narai-primitives 2.0.0-rc.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 NarAI Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/README.md

@@ -0,0 +1,64 @@
+# narai-primitives
+
+Read-only connectors + planning hub + connector framework, in one package.
+
+Bundles what used to ship as eight separate `@narai/*` packages:
+
+- `@narai/connector-toolkit` → `narai-primitives/toolkit`
+- `@narai/connector-config` → `narai-primitives/config`
+- `@narai/connector-hub` → `narai-primitives` (default) or `narai-primitives/hub`
+- `@narai/aws-agent-connector` → `narai-primitives/aws`
+- `@narai/confluence-agent-connector` → `narai-primitives/confluence`
+- `@narai/db-agent-connector` → `narai-primitives/db`
+- `@narai/gcp-agent-connector` → `narai-primitives/gcp`
+- `@narai/github-agent-connector` → `narai-primitives/github`
+- `@narai/jira-agent-connector` → `narai-primitives/jira`
+- `@narai/notion-agent-connector` → `narai-primitives/notion`
+
+`@narai/credential-providers` stays as a separate package.
+
+## Install
+
+```sh
+npm install narai-primitives
+```
+
+## Library use
+
+```ts
+import { gather } from "narai-primitives";
+
+const out = await gather({
+  prompt: "What was the last commit on main in narailabs/foo?",
+  consumer: "doc-wiki",
+});
+console.log(out.plan);
+console.log(out.results);
+```
+
+## CLI
+
+Each connector ships its own CLI binary, plus the umbrella `narai` dispatcher:
+
+```sh
+# umbrella
+npx narai jira list_issues --project AUTH
+
+# individual (back-compat aliases)
+npx jira-agent-connector --action list_issues --params '{"project":"AUTH"}'
+```
+
+## Migration from the old `@narai/*` packages
+
+Update imports:
+
+```diff
+-import { gather } from "@narai/connector-hub";
+-import { createConnector } from "@narai/connector-toolkit";
+-import { loadResolvedConfig } from "@narai/connector-config";
++import { gather } from "narai-primitives";
++import { createConnector } from "narai-primitives/toolkit";
++import { loadResolvedConfig } from "narai-primitives/config";
+```
+
+The eight old packages are deprecated on npm and will receive no new releases.

package/dist/config/bootstrap.d.ts

@@ -0,0 +1,28 @@
+/**
+ * bootstrap — single-shot helper for connectors that runs at CLI startup.
+ *
+ * The hub injects `NARAI_CONFIG_BLOB` (a JSON-serialized `ResolvedConnector`)
+ * when it spawns a connector subprocess. Standalone invocations have no blob
+ * and fall back to reading `~/.connectors/config.yaml` directly.
+ *
+ * Either way, this helper hands the connector its resolved slice and applies
+ * a per-connector mapping from YAML option keys to process.env entries, so
+ * existing connector code that reads from env vars (e.g. `JIRA_API_TOKEN`,
+ * `GCP_PROJECT_ID`) continues to work unchanged.
+ */
+import type { LoadOptions, ResolvedConnector } from "./types.js";
+export interface LoadConnectorEnvironmentOptions extends LoadOptions {
+    /**
+     * Map of YAML option key → environment variable name. For each entry, if
+     * the slice's `options[key]` resolves to a string value, set
+     * `process.env[envName]` to it.
+     */
+    envMapping: Record<string, string>;
+    /**
+     * If true, overwrite existing `process.env` entries. Default: only set
+     * when the env var is currently undefined, so manual exports always win.
+     */
+    overwrite?: boolean;
+}
+export declare function loadConnectorEnvironment(connectorName: string, opts: LoadConnectorEnvironmentOptions): Promise<ResolvedConnector | null>;
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/config/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/config/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAIjE,MAAM,WAAW,+BAAgC,SAAQ,WAAW;IAClE;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,+BAA+B,GACpC,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAKnC"}

package/dist/config/bootstrap.js

@@ -0,0 +1,80 @@
+/**
+ * bootstrap — single-shot helper for connectors that runs at CLI startup.
+ *
+ * The hub injects `NARAI_CONFIG_BLOB` (a JSON-serialized `ResolvedConnector`)
+ * when it spawns a connector subprocess. Standalone invocations have no blob
+ * and fall back to reading `~/.connectors/config.yaml` directly.
+ *
+ * Either way, this helper hands the connector its resolved slice and applies
+ * a per-connector mapping from YAML option keys to process.env entries, so
+ * existing connector code that reads from env vars (e.g. `JIRA_API_TOKEN`,
+ * `GCP_PROJECT_ID`) continues to work unchanged.
+ */
+import { loadResolvedConfig } from "./load.js";
+const ENV_PREFIX = "env:";
+export async function loadConnectorEnvironment(connectorName, opts) {
+    const slice = await loadOwnSlice(connectorName, opts);
+    if (slice === null)
+        return null;
+    applyEnvMapping(slice, opts.envMapping, opts.overwrite ?? false);
+    return slice;
+}
+/**
+ * Load this connector's resolved slice — `NARAI_CONFIG_BLOB` first, else
+ * the on-disk config files via `loadResolvedConfig`. Returns null when the
+ * blob is malformed or the file doesn't list this connector.
+ */
+async function loadOwnSlice(connectorName, opts) {
+    const blob = process.env["NARAI_CONFIG_BLOB"];
+    if (typeof blob === "string" && blob !== "") {
+        try {
+            const parsed = JSON.parse(blob);
+            if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+                return parsed;
+            }
+        }
+        catch {
+            // bad blob — fall through to file load
+        }
+    }
+    try {
+        const loadOpts = {};
+        if (opts.consumer !== undefined)
+            loadOpts.consumer = opts.consumer;
+        if (opts.environment !== undefined)
+            loadOpts.environment = opts.environment;
+        if (opts.cwd !== undefined)
+            loadOpts.cwd = opts.cwd;
+        const resolved = await loadResolvedConfig(loadOpts);
+        return resolved.connectors[connectorName] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function applyEnvMapping(slice, mapping, overwrite) {
+    for (const [optKey, envKey] of Object.entries(mapping)) {
+        if (!overwrite && process.env[envKey] !== undefined)
+            continue;
+        const raw = slice.options[optKey];
+        const value = resolveStringRef(raw);
+        if (value !== undefined) {
+            process.env[envKey] = value;
+        }
+    }
+}
+/**
+ * Translate a config value into a concrete string — `env:NAME` becomes
+ * `process.env.NAME`, plain strings pass through. Anything non-string or
+ * a missing env var returns undefined.
+ */
+function resolveStringRef(value) {
+    if (typeof value !== "string")
+        return undefined;
+    if (value.startsWith(ENV_PREFIX)) {
+        const name = value.slice(ENV_PREFIX.length);
+        return process.env[name];
+    }
+    return value;
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/config/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/config/bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG/C,MAAM,UAAU,GAAG,MAAM,CAAC;AAgB1B,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,aAAqB,EACrB,IAAqC;IAErC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,aAAqB,EACrB,IAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5E,OAAO,MAA2B,CAAC;YACrC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAgB,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QACnE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,QAAQ,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAC5E,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,KAAwB,EACxB,OAA+B,EAC/B,SAAkB;IAElB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/config/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Public API for `@narai/connector-config`.
+ *
+ * Consumers (the hub, every standalone connector) typically need just
+ * `loadResolvedConfig`. The lower-level `resolveConfig` + file loaders are
+ * exported for tests and advanced use.
+ */
+export { loadResolvedConfig, loadBaseConfig, loadFile, deepMerge, userConfigPath, repoConfigPath, } from "./load.js";
+export { resolveConfig, resolveConnector } from "./resolve.js";
+export { assertValidSecretSyntax, validateSecretsInTree, } from "./secrets.js";
+export { loadConnectorEnvironment, type LoadConnectorEnvironmentOptions, } from "./bootstrap.js";
+export type { PolicyAction, PolicyDecision, PolicyMap, RawConfigInput, LoadOptions, ResolveOptions, ResolvedConfig, ResolvedConnector, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,SAAS,EACT,cAAc,EACd,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EACL,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,wBAAwB,EACxB,KAAK,+BAA+B,GACrC,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,YAAY,EACZ,cAAc,EACd,SAAS,EACT,cAAc,EACd,WAAW,EACX,cAAc,EACd,cAAc,EACd,iBAAiB,GAClB,MAAM,YAAY,CAAC"}

package/dist/config/index.js

@@ -0,0 +1,12 @@
+/**
+ * Public API for `@narai/connector-config`.
+ *
+ * Consumers (the hub, every standalone connector) typically need just
+ * `loadResolvedConfig`. The lower-level `resolveConfig` + file loaders are
+ * exported for tests and advanced use.
+ */
+export { loadResolvedConfig, loadBaseConfig, loadFile, deepMerge, userConfigPath, repoConfigPath, } from "./load.js";
+export { resolveConfig, resolveConnector } from "./resolve.js";
+export { assertValidSecretSyntax, validateSecretsInTree, } from "./secrets.js";
+export { loadConnectorEnvironment, } from "./bootstrap.js";
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,QAAQ,EACR,SAAS,EACT,cAAc,EACd,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EACL,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,wBAAwB,GAEzB,MAAM,gBAAgB,CAAC"}

package/dist/config/load.d.ts

@@ -0,0 +1,37 @@
+/**
+ * File discovery, YAML parsing, and base-level deep merge for
+ * ~/.connectors/config.yaml + ./.connectors/config.yaml.
+ *
+ * The repo-level file wins on conflict. The environment + consumer
+ * overrides are applied in resolve.ts on top of this base.
+ */
+import type { LoadOptions, ResolvedConfig } from "./types.js";
+/** Absolute path to the user-level config: `~/.connectors/config.yaml`. */
+export declare function userConfigPath(): string;
+/** Absolute path to the repo-level config under `cwd`. */
+export declare function repoConfigPath(cwd?: string): string;
+/**
+ * Read a single YAML file and return its parsed mapping.
+ *
+ * - Returns `{}` if the file does not exist or contains nothing.
+ * - Throws on parse error or if the top-level value is not a mapping.
+ */
+export declare function loadFile(p: string): Record<string, unknown>;
+/**
+ * Deep merge of two values. Plain objects merge recursively; arrays and
+ * scalars are replaced wholesale by the overlay. Undefined overlay leaves
+ * the base unchanged.
+ */
+export declare function deepMerge(base: unknown, overlay: unknown): unknown;
+/**
+ * Read user + repo files and deep-merge with repo precedence. Either or
+ * both may be missing.
+ */
+export declare function loadBaseConfig(cwd?: string): Record<string, unknown>;
+/**
+ * The main public entry point: load + validate secret syntax + apply
+ * environment + consumer overrides. Returns a `ResolvedConfig` ready to
+ * iterate by the hub or sliced by a standalone connector.
+ */
+export declare function loadResolvedConfig(opts?: LoadOptions): Promise<ResolvedConfig>;
+//# sourceMappingURL=load.d.ts.map

package/dist/config/load.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.d.ts","sourceRoot":"","sources":["../../src/config/load.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAI9D,2EAA2E;AAC3E,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,CAElE;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAc3D;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAiBlE;AAMD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKnF;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,CAOxF"}

package/dist/config/load.js

@@ -0,0 +1,99 @@
+/**
+ * File discovery, YAML parsing, and base-level deep merge for
+ * ~/.connectors/config.yaml + ./.connectors/config.yaml.
+ *
+ * The repo-level file wins on conflict. The environment + consumer
+ * overrides are applied in resolve.ts on top of this base.
+ */
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import yaml from "js-yaml";
+import { resolveConfig } from "./resolve.js";
+import { validateSecretsInTree } from "./secrets.js";
+/** Absolute path to the user-level config: `~/.connectors/config.yaml`. */
+export function userConfigPath() {
+    return path.join(os.homedir(), ".connectors", "config.yaml");
+}
+/** Absolute path to the repo-level config under `cwd`. */
+export function repoConfigPath(cwd = process.cwd()) {
+    return path.join(cwd, ".connectors", "config.yaml");
+}
+/**
+ * Read a single YAML file and return its parsed mapping.
+ *
+ * - Returns `{}` if the file does not exist or contains nothing.
+ * - Throws on parse error or if the top-level value is not a mapping.
+ */
+export function loadFile(p) {
+    if (!fs.existsSync(p))
+        return {};
+    const raw = fs.readFileSync(p, "utf-8");
+    let parsed;
+    try {
+        parsed = yaml.load(raw);
+    }
+    catch (err) {
+        throw new Error(`Failed to parse YAML at ${p}: ${err.message}`);
+    }
+    if (parsed === null || parsed === undefined)
+        return {};
+    if (typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`Expected YAML mapping at ${p}, got ${Array.isArray(parsed) ? "array" : typeof parsed}.`);
+    }
+    return parsed;
+}
+/**
+ * Deep merge of two values. Plain objects merge recursively; arrays and
+ * scalars are replaced wholesale by the overlay. Undefined overlay leaves
+ * the base unchanged.
+ */
+export function deepMerge(base, overlay) {
+    if (overlay === undefined)
+        return base;
+    if (base === undefined)
+        return overlay;
+    if (isPlainObject(base) && isPlainObject(overlay)) {
+        const baseObj = base;
+        const overlayObj = overlay;
+        const result = {};
+        const keys = new Set([
+            ...Object.keys(baseObj),
+            ...Object.keys(overlayObj),
+        ]);
+        for (const k of keys) {
+            result[k] = deepMerge(baseObj[k], overlayObj[k]);
+        }
+        return result;
+    }
+    return overlay;
+}
+function isPlainObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+ * Read user + repo files and deep-merge with repo precedence. Either or
+ * both may be missing.
+ */
+export function loadBaseConfig(cwd = process.cwd()) {
+    const user = loadFile(userConfigPath());
+    const repo = loadFile(repoConfigPath(cwd));
+    const merged = deepMerge(user, repo);
+    return (merged ?? {});
+}
+/**
+ * The main public entry point: load + validate secret syntax + apply
+ * environment + consumer overrides. Returns a `ResolvedConfig` ready to
+ * iterate by the hub or sliced by a standalone connector.
+ */
+export async function loadResolvedConfig(opts = {}) {
+    const raw = loadBaseConfig(opts.cwd);
+    validateSecretsInTree(raw);
+    const resolveOpts = {};
+    if (opts.consumer !== undefined)
+        resolveOpts.consumer = opts.consumer;
+    if (opts.environment !== undefined)
+        resolveOpts.environment = opts.environment;
+    return resolveConfig(raw, resolveOpts);
+}
+//# sourceMappingURL=load.js.map

package/dist/config/load.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load.js","sourceRoot":"","sources":["../../src/config/load.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,IAAI,MAAM,SAAS,CAAC;AAG3B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,2EAA2E;AAC3E,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AAC/D,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,cAAc,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACxD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACvD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,SAAS,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,MAAM,GAAG,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,OAAgB;IACvD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACvC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,UAAU,GAAG,OAAkC,CAAC;QACtD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS;YAC3B,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;YACvB,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;SAC3B,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,OAAO,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAoB,EAAE;IAC7D,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAgD,EAAE,CAAC;IACpE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,WAAW,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IACtE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,WAAW,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAC/E,OAAO,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC"}

package/dist/config/resolve.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Apply environment + consumer overrides on top of a base config and
+ * materialize a strongly-typed `ResolvedConfig`.
+ *
+ * Merge order (latest wins):
+ *   1. base (user file ⊕ repo file)
+ *   2. environments.<envName>
+ *   3. consumers.<consumerName>
+ *
+ * Environment and consumer blocks may override top-level fields
+ * (`model`, `policy`, `enforce_hooks`, `hub`) AND per-connector blocks
+ * (any non-reserved key is treated as a connector name). A consumer
+ * additionally accepts `enabled: [...]` to filter which connectors are
+ * active for that consumer.
+ */
+import type { RawConfigInput, ResolveOptions, ResolvedConfig, ResolvedConnector } from "./types.js";
+export declare function resolveConfig(raw: RawConfigInput, opts?: ResolveOptions): ResolvedConfig;
+/**
+ * Convenience: pull a single connector's resolved view by name. Throws if
+ * the name is missing from the resolved config.
+ */
+export declare function resolveConnector(name: string, resolved: ResolvedConfig): ResolvedConnector;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/config/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/config/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAEV,cAAc,EACd,cAAc,EACd,cAAc,EACd,iBAAiB,EAClB,MAAM,YAAY,CAAC;AA4BpB,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,GAAE,cAAmB,GAAG,cAAc,CAiD5F;AAsHD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,iBAAiB,CAM1F"}

package/dist/config/resolve.js

@@ -0,0 +1,198 @@
+/**
+ * Apply environment + consumer overrides on top of a base config and
+ * materialize a strongly-typed `ResolvedConfig`.
+ *
+ * Merge order (latest wins):
+ *   1. base (user file ⊕ repo file)
+ *   2. environments.<envName>
+ *   3. consumers.<consumerName>
+ *
+ * Environment and consumer blocks may override top-level fields
+ * (`model`, `policy`, `enforce_hooks`, `hub`) AND per-connector blocks
+ * (any non-reserved key is treated as a connector name). A consumer
+ * additionally accepts `enabled: [...]` to filter which connectors are
+ * active for that consumer.
+ */
+import { deepMerge } from "./load.js";
+/** Reserved keys at the top of a consumer block (everything else is a connector override). */
+const RESERVED_CONSUMER_KEYS = new Set([
+    "enabled",
+    "policy",
+    "model",
+    "enforce_hooks",
+    "hub",
+]);
+/** Reserved keys at the top of an environment block. */
+const RESERVED_ENVIRONMENT_KEYS = new Set([
+    "policy",
+    "model",
+    "enforce_hooks",
+    "hub",
+]);
+/** Reserved per-connector fields the lib understands directly; everything else flows into `options`. */
+const RESERVED_CONNECTOR_FIELDS = new Set([
+    "skill",
+    "model",
+    "enforce_hooks",
+    "policy",
+    "disable",
+]);
+export function resolveConfig(raw, opts = {}) {
+    // 1. Determine the active environment (explicit override > environments.default > none).
+    const environments = raw["environments"] ?? {};
+    const defaultEnvName = typeof environments["default"] === "string" ? environments["default"] : undefined;
+    const envName = opts.environment ?? defaultEnvName ?? null;
+    // 2. Apply environment overrides on top of the base.
+    let merged = { ...raw };
+    if (envName !== null) {
+        const envBlock = environments[envName];
+        if (envBlock === undefined) {
+            throw new Error(`Environment '${envName}' not found in config.`);
+        }
+        if (!isPlainObject(envBlock)) {
+            throw new Error(`Environment '${envName}' must be a mapping.`);
+        }
+        merged = applyOverlay(merged, envBlock, RESERVED_ENVIRONMENT_KEYS);
+    }
+    // 3. Apply consumer overrides.
+    //
+    // The consumers block is *optional*. A consumer requested via opts.consumer
+    // that has no entry in `consumers.<name>` is treated as "no overrides" —
+    // the base config (with environment overlay already applied) is used as-is.
+    // This lets every consumer share the default connector setup and only opt
+    // in to overrides when they actually need them, instead of forcing every
+    // user to declare a stub block.
+    //
+    // A non-mapping consumer block is still an error (it's almost certainly a
+    // typo in YAML).
+    const consumerName = opts.consumer ?? null;
+    let enabledList = null;
+    if (consumerName !== null) {
+        const consumers = raw["consumers"] ?? {};
+        const consumerBlock = consumers[consumerName];
+        if (consumerBlock !== undefined) {
+            if (!isPlainObject(consumerBlock)) {
+                throw new Error(`Consumer '${consumerName}' must be a mapping.`);
+            }
+            const block = consumerBlock;
+            merged = applyOverlay(merged, block, RESERVED_CONSUMER_KEYS);
+            const enabled = block["enabled"];
+            if (Array.isArray(enabled)) {
+                enabledList = new Set(enabled.filter((x) => typeof x === "string"));
+            }
+        }
+    }
+    return materialize(merged, envName, consumerName, enabledList);
+}
+/**
+ * Apply an overlay block to `merged`. Reserved keys (top-level
+ * settings) deep-merge into top-level fields; non-reserved keys are
+ * treated as connector names and deep-merge into `connectors[name]`.
+ */
+function applyOverlay(merged, overlay, reservedKeys) {
+    const next = { ...merged };
+    // Top-level field overrides
+    for (const k of reservedKeys) {
+        if (k === "enabled")
+            continue; // consumer-only, handled by caller
+        if (overlay[k] !== undefined) {
+            next[k] = deepMerge(next[k], overlay[k]);
+        }
+    }
+    // Per-connector overrides (any non-reserved key)
+    const baseConnectors = isPlainObject(next["connectors"])
+        ? { ...next["connectors"] }
+        : {};
+    for (const [k, v] of Object.entries(overlay)) {
+        if (reservedKeys.has(k))
+            continue;
+        if (v === undefined)
+            continue;
+        baseConnectors[k] = deepMerge(baseConnectors[k], v);
+    }
+    next["connectors"] = baseConnectors;
+    return next;
+}
+function materialize(merged, envName, consumerName, enabledList) {
+    const connectorsRaw = isPlainObject(merged["connectors"])
+        ? merged["connectors"]
+        : {};
+    const topPolicy = isPlainObject(merged["policy"])
+        ? merged["policy"]
+        : {};
+    const topEnforceHooks = typeof merged["enforce_hooks"] === "boolean"
+        ? merged["enforce_hooks"]
+        : true;
+    const topModel = typeof merged["model"] === "string"
+        ? merged["model"]
+        : null;
+    const resolvedConnectors = {};
+    for (const [name, blockRaw] of Object.entries(connectorsRaw)) {
+        if (!isPlainObject(blockRaw)) {
+            throw new Error(`Connector '${name}' must be a mapping.`);
+        }
+        const block = blockRaw;
+        const disabled = block["disable"] === true;
+        const inEnabledList = enabledList === null || enabledList.has(name);
+        const enabled = inEnabledList && !disabled;
+        const skill = typeof block["skill"] === "string" ? block["skill"] : "";
+        if (skill === "" && enabled) {
+            throw new Error(`Connector '${name}' is enabled but has no 'skill' set.`);
+        }
+        const model = typeof block["model"] === "string"
+            ? block["model"]
+            : null;
+        const enforceHooks = typeof block["enforce_hooks"] === "boolean"
+            ? block["enforce_hooks"]
+            : topEnforceHooks;
+        const blockPolicy = isPlainObject(block["policy"])
+            ? block["policy"]
+            : {};
+        const policy = { ...topPolicy, ...blockPolicy };
+        const options = {};
+        for (const [k, v] of Object.entries(block)) {
+            if (!RESERVED_CONNECTOR_FIELDS.has(k)) {
+                options[k] = v;
+            }
+        }
+        resolvedConnectors[name] = {
+            name,
+            enabled,
+            skill,
+            model,
+            enforce_hooks: enforceHooks,
+            policy,
+            options,
+        };
+    }
+    const hubRaw = isPlainObject(merged["hub"])
+        ? merged["hub"]
+        : {};
+    return {
+        hub: {
+            model: typeof hubRaw["model"] === "string" ? hubRaw["model"] : null,
+            max_tokens: typeof hubRaw["max_tokens"] === "number" ? hubRaw["max_tokens"] : null,
+        },
+        policy: { ...topPolicy },
+        enforce_hooks: topEnforceHooks,
+        model: topModel,
+        environment: envName,
+        consumer: consumerName,
+        connectors: resolvedConnectors,
+    };
+}
+/**
+ * Convenience: pull a single connector's resolved view by name. Throws if
+ * the name is missing from the resolved config.
+ */
+export function resolveConnector(name, resolved) {
+    const slice = resolved.connectors[name];
+    if (slice === undefined) {
+        throw new Error(`Connector '${name}' not found in resolved config.`);
+    }
+    return slice;
+}
+function isPlainObject(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+//# sourceMappingURL=resolve.js.map

package/dist/config/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/config/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAStC,8FAA8F;AAC9F,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,SAAS;IACT,QAAQ;IACR,OAAO;IACP,eAAe;IACf,KAAK;CACN,CAAC,CAAC;AAEH,wDAAwD;AACxD,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,QAAQ;IACR,OAAO;IACP,eAAe;IACf,KAAK;CACN,CAAC,CAAC;AAEH,wGAAwG;AACxG,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,OAAO;IACP,OAAO;IACP,eAAe;IACf,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,GAAmB,EAAE,OAAuB,EAAE;IAC1E,yFAAyF;IACzF,MAAM,YAAY,GAAI,GAAG,CAAC,cAAc,CAAyC,IAAI,EAAE,CAAC;IACxF,MAAM,cAAc,GAAG,OAAO,YAAY,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,OAAO,GAAkB,IAAI,CAAC,WAAW,IAAI,cAAc,IAAI,IAAI,CAAC;IAE1E,qDAAqD;IACrD,IAAI,MAAM,GAA4B,EAAE,GAAG,GAAG,EAAE,CAAC;IACjD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,wBAAwB,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,sBAAsB,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,QAAmC,EAAE,yBAAyB,CAAC,CAAC;IAChG,CAAC;IAED,+BAA+B;IAC/B,EAAE;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,gCAAgC;IAChC,EAAE;IACF,0EAA0E;IAC1E,iBAAiB;IACjB,MAAM,YAAY,GAAkB,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC1D,IAAI,WAAW,GAAuB,IAAI,CAAC;IAC3C,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAI,GAAG,CAAC,WAAW,CAAyC,IAAI,EAAE,CAAC;QAClF,MAAM,aAAa,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,aAAa,YAAY,sBAAsB,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,KAAK,GAAG,aAAwC,CAAC;YACvD,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CACnB,MAA+B,EAC/B,OAAgC,EAChC,YAAiC;IAEjC,MAAM,IAAI,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACpD,4BAA4B;IAC5B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS,CAAC,mCAAmC;QAClE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,iDAAiD;IACjD,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC,CAAC,EAAE,GAAI,IAAI,CAAC,YAAY,CAA6B,EAAE;QACxD,CAAC,CAAC,EAAE,CAAC;IACP,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC9B,cAAc,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,GAAG,cAAc,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAClB,MAA+B,EAC/B,OAAsB,EACtB,YAA2B,EAC3B,WAA+B;IAE/B,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC,CAAE,MAAM,CAAC,YAAY,CAA6B;QACnD,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,SAAS,GAAc,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1D,CAAC,CAAE,MAAM,CAAC,QAAQ,CAAe;QACjC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,eAAe,GAAY,OAAO,MAAM,CAAC,eAAe,CAAC,KAAK,SAAS;QAC3E,CAAC,CAAE,MAAM,CAAC,eAAe,CAAa;QACtC,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,QAAQ,GAAkB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;QACjE,CAAC,CAAE,MAAM,CAAC,OAAO,CAAY;QAC7B,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,kBAAkB,GAAsC,EAAE,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,sBAAsB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,QAAmC,CAAC;QAElD,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;QAC3C,MAAM,aAAa,GAAG,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,aAAa,IAAI,CAAC,QAAQ,CAAC;QAE3C,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,IAAI,KAAK,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,sCAAsC,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ;YAC9C,CAAC,CAAE,KAAK,CAAC,OAAO,CAAY;YAC5B,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,YAAY,GAAG,OAAO,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS;YAC9D,CAAC,CAAE,KAAK,CAAC,eAAe,CAAa;YACrC,CAAC,CAAC,eAAe,CAAC;QAEpB,MAAM,WAAW,GAAc,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC3D,CAAC,CAAE,KAAK,CAAC,QAAQ,CAAe;YAChC,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,GAAc,EAAE,GAAG,SAAS,EAAE,GAAG,WAAW,EAAE,CAAC;QAE3D,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAED,kBAAkB,CAAC,IAAI,CAAC,GAAG;YACzB,IAAI;YACJ,OAAO;YACP,KAAK;YACL,KAAK;YACL,aAAa,EAAE,YAAY;YAC3B,MAAM;YACN,OAAO;SACR,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC,CAAE,MAAM,CAAC,KAAK,CAA6B;QAC5C,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;QACL,GAAG,EAAE;YACH,KAAK,EAAE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,IAAI;YAC/E,UAAU,EAAE,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,YAAY,CAAY,CAAC,CAAC,CAAC,IAAI;SAC/F;QACD,MAAM,EAAE,EAAE,GAAG,SAAS,EAAE;QACxB,aAAa,EAAE,eAAe;QAC9B,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,YAAY;QACtB,UAAU,EAAE,kBAAkB;KAC/B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAwB;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,iCAAiC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/config/secrets.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Secret-reference syntax validation.
+ *
+ * V1 only validates syntax — it does not eagerly resolve secrets. Strings
+ * starting with `env:NAME` pass through unchanged so each connector can
+ * resolve them lazily via its own credential-providers chain at the moment
+ * of use. The wrong form `env.NAME` (with a dot) is rejected with a clear
+ * error so it doesn't silently flow through as a literal.
+ */
+/**
+ * Throws if the string uses the wrong form. Other content (including
+ * `env:NAME`, `keychain:NAME`, plain literals) is accepted unchanged.
+ */
+export declare function assertValidSecretSyntax(value: string, location?: string): void;
+/**
+ * Recursively validates every string in a value tree. Throws on the first
+ * malformed reference, with a dotted path indicating where the bad value lives.
+ */
+export declare function validateSecretsInTree(node: unknown, path?: string): void;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/config/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/config/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAO9E;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,SAAK,GAAG,IAAI,CAiBpE"}