langflower 0.0.1

package/vendor/server/dist/crawl/ssrf-guard.js

@@ -0,0 +1,117 @@
+import dns from 'node:dns/promises';
+import net from 'node:net';
+const BLOCKED_HOSTNAMES = new Set([
+    'localhost',
+    'localhost.localdomain',
+    'metadata.google.internal',
+]);
+const isIpv4Private = (ip) => {
+    const parts = ip.split('.').map((part) => Number(part));
+    if (parts.length !== 4 ||
+        parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+        return false;
+    }
+    const a = parts[0] ?? 0;
+    const b = parts[1] ?? 0;
+    if (a === 10) {
+        return true;
+    }
+    if (a === 127) {
+        return true;
+    }
+    if (a === 0) {
+        return true;
+    }
+    if (a === 169 && b === 254) {
+        return true;
+    }
+    if (a === 172 && b >= 16 && b <= 31) {
+        return true;
+    }
+    if (a === 192 && b === 168) {
+        return true;
+    }
+    if (a === 100 && b >= 64 && b <= 127) {
+        return true;
+    }
+    return false;
+};
+const isIpv6Private = (ip) => {
+    const normalized = ip.toLowerCase();
+    if (normalized === '::1' || normalized === '::') {
+        return true;
+    }
+    if (normalized.startsWith('fc') || normalized.startsWith('fd')) {
+        return true;
+    }
+    if (normalized.startsWith('fe80:')) {
+        return true;
+    }
+    // IPv4-mapped IPv6 (:ffff:x.x.x.x)
+    const mapped = normalized.match(/^:ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+    if (mapped?.[1] !== undefined) {
+        return isIpv4Private(mapped[1]);
+    }
+    return false;
+};
+/** True when the address is loopback, private, link-local, or metadata. */
+export const isBlockedIpAddress = (address) => {
+    const family = net.isIP(address);
+    if (family === 4) {
+        return isIpv4Private(address);
+    }
+    if (family === 6) {
+        return isIpv6Private(address);
+    }
+    return true;
+};
+/**
+ * Reject non-http(s) URLs, blocked hostnames, and (by default) private IPs
+ * after DNS resolution. Optional `allowedHosts` is an exact hostname allowlist.
+ */
+export const assertUrlSafeForFetch = async (rawUrl, options = {}) => {
+    let parsed;
+    try {
+        parsed = new URL(rawUrl);
+    }
+    catch {
+        throw new Error(`Invalid URL: ${rawUrl}`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`Blocked URL protocol «${parsed.protocol}» (only http/https).`);
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    if (hostname.length === 0) {
+        throw new Error('URL hostname is empty.');
+    }
+    if (BLOCKED_HOSTNAMES.has(hostname) ||
+        hostname.endsWith('.localhost') ||
+        hostname.endsWith('.local')) {
+        throw new Error(`Blocked hostname «${hostname}».`);
+    }
+    const allowed = options.allowedHosts?.map((host) => host.toLowerCase());
+    if (allowed !== undefined && allowed.length > 0) {
+        if (!allowed.includes(hostname)) {
+            throw new Error(`Hostname «${hostname}» is not in harness.allowedHosts.`);
+        }
+    }
+    if (net.isIP(hostname) !== 0) {
+        if (isBlockedIpAddress(hostname)) {
+            throw new Error(`Blocked IP address «${hostname}».`);
+        }
+        return parsed;
+    }
+    if (options.skipDns === true) {
+        return parsed;
+    }
+    const records = await dns.lookup(hostname, { all: true, verbatim: true });
+    if (records.length === 0) {
+        throw new Error(`DNS lookup failed for «${hostname}».`);
+    }
+    const blocked = records.find((record) => isBlockedIpAddress(record.address));
+    if (blocked !== undefined) {
+        throw new Error(`Blocked: «${hostname}» resolves to private/link-local address ${blocked.address}.`);
+    }
+    return parsed;
+};
+//# sourceMappingURL=ssrf-guard.js.map

package/vendor/server/dist/crawl/ssrf-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.js","sourceRoot":"","sources":["../../src/crawl/ssrf-guard.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,mBAAmB,CAAC;AACpC,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACjC,WAAW;IACX,uBAAuB;IACvB,0BAA0B;CAC1B,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,EAAU,EAAW,EAAE;IAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAExD,IACC,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC,EACtE,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAExB,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,EAAU,EAAW,EAAE;IAC7C,MAAM,UAAU,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAEpC,IAAI,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,mCAAmC;IACnC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAEjE,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAe,EAAW,EAAE;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjC,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC,CAAC;AAQF;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACzC,MAAc,EACd,UAAgC,EAAE,EACnB,EAAE;IACjB,IAAI,MAAW,CAAC;IAEhB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACd,yBAAyB,MAAM,CAAC,QAAQ,sBAAsB,CAC9D,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IAED,IACC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC1B,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAExE,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACd,aAAa,QAAQ,mCAAmC,CACxD,CAAC;QACH,CAAC;IACF,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,IAAI,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,MAAM,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAE7E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACd,aAAa,QAAQ,4CAA4C,OAAO,CAAC,OAAO,GAAG,CACnF,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC,CAAC"}

package/vendor/server/dist/crawl/ssrf-guard.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ssrf-guard.test.d.ts.map

package/vendor/server/dist/crawl/ssrf-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.test.d.ts","sourceRoot":"","sources":["../../src/crawl/ssrf-guard.test.ts"],"names":[],"mappings":""}

package/vendor/server/dist/crawl/ssrf-guard.test.js

@@ -0,0 +1,46 @@
+import { describe, expect, it } from 'vitest';
+import { assertUrlSafeForFetch, isBlockedIpAddress } from './ssrf-guard.js';
+describe('isBlockedIpAddress', () => {
+    it.each([
+        '127.0.0.1',
+        '10.0.0.1',
+        '192.168.1.1',
+        '172.16.0.1',
+        '169.254.169.254',
+        '0.0.0.0',
+        '::1',
+        'fe80::1',
+        'fc00::1',
+    ])('blocks %s', (ip) => {
+        expect(isBlockedIpAddress(ip)).toBe(true);
+    });
+    it.each(['8.8.8.8', '1.1.1.1', '2001:4860:4860::8888'])('allows public %s', (ip) => {
+        expect(isBlockedIpAddress(ip)).toBe(false);
+    });
+});
+describe('assertUrlSafeForFetch', () => {
+    it('rejects non-http protocols', async () => {
+        await expect(assertUrlSafeForFetch('file:///etc/passwd', { skipDns: true })).rejects.toThrow(/protocol/i);
+    });
+    it('rejects localhost hostnames without DNS', async () => {
+        await expect(assertUrlSafeForFetch('http://localhost/secret', { skipDns: true })).rejects.toThrow(/hostname/i);
+        await expect(assertUrlSafeForFetch('http://127.0.0.1/', { skipDns: true })).rejects.toThrow(/IP/i);
+    });
+    it('enforces allowedHosts allowlist', async () => {
+        await expect(assertUrlSafeForFetch('https://evil.example/x', {
+            skipDns: true,
+            allowedHosts: ['docs.example'],
+        })).rejects.toThrow(/allowedHosts/i);
+        await expect(assertUrlSafeForFetch('https://docs.example/x', {
+            skipDns: true,
+            allowedHosts: ['docs.example'],
+        })).resolves.toMatchObject({ hostname: 'docs.example' });
+    });
+    it('allows public hostnames when DNS skipped', async () => {
+        const url = await assertUrlSafeForFetch('https://example.com/path', {
+            skipDns: true,
+        });
+        expect(url.toString()).toBe('https://example.com/path');
+    });
+});
+//# sourceMappingURL=ssrf-guard.test.js.map

package/vendor/server/dist/crawl/ssrf-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.test.js","sourceRoot":"","sources":["../../src/crawl/ssrf-guard.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE5E,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,IAAI,CAAC;QACP,WAAW;QACX,UAAU;QACV,aAAa;QACb,YAAY;QACZ,iBAAiB;QACjB,SAAS;QACT,KAAK;QACL,SAAS;QACT,SAAS;KACT,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE;QACtB,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC,CACtD,kBAAkB,EAClB,CAAC,EAAE,EAAE,EAAE;QACN,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CACD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,MAAM,CACX,qBAAqB,CAAC,oBAAoB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAC9D,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,MAAM,CACX,qBAAqB,CAAC,yBAAyB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CACnE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC/B,MAAM,MAAM,CACX,qBAAqB,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAC7D,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,MAAM,CACX,qBAAqB,CAAC,wBAAwB,EAAE;YAC/C,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,CAAC,cAAc,CAAC;SAC9B,CAAC,CACF,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEnC,MAAM,MAAM,CACX,qBAAqB,CAAC,wBAAwB,EAAE;YAC/C,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,CAAC,cAAc,CAAC;SAC9B,CAAC,CACF,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,0BAA0B,EAAE;YACnE,OAAO,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/vendor/server/dist/create-server.d.ts

@@ -0,0 +1,11 @@
+import { type TerminalExecutionProgressStatus } from '@langflower/shared/langflower.js';
+import http from 'node:http';
+export type CreateServerOptions = {
+    readonly projectDir: string;
+    readonly port?: number;
+    readonly uiDistPath?: string;
+    /** Fired once when a run settles naturally (`runner.done`). */
+    readonly onRunSettled?: (status: TerminalExecutionProgressStatus) => void;
+};
+export declare function createServer(options: CreateServerOptions): Promise<http.Server>;
+//# sourceMappingURL=create-server.d.ts.map

package/vendor/server/dist/create-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../src/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,+BAA+B,EACpC,MAAM,kCAAkC,CAAC;AAG1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAM7B,MAAM,MAAM,mBAAmB,GAAG;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,+BAA+B,KAAK,IAAI,CAAC;CAC1E,CAAC;AAEF,wBAAsB,YAAY,CACjC,OAAO,EAAE,mBAAmB,GAC1B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAqCtB"}

package/vendor/server/dist/create-server.js

@@ -0,0 +1,43 @@
+import { langflowerWsConfig, } from '@langflower/shared/langflower.js';
+import { createServer as createWsBridge } from '@langflower/websocket-bridge/create-server';
+import express from 'express';
+import http from 'node:http';
+import path from 'node:path';
+import { attachLangflowerBridge } from './bridge/attach-langflower-bridge.js';
+import { listenHttpServer } from './listen-http-server.js';
+import { createServerContext } from './server-context.js';
+export async function createServer(options) {
+    const context = await createServerContext(options.projectDir);
+    const app = express();
+    if (options.uiDistPath !== undefined) {
+        const uiRoot = path.resolve(options.uiDistPath);
+        app.use(express.static(uiRoot));
+        app.get('*', (_request, response) => {
+            response.sendFile(path.join(uiRoot, 'index.html'));
+        });
+    }
+    const toolConfig = await context.configService.read();
+    const port = options.port ?? toolConfig.port;
+    const httpServer = http.createServer(app);
+    const bridge = createWsBridge(langflowerWsConfig, { httpServer });
+    const detachBridge = attachLangflowerBridge(bridge, context, {
+        ...(options.onRunSettled !== undefined
+            ? { onRunSettled: options.onRunSettled }
+            : {}),
+    });
+    httpServer.on('close', () => {
+        detachBridge();
+        bridge.close();
+    });
+    try {
+        await listenHttpServer(httpServer, port, '127.0.0.1');
+    }
+    catch (error) {
+        detachBridge();
+        bridge.close();
+        httpServer.close();
+        throw error;
+    }
+    return httpServer;
+}
+//# sourceMappingURL=create-server.js.map

package/vendor/server/dist/create-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-server.js","sourceRoot":"","sources":["../src/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,kBAAkB,GAElB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,YAAY,IAAI,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAU1D,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,OAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IAEtB,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;YACnC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,cAAc,CAAC,kBAAkB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE;QAC5D,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;YACrC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,CAAC;IAEH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC3B,YAAY,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACJ,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,KAAK,CAAC;IACb,CAAC;IAED,OAAO,UAAU,CAAC;AACnB,CAAC"}

package/vendor/server/dist/harness/pending-permission-asks.d.ts

@@ -0,0 +1,15 @@
+import type { RunnerPermissionAskPayload, RunnerPermissionReplyPayload } from '@langflower/shared/langflower.js';
+import type { PermissionAskRequest } from '@langflower/tools/permission';
+/**
+ * Run-scoped registry for feed `permission.ask` pause/resume.
+ * `harness.invoke` awaits {@link requestPermission}; UI replies resolve it.
+ */
+export declare class PendingPermissionAsks {
+    private readonly pending;
+    list(): readonly RunnerPermissionAskPayload[];
+    requestPermission: (runId: string, nodeId: string, request: PermissionAskRequest, emitAsk: (payload: RunnerPermissionAskPayload) => void) => Promise<"allow" | "deny">;
+    reply: (payload: RunnerPermissionReplyPayload) => boolean;
+    /** Fail closed all outstanding asks (interrupt / run end). */
+    denyAll: (runId?: string) => void;
+}
+//# sourceMappingURL=pending-permission-asks.d.ts.map

package/vendor/server/dist/harness/pending-permission-asks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-permission-asks.d.ts","sourceRoot":"","sources":["../../src/harness/pending-permission-asks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,0BAA0B,EAC1B,4BAA4B,EAC5B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAOzE;;;GAGG;AACH,qBAAa,qBAAqB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IAEzD,IAAI,IAAI,SAAS,0BAA0B,EAAE;IAI7C,iBAAiB,GAChB,OAAO,MAAM,EACb,QAAQ,MAAM,EACd,SAAS,oBAAoB,EAC7B,SAAS,CAAC,OAAO,EAAE,0BAA0B,KAAK,IAAI,KACpD,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,CAe1B;IAEF,KAAK,GAAI,SAAS,4BAA4B,KAAG,OAAO,CActD;IAEF,8DAA8D;IAC9D,OAAO,GAAI,QAAQ,MAAM,KAAG,IAAI,CAS9B;CACF"}

package/vendor/server/dist/harness/pending-permission-asks.js

@@ -0,0 +1,46 @@
+/**
+ * Run-scoped registry for feed `permission.ask` pause/resume.
+ * `harness.invoke` awaits {@link requestPermission}; UI replies resolve it.
+ */
+export class PendingPermissionAsks {
+    pending = new Map();
+    list() {
+        return [...this.pending.values()].map((entry) => entry.payload);
+    }
+    requestPermission = (runId, nodeId, request, emitAsk) => {
+        const askId = crypto.randomUUID();
+        const payload = {
+            runId,
+            askId,
+            nodeId,
+            toolId: request.toolId,
+            detail: request.detail,
+            summary: request.summary,
+        };
+        return new Promise((resolve) => {
+            this.pending.set(askId, { payload, resolve });
+            emitAsk(payload);
+        });
+    };
+    reply = (payload) => {
+        const entry = this.pending.get(payload.askId);
+        if (entry === undefined) {
+            return false;
+        }
+        if (entry.payload.runId !== payload.runId) {
+            return false;
+        }
+        this.pending.delete(payload.askId);
+        entry.resolve(payload.decision === 'allow' ? 'allow' : 'deny');
+        return true;
+    };
+    /** Fail closed all outstanding asks (interrupt / run end). */
+    denyAll = (runId) => {
+        const entries = [...this.pending.entries()].filter(([, entry]) => runId === undefined || entry.payload.runId === runId);
+        for (const [askId, entry] of entries) {
+            this.pending.delete(askId);
+            entry.resolve('deny');
+        }
+    };
+}
+//# sourceMappingURL=pending-permission-asks.js.map

package/vendor/server/dist/harness/pending-permission-asks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-permission-asks.js","sourceRoot":"","sources":["../../src/harness/pending-permission-asks.ts"],"names":[],"mappings":"AAWA;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IAChB,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEzD,IAAI;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,iBAAiB,GAAG,CACnB,KAAa,EACb,MAAc,EACd,OAA6B,EAC7B,OAAsD,EAC1B,EAAE;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,OAAO,GAA+B;YAC3C,KAAK;YACL,KAAK;YACL,MAAM;YACN,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;SACxB,CAAC;QAEF,OAAO,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;YAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,OAAO,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,KAAK,GAAG,CAAC,OAAqC,EAAW,EAAE;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IAEF,8DAA8D;IAC9D,OAAO,GAAG,CAAC,KAAc,EAAQ,EAAE;QAClC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,CACnE,CAAC;QAEF,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACF,CAAC,CAAC;CACF"}

package/vendor/server/dist/harness/permission.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Thin server adapter for OpenCode-style harness permissions.
+ *
+ * Resolution logic lives in `@langflower/tools/permission`. This module wires
+ * project config into `createProjectHarness` and documents the injection point
+ * referenced by docs/CONFIG.md.
+ */
+import type { LangflowerHarnessConfig, LangflowerPermissionConfig } from '@langflower/shared/langflower.js';
+import { type Harness, type PermissionAskRequest } from '@langflower/tools/create-project-harness';
+import { resolvePermission, type PermissionDecision } from '@langflower/tools/permission';
+export { resolvePermission };
+export type CreatePermissionHarnessOptions = {
+    readonly projectRoot: string;
+    readonly permission?: LangflowerPermissionConfig;
+    readonly harness?: LangflowerHarnessConfig;
+    readonly requestPermission?: (request: PermissionAskRequest) => Promise<PermissionDecision>;
+};
+/**
+ * Build a project harness with runtime permission gating.
+ * Bash is enabled at the handler level; allow/ask/deny comes from policy.
+ */
+export declare const createPermissionAwareHarness: (options: CreatePermissionHarnessOptions) => Harness;
+//# sourceMappingURL=permission.d.ts.map

package/vendor/server/dist/harness/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../src/harness/permission.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACX,uBAAuB,EACvB,0BAA0B,EAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEN,KAAK,OAAO,EACZ,KAAK,oBAAoB,EACzB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACN,iBAAiB,EACjB,KAAK,kBAAkB,EACvB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B,MAAM,MAAM,8BAA8B,GAAG;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAC5B,OAAO,EAAE,oBAAoB,KACzB,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,8BAA8B,KACrC,OAgBA,CAAC"}

package/vendor/server/dist/harness/permission.js

@@ -0,0 +1,31 @@
+/**
+ * Thin server adapter for OpenCode-style harness permissions.
+ *
+ * Resolution logic lives in `@langflower/tools/permission`. This module wires
+ * project config into `createProjectHarness` and documents the injection point
+ * referenced by docs/CONFIG.md.
+ */
+import { createProjectHarness, } from '@langflower/tools/create-project-harness';
+import { resolvePermission, } from '@langflower/tools/permission';
+export { resolvePermission };
+/**
+ * Build a project harness with runtime permission gating.
+ * Bash is enabled at the handler level; allow/ask/deny comes from policy.
+ */
+export const createPermissionAwareHarness = (options) => createProjectHarness({
+    projectRoot: options.projectRoot,
+    bashEnabled: true,
+    ...(options.harness?.denyPaths !== undefined
+        ? { denyPaths: options.harness.denyPaths }
+        : {}),
+    ...(options.harness?.allowedRoots !== undefined
+        ? { allowedRoots: options.harness.allowedRoots }
+        : {}),
+    ...(options.permission !== undefined
+        ? { permission: options.permission }
+        : {}),
+    ...(options.requestPermission !== undefined
+        ? { requestPermission: options.requestPermission }
+        : {}),
+});
+//# sourceMappingURL=permission.js.map

package/vendor/server/dist/harness/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../../src/harness/permission.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EACN,oBAAoB,GAGpB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EACN,iBAAiB,GAEjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAW7B;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC3C,OAAuC,EAC7B,EAAE,CACZ,oBAAoB,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC,WAAW;IAChC,WAAW,EAAE,IAAI;IACjB,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS;QAC3C,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE;QAC1C,CAAC,CAAC,EAAE,CAAC;IACN,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS;QAC9C,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE;QAChD,CAAC,CAAC,EAAE,CAAC;IACN,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;QACnC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE;QACpC,CAAC,CAAC,EAAE,CAAC;IACN,GAAG,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS;QAC1C,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE;QAClD,CAAC,CAAC,EAAE,CAAC;CACN,CAAC,CAAC"}

package/vendor/server/dist/harness/permission.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=permission.test.d.ts.map

package/vendor/server/dist/harness/permission.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.test.d.ts","sourceRoot":"","sources":["../../src/harness/permission.test.ts"],"names":[],"mappings":""}

package/vendor/server/dist/harness/permission.test.js

@@ -0,0 +1,50 @@
+import { describe, expect, it } from 'vitest';
+import { createPermissionAwareHarness, resolvePermission, } from './permission.js';
+import { PendingPermissionAsks } from './pending-permission-asks.js';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { afterEach, beforeEach } from 'vitest';
+describe('server harness permission adapter', () => {
+    let projectRoot;
+    beforeEach(async () => {
+        projectRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'lf-perm-'));
+    });
+    afterEach(async () => {
+        await fs.rm(projectRoot, { recursive: true, force: true });
+    });
+    it('re-exports resolvePermission for CONFIG.md injection point', () => {
+        expect(resolvePermission(undefined, 'bash', 'rm -rf /')).toBe('deny');
+    });
+    it('write ask → allow completes; deny fails closed', async () => {
+        const pending = new PendingPermissionAsks();
+        const emitted = [];
+        let autoReply = 'deny';
+        const harness = createPermissionAwareHarness({
+            projectRoot,
+            permission: { write: { '*': 'ask' }, bash: { '*': 'ask' } },
+            requestPermission: (request) => pending.requestPermission('run-1', 'llm-1', request, (payload) => {
+                emitted.push(payload.summary);
+                pending.reply({
+                    runId: payload.runId,
+                    askId: payload.askId,
+                    decision: autoReply,
+                });
+            }),
+        });
+        const denied = await harness.invoke({
+            toolId: 'write',
+            args: { path: 'a.txt', content: 'x' },
+        });
+        expect(denied.ok).toBe(false);
+        expect(emitted).toHaveLength(1);
+        autoReply = 'allow';
+        const allowed = await harness.invoke({
+            toolId: 'write',
+            args: { path: 'a.txt', content: 'ok' },
+        });
+        expect(allowed.ok).toBe(true);
+        expect(await fs.readFile(path.join(projectRoot, 'a.txt'), 'utf8')).toBe('ok');
+    });
+});
+//# sourceMappingURL=permission.test.js.map

package/vendor/server/dist/harness/permission.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.test.js","sourceRoot":"","sources":["../../src/harness/permission.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACN,4BAA4B,EAC5B,iBAAiB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE/C,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IAClD,IAAI,WAAmB,CAAC;IAExB,UAAU,CAAC,KAAK,IAAI,EAAE;QACrB,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,OAAO,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,SAAS,GAAqB,MAAM,CAAC;QAEzC,MAAM,OAAO,GAAG,4BAA4B,CAAC;YAC5C,WAAW;YACX,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC3D,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC9B,OAAO,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;gBAChE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,KAAK,CAAC;oBACb,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,QAAQ,EAAE,SAAS;iBACnB,CAAC,CAAC;YACJ,CAAC,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;YACnC,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEhC,SAAS,GAAG,OAAO,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;YACpC,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CACtE,IAAI,CACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/vendor/server/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { createServer, type CreateServerOptions } from './create-server.js';
+export { bootstrapProject } from './bootstrap/project-bootstrap.service.js';
+export { createServerContext, type ServerContext } from './server-context.js';
+//# sourceMappingURL=index.d.ts.map

package/vendor/server/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/vendor/server/dist/index.js

@@ -0,0 +1,4 @@
+export { createServer } from './create-server.js';
+export { bootstrapProject } from './bootstrap/project-bootstrap.service.js';
+export { createServerContext } from './server-context.js';
+//# sourceMappingURL=index.js.map

package/vendor/server/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA4B,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAsB,MAAM,qBAAqB,CAAC"}

package/vendor/server/dist/kb/chunk-text.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Split text into overlapping character windows (paragraph-aware when possible).
+ */
+export declare const chunkText: (text: string, options?: {
+    readonly maxChars?: number;
+    readonly overlap?: number;
+}) => readonly string[];
+//# sourceMappingURL=chunk-text.d.ts.map

package/vendor/server/dist/kb/chunk-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-text.d.ts","sourceRoot":"","sources":["../../src/kb/chunk-text.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,eAAO,MAAM,SAAS,GACrB,MAAM,MAAM,EACZ,UAAU;IACT,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B,KACC,SAAS,MAAM,EAoDjB,CAAC"}

package/vendor/server/dist/kb/chunk-text.js

@@ -0,0 +1,52 @@
+const DEFAULT_CHUNK_CHARS = 480;
+const DEFAULT_OVERLAP = 64;
+/**
+ * Split text into overlapping character windows (paragraph-aware when possible).
+ */
+export const chunkText = (text, options) => {
+    const maxChars = options?.maxChars ?? DEFAULT_CHUNK_CHARS;
+    const overlap = options?.overlap ?? DEFAULT_OVERLAP;
+    const normalized = text.replace(/\r\n/g, '\n').trim();
+    if (normalized.length === 0) {
+        return [];
+    }
+    if (normalized.length <= maxChars) {
+        return [normalized];
+    }
+    const paragraphs = normalized
+        .split(/\n{2,}/)
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+    const windows = [];
+    let buffer = '';
+    const flushBuffer = () => {
+        if (buffer.length === 0) {
+            return;
+        }
+        let start = 0;
+        while (start < buffer.length) {
+            const end = Math.min(start + maxChars, buffer.length);
+            windows.push(buffer.slice(start, end).trim());
+            if (end >= buffer.length) {
+                break;
+            }
+            start = Math.max(0, end - overlap);
+        }
+        buffer = '';
+    };
+    for (const paragraph of paragraphs) {
+        if (buffer.length === 0) {
+            buffer = paragraph;
+            continue;
+        }
+        if (buffer.length + 2 + paragraph.length <= maxChars) {
+            buffer = `${buffer}\n\n${paragraph}`;
+            continue;
+        }
+        flushBuffer();
+        buffer = paragraph;
+    }
+    flushBuffer();
+    return windows.filter((chunk) => chunk.length > 0);
+};
+//# sourceMappingURL=chunk-text.js.map

package/vendor/server/dist/kb/chunk-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-text.js","sourceRoot":"","sources":["../../src/kb/chunk-text.ts"],"names":[],"mappings":"AAAA,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACxB,IAAY,EACZ,OAGC,EACmB,EAAE;IACtB,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,mBAAmB,CAAC;IAC1D,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAEtD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACX,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;QACnC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,UAAU;SAC3B,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,MAAM,WAAW,GAAG,GAAS,EAAE;QAC9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACR,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9C,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM;YACP,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,GAAG,EAAE,CAAC;IACb,CAAC,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,SAAS,CAAC;YACnB,SAAS;QACV,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,MAAM,OAAO,SAAS,EAAE,CAAC;YACrC,SAAS;QACV,CAAC;QACD,WAAW,EAAE,CAAC;QACd,MAAM,GAAG,SAAS,CAAC;IACpB,CAAC;IACD,WAAW,EAAE,CAAC;IAEd,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC"}

package/vendor/server/dist/kb/cosine.d.ts

@@ -0,0 +1,3 @@
+/** Cosine similarity for equal-length float vectors. */
+export declare const cosineSimilarity: (a: Float32Array, b: Float32Array) => number;
+//# sourceMappingURL=cosine.d.ts.map

package/vendor/server/dist/kb/cosine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosine.d.ts","sourceRoot":"","sources":["../../src/kb/cosine.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,eAAO,MAAM,gBAAgB,GAC5B,GAAG,YAAY,EACf,GAAG,YAAY,KACb,MAkBF,CAAC"}

package/vendor/server/dist/kb/cosine.js

@@ -0,0 +1,21 @@
+/** Cosine similarity for equal-length float vectors. */
+export const cosineSimilarity = (a, b) => {
+    if (a.length !== b.length || a.length === 0) {
+        return 0;
+    }
+    let dot = 0;
+    let normA = 0;
+    let normB = 0;
+    for (let i = 0; i < a.length; i += 1) {
+        const av = a[i];
+        const bv = b[i];
+        dot += av * bv;
+        normA += av * av;
+        normB += bv * bv;
+    }
+    if (normA <= 0 || normB <= 0) {
+        return 0;
+    }
+    return dot / (Math.sqrt(normA) * Math.sqrt(normB));
+};
+//# sourceMappingURL=cosine.js.map

package/vendor/server/dist/kb/cosine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosine.js","sourceRoot":"","sources":["../../src/kb/cosine.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC/B,CAAe,EACf,CAAe,EACN,EAAE;IACX,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACjB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACjB,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;QACf,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC;QACjB,KAAK,IAAI,EAAE,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,CAAC;IACV,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC"}

package/vendor/server/dist/kb/create-kb-context.d.ts

@@ -0,0 +1,6 @@
+import type { KbContext } from '@langflower/node-definitions';
+/**
+ * Project KB under `<project>/.langflower/kb/`.
+ */
+export declare const createKbContext: (projectDir: string) => KbContext;
+//# sourceMappingURL=create-kb-context.d.ts.map

package/vendor/server/dist/kb/create-kb-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-kb-context.d.ts","sourceRoot":"","sources":["../../src/kb/create-kb-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAgB,MAAM,8BAA8B,CAAC;AAS5E;;GAEG;AACH,eAAO,MAAM,eAAe,GAAI,YAAY,MAAM,KAAG,SA6CnD,CAAC"}