patchwork-os 0.2.0-beta.1 → 0.2.0-beta.10.canary.95

package/dist/connectors/woocommerce.js

@@ -0,0 +1,464 @@
+/**
+ * WooCommerce connector — access to WooCommerce store data via the WooCommerce REST API v3.
+ *
+ * Auth: HTTP Basic auth with consumer key/secret.
+ *   - Env vars: WOOCOMMERCE_CONSUMER_KEY, WOOCOMMERCE_CONSUMER_SECRET, WOOCOMMERCE_STORE_URL
+ *   - Stored: getSecretJsonSync("woocommerce") → WooCommerceTokens
+ *
+ * Tools: getOrders, getOrder, updateOrder, getProducts, getProduct, updateProduct,
+ *        getProductVariations, getCustomers, getCustomer, listWebhooks, createWebhook,
+ *        deleteWebhook, getReportsSales
+ *
+ * Extends BaseConnector for unified auth, retry, rate-limit, error handling.
+ */
+import { createHmac } from "node:crypto";
+import { BaseConnector, } from "./baseConnector.js";
+import { deleteSecretJsonSync, getSecretJsonSync, storeSecretJsonSync, } from "./tokenStorage.js";
+// ── Token persistence ─────────────────────────────────────────────────────────
+export function loadTokens() {
+    const key = process.env.WOOCOMMERCE_CONSUMER_KEY;
+    const secret = process.env.WOOCOMMERCE_CONSUMER_SECRET;
+    const storeUrl = process.env.WOOCOMMERCE_STORE_URL;
+    if (key && secret && storeUrl) {
+        return {
+            consumerKey: key,
+            consumerSecret: secret,
+            storeUrl: storeUrl.replace(/\/$/, ""),
+            connected_at: new Date().toISOString(),
+        };
+    }
+    return getSecretJsonSync("woocommerce");
+}
+export function saveTokens(tokens) {
+    storeSecretJsonSync("woocommerce", tokens);
+}
+export function clearTokens() {
+    try {
+        deleteSecretJsonSync("woocommerce");
+    }
+    catch {
+        // ignore
+    }
+}
+// ── Webhook verification ──────────────────────────────────────────────────────
+/**
+ * Verify an incoming WooCommerce webhook.
+ * WooCommerce signs with HMAC-SHA256 over the raw body using the webhook secret,
+ * then base64-encodes the digest. Delivered in X-WC-Webhook-Signature header.
+ */
+export function verifyWooCommerceWebhook(rawBody, signatureHeader, secret) {
+    if (!signatureHeader || !secret)
+        return false;
+    const computed = createHmac("sha256", secret)
+        .update(rawBody)
+        .digest("base64");
+    if (computed.length !== signatureHeader.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < computed.length; i++) {
+        diff |= computed.charCodeAt(i) ^ signatureHeader.charCodeAt(i);
+    }
+    return diff === 0;
+}
+// ── Connector class ───────────────────────────────────────────────────────────
+export class WooCommerceConnector extends BaseConnector {
+    providerName = "woocommerce";
+    tokens = null;
+    getOAuthConfig() {
+        return null;
+    }
+    async authenticate() {
+        const tokens = loadTokens();
+        if (!tokens) {
+            throw new Error("WooCommerce not connected. Run: patchwork connect woocommerce or set WOOCOMMERCE_CONSUMER_KEY, WOOCOMMERCE_CONSUMER_SECRET, WOOCOMMERCE_STORE_URL");
+        }
+        this.tokens = tokens;
+        return {
+            token: Buffer.from(`${tokens.consumerKey}:${tokens.consumerSecret}`).toString("base64"),
+        };
+    }
+    async healthCheck() {
+        try {
+            const result = await this.apiCall(async () => {
+                const res = await fetch(this.baseUrl("/system_status"), {
+                    headers: this.buildHeaders(),
+                });
+                if (!res.ok)
+                    throw res;
+                return res.json();
+            });
+            if ("error" in result)
+                return { ok: false, error: result.error };
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: this.normalizeError(err) };
+        }
+    }
+    normalizeError(error) {
+        // WooCommerce REST errors: { code, message, data: { status } }
+        if (error &&
+            typeof error === "object" &&
+            "code" in error &&
+            "message" in error &&
+            !(error instanceof Response)) {
+            const wooErr = error;
+            const status = wooErr.data?.status ?? 0;
+            if (status === 401 ||
+                wooErr.code === "woocommerce_rest_authentication_error") {
+                return {
+                    code: "auth_expired",
+                    message: "WooCommerce authentication failed — check consumer key/secret",
+                    retryable: false,
+                    suggestedAction: "patchwork connect woocommerce",
+                };
+            }
+            if (status === 429) {
+                return {
+                    code: "rate_limited",
+                    message: "WooCommerce API rate limit exceeded",
+                    retryable: true,
+                    suggestedAction: "Wait and retry",
+                };
+            }
+            if (status === 404) {
+                return { code: "not_found", message: wooErr.message, retryable: false };
+            }
+            if (status === 400) {
+                return {
+                    code: "validation_error",
+                    message: wooErr.message,
+                    retryable: false,
+                };
+            }
+            return {
+                code: "provider_error",
+                message: wooErr.message,
+                retryable: status >= 500,
+            };
+        }
+        if (error instanceof Response ||
+            (error && typeof error === "object" && "status" in error)) {
+            const s = error.status;
+            if (s === 401)
+                return {
+                    code: "auth_expired",
+                    message: "WooCommerce authentication expired",
+                    retryable: false,
+                    suggestedAction: "patchwork connect woocommerce",
+                };
+            if (s === 429)
+                return {
+                    code: "rate_limited",
+                    message: "WooCommerce API rate limit exceeded",
+                    retryable: true,
+                };
+            if (s === 404)
+                return {
+                    code: "not_found",
+                    message: "WooCommerce resource not found",
+                    retryable: false,
+                };
+            if (s === 400)
+                return {
+                    code: "validation_error",
+                    message: `WooCommerce validation error: HTTP ${s}`,
+                    retryable: false,
+                };
+            return {
+                code: "provider_error",
+                message: `WooCommerce API error: HTTP ${s}`,
+                retryable: s >= 500,
+            };
+        }
+        if (error instanceof Error) {
+            if (error.message.includes("ENOTFOUND") ||
+                error.message.includes("ECONNREFUSED")) {
+                return {
+                    code: "network_error",
+                    message: `Cannot connect to WooCommerce store: ${error.message}`,
+                    retryable: true,
+                };
+            }
+        }
+        return {
+            code: "provider_error",
+            message: error instanceof Error ? error.message : String(error),
+            retryable: false,
+        };
+    }
+    getStatus() {
+        const tokens = loadTokens();
+        return {
+            id: "woocommerce",
+            status: tokens ? "connected" : "disconnected",
+            lastSync: tokens?.connected_at,
+            workspace: tokens?.storeUrl,
+        };
+    }
+    // ── API helpers ────────────────────────────────────────────────────────────
+    baseUrl(path) {
+        const storeUrl = this.tokens?.storeUrl ?? "";
+        return `${storeUrl}/wp-json/wc/v3${path}`;
+    }
+    buildHeaders() {
+        const creds = this.tokens
+            ? Buffer.from(`${this.tokens.consumerKey}:${this.tokens.consumerSecret}`).toString("base64")
+            : "";
+        return {
+            Authorization: `Basic ${creds}`,
+            "Content-Type": "application/json",
+            Accept: "application/json",
+        };
+    }
+    async request(method, path, body) {
+        const result = await this.apiCall(async () => {
+            const res = await fetch(this.baseUrl(path), {
+                method,
+                headers: this.buildHeaders(),
+                body: body !== undefined ? JSON.stringify(body) : undefined,
+            });
+            if (!res.ok) {
+                const errBody = (await res.json().catch(() => ({})));
+                throw Object.assign(new Error(errBody.message ?? `HTTP ${res.status}`), {
+                    code: errBody.code ?? "provider_error",
+                    data: errBody.data ?? { status: res.status },
+                });
+            }
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    // ── Orders ────────────────────────────────────────────────────────────────
+    async getOrders(params = {}) {
+        const qs = new URLSearchParams();
+        if (params.status)
+            qs.set("status", params.status);
+        if (params.perPage)
+            qs.set("per_page", String(params.perPage));
+        if (params.page)
+            qs.set("page", String(params.page));
+        if (params.after)
+            qs.set("after", params.after);
+        if (params.before)
+            qs.set("before", params.before);
+        return this.request("GET", `/orders?${qs}`);
+    }
+    async getOrder(id) {
+        return this.request("GET", `/orders/${id}`);
+    }
+    async updateOrder(id, fields) {
+        return this.request("PUT", `/orders/${id}`, fields);
+    }
+    // ── Products ──────────────────────────────────────────────────────────────
+    async getProducts(params = {}) {
+        const qs = new URLSearchParams();
+        if (params.status)
+            qs.set("status", params.status);
+        if (params.perPage)
+            qs.set("per_page", String(params.perPage));
+        if (params.page)
+            qs.set("page", String(params.page));
+        if (params.category)
+            qs.set("category", params.category);
+        return this.request("GET", `/products?${qs}`);
+    }
+    async getProduct(id) {
+        return this.request("GET", `/products/${id}`);
+    }
+    async updateProduct(id, fields) {
+        return this.request("PUT", `/products/${id}`, fields);
+    }
+    async getProductVariations(productId) {
+        return this.request("GET", `/products/${productId}/variations`);
+    }
+    // ── Customers ─────────────────────────────────────────────────────────────
+    async getCustomers(params = {}) {
+        const qs = new URLSearchParams();
+        if (params.search)
+            qs.set("search", params.search);
+        if (params.perPage)
+            qs.set("per_page", String(params.perPage));
+        if (params.page)
+            qs.set("page", String(params.page));
+        return this.request("GET", `/customers?${qs}`);
+    }
+    async getCustomer(id) {
+        return this.request("GET", `/customers/${id}`);
+    }
+    // ── Webhooks ──────────────────────────────────────────────────────────────
+    async listWebhooks() {
+        return this.request("GET", "/webhooks");
+    }
+    async createWebhook(name, topic, deliveryUrl, secret) {
+        const body = {
+            name,
+            topic,
+            delivery_url: deliveryUrl,
+        };
+        if (secret)
+            body.secret = secret;
+        return this.request("POST", "/webhooks", body);
+    }
+    async deleteWebhook(id) {
+        return this.request("DELETE", `/webhooks/${id}?force=true`);
+    }
+    // ── Reports ───────────────────────────────────────────────────────────────
+    async getReportsSales(params = {}) {
+        const qs = new URLSearchParams();
+        if (params.period)
+            qs.set("period", params.period);
+        if (params.dateMin)
+            qs.set("date_min", params.dateMin);
+        if (params.dateMax)
+            qs.set("date_max", params.dateMax);
+        return this.request("GET", `/reports/sales?${qs}`);
+    }
+}
+// ── Singleton ─────────────────────────────────────────────────────────────────
+let _instance = null;
+function resetWooCommerceConnector() {
+    _instance = null;
+}
+export function getWooCommerceConnector() {
+    if (!_instance) {
+        _instance = new WooCommerceConnector();
+    }
+    return _instance;
+}
+export { getWooCommerceConnector as woocommerce };
+/**
+ * POST /connections/woocommerce/connect  { consumerKey, consumerSecret, storeUrl }
+ */
+export async function handleWooCommerceConnect(body) {
+    let consumerKey;
+    let consumerSecret;
+    let storeUrl;
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed.consumerKey !== "string" || !parsed.consumerKey) {
+            return {
+                status: 400,
+                contentType: "application/json",
+                body: JSON.stringify({ ok: false, error: "consumerKey is required" }),
+            };
+        }
+        if (typeof parsed.consumerSecret !== "string" || !parsed.consumerSecret) {
+            return {
+                status: 400,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    ok: false,
+                    error: "consumerSecret is required",
+                }),
+            };
+        }
+        if (typeof parsed.storeUrl !== "string" || !parsed.storeUrl) {
+            return {
+                status: 400,
+                contentType: "application/json",
+                body: JSON.stringify({ ok: false, error: "storeUrl is required" }),
+            };
+        }
+        consumerKey = parsed.consumerKey;
+        consumerSecret = parsed.consumerSecret;
+        storeUrl = parsed.storeUrl.replace(/\/$/, "");
+    }
+    catch {
+        return {
+            status: 400,
+            contentType: "application/json",
+            body: JSON.stringify({ ok: false, error: "Invalid JSON body" }),
+        };
+    }
+    try {
+        const basic = Buffer.from(`${consumerKey}:${consumerSecret}`).toString("base64");
+        const res = await fetch(`${storeUrl}/wp-json/wc/v3/system_status`, {
+            headers: { Authorization: `Basic ${basic}`, Accept: "application/json" },
+        });
+        if (!res.ok) {
+            return {
+                status: 401,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    ok: false,
+                    error: `Credentials rejected by WooCommerce store (HTTP ${res.status}) — check consumerKey and consumerSecret`,
+                }),
+            };
+        }
+        const tokens = {
+            consumerKey,
+            consumerSecret,
+            storeUrl,
+            connected_at: new Date().toISOString(),
+        };
+        saveTokens(tokens);
+        resetWooCommerceConnector();
+        return {
+            status: 200,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: true,
+                storeUrl,
+                connectedAt: tokens.connected_at,
+            }),
+        };
+    }
+    catch (err) {
+        return {
+            status: 500,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            }),
+        };
+    }
+}
+/**
+ * POST /connections/woocommerce/test
+ */
+export async function handleWooCommerceTest() {
+    const tokens = loadTokens();
+    if (!tokens) {
+        return {
+            status: 400,
+            contentType: "application/json",
+            body: JSON.stringify({ ok: false, error: "WooCommerce not connected" }),
+        };
+    }
+    try {
+        const connector = getWooCommerceConnector();
+        const check = await connector.healthCheck();
+        return {
+            status: check.ok ? 200 : 401,
+            contentType: "application/json",
+            body: JSON.stringify(check.ok ? { ok: true } : { ok: false, error: check.error?.message }),
+        };
+    }
+    catch (err) {
+        return {
+            status: 500,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            }),
+        };
+    }
+}
+/**
+ * DELETE /connections/woocommerce
+ */
+export function handleWooCommerceDisconnect() {
+    clearTokens();
+    resetWooCommerceConnector();
+    return {
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ ok: true }),
+    };
+}
+//# sourceMappingURL=woocommerce.js.map

package/dist/connectors/woocommerce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"woocommerce.js","sourceRoot":"","sources":["../../src/connectors/woocommerce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAEL,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AA2I3B,iFAAiF;AAEjF,MAAM,UAAU,UAAU;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACnD,IAAI,GAAG,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,OAAO;YACL,WAAW,EAAE,GAAG;YAChB,cAAc,EAAE,MAAM;YACtB,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACrC,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC;IACJ,CAAC;IACD,OAAO,iBAAiB,CAAoB,aAAa,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB;IAClD,mBAAmB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,oBAAoB,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAwB,EACxB,eAAuB,EACvB,MAAc;IAEd,IAAI,CAAC,eAAe,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpB,IAAI,QAAQ,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,iFAAiF;AAEjF,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IAC5C,YAAY,GAAG,aAAa,CAAC;IAC9B,MAAM,GAA6B,IAAI,CAAC;IAEtC,cAAc;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,mJAAmJ,CACpJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAChB,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,cAAc,EAAE,CACjD,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACrB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;gBAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE;oBACtD,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;iBAC7B,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,GAAG,CAAC;gBACvB,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,IAAI,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,cAAc,CAAC,KAAc;QAC3B,+DAA+D;QAC/D,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,SAAS,IAAI,KAAK;YAClB,CAAC,CAAC,KAAK,YAAY,QAAQ,CAAC,EAC5B,CAAC;YACD,MAAM,MAAM,GAAG,KAId,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;YACxC,IACE,MAAM,KAAK,GAAG;gBACd,MAAM,CAAC,IAAI,KAAK,uCAAuC,EACvD,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EACL,+DAA+D;oBACjE,SAAS,EAAE,KAAK;oBAChB,eAAe,EAAE,+BAA+B;iBACjD,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,qCAAqC;oBAC9C,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE,gBAAgB;iBAClC,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,OAAO;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,IAAI,GAAG;aACzB,CAAC;QACJ,CAAC;QACD,IACE,KAAK,YAAY,QAAQ;YACzB,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,CAAC,EACzD,CAAC;YACD,MAAM,CAAC,GAAI,KAA4B,CAAC,MAAM,CAAC;YAC/C,IAAI,CAAC,KAAK,GAAG;gBACX,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,oCAAoC;oBAC7C,SAAS,EAAE,KAAK;oBAChB,eAAe,EAAE,+BAA+B;iBACjD,CAAC;YACJ,IAAI,CAAC,KAAK,GAAG;gBACX,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,qCAAqC;oBAC9C,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,IAAI,CAAC,KAAK,GAAG;gBACX,OAAO;oBACL,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,gCAAgC;oBACzC,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,IAAI,CAAC,KAAK,GAAG;gBACX,OAAO;oBACL,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,sCAAsC,CAAC,EAAE;oBAClD,SAAS,EAAE,KAAK;iBACjB,CAAC;YACJ,OAAO;gBACL,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,+BAA+B,CAAC,EAAE;gBAC3C,SAAS,EAAE,CAAC,IAAI,GAAG;aACpB,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IACE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBACnC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EACtC,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,wCAAwC,KAAK,CAAC,OAAO,EAAE;oBAChE,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,SAAS;QACP,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,aAAa;YACjB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc;YAC7C,QAAQ,EAAE,MAAM,EAAE,YAAY;YAC9B,SAAS,EAAE,MAAM,EAAE,QAAQ;SAC5B,CAAC;IACJ,CAAC;IAED,8EAA8E;IAEtE,OAAO,CAAC,IAAY;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC7C,OAAO,GAAG,QAAQ,iBAAiB,IAAI,EAAE,CAAC;IAC5C,CAAC;IAEO,YAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM;YACvB,CAAC,CAAC,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAC3D,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,aAAa,EAAE,SAAS,KAAK,EAAE;YAC/B,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC3B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAc;QAEd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAC1C,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC5B,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAIlD,CAAC;gBACF,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,EAClD;oBACE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,gBAAgB;oBACtC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;iBAC7C,CACF,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAS,CAAC;IAC1B,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,SAAS,CACb,SAMI,EAAE;QAEN,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,OAAO;YAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,KAAK;YAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,OAAO,CAAa,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,OAAO,IAAI,CAAC,OAAO,CAAW,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,WAAW,CACf,EAAU,EACV,MAAmD;QAEnD,OAAO,IAAI,CAAC,OAAO,CAAW,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,WAAW,CACf,SAKI,EAAE;QAEN,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,OAAO;YAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ;YAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,OAAO,CAAe,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,OAAO,CAAa,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,EAAU,EACV,MAWyB;QAEzB,OAAO,IAAI,CAAC,OAAO,CAAa,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,SAAiB;QAEjB,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,aAAa,SAAS,aAAa,CACpC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,YAAY,CAChB,SAA+D,EAAE;QAEjE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,OAAO;YAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,IAAI;YAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,OAAO,CAAgB,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAc,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,OAAO,CAAe,KAAK,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,KAAa,EACb,WAAmB,EACnB,MAAe;QAEf,MAAM,IAAI,GAA2B;YACnC,IAAI;YACJ,KAAK;YACL,YAAY,EAAE,WAAW;SAC1B,CAAC;QACF,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACjC,OAAO,IAAI,CAAC,OAAO,CAAa,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,EAAU;QAC5B,OAAO,IAAI,CAAC,OAAO,CACjB,QAAQ,EACR,aAAa,EAAE,aAAa,CAC7B,CAAC;IACJ,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,eAAe,CACnB,SAII,EAAE;QAEN,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM;YAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,OAAO;YAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,OAAO;YAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAmB,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;CACF;AAED,iFAAiF;AAEjF,IAAI,SAAS,GAAgC,IAAI,CAAC;AAElD,SAAS,yBAAyB;IAChC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,OAAO,EAAE,uBAAuB,IAAI,WAAW,EAAE,CAAC;AAWlD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY;IAEZ,IAAI,WAAmB,CAAC;IACxB,IAAI,cAAsB,CAAC;IAC3B,IAAI,QAAgB,CAAC;IAErB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAI7B,CAAC;QACF,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAClE,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;aACtE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACxE,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,4BAA4B;iBACpC,CAAC;aACH,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5D,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QACD,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACjC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,cAAc,EAAE,CAAC,CAAC,QAAQ,CACpE,QAAQ,CACT,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,8BAA8B,EAAE;YACjE,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACzE,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,WAAW,EAAE,kBAAkB;gBAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,mDAAmD,GAAG,CAAC,MAAM,0CAA0C;iBAC/G,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAsB;YAChC,WAAW;YACX,cAAc;YACd,QAAQ;YACR,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC;QACF,UAAU,CAAC,MAAM,CAAC,CAAC;QACnB,yBAAyB,EAAE,CAAC;QAE5B,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,EAAE,EAAE,IAAI;gBACR,QAAQ;gBACR,WAAW,EAAE,MAAM,CAAC,YAAY;aACjC,CAAC;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;SACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,uBAAuB,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YAC5B,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CACrE;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,kBAAkB;YAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;SACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B;IACzC,WAAW,EAAE,CAAC;IACd,yBAAyB,EAAE,CAAC;IAC5B,OAAO;QACL,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;AACJ,CAAC"}

package/dist/crypto.js

@@ -15,8 +15,13 @@ import crypto from "node:crypto";
  * bytes" via timing.
  */
 export function timingSafeStringEqual(a, b) {
-    const bA = Buffer.from(a);
-    const bB = Buffer.from(b);
+    // Encode as UTF-16LE (Node's native string representation) so the comparison
+    // is over the actual JS code units. UTF-8 encoding is NOT injective for
+    // ill-formed strings: two distinct strings containing lone surrogates can
+    // produce identical UTF-8 byte sequences (both surrogates → U+FFFD → same bytes),
+    // causing a false equality. UTF-16LE preserves each code unit exactly.
+    const bA = Buffer.from(a, "utf16le");
+    const bB = Buffer.from(b, "utf16le");
     const len = Math.max(bA.length, bB.length);
     const padA = Buffer.alloc(len);
     const padB = Buffer.alloc(len);

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACxD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjC,mEAAmE;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,OAAO,OAAO,IAAI,KAAK,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAS,EAAE,CAAS;IACxD,6EAA6E;IAC7E,wEAAwE;IACxE,0EAA0E;IAC1E,kFAAkF;IAClF,uEAAuE;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjC,mEAAmE;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,OAAO,OAAO,IAAI,KAAK,CAAC;AAC1B,CAAC"}

package/dist/decisionReplay.js

@@ -76,16 +76,25 @@ export function computeDecisionReplay(activityLog, opts) {
             ...(incomplete && { incomplete: true }),
         });
     }
-    const changedRows = rows.filter((r) => !r.unchanged);
+    let changedCount = 0;
+    let nowAllowedCount = 0;
+    let nowDeniedCount = 0;
+    for (const r of rows) {
+        if (r.unchanged)
+            continue;
+        changedCount++;
+        if (r.changeKind === "now_allowed")
+            nowAllowedCount++;
+        else if (r.changeKind === "now_denied")
+            nowDeniedCount++;
+    }
     return {
         rows,
         generatedAt: new Date().toISOString(),
         totalRows: rows.length,
-        changedCount: changedRows.length,
-        nowAllowedCount: changedRows.filter((r) => r.changeKind === "now_allowed")
-            .length,
-        nowDeniedCount: changedRows.filter((r) => r.changeKind === "now_denied")
-            .length,
+        changedCount,
+        nowAllowedCount,
+        nowDeniedCount,
         workspace,
     };
 }

package/dist/decisionReplay.js.map

@@ -1 +1 @@
-{"version":3,"file":"decisionReplay.js","sourceRoot":"","sources":["../src/decisionReplay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAgDtE,SAAS,UAAU,CACjB,QAAgB,EAChB,MAAsB;IAEtB,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,aAAa,CAAC;IACrE,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,QAAQ,KAAK,OAAO;QAClE,OAAO,YAAY,CAAC;IACtB,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,WAAwB,EACxB,IAQC;IAED,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAExD,wEAAwE;IACxE,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAEnC,8DAA8D;IAC9D,MAAM,GAAG,GAAG,WAAW,CAAC,sBAAsB,EAAE,CAAC;IACjD,MAAM,QAAQ,GACZ,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAErD,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ;YAC1C,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACzB,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,gBAAgB,GACpB,OAAO,KAAK,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ;YAC1C,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACzB,CAAC,CAAC,SAAS,CAAC;QAEhB,mEAAmE;QACnE,sEAAsE;QACtE,IAAI,SAA6B,CAAC;QAClC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC/C,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,SAAS,GAAG,YAAY,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,MAElB,CAAC;YACd,MAAM,GAAG,GACP,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,GAAG,IAAI,MAAM,EAAE,OAAO,CAAC;YACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS,GAAG,GAAG,CAAC;QAC/C,CAAC;QAED,MAAM,UAAU,GAAG,SAAS,KAAK,SAAS,CAAC;QAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAEzD,MAAM,SAAS,GACb,MAAM,KAAK,gBAAgB;YAC3B,CAAC,MAAM,KAAK,MAAM,IAAI,gBAAgB,KAAK,OAAO,CAAC;YACnD,CAAC,MAAM,KAAK,MAAM,IAAI,gBAAgB,KAAK,MAAM,CAAC,CAAC;QAErD,IAAI,CAAC,IAAI,CAAC;YACR,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ;YACR,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7C,gBAAgB;YAChB,cAAc,EAAE,MAAM;YACtB,SAAS;YACT,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,SAAS,IAAI;gBACxD,UAAU,EAAE,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC;aACjD,CAAC;YACF,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErD,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,SAAS,EAAE,IAAI,CAAC,MAAM;QACtB,YAAY,EAAE,WAAW,CAAC,MAAM;QAChC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,aAAa,CAAC;aACvE,MAAM;QACT,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,YAAY,CAAC;aACrE,MAAM;QACT,SAAS;KACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"decisionReplay.js","sourceRoot":"","sources":["../src/decisionReplay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAgDtE,SAAS,UAAU,CACjB,QAAgB,EAChB,MAAsB;IAEtB,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,aAAa,CAAC;IACrE,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,IAAI,QAAQ,KAAK,OAAO;QAClE,OAAO,YAAY,CAAC;IACtB,IAAI,MAAM,KAAK,KAAK,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC;IAC/D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,WAAwB,EACxB,IAQC;IAED,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAExD,wEAAwE;IACxE,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAEnC,8DAA8D;IAC9D,MAAM,GAAG,GAAG,WAAW,CAAC,sBAAsB,EAAE,CAAC;IACjD,MAAM,QAAQ,GACZ,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAErD,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GACZ,OAAO,KAAK,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ;YAC1C,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACzB,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,MAAM,gBAAgB,GACpB,OAAO,KAAK,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ;YAC1C,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACzB,CAAC,CAAC,SAAS,CAAC;QAEhB,mEAAmE;QACnE,sEAAsE;QACtE,IAAI,SAA6B,CAAC;QAClC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC;QAC/C,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,SAAS,GAAG,YAAY,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,MAElB,CAAC;YACd,MAAM,GAAG,GACP,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,IAAI,IAAI,MAAM,EAAE,GAAG,IAAI,MAAM,EAAE,OAAO,CAAC;YACpE,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS,GAAG,GAAG,CAAC;QAC/C,CAAC;QAED,MAAM,UAAU,GAAG,SAAS,KAAK,SAAS,CAAC;QAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAEzD,MAAM,SAAS,GACb,MAAM,KAAK,gBAAgB;YAC3B,CAAC,MAAM,KAAK,MAAM,IAAI,gBAAgB,KAAK,OAAO,CAAC;YACnD,CAAC,MAAM,KAAK,MAAM,IAAI,gBAAgB,KAAK,MAAM,CAAC,CAAC;QAErD,IAAI,CAAC,IAAI,CAAC;YACR,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ;YACR,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7C,gBAAgB;YAChB,cAAc,EAAE,MAAM;YACtB,SAAS;YACT,GAAG,CAAC,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,KAAK,SAAS,IAAI;gBACxD,UAAU,EAAE,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC;aACjD,CAAC;YACF,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,SAAS;YAAE,SAAS;QAC1B,YAAY,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,UAAU,KAAK,aAAa;YAAE,eAAe,EAAE,CAAC;aACjD,IAAI,CAAC,CAAC,UAAU,KAAK,YAAY;YAAE,cAAc,EAAE,CAAC;IAC3D,CAAC;IAED,OAAO;QACL,IAAI;QACJ,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,SAAS,EAAE,IAAI,CAAC,MAAM;QACtB,YAAY;QACZ,eAAe;QACf,cAAc;QACd,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/decisionTraceLog.d.ts

@@ -63,6 +63,16 @@ export declare class DecisionTraceLog {
     private readonly file;
     private readonly memoryCap;
     private readonly now;
+    /**
+     * Byte offset into `file` up to which we've already loaded rows into
+     * `this.traces`. ADR-0007 tail-on-read: every `query()` re-stats the
+     * file and reads the delta `[lastReadOffset, size)`, so a sibling
+     * bridge's appends become visible to this process within one query
+     * — without holding the whole log in memory or paying read cost on
+     * every append. Single-process operation is unaffected (offset is
+     * always at EOF so the stat → no-grow path short-circuits).
+     */
+    private lastReadOffset;
     constructor(opts: DecisionTraceLogOptions);
     /**
      * Record a new decision trace. Validates required fields + clips the
@@ -80,4 +90,22 @@ export declare class DecisionTraceLog {
      */
     private rotateDisk;
     private loadExisting;
+    /**
+     * Tail-on-read (ADR-0007). Read any rows appended to the file since
+     * `lastReadOffset` and merge them into the in-memory ring. Cheap when
+     * nothing changed (one `statSync`); on a fresh sibling write we read
+     * just the delta. Torn rows (mid-write race) JSON.parse-fail and are
+     * skipped — but the cross-process flock around appends (`#584`)
+     * eliminates that failure mode in practice.
+     */
+    private tailDisk;
+    /**
+     * Parse a JSONL chunk and append each well-formed trace into the
+     * in-memory ring. Shared between `loadExisting` (initial load) and
+     * `tailDisk` (incremental merges). Skips malformed rows silently —
+     * the cross-process flock around appends (#584) makes those rare,
+     * and the alternative (throwing) would lose every later row in the
+     * chunk on one bad line.
+     */
+    private consumeRawJsonl;
 }