === 198 && (b === 18 || b === 19))
+        return true; // 198.18.0.0/15 benchmark
+    if (a === 198 && b === 51 && parts[2] === 100)
+        return true; // 198.51.100.0/24 TEST-NET-2
+    if (a === 203 && b === 0 && parts[2] === 113)
+        return true; // 203.0.113.0/24 TEST-NET-3
+    if (a >= 224)
+        return true; // 224.0.0.0/3 multicast + reserved
+    return false;
+}
+function isBlockedSpecialUseIpv6(ip) {
+    const lower = ip.toLowerCase();
+    if (lower === "::")
+        return true; // unspecified
+    if (lower === "::1")
+        return true; // loopback
+    if (lower.startsWith("fe80:"))
+        return true; // link-local
+    if (lower.startsWith("fc") || lower.startsWith("fd"))
+        return true; // ULA
+    if (lower.startsWith("ff"))
+        return true; // multicast
+    if (lower.startsWith("::ffff:")) {
+        const embedded = lower.slice(7);
+        if (net.isIPv4(embedded) && isBlockedSpecialUseIpv4(embedded))
+            return true;
+    }
+    return false;
+}
+export function isPrivateIpAddress(address) {
+    let normalized = address.trim().toLowerCase();
+    if (normalized.startsWith("[") && normalized.endsWith("]")) {
+        normalized = normalized.slice(1, -1);
+    }
+    if (!normalized)
+        return false;
+    if (net.isIPv4(normalized))
+        return isBlockedSpecialUseIpv4(normalized);
+    if (net.isIPv6(normalized))
+        return isBlockedSpecialUseIpv6(normalized);
+    // Malformed IPv6 literals: fail closed
+    if (normalized.includes(":") && !net.isIPv6(normalized))
+        return true;
+    if (!isCanonicalDottedDecimalIPv4(normalized) && isLegacyIpv4Literal(normalized))
+        return true;
+    if (looksLikeUnsupportedIpv4Literal(normalized))
+        return true;
+    return false;
+}
+export function isBlockedHostnameOrIp(hostname) {
+    const normalized = normalizeHostname(hostname);
+    if (!normalized)
+        return false;
+    return isBlockedHostnameNormalized(normalized) || isPrivateIpAddress(normalized);
+}
+// --- Hostname allowlist ---
+function matchesHostnameAllowlist(hostname, allowlist) {
+    if (allowlist.length === 0)
+        return true;
+    return allowlist.some((pattern) => {
+        if (pattern.startsWith("*.")) {
+            const suffix = pattern.slice(2);
+            if (!suffix || hostname === suffix)
+                return false;
+            return hostname.endsWith(`.${suffix}`);
+        }
+        return hostname === pattern;
+    });
+}
+// --- Policy helpers ---
+function shouldSkipPrivateNetworkChecks(hostname, policy) {
+    return (policy?.allowPrivateNetwork === true ||
+        new Set(policy?.allowedHostnames?.map(normalizeHostname)).has(hostname));
+}
+export function buildBaseUrlPolicy(baseUrl) {
+    const trimmed = baseUrl.trim();
+    if (!trimmed)
+        return undefined;
+    try {
+        const parsed = new URL(trimmed);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+            return undefined;
+        return { allowedHostnames: [parsed.hostname], hostnameAllowlist: [normalizeHostname(parsed.hostname)] };
+    }
+    catch {
+        return undefined;
+    }
+}
+// --- URL validation ---
+const BLOCKED_HOST_OR_IP_MESSAGE = "Blocked hostname or private/internal/special-use IP address";
+const BLOCKED_RESOLVED_IP_MESSAGE = "Blocked: resolves to private/internal/special-use IP address";
+export async function validateUrl(url, policy) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new SsrFBlockedError(`SSRF: blocked non-HTTP protocol: ${parsed.protocol}`);
+    }
+    const hostname = normalizeHostname(parsed.hostname);
+    if (!hostname)
+        throw new SsrFBlockedError("SSRF: empty hostname");
+    const hostnameAllowlist = (policy?.hostnameAllowlist ?? []).map(normalizeHostname).filter(Boolean);
+    if (hostnameAllowlist.length > 0 && !matchesHostnameAllowlist(hostname, hostnameAllowlist)) {
+        throw new SsrFBlockedError(`Blocked hostname (not in allowlist): ${parsed.hostname}`);
+    }
+    if (!shouldSkipPrivateNetworkChecks(hostname, policy)) {
+        if (isBlockedHostnameOrIp(hostname)) {
+            throw new SsrFBlockedError(BLOCKED_HOST_OR_IP_MESSAGE);
+        }
+        // Resolve both IPv4 and IPv6 and check ALL results.
+        // Fail-closed: if DNS resolution fails entirely, block the request
+        // (we cannot verify the target IP is safe).
+        const allAddresses = [];
+        let v4Error = null;
+        let v6Error = null;
+        try {
+            const v4 = await dns.resolve4(hostname);
+            allAddresses.push(...v4);
+        }
+        catch (err) {
+            if (err instanceof SsrFBlockedError)
+                throw err;
+            v4Error = err;
+        }
+        try {
+            const v6 = await dns.resolve6(hostname);
+            allAddresses.push(...v6);
+        }
+        catch (err) {
+            if (err instanceof SsrFBlockedError)
+                throw err;
+            v6Error = err;
+        }
+        // Fail-closed: if we got zero resolved addresses (whether DNS errored
+        // or returned empty results) and the hostname is not a literal IP,
+        // block the request — we cannot verify the target IP is safe.
+        if (allAddresses.length === 0 && !net.isIP(hostname)) {
+            throw new SsrFBlockedError(`SSRF: unable to resolve hostname "${hostname}" — blocking (fail-closed)`);
+        }
+        for (const addr of allAddresses) {
+            if (isBlockedHostnameOrIp(addr)) {
+                throw new SsrFBlockedError(BLOCKED_RESOLVED_IP_MESSAGE);
+            }
+        }
+        return { resolvedAddresses: allAddresses };
+    }
+    return { resolvedAddresses: [] };
+}
+// --- Guarded fetch with redirect handling (from fetch-guard.ts) ---
+const DEFAULT_MAX_REDIRECTS = 3;
+function retainSafeHeadersForCrossOriginRedirect(headers) {
+    if (!headers)
+        return undefined;
+    const safe = {};
+    const headerObj = new Headers(headers);
+    const SAFE_HEADERS = new Set(["accept", "accept-language", "content-language", "content-type"]);
+    headerObj.forEach((value, key) => {
+        if (SAFE_HEADERS.has(key.toLowerCase())) {
+            safe[key] = value;
+        }
+    });
+    return Object.keys(safe).length > 0 ? safe : undefined;
+}
+function isRedirectStatus(status) {
+    return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+export async function fetchWithSsrfGuard(url, init, policy) {
+    const maxRedirects = DEFAULT_MAX_REDIRECTS;
+    const visited = new Set();
+    let currentUrl = url;
+    let currentInit = init ? { ...init } : undefined;
+    let redirectCount = 0;
+    while (true) {
+        let parsedUrl;
+        try {
+            parsedUrl = new URL(currentUrl);
+        }
+        catch {
+            throw new Error("Invalid URL: must be http or https");
+        }
+        if (!["http:", "https:"].includes(parsedUrl.protocol)) {
+            throw new Error("Invalid URL: must be http or https");
+        }
+        await validateUrl(currentUrl, policy);
+        const response = await fetch(parsedUrl.toString(), {
+            ...(currentInit ?? {}),
+            redirect: "manual",
+        });
+        if (isRedirectStatus(response.status)) {
+            const location = response.headers.get("location");
+            if (!location)
+                throw new Error(`Redirect missing location header (${response.status})`);
+            redirectCount += 1;
+            if (redirectCount > maxRedirects)
+                throw new Error(`Too many redirects (limit: ${maxRedirects})`);
+            const nextParsedUrl = new URL(location, parsedUrl);
+            const nextUrl = nextParsedUrl.toString();
+            if (visited.has(nextUrl))
+                throw new Error("Redirect loop detected");
+            if (nextParsedUrl.origin !== parsedUrl.origin && currentInit?.headers) {
+                const safeHeaders = retainSafeHeadersForCrossOriginRedirect(currentInit.headers);
+                currentInit = { ...currentInit, headers: safeHeaders };
+            }
+            visited.add(nextUrl);
+            currentUrl = nextUrl;
+            continue;
+        }
+        return response;
+    }
+}
+//# sourceMappingURL=ssrf.js.map

package/dist/memory/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../src/memory/ssrf.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,8EAA8E;AAC9E,wEAAwE;AACxE,oDAAoD;AACpD,8EAA8E;AAC9E,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,2DAA2D;AAE3D,OAAO,KAAK,GAAG,MAAM,mBAAmB,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAQD,iCAAiC;AAEjC,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,4CAA4C;AAE5C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,uBAAuB;IACvB,0BAA0B;CAC3B,CAAC,CAAC;AAEH,SAAS,2BAA2B,CAAC,UAAkB;IACrD,IAAI,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,CACL,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,wCAAwC;AAExC,SAAS,4BAA4B,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,oDAAoD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,+BAA+B,CAAC,OAAe;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,EAAU;IACzC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAa,2BAA2B;IACjE,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAY,sBAAsB;IAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAE,oBAAoB;IACxE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAW,uBAAuB;IAC7D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAE,4BAA4B;IACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAG,yBAAyB;IAC7E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAE,6BAA6B;IACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAE,0BAA0B;IACpF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;IACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAE,0BAA0B;IACpE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;IAChF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,6BAA6B;IACzF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAE,4BAA4B;IACxF,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAY,mCAAmC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,EAAU;IACzC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAU,cAAc;IACxD,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAS,WAAW;IACrD,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,CAAE,aAAa;IAC1D,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,MAAM;IACzE,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAE,YAAY;IACtD,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,uBAAuB,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAEvE,uCAAuC;IACvC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAErE,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,IAAI,mBAAmB,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9F,IAAI,+BAA+B,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,2BAA2B,CAAC,UAAU,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,CAAC;AACnF,CAAC;AAED,6BAA6B;AAE7B,SAAS,wBAAwB,CAAC,QAAgB,EAAE,SAAmB;IACrE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,IAAI,QAAQ,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAC;YACjD,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,QAAQ,KAAK,OAAO,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yBAAyB;AAEzB,SAAS,8BAA8B,CAAC,QAAgB,EAAE,MAAmB;IAC3E,OAAO,CACL,MAAM,EAAE,mBAAmB,KAAK,IAAI;QACpC,IAAI,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClF,OAAO,EAAE,gBAAgB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;IAC1G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,yBAAyB;AAEzB,MAAM,0BAA0B,GAAG,6DAA6D,CAAC;AACjG,MAAM,2BAA2B,GAAG,8DAA8D,CAAC;AAMnG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,MAAmB;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,CAAC,CAAC;IAElE,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,iBAAiB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnG,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,8BAA8B,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACtD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;QACzD,CAAC;QAED,oDAAoD;QACpD,mEAAmE;QACnE,4CAA4C;QAC5C,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,OAAO,GAAY,IAAI,CAAC;QAC5B,IAAI,OAAO,GAAY,IAAI,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB;gBAAE,MAAM,GAAG,CAAC;YAC/C,OAAO,GAAG,GAAG,CAAC;QAChB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB;gBAAE,MAAM,GAAG,CAAC;YAC/C,OAAO,GAAG,GAAG,CAAC;QAChB,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,8DAA8D;QAC9D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,gBAAgB,CACxB,qCAAqC,QAAQ,4BAA4B,CAC1E,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAED,qEAAqE;AAErE,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,SAAS,uCAAuC,CAAC,OAAqB;IACpE,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC,CAAC;IAChG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC/B,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,IAAiB,EACjB,MAAmB;IAEnB,MAAM,YAAY,GAAG,qBAAqB,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,IAAI,WAAW,GAA4B,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,SAAc,CAAC;QACnB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAEtC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE;YACjD,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;YACtB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAExF,aAAa,IAAI,CAAC,CAAC;YACnB,IAAI,aAAa,GAAG,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,GAAG,CAAC,CAAC;YAEjG,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAEpE,IAAI,aAAa,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,WAAW,EAAE,OAAO,EAAE,CAAC;gBACtE,MAAM,WAAW,GAAG,uCAAuC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBACjF,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;YACzD,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACrB,UAAU,GAAG,OAAO,CAAC;YACrB,SAAS;QACX,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/package.json

@@ -1,17 +1,17 @@
 {
-  "name": "agentcore",
-  "version": "0.1.0",
-  "description": "Minimal agent runtime with hybrid memory, skills, sessions, and lifecycle hooks",
+  "name": "bulkhead-runtime",
+  "version": "2026.4.5-beta.2",
+  "description": "Multi-tenant AI agent runtime with OS-level isolation. Sandboxed execution, encrypted credentials, private memory per tenant — one server, no Docker.",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/tonga54/agentcore.git"
+    "url": "git+https://github.com/tonga54/bulkhead-runtime.git"
   },
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",
   "bin": {
-    "openclaw": "dist/cli.js"
+    "bulkhead-runtime": "dist/cli.js"
   },
   "exports": {
     ".": {
@@ -32,5 +32,8 @@
   "engines": {
     "node": ">=22.12.0"
   },
+  "os": [
+    "linux"
+  ],
   "packageManager": "pnpm@10.23.0"
 }

package/dist/platform/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/platform/platform.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAS3D,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CAuE/D"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/platform/platform.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAc3D,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CAyF/D"}

package/dist/platform/platform.js

@@ -2,13 +2,21 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { createWorkspace, validateWorkspaceId, loadWorkspaceConfig, } from "../workspace/workspace.js";
 import { createSkillRegistry } from "../skills/registry.js";
+const PLATFORM_SENSITIVE_PATHS = new Set([
+    "/", "/root", "/proc", "/sys", "/dev", "/boot", "/run",
+    "/tmp", "/var", "/etc", "/bin", "/sbin", "/usr", "/lib",
+]);
 export function createPlatform(config) {
     const { stateDir } = config;
+    const resolvedStateDir = path.resolve(stateDir);
+    if (PLATFORM_SENSITIVE_PATHS.has(resolvedStateDir)) {
+        throw new Error(`stateDir "${stateDir}" references a sensitive system path`);
+    }
     const skillsDir = config.skillsDir ?? path.join(stateDir, "skills");
     const workspacesDir = path.join(stateDir, "workspaces");
-    fs.mkdirSync(stateDir, { recursive: true });
-    fs.mkdirSync(skillsDir, { recursive: true });
-    fs.mkdirSync(workspacesDir, { recursive: true });
+    fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    fs.mkdirSync(skillsDir, { recursive: true, mode: 0o700 });
+    fs.mkdirSync(workspacesDir, { recursive: true, mode: 0o700 });
     const skills = createSkillRegistry(skillsDir);
     return {
         stateDir,
@@ -16,10 +24,19 @@ export function createPlatform(config) {
         async createWorkspace(userId, wsConfig) {
             validateWorkspaceId(userId);
             const wsDir = path.join(workspacesDir, userId);
-            if (fs.existsSync(wsDir)) {
-                throw new Error(`Workspace "${userId}" already exists`);
+            try {
+                fs.mkdirSync(wsDir, { mode: 0o700 });
+            }
+            catch (err) {
+                if (err.code === "EEXIST") {
+                    throw new Error(`Workspace "${userId}" already exists`);
+                }
+                throw err;
             }
-            const mergedConfig = { ...wsConfig };
+            const mergedConfig = {
+                credentialPassphrase: config.credentialPassphrase,
+                ...wsConfig,
+            };
             return createWorkspace({
                 userId,
                 stateDir,
@@ -34,6 +51,9 @@ export function createPlatform(config) {
                 throw new Error(`Workspace "${userId}" does not exist`);
             }
             const wsConfig = loadWorkspaceConfig(wsDir);
+            if (!wsConfig.credentialPassphrase && config.credentialPassphrase) {
+                wsConfig.credentialPassphrase = config.credentialPassphrase;
+            }
             return createWorkspace({
                 userId,
                 stateDir,
@@ -44,7 +64,10 @@ export function createPlatform(config) {
         async listWorkspaces() {
             try {
                 const entries = fs.readdirSync(workspacesDir, { withFileTypes: true });
-                return entries.filter((e) => e.isDirectory()).map((e) => e.name);
+                return entries
+                    .filter((e) => e.isDirectory())
+                    .filter((e) => fs.existsSync(path.join(workspacesDir, e.name, "config.json")))
+                    .map((e) => e.name);
             }
             catch {
                 return [];

package/dist/platform/platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/platform/platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAExD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAE9C,OAAO;QACL,QAAQ;QACR,MAAM;QAEN,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ;YACpC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,kBAAkB,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,YAAY,GAAoB,EAAE,GAAG,QAAQ,EAAE,CAAC;YACtD,OAAO,eAAe,CAAC;gBACrB,MAAM;gBACN,QAAQ;gBACR,MAAM,EAAE,YAAY;gBACpB,aAAa,EAAE,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,kBAAkB,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC5C,OAAO,eAAe,CAAC;gBACrB,MAAM;gBACN,QAAQ;gBACR,MAAM,EAAE,QAAQ;gBAChB,aAAa,EAAE,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,cAAc;YAClB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvE,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM;YAC1B,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,kBAAkB,CAAC,CAAC;YAC1D,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM;YAC1B,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC/C,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/platform/platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACtD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;CACxD,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc,CAAC,MAAsB;IACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,wBAAwB,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,aAAa,QAAQ,sCAAsC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAExD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAE9C,OAAO;QACL,QAAQ;QACR,MAAM;QAEN,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ;YACpC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,kBAAkB,CAAC,CAAC;gBAC1D,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,YAAY,GAAoB;gBACpC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,GAAG,QAAQ;aACZ,CAAC;YACF,OAAO,eAAe,CAAC;gBACrB,MAAM;gBACN,QAAQ;gBACR,MAAM,EAAE,YAAY;gBACpB,aAAa,EAAE,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,kBAAkB,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAClE,QAAQ,CAAC,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;YAC9D,CAAC;YACD,OAAO,eAAe,CAAC;gBACrB,MAAM;gBACN,QAAQ;gBACR,MAAM,EAAE,QAAQ;gBAChB,aAAa,EAAE,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,cAAc;YAClB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,aAAa,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvE,OAAO,OAAO;qBACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;qBAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;qBAC7E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM;YAC1B,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,kBAAkB,CAAC,CAAC;YAC1D,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM;YAC1B,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC/C,OAAO,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/platform/types.d.ts

@@ -3,6 +3,8 @@ import type { SkillRegistry } from "../skills/registry.js";
 export interface PlatformConfig {
     stateDir: string;
     skillsDir?: string;
+    /** Default passphrase for credential encryption. Falls back to BULKHEAD_CREDENTIAL_KEY env var. */
+    credentialPassphrase?: string;
 }
 export interface Platform {
     readonly stateDir: string;

package/dist/platform/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/platform/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAE/B,eAAe,CACb,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAChC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,cAAc,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/platform/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAE/B,eAAe,CACb,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAChC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,cAAc,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnD"}