glirastes 0.4.0 → 0.5.1

package/dist/codegen/tools/emit-module.js

@@ -0,0 +1,182 @@
+import { posix } from 'node:path';
+import { compareCodeUnits, sortKeysDeep } from './canonical.js';
+import { deriveChatInteractions } from './chat-interactions.js';
+const IDENTIFIER = /^[A-Za-z_$][\w$]*$/;
+function accessor(name) {
+    return IDENTIFIER.test(name) ? `.${name}` : `[${JSON.stringify(name)}]`;
+}
+/** The file a NodeNext import names: what the source compiles to (`schemas.ts` → `schemas.js`). */
+const NODENEXT_EXTENSIONS = {
+    '.ts': '.js', '.tsx': '.js', '.mts': '.mjs', '.cts': '.cjs',
+};
+function importSpecifier(fromModule, target, typescript, moduleResolution) {
+    let specifier = posix.relative(posix.dirname(fromModule), target);
+    if (!specifier.startsWith('.'))
+        specifier = `./${specifier}`;
+    if (!typescript)
+        return specifier;
+    if (moduleResolution === 'nodenext') {
+        return specifier.replace(/\.(?:ts|tsx|mts|cts)$/, (extension) => NODENEXT_EXTENSIONS[extension]);
+    }
+    return specifier.replace(/\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/, '');
+}
+function literal(value, indent = 0) {
+    const text = JSON.stringify(sortKeysDeep(value), null, 2);
+    return indent > 0 ? text.replace(/\n/g, `\n${' '.repeat(indent)}`) : text;
+}
+function catalogEntry(tool) {
+    const common = {
+        toolId: tool.toolId,
+        definitionId: tool.name,
+        modelName: tool.modelName ?? tool.name.replace(/\./g, '_'),
+        executionKind: tool.executionKind,
+        sourceFingerprint: tool.sourceFingerprint,
+        inputSchemaDigest: tool.inputSchemaDigest,
+        outputSchemaDigest: tool.outputSchemaDigest,
+        description: tool.description,
+        riskClass: tool.riskClass,
+        requiresApproval: tool.requiresApproval,
+    };
+    return tool.executionKind === 'endpoint'
+        ? { ...common, method: tool.method, path: tool.path }
+        : { ...common, actionBindingRef: tool.actionBindingRef };
+}
+/** Pure function of artifact, contracts and module path; integrity mode re-renders it byte for byte. */
+export function renderGeneratedModule(input) {
+    const typescript = input.modulePath.endsWith('.ts');
+    const contractsById = new Map(input.contracts.map((entry) => [entry.toolId, entry]));
+    const tools = input.artifact.tools
+        .filter((tool) => tool.enabled)
+        .sort((left, right) => compareCodeUnits(left.toolId, right.toolId));
+    const bound = tools.map((tool) => {
+        const contract = contractsById.get(tool.toolId)?.contract;
+        if (!contract)
+            throw new Error(`Enabled tool ${tool.name} has no contract to bind.`);
+        if (tool.executionKind === 'ui' && !contract.uiAction) {
+            throw new Error(`Enabled UI tool ${tool.name} has no UI action to bind.`);
+        }
+        return { tool, contract };
+    });
+    // Search-only synonyms of the enabled tools, keyed like `toolSemantics` of createAiChatHandler.
+    const searchSemantics = Object.fromEntries(tools
+        .map((tool) => [catalogEntry(tool).modelName, contractsById.get(tool.toolId)?.search?.synonyms])
+        .filter((entry) => (entry[1]?.length ?? 0) > 0)
+        .sort(([left], [right]) => compareCodeUnits(left, right))
+        .map(([modelName, synonyms]) => [modelName, { synonyms }]));
+    const modules = [...new Set(bound
+            .flatMap(({ contract }) => [contract.runtime.input, contract.runtime.output])
+            .flatMap((source) => (source.kind === 'module-export' ? [source.module] : [])))]
+        .sort(compareCodeUnits);
+    const aliases = new Map(modules.map((module, index) => [module, `m${index}`]));
+    const usesJson = bound.some(({ contract }) => contract.runtime.input.kind === 'json' || contract.runtime.output.kind === 'json');
+    const usesEndpoints = bound.some(({ tool }) => tool.executionKind === 'endpoint');
+    const usesUi = bound.some(({ tool }) => tool.executionKind === 'ui');
+    const expression = (source) => (source.kind === 'json'
+        ? `createJsonSchemaLike(${literal(source.schema, 2)})`
+        : `${aliases.get(source.module)}${[source.export, ...source.property].map(accessor).join('')}`);
+    const serverImports = [
+        ...(usesEndpoints ? ['endpointToolToTool'] : []),
+        ...(usesUi ? ['uiActionToolToTool'] : []),
+    ];
+    const lines = [
+        '// @generated by `glirastes tools refresh`. Do not edit; rerun the command after code changes.',
+        '/* eslint-disable */',
+    ];
+    if (usesJson)
+        lines.push("import { createJsonSchemaLike } from 'glirastes/runtime';");
+    if (serverImports.length > 0)
+        lines.push(`import { ${serverImports.join(', ')} } from 'glirastes/server';`);
+    for (const module of modules) {
+        const specifier = importSpecifier(input.modulePath, module, typescript, input.moduleResolution ?? 'bundler');
+        lines.push(`import * as ${aliases.get(module)} from ${JSON.stringify(specifier)};`);
+    }
+    lines.push('', `export const setupArtifact = ${literal(input.artifact)};`, '', `export const toolCatalog = ${literal(tools.map(catalogEntry))}${typescript ? ' as const' : ''};`, '', '/** `@` entities and `/` commands derived from the tools; see `createChatInteractionsHandler`. */', `export const chatInteractions = ${literal(deriveChatInteractions(input))}${typescript ? ' as const' : ''};`, '');
+    if (typescript) {
+        lines.push(`export type GeneratedToolId = ${tools.length > 0
+            ? tools.map((tool) => JSON.stringify(tool.toolId)).join(' | ')
+            : 'never'};`, '');
+    }
+    lines.push('/** Pass as `toolSemantics` to createAiChatHandler: synonyms help find_tools, they never grant a tool. */', `export const toolSearchSemantics = ${literal(searchSemantics)}${typescript ? ' as const' : ''};`, '');
+    lines.push('export function createToolBindings() {');
+    if (bound.length === 0) {
+        lines.push('  return [];');
+    }
+    else {
+        bound.forEach(({ contract }, index) => {
+            lines.push(`  const input${index} = ${expression(contract.runtime.input)};`);
+            lines.push(`  const output${index} = ${expression(contract.runtime.output)};`);
+        });
+        lines.push('  return [');
+        bound.forEach(({ tool, contract }, index) => {
+            const entry = `toolCatalog[${index}]`;
+            const shared = [
+                `        id: ${entry}.definitionId,`,
+                `        toolName: ${entry}.modelName,`,
+                `        description: ${entry}.description,`,
+            ];
+            const toolExpression = tool.executionKind === 'endpoint'
+                ? [
+                    '      tool: endpointToolToTool({',
+                    ...shared,
+                    `        method: ${entry}.method,`,
+                    `        path: ${entry}.path,`,
+                    `        inputSchema: input${index},`,
+                    ...(contract.runtime.output.kind === 'module-export' ? [`        outputSchema: output${index},`] : []),
+                    `        needsApproval: ${entry}.requiresApproval,`,
+                    '      }),',
+                ]
+                : [
+                    '      tool: uiActionToolToTool({',
+                    ...shared,
+                    `        inputSchema: input${index},`,
+                    `        needsApproval: ${entry}.requiresApproval,`,
+                    `        action: ${literal(contract.uiAction, 8)},`,
+                    '      }),',
+                ];
+            lines.push('    {', `      ...${entry},`, `      inputSchema: input${index},`, `      outputSchema: output${index},`, ...toolExpression, '    },');
+        });
+        lines.push('  ];');
+    }
+    lines.push('}', '');
+    if (input.mcpCatalog === true) {
+        // MCP only (spec 5.6): enabled endpoint tools under the names MCP clients keep; UI tools stay out.
+        const mcpEntries = bound
+            .flatMap(({ tool, contract }) => {
+            if (tool.executionKind !== 'endpoint')
+                return [];
+            const entry = catalogEntry(tool);
+            const names = contractsById.get(tool.toolId)?.mcp ?? [{ id: tool.name, name: entry.modelName }];
+            return names.map((name) => ({ name, tool, contract, entry }));
+        })
+            .sort((left, right) => compareCodeUnits(left.name.name, right.name.name));
+        lines.push('/** For the app\'s MCP server only (`emit.mcpCatalog`): endpoint tools under their MCP grant ids and names. */', 'export function createMcpEndpointCatalog() {');
+        if (mcpEntries.length === 0) {
+            lines.push('  return [];');
+        }
+        else {
+            lines.push('  return [');
+            for (const { name, tool, contract, entry } of mcpEntries) {
+                const data = literal({
+                    id: name.id,
+                    name: name.name,
+                    toolId: tool.toolId,
+                    definitionId: tool.name,
+                    method: entry.method,
+                    path: entry.path,
+                    description: entry.description,
+                    riskClass: tool.riskClass,
+                    requiresApproval: tool.requiresApproval,
+                    allowedRoles: tool.allowedRoles,
+                    inputJsonSchema: contract.input,
+                }, 4);
+                const schema = expression(contract.runtime.input).replace(/\n/g, '\n    ');
+                // A replacer function: `$$`, `$&` or `$'` inside the schema text must not be read as replacement patterns.
+                lines.push(`    ${data.replace(/\n {4}\}$/, () => `,\n      "inputSchema": ${schema}\n    }`)},`);
+            }
+            lines.push('  ];');
+        }
+        lines.push('}', '');
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=emit-module.js.map

package/dist/codegen/tools/emit-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit-module.js","sourceRoot":"","sources":["../../../src/codegen/tools/emit-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAahE,MAAM,UAAU,GAAG,oBAAoB,CAAC;AAExC,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;AAC1E,CAAC;AAED,mGAAmG;AACnG,MAAM,mBAAmB,GAAqC;IAC5D,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAC5D,CAAC;AAEF,SAAS,eAAe,CACtB,UAAkB,EAClB,MAAc,EACd,UAAmB,EACnB,gBAAwC;IAExC,IAAI,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,KAAK,SAAS,EAAE,CAAC;IAC7D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,SAAS,CAAC,OAAO,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,MAAM,GAAG,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1D,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAID,SAAS,YAAY,CAAC,IAAkB;IACtC,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,YAAY,EAAE,IAAI,CAAC,IAAI;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;QAC1D,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;KACxC,CAAC;IACF,OAAO,IAAI,CAAC,aAAa,KAAK,UAAU;QACtC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QACrD,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;AAC7D,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,qBAAqB,CAAC,KAAiC;IACrE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAU,CAAC,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK;SAC/B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;SAC9B,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAoC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;QAC3F,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;QACrF,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,IAAI,4BAA4B,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,gGAAgG;IAChG,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK;SAC7C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,SAAmB,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAU,CAAC;SAClH,MAAM,CAAC,CAAC,KAAK,EAAwC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;SACpF,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK;aAC9B,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;aAC5E,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC/E,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,EAAE,CAAU,CAAC,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACjI,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,UAAU,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,CAAC,MAA2B,EAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;QACjF,CAAC,CAAC,wBAAwB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG;QACtD,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnG,MAAM,aAAa,GAAG;QACpB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;IAEF,MAAM,KAAK,GAAa;QACtB,gGAAgG;QAChG,sBAAsB;KACvB,CAAC;IACF,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IACtF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5G,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,gBAAgB,IAAI,SAAS,CAAC,CAAC;QAC7G,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,GAAG,CAAC,MAAM,CAAE,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,CAAC,IAAI,CACR,EAAE,EACF,gCAAgC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAC1D,EAAE,EACF,8BAA8B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EACjG,EAAE,EACF,mGAAmG,EACnG,mCAAmC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAC5G,EAAE,CACH,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,iCAAiC,KAAK,CAAC,MAAM,GAAG,CAAC;YAC1D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YAC9D,CAAC,CAAC,OAAO,GAAG,EAAE,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,KAAK,CAAC,IAAI,CACR,2GAA2G,EAC3G,sCAAsC,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EACjG,EAAE,CACH,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE;YACpC,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,MAAM,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7E,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,MAAM,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,eAAe,KAAK,GAAG,CAAC;YACtC,MAAM,MAAM,GAAG;gBACb,eAAe,KAAK,gBAAgB;gBACpC,qBAAqB,KAAK,aAAa;gBACvC,wBAAwB,KAAK,eAAe;aAC7C,CAAC;YACF,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,KAAK,UAAU;gBACtD,CAAC,CAAC;oBACA,kCAAkC;oBAClC,GAAG,MAAM;oBACT,mBAAmB,KAAK,UAAU;oBAClC,iBAAiB,KAAK,QAAQ;oBAC9B,6BAA6B,KAAK,GAAG;oBACrC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,+BAA+B,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtG,0BAA0B,KAAK,oBAAoB;oBACnD,WAAW;iBACZ;gBACD,CAAC,CAAC;oBACA,kCAAkC;oBAClC,GAAG,MAAM;oBACT,6BAA6B,KAAK,GAAG;oBACrC,0BAA0B,KAAK,oBAAoB;oBACnD,mBAAmB,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG;oBACnD,WAAW;iBACZ,CAAC;YACJ,KAAK,CAAC,IAAI,CACR,OAAO,EACP,YAAY,KAAK,GAAG,EACpB,2BAA2B,KAAK,GAAG,EACnC,6BAA6B,KAAK,GAAG,EACrC,GAAG,cAAc,EACjB,QAAQ,CACT,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpB,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC9B,mGAAmG;QACnG,MAAM,UAAU,GAAG,KAAK;aACrB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC9B,IAAI,IAAI,CAAC,aAAa,KAAK,UAAU;gBAAE,OAAO,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,SAAmB,EAAE,CAAC,CAAC;YAC1G,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC;aACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,KAAK,CAAC,IAAI,CACR,gHAAgH,EAChH,8CAA8C,CAC/C,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACzB,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,UAAU,EAAE,CAAC;gBACzD,MAAM,IAAI,GAAG,OAAO,CAAC;oBACnB,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,YAAY,EAAE,IAAI,CAAC,IAAI;oBACvB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,eAAe,EAAE,QAAQ,CAAC,KAAK;iBAChC,EAAE,CAAC,CAAC,CAAC;gBACN,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC3E,2GAA2G;gBAC3G,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,2BAA2B,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACpG,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/codegen/tools/evidence.d.ts

@@ -0,0 +1,13 @@
+import ts from 'typescript';
+import type { AppProgram } from './program.js';
+export declare const EVIDENCE_DEPTH = 2;
+export interface HandlerEvidence {
+    authEvidence: string[];
+    externalCall: boolean;
+}
+/** Static evidence only; the endpoint stays the authorization boundary. */
+export declare function collectHandlerEvidence(input: {
+    app: AppProgram;
+    scope: ts.Node;
+    authHelpers: ReadonlyArray<string>;
+}): HandlerEvidence;

package/dist/codegen/tools/evidence.js

@@ -0,0 +1,138 @@
+import ts from 'typescript';
+import { AUTH_PATTERNS } from '../route-scanner.js';
+import { unwrapExpression } from './handler-locator.js';
+export const EVIDENCE_DEPTH = 2;
+const DEFAULT_AUTH_HELPERS = AUTH_PATTERNS.map(([name]) => name);
+const CHILD_PROCESS_MODULES = new Set(['child_process', 'node:child_process']);
+function calleeName(expression) {
+    const target = unwrapExpression(expression);
+    if (ts.isIdentifier(target))
+        return target.text;
+    if (ts.isPropertyAccessExpression(target))
+        return target.name.text;
+    return undefined;
+}
+function importModuleOf(declaration) {
+    if (ts.isImportEqualsDeclaration(declaration)) {
+        const reference = declaration.moduleReference;
+        return ts.isExternalModuleReference(reference) && ts.isStringLiteralLike(reference.expression)
+            ? reference.expression.text
+            : undefined;
+    }
+    let current = declaration;
+    while (current && !ts.isImportDeclaration(current))
+        current = current.parent;
+    return current && ts.isStringLiteral(current.moduleSpecifier) ? current.moduleSpecifier.text : undefined;
+}
+/** `x: ExecOptions` and `typeof exec` name the binding without running it. */
+function inTypePosition(identifier) {
+    let node = identifier;
+    while (ts.isQualifiedName(node.parent))
+        node = node.parent;
+    return ts.isTypeReferenceNode(node.parent) || ts.isTypeQueryNode(node.parent);
+}
+/**
+ * Any value reference to a binding imported from child_process counts, not only a direct call:
+ * `promisify(exec)`, `{ exec }` and `cp.execFile` passed along all hand the process API onward.
+ */
+function isChildProcessReference(app, identifier) {
+    const parent = identifier.parent;
+    const symbol = ts.isShorthandPropertyAssignment(parent) && parent.name === identifier
+        ? app.checker.getShorthandAssignmentValueSymbol(parent)
+        : app.checker.getSymbolAtLocation(identifier);
+    const declaration = symbol?.declarations?.[0];
+    if (!declaration || !(ts.isImportSpecifier(declaration)
+        || ts.isNamespaceImport(declaration)
+        || ts.isImportClause(declaration)
+        || ts.isImportEqualsDeclaration(declaration)) || inTypePosition(identifier))
+        return false;
+    const module = importModuleOf(declaration);
+    return module !== undefined && CHILD_PROCESS_MODULES.has(module);
+}
+/** require('child_process') and import('child_process'), wherever the result ends up. */
+function isChildProcessLoad(call) {
+    const [specifier] = call.arguments;
+    if (!specifier || !ts.isStringLiteralLike(specifier) || !CHILD_PROCESS_MODULES.has(specifier.text))
+        return false;
+    return call.expression.kind === ts.SyntaxKind.ImportKeyword
+        || (ts.isIdentifier(call.expression) && call.expression.text === 'require');
+}
+function appDeclaration(app, identifier) {
+    let symbol = app.checker.getSymbolAtLocation(identifier);
+    if (symbol && symbol.flags & ts.SymbolFlags.Alias)
+        symbol = app.checker.getAliasedSymbol(symbol);
+    const declaration = symbol?.declarations?.[0];
+    return declaration && app.appRelative(declaration.getSourceFile().fileName) ? declaration : undefined;
+}
+function functionInitializer(declaration) {
+    const initializer = declaration.initializer && unwrapExpression(declaration.initializer);
+    return initializer && (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer))
+        ? initializer
+        : undefined;
+}
+function followTargets(app, expression) {
+    const target = unwrapExpression(expression);
+    const callee = ts.isIdentifier(target)
+        ? target
+        : ts.isPropertyAccessExpression(target) ? target.name : undefined;
+    const root = ts.isIdentifier(target)
+        ? target
+        : ts.isPropertyAccessExpression(target) && ts.isIdentifier(target.expression) ? target.expression : undefined;
+    const targets = [];
+    const declaration = callee && appDeclaration(app, callee);
+    if (declaration && (ts.isFunctionDeclaration(declaration) || ts.isMethodDeclaration(declaration)) && declaration.body) {
+        targets.push({ node: declaration.body, externalOnly: false });
+    }
+    else if (declaration && ts.isVariableDeclaration(declaration)) {
+        const fn = functionInitializer(declaration);
+        if (fn)
+            targets.push({ node: fn.body, externalOnly: false });
+    }
+    // `const run = promisify(exec)` or `const cp = require('child_process')` declared outside the
+    // handler: the called binding's initializer is where the process API enters.
+    const bound = root && appDeclaration(app, root);
+    if (bound && ts.isVariableDeclaration(bound) && bound.initializer && !functionInitializer(bound)) {
+        targets.push({ node: bound.initializer, externalOnly: true });
+    }
+    return targets;
+}
+/** Static evidence only; the endpoint stays the authorization boundary. */
+export function collectHandlerEvidence(input) {
+    const helpers = new Set([...DEFAULT_AUTH_HELPERS, ...input.authHelpers]);
+    const auth = new Set();
+    let externalCall = false;
+    const visited = new Set();
+    const queue = [
+        { node: input.scope, depth: 0, externalOnly: false },
+    ];
+    while (queue.length > 0) {
+        const { node, depth, externalOnly } = queue.shift();
+        if (visited.has(node))
+            continue;
+        visited.add(node);
+        const visit = (child) => {
+            if (ts.isIdentifier(child) && isChildProcessReference(input.app, child))
+                externalCall = true;
+            if (ts.isCallExpression(child) || ts.isNewExpression(child)) {
+                const name = calleeName(child.expression);
+                if (!externalOnly && name && helpers.has(name))
+                    auth.add(name);
+                const callee = unwrapExpression(child.expression);
+                if (ts.isIdentifier(callee) && (callee.text === 'eval' || callee.text === 'Function')) {
+                    externalCall = true;
+                }
+                if (ts.isCallExpression(child) && isChildProcessLoad(child))
+                    externalCall = true;
+                if (depth < EVIDENCE_DEPTH) {
+                    for (const target of followTargets(input.app, child.expression)) {
+                        queue.push({ node: target.node, depth: depth + 1, externalOnly: externalOnly || target.externalOnly });
+                    }
+                }
+            }
+            ts.forEachChild(child, visit);
+        };
+        visit(node);
+    }
+    return { authEvidence: [...auth].sort(), externalCall };
+}
+//# sourceMappingURL=evidence.js.map

package/dist/codegen/tools/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../../src/codegen/tools/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,MAAM,oBAAoB,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;AACjE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAO/E,SAAS,UAAU,CAAC,UAAyB;IAC3C,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAChD,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IACnE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,WAAoB;IAC1C,IAAI,EAAE,CAAC,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,WAAW,CAAC,eAAe,CAAC;QAC9C,OAAO,EAAE,CAAC,yBAAyB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,UAAU,CAAC;YAC5F,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI;YAC3B,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,GAAwB,WAAW,CAAC;IAC/C,OAAO,OAAO,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7E,OAAO,OAAO,IAAI,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3G,CAAC;AAED,8EAA8E;AAC9E,SAAS,cAAc,CAAC,UAAyB;IAC/C,IAAI,IAAI,GAAY,UAAU,CAAC;IAC/B,OAAO,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3D,OAAO,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,GAAe,EAAE,UAAyB;IACzE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IACjC,MAAM,MAAM,GAAG,EAAE,CAAC,6BAA6B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QACnF,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iCAAiC,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,WAAW,IAAI,CAAC,CACnB,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC;WAC9B,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC;WACjC,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC;WAC9B,EAAE,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAC7C,IAAI,cAAc,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO,MAAM,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACnE,CAAC;AAED,yFAAyF;AACzF,SAAS,kBAAkB,CAAC,IAAuB;IACjD,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;IACnC,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACjH,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa;WACtD,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,cAAc,CAAC,GAAe,EAAE,UAAmB;IAC1D,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK;QAAE,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACjG,MAAM,WAAW,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AACxG,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmC;IAC9D,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,IAAI,gBAAgB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IACzF,OAAO,WAAW,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC7F,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAQD,SAAS,aAAa,CAAC,GAAe,EAAE,UAAyB;IAC/D,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;QACpC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;QAClC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,MAAM,IAAI,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;QACtH,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,WAAW,IAAI,EAAE,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;QAChE,MAAM,EAAE,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,8FAA8F;IAC9F,6EAA6E;IAC7E,MAAM,KAAK,GAAG,IAAI,IAAI,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,KAAK,IAAI,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QACjG,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CAAC,KAItC;IACC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,oBAAoB,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAW,CAAC;IACnC,MAAM,KAAK,GAAmE;QAC5E,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE;KACrD,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QACrD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,CAAC,KAAc,EAAQ,EAAE;YACrC,IAAI,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;gBAAE,YAAY,GAAG,IAAI,CAAC;YAC7F,IAAI,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC1C,IAAI,CAAC,YAAY,IAAI,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC/D,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAClD,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;oBACtF,YAAY,GAAG,IAAI,CAAC;gBACtB,CAAC;gBACD,IAAI,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC;oBAAE,YAAY,GAAG,IAAI,CAAC;gBACjF,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;oBAC3B,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;wBAChE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,YAAY,EAAE,YAAY,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;oBACzG,CAAC;gBACH,CAAC;YACH,CAAC;YACD,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,CAAC;IACd,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC;AAC1D,CAAC"}

package/dist/codegen/tools/exclusions.d.ts

@@ -0,0 +1,30 @@
+import type { ExcludedTool } from './types.js';
+export interface ExclusionSubject {
+    stableKey: string;
+    method: string;
+    path: string;
+    chatHandler: boolean;
+    /** The route file header carries an `@ai-ignore` comment (see `hasAiIgnoreMarker`). */
+    aiIgnore?: boolean;
+}
+export interface PolicyExcludeRule {
+    match: string;
+    reason: string;
+}
+export declare function importsChatHandler(source: string): boolean;
+/**
+ * `// @ai-ignore` (or `@ai-ignore` in a block comment) marks a route file the
+ * old SDK kept away from the model, e.g. uploads, debug and admin routes. The
+ * marker counts anywhere in the file header, between and after the imports
+ * and before the first other statement. A marker further down (after a
+ * constant, inside a handler), `@ai-ignored` or a module specifier that spells
+ * it changes nothing.
+ */
+export declare function hasAiIgnoreMarker(source: string): boolean;
+/**
+ * `[METHOD|*] /path/glob` with `*` for one segment and `**` for any number of
+ * segments. A pattern outside the grammar (see `parseExcludePattern`, which
+ * the policy file schema enforces) matches nothing.
+ */
+export declare function matchesExcludePattern(pattern: string, subject: Pick<ExclusionSubject, 'method' | 'path'>): boolean;
+export declare function findExclusion(subject: ExclusionSubject, policyExcludes: ReadonlyArray<PolicyExcludeRule>): ExcludedTool | undefined;

package/dist/codegen/tools/exclusions.js

@@ -0,0 +1,95 @@
+import ts from 'typescript';
+import { parseExcludePattern } from '../../contracts/tool-exclude-pattern.js';
+/** `createAiChatHandler` or an app wrapper such as `createGetItDoneChatHandler` from a Glirastes/agentic module. */
+const CHAT_HANDLER_IMPORT = /import\s*\{[^}]*\b\w*ChatHandler\b[^}]*\}\s*from\s*['"][^'"]*(?:glirastes|agentic)[^'"]*['"]/;
+export function importsChatHandler(source) {
+    return CHAT_HANDLER_IMPORT.test(source);
+}
+/** The comments of a module header: everything before its first statement that is not an import. */
+function headerComments(source) {
+    const file = ts.createSourceFile('route.ts', source, ts.ScriptTarget.Latest, false, ts.ScriptKind.TS);
+    const first = file.statements.find((statement) => !ts.isImportDeclaration(statement));
+    const scanner = ts.createScanner(ts.ScriptTarget.Latest, false, ts.LanguageVariant.Standard, source.slice(0, first ? first.getStart(file) : source.length));
+    const comments = [];
+    for (let kind = scanner.scan(); kind !== ts.SyntaxKind.EndOfFileToken; kind = scanner.scan()) {
+        if (kind === ts.SyntaxKind.SingleLineCommentTrivia || kind === ts.SyntaxKind.MultiLineCommentTrivia) {
+            comments.push(scanner.getTokenText());
+        }
+    }
+    return comments;
+}
+/**
+ * `// @ai-ignore` (or `@ai-ignore` in a block comment) marks a route file the
+ * old SDK kept away from the model, e.g. uploads, debug and admin routes. The
+ * marker counts anywhere in the file header, between and after the imports
+ * and before the first other statement. A marker further down (after a
+ * constant, inside a handler), `@ai-ignored` or a module specifier that spells
+ * it changes nothing.
+ */
+export function hasAiIgnoreMarker(source) {
+    return headerComments(source).some((comment) => /@ai-ignore(?![\w-])/.test(comment));
+}
+function apiSegments(path) {
+    const segments = path.split('/').filter(Boolean);
+    return segments[0] === 'api' ? segments.slice(1) : segments;
+}
+const DEFAULT_RULES = [
+    { reason: 'auth-route', test: (_subject, segments) => segments[0] === 'auth' },
+    { reason: 'webhook', test: (_subject, segments) => segments.some((segment) => /webhook/i.test(segment)) },
+    { reason: 'cron', test: (_subject, segments) => segments.some((segment) => /^crons?$/i.test(segment)) },
+    { reason: 'callback', test: (_subject, segments) => segments.some((segment) => /callbacks?$/i.test(segment)) },
+    {
+        reason: 'health',
+        test: (_subject, segments) => segments.some((segment) => /^(?:health|healthz|healthcheck|livez|readyz)$/i.test(segment)),
+    },
+    { reason: 'catch-all', test: (_subject, segments) => segments.some((segment) => segment.startsWith('*')) },
+    // Any segment: chat and speech handlers often live under a namespace such as /api/ai/.
+    {
+        reason: 'chat-handler',
+        test: (subject, segments) => subject.chatHandler || segments.some((segment) => /^chat(?:-v\d+)?$/i.test(segment)),
+    },
+    {
+        reason: 'stt-handler',
+        test: (_subject, segments) => segments.some((segment) => (/^(?:stt|speech(?:-[a-z]+)*|transcribe|transcriptions?)$/i.test(segment))),
+    },
+];
+function globMatches(pattern, path) {
+    if (pattern.length === 0)
+        return path.length === 0;
+    const [head, ...rest] = pattern;
+    if (head === '**') {
+        for (let index = 0; index <= path.length; index += 1) {
+            if (globMatches(rest, path.slice(index)))
+                return true;
+        }
+        return false;
+    }
+    if (path.length === 0)
+        return false;
+    return (head === '*' || head === path[0]) && globMatches(rest, path.slice(1));
+}
+/**
+ * `[METHOD|*] /path/glob` with `*` for one segment and `**` for any number of
+ * segments. A pattern outside the grammar (see `parseExcludePattern`, which
+ * the policy file schema enforces) matches nothing.
+ */
+export function matchesExcludePattern(pattern, subject) {
+    const parsed = parseExcludePattern(pattern);
+    if (!parsed)
+        return false;
+    if (parsed.method && parsed.method !== subject.method)
+        return false;
+    return globMatches(parsed.segments, subject.path.split('/').filter(Boolean));
+}
+export function findExclusion(subject, policyExcludes) {
+    const segments = apiSegments(subject.path);
+    const rule = DEFAULT_RULES.find((candidate) => candidate.test(subject, segments));
+    if (rule)
+        return { stableKey: subject.stableKey, reason: rule.reason, origin: 'default' };
+    const policy = policyExcludes.find((entry) => matchesExcludePattern(entry.match, subject));
+    if (policy)
+        return { stableKey: subject.stableKey, reason: policy.reason, origin: 'policy' };
+    // Last, so a default or policy reason stays the one tool-report.json names.
+    return subject.aiIgnore ? { stableKey: subject.stableKey, reason: 'ai-ignore', origin: 'code' } : undefined;
+}
+//# sourceMappingURL=exclusions.js.map

package/dist/codegen/tools/exclusions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclusions.js","sourceRoot":"","sources":["../../../src/codegen/tools/exclusions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAiB9E,oHAAoH;AACpH,MAAM,mBAAmB,GAAG,8FAA8F,CAAC;AAE3H,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,OAAO,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,oGAAoG;AACpG,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,IAAI,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,EAAE,CAAC,aAAa,CAC9B,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAC1H,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7F,IAAI,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,uBAAuB,IAAI,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,sBAAsB,EAAE,CAAC;YACpG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9D,CAAC;AAED,MAAM,aAAa,GAGd;IACH,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE;IAC9E,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE;IACzG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE;IACvG,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE;IAC9G;QACE,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gDAAgD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACzH;IACD,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE;IAC1G,uFAAuF;IACvF;QACE,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KAClH;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CACvD,0DAA0D,CAAC,IAAI,CAAC,OAAO,CAAC,CACzE,CAAC;KACH;CACF,CAAC;AAEF,SAAS,WAAW,CAAC,OAA8B,EAAE,IAA2B;IAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IACnD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,OAAkD;IAElD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACpE,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,OAAyB,EACzB,cAAgD;IAEhD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClF,IAAI,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1F,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3F,IAAI,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC7F,4EAA4E;IAC5E,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9G,CAAC"}