@cursor/bdk 0.2.24 → 0.2.26

package/AGENTS.md

@@ -13,16 +13,6 @@ Start machine-readable docs at `dist/docs/llms.txt` when it exists, or at
 `/docs/llms.txt` on a running host. Use `llms-full.txt` only when the whole
 documentation set is needed.
 
-Before committing or reviewing any BDK documentation change, read the
-repo-wide writing skill at `.cursor/skills/docs/writing/SKILL.md` (repo root)
-and run `/docs-lint` on every change. The BDK naming, skill-link, and
-verify rules live in `.cursor/rules/packages/agent-sdk-docs-style.mdc` and
-attach automatically when a published docs file is in context.
-
-Before writing or editing a template, read
-[`docs/.cursor/skills/template-lint/SKILL.md`](./docs/.cursor/skills/template-lint/SKILL.md).
-Run `/template-lint` before every commit or review that changes `templates/`.
-
 Run the CLI under **Node, never Bun** — use the installed `bdk`
 bin; from a source checkout of this package,
 `pnpm exec tsx src/bin/agent-serve.ts <command> …` is equivalent. Bun's
@@ -36,15 +26,15 @@ Before scaffolding, wiring channels, writing evals, or deploying, **read the
 matching skill under `skills/<task>/SKILL.md`** (paths
 below are relative to this package). Those files ship with `@cursor/bdk`.
 Cloud agents get the same published skills via `GetManagedSkills`,
-which reads these files. Open them directly. There are no
-`.cursor/skills/` stubs for authoring.
+which reads these files. Open them directly. Authoring notes live in
+`skills/`, not in a second stub copy.
 
 | Skill | Read it when |
 | --- | --- |
 | `skills/framework-map/SKILL.md` | First contact: folder structure, runtime, sessions, state, invariants |
 | `skills/create-agent/SKILL.md` | Scaffolding a new agent (interview → scaffold → verify) |
 | `skills/evals/SKILL.md` | Writing evals; fixture strategy; the regression ratchet |
-| `skills/otel/SKILL.md` | OpenTelemetry export (OTLP env / `serve({ otel })` / `ctx.host.otel`) |
+| `skills/otel/SKILL.md` | OpenTelemetry export (`OTEL_*` variables and `@opentelemetry/api`) |
 | `skills/hillclimb/SKILL.md` | Improving an existing agent measurably |
 | `skills/github/SKILL.md` | GitHub webhook agents; replay / forward / fixtures / cursor-events |
 | `skills/setup-slack/SKILL.md` | Slack wiring and channel watching |
@@ -52,11 +42,6 @@ which reads these files. Open them directly. There are no
 | `skills/deploy/SKILL.md` | Deploy or redeploy from a pushed Git ref with an attached service account |
 | `skills/debug/SKILL.md` | Something misbehaving locally (symptom → cause) |
 
-Hosted-platform debug (stopped / slow start / health-fail, Datadog
-`cursor.agent_serve.*`) is the monorepo skill
-`.cursor/skills/debugging/debug-agentsdk-deployment/SKILL.md` — it does
-not ship with `@cursor/bdk`.
-
 ## Recommended loop
 
 ```bash
@@ -336,6 +321,7 @@ Fixtures still work for offline replay: `POST` a saved payload with an
 - Expect `bot/evals/` to be loaded — evals live at the **project root** `evals/`.
 - Build optional object fields with a conditional empty-object spread.
   Assign the property directly; `undefined` is fine on optional keys.
+  `bdk/no-conditional-empty-spread` enforces this.
 
   ```ts
   // ❌ BAD

package/CHANGELOG.md

@@ -0,0 +1,3 @@
+# Changelog
+
+The notes for each `@cursor/bdk` release are at <https://cursor.com/docs/bdk/changelog>.

package/dist/artifacts.d.ts

@@ -9,7 +9,7 @@
  * `tag_artifact` built-in tool generated from the same kinds registry.
  *
  * ```ts
- * import { z } from "zod/v3";
+ * import * as z from "zod/v4";
  * import { defineArtifacts } from "@cursor/bdk/artifacts";
  *
  * export default defineArtifacts({

package/dist/artifacts.js

@@ -9,7 +9,7 @@
  * `tag_artifact` built-in tool generated from the same kinds registry.
  *
  * ```ts
- * import { z } from "zod/v3";
+ * import * as z from "zod/v4";
  * import { defineArtifacts } from "@cursor/bdk/artifacts";
  *
  * export default defineArtifacts({

package/dist/bin/agent-serve.d.ts

@@ -13,7 +13,7 @@
  *   agent-sdk convert-automation <url> [--dir <path>] [--json]
  *   agent-sdk migrate   [--dir .] [--no-wait] [--json]
  *   agent-sdk eval        [--dir .] [evalId...]
- *   agent-sdk validate   [--dir .]
+ *   agent-sdk validate   [--dir .] [--json]
  *   agent-sdk slack     <subcommand>
  */
 export {};

package/dist/bin/agent-serve.js

@@ -13,15 +13,16 @@
  *   agent-sdk convert-automation <url> [--dir <path>] [--json]
  *   agent-sdk migrate   [--dir .] [--no-wait] [--json]
  *   agent-sdk eval        [--dir .] [evalId...]
- *   agent-sdk validate   [--dir .]
+ *   agent-sdk validate   [--dir .] [--json]
  *   agent-sdk slack     <subcommand>
  */
 import { spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { parseArgs } from "node:util";
-import { formatDiagnostics, projectInfo, resolveAgentMounts, serve } from "../index.js";
+import { serve } from "../index.js";
 import { registerAuthoredModuleLoaders } from "../internal/authored-loaders.js";
+import { formatDiagnostics, formatValidateJson, projectInfo, resolveAgentMounts, } from "../internal/discovery.js";
 import { cmdCall, cmdChat, cmdCost, cmdEval, cmdEvalCancel, cmdEvalStatus, cmdInit, cmdLogs, cmdPlayground, cmdResume, cmdRun, cmdSession, cmdSessions, cmdSkill, cmdTrajectory, } from "../internal/cli-ax.js";
 import { cmdCancelRuns, cmdDelete, cmdDeploy, cmdDeploymentStatus, cmdDeployments, cmdEventRepos, cmdKill, cmdRollback, cmdRotateToken, cmdSecretsList, cmdSecretsSet, cmdSecretsUnset, cmdStart, cmdStop, cmdUnlockDeploys, cmdUpgrade, } from "../internal/cli-deploy.js";
 import { cmdImagesList, cmdImagesPush, cmdImagesRm } from "../internal/cli-images.js";
@@ -99,7 +100,7 @@ Usage:
                           [--out <file.json>]
   ${CLI} eval cancel <runId> --url <baseUrl> [--dir <path>] [--json]
   ${CLI} info        [--dir <path>] [--json]
-  ${CLI} validate    [--dir <path>]
+  ${CLI} validate    [--dir <path>] [--json]
   ${CLI} login       [--api-key <key>] [--key-name <name>]
   ${CLI} logout
   ${CLI} whoami      [--json]
@@ -308,6 +309,8 @@ Commands:
               recipe (see gitlab help).
   bitbucket   Bitbucket webhook pack (Cloud + Data Center): replay a pull
               request, events, forward recipe (see bitbucket help).
+  pagerduty   PagerDuty webhook pack: replay synthesized incident events,
+              events (see pagerduty help).
 
 Agent loop:
   ${CLI} validate --dir .
@@ -442,7 +445,7 @@ Options:
   --skip-report      eval: ignore reporters from evals.config.ts / eval files.
   --no-stream        run/eval: silence live progress on stderr (JSON still prints).
   --json             JSON output (init/convert-automation/install-skills/
-                     info/chat/eval/logs/version/
+                     info/validate/chat/eval/logs/version/
                      sessions/session/github; run defaults to JSON). logs:
                      NDJSON progress/log events (v2: {sessionId, line}).
                      session: trajectory JSON
@@ -487,7 +490,7 @@ Options:
   --action           github/gitlab replay: event action (e.g. opened, open).
   --conclusion       github replay: CI conclusion (check_run/suite/status).
                      gitlab replay: pipeline status (success, failed, …).
-  --comment          github/gitlab/bitbucket replay: comment / note body.
+  --comment          github/gitlab/bitbucket/pagerduty replay: comment / note body.
   --context          github replay: commit-status context.
   --dry-run          github replay: print synthesized payloads, don't POST.
   --out              eval / eval status <runId>: also write the full results
@@ -726,6 +729,29 @@ async function main(argv) {
                 out: values.out,
             });
         }
+        case "pagerduty": {
+            const port = values.port === undefined ? undefined : Number.parseInt(values.port, 10);
+            if (port !== undefined && (Number.isNaN(port) || port < 0 || port > 65535)) {
+                process.stderr.write(`invalid --port: ${values.port}\n`);
+                return 1;
+            }
+            const { cmdPagerDuty } = await import("../internal/cli-pagerduty.js");
+            return cmdPagerDuty(positionals[0], {
+                dir,
+                slug: values.slug,
+                channel: values.channel?.at(-1),
+                host: values.host,
+                port,
+                url: values.url,
+                events: values.events,
+                secret: values.secret,
+                json: values.json,
+                incidentId: positionals[1],
+                comment: values.comment,
+                dryRun: values["dry-run"],
+                out: values.out,
+            });
+        }
         case "bitbucket": {
             const port = values.port === undefined ? undefined : Number.parseInt(values.port, 10);
             if (port !== undefined && (Number.isNaN(port) || port < 0 || port > 65535)) {
@@ -1172,16 +1198,20 @@ async function main(argv) {
         }
         case "validate": {
             const mounts = await loadMounts(dir);
-            let hasError = false;
-            for (const { slug, project } of mounts) {
-                const label = slug === "" ? project.name : `${slug} (${project.name})`;
-                if (project.diagnostics.length === 0) {
-                    process.stdout.write(`ok: ${label} has no diagnostics\n`);
-                    continue;
+            if (values.json === true) {
+                process.stdout.write(formatValidateJson(mounts));
+            }
+            else {
+                for (const { slug, project } of mounts) {
+                    const label = slug === "" ? project.name : `${slug} (${project.name})`;
+                    if (project.diagnostics.length === 0) {
+                        process.stdout.write(`ok: ${label} has no diagnostics\n`);
+                        continue;
+                    }
+                    process.stdout.write(`${label}:\n${formatDiagnostics(project.diagnostics)}\n`);
                 }
-                process.stdout.write(`${label}:\n${formatDiagnostics(project.diagnostics)}\n`);
-                hasError ||= project.diagnostics.some((d) => d.severity === "error");
             }
+            const hasError = mounts.some((mount) => mount.project.diagnostics.some((diagnostic) => diagnostic.severity === "error"));
             return hasError ? 1 : 0;
         }
         case "info": {
@@ -1509,8 +1539,10 @@ function printServeBanner(handle, opts) {
         process.stdout.write(`${agents.length} agents listening ${versionTag}\n`);
     }
     else {
-        const info = projectInfo(agents[0]?.project ?? handle.project);
-        process.stdout.write(`${info.name} listening ${versionTag}\n`);
+        const info = agents[0]?.info;
+        if (info !== undefined) {
+            process.stdout.write(`${info.name} listening ${versionTag}\n`);
+        }
     }
     const playgroundUrl = resolvePlaygroundBannerUrl(handle, opts.noPlayground);
     if (playgroundUrl !== undefined) {
@@ -1526,26 +1558,28 @@ function printServeBanner(handle, opts) {
         process.stdout.write(c.dim(`  api  ${handle.url}\n`));
         if (agents.length > 1 || agents[0]?.slug !== "") {
             for (const agent of agents) {
-                const info = projectInfo(agent.project);
+                const info = agent.info;
                 process.stdout.write(c.dim(`  /${agent.slug}  ${info.name}\n`));
             }
         }
         else {
-            const info = projectInfo(handle.project);
-            process.stdout.write(c.dim(`  POST ${handle.url}/v1/session\n`));
-            process.stdout.write(c.dim(`  GET  ${handle.url}/v1/session/:sessionId/stream\n`));
-            for (const channel of info.channels) {
-                if (channel.id === "http") {
-                    continue;
+            const info = agents[0]?.info;
+            if (info !== undefined) {
+                process.stdout.write(c.dim(`  POST ${handle.url}/v1/session\n`));
+                process.stdout.write(c.dim(`  GET  ${handle.url}/v1/session/:sessionId/stream\n`));
+                for (const channel of info.channels) {
+                    if (channel.id === "http") {
+                        continue;
+                    }
+                    for (const route of channel.routes) {
+                        process.stdout.write(c.dim(`  ${route.method} ${handle.url}${route.url}\n`));
+                    }
                 }
-                for (const route of channel.routes) {
-                    process.stdout.write(c.dim(`  ${route.method} ${handle.url}${route.url}\n`));
+                if (info.schedules.length > 0) {
+                    const scheduleMode = opts.noSchedules ? "disabled" : "running on cron cadence (UTC)";
+                    process.stdout.write(c.dim(`  schedules: ${info.schedules.map((s) => s.name).join(", ")} — ${scheduleMode}\n`));
                 }
             }
-            if (info.schedules.length > 0) {
-                const scheduleMode = opts.noSchedules ? "disabled" : "running on cron cadence (UTC)";
-                process.stdout.write(c.dim(`  schedules: ${info.schedules.map((s) => s.name).join(", ")} — ${scheduleMode}\n`));
-            }
         }
         if (handle.docsUrl !== undefined) {
             process.stdout.write(c.dim(`  docs  ${handle.docsUrl}\n`));
@@ -1556,20 +1590,26 @@ function printServeBanner(handle, opts) {
     }
     if (opts.dev &&
         (process.env.GITHUB_WEBHOOK_SECRET === undefined || process.env.GITHUB_WEBHOOK_SECRET === "") &&
-        handle.agents.some((agent) => projectInfo(agent.project).channels.some((c) => c.kind === "github"))) {
+        handle.agents.some((agent) => agent.info.channels.some((c) => c.kind === "github"))) {
         process.stdout.write(c.dim(`  github: dev accepts unsigned loopback deliveries (${CLI} github forward works without a secret; set GITHUB_WEBHOOK_SECRET to verify signatures)\n`));
     }
     if (opts.dev &&
         (process.env.GITLAB_WEBHOOK_SECRET === undefined || process.env.GITLAB_WEBHOOK_SECRET === "") &&
-        handle.agents.some((agent) => projectInfo(agent.project).channels.some((c) => c.kind === "gitlab"))) {
+        handle.agents.some((agent) => agent.info.channels.some((c) => c.kind === "gitlab"))) {
         process.stdout.write(c.dim(`  gitlab: dev accepts unsigned loopback deliveries (${CLI} gitlab replay works without a secret; set GITLAB_WEBHOOK_SECRET to verify X-Gitlab-Token)\n`));
     }
     if (opts.dev &&
         (process.env.BITBUCKET_WEBHOOK_SECRET === undefined ||
             process.env.BITBUCKET_WEBHOOK_SECRET === "") &&
-        handle.agents.some((agent) => projectInfo(agent.project).channels.some((c) => c.kind === "bitbucket"))) {
+        handle.agents.some((agent) => agent.info.channels.some((c) => c.kind === "bitbucket"))) {
         process.stdout.write(c.dim(`  bitbucket: dev accepts unsigned loopback deliveries (${CLI} bitbucket replay works without a secret; set BITBUCKET_WEBHOOK_SECRET to verify X-Hub-Signature)\n`));
     }
+    if (opts.dev &&
+        (process.env.PAGERDUTY_WEBHOOK_SECRET === undefined ||
+            process.env.PAGERDUTY_WEBHOOK_SECRET === "") &&
+        handle.agents.some((agent) => agent.info.channels.some((c) => c.kind === "pagerduty"))) {
+        process.stdout.write(c.dim(`  pagerduty: dev accepts unsigned loopback deliveries (${CLI} pagerduty replay works without a secret; set PAGERDUTY_WEBHOOK_SECRET to verify X-PagerDuty-Signature)\n`));
+    }
 }
 /** Prefer the Vite playground URL in --dev; otherwise the static SPA path. */
 function resolvePlaygroundBannerUrl(handle, noPlayground) {

package/dist/channels/bitbucket/api.d.ts

@@ -84,7 +84,7 @@ export interface BitbucketClient {
     request<T = unknown>(input: BitbucketRequestInput): Promise<T>;
 }
 /** `BITBUCKET_TOKEN` when set. */
-export declare function envBitbucketToken(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function envBitbucketToken(env?: Record<string, string | undefined>): string | undefined;
 /**
  * REST base for direct calls: `BITBUCKET_API_BASE_URL`, else api.bitbucket.org
  * 2.0 for Cloud, else `/rest/api/1.0` on `repoHtmlUrl`'s origin. Callers must
@@ -94,7 +94,7 @@ export declare function envBitbucketToken(env?: NodeJS.ProcessEnv): string | und
 export declare function bitbucketApiBaseUrl(input: {
     dialect: BitbucketDialect;
     repoHtmlUrl?: string;
-    env?: NodeJS.ProcessEnv;
+    env?: Record<string, string | undefined>;
 }): string | undefined;
 export declare function createBitbucketClient(options?: BitbucketClientOptions): BitbucketClient;
 /** Build-status states shared by both dialects (DC `STOPPED` → `CANCELLED`). */

package/dist/channels/bitbucket/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAE3E,eAAO,MAAM,oCAAoC,kCAAkC,CAAC;AAEpF,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7E,yEAAyE;AACzE,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAOjF;CACF;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;AAEpE,yEAAyE;AACzE,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,qEAAqE;IACrE,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAAC;IACxC,gFAAgF;IAChF,KAAK,CAAC,EAAE,uBAAuB,CAAC;IAChC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChE;AAOD,kCAAkC;AAClC,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAE1F;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,MAAM,GAAG,SAAS,CAgBrB;AAgBD,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,eAAe,CAyE3F;AAID,gFAAgF;AAChF,MAAM,MAAM,yBAAyB,GAAG,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3F,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,yBAAyB,CAAC;IACjC,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;CACd;AAED,wEAAwE;AACxE,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7D,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACpE,sBAAsB,CACpB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC,cAAc,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,wDAAwD;IACxD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,2BAA2B;IAC1C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7D,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxF,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,6BAA6B,GACpC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,GAAG,oBAAoB,CAAC,CAAC;IAC1E,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChE;AAED,MAAM,MAAM,kCAAkC,GAC1C;IAAE,IAAI,EAAE,yBAAyB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AA8ElD,oEAAoE;AACpE,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAoCjF;AAmBD,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,UAAU,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1F;AAED,kEAAkE;AAClE,wBAAgB,2BAA2B,CAAC,UAAU,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE/F;AAED,wBAAsB,6BAA6B,CACjD,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAC3C,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,MAAM,CAAC,EAC1D,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAc7B;AAyBD,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,8BAA8B,EACzC,OAAO,GAAE;IACP,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,kCAAkC,KAAK,IAAI,CAAC;CACpE,GACL,2BAA2B,CAyH7B;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,eAAe,EACvB,UAAU,EAAE,sBAAsB,GACjC,YAAY,CA4Gd;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,eAAe,EACvB,UAAU,EAAE,sBAAsB,GACjC,YAAY,CAsHd;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,eAAe,EACvB,UAAU,EAAE,sBAAsB,GACjC,YAAY,CAId"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAE3E,eAAO,MAAM,oCAAoC,kCAAkC,CAAC;AAEpF,wEAAwE;AACxE,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE7E,yEAAyE;AACzE,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAOjF;CACF;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;AAEpE,yEAAyE;AACzE,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,qEAAqE;IACrE,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAAC;IACxC,gFAAgF;IAChF,KAAK,CAAC,EAAE,uBAAuB,CAAC;IAChC;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mDAAmD;AACnD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChE;AAOD,kCAAkC;AAClC,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C,GAAG,MAAM,GAAG,SAAS,CAgBrB;AAgBD,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,eAAe,CAyE3F;AAID,gFAAgF;AAChF,MAAM,MAAM,yBAAyB,GAAG,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3F,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,yBAAyB,CAAC;IACjC,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,OAAO,CAAC;CACd;AAED,wEAAwE;AACxE,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,OAAO,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7D,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACpE,sBAAsB,CACpB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChC,cAAc,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,wDAAwD;IACxD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,2BAA2B;IAC1C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC7D,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxF,gBAAgB,CACd,EAAE,EAAE,MAAM,EACV,KAAK,CAAC,EAAE,6BAA6B,GACpC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,gBAAgB,GAAG,oBAAoB,CAAC,CAAC;IAC1E,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAChE;AAED,MAAM,MAAM,kCAAkC,GAC1C;IAAE,IAAI,EAAE,yBAAyB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AA8ElD,oEAAoE;AACpE,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,EAAE,CAoCjF;AAmBD,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,UAAU,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE1F;AAED,kEAAkE;AAClE,wBAAgB,2BAA2B,CAAC,UAAU,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE/F;AAED,wBAAsB,6BAA6B,CACjD,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,EAC3C,UAAU,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,MAAM,CAAC,EAC1D,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAc7B;AAyBD,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,8BAA8B,EACzC,OAAO,GAAE;IACP,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,kCAAkC,KAAK,IAAI,CAAC;CACpE,GACL,2BAA2B,CAyH7B;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,eAAe,EACvB,UAAU,EAAE,sBAAsB,GACjC,YAAY,CA4Gd;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,eAAe,EACvB,UAAU,EAAE,sBAAsB,GACjC,YAAY,CAsHd;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,eAAe,EACvB,UAAU,EAAE,sBAAsB,GACjC,YAAY,CAId"}

package/dist/channels/bitbucket/bitbucket-channel.js

@@ -1,4 +1,4 @@
-import { z } from "zod/v3";
+import * as z from "zod/v4";
 import { allowAll, defineChannel, hmacSignatureAuth, localDevStrict, loopbackOnly, POST, } from "../../channels.js";
 import { withPropagatingBackgroundErrors } from "../../internal/channel-dispatch.js";
 import { normalizeIdentity } from "../../internal/continuation-identity.js";

package/dist/channels/bitbucket/bitbucket-webhook.d.ts

@@ -16,13 +16,14 @@ export declare function envBitbucketWebhookSecret(): string | undefined;
  */
 export declare function resolveBitbucketWebhookSecret(options: Pick<BitbucketChannelOptions, "webhookSecret">): string | undefined;
 /** The `X-Hub-Signature` value Bitbucket sends for a raw body. */
-export declare function signBitbucketWebhookBody(rawBody: string | Buffer, secret: string): string;
+export declare function signBitbucketWebhookBody(rawBody: string | Uint8Array, secret: string): string;
 /**
  * Both dialects sign the raw body with HMAC-SHA256 in `X-Hub-Signature`
- * (`sha256=<hex>`, GitHub-shaped). Constant-time compare; a missing or
- * malformed header is a plain `false`.
+ * (`sha256=<hex>`, GitHub-shaped). `secret` is the named secret's value,
+ * which may hold several signing secrets one per line; any verifies.
+ * Constant-time compare; a missing or malformed header is a plain `false`.
  */
-export declare function verifyBitbucketWebhookSignature(rawBody: string | Buffer, signatureHeader: string | null | undefined, secret: string): boolean;
+export declare function verifyBitbucketWebhookSignature(rawBody: string | Uint8Array, signatureHeader: string | null | undefined, secret: string): boolean;
 /**
  * Accept a raw Bitbucket payload plus the event key. The key comes from
  * `X-Event-Key` (HTTP) or the hosted envelope; Data Center bodies also carry

package/dist/channels/bitbucket/bitbucket-webhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bitbucket-webhook.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/bitbucket-webhook.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAqB,kBAAkB,EAAa,MAAM,gBAAgB,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAyBxD,OAAO,KAAK,EACV,uBAAuB,EAEvB,qBAAqB,EAGrB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,sFAAsF;AACtF,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,6FAA6F;AAC7F,wBAAgB,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAG9D;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,eAAe,CAAC,GACtD,MAAM,GAAG,SAAS,CAEpB;AAID,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,GAAG,MAAM,EACxB,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,MAAM,GACb,OAAO,CAWT;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,wBAAwB,GAAG,IAAI,CA2BjC;AAyED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,wBAAwB,GACjC,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAyBjF;AAwGD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,OAAO,EAAE,uBAAuB,CAAC;IACjC,QAAQ,EAAE,wBAAwB,CAAC;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgHpB;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,qEAAqE;IACrE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCpB"}
+{"version":3,"file":"bitbucket-webhook.d.ts","sourceRoot":"","sources":["../../../src/channels/bitbucket/bitbucket-webhook.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAqB,kBAAkB,EAAa,MAAM,gBAAgB,CAAC;AACvF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAyBxD,OAAO,KAAK,EACV,uBAAuB,EAEvB,qBAAqB,EAGrB,wBAAwB,EACzB,MAAM,YAAY,CAAC;AAEpB,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,sFAAsF;AACtF,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAC5D,eAAO,MAAM,0BAA0B,YAAY,CAAC;AAEpD,6FAA6F;AAC7F,wBAAgB,yBAAyB,IAAI,MAAM,GAAG,SAAS,CAG9D;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,eAAe,CAAC,GACtD,MAAM,GAAG,SAAS,CAEpB;AAID,kEAAkE;AAClE,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,GAAG,UAAU,EAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,MAAM,GACb,OAAO,CAYT;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,OAAO,EAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,wBAAwB,GAAG,IAAI,CA2BjC;AAyED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,wBAAwB,GACjC,IAAI,CAAC,qBAAqB,EAAE,MAAM,GAAG,WAAW,GAAG,WAAW,GAAG,MAAM,CAAC,GAAG,IAAI,CAyBjF;AAwGD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,OAAO,EAAE,uBAAuB,CAAC;IACjC,QAAQ,EAAE,wBAAwB,CAAC;IACnC,IAAI,EAAE,kBAAkB,CAAC;IACzB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgHpB;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CAAC,KAAK,EAAE;IACzD,OAAO,EAAE,uBAAuB,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,qEAAqE;IACrE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCpB"}

package/dist/channels/bitbucket/bitbucket-webhook.js

@@ -1,6 +1,7 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac } from "node:crypto";
 import { acknowledgeTask, isTaskDispatch, skipped, turnStarted, } from "../../internal/channel-dispatch.js";
 import { continuationSource } from "../../internal/continuation-identity.js";
+import { hmacSignatureMatchesAny, parseHmacSecrets } from "../../internal/hmac-secret-values.js";
 import { bindLocalIngressSend } from "../../internal/local-ingress.js";
 import { resolveWebhookSecretValue } from "../../internal/named-webhook-secret.js";
 import { asNonEmptyString, asPositiveInt, asRecord, bitbucketCommentFromPayload, bitbucketPullRequestFromPayload, bitbucketPullRequestRecord, bitbucketPullRequestUrl, bitbucketPushFromPayload, bitbucketRepositoryFromPayload, bitbucketUser, buildBitbucketBinding, } from "./binding.js";
@@ -33,18 +34,22 @@ export function signBitbucketWebhookBody(rawBody, secret) {
 }
 /**
  * Both dialects sign the raw body with HMAC-SHA256 in `X-Hub-Signature`
- * (`sha256=<hex>`, GitHub-shaped). Constant-time compare; a missing or
- * malformed header is a plain `false`.
+ * (`sha256=<hex>`, GitHub-shaped). `secret` is the named secret's value,
+ * which may hold several signing secrets one per line; any verifies.
+ * Constant-time compare; a missing or malformed header is a plain `false`.
  */
 export function verifyBitbucketWebhookSignature(rawBody, signatureHeader, secret) {
-    if (signatureHeader === null ||
-        signatureHeader === undefined ||
-        !signatureHeader.startsWith(SIGNATURE_PREFIX)) {
+    const parsed = parseHmacSecrets(secret);
+    if (signatureHeader === null || signatureHeader === undefined || !parsed.ok) {
         return false;
     }
-    const provided = Buffer.from(signatureHeader, "utf8");
-    const computed = Buffer.from(signBitbucketWebhookBody(rawBody, secret), "utf8");
-    return provided.length === computed.length && timingSafeEqual(provided, computed);
+    return hmacSignatureMatchesAny({
+        body: rawBody,
+        presented: signatureHeader,
+        secrets: parsed.secrets,
+        prefix: SIGNATURE_PREFIX,
+        separator: undefined,
+    });
 }
 /**
  * Accept a raw Bitbucket payload plus the event key. The key comes from

package/dist/channels/change-monitors/change-monitors-channel.js

@@ -1,4 +1,4 @@
-import { z } from "zod/v3";
+import * as z from "zod/v4";
 import { createFactoryResourceChannel } from "../../internal/factory-resource-channel.js";
 import { CHECKPOINT_CREATED_EVENT_TYPE, } from "./types.js";
 const checkpointResourceSchema = z

package/dist/channels/deployments/deployments-channel.js

@@ -1,4 +1,4 @@
-import { z } from "zod/v3";
+import * as z from "zod/v4";
 import { defineChannel, localDevStrict, POST } from "../../channels.js";
 import { skipped, tagOutcome } from "../../internal/channel-dispatch.js";
 import { deploymentEventMatches, resolveDeploymentSubscriptions, } from "../../internal/cursor-deployment-relay.js";

package/dist/channels/github/cursor-account.d.ts

@@ -48,11 +48,18 @@ export declare function parseCursorGithubPermissions(value: unknown, fallback?:
  * `owner/repo` from an Octokit request, for github-proxy calls that have no
  * static `x-cursor-github-repos` header (`cursorAccount: true` with no
  * `--repo` / channel `{ repos }`).
+ *
+ * REST calls name the repo in their route params or `/repos/` path. GraphQL
+ * posts to `/graphql`, so the repo comes from the query variables instead:
+ * `owner` plus `repo` or `name` (the `repository(owner:, name:)` field's
+ * arguments). A query whose variables use other names still needs an
+ * explicit header; the proxy then rejects it with `invalid_scope_headers`.
  */
 export declare function githubRepoFromOctokitRequest(request: {
     owner?: unknown;
     repo?: unknown;
     url?: unknown;
+    variables?: unknown;
 }): string | undefined;
 /**
  * Merge `--repo` / channel-declared repos into a lease scope. Empty is

package/dist/channels/github/cursor-account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor-account.d.ts","sourceRoot":"","sources":["../../../src/channels/github/cursor-account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAI1C,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,YAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAU,CAAC;AAEzF,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAED,MAAM,MAAM,gCAAgC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAErE;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC5C,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,kBAAkB,CAAC,SAAS,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAChE,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAAC;CAC7D;AAED,MAAM,WAAW,0BAA0B;IACzC,gDAAgD;IAChD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,WAAW,EAAE,8BAA8B,CAAC;IAC5C;;;OAGG;IACH,KAAK,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1C;AAID,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,uBAAoC,GAC7C,uBAAuB,CAUzB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;CACf,GAAG,MAAM,GAAG,SAAS,CAqBrB;AAED;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,WAAW,GAAE,uBAAoC,GAChD,qBAAqB,GAAG,SAAS,CAMnC;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,WAAW,GAAE,uBAAoC,GAChD,qBAAqB,CA6BvB;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,QAAQ,CAAC,EAC1D,QAAQ,GAAE,uBAAuB,GAAG,SAAsB,GACzD,uBAAuB,CAczB;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,SAAS,uBAAuB,EAAE,GACzC,uBAAuB,CAQzB;AAED,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE,8BAA8B,GACvC,gCAAgC,CAOlC;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,SAAS,EAAE,0BAA0B,CAAC;CACvC,GAAG,gCAAgC,CAKnC;AAED,6EAA6E;AAC7E,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,gCAAgC,GACzC,0BAA0B,GAAG,SAAS,CAExC;AAOD,gFAAgF;AAChF,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,mBAAmB,EAC1B,cAAc,EAAE,MAAM,GACrB,MAAM,CAOR;AAED,mEAAmE;AACnE,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,gCAAgC,CAE3C;AAED,wBAAgB,oCAAoC,IAAI,8BAA8B,CAsBrF;AAED,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,GAClC,IAAI,CAEN;AAED,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,GACjB,0BAA0B,GAAG,SAAS,CAExC"}
+{"version":3,"file":"cursor-account.d.ts","sourceRoot":"","sources":["../../../src/channels/github/cursor-account.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAI1C,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,YAAI,MAAM,EAAE,UAAU,EAAE,gBAAgB,CAAU,CAAC;AAEzF,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,uBAAuB,CAAC;CACtC;AAED,MAAM,MAAM,gCAAgC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAErE;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,8BAA8B;IAC7C,IAAI,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAC5C,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,kBAAkB,CAAC,SAAS,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAChE,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAAC;CAC7D;AAED,MAAM,WAAW,0BAA0B;IACzC,gDAAgD;IAChD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,WAAW,EAAE,8BAA8B,CAAC;IAC5C;;;OAGG;IACH,KAAK,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1C;AAID,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,uBAAoC,GAC7C,uBAAuB,CAUzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GAAG,MAAM,GAAG,SAAS,CAsBrB;AAaD;;;;;GAKG;AACH,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,WAAW,GAAE,uBAAoC,GAChD,qBAAqB,GAAG,SAAS,CAMnC;AAED,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,WAAW,GAAE,uBAAoC,GAChD,qBAAqB,CA6BvB;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,GAAG,QAAQ,CAAC,EAC1D,QAAQ,GAAE,uBAAuB,GAAG,SAAsB,GACzD,uBAAuB,CAczB;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,SAAS,uBAAuB,EAAE,GACzC,uBAAuB,CAQzB;AAED,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE,8BAA8B,GACvC,gCAAgC,CAOlC;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CAAC,KAAK,EAAE;IACzD,SAAS,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,SAAS,EAAE,0BAA0B,CAAC;CACvC,GAAG,gCAAgC,CAKnC;AAED,6EAA6E;AAC7E,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,gCAAgC,GACzC,0BAA0B,GAAG,SAAS,CAExC;AAOD,gFAAgF;AAChF,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpE;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,mBAAmB,EAC1B,cAAc,EAAE,MAAM,GACrB,MAAM,CAOR;AAED,mEAAmE;AACnE,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,gCAAgC,CAE3C;AAED,wBAAgB,oCAAoC,IAAI,8BAA8B,CAsBrF;AAED,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,GAClC,IAAI,CAEN;AAED,wBAAgB,6BAA6B,CAC3C,UAAU,EAAE,MAAM,GACjB,0BAA0B,GAAG,SAAS,CAExC"}

package/dist/channels/github/cursor-account.js

@@ -25,12 +25,23 @@ export function parseCursorGithubPermissions(value, fallback = "pr-write") {
  * `owner/repo` from an Octokit request, for github-proxy calls that have no
  * static `x-cursor-github-repos` header (`cursorAccount: true` with no
  * `--repo` / channel `{ repos }`).
+ *
+ * REST calls name the repo in their route params or `/repos/` path. GraphQL
+ * posts to `/graphql`, so the repo comes from the query variables instead:
+ * `owner` plus `repo` or `name` (the `repository(owner:, name:)` field's
+ * arguments). A query whose variables use other names still needs an
+ * explicit header; the proxy then rejects it with `invalid_scope_headers`.
  */
 export function githubRepoFromOctokitRequest(request) {
-    if (typeof request.owner === "string" && typeof request.repo === "string") {
-        const slug = `${request.owner.trim()}/${request.repo.trim()}`.toLowerCase();
-        if (CURSOR_GITHUB_REPO_PATTERN.test(slug) && !slug.includes("..")) {
-            return slug;
+    const fromParams = githubRepoSlug(request.owner, request.repo);
+    if (fromParams !== undefined) {
+        return fromParams;
+    }
+    if (typeof request.variables === "object" && request.variables !== null) {
+        const variables = request.variables;
+        const fromVariables = githubRepoSlug(variables.owner, variables.repo ?? variables.name);
+        if (fromVariables !== undefined) {
+            return fromVariables;
         }
     }
     if (typeof request.url !== "string") {
@@ -42,7 +53,13 @@ export function githubRepoFromOctokitRequest(request) {
     if (owner === "" || repo === "" || owner.includes("{") || repo.includes("{")) {
         return undefined;
     }
-    const slug = `${owner}/${repo}`.toLowerCase();
+    return githubRepoSlug(owner, repo);
+}
+function githubRepoSlug(owner, repo) {
+    if (typeof owner !== "string" || typeof repo !== "string") {
+        return undefined;
+    }
+    const slug = `${owner.trim()}/${repo.trim()}`.toLowerCase();
     if (!CURSOR_GITHUB_REPO_PATTERN.test(slug) || slug.includes("..")) {
         return undefined;
     }

package/dist/channels/github/github-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/github/github-channel.ts"],"names":[],"mappings":"AA6BA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EAEtB,KAAK,kBAAkB,EAMxB,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,oBAAoB,EAKpB,aAAa,EAEb,qBAAqB,EACrB,kBAAkB,EAGlB,sBAAsB,EAKtB,kBAAkB,EAClB,UAAU,EAEX,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,KAAK,mBAAmB,GAAG,IAAI,CAC7B,kBAAkB,EAClB,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CACvD,CAAC;AAoFF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,GAAG,WAAW,CAkBvE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAGtE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAU1F;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAEnE;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,MAAM,CAaR;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,kBAAkB,GAAG,IAAI,CAK3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B,kBAAkB,GAAG,IAAI,CAW3B;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAUV;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAYlC;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,sBAAsB,CAAA;CAAE,GAAG,IAAI,CA8C3E;AAED,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3C,GAAG,OAAO,CAAC,UAAU,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,UAAU,CAAC,CAc5E;AAqBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4FpB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,mEAAmE;IACnE,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8CpB;AAKD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAE5F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,aAAa,CAC3B,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAAC,kBAAkB,CAAC,CA4GvC;AAKD,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAgBjE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAuCrF;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAe/E;AAED,gEAAgE;AAChE,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAGxE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAMzE;AA+zBD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAcT"}
+{"version":3,"file":"github-channel.d.ts","sourceRoot":"","sources":["../../../src/channels/github/github-channel.ts"],"names":[],"mappings":"AA6BA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EAEtB,KAAK,kBAAkB,EAMxB,MAAM,gBAAgB,CAAC;AAkBxB,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,oBAAoB,EAKpB,aAAa,EAEb,qBAAqB,EACrB,kBAAkB,EAGlB,sBAAsB,EAKtB,kBAAkB,EAClB,UAAU,EAEX,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,KAAK,mBAAmB,GAAG,IAAI,CAC7B,kBAAkB,EAClB,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,CACvD,CAAC;AAoFF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,mBAAmB,GAAG,WAAW,CAkBvE;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAGtE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAU1F;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAEnE;AAED,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,MAAM,CAaR;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,sBAAsB,GAClC,kBAAkB,GAAG,IAAI,CAK3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B,kBAAkB,GAAG,IAAI,CAW3B;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAUV;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAYlC;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG;IAAE,GAAG,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,sBAAsB,CAAA;CAAE,GAAG,IAAI,CA8C3E;AAED,wBAAsB,4BAA4B,CAAC,IAAI,EAAE;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC3C,GAAG,OAAO,CAAC,UAAU,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,UAAU,CAAC,CAiB5E;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4FpB;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,kBAAkB,CAAC;IACzB,mEAAmE;IACnE,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8CpB;AAKD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS,CAE5F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,aAAa,CAC3B,OAAO,GAAE,oBAAyB,GACjC,iBAAiB,CAAC,kBAAkB,CAAC,CA4GvC;AAKD,4EAA4E;AAC5E,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAgBjE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAuCrF;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAe/E;AAED,gEAAgE;AAChE,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAGxE;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAMzE;AA+zBD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,OAAO,CAcT"}

package/dist/channels/github/github-channel.js

@@ -1,9 +1,9 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { z } from "zod/v3";
+import * as z from "zod/v4";
 import { allowAll, defineChannel, hmacSignatureAuth, localDevStrict, loopbackGitHubDev, POST, } from "../../channels.js";
 import { acknowledgeTask, acknowledgeTurn, isTaskDispatch, scheduleAfterAck, skipped, turnStarted, withPropagatingBackgroundErrors, } from "../../internal/channel-dispatch.js";
 import { continuationSource, normalizeIdentity } from "../../internal/continuation-identity.js";
 import { isDevMode } from "../../internal/dev-mode.js";
+import { hmacSignatureMatchesAny, parseHmacSecrets } from "../../internal/hmac-secret-values.js";
 import { attachHostedAdmissionAdapter } from "../../internal/hosted-admission-adapter.js";
 import { CATCH_DELIVERY_ID_HEADER, replayCatchRequest } from "../../internal/hosted-catch.js";
 import { AGENT_SDK_CATCH_EVENT_TYPE } from "../../internal/hosted-catch-protocol.js";
@@ -253,32 +253,23 @@ export function parseGitHubPullRequestEvent(args) {
     return { ctx, pullRequest };
 }
 export async function verifyGitHubWebhookSignature(args) {
-    const secret = await resolveCredentialValue(args.secret);
-    if (secret === undefined || secret === "") {
+    // A value over the secret cap holds no usable secret, the same as unset.
+    const parsed = parseHmacSecrets(await resolveCredentialValue(args.secret));
+    if (!parsed.ok) {
         return "missing_secret";
     }
     if (args.signatureHeader === null) {
         return "missing_signature";
     }
-    const isVerified = verifyWebhookSha256Signature({
-        secret,
+    const isVerified = hmacSignatureMatchesAny({
         body: args.body,
-        signatureHeader: args.signatureHeader,
+        presented: args.signatureHeader,
+        secrets: parsed.secrets,
+        prefix: GITHUB_SIGNATURE_PREFIX,
+        separator: undefined,
     });
     return isVerified ? "verified" : "mismatch";
 }
-function verifyWebhookSha256Signature(args) {
-    if (!args.signatureHeader.startsWith(GITHUB_SIGNATURE_PREFIX)) {
-        return false;
-    }
-    const receivedHex = args.signatureHeader.slice(GITHUB_SIGNATURE_PREFIX.length);
-    if (!/^[0-9a-f]+$/i.test(receivedHex) || receivedHex.length % 2 !== 0) {
-        return false;
-    }
-    const expected = createHmac("sha256", args.secret).update(args.body).digest();
-    const received = Buffer.from(receivedHex, "hex");
-    return received.length === expected.length && timingSafeEqual(received, expected);
-}
 /**
  * Run the authored hooks for one GitHub delivery and `send()` the turn.
  * Callers own delivery auth: the HTTP route verifies the HMAC; trigger

package/dist/channels/github/replay.d.ts

@@ -101,7 +101,7 @@ export declare function synthesizeGitHubEvent(input: SynthesizeInput): Synthesiz
 /** Hex HMAC-SHA256 for the `X-Hub-Signature-256` header (`sha256=<hex>`). */
 export declare function signGitHubWebhookBody(options: {
     secret: string;
-    body: string | Buffer;
+    body: string | Uint8Array;
 }): string;
 /**
  * Resolve the events to replay: explicit list (validated), `*` → the channel's

package/dist/channels/github/replay.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../../src/channels/github/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,6BAA6B;AAC7B,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAiBrE;AAGD,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC1E,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC;AAED,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/C;AAED,qDAAqD;AACrD,eAAO,MAAM,oBAAoB,YAC/B,cAAc,EACd,eAAe,EACf,6BAA6B,EAC7B,WAAW,EACX,aAAa,EACb,cAAc,EACd,QAAQ,CACA,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,kBAAkB,CAE/E;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,kEAAkE;AAClE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CA2J9E;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhG;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACxC,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAqB7C"}
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../../src/channels/github/replay.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,6BAA6B;AAC7B,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAiBrE;AAGD,MAAM,WAAW,UAAU;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC1E,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrC;AAED,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/C;AAED,qDAAqD;AACrD,eAAO,MAAM,oBAAoB,YAC/B,cAAc,EACd,eAAe,EACf,6BAA6B,EAC7B,WAAW,EACX,aAAa,EACb,cAAc,EACd,QAAQ,CACA,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,kBAAkB,CAE/E;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,kEAAkE;AAClE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CA2J9E;AAED,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;CAC3B,GAAG,MAAM,CAET;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EACxC,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAA;CAAE,CAqB7C"}