rea-agents 3.2.0 → 4.0.0

package/dist/cliPolicyCommands.js

@@ -1,185 +0,0 @@
-import { Cli, z } from "incur";
-import { createInterface } from "node:readline/promises";
-import { loadConfiguredPermissionAuthority } from "./application/PermissionConfiguration.js";
-import { readProjectPermissionStore, revokeProjectPermissionGrant, } from "./application/ProjectPermissionStore.js";
-import { logCliCommand } from "./cliLogging.js";
-import { parseConfig } from "./config.js";
-import { PermissionRequiredError, projectAnalysisError, } from "./domain/errors.js";
-import { PERMISSION_CAPABILITIES, } from "./domain/permissionPolicy.js";
-import { CLI_COMMANDS } from "./cliCommandNames.js";
-const capabilitySchema = z.enum(PERMISSION_CAPABILITIES);
-/** Require an explicit decision before a project permission grant is removed. */
-export const approvePolicyRevocation = async (options) => {
-    if (options.approved)
-        return { approved: true };
-    if (!options.interactive)
-        return { approved: false, reason: "required" };
-    return (await options.confirm(options.grantId))
-        ? { approved: true }
-        : { approved: false, reason: "cancelled" };
-};
-/** Register inspectable, dry-run, and revocation policy UX for the CLI. */
-export const registerPolicyCommands = (cli, logger) => {
-    cli.command(CLI_COMMANDS.policy, {
-        description: "Inspect, explain, or revoke unified local permission grants",
-        args: z.object({
-            action: z
-                .enum(["status", "list", "explain", "revoke"])
-                .describe("Permission-policy operation to perform"),
-            value: z
-                .string()
-                .optional()
-                .describe("Capability to explain or grant ID to revoke"),
-        }),
-        options: z.object({
-            root: z.string().optional().describe("Filesystem root to authorize"),
-            executable: z
-                .string()
-                .optional()
-                .describe("Executable path to authorize"),
-            environmentNames: z
-                .array(z.string())
-                .default([])
-                .describe("Environment variable names the operation may read"),
-            origins: z
-                .array(z.string())
-                .default([])
-                .describe("Exact browser origins the operation may access"),
-            network: z
-                .enum(["none", "loopback", "external"])
-                .default("none")
-                .describe("Maximum network scope to authorize"),
-            mount: z
-                .boolean()
-                .default(false)
-                .describe("Authorize mounting an artifact filesystem"),
-            write: z
-                .boolean()
-                .default(false)
-                .describe("Explain the write form of the requested capability"),
-            yes: z
-                .boolean()
-                .default(false)
-                .describe("Confirm project permission revocation without prompting"),
-        }),
-        alias: { environmentNames: "environment-names", yes: "y" },
-        run: ({ agent, args, formatExplicit, options }) => logCliCommand(logger, "policy", async () => {
-            const config = parseConfig(process.env);
-            if (!config.ok)
-                return failure(config.error);
-            if (args.action === "status")
-                return policyStatus(config.value);
-            if (args.action === "list")
-                return policyList(config.value);
-            if (args.action === "revoke")
-                return policyRevoke({
-                    config: config.value,
-                    grantId: args.value,
-                    approved: options.yes,
-                    interactive: !agent && !formatExplicit && process.stdin.isTTY === true,
-                    confirm: confirmPolicyRevocation,
-                });
-            const capability = capabilitySchema.safeParse(args.value);
-            if (!capability.success)
-                return {
-                    error: "A registered capability is required for policy explain",
-                };
-            return policyExplain(config.value, capability.data, options);
-        }),
-    });
-};
-const policyStatus = (config) => ({
-    reload: "SIGHUP",
-    restart_required: false,
-    administrator_ceilings: config.permissionCeilings,
-    project_store: config.permissionProjectStore ?? null,
-});
-const policyList = (config) => readProjectGrants(config).then((result) => result.ok ? { grants: result.grants } : result.error);
-const policyRevoke = async (context) => {
-    if (context.grantId === undefined)
-        return { error: "Grant ID is required for policy revoke" };
-    const { permissionProjectRoot, permissionProjectStore } = context.config;
-    if (permissionProjectRoot === undefined ||
-        permissionProjectStore === undefined)
-        return { error: "Project policy is not configured" };
-    const approval = await approvePolicyRevocation({
-        approved: context.approved,
-        interactive: context.interactive,
-        grantId: context.grantId,
-        confirm: context.confirm,
-    });
-    if (!approval.approved)
-        return approval.reason === "required"
-            ? {
-                error: "Policy revoke requires confirmation. Rerun interactively or with --yes.",
-                grant_id: context.grantId,
-            }
-            : {
-                error: "Policy revocation was cancelled",
-                grant_id: context.grantId,
-            };
-    const revoked = await revokeProjectPermissionGrant(permissionProjectStore, permissionProjectRoot, context.grantId);
-    return revoked.ok && revoked.value
-        ? {
-            revoked: context.grantId,
-            reload: "Send SIGHUP to the REA MCP process",
-        }
-        : revoked.ok
-            ? { error: "Grant was not found", grant_id: context.grantId }
-            : { error: revoked.error.message };
-};
-const policyExplain = async (config, capability, options) => explain(config, capability, options);
-const confirmPolicyRevocation = async (grantId) => {
-    const prompt = createInterface({
-        input: process.stdin,
-        output: process.stdout,
-    });
-    try {
-        const answer = await prompt.question(`Revoke project permission grant ${JSON.stringify(grantId)}? [y/N] `);
-        return ["y", "yes"].includes(answer.trim().toLowerCase());
-    }
-    finally {
-        prompt.close();
-    }
-};
-const explain = async (config, capability, options) => {
-    const authority = await loadConfiguredPermissionAuthority(config);
-    if (!authority.ok)
-        return failure(authority.error);
-    const evaluated = await authority.value.explain({
-        capability,
-        roots: options.root === undefined ? [] : [options.root],
-        executables: options.executable === undefined ? [] : [options.executable],
-        environment_names: options.environmentNames,
-        origins: options.origins,
-        network: options.network,
-        mount: options.mount,
-        operation_identity: `policy_explain:${capability}`,
-    }, options.write ? "write" : "read");
-    return evaluated.ok
-        ? { allowed: true, grant_id: evaluated.value.grant_id }
-        : evaluated.error instanceof PermissionRequiredError
-            ? { allowed: false, error: projectAnalysisError(evaluated.error) }
-            : { allowed: false, error: evaluated.error.message };
-};
-const readProjectGrants = async (config) => {
-    if (config.permissionProjectRoot === undefined ||
-        config.permissionProjectStore === undefined)
-        return {
-            ok: false,
-            error: { error: "Project policy is not configured" },
-        };
-    const store = await readProjectPermissionStore(config.permissionProjectStore, config.permissionProjectRoot);
-    return store.ok
-        ? {
-            ok: true,
-            grants: store.value?.grants ?? [],
-            path: config.permissionProjectStore,
-            root: config.permissionProjectRoot,
-        }
-        : { ok: false, error: { error: store.error.message } };
-};
-const failure = (error) => ({
-    error: "Policy command failed",
-    ...projectAnalysisError(error),
-});

package/dist/config/browserScenario.js

@@ -1,77 +0,0 @@
-import { ConfigurationError } from "../domain/errors.js";
-import { err, ok } from "../domain/result.js";
-import { browserEndpointSchema, browserOriginSchema, } from "../domain/browserObservation.js";
-import { parseAbsoluteRoots, parseBrowserArray, parseStringArray, } from "./parsers.js";
-import { browserNetworkScope, permissionScope } from "./permissions.js";
-/** Parse controlled browser scenarios into a closed disabled or enabled policy. */
-export const parseBrowserScenarioPolicy = (env) => {
-    const executableRoots = parseAbsoluteRoots(env.REA_BROWSER_SCENARIO_EXECUTABLE_ROOTS_JSON, "REA_BROWSER_SCENARIO_EXECUTABLE_ROOTS_JSON");
-    if (!executableRoots.ok)
-        return executableRoots;
-    const cdpEndpoints = parseBrowserArray(env.REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON, "REA_BROWSER_SCENARIO_CDP_ENDPOINTS_JSON", browserEndpointSchema);
-    if (!cdpEndpoints.ok)
-        return cdpEndpoints;
-    const allowedOrigins = parseBrowserArray(env.REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON, "REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON", browserOriginSchema);
-    if (!allowedOrigins.ok)
-        return allowedOrigins;
-    const allowedEnvironment = parseStringArray(env.REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON, "REA_BROWSER_SCENARIO_ALLOWED_ENV_JSON");
-    if (!allowedEnvironment.ok)
-        return allowedEnvironment;
-    if (env.REA_BROWSER_SCENARIO_ENABLED !== "true")
-        return ok({ status: "disabled" });
-    const [firstOrigin, ...remainingOrigins] = allowedOrigins.value;
-    if (firstOrigin === undefined)
-        return err(new ConfigurationError("REA_BROWSER_SCENARIO_ALLOWED_ORIGINS_JSON must encode at least one exact origin when browser scenarios are enabled"));
-    const target = parseTargetPolicy(executableRoots.value, cdpEndpoints.value);
-    if (!target.ok)
-        return target;
-    return ok({
-        status: "enabled",
-        target: target.value,
-        allowedOrigins: [firstOrigin, ...remainingOrigins],
-        allowedEnvironment: allowedEnvironment.value,
-    });
-};
-/** Add the separately permissioned controlled-browser ceiling. */
-export const appendBrowserScenarioCeiling = (ceilings, policy) => {
-    if (policy.status === "disabled")
-        return;
-    const { executableRoots, cdpEndpoints } = targetScopes(policy.target);
-    ceilings.push(permissionScope("browser_automate", [], {
-        executables: executableRoots,
-        environment_names: policy.allowedEnvironment,
-        origins: [...cdpEndpoints, ...policy.allowedOrigins],
-        network: browserNetworkScope(policy.allowedOrigins),
-    }));
-};
-const parseTargetPolicy = (executableRoots, cdpEndpoints) => {
-    const [firstExecutableRoot, ...remainingExecutableRoots] = executableRoots;
-    const [firstCdpEndpoint, ...remainingCdpEndpoints] = cdpEndpoints;
-    if (firstExecutableRoot !== undefined && firstCdpEndpoint !== undefined)
-        return ok({
-            access: "launch-or-attach",
-            executableRoots: [firstExecutableRoot, ...remainingExecutableRoots],
-            cdpEndpoints: [firstCdpEndpoint, ...remainingCdpEndpoints],
-        });
-    if (firstExecutableRoot !== undefined)
-        return ok({
-            access: "launch",
-            executableRoots: [firstExecutableRoot, ...remainingExecutableRoots],
-        });
-    if (firstCdpEndpoint !== undefined)
-        return ok({
-            access: "attach",
-            cdpEndpoints: [firstCdpEndpoint, ...remainingCdpEndpoints],
-        });
-    return err(new ConfigurationError("Browser scenarios require at least one executable root or loopback CDP endpoint when enabled"));
-};
-const targetScopes = (target) => {
-    switch (target.access) {
-        case "launch":
-            return { executableRoots: target.executableRoots, cdpEndpoints: [] };
-        case "attach":
-            return { executableRoots: [], cdpEndpoints: target.cdpEndpoints };
-        case "launch-or-attach":
-            return target;
-    }
-};

package/dist/config/electronAutomation.js

@@ -1,35 +0,0 @@
-import { ConfigurationError } from "../domain/errors.js";
-import { err, ok } from "../domain/result.js";
-import { permissionScope } from "./permissions.js";
-import { parseAbsoluteRoots } from "./parsers.js";
-/** Parse active Electron automation into a closed disabled or enabled policy. */
-export const parseElectronAutomationPolicy = (env) => {
-    const executableRoots = parseAbsoluteRoots(env.REA_ELECTRON_AUTOMATE_EXECUTABLE_ROOTS_JSON, "REA_ELECTRON_AUTOMATE_EXECUTABLE_ROOTS_JSON");
-    if (!executableRoots.ok)
-        return executableRoots;
-    const applicationRoots = parseAbsoluteRoots(env.REA_ELECTRON_AUTOMATE_APPLICATION_ROOTS_JSON, "REA_ELECTRON_AUTOMATE_APPLICATION_ROOTS_JSON");
-    if (!applicationRoots.ok)
-        return applicationRoots;
-    if (env.REA_ELECTRON_AUTOMATE_ENABLED !== "true")
-        return ok({ status: "disabled" });
-    const [firstExecutableRoot, ...remainingExecutableRoots] = executableRoots.value;
-    if (firstExecutableRoot === undefined)
-        return err(new ConfigurationError("REA_ELECTRON_AUTOMATE_EXECUTABLE_ROOTS_JSON must encode at least one absolute root when Electron automation is enabled"));
-    const [firstApplicationRoot, ...remainingApplicationRoots] = applicationRoots.value;
-    if (firstApplicationRoot === undefined)
-        return err(new ConfigurationError("REA_ELECTRON_AUTOMATE_APPLICATION_ROOTS_JSON must encode at least one absolute root when Electron automation is enabled"));
-    return ok({
-        status: "enabled",
-        executableRoots: [firstExecutableRoot, ...remainingExecutableRoots],
-        applicationRoots: [firstApplicationRoot, ...remainingApplicationRoots],
-    });
-};
-/** Add the separately permissioned, no-network Electron automation ceiling. */
-export const appendElectronAutomationCeiling = (ceilings, policy) => {
-    if (policy.status === "disabled")
-        return;
-    ceilings.push(permissionScope("electron_automate", policy.applicationRoots, {
-        executables: policy.executableRoots,
-        network: "external",
-    }));
-};

package/dist/config/javascriptReplay.js

@@ -1,41 +0,0 @@
-import { ConfigurationError } from "../domain/errors.js";
-import { err, ok } from "../domain/result.js";
-import { parseAbsoluteRoots } from "./parsers.js";
-import { permissionScope } from "./permissions.js";
-/** Parse controlled replay configuration into disabled or fully enabled state. */
-export const parseJavaScriptReplayPolicy = (env) => {
-    const roots = parseAbsoluteRoots(env.REA_JAVASCRIPT_REPLAY_ROOTS_JSON, "REA_JAVASCRIPT_REPLAY_ROOTS_JSON");
-    if (!roots.ok)
-        return roots;
-    if (env.REA_JAVASCRIPT_REPLAY_ENABLED !== "true")
-        return ok({ status: "disabled" });
-    const [firstRoot, ...remainingRoots] = roots.value;
-    if (firstRoot === undefined)
-        return err(new ConfigurationError("REA_JAVASCRIPT_REPLAY_ROOTS_JSON must encode at least one absolute root when JavaScript replay is enabled"));
-    return ok({
-        status: "enabled",
-        roots: [firstRoot, ...remainingRoots],
-        nodePath: env.REA_JAVASCRIPT_REPLAY_NODE_PATH,
-        bubblewrapPath: env.REA_JAVASCRIPT_REPLAY_BWRAP_PATH,
-        systemdRunPath: env.REA_JAVASCRIPT_REPLAY_SYSTEMD_RUN_PATH,
-        systemctlPath: env.REA_JAVASCRIPT_REPLAY_SYSTEMCTL_PATH,
-        shellPath: env.REA_JAVASCRIPT_REPLAY_SHELL_PATH,
-    });
-};
-/** Add the exact controlled replay ceiling when replay is enabled. */
-export const appendJavaScriptReplayCeiling = (ceilings, policy) => {
-    if (policy.status === "disabled")
-        return;
-    ceilings.push(permissionScope("javascript_replay", policy.roots, {
-        executables: replayExecutables(policy),
-        network: "none",
-        mount: true,
-    }));
-};
-const replayExecutables = (policy) => [
-    policy.nodePath,
-    policy.bubblewrapPath,
-    policy.systemdRunPath,
-    policy.systemctlPath,
-    policy.shellPath,
-];

package/dist/config/managedRuntime.js

@@ -1,25 +0,0 @@
-import { ConfigurationError } from "../domain/errors.js";
-import { err, ok } from "../domain/result.js";
-import { permissionScope } from "./permissions.js";
-/** Parse managed runtime correlation into a closed disabled or enabled policy. */
-export const parseManagedRuntimePolicy = (env, roots) => {
-    if (env.REA_MANAGED_RUNTIME_ENABLED !== "true")
-        return ok({ status: "disabled" });
-    const [firstRoot, ...remainingRoots] = roots;
-    if (firstRoot === undefined)
-        return err(new ConfigurationError("REA_MANAGED_RUNTIME_ROOTS_JSON must encode at least one absolute root when managed runtime correlation is enabled"));
-    return ok({
-        status: "enabled",
-        roots: [firstRoot, ...remainingRoots],
-        executablePath: env.REA_MANAGED_RUNTIME_EXECUTABLE_PATH,
-    });
-};
-/** Add the separately permissioned, no-network managed runtime ceiling. */
-export const appendManagedRuntimeCeiling = (ceilings, policy) => {
-    if (policy.status === "disabled")
-        return;
-    ceilings.push(permissionScope("managed_runtime", policy.roots, {
-        executables: [policy.executablePath],
-        network: "none",
-    }));
-};

package/dist/config/passiveObservation.js

@@ -1,87 +0,0 @@
-import { ConfigurationError } from "../domain/errors.js";
-import { err, ok } from "../domain/result.js";
-import { browserEndpointSchema, browserOriginSchema, } from "../domain/browserObservation.js";
-import { parseBrowserArray } from "./parsers.js";
-import { browserNetworkScope, permissionScope } from "./permissions.js";
-/** Parse every passive observation capability into closed policy variants. */
-export const parsePassiveObservationPolicies = (env) => {
-    const browser = parseBrowserObservationPolicy(env);
-    if (!browser.ok)
-        return browser;
-    const electron = parseElectronObservationPolicy(env);
-    if (!electron.ok)
-        return electron;
-    const v8Inspector = parseV8InspectorObservationPolicy(env);
-    if (!v8Inspector.ok)
-        return v8Inspector;
-    return ok({
-        browser: browser.value,
-        electron: electron.value,
-        v8Inspector: v8Inspector.value,
-    });
-};
-/** Add permission ceilings for each enabled passive observation policy. */
-export const appendPassiveObservationCeilings = (ceilings, policies) => {
-    appendBrowserCeiling(ceilings, policies.browser);
-    appendElectronCeiling(ceilings, policies.electron);
-    appendV8InspectorCeiling(ceilings, policies.v8Inspector);
-};
-const parseBrowserObservationPolicy = (env) => {
-    const endpoints = parseBrowserArray(env.REA_BROWSER_CDP_ENDPOINTS_JSON, "REA_BROWSER_CDP_ENDPOINTS_JSON", browserEndpointSchema);
-    if (!endpoints.ok)
-        return endpoints;
-    const origins = parseBrowserArray(env.REA_BROWSER_ALLOWED_ORIGINS_JSON, "REA_BROWSER_ALLOWED_ORIGINS_JSON", browserOriginSchema);
-    if (!origins.ok)
-        return origins;
-    if (env.REA_BROWSER_OBSERVE_ENABLED !== "true")
-        return ok({ status: "disabled" });
-    const parsedEndpoints = requireFirst(endpoints.value, "REA_BROWSER_CDP_ENDPOINTS_JSON must encode at least one loopback endpoint when browser observation is enabled");
-    if (!parsedEndpoints.ok)
-        return parsedEndpoints;
-    const parsedOrigins = requireFirst(origins.value, "REA_BROWSER_ALLOWED_ORIGINS_JSON must encode at least one exact origin when browser observation is enabled");
-    if (!parsedOrigins.ok)
-        return parsedOrigins;
-    return ok({
-        status: "enabled",
-        cdpEndpoints: parsedEndpoints.value,
-        allowedOrigins: parsedOrigins.value,
-    });
-};
-const parseElectronObservationPolicy = (env) => {
-    if (env.REA_ELECTRON_OBSERVE_ENABLED !== "true")
-        return ok({ status: "disabled" });
-    return ok({ status: "enabled" });
-};
-const parseV8InspectorObservationPolicy = (env) => {
-    if (env.REA_V8_INSPECTOR_OBSERVE_ENABLED !== "true")
-        return ok({ status: "disabled" });
-    return ok({ status: "enabled" });
-};
-const requireFirst = (values, message) => {
-    const [first, ...remaining] = values;
-    return first === undefined
-        ? err(new ConfigurationError(message))
-        : ok([first, ...remaining]);
-};
-const appendBrowserCeiling = (ceilings, policy) => {
-    if (policy.status === "disabled")
-        return;
-    ceilings.push(permissionScope("browser_observe", [], {
-        origins: [...policy.cdpEndpoints, ...policy.allowedOrigins],
-        network: browserNetworkScope(policy.allowedOrigins),
-    }));
-};
-const appendElectronCeiling = (ceilings, policy) => {
-    if (policy.status === "disabled")
-        return;
-    ceilings.push(permissionScope("electron_observe", [], {
-        network: "loopback",
-    }));
-};
-const appendV8InspectorCeiling = (ceilings, policy) => {
-    if (policy.status === "disabled")
-        return;
-    ceilings.push(permissionScope("v8_inspector_observe", [], {
-        network: "loopback",
-    }));
-};

package/dist/config/permissions.js

@@ -1,23 +0,0 @@
-import { isLiteralLoopbackHostname } from "../domain/browserObservation.js";
-export const permissionScope = (capability, roots, options = {}) => ({
-    capability,
-    roots,
-    executables: options.executables ?? [],
-    environment_names: options.environment_names ?? [],
-    ...(options.origins === undefined ? {} : { origins: options.origins }),
-    network: options.network ?? "none",
-    mount: options.mount ?? false,
-});
-export const administratorGrants = (ceilings) => ceilings.map((ceiling) => ({
-    ...ceiling,
-    grant_id: `administrator:${ceiling.capability}`,
-    lifetime: "administrator",
-    operation_identity: null,
-    expires_at: null,
-}));
-export const browserNetworkScope = (origins) => origins.every((origin) => {
-    const hostname = new URL(origin).hostname;
-    return isLiteralLoopbackHostname(hostname);
-})
-    ? "loopback"
-    : "external";

package/dist/config/processCapture.js

@@ -1,47 +0,0 @@
-import { ConfigurationError } from "../domain/errors.js";
-import { err, ok } from "../domain/result.js";
-import { parseAbsoluteRoots, parseStringArray } from "./parsers.js";
-import { permissionScope } from "./permissions.js";
-/** Parse process capture into disabled or fully authorized state. */
-export const parseProcessExecutionPolicy = (env) => {
-    const executableRoots = parseAbsoluteRoots(env.REA_PROCESS_EXECUTABLE_ROOTS_JSON, "REA_PROCESS_EXECUTABLE_ROOTS_JSON");
-    if (!executableRoots.ok)
-        return executableRoots;
-    const workingRoots = parseAbsoluteRoots(env.REA_PROCESS_WORKING_ROOTS_JSON, "REA_PROCESS_WORKING_ROOTS_JSON");
-    if (!workingRoots.ok)
-        return workingRoots;
-    const allowedEnvironment = parseStringArray(env.REA_PROCESS_ALLOWED_ENV_JSON, "REA_PROCESS_ALLOWED_ENV_JSON");
-    if (!allowedEnvironment.ok)
-        return allowedEnvironment;
-    if (env.REA_PROCESS_CAPTURE_ENABLED !== "true")
-        return ok({ status: "disabled" });
-    const parsedExecutables = requireRoots(executableRoots.value, "REA_PROCESS_EXECUTABLE_ROOTS_JSON must encode at least one absolute root when process capture is enabled");
-    if (!parsedExecutables.ok)
-        return parsedExecutables;
-    const parsedWorking = requireRoots(workingRoots.value, "REA_PROCESS_WORKING_ROOTS_JSON must encode at least one absolute root when process capture is enabled");
-    if (!parsedWorking.ok)
-        return parsedWorking;
-    return ok({
-        status: "enabled",
-        executableRoots: parsedExecutables.value,
-        workingRoots: parsedWorking.value,
-        allowedEnvironment: allowedEnvironment.value,
-        networkAccess: env.REA_PROCESS_ALLOW_EXTERNAL_NETWORK === "true" ? "external" : "none",
-    });
-};
-/** Add the exact process-capture ceiling when capture is enabled. */
-export const appendProcessCaptureCeiling = (ceilings, policy) => {
-    if (policy.status === "disabled")
-        return;
-    ceilings.push(permissionScope("process_capture", policy.workingRoots, {
-        executables: policy.executableRoots,
-        environment_names: policy.allowedEnvironment,
-        network: policy.networkAccess,
-    }));
-};
-const requireRoots = (roots, message) => {
-    const [first, ...remaining] = roots;
-    return first === undefined
-        ? err(new ConfigurationError(message))
-        : ok([first, ...remaining]);
-};

package/dist/contracts/replayMachineExample.js

@@ -1,37 +0,0 @@
-import { jsonObjectSchema } from "../domain/jsonValue.js";
-/** Minimal login callback accepted by the direct replay-machine contract. */
-export const REPLAY_MACHINE_RUN_EXAMPLE = jsonObjectSchema.parse({
-    machine: {
-        initial_state: "waiting",
-        states: [{ name: "waiting" }, { name: "complete", terminal: true }],
-        transitions: [
-            {
-                id: "accept_callback",
-                from: "waiting",
-                to: "complete",
-                trigger: { protocol: "http", method: "POST", path: "/callback" },
-                captures: [
-                    {
-                        variable: "token",
-                        value: { source: "request_json", path: ["token"] },
-                        sensitive: true,
-                    },
-                ],
-                actions: [{ type: "http_response", status: 204, body: "" }],
-                max_uses: 1,
-            },
-        ],
-        max_transitions: 1,
-    },
-    events: [
-        {
-            protocol: "http",
-            connection: "not_applicable",
-            at_ms: 0,
-            method: "POST",
-            path: "/callback",
-            headers: {},
-            body: '{"token":"opaque"}',
-        },
-    ],
-});

package/dist/domain/javascriptExportInstrumentation.js

@@ -1,95 +0,0 @@
-import { createHash } from "node:crypto";
-import { z } from "zod";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-export const javascriptExportInstrumentationInputSchema = z.strictObject({
-    artifact_path: z.string().min(1),
-    artifact_sha256: digestSchema,
-    selection: z.strictObject({
-        byte_start: z.number().int().min(0),
-        byte_end: z.number().int().min(1),
-        selected_sha256: digestSchema,
-        export_name: z.string().regex(/^[A-Za-z_$][A-Za-z0-9_$]{0,199}$/u),
-    }),
-});
-export const javascriptExportTransformationManifestSchema = z.strictObject({
-    kind: z.literal("commonjs-factory-export-v1"),
-    artifact_path: z.string().min(1),
-    original_sha256: digestSchema,
-    original_byte_length: z.number().int().min(0),
-    instrumented_sha256: digestSchema,
-    instrumented_byte_length: z.number().int().min(0),
-    selected_range: z.strictObject({
-        byte_start: z.number().int().min(0),
-        byte_end: z.number().int().min(1),
-        selected_sha256: digestSchema,
-    }),
-    inserted_ranges: z
-        .array(z.strictObject({
-        byte_start: z.number().int().min(0),
-        byte_end: z.number().int().min(1),
-        inserted_sha256: digestSchema,
-        purpose: z.enum(["factory-prefix", "export-binding", "factory-suffix"]),
-    }))
-        .length(3),
-    output_format: z.literal("commonjs-factory"),
-    source_map: z.literal(null),
-});
-/** Instrument one exact UTF-8 expression range without mutating source bytes. */
-export const instrumentJavaScriptExport = (source, rawInput) => {
-    const input = javascriptExportInstrumentationInputSchema.parse(rawInput);
-    if (sha256(source) !== input.artifact_sha256)
-        throw new TypeError("JavaScript instrumentation artifact digest mismatch");
-    const { byte_start: start, byte_end: end } = input.selection;
-    if (end <= start || end > source.byteLength)
-        throw new TypeError("JavaScript instrumentation selection is out of bounds");
-    const selected = source.slice(start, end);
-    if (sha256(selected) !== input.selection.selected_sha256)
-        throw new TypeError("JavaScript instrumentation selection digest mismatch");
-    decodeUtf8(source);
-    decodeUtf8(selected);
-    const prefix = encode("function(module, exports, require) {\n");
-    const binding = encode(`\nmodule.exports[${JSON.stringify(input.selection.export_name)}] = (${decodeUtf8(selected)});\n`);
-    const suffix = encode("}\n");
-    const bytes = concatenate([prefix, source, binding, suffix]);
-    const bindingStart = prefix.byteLength + source.byteLength;
-    const suffixStart = bindingStart + binding.byteLength;
-    const manifest = javascriptExportTransformationManifestSchema.parse({
-        kind: "commonjs-factory-export-v1",
-        artifact_path: input.artifact_path,
-        original_sha256: input.artifact_sha256,
-        original_byte_length: source.byteLength,
-        instrumented_sha256: sha256(bytes),
-        instrumented_byte_length: bytes.byteLength,
-        selected_range: {
-            byte_start: start,
-            byte_end: end,
-            selected_sha256: input.selection.selected_sha256,
-        },
-        inserted_ranges: [
-            range(0, prefix, "factory-prefix"),
-            range(bindingStart, binding, "export-binding"),
-            range(suffixStart, suffix, "factory-suffix"),
-        ],
-        output_format: "commonjs-factory",
-        source_map: null,
-    });
-    return { bytes, manifest };
-};
-const range = (start, bytes, purpose) => ({
-    byte_start: start,
-    byte_end: start + bytes.byteLength,
-    inserted_sha256: sha256(bytes),
-    purpose,
-});
-const encode = (value) => new TextEncoder().encode(value);
-const decodeUtf8 = (value) => new TextDecoder("utf-8", { fatal: true }).decode(value);
-const concatenate = (values) => {
-    const output = new Uint8Array(values.reduce((total, value) => total + value.byteLength, 0));
-    let offset = 0;
-    for (const value of values) {
-        output.set(value, offset);
-        offset += value.byteLength;
-    }
-    return output;
-};
-const sha256 = (value) => createHash("sha256").update(value).digest("hex");