octoflow-core 1.0.0

package/dist/utils/rate-limiter.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/rate-limiter.ts"],
+  "sourcesContent": ["interface RateLimitBucket {\n  concurrent: number;\n  timestamps: number[];\n}\n\ninterface RateLimiterConfig {\n  maxConcurrent?: number | null;\n  maxRequests: number;\n  windowMs: number;\n}\n\nexport interface RateLimitLease {\n  allowed: boolean;\n  limit: number;\n  remaining: number;\n  resetMs: number;\n  retryAfterMs?: number;\n  release(): void;\n}\n\nexport class RateLimiter {\n  private readonly buckets = new Map<string, RateLimitBucket>();\n\n  constructor(private readonly config: RateLimiterConfig) {}\n\n  acquire(key: string): RateLimitLease {\n    const bucket = this.getBucket(key);\n    const now = Date.now();\n    bucket.timestamps = bucket.timestamps.filter(\n      (timestamp) => now - timestamp < this.config.windowMs\n    );\n\n    if (bucket.timestamps.length >= this.config.maxRequests) {\n      const earliest = bucket.timestamps[0] ?? now;\n      const retryAfterMs = Math.max(0, this.config.windowMs - (now - earliest));\n      return {\n        allowed: false,\n        limit: this.config.maxRequests,\n        remaining: 0,\n        resetMs: retryAfterMs,\n        retryAfterMs,\n        release: () => undefined,\n      };\n    }\n\n    if (\n      this.config.maxConcurrent != null &&\n      this.config.maxConcurrent > 0 &&\n      bucket.concurrent >= this.config.maxConcurrent\n    ) {\n      const earliest = bucket.timestamps[0] ?? now;\n      const retryAfterMs = Math.max(0, this.config.windowMs - (now - earliest));\n      return {\n        allowed: false,\n        limit: this.config.maxRequests,\n        remaining: Math.max(\n          0,\n          this.config.maxRequests - bucket.timestamps.length\n        ),\n        resetMs: retryAfterMs,\n        retryAfterMs,\n        release: () => undefined,\n      };\n    }\n\n    bucket.timestamps.push(now);\n    bucket.concurrent += 1;\n\n    const earliest = bucket.timestamps[0] ?? now;\n    const resetMs = Math.max(0, this.config.windowMs - (now - earliest));\n\n    return {\n      allowed: true,\n      limit: this.config.maxRequests,\n      remaining: Math.max(\n        0,\n        this.config.maxRequests - bucket.timestamps.length\n      ),\n      resetMs,\n      release: () => {\n        const current = this.buckets.get(key);\n        if (!current) return;\n        current.concurrent = Math.max(0, current.concurrent - 1);\n        const activeTimestamps = current.timestamps.filter(\n          (timestamp) => Date.now() - timestamp < this.config.windowMs\n        );\n        current.timestamps = activeTimestamps;\n        if (current.concurrent === 0 && current.timestamps.length === 0) {\n          this.buckets.delete(key);\n        }\n      },\n    };\n  }\n\n  private getBucket(key: string): RateLimitBucket {\n    let bucket = this.buckets.get(key);\n    if (!bucket) {\n      bucket = {\n        concurrent: 0,\n        timestamps: [],\n      };\n      this.buckets.set(key, bucket);\n    }\n    return bucket;\n  }\n}\n"],
+  "mappings": "AAoBO,MAAM,YAAY;AAAA,EAGvB,YAA6B,QAA2B;AAA3B;AAAA,EAA4B;AAAA,EAA5B;AAAA,EAFZ,UAAU,oBAAI,IAA6B;AAAA,EAI5D,QAAQ,KAA6B;AACnC,UAAM,SAAS,KAAK,UAAU,GAAG;AACjC,UAAM,MAAM,KAAK,IAAI;AACrB,WAAO,aAAa,OAAO,WAAW;AAAA,MACpC,CAAC,cAAc,MAAM,YAAY,KAAK,OAAO;AAAA,IAC/C;AAEA,QAAI,OAAO,WAAW,UAAU,KAAK,OAAO,aAAa;AACvD,YAAMA,YAAW,OAAO,WAAW,CAAC,KAAK;AACzC,YAAM,eAAe,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,MAAMA,UAAS;AACxE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,KAAK,OAAO;AAAA,QACnB,WAAW;AAAA,QACX,SAAS;AAAA,QACT;AAAA,QACA,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,QACE,KAAK,OAAO,iBAAiB,QAC7B,KAAK,OAAO,gBAAgB,KAC5B,OAAO,cAAc,KAAK,OAAO,eACjC;AACA,YAAMA,YAAW,OAAO,WAAW,CAAC,KAAK;AACzC,YAAM,eAAe,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,MAAMA,UAAS;AACxE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,KAAK,OAAO;AAAA,QACnB,WAAW,KAAK;AAAA,UACd;AAAA,UACA,KAAK,OAAO,cAAc,OAAO,WAAW;AAAA,QAC9C;AAAA,QACA,SAAS;AAAA,QACT;AAAA,QACA,SAAS,MAAM;AAAA,MACjB;AAAA,IACF;AAEA,WAAO,WAAW,KAAK,GAAG;AAC1B,WAAO,cAAc;AAErB,UAAM,WAAW,OAAO,WAAW,CAAC,KAAK;AACzC,UAAM,UAAU,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,MAAM,SAAS;AAEnE,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO,KAAK,OAAO;AAAA,MACnB,WAAW,KAAK;AAAA,QACd;AAAA,QACA,KAAK,OAAO,cAAc,OAAO,WAAW;AAAA,MAC9C;AAAA,MACA;AAAA,MACA,SAAS,MAAM;AACb,cAAM,UAAU,KAAK,QAAQ,IAAI,GAAG;AACpC,YAAI,CAAC,QAAS;AACd,gBAAQ,aAAa,KAAK,IAAI,GAAG,QAAQ,aAAa,CAAC;AACvD,cAAM,mBAAmB,QAAQ,WAAW;AAAA,UAC1C,CAAC,cAAc,KAAK,IAAI,IAAI,YAAY,KAAK,OAAO;AAAA,QACtD;AACA,gBAAQ,aAAa;AACrB,YAAI,QAAQ,eAAe,KAAK,QAAQ,WAAW,WAAW,GAAG;AAC/D,eAAK,QAAQ,OAAO,GAAG;AAAA,QACzB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,UAAU,KAA8B;AAC9C,QAAI,SAAS,KAAK,QAAQ,IAAI,GAAG;AACjC,QAAI,CAAC,QAAQ;AACX,eAAS;AAAA,QACP,YAAY;AAAA,QACZ,YAAY,CAAC;AAAA,MACf;AACA,WAAK,QAAQ,IAAI,KAAK,MAAM;AAAA,IAC9B;AACA,WAAO;AAAA,EACT;AACF;",
+  "names": ["earliest"]
+}

package/dist/utils/redact-secrets.d.ts

@@ -0,0 +1,2 @@
+export declare function redactSecrets(str: string): string;
+//# sourceMappingURL=redact-secrets.d.ts.map

package/dist/utils/redact-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-secrets.d.ts","sourceRoot":"","sources":["../../src/utils/redact-secrets.ts"],"names":[],"mappings":"AAaA,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOjD"}

package/dist/utils/redact-secrets.js

@@ -0,0 +1,24 @@
+const SECRET_PATTERNS = [
+  { pattern: /\bsk-[A-Za-z0-9]{20,}\b/g, replacement: "[REDACTED:sk-key]" },
+  { pattern: /\bghp_[A-Za-z0-9]{36,}\b/g, replacement: "[REDACTED:gh-token]" },
+  {
+    pattern: /\b(Bearer|Token)\s+[A-Za-z0-9._-]{16,}\b/gi,
+    replacement: "$1 [REDACTED]"
+  },
+  {
+    pattern: /password[\s"':=]+["']?[^\s"',;\n]{8,}["']?/gi,
+    replacement: "password=[REDACTED]"
+  }
+];
+function redactSecrets(str) {
+  if (!str) return str;
+  let result = str;
+  for (const { pattern, replacement } of SECRET_PATTERNS) {
+    result = result.replace(pattern, replacement);
+  }
+  return result;
+}
+export {
+  redactSecrets
+};
+//# sourceMappingURL=redact-secrets.js.map

package/dist/utils/redact-secrets.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/redact-secrets.ts"],
+  "sourcesContent": ["const SECRET_PATTERNS: Array<{ pattern: RegExp; replacement: string }> = [\n  { pattern: /\\bsk-[A-Za-z0-9]{20,}\\b/g, replacement: '[REDACTED:sk-key]' },\n  { pattern: /\\bghp_[A-Za-z0-9]{36,}\\b/g, replacement: '[REDACTED:gh-token]' },\n  {\n    pattern: /\\b(Bearer|Token)\\s+[A-Za-z0-9._-]{16,}\\b/gi,\n    replacement: '$1 [REDACTED]',\n  },\n  {\n    pattern: /password[\\s\"':=]+[\"']?[^\\s\"',;\\n]{8,}[\"']?/gi,\n    replacement: 'password=[REDACTED]',\n  },\n];\n\nexport function redactSecrets(str: string): string {\n  if (!str) return str;\n  let result = str;\n  for (const { pattern, replacement } of SECRET_PATTERNS) {\n    result = result.replace(pattern, replacement);\n  }\n  return result;\n}\n"],
+  "mappings": "AAAA,MAAM,kBAAmE;AAAA,EACvE,EAAE,SAAS,4BAA4B,aAAa,oBAAoB;AAAA,EACxE,EAAE,SAAS,6BAA6B,aAAa,sBAAsB;AAAA,EAC3E;AAAA,IACE,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AACF;AAEO,SAAS,cAAc,KAAqB;AACjD,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,SAAS;AACb,aAAW,EAAE,SAAS,YAAY,KAAK,iBAAiB;AACtD,aAAS,OAAO,QAAQ,SAAS,WAAW;AAAA,EAC9C;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/utils/retry.d.ts

@@ -0,0 +1,11 @@
+import type { BackendName, RunOptions } from '../domain/core-client.js';
+interface RetryOptions {
+    retries: number;
+    backend: BackendName | null;
+    phase: 'run' | 'stream' | 'session';
+    onError?: RunOptions['onError'];
+    onRetry?: RunOptions['onRetry'];
+}
+export declare function withRetry<T>(fn: () => Promise<T>, opts: RetryOptions): Promise<T>;
+export {};
+//# sourceMappingURL=retry.d.ts.map

package/dist/utils/retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../../src/utils/retry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAIxE,UAAU,YAAY;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;IACpC,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;CACjC;AAED,wBAAsB,SAAS,CAAC,CAAC,EAC/B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,CAAC,CAAC,CAiBZ"}

package/dist/utils/retry.js

@@ -0,0 +1,24 @@
+import { retryDelayMs, toErrorInfo, toRetryInfo } from "./operation-info.js";
+import { sleep } from "./time.js";
+async function withRetry(fn, opts) {
+  let attempt = 0;
+  while (true) {
+    try {
+      return await fn();
+    } catch (err) {
+      if (attempt >= opts.retries) {
+        await opts.onError?.(toErrorInfo(opts.phase, opts.backend, err));
+        throw err;
+      }
+      attempt++;
+      await opts.onRetry?.(
+        toRetryInfo(opts.backend, err, attempt, opts.retries)
+      );
+      await sleep(retryDelayMs(attempt));
+    }
+  }
+}
+export {
+  withRetry
+};
+//# sourceMappingURL=retry.js.map

package/dist/utils/retry.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/retry.ts"],
+  "sourcesContent": ["import type { BackendName, RunOptions } from '../domain/core-client.js';\nimport { retryDelayMs, toErrorInfo, toRetryInfo } from './operation-info.js';\nimport { sleep } from './time.js';\n\ninterface RetryOptions {\n  retries: number;\n  backend: BackendName | null;\n  phase: 'run' | 'stream' | 'session';\n  onError?: RunOptions['onError'];\n  onRetry?: RunOptions['onRetry'];\n}\n\nexport async function withRetry<T>(\n  fn: () => Promise<T>,\n  opts: RetryOptions\n): Promise<T> {\n  let attempt = 0;\n  while (true) {\n    try {\n      return await fn();\n    } catch (err) {\n      if (attempt >= opts.retries) {\n        await opts.onError?.(toErrorInfo(opts.phase, opts.backend, err));\n        throw err;\n      }\n      attempt++;\n      await opts.onRetry?.(\n        toRetryInfo(opts.backend, err, attempt, opts.retries)\n      );\n      await sleep(retryDelayMs(attempt));\n    }\n  }\n}\n"],
+  "mappings": "AACA,SAAS,cAAc,aAAa,mBAAmB;AACvD,SAAS,aAAa;AAUtB,eAAsB,UACpB,IACA,MACY;AACZ,MAAI,UAAU;AACd,SAAO,MAAM;AACX,QAAI;AACF,aAAO,MAAM,GAAG;AAAA,IAClB,SAAS,KAAK;AACZ,UAAI,WAAW,KAAK,SAAS;AAC3B,cAAM,KAAK,UAAU,YAAY,KAAK,OAAO,KAAK,SAAS,GAAG,CAAC;AAC/D,cAAM;AAAA,MACR;AACA;AACA,YAAM,KAAK;AAAA,QACT,YAAY,KAAK,SAAS,KAAK,SAAS,KAAK,OAAO;AAAA,MACtD;AACA,YAAM,MAAM,aAAa,OAAO,CAAC;AAAA,IACnC;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/utils/safe-key.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Reject keys that would mutate Object.prototype or hijack property lookup.
+ *
+ * Use when assigning into a record from a key sourced from user-controlled
+ * input (JSON/TOML/YAML files, network payloads). Without this guard, a
+ * payload containing `__proto__`, `constructor`, or `prototype` keys can
+ * pollute the prototype chain via `obj[key] = value`.
+ */
+export declare function isSafeKey(key: string): boolean;
+//# sourceMappingURL=safe-key.d.ts.map

package/dist/utils/safe-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-key.d.ts","sourceRoot":"","sources":["../../src/utils/safe-key.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9C"}

package/dist/utils/safe-key.js

@@ -0,0 +1,7 @@
+function isSafeKey(key) {
+  return key !== "__proto__" && key !== "constructor" && key !== "prototype";
+}
+export {
+  isSafeKey
+};
+//# sourceMappingURL=safe-key.js.map

package/dist/utils/safe-key.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/safe-key.ts"],
+  "sourcesContent": ["/**\n * Reject keys that would mutate Object.prototype or hijack property lookup.\n *\n * Use when assigning into a record from a key sourced from user-controlled\n * input (JSON/TOML/YAML files, network payloads). Without this guard, a\n * payload containing `__proto__`, `constructor`, or `prototype` keys can\n * pollute the prototype chain via `obj[key] = value`.\n */\nexport function isSafeKey(key: string): boolean {\n  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype';\n}\n"],
+  "mappings": "AAQO,SAAS,UAAU,KAAsB;AAC9C,SAAO,QAAQ,eAAe,QAAQ,iBAAiB,QAAQ;AACjE;",
+  "names": []
+}

package/dist/utils/safe-path.d.ts

@@ -0,0 +1,24 @@
+import { OctoFlowError } from '../domain/errors/base.js';
+export interface SafePathOptions {
+    /**
+     * Root directory. When provided, the resolved path must be inside it —
+     * otherwise `safePath` throws `PathTraversalError`.
+     */
+    readonly base?: string;
+}
+export declare class PathTraversalError extends OctoFlowError {
+    constructor(input: string, reason: string);
+}
+/**
+ * Resolve a user-supplied path and reject traversal attempts.
+ *
+ * - With `base`: resolves against it and verifies the result stays inside.
+ * - Without `base`: resolves against `cwd` and rejects inputs whose segments
+ *   walk above the resolution root (absolute paths are allowed as-is since
+ *   only the caller knows what "above" means for them).
+ *
+ * Shared by `octoflow-core` built-ins and `octoflow-tools` presets so
+ * traversal fixes propagate across both packages.
+ */
+export declare function safePath(input: string, opts?: SafePathOptions): string;
+//# sourceMappingURL=safe-path.d.ts.map

package/dist/utils/safe-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-path.d.ts","sourceRoot":"","sources":["../../src/utils/safe-path.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,kBAAmB,SAAQ,aAAa;gBACvC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAQ1C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,MAAM,CAmC1E"}

package/dist/utils/safe-path.js

@@ -0,0 +1,49 @@
+import path from "node:path";
+import { OctoFlowError } from "../domain/errors/base.js";
+class PathTraversalError extends OctoFlowError {
+  constructor(input, reason) {
+    super(
+      "PATH_TRAVERSAL_DENIED",
+      `Path traversal denied: ${input} (${reason})`,
+      { input, reason }
+    );
+    this.name = "PathTraversalError";
+  }
+}
+function safePath(input, opts = {}) {
+  if (typeof input !== "string" || input.length === 0) {
+    throw new PathTraversalError(String(input), "empty path");
+  }
+  if (input.includes("\0")) {
+    throw new PathTraversalError(input, "null byte");
+  }
+  if (opts.base) {
+    const baseResolved = path.resolve(opts.base);
+    const resolved = path.resolve(baseResolved, input);
+    const rel = path.relative(baseResolved, resolved);
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+      throw new PathTraversalError(input, `escapes base ${baseResolved}`);
+    }
+    return resolved;
+  }
+  if (!path.isAbsolute(input)) {
+    const segments = input.split(/[\\/]+/);
+    let depth = 0;
+    for (const seg of segments) {
+      if (seg === "..") {
+        depth--;
+        if (depth < 0) {
+          throw new PathTraversalError(input, "climbs above cwd");
+        }
+      } else if (seg && seg !== ".") {
+        depth++;
+      }
+    }
+  }
+  return path.resolve(input);
+}
+export {
+  PathTraversalError,
+  safePath
+};
+//# sourceMappingURL=safe-path.js.map

package/dist/utils/safe-path.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/safe-path.ts"],
+  "sourcesContent": ["import path from 'node:path';\n\nimport { OctoFlowError } from '../domain/errors/base.js';\n\nexport interface SafePathOptions {\n  /**\n   * Root directory. When provided, the resolved path must be inside it \u2014\n   * otherwise `safePath` throws `PathTraversalError`.\n   */\n  readonly base?: string;\n}\n\nexport class PathTraversalError extends OctoFlowError {\n  constructor(input: string, reason: string) {\n    super(\n      'PATH_TRAVERSAL_DENIED',\n      `Path traversal denied: ${input} (${reason})`,\n      { input, reason }\n    );\n    this.name = 'PathTraversalError';\n  }\n}\n\n/**\n * Resolve a user-supplied path and reject traversal attempts.\n *\n * - With `base`: resolves against it and verifies the result stays inside.\n * - Without `base`: resolves against `cwd` and rejects inputs whose segments\n *   walk above the resolution root (absolute paths are allowed as-is since\n *   only the caller knows what \"above\" means for them).\n *\n * Shared by `octoflow-core` built-ins and `octoflow-tools` presets so\n * traversal fixes propagate across both packages.\n */\nexport function safePath(input: string, opts: SafePathOptions = {}): string {\n  if (typeof input !== 'string' || input.length === 0) {\n    throw new PathTraversalError(String(input), 'empty path');\n  }\n\n  if (input.includes('\\0')) {\n    throw new PathTraversalError(input, 'null byte');\n  }\n\n  if (opts.base) {\n    const baseResolved = path.resolve(opts.base);\n    const resolved = path.resolve(baseResolved, input);\n    const rel = path.relative(baseResolved, resolved);\n    if (rel.startsWith('..') || path.isAbsolute(rel)) {\n      throw new PathTraversalError(input, `escapes base ${baseResolved}`);\n    }\n    return resolved;\n  }\n\n  if (!path.isAbsolute(input)) {\n    const segments = input.split(/[\\\\/]+/);\n    let depth = 0;\n    for (const seg of segments) {\n      if (seg === '..') {\n        depth--;\n        if (depth < 0) {\n          throw new PathTraversalError(input, 'climbs above cwd');\n        }\n      } else if (seg && seg !== '.') {\n        depth++;\n      }\n    }\n  }\n\n  return path.resolve(input);\n}\n"],
+  "mappings": "AAAA,OAAO,UAAU;AAEjB,SAAS,qBAAqB;AAUvB,MAAM,2BAA2B,cAAc;AAAA,EACpD,YAAY,OAAe,QAAgB;AACzC;AAAA,MACE;AAAA,MACA,0BAA0B,KAAK,KAAK,MAAM;AAAA,MAC1C,EAAE,OAAO,OAAO;AAAA,IAClB;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAaO,SAAS,SAAS,OAAe,OAAwB,CAAC,GAAW;AAC1E,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG;AACnD,UAAM,IAAI,mBAAmB,OAAO,KAAK,GAAG,YAAY;AAAA,EAC1D;AAEA,MAAI,MAAM,SAAS,IAAI,GAAG;AACxB,UAAM,IAAI,mBAAmB,OAAO,WAAW;AAAA,EACjD;AAEA,MAAI,KAAK,MAAM;AACb,UAAM,eAAe,KAAK,QAAQ,KAAK,IAAI;AAC3C,UAAM,WAAW,KAAK,QAAQ,cAAc,KAAK;AACjD,UAAM,MAAM,KAAK,SAAS,cAAc,QAAQ;AAChD,QAAI,IAAI,WAAW,IAAI,KAAK,KAAK,WAAW,GAAG,GAAG;AAChD,YAAM,IAAI,mBAAmB,OAAO,gBAAgB,YAAY,EAAE;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,KAAK,WAAW,KAAK,GAAG;AAC3B,UAAM,WAAW,MAAM,MAAM,QAAQ;AACrC,QAAI,QAAQ;AACZ,eAAW,OAAO,UAAU;AAC1B,UAAI,QAAQ,MAAM;AAChB;AACA,YAAI,QAAQ,GAAG;AACb,gBAAM,IAAI,mBAAmB,OAAO,kBAAkB;AAAA,QACxD;AAAA,MACF,WAAW,OAAO,QAAQ,KAAK;AAC7B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,KAAK,QAAQ,KAAK;AAC3B;",
+  "names": []
+}

package/dist/utils/sanitize.d.ts

@@ -0,0 +1,11 @@
+export declare function sanitizePath(p: string): string | null;
+export declare function redactSecrets(value: string, env?: NodeJS.ProcessEnv): string;
+export declare function sanitizeErrorMessage(value: string, env?: NodeJS.ProcessEnv): string;
+/**
+ * Recursively redact secrets from structured data.
+ * Key-pattern detection reuses SENSITIVE_ENV_NAME; JWT-shaped string values
+ * are redacted regardless of key name; leaf strings under secret-looking keys
+ * are passed through redactSecrets() for consistent handling.
+ */
+export declare function sanitizeRecord(data: unknown, env?: NodeJS.ProcessEnv): unknown;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/utils/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/utils/sanitize.ts"],"names":[],"mappings":"AA6BA,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIrD;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAsBR;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAER;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,OAAO,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAsBT"}

package/dist/utils/sanitize.js

@@ -0,0 +1,67 @@
+const SHELL_META = /[;|&`$(){}\n\r\\!#<>]/;
+const SENSITIVE_ENV_NAME = /(?:^|_)(?:api[_-]?key|token|secret|password|authorization|cookie|credential)(?:_|$)/i;
+const STRUCTURED_SECRET = /(["']?(?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|secret|password|authorization|cookie|credential)["']?\s*[:=]\s*["']?)([^"',\s}]+)/gi;
+const ENV_ASSIGNMENT_SECRET = /\b([A-Z][A-Z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD|AUTHORIZATION|COOKIE|CREDENTIAL)[A-Z0-9_]*)=([^\s]+)/g;
+const RAW_SECRET_PATTERNS = [
+  /\bBearer\s+[-A-Za-z0-9._~+/]{6,}\b/gi,
+  /\bsk-[A-Za-z0-9_-]{8,}\b/g,
+  /\bgh[pousr]_[A-Za-z0-9]{8,}\b/g,
+  /\bAIza[0-9A-Za-z_-]{20,}\b/g
+];
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function collectSensitiveValues(env) {
+  return Object.entries(env).filter(
+    ([key, value]) => SENSITIVE_ENV_NAME.test(key) && typeof value === "string" && value.length >= 6
+  ).map(([, value]) => value);
+}
+function sanitizePath(p) {
+  if (!p) return null;
+  if (SHELL_META.test(p)) return null;
+  return p;
+}
+function redactSecrets(value, env = process.env) {
+  if (!value) return value;
+  let redacted = value;
+  for (const pattern of RAW_SECRET_PATTERNS) {
+    redacted = redacted.replace(pattern, "[REDACTED]");
+  }
+  redacted = redacted.replace(STRUCTURED_SECRET, "$1[REDACTED]").replace(ENV_ASSIGNMENT_SECRET, "$1=[REDACTED]");
+  for (const secret of collectSensitiveValues(env)) {
+    redacted = redacted.replace(
+      new RegExp(escapeRegExp(secret), "g"),
+      "[REDACTED]"
+    );
+  }
+  return redacted;
+}
+function sanitizeErrorMessage(value, env = process.env) {
+  return redactSecrets(value, env);
+}
+const JWT_PATTERN = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/;
+function sanitizeRecord(data, env = process.env) {
+  return walk(data, null);
+  function walk(value, key) {
+    if (value === null || value === void 0) return value;
+    if (typeof value === "string") {
+      if (JWT_PATTERN.test(value)) return "[REDACTED]";
+      if (key !== null && SENSITIVE_ENV_NAME.test(key)) return "[REDACTED]";
+      return redactSecrets(value, env);
+    }
+    if (typeof value !== "object") return value;
+    if (Array.isArray(value)) return value.map((item) => walk(item, null));
+    const result = {};
+    for (const [k, v] of Object.entries(value)) {
+      result[k] = walk(v, k);
+    }
+    return result;
+  }
+}
+export {
+  redactSecrets,
+  sanitizeErrorMessage,
+  sanitizePath,
+  sanitizeRecord
+};
+//# sourceMappingURL=sanitize.js.map

package/dist/utils/sanitize.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/sanitize.ts"],
+  "sourcesContent": ["const SHELL_META = /[;|&`$(){}\\n\\r\\\\!#<>]/;\nconst SENSITIVE_ENV_NAME =\n  /(?:^|_)(?:api[_-]?key|token|secret|password|authorization|cookie|credential)(?:_|$)/i;\nconst STRUCTURED_SECRET =\n  /([\"']?(?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|secret|password|authorization|cookie|credential)[\"']?\\s*[:=]\\s*[\"']?)([^\"',\\s}]+)/gi;\nconst ENV_ASSIGNMENT_SECRET =\n  /\\b([A-Z][A-Z0-9_]*(?:API_KEY|TOKEN|SECRET|PASSWORD|AUTHORIZATION|COOKIE|CREDENTIAL)[A-Z0-9_]*)=([^\\s]+)/g;\nconst RAW_SECRET_PATTERNS = [\n  /\\bBearer\\s+[-A-Za-z0-9._~+/]{6,}\\b/gi,\n  /\\bsk-[A-Za-z0-9_-]{8,}\\b/g,\n  /\\bgh[pousr]_[A-Za-z0-9]{8,}\\b/g,\n  /\\bAIza[0-9A-Za-z_-]{20,}\\b/g,\n];\n\nfunction escapeRegExp(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\nfunction collectSensitiveValues(env: NodeJS.ProcessEnv): string[] {\n  return Object.entries(env)\n    .filter(\n      ([key, value]) =>\n        SENSITIVE_ENV_NAME.test(key) &&\n        typeof value === 'string' &&\n        value.length >= 6\n    )\n    .map(([, value]) => value as string);\n}\n\nexport function sanitizePath(p: string): string | null {\n  if (!p) return null;\n  if (SHELL_META.test(p)) return null;\n  return p;\n}\n\nexport function redactSecrets(\n  value: string,\n  env: NodeJS.ProcessEnv = process.env\n): string {\n  if (!value) return value;\n\n  // Raw well-known token formats first so STRUCTURED_SECRET can't mask them\n  // by treating a scheme keyword (e.g. \"Bearer\") as the captured value.\n  let redacted = value;\n  for (const pattern of RAW_SECRET_PATTERNS) {\n    redacted = redacted.replace(pattern, '[REDACTED]');\n  }\n\n  redacted = redacted\n    .replace(STRUCTURED_SECRET, '$1[REDACTED]')\n    .replace(ENV_ASSIGNMENT_SECRET, '$1=[REDACTED]');\n\n  for (const secret of collectSensitiveValues(env)) {\n    redacted = redacted.replace(\n      new RegExp(escapeRegExp(secret), 'g'),\n      '[REDACTED]'\n    );\n  }\n\n  return redacted;\n}\n\nexport function sanitizeErrorMessage(\n  value: string,\n  env: NodeJS.ProcessEnv = process.env\n): string {\n  return redactSecrets(value, env);\n}\n\nconst JWT_PATTERN = /^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/;\n\n/**\n * Recursively redact secrets from structured data.\n * Key-pattern detection reuses SENSITIVE_ENV_NAME; JWT-shaped string values\n * are redacted regardless of key name; leaf strings under secret-looking keys\n * are passed through redactSecrets() for consistent handling.\n */\nexport function sanitizeRecord(\n  data: unknown,\n  env: NodeJS.ProcessEnv = process.env\n): unknown {\n  return walk(data, null);\n\n  function walk(value: unknown, key: string | null): unknown {\n    if (value === null || value === undefined) return value;\n\n    if (typeof value === 'string') {\n      if (JWT_PATTERN.test(value)) return '[REDACTED]';\n      if (key !== null && SENSITIVE_ENV_NAME.test(key)) return '[REDACTED]';\n      return redactSecrets(value, env);\n    }\n\n    if (typeof value !== 'object') return value;\n\n    if (Array.isArray(value)) return value.map((item) => walk(item, null));\n\n    const result: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n      result[k] = walk(v, k);\n    }\n    return result;\n  }\n}\n"],
+  "mappings": "AAAA,MAAM,aAAa;AACnB,MAAM,qBACJ;AACF,MAAM,oBACJ;AACF,MAAM,wBACJ;AACF,MAAM,sBAAsB;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,aAAa,OAAuB;AAC3C,SAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD;AAEA,SAAS,uBAAuB,KAAkC;AAChE,SAAO,OAAO,QAAQ,GAAG,EACtB;AAAA,IACC,CAAC,CAAC,KAAK,KAAK,MACV,mBAAmB,KAAK,GAAG,KAC3B,OAAO,UAAU,YACjB,MAAM,UAAU;AAAA,EACpB,EACC,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,KAAe;AACvC;AAEO,SAAS,aAAa,GAA0B;AACrD,MAAI,CAAC,EAAG,QAAO;AACf,MAAI,WAAW,KAAK,CAAC,EAAG,QAAO;AAC/B,SAAO;AACT;AAEO,SAAS,cACd,OACA,MAAyB,QAAQ,KACzB;AACR,MAAI,CAAC,MAAO,QAAO;AAInB,MAAI,WAAW;AACf,aAAW,WAAW,qBAAqB;AACzC,eAAW,SAAS,QAAQ,SAAS,YAAY;AAAA,EACnD;AAEA,aAAW,SACR,QAAQ,mBAAmB,cAAc,EACzC,QAAQ,uBAAuB,eAAe;AAEjD,aAAW,UAAU,uBAAuB,GAAG,GAAG;AAChD,eAAW,SAAS;AAAA,MAClB,IAAI,OAAO,aAAa,MAAM,GAAG,GAAG;AAAA,MACpC;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,qBACd,OACA,MAAyB,QAAQ,KACzB;AACR,SAAO,cAAc,OAAO,GAAG;AACjC;AAEA,MAAM,cAAc;AAQb,SAAS,eACd,MACA,MAAyB,QAAQ,KACxB;AACT,SAAO,KAAK,MAAM,IAAI;AAEtB,WAAS,KAAK,OAAgB,KAA6B;AACzD,QAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAElD,QAAI,OAAO,UAAU,UAAU;AAC7B,UAAI,YAAY,KAAK,KAAK,EAAG,QAAO;AACpC,UAAI,QAAQ,QAAQ,mBAAmB,KAAK,GAAG,EAAG,QAAO;AACzD,aAAO,cAAc,OAAO,GAAG;AAAA,IACjC;AAEA,QAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,CAAC;AAErE,UAAM,SAAkC,CAAC;AACzC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAgC,GAAG;AACrE,aAAO,CAAC,IAAI,KAAK,GAAG,CAAC;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/utils/signals.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Composes multiple AbortSignals into a single signal that aborts
+ * when ANY of the input signals abort.
+ *
+ * If any input signal is already aborted at call time, the returned
+ * signal is immediately aborted.
+ */
+export declare function composeSignals(...signals: AbortSignal[]): AbortSignal;
+//# sourceMappingURL=signals.d.ts.map

package/dist/utils/signals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signals.d.ts","sourceRoot":"","sources":["../../src/utils/signals.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,OAAO,EAAE,WAAW,EAAE,GAAG,WAAW,CAYrE"}

package/dist/utils/signals.js

@@ -0,0 +1,17 @@
+function composeSignals(...signals) {
+  const controller = new AbortController();
+  for (const signal of signals) {
+    if (signal.aborted) {
+      controller.abort(signal.reason);
+      return controller.signal;
+    }
+    signal.addEventListener("abort", () => controller.abort(signal.reason), {
+      once: true
+    });
+  }
+  return controller.signal;
+}
+export {
+  composeSignals
+};
+//# sourceMappingURL=signals.js.map

package/dist/utils/signals.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/signals.ts"],
+  "sourcesContent": ["/**\n * Composes multiple AbortSignals into a single signal that aborts\n * when ANY of the input signals abort.\n *\n * If any input signal is already aborted at call time, the returned\n * signal is immediately aborted.\n */\nexport function composeSignals(...signals: AbortSignal[]): AbortSignal {\n  const controller = new AbortController();\n  for (const signal of signals) {\n    if (signal.aborted) {\n      controller.abort(signal.reason);\n      return controller.signal;\n    }\n    signal.addEventListener('abort', () => controller.abort(signal.reason), {\n      once: true,\n    });\n  }\n  return controller.signal;\n}\n"],
+  "mappings": "AAOO,SAAS,kBAAkB,SAAqC;AACrE,QAAM,aAAa,IAAI,gBAAgB;AACvC,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,SAAS;AAClB,iBAAW,MAAM,OAAO,MAAM;AAC9B,aAAO,WAAW;AAAA,IACpB;AACA,WAAO,iBAAiB,SAAS,MAAM,WAAW,MAAM,OAAO,MAAM,GAAG;AAAA,MACtE,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,WAAW;AACpB;",
+  "names": []
+}

package/dist/utils/stream-channel.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Push-based async channel that bridges synchronous event producers
+ * (e.g. observer callbacks) to async generator consumers.
+ *
+ * Pattern extracted from `pack/helpers.ts:mergePackEvents` for reuse
+ * across agent streaming, batch streaming, and any producer/consumer flow.
+ */
+export declare class StreamChannel<T> {
+    private buffer;
+    private resolveNext;
+    private closed;
+    push(item: T): void;
+    close(): void;
+    get isClosed(): boolean;
+    [Symbol.asyncIterator](): AsyncGenerator<T>;
+}
+//# sourceMappingURL=stream-channel.d.ts.map

package/dist/utils/stream-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-channel.d.ts","sourceRoot":"","sources":["../../src/utils/stream-channel.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,qBAAa,aAAa,CAAC,CAAC;IAC1B,OAAO,CAAC,MAAM,CAAW;IACzB,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,MAAM,CAAS;IAEvB,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI;IAOnB,KAAK,IAAI,IAAI;IAMb,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAEM,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC;CAWnD"}

package/dist/utils/stream-channel.js

@@ -0,0 +1,34 @@
+class StreamChannel {
+  buffer = [];
+  resolveNext = null;
+  closed = false;
+  push(item) {
+    if (this.closed) return;
+    this.buffer.push(item);
+    this.resolveNext?.();
+    this.resolveNext = null;
+  }
+  close() {
+    this.closed = true;
+    this.resolveNext?.();
+    this.resolveNext = null;
+  }
+  get isClosed() {
+    return this.closed;
+  }
+  async *[Symbol.asyncIterator]() {
+    while (!this.closed || this.buffer.length > 0) {
+      if (this.buffer.length > 0) {
+        yield this.buffer.shift();
+      } else if (!this.closed) {
+        await new Promise((r) => {
+          this.resolveNext = r;
+        });
+      }
+    }
+  }
+}
+export {
+  StreamChannel
+};
+//# sourceMappingURL=stream-channel.js.map

package/dist/utils/stream-channel.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/stream-channel.ts"],
+  "sourcesContent": ["/**\n * Push-based async channel that bridges synchronous event producers\n * (e.g. observer callbacks) to async generator consumers.\n *\n * Pattern extracted from `pack/helpers.ts:mergePackEvents` for reuse\n * across agent streaming, batch streaming, and any producer/consumer flow.\n */\nexport class StreamChannel<T> {\n  private buffer: T[] = [];\n  private resolveNext: (() => void) | null = null;\n  private closed = false;\n\n  push(item: T): void {\n    if (this.closed) return;\n    this.buffer.push(item);\n    this.resolveNext?.();\n    this.resolveNext = null;\n  }\n\n  close(): void {\n    this.closed = true;\n    this.resolveNext?.();\n    this.resolveNext = null;\n  }\n\n  get isClosed(): boolean {\n    return this.closed;\n  }\n\n  async *[Symbol.asyncIterator](): AsyncGenerator<T> {\n    while (!this.closed || this.buffer.length > 0) {\n      if (this.buffer.length > 0) {\n        yield this.buffer.shift()!;\n      } else if (!this.closed) {\n        await new Promise<void>((r) => {\n          this.resolveNext = r;\n        });\n      }\n    }\n  }\n}\n"],
+  "mappings": "AAOO,MAAM,cAAiB;AAAA,EACpB,SAAc,CAAC;AAAA,EACf,cAAmC;AAAA,EACnC,SAAS;AAAA,EAEjB,KAAK,MAAe;AAClB,QAAI,KAAK,OAAQ;AACjB,SAAK,OAAO,KAAK,IAAI;AACrB,SAAK,cAAc;AACnB,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,QAAc;AACZ,SAAK,SAAS;AACd,SAAK,cAAc;AACnB,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,IAAI,WAAoB;AACtB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,QAAQ,OAAO,aAAa,IAAuB;AACjD,WAAO,CAAC,KAAK,UAAU,KAAK,OAAO,SAAS,GAAG;AAC7C,UAAI,KAAK,OAAO,SAAS,GAAG;AAC1B,cAAM,KAAK,OAAO,MAAM;AAAA,MAC1B,WAAW,CAAC,KAAK,QAAQ;AACvB,cAAM,IAAI,QAAc,CAAC,MAAM;AAC7B,eAAK,cAAc;AAAA,QACrB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/utils/sync-promise.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Wrap a synchronous function as a `Promise`.
+ *
+ * Use when implementing an async interface with a sync backend (in-memory
+ * stores, synchronous drivers like better-sqlite3) — preserves the invariant
+ * that errors surface as promise rejections instead of synchronous throws.
+ */
+export declare function syncPromise<T>(fn: () => T): Promise<T>;
+//# sourceMappingURL=sync-promise.d.ts.map

package/dist/utils/sync-promise.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-promise.d.ts","sourceRoot":"","sources":["../../src/utils/sync-promise.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAMtD"}

package/dist/utils/sync-promise.js

@@ -0,0 +1,11 @@
+function syncPromise(fn) {
+  try {
+    return Promise.resolve(fn());
+  } catch (err) {
+    return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+  }
+}
+export {
+  syncPromise
+};
+//# sourceMappingURL=sync-promise.js.map

package/dist/utils/sync-promise.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/sync-promise.ts"],
+  "sourcesContent": ["/**\n * Wrap a synchronous function as a `Promise`.\n *\n * Use when implementing an async interface with a sync backend (in-memory\n * stores, synchronous drivers like better-sqlite3) \u2014 preserves the invariant\n * that errors surface as promise rejections instead of synchronous throws.\n */\nexport function syncPromise<T>(fn: () => T): Promise<T> {\n  try {\n    return Promise.resolve(fn());\n  } catch (err) {\n    return Promise.reject(err instanceof Error ? err : new Error(String(err)));\n  }\n}\n"],
+  "mappings": "AAOO,SAAS,YAAe,IAAyB;AACtD,MAAI;AACF,WAAO,QAAQ,QAAQ,GAAG,CAAC;AAAA,EAC7B,SAAS,KAAK;AACZ,WAAO,QAAQ,OAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,EAC3E;AACF;",
+  "names": []
+}

package/dist/utils/time.d.ts

@@ -0,0 +1,3 @@
+export declare function nowIso(): string;
+export declare function sleep(ms: number): Promise<void>;
+//# sourceMappingURL=time.d.ts.map

package/dist/utils/time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../src/utils/time.ts"],"names":[],"mappings":"AAAA,wBAAgB,MAAM,IAAI,MAAM,CAE/B;AAED,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C"}

package/dist/utils/time.js

@@ -0,0 +1,11 @@
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export {
+  nowIso,
+  sleep
+};
+//# sourceMappingURL=time.js.map

package/dist/utils/time.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/time.ts"],
+  "sourcesContent": ["export function nowIso(): string {\n  return new Date().toISOString();\n}\n\nexport function sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n"],
+  "mappings": "AAAO,SAAS,SAAiB;AAC/B,UAAO,oBAAI,KAAK,GAAE,YAAY;AAChC;AAEO,SAAS,MAAM,IAA2B;AAC/C,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;",
+  "names": []
+}

package/dist/utils/timeout.d.ts

@@ -0,0 +1,9 @@
+type FetchLike = typeof globalThis.fetch;
+/**
+ * Wraps a fetch implementation with a combined timeout + external AbortSignal.
+ * Returns the original fetch unchanged if neither timeout nor external signal is provided.
+ * Correctly removes the external signal listener in `finally` to prevent stale callbacks.
+ */
+export declare function buildFetchWithTimeout(baseFetch: FetchLike | undefined, timeoutMs: number | undefined, externalSignal?: AbortSignal): FetchLike;
+export {};
+//# sourceMappingURL=timeout.d.ts.map

package/dist/utils/timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeout.d.ts","sourceRoot":"","sources":["../../src/utils/timeout.ts"],"names":[],"mappings":"AAAA,KAAK,SAAS,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC;AAEzC;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,cAAc,CAAC,EAAE,WAAW,GAC3B,SAAS,CA0BX"}

package/dist/utils/timeout.js

@@ -0,0 +1,26 @@
+function buildFetchWithTimeout(baseFetch, timeoutMs, externalSignal) {
+  if (!timeoutMs && !externalSignal) return baseFetch ?? globalThis.fetch;
+  const fetchImpl = baseFetch ?? globalThis.fetch;
+  return async (input, init) => {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    if (externalSignal) {
+      if (externalSignal.aborted) {
+        controller.abort();
+      } else {
+        externalSignal.addEventListener("abort", abort, { once: true });
+      }
+    }
+    const timer = timeoutMs ? setTimeout(abort, timeoutMs) : null;
+    try {
+      return await fetchImpl(input, { ...init, signal: controller.signal });
+    } finally {
+      if (timer) clearTimeout(timer);
+      externalSignal?.removeEventListener("abort", abort);
+    }
+  };
+}
+export {
+  buildFetchWithTimeout
+};
+//# sourceMappingURL=timeout.js.map

package/dist/utils/timeout.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/timeout.ts"],
+  "sourcesContent": ["type FetchLike = typeof globalThis.fetch;\n\n/**\n * Wraps a fetch implementation with a combined timeout + external AbortSignal.\n * Returns the original fetch unchanged if neither timeout nor external signal is provided.\n * Correctly removes the external signal listener in `finally` to prevent stale callbacks.\n */\nexport function buildFetchWithTimeout(\n  baseFetch: FetchLike | undefined,\n  timeoutMs: number | undefined,\n  externalSignal?: AbortSignal\n): FetchLike {\n  if (!timeoutMs && !externalSignal) return baseFetch ?? globalThis.fetch;\n\n  const fetchImpl = baseFetch ?? globalThis.fetch;\n\n  return async (input, init) => {\n    const controller = new AbortController();\n    const abort = () => controller.abort();\n\n    if (externalSignal) {\n      if (externalSignal.aborted) {\n        controller.abort();\n      } else {\n        externalSignal.addEventListener('abort', abort, { once: true });\n      }\n    }\n\n    const timer = timeoutMs ? setTimeout(abort, timeoutMs) : null;\n\n    try {\n      return await fetchImpl(input, { ...init, signal: controller.signal });\n    } finally {\n      if (timer) clearTimeout(timer);\n      externalSignal?.removeEventListener('abort', abort);\n    }\n  };\n}\n"],
+  "mappings": "AAOO,SAAS,sBACd,WACA,WACA,gBACW;AACX,MAAI,CAAC,aAAa,CAAC,eAAgB,QAAO,aAAa,WAAW;AAElE,QAAM,YAAY,aAAa,WAAW;AAE1C,SAAO,OAAO,OAAO,SAAS;AAC5B,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,MAAM,WAAW,MAAM;AAErC,QAAI,gBAAgB;AAClB,UAAI,eAAe,SAAS;AAC1B,mBAAW,MAAM;AAAA,MACnB,OAAO;AACL,uBAAe,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AAAA,MAChE;AAAA,IACF;AAEA,UAAM,QAAQ,YAAY,WAAW,OAAO,SAAS,IAAI;AAEzD,QAAI;AACF,aAAO,MAAM,UAAU,OAAO,EAAE,GAAG,MAAM,QAAQ,WAAW,OAAO,CAAC;AAAA,IACtE,UAAE;AACA,UAAI,MAAO,cAAa,KAAK;AAC7B,sBAAgB,oBAAoB,SAAS,KAAK;AAAA,IACpD;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/utils/token-estimator.d.ts

@@ -0,0 +1,18 @@
+import type { TokenEstimator } from '../domain/harness-shared.js';
+export declare const defaultTokenEstimator: TokenEstimator;
+/**
+ * Create a token estimator backed by tiktoken.
+ * Falls back to the default chars/4 heuristic when tiktoken is unavailable.
+ *
+ */
+export declare function tiktokenEstimator(encoding?: string): TokenEstimator;
+/**
+ * Probe whether `tiktoken` is available in the current runtime without
+ * creating a long-lived encoder. Used at bridge init to decide whether to emit
+ * a heuristic-fallback warning.
+ */
+export declare function probeTiktoken(encoding?: string): {
+    available: boolean;
+    error?: string;
+};
+//# sourceMappingURL=token-estimator.d.ts.map

package/dist/utils/token-estimator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-estimator.d.ts","sourceRoot":"","sources":["../../src/utils/token-estimator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAyBlE,eAAO,MAAM,qBAAqB,EAAE,cACc,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,SAAgB,GAAG,cAAc,CAmB1E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,SAAgB,GAAG;IACvD,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAeA"}