@assemblyline-agents/core 1.0.0 → 3.0.0

package/dist/agent-hooks.js

@@ -0,0 +1,198 @@
+/** Define one filesystem-discovered agent hook. */
+export function defineHook(definition) {
+    return definition;
+}
+export function isHookDefinition(candidate) {
+    if (!candidate || typeof candidate !== "object")
+        return false;
+    const events = candidate.events;
+    if (!events || typeof events !== "object" || Array.isArray(events))
+        return false;
+    return Object.values(events).every((handler) => typeof handler === "function");
+}
+// Deployment artifacts may resolve their packaged core module separately from
+// the runtime's core module. The synchronous stack lives on the shared isolate
+// global so both copies participate in the same evaluation frame.
+const dispatcherGlobal = globalThis;
+const dispatcherStack = dispatcherGlobal.__assemblyLineAgentHookDispatcherV1 ??= [];
+export function useRun() {
+    return currentFrame("useRun").run;
+}
+export function usePersistentState(key, initial) {
+    const frame = currentFrame("usePersistentState");
+    assertStateKey(key);
+    assertJsonValue(initial, `initial value for hook state "${key}"`);
+    const stored = frame.state.values[key];
+    const value = stored === undefined ? initial : stored;
+    const setter = (next) => {
+        if (dispatcherStack.includes(frame)) {
+            throw new Error(`The setter for hook state "${key}" cannot be called during agent.setup(); setup evaluation is side-effect free.`);
+        }
+        return frame.setState(key, typeof next === "function"
+            ? (current) => {
+                const resolved = next((current === undefined ? initial : current));
+                assertJsonValue(resolved, `next value for hook state "${key}"`);
+                return resolved;
+            }
+            : next);
+    };
+    return [value, setter];
+}
+export function useModel(model) {
+    const frame = currentFrame("useModel");
+    assertName("model", model);
+    if (frame.model !== undefined && frame.model !== model) {
+        throw new Error(`Conflicting useModel() calls selected "${frame.model}" and "${model}".`);
+    }
+    frame.model = model;
+}
+export function useReasoning(level) {
+    const frame = currentFrame("useReasoning");
+    if (!["off", "minimal", "low", "medium", "high", "xhigh"].includes(level)) {
+        throw new Error(`useReasoning() received invalid level "${String(level)}".`);
+    }
+    if (frame.reasoning !== undefined && frame.reasoning !== level) {
+        throw new Error(`Conflicting useReasoning() calls selected "${frame.reasoning}" and "${level}".`);
+    }
+    frame.reasoning = level;
+}
+export function useInstructions(text) {
+    const frame = currentFrame("useInstructions");
+    if (typeof text !== "string" || !text.trim())
+        throw new Error("useInstructions() requires non-empty text.");
+    frame.instructions.push(text);
+}
+export function useTool(name) {
+    addName(currentFrame("useTool").tools, "tool", name);
+}
+export function useSandbox(name) {
+    const frame = currentFrame("useSandbox");
+    assertName("sandbox", name);
+    if (frame.sandbox !== undefined && frame.sandbox !== name) {
+        throw new Error(`Conflicting useSandbox() calls selected "${frame.sandbox}" and "${name}".`);
+    }
+    frame.sandbox = name;
+}
+export function useOutputSchema(schema) {
+    const frame = currentFrame("useOutputSchema");
+    assertJsonValue(schema, "output schema");
+    if (frame.outputSchema !== undefined && stableJson(frame.outputSchema) !== stableJson(schema)) {
+        throw new Error("Conflicting useOutputSchema() calls selected different schemas.");
+    }
+    frame.outputSchema = schema;
+}
+/** @deprecated Author after-persist event reactions in `hooks/*.ts` with `defineHook()`. */
+export function useEvent(type, handler) {
+    const frame = currentFrame("useEvent");
+    if (typeof type !== "string" || !type.trim())
+        throw new Error("useEvent() requires a non-empty event type.");
+    if (typeof handler !== "function")
+        throw new Error("useEvent() requires a handler function.");
+    frame.events.push({ type, handler });
+}
+/** Runtime/compiler seam for one synchronous setup evaluation. */
+export function evaluateAgentSetup(setup, input) {
+    const frame = {
+        ...input,
+        instructions: [],
+        tools: orderedNames(input.defaultTools),
+        skills: orderedNames(input.defaultSkills),
+        connections: orderedNames(input.defaultConnections),
+        subagents: orderedNames(input.defaultSubagents),
+        events: []
+    };
+    dispatcherStack.push(frame);
+    try {
+        const result = setup();
+        if (isPromiseLike(result)) {
+            throw new Error("agent.setup() must be synchronous and must not return a promise.");
+        }
+    }
+    finally {
+        const popped = dispatcherStack.pop();
+        if (popped !== frame) {
+            dispatcherStack.length = 0;
+            throw new Error("Agent hook dispatcher stack became unbalanced.");
+        }
+    }
+    if (!frame.model)
+        throw new Error("agent.setup() must select exactly one model with useModel().");
+    const declaration = {
+        model: frame.model,
+        instructions: frame.instructions,
+        tools: frame.tools.values,
+        skills: frame.skills.values,
+        connections: frame.connections.values,
+        subagents: frame.subagents.values,
+        events: frame.events
+    };
+    if (frame.reasoning !== undefined)
+        declaration.reasoning = frame.reasoning;
+    if (frame.sandbox !== undefined)
+        declaration.sandbox = frame.sandbox;
+    if (frame.outputSchema !== undefined)
+        declaration.outputSchema = frame.outputSchema;
+    return declaration;
+}
+function currentFrame(hook) {
+    const frame = dispatcherStack.at(-1);
+    if (!frame) {
+        throw new Error(`${hook}() may only be called synchronously inside agent.setup() or a function called by setup().`);
+    }
+    return frame;
+}
+function orderedNames(initial = []) {
+    const target = { values: [], seen: new Set() };
+    for (const name of initial)
+        addName(target, "tool", name);
+    return target;
+}
+function addName(target, kind, name) {
+    assertName(kind, name);
+    if (target.seen.has(name))
+        return;
+    target.seen.add(name);
+    target.values.push(name);
+}
+function assertName(kind, value) {
+    if (typeof value !== "string" || !value.trim())
+        throw new Error(`use${capitalize(kind)}() requires a non-empty name.`);
+}
+function assertStateKey(key) {
+    if (typeof key !== "string" || !key.trim())
+        throw new Error("usePersistentState() requires a non-empty explicit key.");
+    if (key.length > 200)
+        throw new Error("Hook-state keys may not exceed 200 characters.");
+}
+function assertJsonValue(value, label) {
+    let serialized;
+    try {
+        serialized = JSON.stringify(value);
+    }
+    catch {
+        throw new Error(`${label} must be JSON serializable.`);
+    }
+    if (serialized === undefined)
+        throw new Error(`${label} must be JSON serializable.`);
+    if (serialized.length > 16_384)
+        throw new Error(`${label} exceeds the 16384-character hook-state limit.`);
+}
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    if (value && typeof value === "object") {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, child]) => `${JSON.stringify(key)}:${stableJson(child)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function isPromiseLike(value) {
+    return Boolean(value) && (typeof value === "object" || typeof value === "function") &&
+        typeof value.then === "function";
+}
+function capitalize(value) {
+    return `${value.slice(0, 1).toUpperCase()}${value.slice(1)}`;
+}
+//# sourceMappingURL=agent-hooks.js.map

package/dist/agent-hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-hooks.js","sourceRoot":"","sources":["../src/agent-hooks.ts"],"names":[],"mappings":"AAuCA,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,UAA0B;IACnD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAkB;IACjD,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,MAAM,GAAI,SAAkC,CAAC,MAAM,CAAC;IAC1D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,KAAK,UAAU,CAAC,CAAC;AACjF,CAAC;AA2CD,8EAA8E;AAC9E,+EAA+E;AAC/E,kEAAkE;AAClE,MAAM,gBAAgB,GAAG,UAAkD,CAAC;AAC5E,MAAM,eAAe,GAAG,gBAAgB,CAAC,mCAAmC,KAAK,EAAE,CAAC;AAEpF,MAAM,UAAU,MAAM;IACpB,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,OAAU;IAEV,MAAM,KAAK,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;IACjD,cAAc,CAAC,GAAG,CAAC,CAAC;IACpB,eAAe,CAAC,OAAO,EAAE,iCAAiC,GAAG,GAAG,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAkB,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IACtD,MAAM,MAAM,GAA6B,CAAC,IAAI,EAAE,EAAE;QAChD,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,gFAAgF,CAAC,CAAC;QACrI,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,CACnB,GAAG,EACH,OAAO,IAAI,KAAK,UAAU;YACxB,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE;gBACV,MAAM,QAAQ,GAAI,IAA0B,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAM,CAAC,CAAC;gBAC/F,eAAe,CAAC,QAAQ,EAAE,8BAA8B,GAAG,GAAG,CAAC,CAAC;gBAChE,OAAO,QAAQ,CAAC;YAClB,CAAC;YACH,CAAC,CAAC,IAAI,CACT,CAAC;IACJ,CAAC,CAAC;IACF,OAAO,CAAC,KAAK,EAAE,MAAM,CAAU,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,0CAA0C,KAAK,CAAC,KAAK,UAAU,KAAK,IAAI,CAAC,CAAC;IAC5F,CAAC;IACD,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAqB;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,CAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,CAAC,SAAS,UAAU,KAAK,IAAI,CAAC,CAAC;IACpG,CAAC;IACD,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC5G,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IACzC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,CAAC,OAAO,UAAU,IAAI,IAAI,CAAC,CAAC;IAC/F,CAAC;IACD,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAkB;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAC9C,eAAe,CAAC,MAAmB,EAAE,eAAe,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC;AAC9B,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAA0B;IAC/D,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC7G,IAAI,OAAO,OAAO,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC9F,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,KAA+B;IAE/B,MAAM,KAAK,GAAoB;QAC7B,GAAG,KAAK;QACR,YAAY,EAAE,EAAE;QAChB,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC;QACvC,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC;QACzC,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,kBAAkB,CAAC;QACnD,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAC/C,MAAM,EAAE,EAAE;KACX,CAAC;IACF,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC;QACvB,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClG,MAAM,WAAW,GAA8B;QAC7C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;QACzB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;QAC3B,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,WAAW,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAC3E,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,WAAW,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IACrE,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,WAAW,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACpF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2FAA2F,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,UAA6B,EAAE;IACnD,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAU,EAAyB,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,MAAoB,EAAE,IAAY,EAAE,IAAY;IAC/D,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvB,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO;IAClC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;AACzH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACvH,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,eAAe,CAAC,KAAgB,EAAE,KAAa;IACtD,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACrF,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gDAAgD,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACxE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aACxD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;aACpE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC;QACjF,OAAQ,KAA4B,CAAC,IAAI,KAAK,UAAU,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC"}

package/dist/agent-state.d.ts

@@ -0,0 +1,18 @@
+import type { JsonValue } from "./index.js";
+export type AgentStateUpdater<T extends JsonValue> = T | ((current: T) => T);
+/** Conversation-scoped durable control-plane state exposed to tools and hooks. */
+export interface AgentStateHandle {
+    readonly revision: number;
+    get<T extends JsonValue>(key: string): Promise<T | undefined>;
+    set<T extends JsonValue>(key: string, value: T, options?: {
+        expectedRevision?: number;
+    }): Promise<number>;
+    update<T extends JsonValue>(key: string, update: (current: T | undefined) => T, options?: {
+        expectedRevision?: number;
+    }): Promise<number>;
+    delete(key: string, options?: {
+        expectedRevision?: number;
+    }): Promise<number>;
+}
+export type PersistentStateSetter<T extends JsonValue> = (value: AgentStateUpdater<T>) => Promise<number>;
+//# sourceMappingURL=agent-state.d.ts.map

package/dist/agent-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-state.d.ts","sourceRoot":"","sources":["../src/agent-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AAE7E,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,GAAG,CAAC,CAAC,SAAS,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAC9D,GAAG,CAAC,CAAC,SAAS,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1G,MAAM,CAAC,CAAC,SAAS,SAAS,EACxB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,SAAS,KAAK,CAAC,EACrC,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GACtC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/E;AAED,MAAM,MAAM,qBAAqB,CAAC,CAAC,SAAS,SAAS,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC"}

package/dist/agent-state.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent-state.js.map

package/dist/agent-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-state.js","sourceRoot":"","sources":["../src/agent-state.ts"],"names":[],"mappings":""}

package/dist/artifact-dir.d.ts

@@ -1,10 +1,4 @@
-/**
- * Generated-artifact directory naming. The live name is `.assembly-line`;
- * the legacy `.openeve` spelling is recognized ONLY so ignore/clean tooling
- * (compiler manifest walk, `clean:artifacts`, .gitignore) keeps skipping and
- * deleting stale legacy build output. Nothing reads or writes `.openeve`
- * artifacts anymore.
- */
+/** Generated-artifact directory naming. */
 export declare const KNOWN_ARTIFACT_DIR_NAMES: readonly string[];
 export declare function isKnownArtifactDirName(name: string): boolean;
 //# sourceMappingURL=artifact-dir.d.ts.map

package/dist/artifact-dir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-dir.d.ts","sourceRoot":"","sources":["../src/artifact-dir.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAGrD,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D"}
+{"version":3,"file":"artifact-dir.d.ts","sourceRoot":"","sources":["../src/artifact-dir.ts"],"names":[],"mappings":"AAEA,2CAA2C;AAE3C,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAwB,CAAC;AAE/E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/dist/artifact-dir.js

@@ -1,15 +1,6 @@
-import { ARTIFACT_DIR_NAME, LEGACY_ARTIFACT_DIR_NAME } from "./brand.js";
-/**
- * Generated-artifact directory naming. The live name is `.assembly-line`;
- * the legacy `.openeve` spelling is recognized ONLY so ignore/clean tooling
- * (compiler manifest walk, `clean:artifacts`, .gitignore) keeps skipping and
- * deleting stale legacy build output. Nothing reads or writes `.openeve`
- * artifacts anymore.
- */
-export const KNOWN_ARTIFACT_DIR_NAMES = [
-    ARTIFACT_DIR_NAME,
-    LEGACY_ARTIFACT_DIR_NAME,
-];
+import { ARTIFACT_DIR_NAME } from "./brand.js";
+/** Generated-artifact directory naming. */
+export const KNOWN_ARTIFACT_DIR_NAMES = [ARTIFACT_DIR_NAME];
 export function isKnownArtifactDirName(name) {
     return KNOWN_ARTIFACT_DIR_NAMES.includes(name);
 }

package/dist/artifact-dir.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-dir.js","sourceRoot":"","sources":["../src/artifact-dir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEzE;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,iBAAiB;IACjB,wBAAwB;CACzB,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"artifact-dir.js","sourceRoot":"","sources":["../src/artifact-dir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,2CAA2C;AAE3C,MAAM,CAAC,MAAM,wBAAwB,GAAsB,CAAC,iBAAiB,CAAC,CAAC;AAE/E,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC"}

package/dist/audience.d.ts

@@ -0,0 +1,16 @@
+import type { AgentPrincipal } from "./connection-types.js";
+/**
+ * The trust boundary allowed to learn from, act on, and receive one run's
+ * result. Two states: a private surface (a trusted direct run, or a channel
+ * surface belonging to one authenticated person, such as a DM) and a shared
+ * surface (everything else). Personal context — user-subject connections and
+ * principal-scoped memory — is available only on private surfaces.
+ */
+export type AgentAudience = {
+    private: boolean;
+    /** The authenticated person a private channel surface belongs to. Absent for shared surfaces and trusted direct runs. */
+    principal?: AgentPrincipal;
+    /** The originating channel conversation. Absent for direct runs. */
+    conversationId?: string;
+};
+//# sourceMappingURL=audience.d.ts.map

package/dist/audience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience.d.ts","sourceRoot":"","sources":["../src/audience.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,yHAAyH;IACzH,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC"}

package/dist/audience.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audience.js.map

package/dist/audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience.js","sourceRoot":"","sources":["../src/audience.ts"],"names":[],"mappings":""}

package/dist/brand.d.ts

@@ -1,27 +1,12 @@
 /**
- * Central brand/name constants for Assembly Line (formerly OpenEve).
+ * Central brand/name constants for Assembly Line.
  *
  * Every module that needs a brand-derived identifier imports it from here
- * instead of spelling a literal. The pre-launch alias cleanup removed all
- * transitional legacy spellings except two deliberate survivors:
- *
- * - `LEGACY_ENV_PREFIX`: the `OPENEVE_*` <-> `ASSEMBLY_LINE_*` env mirror
- *   (`applyEnvAliases`) is PERMANENT — production hosts keep `OPENEVE_*`
- *   spellings and both prefixes are always accepted.
- * - `LEGACY_ARTIFACT_DIR_NAME`: kept only so ignore/clean tooling keeps
- *   recognizing (and deleting) stale legacy build output.
- *
- * Identifiers that must never change (crypto contexts, migration IDs,
- * physical database names) are documented in docs/rename/manifest.md and
- * deliberately absent from this module.
+ * instead of spelling a literal.
  */
 export declare const PRODUCT_NAME = "Assembly Line";
 export declare const ENV_PREFIX = "ASSEMBLY_LINE_";
-/** Permanent: the env-alias mirror accepts this prefix forever. */
-export declare const LEGACY_ENV_PREFIX = "OPENEVE_";
 export declare const ARTIFACT_DIR_NAME = ".assembly-line";
-/** Recognized only by ignore/clean tooling; never read or written as a build dir. */
-export declare const LEGACY_ARTIFACT_DIR_NAME = ".openeve";
 export declare const HOSTS_FILE_NAME = "assembly-line.hosts.json";
 export declare const INTERNAL_ROUTE_PREFIX = "/assembly-line";
 export declare const SCHEDULER_SECRET_HEADER = "x-assembly-line-scheduler-secret";

package/dist/brand.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"brand.d.ts","sourceRoot":"","sources":["../src/brand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAE5C,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAC3C,mEAAmE;AACnE,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAE5C,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAClD,qFAAqF;AACrF,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAE1D,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,eAAO,MAAM,SAAS,yBAAyB,CAAC"}
+{"version":3,"file":"brand.d.ts","sourceRoot":"","sources":["../src/brand.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAE5C,eAAO,MAAM,UAAU,mBAAmB,CAAC;AAE3C,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAElD,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAE1D,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAEtD,eAAO,MAAM,uBAAuB,qCAAqC,CAAC;AAE1E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D,eAAO,MAAM,SAAS,yBAAyB,CAAC"}

package/dist/brand.js

@@ -1,27 +1,12 @@
 /**
- * Central brand/name constants for Assembly Line (formerly OpenEve).
+ * Central brand/name constants for Assembly Line.
  *
  * Every module that needs a brand-derived identifier imports it from here
- * instead of spelling a literal. The pre-launch alias cleanup removed all
- * transitional legacy spellings except two deliberate survivors:
- *
- * - `LEGACY_ENV_PREFIX`: the `OPENEVE_*` <-> `ASSEMBLY_LINE_*` env mirror
- *   (`applyEnvAliases`) is PERMANENT — production hosts keep `OPENEVE_*`
- *   spellings and both prefixes are always accepted.
- * - `LEGACY_ARTIFACT_DIR_NAME`: kept only so ignore/clean tooling keeps
- *   recognizing (and deleting) stale legacy build output.
- *
- * Identifiers that must never change (crypto contexts, migration IDs,
- * physical database names) are documented in docs/rename/manifest.md and
- * deliberately absent from this module.
+ * instead of spelling a literal.
  */
 export const PRODUCT_NAME = "Assembly Line";
 export const ENV_PREFIX = "ASSEMBLY_LINE_";
-/** Permanent: the env-alias mirror accepts this prefix forever. */
-export const LEGACY_ENV_PREFIX = "OPENEVE_";
 export const ARTIFACT_DIR_NAME = ".assembly-line";
-/** Recognized only by ignore/clean tooling; never read or written as a build dir. */
-export const LEGACY_ARTIFACT_DIR_NAME = ".openeve";
 export const HOSTS_FILE_NAME = "assembly-line.hosts.json";
 export const INTERNAL_ROUTE_PREFIX = "/assembly-line";
 export const SCHEDULER_SECRET_HEADER = "x-assembly-line-scheduler-secret";

package/dist/brand.js.map

@@ -1 +1 @@
-{"version":3,"file":"brand.js","sourceRoot":"","sources":["../src/brand.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAE5C,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAC3C,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAClD,qFAAqF;AACrF,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAAC;AAEnD,MAAM,CAAC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAE1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,kCAAkC,CAAC;AAE1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,MAAM,CAAC,MAAM,SAAS,GAAG,sBAAsB,CAAC"}
+{"version":3,"file":"brand.js","sourceRoot":"","sources":["../src/brand.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAE5C,MAAM,CAAC,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAE3C,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAElD,MAAM,CAAC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAE1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,kCAAkC,CAAC;AAE1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D,MAAM,CAAC,MAAM,SAAS,GAAG,sBAAsB,CAAC"}

package/dist/connection-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection-auth.d.ts","sourceRoot":"","sources":["../src/connection-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB,qBAAa,oCAAqC,SAAQ,KAAK;IAC7D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,gCAAgC,CAAC;gBAE1C,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,gCAAgC,CAAA;KAAO;CAOtI;AAED,qBAAa,kCAAmC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO;CAO7G;AAED,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oCAAoC,CAEpH;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kCAAkC,CAEhH;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAgBjH;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAKjG;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAa7G"}
+{"version":3,"file":"connection-auth.d.ts","sourceRoot":"","sources":["../src/connection-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACxB,gCAAgC,EAChC,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAEpB,qBAAa,oCAAqC,SAAQ,KAAK;IAC7D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,gCAAgC,CAAC;gBAE1C,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,gCAAgC,CAAA;KAAO;CAOtI;AAED,qBAAa,kCAAmC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,cAAc,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO;CAO7G;AAED,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oCAAoC,CAEpH;AAED,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kCAAkC,CAEhH;AAED,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAgBjH;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,oBAAoB,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAUjG;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAqB7G"}

package/dist/connection-auth.js

@@ -50,8 +50,15 @@ export function validateConnectionAuthDefinition(auth, prefix) {
 export function validateToolFilter(filter, prefix) {
     if (!filter)
         return;
-    if ("allow" in filter && "block" in filter) {
-        throw new Error(`${prefix}: specify only one of allow or block.`);
+    const variants = Number("allow" in filter) + Number("block" in filter) + Number("allOf" in filter);
+    if (variants !== 1)
+        throw new Error(`${prefix}: specify exactly one of allow, block, or allOf.`);
+    if ("allOf" in filter) {
+        if (!Array.isArray(filter.allOf) || filter.allOf.length === 0) {
+            throw new Error(`${prefix}: allOf must contain at least one tool filter.`);
+        }
+        for (const child of filter.allOf)
+            validateToolFilter(child, prefix);
     }
 }
 export function validateConnectionAccess(access, prefix) {
@@ -67,6 +74,14 @@ export function validateConnectionAccess(access, prefix) {
         if (access.write.approval === undefined) {
             throw new Error(`${prefix}: access.write.approval is required when writes are enabled.`);
         }
+        for (const override of access.write.approvalOverrides ?? []) {
+            if (!Array.isArray(override.tools) || override.tools.length === 0) {
+                throw new Error(`${prefix}: access.write.approvalOverrides tools must contain at least one tool pattern.`);
+            }
+            if (override.approval === undefined) {
+                throw new Error(`${prefix}: access.write.approvalOverrides approval is required.`);
+            }
+        }
     }
 }
 function isNamedConnectionError(error, name) {

package/dist/connection-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"connection-auth.js","sourceRoot":"","sources":["../src/connection-auth.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IACpD,cAAc,CAAS;IACvB,MAAM,CAAS;IACf,SAAS,CAAoC;IAEtD,YAAY,cAAsB,EAAE,UAA+F,EAAE;QACnI,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,cAAc,0BAA0B,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;QACnD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,wBAAwB,CAAC;QACzD,IAAI,OAAO,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAC5D,CAAC;CACF;AAED,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAClD,cAAc,CAAS;IACvB,MAAM,CAAS;IACf,SAAS,CAAU;IAE5B,YAAY,cAAsB,EAAE,UAAsE,EAAE;QAC1G,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,cAAc,wBAAwB,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC;QACvD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CAAC,KAAc;IACnE,OAAO,sBAAsB,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAAc;IACjE,OAAO,sBAAsB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,IAA0C,EAAE,MAAc;IACzG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO;IAChD,IAAI,cAAc,IAAI,IAAI,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,sDAAsD,CAAC,CAAC;QACnF,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,IAAI,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC;IACvF,MAAM,WAAW,GAAG,uBAAuB,IAAI,IAAI,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,CAAC;IAChG,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,2EAA2E,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,QAAQ,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,4DAA4D,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAwC,EAAE,MAAc;IACzF,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,OAAO,IAAI,MAAM,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,uCAAuC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAA8C,EAAE,MAAc;IACrG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,4CAA4C,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,6DAA6D,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,sFAAsF,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,8DAA8D,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,IAAY;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAK,KAA4B,CAAC,IAAI,KAAK,IAAI,CAAC;AACvH,CAAC"}
+{"version":3,"file":"connection-auth.js","sourceRoot":"","sources":["../src/connection-auth.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,oCAAqC,SAAQ,KAAK;IACpD,cAAc,CAAS;IACvB,MAAM,CAAS;IACf,SAAS,CAAoC;IAEtD,YAAY,cAAsB,EAAE,UAA+F,EAAE;QACnI,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,cAAc,0BAA0B,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,GAAG,sCAAsC,CAAC;QACnD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,wBAAwB,CAAC;QACzD,IAAI,OAAO,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAC5D,CAAC;CACF;AAED,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAClD,cAAc,CAAS;IACvB,MAAM,CAAS;IACf,SAAS,CAAU;IAE5B,YAAY,cAAsB,EAAE,UAAsE,EAAE;QAC1G,KAAK,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,cAAc,wBAAwB,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;QACjD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC;QACvD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAC7C,CAAC;CACF;AAED,MAAM,UAAU,sCAAsC,CAAC,KAAc;IACnE,OAAO,sBAAsB,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,KAAc;IACjE,OAAO,sBAAsB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,IAA0C,EAAE,MAAc;IACzG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO;IAChD,IAAI,cAAc,IAAI,IAAI,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,sDAAsD,CAAC,CAAC;QACnF,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,oBAAoB,IAAI,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC;IACvF,MAAM,WAAW,GAAG,uBAAuB,IAAI,IAAI,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,CAAC;IAChG,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,2EAA2E,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,QAAQ,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,4DAA4D,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAwC,EAAE,MAAc;IACzF,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;IACnG,IAAI,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,kDAAkD,CAAC,CAAC;IACjG,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,gDAAgD,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK;YAAE,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAA8C,EAAE,MAAc;IACrG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,4CAA4C,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,6DAA6D,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,sFAAsF,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,8DAA8D,CAAC,CAAC;QAC3F,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,gFAAgF,CAAC,CAAC;YAC7G,CAAC;YACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,wDAAwD,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,IAAY;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAK,KAA4B,CAAC,IAAI,KAAK,IAAI,CAAC;AACvH,CAAC"}

package/dist/connection-events.d.ts

@@ -0,0 +1,35 @@
+import type { ConnectionEventCheckResult, ConnectionEventIngressContext, ConnectionEventIngressResult, ConnectionEventLifecycleContext, ConnectionEventReconcileResult, ConnectionEventRequest, ConnectionEventsDefinition, ConnectionEventSelection } from "./connection-types.js";
+import type { ConnectionPluginMetadata } from "./plugin.js";
+export interface ConnectionPluginEventAdapter {
+    prepare?(context: ConnectionEventLifecycleContext): Promise<NonNullable<ConnectionEventLifecycleContext["state"]>> | NonNullable<ConnectionEventLifecycleContext["state"]>;
+    ingress(request: ConnectionEventRequest, context: ConnectionEventIngressContext): Promise<ConnectionEventIngressResult> | ConnectionEventIngressResult;
+    reconcile?(context: ConnectionEventLifecycleContext): Promise<ConnectionEventReconcileResult> | ConnectionEventReconcileResult;
+    remove?(context: ConnectionEventLifecycleContext): Promise<void> | void;
+    check?(context: ConnectionEventLifecycleContext): Promise<ConnectionEventCheckResult> | ConnectionEventCheckResult;
+}
+/** Attach a provider adapter to the common, validated plugin event selection. */
+export declare function defineConnectionPluginEvents(plugin: ConnectionPluginMetadata, selection: ConnectionEventSelection | undefined, adapter: ConnectionPluginEventAdapter): ConnectionEventsDefinition | undefined;
+export declare function parseConnectionEventJson(body: string): Record<string, unknown>;
+export declare function headerValue(headers: Record<string, string>, name: string): string | undefined;
+export declare function requireEnvironmentValue(env: Record<string, string | undefined>, name: string): string;
+export declare function verifyHmacSha256(input: {
+    secret: string;
+    body: string;
+    signature: string | undefined;
+    encoding?: "hex" | "base64";
+    prefix?: string;
+}): boolean;
+/** Verify Standard Webhooks/Svix v1 signatures against the exact raw body. */
+export declare function verifySvix(input: {
+    secret: string;
+    body: string;
+    id: string | undefined;
+    timestamp: string | undefined;
+    signature: string | undefined;
+    now?: number;
+    toleranceSeconds?: number;
+}): boolean;
+export declare function providerJson(fetchImpl: typeof fetch, url: string, init: RequestInit, accepted?: readonly number[]): Promise<Record<string, unknown>>;
+export declare function stringField(value: Record<string, unknown>, ...names: string[]): string | undefined;
+export declare function recordField(value: Record<string, unknown>, name: string): Record<string, unknown> | undefined;
+//# sourceMappingURL=connection-events.d.ts.map

package/dist/connection-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-events.d.ts","sourceRoot":"","sources":["../src/connection-events.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAC5B,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAG5D,MAAM,WAAW,4BAA4B;IAC3C,OAAO,CAAC,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,WAAW,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3K,OAAO,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,4BAA4B,CAAC,GAAG,4BAA4B,CAAC;IACvJ,SAAS,CAAC,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG,8BAA8B,CAAC;IAC/H,MAAM,CAAC,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACxE,KAAK,CAAC,CAAC,OAAO,EAAE,+BAA+B,GAAG,OAAO,CAAC,0BAA0B,CAAC,GAAG,0BAA0B,CAAC;CACpH;AAED,iFAAiF;AACjF,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,wBAAwB,GAAG,SAAS,EAC/C,OAAO,EAAE,4BAA4B,GACpC,0BAA0B,GAAG,SAAS,CAkBxC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAW9E;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG7F;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrG;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAcV;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,KAAK,EAAE;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,OAAO,CA0BV;AAED,wBAAsB,YAAY,CAChC,SAAS,EAAE,OAAO,KAAK,EACvB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,QAAQ,GAAE,SAAS,MAAM,EAAyB,GACjD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgBlC;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAMlG;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAG7G"}

package/dist/connection-events.js

@@ -0,0 +1,131 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { resolveConnectionPluginEvents } from "./plugin.js";
+/** Attach a provider adapter to the common, validated plugin event selection. */
+export function defineConnectionPluginEvents(plugin, selection, adapter) {
+    const resolved = resolveConnectionPluginEvents(plugin, selection);
+    if (!resolved)
+        return undefined;
+    return {
+        enabled: resolved.enabled,
+        catalog: resolved.catalog,
+        defaultEvents: resolved.defaultEvents,
+        selectedEvents: resolved.selectedEvents,
+        resources: resolved.resources,
+        mode: resolved.mode,
+        scope: resolved.scope,
+        requiredEnv: resolved.requiredEnv,
+        ...(adapter.prepare ? { prepare: adapter.prepare } : {}),
+        ingress: adapter.ingress,
+        ...(adapter.reconcile ? { reconcile: adapter.reconcile } : {}),
+        ...(adapter.remove ? { remove: adapter.remove } : {}),
+        ...(adapter.check ? { check: adapter.check } : {})
+    };
+}
+export function parseConnectionEventJson(body) {
+    let value;
+    try {
+        value = JSON.parse(body);
+    }
+    catch {
+        throw new Error("Provider event body is not valid JSON.");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Provider event body must be a JSON object.");
+    }
+    return value;
+}
+export function headerValue(headers, name) {
+    const lower = name.toLowerCase();
+    return Object.entries(headers).find(([key]) => key.toLowerCase() === lower)?.[1];
+}
+export function requireEnvironmentValue(env, name) {
+    const value = env[name]?.trim();
+    if (!value)
+        throw new Error(`${name} is required for connection events.`);
+    return value;
+}
+export function verifyHmacSha256(input) {
+    if (!input.signature)
+        return false;
+    const signature = input.prefix && input.signature.startsWith(input.prefix)
+        ? input.signature.slice(input.prefix.length)
+        : input.signature;
+    const encoding = input.encoding ?? "hex";
+    let actual;
+    try {
+        actual = Buffer.from(signature, encoding);
+    }
+    catch {
+        return false;
+    }
+    const expected = createHmac("sha256", input.secret).update(input.body).digest();
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+/** Verify Standard Webhooks/Svix v1 signatures against the exact raw body. */
+export function verifySvix(input) {
+    if (!input.id || !input.timestamp || !input.signature)
+        return false;
+    const timestamp = Number(input.timestamp);
+    if (!Number.isFinite(timestamp))
+        return false;
+    const now = Math.floor((input.now ?? Date.now()) / 1_000);
+    if (Math.abs(now - timestamp) > (input.toleranceSeconds ?? 300))
+        return false;
+    const key = input.secret.startsWith("whsec_") ? input.secret.slice(6) : input.secret;
+    let decoded;
+    try {
+        decoded = Buffer.from(key, "base64");
+    }
+    catch {
+        return false;
+    }
+    const expected = createHmac("sha256", decoded)
+        .update(`${input.id}.${input.timestamp}.${input.body}`)
+        .digest();
+    return input.signature.split(/\s+/u).some((candidate) => {
+        const encoded = candidate.startsWith("v1,") ? candidate.slice(3) : candidate;
+        let actual;
+        try {
+            actual = Buffer.from(encoded, "base64");
+        }
+        catch {
+            return false;
+        }
+        return actual.length === expected.length && timingSafeEqual(actual, expected);
+    });
+}
+export async function providerJson(fetchImpl, url, init, accepted = [200, 201, 202, 204]) {
+    const response = await fetchImpl(url, init);
+    const text = await response.text();
+    let value = {};
+    if (text) {
+        try {
+            value = JSON.parse(text);
+        }
+        catch {
+            value = text;
+        }
+    }
+    if (!accepted.includes(response.status)) {
+        const detail = value && typeof value === "object" && !Array.isArray(value)
+            ? JSON.stringify(value)
+            : text;
+        throw new Error(`Provider event API returned HTTP ${response.status}${detail ? `: ${detail}` : ""}.`);
+    }
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+export function stringField(value, ...names) {
+    for (const name of names) {
+        const item = value[name];
+        if (typeof item === "string" && item.length > 0)
+            return item;
+    }
+    return undefined;
+}
+export function recordField(value, name) {
+    const item = value[name];
+    return item && typeof item === "object" && !Array.isArray(item) ? item : undefined;
+}
+//# sourceMappingURL=connection-events.js.map