memeloop 0.0.1 → 0.1.0

package/dist/chunk-CCEFAOSH.js

@@ -0,0 +1,496 @@
+import {
+  OrchestrationError
+} from "./chunk-FWSY5HOA.js";
+
+// src/orchestration/remoteClient.ts
+var REMOTE_ORCHESTRATION_PROTOCOL = "memeloop.resource.v1";
+var REMOTE_OPERATIONS = /* @__PURE__ */ new Set([
+  "capabilities",
+  "apply",
+  "get",
+  "list",
+  "watch",
+  "delete"
+]);
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function errorData(error) {
+  if (error instanceof OrchestrationError) {
+    return {
+      code: error.code,
+      message: error.message,
+      retryable: error.retryable,
+      ...error.retryAfterMs !== void 0 ? { retryAfterMs: error.retryAfterMs } : {},
+      ...error.reason !== void 0 ? { reason: error.reason } : {},
+      ...error.details !== void 0 ? { details: error.details } : {}
+    };
+  }
+  return {
+    code: "INTERNAL",
+    message: error instanceof Error ? error.message : String(error),
+    retryable: false
+  };
+}
+function throwResponseError(response) {
+  throw new OrchestrationError(response.error);
+}
+function assertResponse(request, response) {
+  if (!isRecord(response) || response.protocol !== REMOTE_ORCHESTRATION_PROTOCOL || response.requestId !== request.requestId || typeof response.ok !== "boolean" || response.ok && !("result" in response) || !response.ok && (!isRecord(response.error) || typeof response.error.code !== "string" || typeof response.error.message !== "string" || typeof response.error.retryable !== "boolean")) {
+    throw new OrchestrationError({
+      code: "INVALID",
+      message: "remote orchestration response correlation or protocol mismatch",
+      retryable: false
+    });
+  }
+}
+var requestSequence = 0;
+function createRemoteOrchestrationClient(transport, options = {}) {
+  const createRequestId = options.createRequestId ?? (() => `resource-${Date.now().toString(36)}-${(++requestSequence).toString(36)}`);
+  function makeRequest(operation, payload) {
+    return {
+      protocol: REMOTE_ORCHESTRATION_PROTOCOL,
+      requestId: createRequestId(),
+      operation,
+      payload
+    };
+  }
+  async function request(operation, payload, signal) {
+    const envelope = makeRequest(operation, payload);
+    const response = await transport.request(envelope, { signal });
+    assertResponse(envelope, response);
+    if (!response.ok) throwResponseError(response);
+    return response.result;
+  }
+  return {
+    getCapabilities() {
+      return request("capabilities", {});
+    },
+    apply(resource, applyOptions) {
+      return request("apply", {
+        resource,
+        ...applyOptions ? { options: applyOptions } : {}
+      });
+    },
+    get(reference, getOptions) {
+      return request("get", {
+        reference,
+        ...getOptions ? { options: getOptions } : {}
+      });
+    },
+    list(query, listOptions) {
+      return request("list", {
+        query,
+        ...listOptions ? { options: listOptions } : {}
+      });
+    },
+    async *watch(query, watchOptions) {
+      const envelope = makeRequest("watch", {
+        query,
+        ...watchOptions ? {
+          options: {
+            ...watchOptions,
+            signal: void 0
+          }
+        } : {}
+      });
+      for await (const response of transport.watch(envelope, {
+        signal: watchOptions?.signal
+      })) {
+        assertResponse(envelope, response);
+        if (!response.ok) throwResponseError(response);
+        yield response.result;
+      }
+    },
+    delete(reference, deleteOptions) {
+      return request("delete", {
+        reference,
+        ...deleteOptions ? { options: deleteOptions } : {}
+      });
+    }
+  };
+}
+function createReadOnlyOrchestrationClient(client, options = {}) {
+  const allowedKinds = options.allowedResourceKinds ? new Set(options.allowedResourceKinds) : void 0;
+  function assertAllowedKind(kind) {
+    if (!allowedKinds || allowedKinds.has(kind)) return;
+    throw new OrchestrationError({
+      code: "FORBIDDEN",
+      message: `remote orchestration access to resource kind '${kind}' is forbidden`,
+      retryable: false
+    });
+  }
+  function forbidden(operation) {
+    throw new OrchestrationError({
+      code: "FORBIDDEN",
+      message: `remote orchestration operation '${operation}' is read-only`,
+      retryable: false
+    });
+  }
+  return {
+    async getCapabilities() {
+      const capabilities = await client.getCapabilities();
+      return {
+        operations: ["get", "list", "watch"],
+        resourceKinds: capabilities.resourceKinds.filter((kind) => allowedKinds ? allowedKinds.has(kind) : true),
+        interfaces: capabilities.interfaces.includes("resource") ? ["resource"] : []
+      };
+    },
+    async apply() {
+      forbidden("apply");
+    },
+    async get(reference, getOptions) {
+      assertAllowedKind(reference.kind);
+      return await client.get(reference, getOptions);
+    },
+    async list(query, listOptions) {
+      assertAllowedKind(query.kind);
+      return await client.list(query, listOptions);
+    },
+    async *watch(query, watchOptions) {
+      assertAllowedKind(query.kind);
+      yield* client.watch(query, watchOptions);
+    },
+    async delete() {
+      forbidden("delete");
+    }
+  };
+}
+function createNamespacedOrchestrationClient(client, options) {
+  const namespace = options.namespace.trim();
+  if (!namespace || namespace.length > 253) {
+    throw new TypeError("namespace must contain between 1 and 253 characters");
+  }
+  const allowedKinds = new Set(options.allowedResourceKinds);
+  const mutableKinds = new Set(options.mutableResourceKinds ?? options.allowedResourceKinds);
+  for (const kind of mutableKinds) {
+    if (!allowedKinds.has(kind)) {
+      throw new TypeError(`mutable resource kind '${kind}' must also be allowed`);
+    }
+  }
+  function assertAllowedKind(kind) {
+    if (allowedKinds.has(kind)) return;
+    throw new OrchestrationError({
+      code: "FORBIDDEN",
+      message: `remote orchestration access to resource kind '${kind}' is forbidden`,
+      retryable: false
+    });
+  }
+  function bindNamespace(metadata) {
+    if (metadata.namespace !== void 0 && metadata.namespace !== namespace) {
+      throw new OrchestrationError({
+        code: "FORBIDDEN",
+        message: `remote orchestration access outside namespace '${namespace}' is forbidden`,
+        retryable: false
+      });
+    }
+    return { ...metadata, namespace };
+  }
+  function assertMutableKind(kind) {
+    assertAllowedKind(kind);
+    if (mutableKinds.has(kind)) return;
+    throw new OrchestrationError({
+      code: "FORBIDDEN",
+      message: `remote orchestration mutation of resource kind '${kind}' is forbidden`,
+      retryable: false
+    });
+  }
+  return {
+    async getCapabilities() {
+      const capabilities = await client.getCapabilities();
+      const resourceKinds = capabilities.resourceKinds.filter((kind) => allowedKinds.has(kind));
+      const resourceOperations = Object.fromEntries(
+        resourceKinds.map((kind) => {
+          const sourceOperations = capabilities.resourceOperations?.[kind] ?? capabilities.operations;
+          return [
+            kind,
+            sourceOperations.filter((operation) => mutableKinds.has(kind) || operation !== "apply" && operation !== "delete")
+          ];
+        })
+      );
+      return {
+        operations: capabilities.operations,
+        resourceKinds,
+        resourceOperations,
+        interfaces: capabilities.interfaces.includes("resource") ? ["resource"] : []
+      };
+    },
+    async apply(resource, applyOptions) {
+      assertMutableKind(resource.kind);
+      return await client.apply(
+        {
+          ...resource,
+          metadata: bindNamespace(resource.metadata)
+        },
+        applyOptions
+      );
+    },
+    async get(reference, getOptions) {
+      assertAllowedKind(reference.kind);
+      return await client.get(bindNamespace(reference), getOptions);
+    },
+    async list(query, listOptions) {
+      assertAllowedKind(query.kind);
+      return await client.list(bindNamespace(query), listOptions);
+    },
+    watch(query, watchOptions) {
+      assertAllowedKind(query.kind);
+      return client.watch(bindNamespace(query), watchOptions);
+    },
+    async delete(reference, deleteOptions) {
+      assertMutableKind(reference.kind);
+      return await client.delete(bindNamespace(reference), deleteOptions);
+    }
+  };
+}
+function requirePayload(payload, key) {
+  if (!(key in payload)) {
+    throw new OrchestrationError({
+      code: "INVALID",
+      message: `remote orchestration request is missing payload.${key}`,
+      retryable: false
+    });
+  }
+  return payload[key];
+}
+function success(request, result) {
+  return {
+    protocol: REMOTE_ORCHESTRATION_PROTOCOL,
+    requestId: request.requestId,
+    ok: true,
+    result
+  };
+}
+function failure(request, error) {
+  const requestRecord = isRecord(request) ? request : void 0;
+  return {
+    protocol: REMOTE_ORCHESTRATION_PROTOCOL,
+    requestId: typeof requestRecord?.requestId === "string" ? requestRecord.requestId : "invalid",
+    ok: false,
+    error: errorData(error)
+  };
+}
+function createRemoteOrchestrationHandler(client) {
+  function validate(request) {
+    if (!isRecord(request) || request.protocol !== REMOTE_ORCHESTRATION_PROTOCOL || typeof request.requestId !== "string" || !request.requestId || request.requestId.length > 256 || !REMOTE_OPERATIONS.has(request.operation) || !isRecord(request.payload)) {
+      throw new OrchestrationError({
+        code: "INVALID",
+        message: "invalid remote orchestration request envelope",
+        retryable: false
+      });
+    }
+  }
+  return {
+    async request(request) {
+      try {
+        validate(request);
+        const payload = request.payload;
+        switch (request.operation) {
+          case "capabilities":
+            return success(request, await client.getCapabilities());
+          case "apply":
+            return success(
+              request,
+              await client.apply(
+                requirePayload(payload, "resource"),
+                payload.options
+              )
+            );
+          case "get":
+            return success(
+              request,
+              await client.get(
+                requirePayload(payload, "reference"),
+                payload.options
+              )
+            );
+          case "list":
+            return success(
+              request,
+              await client.list(
+                requirePayload(payload, "query"),
+                payload.options
+              )
+            );
+          case "delete":
+            return success(
+              request,
+              await client.delete(
+                requirePayload(payload, "reference"),
+                payload.options
+              )
+            );
+          case "watch":
+            throw new OrchestrationError({
+              code: "INVALID",
+              message: "watch requests require the streaming protocol method",
+              retryable: false
+            });
+          default:
+            throw new OrchestrationError({
+              code: "UNSUPPORTED",
+              message: `unsupported remote orchestration operation '${String(request.operation)}'`,
+              retryable: false
+            });
+        }
+      } catch (error) {
+        return failure(request, error);
+      }
+    },
+    async *watch(request, options = {}) {
+      try {
+        validate(request);
+        if (request.operation !== "watch") {
+          throw new OrchestrationError({
+            code: "INVALID",
+            message: "streaming protocol accepts only watch operations",
+            retryable: false
+          });
+        }
+        const watchOptions = request.payload.options;
+        for await (const event of client.watch(
+          requirePayload(request.payload, "query"),
+          {
+            ...watchOptions,
+            signal: options.signal
+          }
+        )) {
+          yield success(request, event);
+        }
+      } catch (error) {
+        yield failure(request, error);
+      }
+    }
+  };
+}
+function createFetchOrchestrationTransport(options) {
+  const fetch_ = options.fetch ?? globalThis.fetch;
+  const maxResponseBytes = options.maxResponseBytes ?? 1024 * 1024;
+  const maxWatchLineBytes = options.maxWatchLineBytes ?? 1024 * 1024;
+  function assertWatchLineSize(line) {
+    if (new TextEncoder().encode(line).byteLength > maxWatchLineBytes) {
+      throw new OrchestrationError({
+        code: "EXHAUSTED",
+        message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,
+        retryable: false
+      });
+    }
+  }
+  async function headers(accept) {
+    const additional = typeof options.headers === "function" ? await options.headers() : options.headers ?? {};
+    return {
+      Accept: accept,
+      "Content-Type": "application/json",
+      ...additional
+    };
+  }
+  async function post(request, accept, signal) {
+    const response = await fetch_(options.endpoint, {
+      method: "POST",
+      headers: await headers(accept),
+      body: JSON.stringify(request),
+      signal,
+      ...options.credentials ? { credentials: options.credentials } : {}
+    });
+    if (!response.ok) {
+      throw new OrchestrationError({
+        code: response.status === 401 || response.status === 403 ? "FORBIDDEN" : "UNAVAILABLE",
+        message: `remote orchestration endpoint returned HTTP ${response.status}`,
+        retryable: response.status >= 500
+      });
+    }
+    return response;
+  }
+  async function readBoundedText(response, limit) {
+    if (!response.body) return "";
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let size = 0;
+    let text = "";
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > limit) {
+          await reader.cancel();
+          throw new OrchestrationError({
+            code: "EXHAUSTED",
+            message: `remote orchestration response exceeds ${limit} bytes`,
+            retryable: false
+          });
+        }
+        text += decoder.decode(value, { stream: true });
+      }
+      return text + decoder.decode();
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  return {
+    async request(request, transportOptions = {}) {
+      const response = await post(request, "application/json", transportOptions.signal);
+      const text = await readBoundedText(response, maxResponseBytes);
+      return JSON.parse(text);
+    },
+    async *watch(request, transportOptions = {}) {
+      const response = await post(request, "application/x-ndjson", transportOptions.signal);
+      if (!response.body) {
+        throw new OrchestrationError({
+          code: "UNAVAILABLE",
+          message: "remote orchestration watch response has no body",
+          retryable: true
+        });
+      }
+      const reader = response.body.getReader();
+      const decoder = new TextDecoder();
+      let pending = "";
+      let streamCompleted = false;
+      try {
+        for (; ; ) {
+          const { done, value } = await reader.read();
+          if (done) {
+            streamCompleted = true;
+            break;
+          }
+          pending += decoder.decode(value, { stream: true });
+          let newline = pending.indexOf("\n");
+          while (newline >= 0) {
+            const line = pending.slice(0, newline).trim();
+            pending = pending.slice(newline + 1);
+            assertWatchLineSize(line);
+            if (line) yield JSON.parse(line);
+            newline = pending.indexOf("\n");
+          }
+          if (pending.length > maxWatchLineBytes) {
+            throw new OrchestrationError({
+              code: "EXHAUSTED",
+              message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,
+              retryable: false
+            });
+          }
+        }
+        pending += decoder.decode();
+        if (pending.trim()) {
+          assertWatchLineSize(pending.trim());
+          yield JSON.parse(pending);
+        }
+      } finally {
+        if (!streamCompleted) {
+          await reader.cancel().catch(() => void 0);
+        }
+        reader.releaseLock();
+      }
+    }
+  };
+}
+
+export {
+  REMOTE_ORCHESTRATION_PROTOCOL,
+  createRemoteOrchestrationClient,
+  createReadOnlyOrchestrationClient,
+  createNamespacedOrchestrationClient,
+  createRemoteOrchestrationHandler,
+  createFetchOrchestrationTransport
+};
+//# sourceMappingURL=chunk-CCEFAOSH.js.map

package/dist/chunk-CCEFAOSH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/orchestration/remoteClient.ts"],"sourcesContent":["import type {\n  AgentOrchestrationCapabilities,\n  AgentOrchestrationClient,\n  OrchestrationApplyOptions,\n  OrchestrationDeleteOptions,\n  OrchestrationDeleteResult,\n  OrchestrationGetOptions,\n  OrchestrationListOptions,\n  OrchestrationResource,\n  OrchestrationResourceList,\n  OrchestrationResourceManifest,\n  OrchestrationResourceQuery,\n  OrchestrationResourceReference,\n  OrchestrationResourceStatus,\n  OrchestrationWatchEvent,\n  OrchestrationWatchOptions,\n} from './client.js';\nimport { OrchestrationError } from './errors.js';\nimport type { OrchestrationErrorData } from './errors.js';\n\nexport const REMOTE_ORCHESTRATION_PROTOCOL = 'memeloop.resource.v1' as const;\nexport type RemoteOrchestrationOperation =\n  | 'capabilities'\n  | 'apply'\n  | 'get'\n  | 'list'\n  | 'watch'\n  | 'delete';\n\nexport interface RemoteOrchestrationRequest {\n  protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n  requestId: string;\n  operation: RemoteOrchestrationOperation;\n  payload: Record<string, unknown>;\n}\n\nexport type RemoteOrchestrationResponse =\n  | {\n    protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n    requestId: string;\n    ok: true;\n    result: unknown;\n  }\n  | {\n    protocol: typeof REMOTE_ORCHESTRATION_PROTOCOL;\n    requestId: string;\n    ok: false;\n    error: OrchestrationErrorData;\n  };\n\nexport interface RemoteOrchestrationTransportOptions {\n  signal?: AbortSignal;\n}\n\n/**\n * Portable host boundary. Browser, Electron renderer, React Native, and Tauri\n * WebView clients implement this interface; trusted hosts bind identity and\n * policy behind the server-side AgentOrchestrationClient.\n */\nexport interface RemoteOrchestrationTransport {\n  request(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): Promise<RemoteOrchestrationResponse>;\n  watch(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): AsyncIterable<RemoteOrchestrationResponse>;\n}\n\nexport interface RemoteOrchestrationClientOptions {\n  createRequestId?: () => string;\n}\n\nexport interface ReadOnlyOrchestrationClientOptions {\n  /** Resource kinds visible to the remote client. Omit to retain every kind exposed by the source client. */\n  allowedResourceKinds?: readonly string[];\n}\n\nexport interface NamespacedOrchestrationClientOptions {\n  /** Host-bound namespace. Callers may omit it, but cannot select another namespace. */\n  namespace: string;\n  /** Resource kinds the caller may access. An empty list denies every resource kind. */\n  allowedResourceKinds: readonly string[];\n  /**\n   * Resource kinds the caller may apply or delete. Defaults to every allowed\n   * kind for compatibility; hosts should narrow this when status resources are\n   * controller-owned.\n   */\n  mutableResourceKinds?: readonly string[];\n}\n\nconst REMOTE_OPERATIONS = new Set<RemoteOrchestrationOperation>([\n  'capabilities',\n  'apply',\n  'get',\n  'list',\n  'watch',\n  'delete',\n]);\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction errorData(error: unknown): OrchestrationErrorData {\n  if (error instanceof OrchestrationError) {\n    return {\n      code: error.code,\n      message: error.message,\n      retryable: error.retryable,\n      ...(error.retryAfterMs !== undefined ? { retryAfterMs: error.retryAfterMs } : {}),\n      ...(error.reason !== undefined ? { reason: error.reason } : {}),\n      ...(error.details !== undefined ? { details: error.details } : {}),\n    };\n  }\n  return {\n    code: 'INTERNAL',\n    message: error instanceof Error ? error.message : String(error),\n    retryable: false,\n  };\n}\n\nfunction throwResponseError(response: Extract<RemoteOrchestrationResponse, { ok: false }>): never {\n  throw new OrchestrationError(response.error);\n}\n\nfunction assertResponse(\n  request: RemoteOrchestrationRequest,\n  response: RemoteOrchestrationResponse,\n): void {\n  if (\n    !isRecord(response) ||\n    response.protocol !== REMOTE_ORCHESTRATION_PROTOCOL ||\n    response.requestId !== request.requestId ||\n    typeof response.ok !== 'boolean' ||\n    (response.ok && !('result' in response)) ||\n    (!response.ok &&\n      (!isRecord(response.error) ||\n        typeof response.error.code !== 'string' ||\n        typeof response.error.message !== 'string' ||\n        typeof response.error.retryable !== 'boolean'))\n  ) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: 'remote orchestration response correlation or protocol mismatch',\n      retryable: false,\n    });\n  }\n}\n\nlet requestSequence = 0;\n\n/** Build the policy-scoped Agent facade over a browser-safe remote transport. */\nexport function createRemoteOrchestrationClient(\n  transport: RemoteOrchestrationTransport,\n  options: RemoteOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const createRequestId = options.createRequestId ??\n    (() => `resource-${Date.now().toString(36)}-${(++requestSequence).toString(36)}`);\n\n  function makeRequest(\n    operation: RemoteOrchestrationOperation,\n    payload: Record<string, unknown>,\n  ): RemoteOrchestrationRequest {\n    return {\n      protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n      requestId: createRequestId(),\n      operation,\n      payload,\n    };\n  }\n\n  async function request<T>(\n    operation: RemoteOrchestrationOperation,\n    payload: Record<string, unknown>,\n    signal?: AbortSignal,\n  ): Promise<T> {\n    const envelope = makeRequest(operation, payload);\n    const response = await transport.request(envelope, { signal });\n    assertResponse(envelope, response);\n    if (!response.ok) throwResponseError(response);\n    return response.result as T;\n  }\n\n  return {\n    getCapabilities() {\n      return request<AgentOrchestrationCapabilities>('capabilities', {});\n    },\n    apply<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      resource: OrchestrationResourceManifest<TSpec>,\n      applyOptions?: OrchestrationApplyOptions,\n    ) {\n      return request<OrchestrationResource<TSpec, TStatus>>('apply', {\n        resource,\n        ...(applyOptions ? { options: applyOptions } : {}),\n      });\n    },\n    get<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      reference: OrchestrationResourceReference,\n      getOptions?: OrchestrationGetOptions,\n    ) {\n      return request<OrchestrationResource<TSpec, TStatus> | null>('get', {\n        reference,\n        ...(getOptions ? { options: getOptions } : {}),\n      });\n    },\n    list<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      listOptions?: OrchestrationListOptions,\n    ) {\n      return request<OrchestrationResourceList<TSpec, TStatus>>('list', {\n        query,\n        ...(listOptions ? { options: listOptions } : {}),\n      });\n    },\n    async *watch<TSpec = Record<string, unknown>, TStatus = OrchestrationResourceStatus>(\n      query: OrchestrationResourceQuery,\n      watchOptions?: OrchestrationWatchOptions,\n    ): AsyncIterable<OrchestrationWatchEvent<TSpec, TStatus>> {\n      const envelope = makeRequest('watch', {\n        query,\n        ...(watchOptions\n          ? {\n            options: {\n              ...watchOptions,\n              signal: undefined,\n            },\n          }\n          : {}),\n      });\n      for await (\n        const response of transport.watch(envelope, {\n          signal: watchOptions?.signal,\n        })\n      ) {\n        assertResponse(envelope, response);\n        if (!response.ok) throwResponseError(response);\n        yield response.result as OrchestrationWatchEvent<TSpec, TStatus>;\n      }\n    },\n    delete(reference: OrchestrationResourceReference, deleteOptions?: OrchestrationDeleteOptions) {\n      return request<OrchestrationDeleteResult>('delete', {\n        reference,\n        ...(deleteOptions ? { options: deleteOptions } : {}),\n      });\n    },\n  };\n}\n\n/**\n * Bind a remote/mobile caller to a read-only view of an existing policy-scoped\n * client. This is an enforcement boundary, not only capability advertising:\n * mutations and out-of-scope kinds fail before reaching the source client.\n */\nexport function createReadOnlyOrchestrationClient(\n  client: AgentOrchestrationClient,\n  options: ReadOnlyOrchestrationClientOptions = {},\n): AgentOrchestrationClient {\n  const allowedKinds = options.allowedResourceKinds\n    ? new Set(options.allowedResourceKinds)\n    : undefined;\n\n  function assertAllowedKind(kind: string): void {\n    if (!allowedKinds || allowedKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration access to resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  function forbidden(operation: 'apply' | 'delete'): never {\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration operation '${operation}' is read-only`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async getCapabilities() {\n      const capabilities = await client.getCapabilities();\n      return {\n        operations: ['get', 'list', 'watch'],\n        resourceKinds: capabilities.resourceKinds.filter((kind) => allowedKinds ? allowedKinds.has(kind) : true),\n        interfaces: capabilities.interfaces.includes('resource') ? ['resource'] : [],\n      };\n    },\n    async apply() {\n      forbidden('apply');\n    },\n    async get(reference, getOptions) {\n      assertAllowedKind(reference.kind);\n      return await client.get(reference, getOptions);\n    },\n    async list(query, listOptions) {\n      assertAllowedKind(query.kind);\n      return await client.list(query, listOptions);\n    },\n    async *watch(query, watchOptions) {\n      assertAllowedKind(query.kind);\n      yield* client.watch(query, watchOptions);\n    },\n    async delete() {\n      forbidden('delete');\n    },\n  };\n}\n\n/**\n * Bind a mutable remote caller to one host-selected namespace and an explicit\n * resource-kind allowlist. The wrapper is an authorization boundary: it\n * rejects cross-namespace references before they reach the source client and\n * fills an omitted namespace with the host-bound value.\n */\nexport function createNamespacedOrchestrationClient(\n  client: AgentOrchestrationClient,\n  options: NamespacedOrchestrationClientOptions,\n): AgentOrchestrationClient {\n  const namespace = options.namespace.trim();\n  if (!namespace || namespace.length > 253) {\n    throw new TypeError('namespace must contain between 1 and 253 characters');\n  }\n  const allowedKinds = new Set(options.allowedResourceKinds);\n  const mutableKinds = new Set(options.mutableResourceKinds ?? options.allowedResourceKinds);\n  for (const kind of mutableKinds) {\n    if (!allowedKinds.has(kind)) {\n      throw new TypeError(`mutable resource kind '${kind}' must also be allowed`);\n    }\n  }\n\n  function assertAllowedKind(kind: string): void {\n    if (allowedKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration access to resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  function bindNamespace<T extends { namespace?: string }>(metadata: T): T & { namespace: string } {\n    if (metadata.namespace !== undefined && metadata.namespace !== namespace) {\n      throw new OrchestrationError({\n        code: 'FORBIDDEN',\n        message: `remote orchestration access outside namespace '${namespace}' is forbidden`,\n        retryable: false,\n      });\n    }\n    return { ...metadata, namespace };\n  }\n\n  function assertMutableKind(kind: string): void {\n    assertAllowedKind(kind);\n    if (mutableKinds.has(kind)) return;\n    throw new OrchestrationError({\n      code: 'FORBIDDEN',\n      message: `remote orchestration mutation of resource kind '${kind}' is forbidden`,\n      retryable: false,\n    });\n  }\n\n  return {\n    async getCapabilities() {\n      const capabilities = await client.getCapabilities();\n      const resourceKinds = capabilities.resourceKinds.filter((kind) => allowedKinds.has(kind));\n      const resourceOperations = Object.fromEntries(\n        resourceKinds.map((kind) => {\n          const sourceOperations = capabilities.resourceOperations?.[kind] ??\n            capabilities.operations;\n          return [\n            kind,\n            sourceOperations.filter((operation) => mutableKinds.has(kind) || (operation !== 'apply' && operation !== 'delete')),\n          ];\n        }),\n      );\n      return {\n        operations: capabilities.operations,\n        resourceKinds,\n        resourceOperations,\n        interfaces: capabilities.interfaces.includes('resource') ? ['resource'] : [],\n      };\n    },\n    async apply(resource, applyOptions) {\n      assertMutableKind(resource.kind);\n      return await client.apply(\n        {\n          ...resource,\n          metadata: bindNamespace(resource.metadata),\n        },\n        applyOptions,\n      );\n    },\n    async get(reference, getOptions) {\n      assertAllowedKind(reference.kind);\n      return await client.get(bindNamespace(reference), getOptions);\n    },\n    async list(query, listOptions) {\n      assertAllowedKind(query.kind);\n      return await client.list(bindNamespace(query), listOptions);\n    },\n    watch(query, watchOptions) {\n      assertAllowedKind(query.kind);\n      return client.watch(bindNamespace(query), watchOptions);\n    },\n    async delete(reference, deleteOptions) {\n      assertMutableKind(reference.kind);\n      return await client.delete(bindNamespace(reference), deleteOptions);\n    },\n  };\n}\n\nfunction requirePayload(payload: Record<string, unknown>, key: string): unknown {\n  if (!(key in payload)) {\n    throw new OrchestrationError({\n      code: 'INVALID',\n      message: `remote orchestration request is missing payload.${key}`,\n      retryable: false,\n    });\n  }\n  return payload[key];\n}\n\nfunction success(\n  request: RemoteOrchestrationRequest,\n  result: unknown,\n): RemoteOrchestrationResponse {\n  return {\n    protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n    requestId: request.requestId,\n    ok: true,\n    result,\n  };\n}\n\nfunction failure(request: unknown, error: unknown): RemoteOrchestrationResponse {\n  const requestRecord = isRecord(request) ? request : undefined;\n  return {\n    protocol: REMOTE_ORCHESTRATION_PROTOCOL,\n    requestId: typeof requestRecord?.requestId === 'string' ? requestRecord.requestId : 'invalid',\n    ok: false,\n    error: errorData(error),\n  };\n}\n\n/**\n * Trusted-side protocol adapter. The injected client has already bound actor,\n * admission, quotas, and resource scope; wire callers cannot select an actor.\n */\nexport function createRemoteOrchestrationHandler(client: AgentOrchestrationClient): {\n  request(request: RemoteOrchestrationRequest): Promise<RemoteOrchestrationResponse>;\n  watch(\n    request: RemoteOrchestrationRequest,\n    options?: RemoteOrchestrationTransportOptions,\n  ): AsyncIterable<RemoteOrchestrationResponse>;\n} {\n  function validate(request: RemoteOrchestrationRequest): void {\n    if (\n      !isRecord(request) ||\n      request.protocol !== REMOTE_ORCHESTRATION_PROTOCOL ||\n      typeof request.requestId !== 'string' ||\n      !request.requestId ||\n      request.requestId.length > 256 ||\n      !REMOTE_OPERATIONS.has(request.operation) ||\n      !isRecord(request.payload)\n    ) {\n      throw new OrchestrationError({\n        code: 'INVALID',\n        message: 'invalid remote orchestration request envelope',\n        retryable: false,\n      });\n    }\n  }\n\n  return {\n    async request(request) {\n      try {\n        validate(request);\n        const payload = request.payload;\n        switch (request.operation) {\n          case 'capabilities':\n            return success(request, await client.getCapabilities());\n          case 'apply':\n            return success(\n              request,\n              await client.apply(\n                requirePayload(payload, 'resource') as OrchestrationResourceManifest,\n                payload.options as OrchestrationApplyOptions | undefined,\n              ),\n            );\n          case 'get':\n            return success(\n              request,\n              await client.get(\n                requirePayload(payload, 'reference') as OrchestrationResourceReference,\n                payload.options as OrchestrationGetOptions | undefined,\n              ),\n            );\n          case 'list':\n            return success(\n              request,\n              await client.list(\n                requirePayload(payload, 'query') as OrchestrationResourceQuery,\n                payload.options as OrchestrationListOptions | undefined,\n              ),\n            );\n          case 'delete':\n            return success(\n              request,\n              await client.delete(\n                requirePayload(payload, 'reference') as OrchestrationResourceReference,\n                payload.options as OrchestrationDeleteOptions | undefined,\n              ),\n            );\n          case 'watch':\n            throw new OrchestrationError({\n              code: 'INVALID',\n              message: 'watch requests require the streaming protocol method',\n              retryable: false,\n            });\n          default:\n            throw new OrchestrationError({\n              code: 'UNSUPPORTED',\n              message: `unsupported remote orchestration operation '${String(request.operation)}'`,\n              retryable: false,\n            });\n        }\n      } catch (error) {\n        return failure(request, error);\n      }\n    },\n    async *watch(request, options = {}) {\n      try {\n        validate(request);\n        if (request.operation !== 'watch') {\n          throw new OrchestrationError({\n            code: 'INVALID',\n            message: 'streaming protocol accepts only watch operations',\n            retryable: false,\n          });\n        }\n        const watchOptions = request.payload.options as OrchestrationWatchOptions | undefined;\n        for await (\n          const event of client.watch(\n            requirePayload(request.payload, 'query') as OrchestrationResourceQuery,\n            {\n              ...watchOptions,\n              signal: options.signal,\n            },\n          )\n        ) {\n          yield success(request, event);\n        }\n      } catch (error) {\n        yield failure(request, error);\n      }\n    },\n  };\n}\n\nexport interface FetchOrchestrationTransportOptions {\n  endpoint: string;\n  fetch?: typeof globalThis.fetch;\n  headers?: Record<string, string> | (() => Promise<Record<string, string>>);\n  credentials?: RequestCredentials;\n  maxResponseBytes?: number;\n  maxWatchLineBytes?: number;\n}\n\n/** Browser/Tauri/React-Native fetch transport with bounded NDJSON watch. */\nexport function createFetchOrchestrationTransport(\n  options: FetchOrchestrationTransportOptions,\n): RemoteOrchestrationTransport {\n  const fetch_ = options.fetch ?? globalThis.fetch;\n  const maxResponseBytes = options.maxResponseBytes ?? 1024 * 1024;\n  const maxWatchLineBytes = options.maxWatchLineBytes ?? 1024 * 1024;\n\n  function assertWatchLineSize(line: string): void {\n    if (new TextEncoder().encode(line).byteLength > maxWatchLineBytes) {\n      throw new OrchestrationError({\n        code: 'EXHAUSTED',\n        message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,\n        retryable: false,\n      });\n    }\n  }\n\n  async function headers(accept: string): Promise<Record<string, string>> {\n    const additional = typeof options.headers === 'function' ? await options.headers() : (options.headers ?? {});\n    return {\n      Accept: accept,\n      'Content-Type': 'application/json',\n      ...additional,\n    };\n  }\n\n  async function post(\n    request: RemoteOrchestrationRequest,\n    accept: string,\n    signal?: AbortSignal,\n  ): Promise<Response> {\n    const response = await fetch_(options.endpoint, {\n      method: 'POST',\n      headers: await headers(accept),\n      body: JSON.stringify(request),\n      signal,\n      ...(options.credentials ? { credentials: options.credentials } : {}),\n    });\n    if (!response.ok) {\n      throw new OrchestrationError({\n        code: response.status === 401 || response.status === 403 ? 'FORBIDDEN' : 'UNAVAILABLE',\n        message: `remote orchestration endpoint returned HTTP ${response.status}`,\n        retryable: response.status >= 500,\n      });\n    }\n    return response;\n  }\n\n  async function readBoundedText(response: Response, limit: number): Promise<string> {\n    if (!response.body) return '';\n    const reader = response.body.getReader();\n    const decoder = new TextDecoder();\n    let size = 0;\n    let text = '';\n    try {\n      for (;;) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        size += value.byteLength;\n        if (size > limit) {\n          await reader.cancel();\n          throw new OrchestrationError({\n            code: 'EXHAUSTED',\n            message: `remote orchestration response exceeds ${limit} bytes`,\n            retryable: false,\n          });\n        }\n        text += decoder.decode(value, { stream: true });\n      }\n      return text + decoder.decode();\n    } finally {\n      reader.releaseLock();\n    }\n  }\n\n  return {\n    async request(request, transportOptions = {}) {\n      const response = await post(request, 'application/json', transportOptions.signal);\n      const text = await readBoundedText(response, maxResponseBytes);\n      return JSON.parse(text) as RemoteOrchestrationResponse;\n    },\n    async *watch(request, transportOptions = {}) {\n      const response = await post(request, 'application/x-ndjson', transportOptions.signal);\n      if (!response.body) {\n        throw new OrchestrationError({\n          code: 'UNAVAILABLE',\n          message: 'remote orchestration watch response has no body',\n          retryable: true,\n        });\n      }\n      const reader = response.body.getReader();\n      const decoder = new TextDecoder();\n      let pending = '';\n      let streamCompleted = false;\n      try {\n        for (;;) {\n          const { done, value } = await reader.read();\n          if (done) {\n            streamCompleted = true;\n            break;\n          }\n          pending += decoder.decode(value, { stream: true });\n          let newline = pending.indexOf('\\n');\n          while (newline >= 0) {\n            const line = pending.slice(0, newline).trim();\n            pending = pending.slice(newline + 1);\n            assertWatchLineSize(line);\n            if (line) yield JSON.parse(line) as RemoteOrchestrationResponse;\n            newline = pending.indexOf('\\n');\n          }\n          // UTF-8 is never smaller than the JS code-unit count. This cheap\n          // guard avoids repeatedly re-encoding an attacker-controlled partial\n          // line; the exact byte check runs once when the line is complete.\n          if (pending.length > maxWatchLineBytes) {\n            throw new OrchestrationError({\n              code: 'EXHAUSTED',\n              message: `remote orchestration watch line exceeds ${maxWatchLineBytes} bytes`,\n              retryable: false,\n            });\n          }\n        }\n        pending += decoder.decode();\n        if (pending.trim()) {\n          assertWatchLineSize(pending.trim());\n          yield JSON.parse(pending) as RemoteOrchestrationResponse;\n        }\n      } finally {\n        if (!streamCompleted) {\n          await reader.cancel().catch(() => undefined);\n        }\n        reader.releaseLock();\n      }\n    },\n  };\n}\n"],"mappings":";;;;;AAoBO,IAAM,gCAAgC;AAwE7C,IAAM,oBAAoB,oBAAI,IAAkC;AAAA,EAC9D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,UAAU,OAAwC;AACzD,MAAI,iBAAiB,oBAAoB;AACvC,WAAO;AAAA,MACL,MAAM,MAAM;AAAA,MACZ,SAAS,MAAM;AAAA,MACf,WAAW,MAAM;AAAA,MACjB,GAAI,MAAM,iBAAiB,SAAY,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,MAC/E,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC7D,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,WAAW;AAAA,EACb;AACF;AAEA,SAAS,mBAAmB,UAAsE;AAChG,QAAM,IAAI,mBAAmB,SAAS,KAAK;AAC7C;AAEA,SAAS,eACP,SACA,UACM;AACN,MACE,CAAC,SAAS,QAAQ,KAClB,SAAS,aAAa,iCACtB,SAAS,cAAc,QAAQ,aAC/B,OAAO,SAAS,OAAO,aACtB,SAAS,MAAM,EAAE,YAAY,aAC7B,CAAC,SAAS,OACR,CAAC,SAAS,SAAS,KAAK,KACvB,OAAO,SAAS,MAAM,SAAS,YAC/B,OAAO,SAAS,MAAM,YAAY,YAClC,OAAO,SAAS,MAAM,cAAc,YACxC;AACA,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACF;AAEA,IAAI,kBAAkB;AAGf,SAAS,gCACd,WACA,UAA4C,CAAC,GACnB;AAC1B,QAAM,kBAAkB,QAAQ,oBAC7B,MAAM,YAAY,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,iBAAiB,SAAS,EAAE,CAAC;AAEhF,WAAS,YACP,WACA,SAC4B;AAC5B,WAAO;AAAA,MACL,UAAU;AAAA,MACV,WAAW,gBAAgB;AAAA,MAC3B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,QACb,WACA,SACA,QACY;AACZ,UAAM,WAAW,YAAY,WAAW,OAAO;AAC/C,UAAM,WAAW,MAAM,UAAU,QAAQ,UAAU,EAAE,OAAO,CAAC;AAC7D,mBAAe,UAAU,QAAQ;AACjC,QAAI,CAAC,SAAS,GAAI,oBAAmB,QAAQ;AAC7C,WAAO,SAAS;AAAA,EAClB;AAEA,SAAO;AAAA,IACL,kBAAkB;AAChB,aAAO,QAAwC,gBAAgB,CAAC,CAAC;AAAA,IACnE;AAAA,IACA,MACE,UACA,cACA;AACA,aAAO,QAA+C,SAAS;AAAA,QAC7D;AAAA,QACA,GAAI,eAAe,EAAE,SAAS,aAAa,IAAI,CAAC;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,IACA,IACE,WACA,YACA;AACA,aAAO,QAAsD,OAAO;AAAA,QAClE;AAAA,QACA,GAAI,aAAa,EAAE,SAAS,WAAW,IAAI,CAAC;AAAA,MAC9C,CAAC;AAAA,IACH;AAAA,IACA,KACE,OACA,aACA;AACA,aAAO,QAAmD,QAAQ;AAAA,QAChE;AAAA,QACA,GAAI,cAAc,EAAE,SAAS,YAAY,IAAI,CAAC;AAAA,MAChD,CAAC;AAAA,IACH;AAAA,IACA,OAAO,MACL,OACA,cACwD;AACxD,YAAM,WAAW,YAAY,SAAS;AAAA,QACpC;AAAA,QACA,GAAI,eACA;AAAA,UACA,SAAS;AAAA,YACP,GAAG;AAAA,YACH,QAAQ;AAAA,UACV;AAAA,QACF,IACE,CAAC;AAAA,MACP,CAAC;AACD,uBACQ,YAAY,UAAU,MAAM,UAAU;AAAA,QAC1C,QAAQ,cAAc;AAAA,MACxB,CAAC,GACD;AACA,uBAAe,UAAU,QAAQ;AACjC,YAAI,CAAC,SAAS,GAAI,oBAAmB,QAAQ;AAC7C,cAAM,SAAS;AAAA,MACjB;AAAA,IACF;AAAA,IACA,OAAO,WAA2C,eAA4C;AAC5F,aAAO,QAAmC,UAAU;AAAA,QAClD;AAAA,QACA,GAAI,gBAAgB,EAAE,SAAS,cAAc,IAAI,CAAC;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAOO,SAAS,kCACd,QACA,UAA8C,CAAC,GACrB;AAC1B,QAAM,eAAe,QAAQ,uBACzB,IAAI,IAAI,QAAQ,oBAAoB,IACpC;AAEJ,WAAS,kBAAkB,MAAoB;AAC7C,QAAI,CAAC,gBAAgB,aAAa,IAAI,IAAI,EAAG;AAC7C,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iDAAiD,IAAI;AAAA,MAC9D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,UAAU,WAAsC;AACvD,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mCAAmC,SAAS;AAAA,MACrD,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,aAAO;AAAA,QACL,YAAY,CAAC,OAAO,QAAQ,OAAO;AAAA,QACnC,eAAe,aAAa,cAAc,OAAO,CAAC,SAAS,eAAe,aAAa,IAAI,IAAI,IAAI,IAAI;AAAA,QACvG,YAAY,aAAa,WAAW,SAAS,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,QAAQ;AACZ,gBAAU,OAAO;AAAA,IACnB;AAAA,IACA,MAAM,IAAI,WAAW,YAAY;AAC/B,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,IAAI,WAAW,UAAU;AAAA,IAC/C;AAAA,IACA,MAAM,KAAK,OAAO,aAAa;AAC7B,wBAAkB,MAAM,IAAI;AAC5B,aAAO,MAAM,OAAO,KAAK,OAAO,WAAW;AAAA,IAC7C;AAAA,IACA,OAAO,MAAM,OAAO,cAAc;AAChC,wBAAkB,MAAM,IAAI;AAC5B,aAAO,OAAO,MAAM,OAAO,YAAY;AAAA,IACzC;AAAA,IACA,MAAM,SAAS;AACb,gBAAU,QAAQ;AAAA,IACpB;AAAA,EACF;AACF;AAQO,SAAS,oCACd,QACA,SAC0B;AAC1B,QAAM,YAAY,QAAQ,UAAU,KAAK;AACzC,MAAI,CAAC,aAAa,UAAU,SAAS,KAAK;AACxC,UAAM,IAAI,UAAU,qDAAqD;AAAA,EAC3E;AACA,QAAM,eAAe,IAAI,IAAI,QAAQ,oBAAoB;AACzD,QAAM,eAAe,IAAI,IAAI,QAAQ,wBAAwB,QAAQ,oBAAoB;AACzF,aAAW,QAAQ,cAAc;AAC/B,QAAI,CAAC,aAAa,IAAI,IAAI,GAAG;AAC3B,YAAM,IAAI,UAAU,0BAA0B,IAAI,wBAAwB;AAAA,IAC5E;AAAA,EACF;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,QAAI,aAAa,IAAI,IAAI,EAAG;AAC5B,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,iDAAiD,IAAI;AAAA,MAC9D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,WAAS,cAAgD,UAAwC;AAC/F,QAAI,SAAS,cAAc,UAAa,SAAS,cAAc,WAAW;AACxE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,kDAAkD,SAAS;AAAA,QACpE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AACA,WAAO,EAAE,GAAG,UAAU,UAAU;AAAA,EAClC;AAEA,WAAS,kBAAkB,MAAoB;AAC7C,sBAAkB,IAAI;AACtB,QAAI,aAAa,IAAI,IAAI,EAAG;AAC5B,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mDAAmD,IAAI;AAAA,MAChE,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,MAAM,kBAAkB;AACtB,YAAM,eAAe,MAAM,OAAO,gBAAgB;AAClD,YAAM,gBAAgB,aAAa,cAAc,OAAO,CAAC,SAAS,aAAa,IAAI,IAAI,CAAC;AACxF,YAAM,qBAAqB,OAAO;AAAA,QAChC,cAAc,IAAI,CAAC,SAAS;AAC1B,gBAAM,mBAAmB,aAAa,qBAAqB,IAAI,KAC7D,aAAa;AACf,iBAAO;AAAA,YACL;AAAA,YACA,iBAAiB,OAAO,CAAC,cAAc,aAAa,IAAI,IAAI,KAAM,cAAc,WAAW,cAAc,QAAS;AAAA,UACpH;AAAA,QACF,CAAC;AAAA,MACH;AACA,aAAO;AAAA,QACL,YAAY,aAAa;AAAA,QACzB;AAAA,QACA;AAAA,QACA,YAAY,aAAa,WAAW,SAAS,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,MAAM,UAAU,cAAc;AAClC,wBAAkB,SAAS,IAAI;AAC/B,aAAO,MAAM,OAAO;AAAA,QAClB;AAAA,UACE,GAAG;AAAA,UACH,UAAU,cAAc,SAAS,QAAQ;AAAA,QAC3C;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM,IAAI,WAAW,YAAY;AAC/B,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,IAAI,cAAc,SAAS,GAAG,UAAU;AAAA,IAC9D;AAAA,IACA,MAAM,KAAK,OAAO,aAAa;AAC7B,wBAAkB,MAAM,IAAI;AAC5B,aAAO,MAAM,OAAO,KAAK,cAAc,KAAK,GAAG,WAAW;AAAA,IAC5D;AAAA,IACA,MAAM,OAAO,cAAc;AACzB,wBAAkB,MAAM,IAAI;AAC5B,aAAO,OAAO,MAAM,cAAc,KAAK,GAAG,YAAY;AAAA,IACxD;AAAA,IACA,MAAM,OAAO,WAAW,eAAe;AACrC,wBAAkB,UAAU,IAAI;AAChC,aAAO,MAAM,OAAO,OAAO,cAAc,SAAS,GAAG,aAAa;AAAA,IACpE;AAAA,EACF;AACF;AAEA,SAAS,eAAe,SAAkC,KAAsB;AAC9E,MAAI,EAAE,OAAO,UAAU;AACrB,UAAM,IAAI,mBAAmB;AAAA,MAC3B,MAAM;AAAA,MACN,SAAS,mDAAmD,GAAG;AAAA,MAC/D,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,SAAO,QAAQ,GAAG;AACpB;AAEA,SAAS,QACP,SACA,QAC6B;AAC7B,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB,IAAI;AAAA,IACJ;AAAA,EACF;AACF;AAEA,SAAS,QAAQ,SAAkB,OAA6C;AAC9E,QAAM,gBAAgB,SAAS,OAAO,IAAI,UAAU;AACpD,SAAO;AAAA,IACL,UAAU;AAAA,IACV,WAAW,OAAO,eAAe,cAAc,WAAW,cAAc,YAAY;AAAA,IACpF,IAAI;AAAA,IACJ,OAAO,UAAU,KAAK;AAAA,EACxB;AACF;AAMO,SAAS,iCAAiC,QAM/C;AACA,WAAS,SAAS,SAA2C;AAC3D,QACE,CAAC,SAAS,OAAO,KACjB,QAAQ,aAAa,iCACrB,OAAO,QAAQ,cAAc,YAC7B,CAAC,QAAQ,aACT,QAAQ,UAAU,SAAS,OAC3B,CAAC,kBAAkB,IAAI,QAAQ,SAAS,KACxC,CAAC,SAAS,QAAQ,OAAO,GACzB;AACA,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS;AACrB,UAAI;AACF,iBAAS,OAAO;AAChB,cAAM,UAAU,QAAQ;AACxB,gBAAQ,QAAQ,WAAW;AAAA,UACzB,KAAK;AACH,mBAAO,QAAQ,SAAS,MAAM,OAAO,gBAAgB,CAAC;AAAA,UACxD,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,UAAU;AAAA,gBAClC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,WAAW;AAAA,gBACnC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,OAAO;AAAA,gBAC/B,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,mBAAO;AAAA,cACL;AAAA,cACA,MAAM,OAAO;AAAA,gBACX,eAAe,SAAS,WAAW;AAAA,gBACnC,QAAQ;AAAA,cACV;AAAA,YACF;AAAA,UACF,KAAK;AACH,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS;AAAA,cACT,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AACE,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,+CAA+C,OAAO,QAAQ,SAAS,CAAC;AAAA,cACjF,WAAW;AAAA,YACb,CAAC;AAAA,QACL;AAAA,MACF,SAAS,OAAO;AACd,eAAO,QAAQ,SAAS,KAAK;AAAA,MAC/B;AAAA,IACF;AAAA,IACA,OAAO,MAAM,SAAS,UAAU,CAAC,GAAG;AAClC,UAAI;AACF,iBAAS,OAAO;AAChB,YAAI,QAAQ,cAAc,SAAS;AACjC,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,eAAe,QAAQ,QAAQ;AACrC,yBACQ,SAAS,OAAO;AAAA,UACpB,eAAe,QAAQ,SAAS,OAAO;AAAA,UACvC;AAAA,YACE,GAAG;AAAA,YACH,QAAQ,QAAQ;AAAA,UAClB;AAAA,QACF,GACA;AACA,gBAAM,QAAQ,SAAS,KAAK;AAAA,QAC9B;AAAA,MACF,SAAS,OAAO;AACd,cAAM,QAAQ,SAAS,KAAK;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,kCACd,SAC8B;AAC9B,QAAM,SAAS,QAAQ,SAAS,WAAW;AAC3C,QAAM,mBAAmB,QAAQ,oBAAoB,OAAO;AAC5D,QAAM,oBAAoB,QAAQ,qBAAqB,OAAO;AAE9D,WAAS,oBAAoB,MAAoB;AAC/C,QAAI,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE,aAAa,mBAAmB;AACjE,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM;AAAA,QACN,SAAS,2CAA2C,iBAAiB;AAAA,QACrE,WAAW;AAAA,MACb,CAAC;AAAA,IACH;AAAA,EACF;AAEA,iBAAe,QAAQ,QAAiD;AACtE,UAAM,aAAa,OAAO,QAAQ,YAAY,aAAa,MAAM,QAAQ,QAAQ,IAAK,QAAQ,WAAW,CAAC;AAC1G,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,GAAG;AAAA,IACL;AAAA,EACF;AAEA,iBAAe,KACb,SACA,QACA,QACmB;AACnB,UAAM,WAAW,MAAM,OAAO,QAAQ,UAAU;AAAA,MAC9C,QAAQ;AAAA,MACR,SAAS,MAAM,QAAQ,MAAM;AAAA,MAC7B,MAAM,KAAK,UAAU,OAAO;AAAA,MAC5B;AAAA,MACA,GAAI,QAAQ,cAAc,EAAE,aAAa,QAAQ,YAAY,IAAI,CAAC;AAAA,IACpE,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,mBAAmB;AAAA,QAC3B,MAAM,SAAS,WAAW,OAAO,SAAS,WAAW,MAAM,cAAc;AAAA,QACzE,SAAS,+CAA+C,SAAS,MAAM;AAAA,QACvE,WAAW,SAAS,UAAU;AAAA,MAChC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAe,gBAAgB,UAAoB,OAAgC;AACjF,QAAI,CAAC,SAAS,KAAM,QAAO;AAC3B,UAAM,SAAS,SAAS,KAAK,UAAU;AACvC,UAAM,UAAU,IAAI,YAAY;AAChC,QAAI,OAAO;AACX,QAAI,OAAO;AACX,QAAI;AACF,iBAAS;AACP,cAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,YAAI,KAAM;AACV,gBAAQ,MAAM;AACd,YAAI,OAAO,OAAO;AAChB,gBAAM,OAAO,OAAO;AACpB,gBAAM,IAAI,mBAAmB;AAAA,YAC3B,MAAM;AAAA,YACN,SAAS,yCAAyC,KAAK;AAAA,YACvD,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,gBAAQ,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,MAChD;AACA,aAAO,OAAO,QAAQ,OAAO;AAAA,IAC/B,UAAE;AACA,aAAO,YAAY;AAAA,IACrB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS,mBAAmB,CAAC,GAAG;AAC5C,YAAM,WAAW,MAAM,KAAK,SAAS,oBAAoB,iBAAiB,MAAM;AAChF,YAAM,OAAO,MAAM,gBAAgB,UAAU,gBAAgB;AAC7D,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB;AAAA,IACA,OAAO,MAAM,SAAS,mBAAmB,CAAC,GAAG;AAC3C,YAAM,WAAW,MAAM,KAAK,SAAS,wBAAwB,iBAAiB,MAAM;AACpF,UAAI,CAAC,SAAS,MAAM;AAClB,cAAM,IAAI,mBAAmB;AAAA,UAC3B,MAAM;AAAA,UACN,SAAS;AAAA,UACT,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,SAAS,SAAS,KAAK,UAAU;AACvC,YAAM,UAAU,IAAI,YAAY;AAChC,UAAI,UAAU;AACd,UAAI,kBAAkB;AACtB,UAAI;AACF,mBAAS;AACP,gBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,cAAI,MAAM;AACR,8BAAkB;AAClB;AAAA,UACF;AACA,qBAAW,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AACjD,cAAI,UAAU,QAAQ,QAAQ,IAAI;AAClC,iBAAO,WAAW,GAAG;AACnB,kBAAM,OAAO,QAAQ,MAAM,GAAG,OAAO,EAAE,KAAK;AAC5C,sBAAU,QAAQ,MAAM,UAAU,CAAC;AACnC,gCAAoB,IAAI;AACxB,gBAAI,KAAM,OAAM,KAAK,MAAM,IAAI;AAC/B,sBAAU,QAAQ,QAAQ,IAAI;AAAA,UAChC;AAIA,cAAI,QAAQ,SAAS,mBAAmB;AACtC,kBAAM,IAAI,mBAAmB;AAAA,cAC3B,MAAM;AAAA,cACN,SAAS,2CAA2C,iBAAiB;AAAA,cACrE,WAAW;AAAA,YACb,CAAC;AAAA,UACH;AAAA,QACF;AACA,mBAAW,QAAQ,OAAO;AAC1B,YAAI,QAAQ,KAAK,GAAG;AAClB,8BAAoB,QAAQ,KAAK,CAAC;AAClC,gBAAM,KAAK,MAAM,OAAO;AAAA,QAC1B;AAAA,MACF,UAAE;AACA,YAAI,CAAC,iBAAiB;AACpB,gBAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,QAC7C;AACA,eAAO,YAAY;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-FWSY5HOA.js

@@ -0,0 +1,63 @@
+// src/orchestration/errors.ts
+var ORCHESTRATION_ERROR_CODES = [
+  "UNSUPPORTED",
+  "FORBIDDEN",
+  "CONFLICT",
+  "STALE_EPOCH",
+  "NOT_FOUND",
+  "INVALID",
+  "EXHAUSTED",
+  "UNAVAILABLE",
+  "TIMEOUT",
+  "CANCELLED",
+  "UNKNOWN_EFFECT",
+  "WATCH_COMPACTED",
+  "INTERNAL"
+];
+var OrchestrationError = class extends Error {
+  code;
+  retryable;
+  retryAfterMs;
+  reason;
+  details;
+  constructor(data) {
+    super(data.message);
+    this.name = "OrchestrationError";
+    this.code = data.code;
+    this.retryable = data.retryable;
+    this.retryAfterMs = data.retryAfterMs;
+    this.reason = data.reason;
+    this.details = data.details;
+  }
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      retryable: this.retryable,
+      retryAfterMs: this.retryAfterMs,
+      reason: this.reason,
+      details: this.details
+    };
+  }
+};
+function isOrchestrationError(error) {
+  return error instanceof OrchestrationError;
+}
+function toOrchestrationErrorData(error, fallback = {
+  code: "INTERNAL",
+  retryable: false
+}) {
+  if (isOrchestrationError(error)) return error.toJSON();
+  return {
+    ...fallback,
+    message: error instanceof Error ? error.message : String(error)
+  };
+}
+
+export {
+  ORCHESTRATION_ERROR_CODES,
+  OrchestrationError,
+  isOrchestrationError,
+  toOrchestrationErrorData
+};
+//# sourceMappingURL=chunk-FWSY5HOA.js.map

package/dist/chunk-FWSY5HOA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/orchestration/errors.ts"],"sourcesContent":["export const ORCHESTRATION_ERROR_CODES = [\n  'UNSUPPORTED',\n  'FORBIDDEN',\n  'CONFLICT',\n  'STALE_EPOCH',\n  'NOT_FOUND',\n  'INVALID',\n  'EXHAUSTED',\n  'UNAVAILABLE',\n  'TIMEOUT',\n  'CANCELLED',\n  'UNKNOWN_EFFECT',\n  'WATCH_COMPACTED',\n  'INTERNAL',\n] as const;\n\nexport type OrchestrationErrorCode = typeof ORCHESTRATION_ERROR_CODES[number];\n\nexport interface OrchestrationErrorData {\n  code: OrchestrationErrorCode;\n  message: string;\n  retryable: boolean;\n  retryAfterMs?: number;\n  reason?: string;\n  details?: Record<string, unknown>;\n}\n\nexport class OrchestrationError extends Error {\n  readonly code: OrchestrationErrorCode;\n  readonly retryable: boolean;\n  readonly retryAfterMs?: number;\n  readonly reason?: string;\n  readonly details?: Record<string, unknown>;\n\n  constructor(data: OrchestrationErrorData) {\n    super(data.message);\n    this.name = 'OrchestrationError';\n    this.code = data.code;\n    this.retryable = data.retryable;\n    this.retryAfterMs = data.retryAfterMs;\n    this.reason = data.reason;\n    this.details = data.details;\n  }\n\n  toJSON(): OrchestrationErrorData {\n    return {\n      code: this.code,\n      message: this.message,\n      retryable: this.retryable,\n      retryAfterMs: this.retryAfterMs,\n      reason: this.reason,\n      details: this.details,\n    };\n  }\n}\n\nexport function isOrchestrationError(error: unknown): error is OrchestrationError {\n  return error instanceof OrchestrationError;\n}\n\nexport function toOrchestrationErrorData(\n  error: unknown,\n  fallback: Pick<OrchestrationErrorData, 'code' | 'retryable'> = {\n    code: 'INTERNAL',\n    retryable: false,\n  },\n): OrchestrationErrorData {\n  if (isOrchestrationError(error)) return error.toJSON();\n  return {\n    ...fallback,\n    message: error instanceof Error ? error.message : String(error),\n  };\n}\n"],"mappings":";AAAO,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAaO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAA8B;AACxC,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,YAAY,KAAK;AACtB,SAAK,eAAe,KAAK;AACzB,SAAK,SAAS,KAAK;AACnB,SAAK,UAAU,KAAK;AAAA,EACtB;AAAA,EAEA,SAAiC;AAC/B,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,WAAW,KAAK;AAAA,MAChB,cAAc,KAAK;AAAA,MACnB,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,IAChB;AAAA,EACF;AACF;AAEO,SAAS,qBAAqB,OAA6C;AAChF,SAAO,iBAAiB;AAC1B;AAEO,SAAS,yBACd,OACA,WAA+D;AAAA,EAC7D,MAAM;AAAA,EACN,WAAW;AACb,GACwB;AACxB,MAAI,qBAAqB,KAAK,EAAG,QAAO,MAAM,OAAO;AACrD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EAChE;AACF;","names":[]}