experimental-ash 0.25.2 → 0.27.0

package/dist/src/runtime/governance/auth/oidc.js

@@ -1,126 +1 @@
-import { createRemoteJWKSet, jwtVerify } from "#compiled/jose/index.js";
-import { z } from "#compiled/zod/index.js";
-import { areTokenClaimMatchersSatisfied, createJwtAuthenticatedCallerPrincipal, } from "#runtime/governance/auth/token-claims.js";
-const oidcDiscoveryDocumentSchema = z
-    .object({
-    issuer: z.string().optional(),
-    jwks_uri: z.string().url(),
-})
-    .passthrough();
-const oidcDiscoveryDocumentCache = new Map();
-const oidcJwksCache = new Map();
-/**
- * Verifies one bearer token against a resolved OIDC strategy.
- */
-export async function authenticateOidcStrategy(input) {
-    let remoteJwks;
-    try {
-        remoteJwks = await getOidcRemoteJwks(input.strategy);
-    }
-    catch (error) {
-        return {
-            kind: "misconfigured",
-            message: `Failed to load OIDC discovery metadata. ${error instanceof Error ? error.message : "Unknown discovery failure."}`,
-        };
-    }
-    try {
-        const verified = await jwtVerify(input.token, remoteJwks, {
-            audience: [...input.strategy.audiences],
-            clockTolerance: input.strategy.clockSkewSeconds,
-            issuer: input.strategy.issuer,
-        });
-        if (typeof verified.payload.sub !== "string" || verified.payload.sub.length === 0) {
-            return {
-                kind: "not-authenticated",
-            };
-        }
-        const isCurrentVercelProjectToken = input.strategy.acceptCurrentVercelProject &&
-            isCurrentVercelProject({
-                issuer: input.strategy.issuer,
-                payload: verified.payload,
-            });
-        const isCurrentVercelRuntimeToken = isCurrentVercelProjectToken && isCurrentVercelEnvironment({ payload: verified.payload });
-        if (!isCurrentVercelProjectToken &&
-            !areTokenClaimMatchersSatisfied(verified.payload, input.strategy)) {
-            return {
-                kind: "caller-not-allowed",
-            };
-        }
-        return {
-            kind: "authenticated",
-            principal: createJwtAuthenticatedCallerPrincipal({
-                authenticator: "oidc",
-                payload: verified.payload,
-                principalType: isCurrentVercelRuntimeToken ? "runtime" : "service",
-            }),
-        };
-    }
-    catch {
-        return {
-            kind: "not-authenticated",
-        };
-    }
-}
-async function getOidcRemoteJwks(strategy) {
-    const discoveryDocument = await getOidcDiscoveryDocument(strategy.discoveryUrl);
-    const existing = oidcJwksCache.get(discoveryDocument.jwks_uri);
-    if (existing !== undefined) {
-        return existing;
-    }
-    const remoteJwks = createRemoteJWKSet(new URL(discoveryDocument.jwks_uri));
-    oidcJwksCache.set(discoveryDocument.jwks_uri, remoteJwks);
-    return remoteJwks;
-}
-async function getOidcDiscoveryDocument(discoveryUrl) {
-    const cached = oidcDiscoveryDocumentCache.get(discoveryUrl);
-    if (cached !== undefined) {
-        return await cached;
-    }
-    const discoveryPromise = fetch(discoveryUrl, {
-        headers: {
-            accept: "application/json",
-        },
-    })
-        .then(async (response) => {
-        if (!response.ok) {
-            throw new Error(`Discovery route returned HTTP ${response.status}.`);
-        }
-        return oidcDiscoveryDocumentSchema.parse(await response.json());
-    })
-        .catch((error) => {
-        oidcDiscoveryDocumentCache.delete(discoveryUrl);
-        throw error;
-    });
-    oidcDiscoveryDocumentCache.set(discoveryUrl, discoveryPromise);
-    return await discoveryPromise;
-}
-/**
- * Returns whether a verified JWT was minted by Vercel OIDC for the
- * current Vercel project (any environment). Used by the verifier to
- * unconditionally accept tokens from the deployment's own project on
- * top of any author-supplied `subjects`/`claims` matchers.
- */
-function isCurrentVercelProject(input) {
-    if (!input.issuer.startsWith("https://oidc.vercel.com")) {
-        return false;
-    }
-    const currentProjectId = process.env.VERCEL_PROJECT_ID?.trim();
-    if (currentProjectId === undefined || currentProjectId.length === 0) {
-        return false;
-    }
-    return (typeof input.payload.project_id === "string" && input.payload.project_id === currentProjectId);
-}
-/**
- * Returns whether a verified JWT's `environment` claim matches the
- * current Vercel deployment environment. Combined with
- * {@link isCurrentVercelProject} to upgrade `principalType` from
- * `"service"` to `"runtime"` when the caller is the deployment itself.
- */
-function isCurrentVercelEnvironment(input) {
-    const currentEnvironment = (process.env.VERCEL_TARGET_ENV?.trim() ?? process.env.VERCEL_ENV?.trim())?.trim();
-    if (currentEnvironment === undefined || currentEnvironment.length === 0) {
-        return false;
-    }
-    return (typeof input.payload.environment === "string" &&
-        input.payload.environment === currentEnvironment);
-}
+import{z}from"#compiled/zod/index.js";import{createRemoteJWKSet,jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#runtime/governance/auth/token-claims.js";var oidcDiscoveryDocumentSchema=z.object({issuer:z.string().optional(),jwks_uri:z.string().url()}).passthrough(),oidcDiscoveryDocumentCache=new Map,oidcJwksCache=new Map;async function authenticateOidcStrategy(e){let t;try{t=await getOidcRemoteJwks(e.strategy)}catch(e){return{kind:`misconfigured`,message:`Failed to load OIDC discovery metadata. ${e instanceof Error?e.message:`Unknown discovery failure.`}`}}try{let a=await jwtVerify(e.token,t,{audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});if(typeof a.payload.sub!=`string`||a.payload.sub.length===0)return{kind:`not-authenticated`};let o=e.strategy.acceptCurrentVercelProject&&isCurrentVercelProject({issuer:e.strategy.issuer,payload:a.payload}),s=o&&isCurrentVercelEnvironment({payload:a.payload});return!o&&!areTokenClaimMatchersSatisfied(a.payload,e.strategy)?{kind:`caller-not-allowed`}:{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`oidc`,payload:a.payload,principalType:s?`runtime`:`service`})}}catch{return{kind:`not-authenticated`}}}async function getOidcRemoteJwks(e){let n=await getOidcDiscoveryDocument(e.discoveryUrl),r=oidcJwksCache.get(n.jwks_uri);if(r!==void 0)return r;let i=createRemoteJWKSet(new URL(n.jwks_uri));return oidcJwksCache.set(n.jwks_uri,i),i}async function getOidcDiscoveryDocument(e){let t=oidcDiscoveryDocumentCache.get(e);if(t!==void 0)return await t;let n=fetch(e,{headers:{accept:`application/json`}}).then(async e=>{if(!e.ok)throw Error(`Discovery route returned HTTP ${e.status}.`);return oidcDiscoveryDocumentSchema.parse(await e.json())}).catch(t=>{throw oidcDiscoveryDocumentCache.delete(e),t});return oidcDiscoveryDocumentCache.set(e,n),await n}function isCurrentVercelProject(e){if(!e.issuer.startsWith(`https://oidc.vercel.com`))return!1;let t=process.env.VERCEL_PROJECT_ID?.trim();return t===void 0||t.length===0?!1:typeof e.payload.project_id==`string`&&e.payload.project_id===t}function isCurrentVercelEnvironment(e){let t=(process.env.VERCEL_TARGET_ENV?.trim()??process.env.VERCEL_ENV?.trim())?.trim();return t===void 0||t.length===0?!1:typeof e.payload.environment==`string`&&e.payload.environment===t}export{authenticateOidcStrategy};

package/dist/src/runtime/governance/auth/token-claims.js

@@ -1,84 +1 @@
-const STANDARD_PROJECTED_CLAIM_KEYS = new Set(["aud", "exp", "iat", "iss", "jti", "nbf", "sub"]);
-/**
- * Returns the normalized string-valued JWT claim projection used by Ash's
- * runtime auth layer.
- */
-function normalizeJwtClaims(payload) {
-    const normalized = {};
-    for (const [key, value] of Object.entries(payload)) {
-        if (typeof value === "string") {
-            normalized[key] = value;
-            continue;
-        }
-        if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
-            normalized[key] = Object.freeze([...value]);
-        }
-    }
-    return Object.freeze(normalized);
-}
-/**
- * Returns the non-standard string-valued JWT claim projection exposed as public
- * session auth attributes.
- */
-function createJwtAttributeProjection(payload) {
-    const claims = normalizeJwtClaims(payload);
-    return Object.freeze(Object.fromEntries(Object.entries(claims).filter(([key]) => !STANDARD_PROJECTED_CLAIM_KEYS.has(key))));
-}
-/**
- * Returns whether the verified JWT payload satisfies the authored subject and
- * claim selectors.
- */
-export function areTokenClaimMatchersSatisfied(payload, matchers) {
-    const normalizedClaims = normalizeJwtClaims(payload);
-    if (matchers.subjects !== undefined) {
-        const subject = typeof payload.sub === "string" ? payload.sub : null;
-        if (subject === null ||
-            !matchers.subjects.some((pattern) => matchesWildcardPattern(pattern, subject))) {
-            return false;
-        }
-    }
-    if (matchers.claims === undefined) {
-        return true;
-    }
-    return Object.entries(matchers.claims).every(([claimName, expectedValues]) => {
-        const claimValue = normalizedClaims[claimName];
-        if (claimValue === undefined) {
-            return false;
-        }
-        if (typeof claimValue === "string") {
-            return expectedValues.includes(claimValue);
-        }
-        return claimValue.some((value) => expectedValues.includes(value));
-    });
-}
-/**
- * Creates a normalized JWT-backed Ash principal from a verified payload.
- */
-export function createJwtAuthenticatedCallerPrincipal(input) {
-    const issuer = typeof input.payload.iss === "string" ? input.payload.iss : undefined;
-    const subject = typeof input.payload.sub === "string" ? input.payload.sub : undefined;
-    if (issuer === undefined || subject === undefined) {
-        throw new Error("Expected verified JWT payloads to include string iss and sub claims.");
-    }
-    const claims = normalizeJwtClaims(input.payload);
-    return {
-        attributes: createJwtAttributeProjection(input.payload),
-        authenticator: input.authenticator,
-        claims,
-        issuer,
-        principalId: `${issuer}:${subject}`,
-        principalType: input.principalType,
-        subject,
-    };
-}
-/**
- * Returns whether the value matches one AWS IAM-style whole-string wildcard
- * pattern where `*` matches zero or more characters.
- */
-function matchesWildcardPattern(pattern, value) {
-    if (!pattern.includes("*")) {
-        return pattern === value;
-    }
-    const escaped = pattern.replaceAll(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
-    return new RegExp(`^${escaped}$`).test(value);
-}
+var STANDARD_PROJECTED_CLAIM_KEYS=new Set([`aud`,`exp`,`iat`,`iss`,`jti`,`nbf`,`sub`]);function normalizeJwtClaims(e){let t={};for(let[n,r]of Object.entries(e)){if(typeof r==`string`){t[n]=r;continue}Array.isArray(r)&&r.every(e=>typeof e==`string`)&&(t[n]=Object.freeze([...r]))}return Object.freeze(t)}function createJwtAttributeProjection(t){let n=normalizeJwtClaims(t);return Object.freeze(Object.fromEntries(Object.entries(n).filter(([t])=>!STANDARD_PROJECTED_CLAIM_KEYS.has(t))))}function areTokenClaimMatchersSatisfied(e,t){let n=normalizeJwtClaims(e);if(t.subjects!==void 0){let n=typeof e.sub==`string`?e.sub:null;if(n===null||!t.subjects.some(e=>matchesWildcardPattern(e,n)))return!1}return t.claims===void 0?!0:Object.entries(t.claims).every(([e,t])=>{let r=n[e];return r===void 0?!1:typeof r==`string`?t.includes(r):r.some(e=>t.includes(e))})}function createJwtAuthenticatedCallerPrincipal(e){let t=typeof e.payload.iss==`string`?e.payload.iss:void 0,n=typeof e.payload.sub==`string`?e.payload.sub:void 0;if(t===void 0||n===void 0)throw Error(`Expected verified JWT payloads to include string iss and sub claims.`);let r=normalizeJwtClaims(e.payload);return{attributes:createJwtAttributeProjection(e.payload),authenticator:e.authenticator,claims:r,issuer:t,principalId:`${t}:${n}`,principalType:e.principalType,subject:n}}function matchesWildcardPattern(e,t){if(!e.includes(`*`))return e===t;let n=e.replaceAll(/[.+?^${}()|[\]\\]/g,`\\$&`).replaceAll(`*`,`.*`);return RegExp(`^${n}$`).test(t)}export{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal};

package/dist/src/runtime/governance/auth/types.js

@@ -1,14 +1 @@
-/**
- * Creates the session-auth projection persisted on runtime state and exposed to
- * authored `getSession()` calls.
- */
-export function createRuntimeSessionAuthContext(principal) {
-    return {
-        attributes: principal.attributes,
-        authenticator: principal.authenticator,
-        issuer: principal.issuer,
-        principalId: principal.principalId,
-        principalType: principal.principalType,
-        subject: principal.subject,
-    };
-}
+function createRuntimeSessionAuthContext(e){return{attributes:e.attributes,authenticator:e.authenticator,issuer:e.issuer,principalId:e.principalId,principalType:e.principalType,subject:e.subject}}export{createRuntimeSessionAuthContext};

package/dist/src/runtime/governance/network/ip-allow-list.js

@@ -1,66 +1 @@
-import { BlockList, isIP } from "node:net";
-/**
- * Parses exact IP and CIDR entries into a reusable runtime-owned allowlist.
- */
-export function createRuntimeIpAllowList(entries) {
-    const blockList = new BlockList();
-    for (const rawEntry of entries) {
-        const entry = rawEntry.trim();
-        if (entry.length === 0) {
-            throw new Error("Expected every network.ipAllowList entry to be non-empty.");
-        }
-        if (entry.includes("*")) {
-            throw new Error(`Expected "${entry}" to use exact IP or CIDR syntax instead of "*".`);
-        }
-        const slashIndex = entry.indexOf("/");
-        if (slashIndex === -1) {
-            const normalizedAddress = normalizeIpAddress(entry);
-            const family = getIpFamily(normalizedAddress);
-            blockList.addAddress(normalizedAddress, family);
-            continue;
-        }
-        const address = normalizeIpAddress(entry.slice(0, slashIndex));
-        const prefix = Number.parseInt(entry.slice(slashIndex + 1), 10);
-        const family = getIpFamily(address);
-        const maxPrefix = family === "ipv4" ? 32 : 128;
-        if (!Number.isInteger(prefix) || prefix < 0 || prefix > maxPrefix) {
-            throw new Error(`Expected "${entry}" to use a valid ${family} CIDR prefix length.`);
-        }
-        blockList.addSubnet(address, prefix, family);
-    }
-    return {
-        blockList,
-        entries: [...entries],
-    };
-}
-/**
- * Returns whether the normalized request IP matches at least one allowlist
- * entry.
- */
-export function isRuntimeIpAllowed(address, allowList) {
-    const normalizedAddress = normalizeIpAddress(address);
-    const family = getIpFamily(normalizedAddress);
-    return allowList.blockList.check(normalizedAddress, family);
-}
-function normalizeIpAddress(value) {
-    const trimmed = value.trim().replace(/^\[(.*)\]$/, "$1");
-    const percentIndex = trimmed.indexOf("%");
-    const withoutZone = percentIndex === -1 ? trimmed : trimmed.slice(0, percentIndex);
-    if (withoutZone.startsWith("::ffff:")) {
-        const candidate = withoutZone.slice("::ffff:".length);
-        if (isIP(candidate) === 4) {
-            return candidate;
-        }
-    }
-    return withoutZone;
-}
-function getIpFamily(address) {
-    switch (isIP(address)) {
-        case 4:
-            return "ipv4";
-        case 6:
-            return "ipv6";
-        default:
-            throw new Error(`Expected "${address}" to be a valid IP address.`);
-    }
-}
+import{BlockList,isIP}from"node:net";function createRuntimeIpAllowList(t){let n=new BlockList;for(let e of t){let t=e.trim();if(t.length===0)throw Error(`Expected every network.ipAllowList entry to be non-empty.`);if(t.includes(`*`))throw Error(`Expected "${t}" to use exact IP or CIDR syntax instead of "*".`);let r=t.indexOf(`/`);if(r===-1){let e=normalizeIpAddress(t),r=getIpFamily(e);n.addAddress(e,r);continue}let i=normalizeIpAddress(t.slice(0,r)),a=Number.parseInt(t.slice(r+1),10),o=getIpFamily(i),s=o===`ipv4`?32:128;if(!Number.isInteger(a)||a<0||a>s)throw Error(`Expected "${t}" to use a valid ${o} CIDR prefix length.`);n.addSubnet(i,a,o)}return{blockList:n,entries:[...t]}}function isRuntimeIpAllowed(e,t){let n=normalizeIpAddress(e),r=getIpFamily(n);return t.blockList.check(n,r)}function normalizeIpAddress(e){let n=e.trim().replace(/^\[(.*)\]$/,`$1`),r=n.indexOf(`%`),i=r===-1?n:n.slice(0,r);if(i.startsWith(`::ffff:`)){let e=i.slice(7);if(isIP(e)===4)return e}return i}function getIpFamily(e){switch(isIP(e)){case 4:return`ipv4`;case 6:return`ipv6`;default:throw Error(`Expected "${e}" to be a valid IP address.`)}}export{createRuntimeIpAllowList,isRuntimeIpAllowed};

package/dist/src/runtime/graph.js

@@ -1,17 +1 @@
-/**
- * Stable node id used by the runtime-owned graph bundle for the root agent.
- */
-export const ROOT_RUNTIME_AGENT_NODE_ID = "__root__";
-/**
- * Resolves one runtime-owned agent node from the compiled recursive graph.
- */
-export function getResolvedRuntimeAgentNode(bundle, nodeId) {
-    if (nodeId === undefined || nodeId === ROOT_RUNTIME_AGENT_NODE_ID) {
-        return bundle.root;
-    }
-    const node = bundle.nodesByNodeId.get(nodeId);
-    if (node === undefined) {
-        throw new Error(`Missing runtime agent node for node id "${nodeId}".`);
-    }
-    return node;
-}
+var ROOT_RUNTIME_AGENT_NODE_ID=`__root__`;function getResolvedRuntimeAgentNode(e,t){if(t===void 0||t===`__root__`)return e.root;let n=e.nodesByNodeId.get(t);if(n===void 0)throw Error(`Missing runtime agent node for node id "${t}".`);return n}export{ROOT_RUNTIME_AGENT_NODE_ID,getResolvedRuntimeAgentNode};

package/dist/src/runtime/hooks/registry.js

@@ -1,55 +1 @@
-/**
- * Returns an empty registry. Used by tests that build a runtime bundle
- * stub without authored hooks — production registries are constructed
- * via {@link createRuntimeHookRegistry} from the resolved authored
- * graph.
- */
-export function createEmptyHookRegistry() {
-    return {
-        session: [],
-        turn: [],
-        streamEventsByType: new Map(),
-        streamEventsWildcard: [],
-    };
-}
-/**
- * Builds the per-node runtime hook registry from an ordered list of
- * resolved hook definitions.
- *
- * The caller is responsible for sorting the input — discover-time
- * lexicographic ordering on full slug is preserved by the discovery
- * helper, so callers usually pass `resolvedHooks` directly.
- */
-export function createRuntimeHookRegistry(resolvedHooks) {
-    const session = [];
-    const turn = [];
-    const streamEventsByType = new Map();
-    const streamEventsWildcard = [];
-    for (const hook of resolvedHooks) {
-        const sessionFn = hook.lifecycle.session;
-        if (sessionFn !== undefined) {
-            session.push({ slug: hook.slug, handler: sessionFn });
-        }
-        const turnFn = hook.lifecycle.turn;
-        if (turnFn !== undefined) {
-            turn.push({ slug: hook.slug, handler: turnFn });
-        }
-        for (const [eventType, handler] of Object.entries(hook.events)) {
-            const entry = { slug: hook.slug, handler, eventType };
-            if (eventType === "*") {
-                streamEventsWildcard.push(entry);
-            }
-            else {
-                const bucket = streamEventsByType.get(eventType) ?? [];
-                bucket.push(entry);
-                streamEventsByType.set(eventType, bucket);
-            }
-        }
-    }
-    return {
-        session,
-        turn,
-        streamEventsByType,
-        streamEventsWildcard,
-    };
-}
+function createEmptyHookRegistry(){return{session:[],turn:[],streamEventsByType:new Map,streamEventsWildcard:[]}}function createRuntimeHookRegistry(e){let t=[],n=[],r=new Map,i=[];for(let a of e){let e=a.lifecycle.session;e!==void 0&&t.push({slug:a.slug,handler:e});let o=a.lifecycle.turn;o!==void 0&&n.push({slug:a.slug,handler:o});for(let[e,t]of Object.entries(a.events)){let n={slug:a.slug,handler:t,eventType:e};if(e===`*`)i.push(n);else{let t=r.get(e)??[];t.push(n),r.set(e,t)}}}return{session:t,turn:n,streamEventsByType:r,streamEventsWildcard:i}}export{createEmptyHookRegistry,createRuntimeHookRegistry};

package/dist/src/runtime/input/types.js

@@ -1,63 +1 @@
-import { z } from "#compiled/zod/index.js";
-import { runtimeToolCallActionRequestSchema } from "#runtime/actions/types.js";
-/**
- * Zod schema for one input option.
- *
- * Descriptions are included as this schema is used in the `ask_question` tool
- * input, which is surfaced directly to the model.
- */
-export const inputOptionSchema = z
-    .object({
-    description: z.string().describe("Optional additional context for this option.").optional(),
-    id: z.string().describe("Stable identifier for the option."),
-    label: z.string().describe("User-facing label for the option."),
-    style: z
-        .enum(["primary", "danger", "default"])
-        .describe("Visual treatment hint for the option.")
-        .optional(),
-})
-    .strict();
-/**
- * Zod schema for one input request.
- */
-export const inputRequestSchema = z
-    .object({
-    action: runtimeToolCallActionRequestSchema,
-    allowFreeform: z
-        .boolean()
-        .describe("Whether the user may answer with freeform text instead of selecting one of the provided options.")
-        .optional(),
-    display: z
-        .enum(["confirmation", "select", "text"])
-        .describe("Rendering hint — the channel uses this to pick a UX treatment.")
-        .optional(),
-    options: z
-        .array(inputOptionSchema)
-        .describe("Selectable answer options to present to the user.")
-        .optional(),
-    prompt: z.string().describe("The prompt to present to the user."),
-    requestId: z.string().describe("Stable identifier for this request."),
-})
-    .strict();
-/**
- * Zod schema for one input response.
- */
-export const inputResponseSchema = z
-    .object({
-    optionId: z.string().optional(),
-    requestId: z.string(),
-    text: z.string().optional(),
-})
-    .strict();
-/**
- * Returns true when a value matches the input request contract.
- */
-export function isInputRequest(value) {
-    return inputRequestSchema.safeParse(value).success;
-}
-/**
- * Returns true when a value matches the input response contract.
- */
-export function isInputResponse(value) {
-    return inputResponseSchema.safeParse(value).success;
-}
+import{z}from"#compiled/zod/index.js";import{runtimeToolCallActionRequestSchema}from"#runtime/actions/types.js";var inputOptionSchema=z.object({description:z.string().describe(`Optional additional context for this option.`).optional(),id:z.string().describe(`Stable identifier for the option.`),label:z.string().describe(`User-facing label for the option.`),style:z.enum([`primary`,`danger`,`default`]).describe(`Visual treatment hint for the option.`).optional()}).strict(),inputRequestSchema=z.object({action:runtimeToolCallActionRequestSchema,allowFreeform:z.boolean().describe(`Whether the user may answer with freeform text instead of selecting one of the provided options.`).optional(),display:z.enum([`confirmation`,`select`,`text`]).describe(`Rendering hint — the channel uses this to pick a UX treatment.`).optional(),options:z.array(inputOptionSchema).describe(`Selectable answer options to present to the user.`).optional(),prompt:z.string().describe(`The prompt to present to the user.`),requestId:z.string().describe(`Stable identifier for this request.`)}).strict(),inputResponseSchema=z.object({optionId:z.string().optional(),requestId:z.string(),text:z.string().optional()}).strict();function isInputRequest(e){return inputRequestSchema.safeParse(e).success}function isInputResponse(e){return inputResponseSchema.safeParse(e).success}export{inputOptionSchema,inputRequestSchema,inputResponseSchema,isInputRequest,isInputResponse};

package/dist/src/runtime/loaders/artifact-paths.js

@@ -1,26 +1 @@
-/**
- * Resolves the stable Ash artifact paths for one application root without
- * depending on Node path helpers.
- */
-export function resolveRuntimeCompilerArtifactPaths(appRoot) {
-    const normalizedAppRoot = normalizeFilesystemPath(appRoot);
-    const discoveryDirectoryPath = `${normalizedAppRoot}/.ash/discovery`;
-    const compileDirectoryPath = `${normalizedAppRoot}/.ash/compile`;
-    return {
-        appRoot: normalizedAppRoot,
-        compiledManifestPath: `${compileDirectoryPath}/compiled-agent-manifest.json`,
-        compileDirectoryPath,
-        compileMetadataPath: `${compileDirectoryPath}/compile-metadata.json`,
-        diagnosticsPath: `${discoveryDirectoryPath}/diagnostics.json`,
-        discoveryDirectoryPath,
-        discoveryManifestPath: `${discoveryDirectoryPath}/agent-discovery-manifest.json`,
-        moduleMapPath: `${compileDirectoryPath}/module-map.mjs`,
-    };
-}
-function normalizeFilesystemPath(path) {
-    const normalized = path.replaceAll("\\", "/");
-    if (normalized === "/") {
-        return normalized;
-    }
-    return normalized.replace(/\/+$/, "");
-}
+function resolveRuntimeCompilerArtifactPaths(e){let t=normalizeFilesystemPath(e),n=`${t}/.ash/discovery`,r=`${t}/.ash/compile`;return{appRoot:t,compiledManifestPath:`${r}/compiled-agent-manifest.json`,compileDirectoryPath:r,compileMetadataPath:`${r}/compile-metadata.json`,diagnosticsPath:`${n}/diagnostics.json`,discoveryDirectoryPath:n,discoveryManifestPath:`${n}/agent-discovery-manifest.json`,moduleMapPath:`${r}/module-map.mjs`}}function normalizeFilesystemPath(e){let t=e.replaceAll(`\\`,`/`);return t===`/`?t:t.replace(/\/+$/,``)}export{resolveRuntimeCompilerArtifactPaths};

package/dist/src/runtime/loaders/bundled-artifacts.js

@@ -1,21 +1 @@
-import { getActiveRuntimeSession } from "#runtime/sessions/runtime-session.js";
-/**
- * Installs one bundled compiled-artifact snapshot on the active runtime
- * session. In production this writes to the process-default session at
- * Nitro bootstrap time; inside a `withRuntimeSession` scope it targets the
- * scoped session so tests cannot leak installations across each other.
- */
-export function installBundledCompiledArtifacts(input) {
-    getActiveRuntimeSession().compiledArtifacts = {
-        manifest: input.manifest,
-        metadata: input.metadata,
-        moduleMap: input.moduleMap,
-    };
-}
-/**
- * Reads the bundled compiled-artifact snapshot for the active runtime
- * session, or `null` if none has been installed.
- */
-export function readBundledCompiledArtifacts() {
-    return getActiveRuntimeSession().compiledArtifacts;
-}
+import{getActiveRuntimeSession}from"#runtime/sessions/runtime-session.js";function installBundledCompiledArtifacts(e){getActiveRuntimeSession().compiledArtifacts={manifest:e.manifest,metadata:e.metadata,moduleMap:e.moduleMap}}function readBundledCompiledArtifacts(){return getActiveRuntimeSession().compiledArtifacts}export{installBundledCompiledArtifacts,readBundledCompiledArtifacts};

package/dist/src/runtime/loaders/compile-metadata.js

@@ -1,92 +1 @@
-import { z } from "#compiled/zod/index.js";
-import { COMPILE_METADATA_KIND, COMPILE_METADATA_VERSION, } from "#compiler/artifacts.js";
-import { formatValidationError } from "#runtime/validation.js";
-import { resolveRuntimeCompilerArtifactPaths } from "#runtime/loaders/artifact-paths.js";
-import { readBundledCompiledArtifacts } from "#runtime/loaders/bundled-artifacts.js";
-const compileArtifactDigestSchema = z
-    .object({
-    path: z.string(),
-    sha256: z.string(),
-})
-    .strict();
-const compileMetadataSchema = z
-    .object({
-    compile: z
-        .object({
-        moduleMap: compileArtifactDigestSchema,
-    })
-        .strict(),
-    discovery: z
-        .object({
-        diagnostics: compileArtifactDigestSchema,
-        manifest: compileArtifactDigestSchema,
-        sourceGraphHash: z.string(),
-        summary: z
-            .object({
-            errors: z.number().finite(),
-            warnings: z.number().finite(),
-        })
-            .strict(),
-    })
-        .strict(),
-    generator: z
-        .object({
-        name: z.string(),
-        version: z.string(),
-    })
-        .strict(),
-    kind: z.literal(COMPILE_METADATA_KIND),
-    status: z.union([z.literal("failed"), z.literal("ready")]),
-    version: z.literal(COMPILE_METADATA_VERSION),
-})
-    .strict();
-const BUNDLED_COMPILE_METADATA_SOURCE = "bundled compile metadata";
-/**
- * Error raised when compile metadata cannot be loaded or validated.
- */
-class LoadCompileMetadataError extends Error {
-    metadataPath;
-    constructor(message, metadataPath) {
-        super(message);
-        this.name = "LoadCompileMetadataError";
-        if (metadataPath !== undefined) {
-            this.metadataPath = metadataPath;
-        }
-    }
-}
-/**
- * Loads and validates compile metadata when it is available for the current
- * artifact source.
- */
-export async function loadCompileMetadata(input) {
-    const metadataPath = input.compiledArtifactsSource.kind === "disk"
-        ? resolveRuntimeCompilerArtifactPaths(input.compiledArtifactsSource.appRoot)
-            .compileMetadataPath
-        : undefined;
-    if (metadataPath !== undefined) {
-        const { readFile } = await import("node:fs/promises");
-        let metadataJson;
-        try {
-            metadataJson = JSON.parse(await readFile(metadataPath, "utf8"));
-        }
-        catch (error) {
-            throw new LoadCompileMetadataError(formatLoadErrorMessage(error), metadataPath);
-        }
-        return parseCompileMetadata(metadataJson, metadataPath);
-    }
-    const bundledArtifacts = readBundledCompiledArtifacts();
-    const bundledMetadata = bundledArtifacts?.metadata;
-    return bundledMetadata === undefined
-        ? null
-        : parseCompileMetadata(bundledMetadata, BUNDLED_COMPILE_METADATA_SOURCE);
-}
-function parseCompileMetadata(value, metadataPath) {
-    const parsed = compileMetadataSchema.safeParse(value);
-    if (!parsed.success) {
-        throw new LoadCompileMetadataError(`Expected "${metadataPath}" to contain valid Ash compile metadata. ${formatValidationError(parsed.error)}`, metadataPath);
-    }
-    return parsed.data;
-}
-function formatLoadErrorMessage(error) {
-    return error instanceof Error ? error.message : "Unknown compile metadata load failure.";
-}
+import{z}from"#compiled/zod/index.js";import{COMPILE_METADATA_KIND,COMPILE_METADATA_VERSION}from"#compiler/artifacts.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";import{formatValidationError}from"#runtime/validation.js";var compileArtifactDigestSchema=z.object({path:z.string(),sha256:z.string()}).strict(),compileMetadataSchema=z.object({compile:z.object({moduleMap:compileArtifactDigestSchema}).strict(),discovery:z.object({diagnostics:compileArtifactDigestSchema,manifest:compileArtifactDigestSchema,sourceGraphHash:z.string(),summary:z.object({errors:z.number().finite(),warnings:z.number().finite()}).strict()}).strict(),generator:z.object({name:z.string(),version:z.string()}).strict(),kind:z.literal(COMPILE_METADATA_KIND),status:z.union([z.literal(`failed`),z.literal(`ready`)]),version:z.literal(COMPILE_METADATA_VERSION)}).strict(),BUNDLED_COMPILE_METADATA_SOURCE=`bundled compile metadata`,LoadCompileMetadataError=class extends Error{metadataPath;constructor(e,t){super(e),this.name=`LoadCompileMetadataError`,t!==void 0&&(this.metadataPath=t)}};async function loadCompileMetadata(e){let t=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).compileMetadataPath:void 0;if(t!==void 0){let{readFile:e}=await import(`node:fs/promises`),n;try{n=JSON.parse(await e(t,`utf8`))}catch(e){throw new LoadCompileMetadataError(formatLoadErrorMessage(e),t)}return parseCompileMetadata(n,t)}let n=readBundledCompiledArtifacts()?.metadata;return n===void 0?null:parseCompileMetadata(n,BUNDLED_COMPILE_METADATA_SOURCE)}function parseCompileMetadata(e,t){let n=compileMetadataSchema.safeParse(e);if(!n.success)throw new LoadCompileMetadataError(`Expected "${t}" to contain valid Ash compile metadata. ${formatValidationError(n.error)}`,t);return n.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown compile metadata load failure.`}export{loadCompileMetadata};

package/dist/src/runtime/loaders/manifest.js

@@ -1,56 +1 @@
-import { compiledAgentManifestSchema } from "#compiler/manifest.js";
-import { formatValidationError } from "#runtime/validation.js";
-import { resolveRuntimeCompilerArtifactPaths } from "#runtime/loaders/artifact-paths.js";
-import { readBundledCompiledArtifacts } from "#runtime/loaders/bundled-artifacts.js";
-const BUNDLED_MANIFEST_SOURCE = "bundled compiled manifest";
-/**
- * Error raised when the compiled manifest cannot be loaded or validated.
- */
-export class LoadCompiledManifestError extends Error {
-    manifestPath;
-    constructor(message, manifestPath) {
-        super(message);
-        this.name = "LoadCompiledManifestError";
-        if (manifestPath !== undefined) {
-            this.manifestPath = manifestPath;
-        }
-    }
-}
-/**
- * Loads and validates the compiler-owned source manifest.
- */
-export async function loadCompiledManifest(input) {
-    const manifestPath = input.compiledArtifactsSource.kind === "disk"
-        ? resolveRuntimeCompilerArtifactPaths(input.compiledArtifactsSource.appRoot)
-            .compiledManifestPath
-        : undefined;
-    if (manifestPath !== undefined) {
-        const { readFile } = await import("node:fs/promises");
-        let manifestJson;
-        try {
-            manifestJson = JSON.parse(await readFile(manifestPath, "utf8"));
-        }
-        catch (error) {
-            throw new LoadCompiledManifestError(formatLoadErrorMessage(error), manifestPath);
-        }
-        return parseCompiledManifest(manifestJson, manifestPath);
-    }
-    const bundledArtifacts = readBundledCompiledArtifacts();
-    if (bundledArtifacts !== null) {
-        return parseCompiledManifest(bundledArtifacts.manifest, BUNDLED_MANIFEST_SOURCE);
-    }
-    throw new LoadCompiledManifestError("Compiled manifest is unavailable without an app root or bundled compiled artifacts.", BUNDLED_MANIFEST_SOURCE);
-}
-function parseCompiledManifest(value, manifestPath) {
-    const parsed = compiledAgentManifestSchema.safeParse(value);
-    if (!parsed.success) {
-        throw new LoadCompiledManifestError(`Expected "${manifestPath}" to contain a valid compiled Ash agent manifest. ${formatValidationError(parsed.error)}`, manifestPath);
-    }
-    return parsed.data;
-}
-function formatLoadErrorMessage(error) {
-    if (error instanceof Error) {
-        return error.message;
-    }
-    return "Unknown manifest load failure.";
-}
+import{compiledAgentManifestSchema}from"#compiler/manifest.js";import{resolveRuntimeCompilerArtifactPaths}from"#runtime/loaders/artifact-paths.js";import{readBundledCompiledArtifacts}from"#runtime/loaders/bundled-artifacts.js";import{formatValidationError}from"#runtime/validation.js";var BUNDLED_MANIFEST_SOURCE=`bundled compiled manifest`,LoadCompiledManifestError=class extends Error{manifestPath;constructor(e,t){super(e),this.name=`LoadCompiledManifestError`,t!==void 0&&(this.manifestPath=t)}};async function loadCompiledManifest(e){let r=e.compiledArtifactsSource.kind===`disk`?resolveRuntimeCompilerArtifactPaths(e.compiledArtifactsSource.appRoot).compiledManifestPath:void 0;if(r!==void 0){let{readFile:e}=await import(`node:fs/promises`),t;try{t=JSON.parse(await e(r,`utf8`))}catch(e){throw new LoadCompiledManifestError(formatLoadErrorMessage(e),r)}return parseCompiledManifest(t,r)}let a=readBundledCompiledArtifacts();if(a!==null)return parseCompiledManifest(a.manifest,BUNDLED_MANIFEST_SOURCE);throw new LoadCompiledManifestError(`Compiled manifest is unavailable without an app root or bundled compiled artifacts.`,BUNDLED_MANIFEST_SOURCE)}function parseCompiledManifest(t,n){let i=compiledAgentManifestSchema.safeParse(t);if(!i.success)throw new LoadCompiledManifestError(`Expected "${n}" to contain a valid compiled Ash agent manifest. ${formatValidationError(i.error)}`,n);return i.data}function formatLoadErrorMessage(e){return e instanceof Error?e.message:`Unknown manifest load failure.`}export{LoadCompiledManifestError,loadCompiledManifest};