@granular-software/sdk 0.4.68 → 0.4.70

package/dist/delegated-auth.mjs

@@ -0,0 +1,350 @@
+// src/endpoints.ts
+var LOCAL_API_URL = "ws://localhost:8787/granular";
+var PRODUCTION_API_URL = "wss://cf-api-gateway.arthur6084.workers.dev/granular";
+function readEnv(name) {
+  if (typeof process === "undefined" || !process.env) return void 0;
+  return process.env[name];
+}
+function normalizeMode(value) {
+  if (!value) return void 0;
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "local") return "local";
+  if (normalized === "prod" || normalized === "production") return "production";
+  if (normalized === "auto") return "auto";
+  return void 0;
+}
+function isTruthy(value) {
+  if (!value) return false;
+  const normalized = value.trim().toLowerCase();
+  return normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on";
+}
+function resolveEndpointMode(explicitMode) {
+  const explicit = normalizeMode(explicitMode);
+  if (explicit === "local" || explicit === "production") {
+    return explicit;
+  }
+  const envMode = normalizeMode(
+    readEnv("GRANULAR_ENDPOINT_MODE") || readEnv("GRANULAR_ENV")
+  );
+  if (envMode === "local" || envMode === "production") {
+    return envMode;
+  }
+  if (isTruthy(readEnv("GRANULAR_USE_LOCAL_ENDPOINTS")) || isTruthy(readEnv("GRANULAR_LOCAL"))) {
+    return "local";
+  }
+  if (isTruthy(readEnv("GRANULAR_USE_PRODUCTION_ENDPOINTS")) || isTruthy(readEnv("GRANULAR_PROD"))) {
+    return "production";
+  }
+  return readEnv("NODE_ENV") === "development" ? "local" : "production";
+}
+function resolveApiUrl(explicitApiUrl, mode) {
+  if (explicitApiUrl) {
+    return explicitApiUrl;
+  }
+  return resolveEndpointMode(mode) === "local" ? LOCAL_API_URL : PRODUCTION_API_URL;
+}
+
+// src/delegated-auth.ts
+var DEFAULT_SESSION_REQUEST_TIMEOUT_MS = 3e4;
+var MAX_SESSION_REQUEST_BYTES = 8192;
+var PUBLIC_UPSTREAM_ERRORS = /* @__PURE__ */ new Map([
+  ["invalid_request", { status: 400, message: "The session request is invalid." }],
+  ["invalid_embedded_ui_key", {
+    status: 401,
+    message: "The Embedded UI key is invalid or has been revoked."
+  }],
+  ["server_side_only", {
+    status: 403,
+    message: "Create browser sessions from your server route."
+  }],
+  ["insufficient_key_permissions", {
+    status: 403,
+    message: "Use an Embedded UI API key for this session route."
+  }],
+  ["subject_not_provisioned", {
+    status: 403,
+    message: "This product user does not have Granular access yet. Assign the user to this ontology first."
+  }],
+  ["sandbox_not_authorized", {
+    status: 403,
+    message: "This product user is not assigned to the requested ontology."
+  }],
+  ["environment_scope_mismatch", {
+    status: 403,
+    message: "The requested environment does not match this user's access."
+  }],
+  ["environment_not_found", {
+    status: 404,
+    message: "This environment is not ready yet. Provision it from your server or the Granular console, then try again."
+  }],
+  ["rate_limited", {
+    status: 429,
+    message: "Too many session requests. Try again shortly."
+  }]
+]);
+function env(name) {
+  if (typeof process === "undefined" || !process.env) return void 0;
+  return process.env[name];
+}
+function json(body, status, extraHeaders) {
+  const headers = new Headers(extraHeaders);
+  headers.set("Content-Type", "application/json");
+  headers.set("Cache-Control", "no-store");
+  headers.set("Pragma", "no-cache");
+  headers.set("Referrer-Policy", "no-referrer");
+  return new Response(JSON.stringify(body), { status, headers });
+}
+function normalizedOrigin(value) {
+  try {
+    return new URL(value).origin;
+  } catch {
+    return null;
+  }
+}
+function originHeaders(request, allowedOrigins) {
+  const headers = new Headers({ Vary: "Origin" });
+  const origin = request.headers.get("origin");
+  if (origin && allowedOrigins.has(origin)) {
+    headers.set("Access-Control-Allow-Origin", origin);
+    headers.set("Access-Control-Allow-Credentials", "true");
+  }
+  return headers;
+}
+function isAllowedBrowserRequest(request, allowedOrigins) {
+  const origin = request.headers.get("origin");
+  if (!origin) return true;
+  const normalized = normalizedOrigin(origin);
+  if (!normalized) return false;
+  if (normalized === new URL(request.url).origin) return true;
+  return allowedOrigins.has(normalized);
+}
+function optionalString(record, key, maxLength) {
+  const value = record[key];
+  if (value === void 0 || value === null || value === "") return void 0;
+  if (typeof value !== "string") {
+    throw new Error(`${key} must be a string`);
+  }
+  const normalized = value.trim();
+  if (!normalized || normalized.length > maxLength) {
+    throw new Error(`${key} is invalid`);
+  }
+  return normalized;
+}
+async function readSessionRequest(request) {
+  const contentType = request.headers.get("content-type") || "";
+  if (!contentType.toLowerCase().includes("application/json")) {
+    throw new Error("Content-Type must be application/json");
+  }
+  const contentLength = Number(request.headers.get("content-length") || "0");
+  if (Number.isFinite(contentLength) && contentLength > MAX_SESSION_REQUEST_BYTES) {
+    throw new Error("Request body is too large");
+  }
+  const text = await request.text();
+  if (new TextEncoder().encode(text).byteLength > MAX_SESSION_REQUEST_BYTES) {
+    throw new Error("Request body is too large");
+  }
+  const parsed = JSON.parse(text);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("Request body must be an object");
+  }
+  const record = parsed;
+  const allowedFields = /* @__PURE__ */ new Set([
+    "ontologyId",
+    "environmentName",
+    "environmentId",
+    "environmentTagName"
+  ]);
+  if (Object.keys(record).some((key) => !allowedFields.has(key))) {
+    throw new Error("Request body contains unsupported fields");
+  }
+  const ontologyId = optionalString(record, "ontologyId", 256);
+  if (!ontologyId) throw new Error("ontologyId is required");
+  return {
+    ontologyId,
+    environmentName: optionalString(record, "environmentName", 128),
+    environmentId: optionalString(record, "environmentId", 256),
+    environmentTagName: optionalString(record, "environmentTagName", 128)
+  };
+}
+function gatewayHttpUrl(apiUrl) {
+  const resolved = new URL(resolveApiUrl(apiUrl));
+  if (resolved.protocol === "ws:") {
+    resolved.protocol = "http:";
+  } else if (resolved.protocol === "wss:") {
+    resolved.protocol = "https:";
+  }
+  resolved.search = "";
+  resolved.hash = "";
+  resolved.pathname = resolved.pathname.replace(/\/+$/, "").replace(/\/ws\/connect$/, "").replace(/\/ws$/, "") || "/granular";
+  return resolved.toString().replace(/\/$/, "");
+}
+function createGranularSessionRoute(options) {
+  const configuredOrigins = new Set(
+    (options.allowedOrigins || []).map(normalizedOrigin).filter((value) => Boolean(value))
+  );
+  return async (request) => {
+    const responseOriginHeaders = originHeaders(request, configuredOrigins);
+    if (!isAllowedBrowserRequest(request, configuredOrigins)) {
+      return json(
+        { error: "origin_not_allowed", message: "This origin is not allowed." },
+        403,
+        responseOriginHeaders
+      );
+    }
+    if (request.method === "OPTIONS") {
+      responseOriginHeaders.set("Access-Control-Allow-Methods", "POST");
+      responseOriginHeaders.set(
+        "Access-Control-Allow-Headers",
+        request.headers.get("access-control-request-headers") || "Content-Type"
+      );
+      responseOriginHeaders.set("Access-Control-Max-Age", "600");
+      return new Response(null, {
+        status: 204,
+        headers: responseOriginHeaders
+      });
+    }
+    if (request.method !== "POST") {
+      return json({ error: "method_not_allowed", message: "Use POST." }, 405, {
+        ...Object.fromEntries(responseOriginHeaders),
+        Allow: "POST"
+      });
+    }
+    let requestBody;
+    try {
+      requestBody = await readSessionRequest(request);
+    } catch (error) {
+      return json(
+        {
+          error: "invalid_request",
+          message: error instanceof Error ? error.message : "Invalid request."
+        },
+        400,
+        responseOriginHeaders
+      );
+    }
+    let subject;
+    try {
+      subject = await options.getSubject(request);
+    } catch {
+      return json(
+        {
+          error: "authentication_failed",
+          message: "Login could not be verified."
+        },
+        401,
+        responseOriginHeaders
+      );
+    }
+    const externalSubjectId = typeof subject === "string" ? subject.trim() : "";
+    if (!externalSubjectId || externalSubjectId.length > 512) {
+      return json(
+        { error: "login_required", message: "Log in to continue." },
+        401,
+        responseOriginHeaders
+      );
+    }
+    const apiKey = (options.apiKey || env("GRANULAR_EMBEDDED_UI_API_KEY") || "").trim();
+    if (!apiKey) {
+      return json(
+        {
+          error: "server_not_configured",
+          message: "Granular authentication is not configured."
+        },
+        503,
+        responseOriginHeaders
+      );
+    }
+    const controller = new AbortController();
+    const abortFromRequest = () => controller.abort(request.signal.reason);
+    if (request.signal.aborted) {
+      abortFromRequest();
+    } else {
+      request.signal.addEventListener("abort", abortFromRequest, {
+        once: true
+      });
+    }
+    const timeout = setTimeout(
+      () => controller.abort(),
+      options.timeoutMs ?? DEFAULT_SESSION_REQUEST_TIMEOUT_MS
+    );
+    try {
+      const response = await (options.fetch || globalThis.fetch)(
+        `${gatewayHttpUrl(options.apiUrl)}/sdk/browser-access-token`,
+        {
+          method: "POST",
+          headers: {
+            Accept: "application/json",
+            Authorization: `Bearer ${apiKey}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            externalSubjectId,
+            sandboxId: requestBody.ontologyId,
+            environment: requestBody.environmentName || "prod",
+            environmentId: requestBody.environmentId,
+            tagName: requestBody.environmentTagName
+          }),
+          signal: controller.signal
+        }
+      );
+      const responseText = await response.text();
+      let responseBody;
+      try {
+        const parsed = JSON.parse(responseText);
+        responseBody = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+      } catch {
+        responseBody = {};
+      }
+      if (!response.ok) {
+        const retryAfter = response.headers.get("Retry-After");
+        if (retryAfter) responseOriginHeaders.set("Retry-After", retryAfter);
+        const upstreamCode = typeof responseBody.error === "string" ? responseBody.error : "";
+        const publicError = PUBLIC_UPSTREAM_ERRORS.get(upstreamCode);
+        return json(
+          publicError ? { error: upstreamCode, message: publicError.message } : {
+            error: "session_creation_failed",
+            message: "Granular could not start this session."
+          },
+          publicError ? publicError.status : 503,
+          responseOriginHeaders
+        );
+      }
+      if (typeof responseBody.access_token !== "string" || typeof responseBody.expires_in !== "number" || !responseBody.user || typeof responseBody.user !== "object" || Array.isArray(responseBody.user)) {
+        return json(
+          {
+            error: "invalid_granular_response",
+            message: "Granular returned an invalid session response."
+          },
+          503,
+          responseOriginHeaders
+        );
+      }
+      return json(
+        {
+          access_token: responseBody.access_token,
+          token_type: typeof responseBody.token_type === "string" ? responseBody.token_type : "Bearer",
+          expires_in: responseBody.expires_in,
+          user: responseBody.user
+        },
+        200,
+        responseOriginHeaders
+      );
+    } catch (error) {
+      return json(
+        {
+          error: "session_service_unavailable",
+          message: error instanceof Error && error.name === "AbortError" ? "Granular took too long to start the session." : "Granular is temporarily unavailable."
+        },
+        503,
+        responseOriginHeaders
+      );
+    } finally {
+      clearTimeout(timeout);
+      request.signal.removeEventListener("abort", abortFromRequest);
+    }
+  };
+}
+
+export { createGranularSessionRoute };
+//# sourceMappingURL=delegated-auth.mjs.map
+//# sourceMappingURL=delegated-auth.mjs.map

package/dist/delegated-auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/endpoints.ts","../src/delegated-auth.ts"],"names":[],"mappings":";AAEO,IAAM,aAAA,GAAgB,8BAAA;AACtB,IAAM,kBAAA,GACX,sDAAA;AASF,SAAS,QAAQ,IAAA,EAAkC;AACjD,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,CAAC,OAAA,CAAQ,KAAK,OAAO,MAAA;AAC3D,EAAA,OAAO,OAAA,CAAQ,IAAI,IAAI,CAAA;AACzB;AAEA,SAAS,cAAc,KAAA,EAA0C;AAC/D,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,IAAI,UAAA,KAAe,SAAS,OAAO,OAAA;AACnC,EAAA,IAAI,UAAA,KAAe,MAAA,IAAU,UAAA,KAAe,YAAA,EAAc,OAAO,YAAA;AACjE,EAAA,IAAI,UAAA,KAAe,QAAQ,OAAO,MAAA;AAClC,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,SAAS,KAAA,EAAyB;AACzC,EAAA,IAAI,CAAC,OAAO,OAAO,KAAA;AACnB,EAAA,MAAM,UAAA,GAAa,KAAA,CAAM,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,OACE,eAAe,GAAA,IACf,UAAA,KAAe,MAAA,IACf,UAAA,KAAe,SACf,UAAA,KAAe,IAAA;AAEnB;AAsCO,SAAS,oBACd,YAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,cAAc,YAAY,CAAA;AAC3C,EAAA,IAAI,QAAA,KAAa,OAAA,IAAW,QAAA,KAAa,YAAA,EAAc;AACrD,IAAA,OAAO,QAAA;AAAA,EACT;AAEA,EAAA,MAAM,OAAA,GAAU,aAAA;AAAA,IACd,OAAA,CAAQ,wBAAwB,CAAA,IAAK,OAAA,CAAQ,cAAc;AAAA,GAC7D;AACA,EAAA,IAAI,OAAA,KAAY,OAAA,IAAW,OAAA,KAAY,YAAA,EAAc;AACnD,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,IACE,QAAA,CAAS,QAAQ,8BAA8B,CAAC,KAChD,QAAA,CAAS,OAAA,CAAQ,gBAAgB,CAAC,CAAA,EAClC;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,IACE,QAAA,CAAS,QAAQ,mCAAmC,CAAC,KACrD,QAAA,CAAS,OAAA,CAAQ,eAAe,CAAC,CAAA,EACjC;AACA,IAAA,OAAO,YAAA;AAAA,EACT;AAEA,EAAA,OAAO,OAAA,CAAQ,UAAU,CAAA,KAAM,aAAA,GAAgB,OAAA,GAAU,YAAA;AAC3D;AAEO,SAAS,aAAA,CACd,gBACA,IAAA,EACQ;AACR,EAAA,IAAI,cAAA,EAAgB;AAClB,IAAA,OAAO,cAAA;AAAA,EACT;AAEA,EAAA,OAAO,mBAAA,CAAoB,IAAI,CAAA,KAAM,OAAA,GACjC,aAAA,GACA,kBAAA;AACN;;;AClHA,IAAM,kCAAA,GAAqC,GAAA;AAC3C,IAAM,yBAAA,GAA4B,IAAA;AA4BlC,IAAM,sBAAA,uBAA6B,GAAA,CAGjC;AAAA,EACA,CAAC,iBAAA,EAAmB,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,mCAAmC,CAAA;AAAA,EAC/E,CAAC,yBAAA,EAA2B;AAAA,IAC1B,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,CAAC,kBAAA,EAAoB;AAAA,IACnB,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,CAAC,8BAAA,EAAgC;AAAA,IAC/B,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,CAAC,yBAAA,EAA2B;AAAA,IAC1B,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EACE;AAAA,GACH,CAAA;AAAA,EACD,CAAC,wBAAA,EAA0B;AAAA,IACzB,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,CAAC,4BAAA,EAA8B;AAAA,IAC7B,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EAAS;AAAA,GACV,CAAA;AAAA,EACD,CAAC,uBAAA,EAAyB;AAAA,IACxB,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EACE;AAAA,GACH,CAAA;AAAA,EACD,CAAC,cAAA,EAAgB;AAAA,IACf,MAAA,EAAQ,GAAA;AAAA,IACR,OAAA,EAAS;AAAA,GACV;AACH,CAAC,CAAA;AAED,SAAS,IAAI,IAAA,EAAkC;AAC7C,EAAA,IAAI,OAAO,OAAA,KAAY,WAAA,IAAe,CAAC,OAAA,CAAQ,KAAK,OAAO,MAAA;AAC3D,EAAA,OAAO,OAAA,CAAQ,IAAI,IAAI,CAAA;AACzB;AAEA,SAAS,IAAA,CACP,IAAA,EACA,MAAA,EACA,YAAA,EACU;AACV,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,YAAY,CAAA;AACxC,EAAA,OAAA,CAAQ,GAAA,CAAI,gBAAgB,kBAAkB,CAAA;AAC9C,EAAA,OAAA,CAAQ,GAAA,CAAI,iBAAiB,UAAU,CAAA;AACvC,EAAA,OAAA,CAAQ,GAAA,CAAI,UAAU,UAAU,CAAA;AAChC,EAAA,OAAA,CAAQ,GAAA,CAAI,mBAAmB,aAAa,CAAA;AAC5C,EAAA,OAAO,IAAI,SAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAA;AAC/D;AAEA,SAAS,iBAAiB,KAAA,EAA8B;AACtD,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,MAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,aAAA,CAAc,SAAkB,cAAA,EAAsC;AAC7E,EAAA,MAAM,UAAU,IAAI,OAAA,CAAQ,EAAE,IAAA,EAAM,UAAU,CAAA;AAC9C,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAC3C,EAAA,IAAI,MAAA,IAAU,cAAA,CAAe,GAAA,CAAI,MAAM,CAAA,EAAG;AACxC,IAAA,OAAA,CAAQ,GAAA,CAAI,+BAA+B,MAAM,CAAA;AACjD,IAAA,OAAA,CAAQ,GAAA,CAAI,oCAAoC,MAAM,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,uBAAA,CACP,SACA,cAAA,EACS;AACT,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAA;AAC3C,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,MAAM,UAAA,GAAa,iBAAiB,MAAM,CAAA;AAC1C,EAAA,IAAI,CAAC,YAAY,OAAO,KAAA;AACxB,EAAA,IAAI,eAAe,IAAI,GAAA,CAAI,QAAQ,GAAG,CAAA,CAAE,QAAQ,OAAO,IAAA;AACvD,EAAA,OAAO,cAAA,CAAe,IAAI,UAAU,CAAA;AACtC;AAEA,SAAS,cAAA,CACP,MAAA,EACA,GAAA,EACA,SAAA,EACoB;AACpB,EAAA,MAAM,KAAA,GAAQ,OAAO,GAAG,CAAA;AACxB,EAAA,IAAI,UAAU,MAAA,IAAa,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,IAAI,OAAO,MAAA;AAClE,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,iBAAA,CAAmB,CAAA;AAAA,EAC3C;AACA,EAAA,MAAM,UAAA,GAAa,MAAM,IAAA,EAAK;AAC9B,EAAA,IAAI,CAAC,UAAA,IAAc,UAAA,CAAW,MAAA,GAAS,SAAA,EAAW;AAChD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,WAAA,CAAa,CAAA;AAAA,EACrC;AACA,EAAA,OAAO,UAAA;AACT;AAEA,eAAe,mBACb,OAAA,EAC6B;AAC7B,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,cAAc,CAAA,IAAK,EAAA;AAC3D,EAAA,IAAI,CAAC,WAAA,CAAY,WAAA,EAAY,CAAE,QAAA,CAAS,kBAAkB,CAAA,EAAG;AAC3D,IAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,EACzD;AACA,EAAA,MAAM,gBAAgB,MAAA,CAAO,OAAA,CAAQ,QAAQ,GAAA,CAAI,gBAAgB,KAAK,GAAG,CAAA;AACzE,EAAA,IACE,MAAA,CAAO,QAAA,CAAS,aAAa,CAAA,IAC7B,gBAAgB,yBAAA,EAChB;AACA,IAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,EAC7C;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,IAAA,EAAK;AAChC,EAAA,IAAI,IAAI,WAAA,EAAY,CAAE,OAAO,IAAI,CAAA,CAAE,aAAa,yBAAA,EAA2B;AACzE,IAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,EAC7C;AACA,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAC9B,EAAA,IAAI,CAAC,UAAU,OAAO,MAAA,KAAW,YAAY,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,EAAG;AAClE,IAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,EAClD;AACA,EAAA,MAAM,MAAA,GAAS,MAAA;AACf,EAAA,MAAM,aAAA,uBAAoB,GAAA,CAAI;AAAA,IAC5B,YAAA;AAAA,IACA,iBAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,IAAI,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,IAAA,CAAK,CAAC,GAAA,KAAQ,CAAC,aAAA,CAAc,GAAA,CAAI,GAAG,CAAC,CAAA,EAAG;AAC9D,IAAA,MAAM,IAAI,MAAM,0CAA0C,CAAA;AAAA,EAC5D;AACA,EAAA,MAAM,UAAA,GAAa,cAAA,CAAe,MAAA,EAAQ,YAAA,EAAc,GAAG,CAAA;AAC3D,EAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,MAAM,wBAAwB,CAAA;AACzD,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,eAAA,EAAiB,cAAA,CAAe,MAAA,EAAQ,iBAAA,EAAmB,GAAG,CAAA;AAAA,IAC9D,aAAA,EAAe,cAAA,CAAe,MAAA,EAAQ,eAAA,EAAiB,GAAG,CAAA;AAAA,IAC1D,kBAAA,EAAoB,cAAA,CAAe,MAAA,EAAQ,oBAAA,EAAsB,GAAG;AAAA,GACtE;AACF;AAEA,SAAS,eAAe,MAAA,EAAyB;AAC/C,EAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,aAAA,CAAc,MAAM,CAAC,CAAA;AAC9C,EAAA,IAAI,QAAA,CAAS,aAAa,KAAA,EAAO;AAC/B,IAAA,QAAA,CAAS,QAAA,GAAW,OAAA;AAAA,EACtB,CAAA,MAAA,IAAW,QAAA,CAAS,QAAA,KAAa,MAAA,EAAQ;AACvC,IAAA,QAAA,CAAS,QAAA,GAAW,QAAA;AAAA,EACtB;AACA,EAAA,QAAA,CAAS,MAAA,GAAS,EAAA;AAClB,EAAA,QAAA,CAAS,IAAA,GAAO,EAAA;AAChB,EAAA,QAAA,CAAS,QAAA,GACP,QAAA,CAAS,QAAA,CACN,OAAA,CAAQ,QAAQ,EAAE,CAAA,CAClB,OAAA,CAAQ,gBAAA,EAAkB,EAAE,CAAA,CAC5B,OAAA,CAAQ,OAAA,EAAS,EAAE,CAAA,IAAK,WAAA;AAC7B,EAAA,OAAO,QAAA,CAAS,QAAA,EAAS,CAAE,OAAA,CAAQ,OAAO,EAAE,CAAA;AAC9C;AASO,SAAS,2BACd,OAAA,EACyC;AACzC,EAAA,MAAM,oBAAoB,IAAI,GAAA;AAAA,IAAA,CAC3B,OAAA,CAAQ,cAAA,IAAkB,EAAC,EACzB,GAAA,CAAI,gBAAgB,CAAA,CACpB,MAAA,CAAO,CAAC,KAAA,KAA2B,OAAA,CAAQ,KAAK,CAAC;AAAA,GACtD;AAEA,EAAA,OAAO,OAAO,OAAA,KAAwC;AACpD,IAAA,MAAM,qBAAA,GAAwB,aAAA,CAAc,OAAA,EAAS,iBAAiB,CAAA;AACtE,IAAA,IAAI,CAAC,uBAAA,CAAwB,OAAA,EAAS,iBAAiB,CAAA,EAAG;AACxD,MAAA,OAAO,IAAA;AAAA,QACL,EAAE,KAAA,EAAO,oBAAA,EAAsB,OAAA,EAAS,6BAAA,EAA8B;AAAA,QACtE,GAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,WAAW,SAAA,EAAW;AAChC,MAAA,qBAAA,CAAsB,GAAA,CAAI,gCAAgC,MAAM,CAAA;AAChE,MAAA,qBAAA,CAAsB,GAAA;AAAA,QACpB,8BAAA;AAAA,QACA,OAAA,CAAQ,OAAA,CAAQ,GAAA,CAAI,gCAAgC,CAAA,IAAK;AAAA,OAC3D;AACA,MAAA,qBAAA,CAAsB,GAAA,CAAI,0BAA0B,KAAK,CAAA;AACzD,MAAA,OAAO,IAAI,SAAS,IAAA,EAAM;AAAA,QACxB,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS;AAAA,OACV,CAAA;AAAA,IACH;AACA,IAAA,IAAI,OAAA,CAAQ,WAAW,MAAA,EAAQ;AAC7B,MAAA,OAAO,KAAK,EAAE,KAAA,EAAO,sBAAsB,OAAA,EAAS,WAAA,IAAe,GAAA,EAAK;AAAA,QACtE,GAAG,MAAA,CAAO,WAAA,CAAY,qBAAqB,CAAA;AAAA,QAC3C,KAAA,EAAO;AAAA,OACR,CAAA;AAAA,IACH;AAEA,IAAA,IAAI,WAAA;AACJ,IAAA,IAAI;AACF,MAAA,WAAA,GAAc,MAAM,mBAAmB,OAAO,CAAA;AAAA,IAChD,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,IAAA;AAAA,QACL;AAAA,UACE,KAAA,EAAO,iBAAA;AAAA,UACP,OAAA,EAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,SACpD;AAAA,QACA,GAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAA,CAAW,OAAO,CAAA;AAAA,IAC5C,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,QACL;AAAA,UACE,KAAA,EAAO,uBAAA;AAAA,UACP,OAAA,EAAS;AAAA,SACX;AAAA,QACA,GAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,oBAAoB,OAAO,OAAA,KAAY,QAAA,GAAW,OAAA,CAAQ,MAAK,GAAI,EAAA;AACzE,IAAA,IAAI,CAAC,iBAAA,IAAqB,iBAAA,CAAkB,MAAA,GAAS,GAAA,EAAK;AACxD,MAAA,OAAO,IAAA;AAAA,QACL,EAAE,KAAA,EAAO,gBAAA,EAAkB,OAAA,EAAS,qBAAA,EAAsB;AAAA,QAC1D,GAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,UACJ,OAAA,CAAQ,MAAA,IACR,IAAI,8BAA8B,CAAA,IAClC,IACA,IAAA,EAAK;AACP,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,OAAO,IAAA;AAAA,QACL;AAAA,UACE,KAAA,EAAO,uBAAA;AAAA,UACP,OAAA,EAAS;AAAA,SACX;AAAA,QACA,GAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAEA,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,mBAAmB,MAAM,UAAA,CAAW,KAAA,CAAM,OAAA,CAAQ,OAAO,MAAM,CAAA;AACrE,IAAA,IAAI,OAAA,CAAQ,OAAO,OAAA,EAAS;AAC1B,MAAA,gBAAA,EAAiB;AAAA,IACnB,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,MAAA,CAAO,gBAAA,CAAiB,OAAA,EAAS,gBAAA,EAAkB;AAAA,QACzD,IAAA,EAAM;AAAA,OACP,CAAA;AAAA,IACH;AACA,IAAA,MAAM,OAAA,GAAU,UAAA;AAAA,MACd,MAAM,WAAW,KAAA,EAAM;AAAA,MACvB,QAAQ,SAAA,IAAa;AAAA,KACvB;AACA,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,CAAQ,KAAA,IAAS,UAAA,CAAW,KAAA;AAAA,QAClD,CAAA,EAAG,cAAA,CAAe,OAAA,CAAQ,MAAM,CAAC,CAAA,yBAAA,CAAA;AAAA,QACjC;AAAA,UACE,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS;AAAA,YACP,MAAA,EAAQ,kBAAA;AAAA,YACR,aAAA,EAAe,UAAU,MAAM,CAAA,CAAA;AAAA,YAC/B,cAAA,EAAgB;AAAA,WAClB;AAAA,UACA,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,YACnB,iBAAA;AAAA,YACA,WAAW,WAAA,CAAY,UAAA;AAAA,YACvB,WAAA,EAAa,YAAY,eAAA,IAAmB,MAAA;AAAA,YAC5C,eAAe,WAAA,CAAY,aAAA;AAAA,YAC3B,SAAS,WAAA,CAAY;AAAA,WACtB,CAAA;AAAA,UACD,QAAQ,UAAA,CAAW;AAAA;AACrB,OACF;AACA,MAAA,MAAM,YAAA,GAAe,MAAM,QAAA,CAAS,IAAA,EAAK;AACzC,MAAA,IAAI,YAAA;AACJ,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,YAAY,CAAA;AACtC,QAAA,YAAA,GACE,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,IAAY,CAAC,MAAM,OAAA,CAAQ,MAAM,CAAA,GACxD,MAAA,GACD,EAAC;AAAA,MACT,CAAA,CAAA,MAAQ;AACN,QAAA,YAAA,GAAe,EAAC;AAAA,MAClB;AACA,MAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,QAAA,MAAM,UAAA,GAAa,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AACrD,QAAA,IAAI,UAAA,EAAY,qBAAA,CAAsB,GAAA,CAAI,aAAA,EAAe,UAAU,CAAA;AACnE,QAAA,MAAM,eACJ,OAAO,YAAA,CAAa,KAAA,KAAU,QAAA,GAAW,aAAa,KAAA,GAAQ,EAAA;AAChE,QAAA,MAAM,WAAA,GAAc,sBAAA,CAAuB,GAAA,CAAI,YAAY,CAAA;AAC3D,QAAA,OAAO,IAAA;AAAA,UACL,cACI,EAAE,KAAA,EAAO,cAAc,OAAA,EAAS,WAAA,CAAY,SAAQ,GACpD;AAAA,YACE,KAAA,EAAO,yBAAA;AAAA,YACP,OAAA,EAAS;AAAA,WACX;AAAA,UACJ,WAAA,GAAc,YAAY,MAAA,GAAS,GAAA;AAAA,UACnC;AAAA,SACF;AAAA,MACF;AACA,MAAA,IACE,OAAO,YAAA,CAAa,YAAA,KAAiB,YACrC,OAAO,YAAA,CAAa,eAAe,QAAA,IACnC,CAAC,aAAa,IAAA,IACd,OAAO,aAAa,IAAA,KAAS,QAAA,IAC7B,MAAM,OAAA,CAAQ,YAAA,CAAa,IAAI,CAAA,EAC/B;AACA,QAAA,OAAO,IAAA;AAAA,UACL;AAAA,YACE,KAAA,EAAO,2BAAA;AAAA,YACP,OAAA,EAAS;AAAA,WACX;AAAA,UACA,GAAA;AAAA,UACA;AAAA,SACF;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,QACL;AAAA,UACE,cAAc,YAAA,CAAa,YAAA;AAAA,UAC3B,YACE,OAAO,YAAA,CAAa,UAAA,KAAe,QAAA,GAC/B,aAAa,UAAA,GACb,QAAA;AAAA,UACN,YAAY,YAAA,CAAa,UAAA;AAAA,UACzB,MAAM,YAAA,CAAa;AAAA,SACrB;AAAA,QACA,GAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,SAAS,KAAA,EAAO;AACd,MAAA,OAAO,IAAA;AAAA,QACL;AAAA,UACE,KAAA,EAAO,6BAAA;AAAA,UACP,SACE,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,eACrC,8CAAA,GACA;AAAA,SACR;AAAA,QACA,GAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,OAAO,CAAA;AACpB,MAAA,OAAA,CAAQ,MAAA,CAAO,mBAAA,CAAoB,OAAA,EAAS,gBAAgB,CAAA;AAAA,IAC9D;AAAA,EACF,CAAA;AACF","file":"delegated-auth.mjs","sourcesContent":["import type { EndpointMode } from \"./types\";\n\nexport const LOCAL_API_URL = \"ws://localhost:8787/granular\";\nexport const PRODUCTION_API_URL =\n  \"wss://cf-api-gateway.arthur6084.workers.dev/granular\";\nexport const DEFAULT_LOCAL_API_KEY =\n  \"gn_sk_tenant_default_principal_local_e2e_00000000\";\n\nexport const LOCAL_AUTH_URL = \"http://localhost:3000\";\nexport const PRODUCTION_AUTH_URL = \"https://app.granular.software\";\n\ntype ResolvedEndpointMode = \"local\" | \"production\";\n\nfunction readEnv(name: string): string | undefined {\n  if (typeof process === \"undefined\" || !process.env) return undefined;\n  return process.env[name];\n}\n\nfunction normalizeMode(value?: string): EndpointMode | undefined {\n  if (!value) return undefined;\n  const normalized = value.trim().toLowerCase();\n  if (normalized === \"local\") return \"local\";\n  if (normalized === \"prod\" || normalized === \"production\") return \"production\";\n  if (normalized === \"auto\") return \"auto\";\n  return undefined;\n}\n\nfunction isTruthy(value?: string): boolean {\n  if (!value) return false;\n  const normalized = value.trim().toLowerCase();\n  return (\n    normalized === \"1\" ||\n    normalized === \"true\" ||\n    normalized === \"yes\" ||\n    normalized === \"on\"\n  );\n}\n\nexport function isLocalApiUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    return parsed.hostname === \"localhost\" || parsed.hostname === \"127.0.0.1\";\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Local dev + `sk_*` (WorkOS org key in env): map to the local gn_sk e2e key by default so every\n * request (HTTP + WebSocket) uses the same tenant as the v2 UI on localhost (`default`). Without\n * this, the SDK passes `sk_*` through → gateway resolves org_… while the UI still uses gn_sk →\n * you only see old default-tenant sandboxes and new ingest data looks “missing”.\n *\n * - `GRANULAR_LOCAL_API_KEY` — explicit key to use instead (e.g. another gn_sk).\n * - `GRANULAR_DISABLE_LOCAL_API_KEY_FALLBACK=1` — do not swap; send the real `sk_*` (org tenant +\n *   WorkOS validation on the gateway). Use when the UI is also on that org (e.g. session auth +\n *   NEXT_PUBLIC_DISABLE_LOCAL_API_KEY_FALLBACK on the app).\n */\nexport function resolveAuthTokenForApiUrl(\n  authToken: string,\n  apiUrl: string,\n): string {\n  if (\n    !authToken.startsWith(\"sk_\") ||\n    !isLocalApiUrl(apiUrl) ||\n    isTruthy(readEnv(\"GRANULAR_DISABLE_LOCAL_API_KEY_FALLBACK\"))\n  ) {\n    return authToken;\n  }\n\n  const override = readEnv(\"GRANULAR_LOCAL_API_KEY\")?.trim();\n  return override || DEFAULT_LOCAL_API_KEY;\n}\n\nexport function resolveEndpointMode(\n  explicitMode?: EndpointMode,\n): ResolvedEndpointMode {\n  const explicit = normalizeMode(explicitMode);\n  if (explicit === \"local\" || explicit === \"production\") {\n    return explicit;\n  }\n\n  const envMode = normalizeMode(\n    readEnv(\"GRANULAR_ENDPOINT_MODE\") || readEnv(\"GRANULAR_ENV\"),\n  );\n  if (envMode === \"local\" || envMode === \"production\") {\n    return envMode;\n  }\n\n  if (\n    isTruthy(readEnv(\"GRANULAR_USE_LOCAL_ENDPOINTS\")) ||\n    isTruthy(readEnv(\"GRANULAR_LOCAL\"))\n  ) {\n    return \"local\";\n  }\n  if (\n    isTruthy(readEnv(\"GRANULAR_USE_PRODUCTION_ENDPOINTS\")) ||\n    isTruthy(readEnv(\"GRANULAR_PROD\"))\n  ) {\n    return \"production\";\n  }\n\n  return readEnv(\"NODE_ENV\") === \"development\" ? \"local\" : \"production\";\n}\n\nexport function resolveApiUrl(\n  explicitApiUrl?: string,\n  mode?: EndpointMode,\n): string {\n  if (explicitApiUrl) {\n    return explicitApiUrl;\n  }\n\n  return resolveEndpointMode(mode) === \"local\"\n    ? LOCAL_API_URL\n    : PRODUCTION_API_URL;\n}\n\nexport function resolveAuthUrl(\n  explicitAuthUrl?: string,\n  mode?: EndpointMode,\n): string {\n  if (explicitAuthUrl) {\n    return explicitAuthUrl;\n  }\n\n  return resolveEndpointMode(mode) === \"local\"\n    ? LOCAL_AUTH_URL\n    : PRODUCTION_AUTH_URL;\n}\n","import { resolveApiUrl } from \"./endpoints\";\n\nconst DEFAULT_SESSION_REQUEST_TIMEOUT_MS = 30_000;\nconst MAX_SESSION_REQUEST_BYTES = 8_192;\n\nexport type GranularSessionSubject = string | null | undefined;\n\nexport interface CreateGranularSessionRouteOptions {\n  /** Resolve the stable product-user ID from the request's trusted server session. */\n  getSubject: (\n    request: Request,\n  ) => GranularSessionSubject | Promise<GranularSessionSubject>;\n  /** Server-only Embedded UI API key. Defaults to GRANULAR_EMBEDDED_UI_API_KEY. */\n  apiKey?: string;\n  /** Granular gateway URL. Defaults to the normal SDK endpoint selection. */\n  apiUrl?: string;\n  /** Additional browser origins allowed to call this route. Same-origin is always allowed. */\n  allowedOrigins?: string[];\n  /** Upstream timeout. The default is 30 seconds. */\n  timeoutMs?: number;\n  /** Test or runtime-specific fetch implementation. */\n  fetch?: typeof globalThis.fetch;\n}\n\ntype SessionRequestBody = {\n  ontologyId: string;\n  environmentName?: string;\n  environmentId?: string;\n  environmentTagName?: string;\n};\n\nconst PUBLIC_UPSTREAM_ERRORS = new Map<\n  string,\n  { status: number; message: string }\n>([\n  [\"invalid_request\", { status: 400, message: \"The session request is invalid.\" }],\n  [\"invalid_embedded_ui_key\", {\n    status: 401,\n    message: \"The Embedded UI key is invalid or has been revoked.\",\n  }],\n  [\"server_side_only\", {\n    status: 403,\n    message: \"Create browser sessions from your server route.\",\n  }],\n  [\"insufficient_key_permissions\", {\n    status: 403,\n    message: \"Use an Embedded UI API key for this session route.\",\n  }],\n  [\"subject_not_provisioned\", {\n    status: 403,\n    message:\n      \"This product user does not have Granular access yet. Assign the user to this ontology first.\",\n  }],\n  [\"sandbox_not_authorized\", {\n    status: 403,\n    message: \"This product user is not assigned to the requested ontology.\",\n  }],\n  [\"environment_scope_mismatch\", {\n    status: 403,\n    message: \"The requested environment does not match this user's access.\",\n  }],\n  [\"environment_not_found\", {\n    status: 404,\n    message:\n      \"This environment is not ready yet. Provision it from your server or the Granular console, then try again.\",\n  }],\n  [\"rate_limited\", {\n    status: 429,\n    message: \"Too many session requests. Try again shortly.\",\n  }],\n]);\n\nfunction env(name: string): string | undefined {\n  if (typeof process === \"undefined\" || !process.env) return undefined;\n  return process.env[name];\n}\n\nfunction json(\n  body: Record<string, unknown>,\n  status: number,\n  extraHeaders?: ConstructorParameters<typeof Headers>[0],\n): Response {\n  const headers = new Headers(extraHeaders);\n  headers.set(\"Content-Type\", \"application/json\");\n  headers.set(\"Cache-Control\", \"no-store\");\n  headers.set(\"Pragma\", \"no-cache\");\n  headers.set(\"Referrer-Policy\", \"no-referrer\");\n  return new Response(JSON.stringify(body), { status, headers });\n}\n\nfunction normalizedOrigin(value: string): string | null {\n  try {\n    return new URL(value).origin;\n  } catch {\n    return null;\n  }\n}\n\nfunction originHeaders(request: Request, allowedOrigins: Set<string>): Headers {\n  const headers = new Headers({ Vary: \"Origin\" });\n  const origin = request.headers.get(\"origin\");\n  if (origin && allowedOrigins.has(origin)) {\n    headers.set(\"Access-Control-Allow-Origin\", origin);\n    headers.set(\"Access-Control-Allow-Credentials\", \"true\");\n  }\n  return headers;\n}\n\nfunction isAllowedBrowserRequest(\n  request: Request,\n  allowedOrigins: Set<string>,\n): boolean {\n  const origin = request.headers.get(\"origin\");\n  if (!origin) return true;\n  const normalized = normalizedOrigin(origin);\n  if (!normalized) return false;\n  if (normalized === new URL(request.url).origin) return true;\n  return allowedOrigins.has(normalized);\n}\n\nfunction optionalString(\n  record: Record<string, unknown>,\n  key: string,\n  maxLength: number,\n): string | undefined {\n  const value = record[key];\n  if (value === undefined || value === null || value === \"\") return undefined;\n  if (typeof value !== \"string\") {\n    throw new Error(`${key} must be a string`);\n  }\n  const normalized = value.trim();\n  if (!normalized || normalized.length > maxLength) {\n    throw new Error(`${key} is invalid`);\n  }\n  return normalized;\n}\n\nasync function readSessionRequest(\n  request: Request,\n): Promise<SessionRequestBody> {\n  const contentType = request.headers.get(\"content-type\") || \"\";\n  if (!contentType.toLowerCase().includes(\"application/json\")) {\n    throw new Error(\"Content-Type must be application/json\");\n  }\n  const contentLength = Number(request.headers.get(\"content-length\") || \"0\");\n  if (\n    Number.isFinite(contentLength) &&\n    contentLength > MAX_SESSION_REQUEST_BYTES\n  ) {\n    throw new Error(\"Request body is too large\");\n  }\n  const text = await request.text();\n  if (new TextEncoder().encode(text).byteLength > MAX_SESSION_REQUEST_BYTES) {\n    throw new Error(\"Request body is too large\");\n  }\n  const parsed = JSON.parse(text) as unknown;\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new Error(\"Request body must be an object\");\n  }\n  const record = parsed as Record<string, unknown>;\n  const allowedFields = new Set([\n    \"ontologyId\",\n    \"environmentName\",\n    \"environmentId\",\n    \"environmentTagName\",\n  ]);\n  if (Object.keys(record).some((key) => !allowedFields.has(key))) {\n    throw new Error(\"Request body contains unsupported fields\");\n  }\n  const ontologyId = optionalString(record, \"ontologyId\", 256);\n  if (!ontologyId) throw new Error(\"ontologyId is required\");\n  return {\n    ontologyId,\n    environmentName: optionalString(record, \"environmentName\", 128),\n    environmentId: optionalString(record, \"environmentId\", 256),\n    environmentTagName: optionalString(record, \"environmentTagName\", 128),\n  };\n}\n\nfunction gatewayHttpUrl(apiUrl?: string): string {\n  const resolved = new URL(resolveApiUrl(apiUrl));\n  if (resolved.protocol === \"ws:\") {\n    resolved.protocol = \"http:\";\n  } else if (resolved.protocol === \"wss:\") {\n    resolved.protocol = \"https:\";\n  }\n  resolved.search = \"\";\n  resolved.hash = \"\";\n  resolved.pathname =\n    resolved.pathname\n      .replace(/\\/+$/, \"\")\n      .replace(/\\/ws\\/connect$/, \"\")\n      .replace(/\\/ws$/, \"\") || \"/granular\";\n  return resolved.toString().replace(/\\/$/, \"\");\n}\n\n/**\n * Create the one customer-owned delegated-auth endpoint used by Granular React.\n *\n * The browser supplies only public resource selection. `getSubject` is the\n * sole identity boundary and must derive its value from the existing trusted\n * server session, never from the request body.\n */\nexport function createGranularSessionRoute(\n  options: CreateGranularSessionRouteOptions,\n): (request: Request) => Promise<Response> {\n  const configuredOrigins = new Set(\n    (options.allowedOrigins || [])\n      .map(normalizedOrigin)\n      .filter((value): value is string => Boolean(value)),\n  );\n\n  return async (request: Request): Promise<Response> => {\n    const responseOriginHeaders = originHeaders(request, configuredOrigins);\n    if (!isAllowedBrowserRequest(request, configuredOrigins)) {\n      return json(\n        { error: \"origin_not_allowed\", message: \"This origin is not allowed.\" },\n        403,\n        responseOriginHeaders,\n      );\n    }\n    if (request.method === \"OPTIONS\") {\n      responseOriginHeaders.set(\"Access-Control-Allow-Methods\", \"POST\");\n      responseOriginHeaders.set(\n        \"Access-Control-Allow-Headers\",\n        request.headers.get(\"access-control-request-headers\") || \"Content-Type\",\n      );\n      responseOriginHeaders.set(\"Access-Control-Max-Age\", \"600\");\n      return new Response(null, {\n        status: 204,\n        headers: responseOriginHeaders,\n      });\n    }\n    if (request.method !== \"POST\") {\n      return json({ error: \"method_not_allowed\", message: \"Use POST.\" }, 405, {\n        ...Object.fromEntries(responseOriginHeaders),\n        Allow: \"POST\",\n      });\n    }\n\n    let requestBody: SessionRequestBody;\n    try {\n      requestBody = await readSessionRequest(request);\n    } catch (error) {\n      return json(\n        {\n          error: \"invalid_request\",\n          message: error instanceof Error ? error.message : \"Invalid request.\",\n        },\n        400,\n        responseOriginHeaders,\n      );\n    }\n\n    let subject: GranularSessionSubject;\n    try {\n      subject = await options.getSubject(request);\n    } catch {\n      return json(\n        {\n          error: \"authentication_failed\",\n          message: \"Login could not be verified.\",\n        },\n        401,\n        responseOriginHeaders,\n      );\n    }\n    const externalSubjectId = typeof subject === \"string\" ? subject.trim() : \"\";\n    if (!externalSubjectId || externalSubjectId.length > 512) {\n      return json(\n        { error: \"login_required\", message: \"Log in to continue.\" },\n        401,\n        responseOriginHeaders,\n      );\n    }\n\n    const apiKey = (\n      options.apiKey ||\n      env(\"GRANULAR_EMBEDDED_UI_API_KEY\") ||\n      \"\"\n    ).trim();\n    if (!apiKey) {\n      return json(\n        {\n          error: \"server_not_configured\",\n          message: \"Granular authentication is not configured.\",\n        },\n        503,\n        responseOriginHeaders,\n      );\n    }\n\n    const controller = new AbortController();\n    const abortFromRequest = () => controller.abort(request.signal.reason);\n    if (request.signal.aborted) {\n      abortFromRequest();\n    } else {\n      request.signal.addEventListener(\"abort\", abortFromRequest, {\n        once: true,\n      });\n    }\n    const timeout = setTimeout(\n      () => controller.abort(),\n      options.timeoutMs ?? DEFAULT_SESSION_REQUEST_TIMEOUT_MS,\n    );\n    try {\n      const response = await (options.fetch || globalThis.fetch)(\n        `${gatewayHttpUrl(options.apiUrl)}/sdk/browser-access-token`,\n        {\n          method: \"POST\",\n          headers: {\n            Accept: \"application/json\",\n            Authorization: `Bearer ${apiKey}`,\n            \"Content-Type\": \"application/json\",\n          },\n          body: JSON.stringify({\n            externalSubjectId,\n            sandboxId: requestBody.ontologyId,\n            environment: requestBody.environmentName || \"prod\",\n            environmentId: requestBody.environmentId,\n            tagName: requestBody.environmentTagName,\n          }),\n          signal: controller.signal,\n        },\n      );\n      const responseText = await response.text();\n      let responseBody: Record<string, unknown>;\n      try {\n        const parsed = JSON.parse(responseText) as unknown;\n        responseBody =\n          parsed && typeof parsed === \"object\" && !Array.isArray(parsed)\n            ? (parsed as Record<string, unknown>)\n            : {};\n      } catch {\n        responseBody = {};\n      }\n      if (!response.ok) {\n        const retryAfter = response.headers.get(\"Retry-After\");\n        if (retryAfter) responseOriginHeaders.set(\"Retry-After\", retryAfter);\n        const upstreamCode =\n          typeof responseBody.error === \"string\" ? responseBody.error : \"\";\n        const publicError = PUBLIC_UPSTREAM_ERRORS.get(upstreamCode);\n        return json(\n          publicError\n            ? { error: upstreamCode, message: publicError.message }\n            : {\n                error: \"session_creation_failed\",\n                message: \"Granular could not start this session.\",\n              },\n          publicError ? publicError.status : 503,\n          responseOriginHeaders,\n        );\n      }\n      if (\n        typeof responseBody.access_token !== \"string\" ||\n        typeof responseBody.expires_in !== \"number\" ||\n        !responseBody.user ||\n        typeof responseBody.user !== \"object\" ||\n        Array.isArray(responseBody.user)\n      ) {\n        return json(\n          {\n            error: \"invalid_granular_response\",\n            message: \"Granular returned an invalid session response.\",\n          },\n          503,\n          responseOriginHeaders,\n        );\n      }\n      return json(\n        {\n          access_token: responseBody.access_token,\n          token_type:\n            typeof responseBody.token_type === \"string\"\n              ? responseBody.token_type\n              : \"Bearer\",\n          expires_in: responseBody.expires_in,\n          user: responseBody.user,\n        },\n        200,\n        responseOriginHeaders,\n      );\n    } catch (error) {\n      return json(\n        {\n          error: \"session_service_unavailable\",\n          message:\n            error instanceof Error && error.name === \"AbortError\"\n              ? \"Granular took too long to start the session.\"\n              : \"Granular is temporarily unavailable.\",\n        },\n        503,\n        responseOriginHeaders,\n      );\n    } finally {\n      clearTimeout(timeout);\n      request.signal.removeEventListener(\"abort\", abortFromRequest);\n    }\n  };\n}\n"]}

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-export { E as Environment, a as EnvironmentSession, G as Granular, O as OntologyHandle, S as Session, W as WSClient, i as isGraphQLMutationDocument } from './client-BNpPrX2X.mjs';
-import { E as EnvironmentData, a as EnvironmentRecordImportSummary, b as EndpointMode, c as EffectCommitRequest, C as CommitReceipt, T as ToolWithHandler, P as ProjectionResult, d as ProjectionMapper, e as CommitTransitionOutcomeDeclaration, f as CommitDeclaration, g as EffectHandlerContext, F as FeedPublishTransport, M as ManifestEffectMetamodelSpec, R as ResolvedEffectBehaviors, h as RecordObjectOptions, i as ManifestContent, j as CommitTransitionInvocation, S as SessionHeapEntry, k as SessionHeapList, l as FeedItem, m as SessionHeapSnapshot, n as Prompt, o as SessionTranscriptEntry } from './spend-BDGtgZtl.mjs';
-export { ef as APIError, aS as AccessTokenProvider, Y as ActionSuggestionFeedItem, aZ as AdoptEnvironmentOptions, bK as AgentCommitStatus, cL as ArtifactApprovalDecisionInput, cM as ArtifactApprovalDecisionResult, cJ as ArtifactApprovalTask, cK as ArtifactApprovalTaskListOptions, cI as ArtifactApprovalTaskStatus, U as ArtifactFeedItem, b_ as ArtifactOptionsHandler, bj as Assignment, bk as AssignmentListResponse, cm as AssistantReplyPublicationInput, cn as AssistantReplyPublicationResult, bH as BaseProjectionResult, bt as Build, bv as BuildListResponse, bl as BuildPolicy, bs as BuildStatus, bC as CanonicalProjectedRecord, bL as CommitChangeReceipt, bA as CommitSafeError, bM as CommitTransitionReceipt, aO as ConditionIR, a_ as ConnectOptions, b0 as ConversationSessionInfo, b2 as ConversationSessionListOptions, b3 as ConversationSessionListResponse, b1 as ConversationSessionListStatus, bo as CreateEnvironmentData, bh as CreatePermissionProfileData, bd as CreateSandboxData, a$ as CreateSessionOptions, dp as DefineRelationshipOptions, eg as DeleteResponse, D as DomainState, bW as EffectArtifactOptionsInvocation, bY as EffectArtifactRelationshipOption, bZ as EffectArtifactRelationshipOptionsResult, bQ as EffectCommitContext, c7 as EffectHandler, c4 as EffectInfo, bX as EffectInvocationMetadata, bV as EffectInvocationMode, bI as EffectProjectionResult, b$ as EffectSchema, c2 as EffectVersionSelector, c0 as EffectWithHandler, c6 as EffectsChangedEvent, cf as EnvironmentFeedbackRecord, dM as EnvironmentImporter, dL as EnvironmentImporterImportOptions, bp as EnvironmentListResponse, dK as EnvironmentSetupImporterClaim, dI as EnvironmentSetupLifecycleStatus, dJ as EnvironmentSetupSummary, dG as EnvironmentSetupTriggerReason, du as EnvironmentStateMachineProxy, ds as EnvironmentStateObservationInput, dv as EnvironmentStateProxy, dr as EnvironmentStateTarget, dt as EnvironmentStateUpdateInput, bN as ExternalCommitOptions, ac as FeedDiagnostic, ad as FeedDiagnosticListener, ak as FeedDocumentState, v as FeedFeedbackTone, V as FeedFileSource, u as FeedIconToken, z as FeedItemBase, x as FeedItemKind, a3 as FeedListOptions, aa as FeedListTransport, G as FeedObjectReference, a4 as FeedPage, av as FeedPublisher, a2 as FeedSnapshot, ab as FeedSnapshotRegressionReason, t as FeedSource, s as FeedSourceActor, a5 as FeedSubscribeOptions, a6 as FeedSubscriptionChange, H as FeedTableCell, J as FeedTableColumn, N as FeedTableProjection, L as FeedTableRow, K as FeedTableRowReference, y as FeedTarget, w as FeedTransientFeedbackTone, B as FeedbackFeedItem, W as FileFeedItem, ae as GRANULAR_FEED_DIAGNOSTIC_EVENT, aU as GranularAuth, aT as GranularOptions, ba as GranularQuotaPolicy, bb as GranularQuotaProgress, aE as GranularSpendContext, ee as GraphQLResult, c8 as InstanceEffectHandler, I as InstanceToolHandler, ch as Job, cd as JobFeedbackInput, cc as JobFeedbackMetadata, ce as JobFeedbackRecord, ca as JobFeedbackSentiment, cb as JobFeedbackToolCall, c9 as JobStatus, cg as JobSubmitResult, bq as Manifest, e4 as ManifestApprovalRequiredSpec, e5 as ManifestCreatesSpec, e2 as ManifestDryRunSpec, e8 as ManifestEffectDeclaration, e7 as ManifestEffectSchema, dP as ManifestEnumRuleSpec, ea as ManifestEventStreamDef, e9 as ManifestEventTypeDef, dQ as ManifestFilterBySpec, ec as ManifestImport, br as ManifestListResponse, eb as ManifestOperation, e1 as ManifestPostConditionSpec, dN as ManifestPropertySpec, e6 as ManifestRelationshipDef, e3 as ManifestReverseSpec, e0 as ManifestStateMachineSpec, dS as ManifestStateMachineStateSpec, d$ as ManifestStateMachineTransitionSpec, dU as ManifestStateTransitionActionSpec, dV as ManifestStateTransitionAssigneeSpec, dZ as ManifestStateTransitionExpectedOutcomeSpec, dT as ManifestStateTransitionInputBinding, d_ as ManifestStateTransitionOutcomeSpec, dY as ManifestStateTransitionPermissionSpec, dW as ManifestStateTransitionRelatedStateRequirementSpec, dX as ManifestStateTransitionRequirementsSpec, dO as ManifestValidationOperator, dR as ManifestValidationRuleSpec, ed as ManifestVolume, cU as ManualActionListOptions, cS as ManualActionOccurrence, cT as ManualActionRecordResult, cQ as ManualActionRelatedRecord, cO as ManualActionSource, cN as ManualActionStatus, cV as ManualActionSuggestion, cW as ManualActionSuggestionOptions, cP as ManualActionTarget, dc as MarkUserEnvironmentReadOptions, aR as MatchedPolicy, A as MessageFeedItem, dm as ModelRef, ay as NormalizedOpenAIUsage, X as NormalizedSuggestedArtifact, aA as OPENAI_MODEL_PRICING_USD_PER_MILLION, bD as ObjectProjectionChange, by as ObjectReference, O as ObjectsFeedItem, bO as ObservationReceipt, ax as OpenAIModelPricing, az as OpenAITokenSpend, aF as OpenAIUsageSpendEvent, aY as OpenEnvironmentOptions, bg as PermissionProfile, bi as PermissionProfileListResponse, bf as PermissionRules, aN as PolicyOperator, aP as PolicyOrigin, aM as PolicyPredicateSource, aQ as PolicyRuleIR, aL as PolicySource, bG as ProjectionChange, Z as PromptFeedItem, c1 as PublishEffectsResult, ar as PublishFeedbackOptions, q as PublishToolsResult, as as PublishTransientFeedbackOptions, b9 as QuotaLineItemFilter, b6 as QuotaPeriod, b5 as QuotaScopeType, b7 as QuotaStatus, dg as RPCRequest, dj as RPCRequestFromServer, dh as RPCResponse, dF as RecordImport, dE as RecordImportItem, dC as RecordImportItemStatus, dA as RecordImportOptions, dD as RecordImportStats, dB as RecordImportStatus, dz as RecordImportWriteMode, cR as RecordManualActionInput, d2 as RecordMentionInput, dw as RecordObjectResult, dq as RecordObjectStateValue, dx as RecordObjectsChunkInfo, dy as RecordObjectsOptions, aG as RecordOpenAIUsageSpendOptions, aH as RecordOpenAIUsageSpendResult, d1 as RecordSearchOptions, d0 as RecordSearchResult, aW as RecordUserOptions, dn as RelationshipInfo, bE as RelationshipProjectionChange, bU as ResolvedEffectApprovalRequired, bS as ResolvedEffectDryRun, bR as ResolvedEffectPostCondition, bT as ResolvedEffectReverse, dH as RunEnvironmentImporterOptions, bc as Sandbox, be as SandboxListResponse, bx as SemanticVersionDiff, bw as SemanticVersionDiffEntry, cH as SessionArtifactApprovalOptions, cx as SessionArtifactAutonomyPolicy, cG as SessionArtifactExecutionOptions, cF as SessionArtifactExecutionResult, cw as SessionArtifactKind, cz as SessionArtifactListOptions, cy as SessionArtifactRecord, cE as SessionArtifactRelationshipCreateInput, cC as SessionArtifactRelationshipOption, cB as SessionArtifactRelationshipOptionsInput, cD as SessionArtifactRelationshipOptionsResult, cv as SessionArtifactStatus, cA as SessionArtifactValidationResult, d4 as SessionCollectionListOptions, d6 as SessionCollectionListResult, d3 as SessionDocumentResult, a7 as SessionFeedApi, aq as SessionFeedController, aj as SessionFeedControllerOptions, cs as SessionFileKind, cu as SessionFileRecord, cr as SessionFileSource, ct as SessionFileStatus, cX as SessionFileUploadOptions, cZ as SessionHeapFieldType, c_ as SessionHeapFieldValue, c$ as SessionHeapVariable, d5 as SessionJobListOptions, cY as SessionJobRecord, bP as SessionMutationView, cq as SessionTimelineEvent, co as SessionTranscriptActionSuggestion, cp as SessionTranscriptShowRefs, at as SettleTransientFeedbackOptions, di as SnapshotResetMessage, bz as SourceAcknowledgement, b4 as SpendLineItemType, b8 as SpendSummary, bF as StateObservationProjectionChange, eh as StreamEvent, ej as StreamStats, ei as StreamSubscription, aX as Subject, Q as TableFeedItem, r as ToolHandler, c3 as ToolInfo, dk as ToolInvokeParams, dl as ToolResultParams, p as ToolSchema, c5 as ToolsChangedEvent, a1 as TransientFeedItem, _ as TransientFeedItemBase, a0 as TransientFeedbackFeedItem, au as TransientFeedbackHandle, $ as TransientMessageFeedItem, bB as TransitionOutcomeProjection, bJ as TransitionProjectionResult, aV as User, d8 as UserEnvironmentMessagePreview, d7 as UserEnvironmentPrompt, d9 as UserEnvironmentSessionState, da as UserEnvironmentState, db as UserEnvironmentStateOptions, cl as UserMessageAppendResult, ck as UserMessageInput, ci as UserMessageShowRefs, cj as UserMessageTarget, bu as Version, bn as VersionTag, bm as VersionTracking, df as WSClientOptions, dd as WSDisconnectInfo, de as WSReconnectErrorInfo, aJ as buildOpenAISpendEventId, aD as calculateOpenAITokenSpend, aw as createFeedPublisher, ai as emitFeedDiagnostic, ah as emitFeedDiagnosticToDefaultSink, al as emptyFeedSnapshot, aB as getOpenAIModelPricing, am as hasCanonicalSessionFeedActivation, an as isCanonicalSessionFeedDocument, a8 as mergeFeedItemsBySequence, ag as normalizeFeedDiagnostic, af as normalizeFeedDiagnosticKind, ap as normalizeFeedPage, aC as normalizeOpenAIUsage, a9 as orderTransientFeedItems, ao as readSessionFeedSnapshot, aK as recordOpenAIUsageSpend, aI as toGranularHttpBase } from './spend-BDGtgZtl.mjs';
+export { E as Environment, a as EnvironmentSession, G as Granular, O as OntologyHandle, S as Session, W as WSClient, i as isGraphQLMutationDocument } from './client-qgWZ495o.mjs';
+import { E as EnvironmentData, a as EnvironmentRecordImportSummary, b as EndpointMode, c as EffectCommitRequest, C as CommitReceipt, T as ToolWithHandler, P as ProjectionResult, d as ProjectionMapper, e as CommitTransitionOutcomeDeclaration, f as CommitDeclaration, g as EffectHandlerContext, F as FeedPublishTransport, M as ManifestEffectMetamodelSpec, R as ResolvedEffectBehaviors, h as RecordObjectOptions, i as ManifestContent, j as CommitTransitionInvocation, S as SessionHeapEntry, k as SessionHeapList, l as FeedItem, m as SessionHeapSnapshot, n as Prompt, o as SessionTranscriptEntry } from './spend-B-IQmp7F.mjs';
+export { eh as APIError, aS as AccessTokenProvider, Y as ActionSuggestionFeedItem, aZ as AdoptEnvironmentOptions, bK as AgentCommitStatus, cN as ArtifactApprovalDecisionInput, cO as ArtifactApprovalDecisionResult, cL as ArtifactApprovalTask, cM as ArtifactApprovalTaskListOptions, cK as ArtifactApprovalTaskStatus, U as ArtifactFeedItem, b_ as ArtifactOptionsHandler, bj as Assignment, bk as AssignmentListResponse, cm as AssistantReplyPublicationInput, cn as AssistantReplyPublicationResult, bH as BaseProjectionResult, bt as Build, bv as BuildListResponse, bl as BuildPolicy, bs as BuildStatus, bC as CanonicalProjectedRecord, bL as CommitChangeReceipt, bA as CommitSafeError, bM as CommitTransitionReceipt, aO as ConditionIR, a_ as ConnectOptions, b0 as ConversationSessionInfo, b2 as ConversationSessionListOptions, b3 as ConversationSessionListResponse, b1 as ConversationSessionListStatus, bo as CreateEnvironmentData, bh as CreatePermissionProfileData, bd as CreateSandboxData, a$ as CreateSessionOptions, dr as DefineRelationshipOptions, ei as DeleteResponse, D as DomainState, bW as EffectArtifactOptionsInvocation, bY as EffectArtifactRelationshipOption, bZ as EffectArtifactRelationshipOptionsResult, bQ as EffectCommitContext, c7 as EffectHandler, c4 as EffectInfo, bX as EffectInvocationMetadata, bV as EffectInvocationMode, bI as EffectProjectionResult, b$ as EffectSchema, c2 as EffectVersionSelector, c0 as EffectWithHandler, c6 as EffectsChangedEvent, cf as EnvironmentFeedbackRecord, dO as EnvironmentImporter, dN as EnvironmentImporterImportOptions, bp as EnvironmentListResponse, dM as EnvironmentSetupImporterClaim, dK as EnvironmentSetupLifecycleStatus, dL as EnvironmentSetupSummary, dI as EnvironmentSetupTriggerReason, dw as EnvironmentStateMachineProxy, du as EnvironmentStateObservationInput, dx as EnvironmentStateProxy, dt as EnvironmentStateTarget, dv as EnvironmentStateUpdateInput, bN as ExternalCommitOptions, ac as FeedDiagnostic, ad as FeedDiagnosticListener, ak as FeedDocumentState, v as FeedFeedbackTone, V as FeedFileSource, u as FeedIconToken, z as FeedItemBase, x as FeedItemKind, a3 as FeedListOptions, aa as FeedListTransport, G as FeedObjectReference, a4 as FeedPage, av as FeedPublisher, a2 as FeedSnapshot, ab as FeedSnapshotRegressionReason, t as FeedSource, s as FeedSourceActor, a5 as FeedSubscribeOptions, a6 as FeedSubscriptionChange, H as FeedTableCell, J as FeedTableColumn, N as FeedTableProjection, L as FeedTableRow, K as FeedTableRowReference, y as FeedTarget, w as FeedTransientFeedbackTone, B as FeedbackFeedItem, W as FileFeedItem, ae as GRANULAR_FEED_DIAGNOSTIC_EVENT, aU as GranularAuth, aT as GranularOptions, ba as GranularQuotaPolicy, bb as GranularQuotaProgress, aE as GranularSpendContext, eg as GraphQLResult, c8 as InstanceEffectHandler, I as InstanceToolHandler, ch as Job, cd as JobFeedbackInput, cc as JobFeedbackMetadata, ce as JobFeedbackRecord, ca as JobFeedbackSentiment, cb as JobFeedbackToolCall, c9 as JobStatus, cg as JobSubmitResult, bq as Manifest, e6 as ManifestApprovalRequiredSpec, e7 as ManifestCreatesSpec, e4 as ManifestDryRunSpec, ea as ManifestEffectDeclaration, e9 as ManifestEffectSchema, dR as ManifestEnumRuleSpec, ec as ManifestEventStreamDef, eb as ManifestEventTypeDef, dS as ManifestFilterBySpec, ee as ManifestImport, br as ManifestListResponse, ed as ManifestOperation, e3 as ManifestPostConditionSpec, dP as ManifestPropertySpec, e8 as ManifestRelationshipDef, e5 as ManifestReverseSpec, e2 as ManifestStateMachineSpec, dU as ManifestStateMachineStateSpec, e1 as ManifestStateMachineTransitionSpec, dW as ManifestStateTransitionActionSpec, dX as ManifestStateTransitionAssigneeSpec, d$ as ManifestStateTransitionExpectedOutcomeSpec, dV as ManifestStateTransitionInputBinding, e0 as ManifestStateTransitionOutcomeSpec, d_ as ManifestStateTransitionPermissionSpec, dY as ManifestStateTransitionRelatedStateRequirementSpec, dZ as ManifestStateTransitionRequirementsSpec, dQ as ManifestValidationOperator, dT as ManifestValidationRuleSpec, ef as ManifestVolume, cW as ManualActionListOptions, cU as ManualActionOccurrence, cV as ManualActionRecordResult, cS as ManualActionRelatedRecord, cQ as ManualActionSource, cP as ManualActionStatus, cX as ManualActionSuggestion, cY as ManualActionSuggestionOptions, cR as ManualActionTarget, de as MarkUserEnvironmentReadOptions, aR as MatchedPolicy, A as MessageFeedItem, dp as ModelRef, ay as NormalizedOpenAIUsage, X as NormalizedSuggestedArtifact, aA as OPENAI_MODEL_PRICING_USD_PER_MILLION, bD as ObjectProjectionChange, by as ObjectReference, O as ObjectsFeedItem, bO as ObservationReceipt, ax as OpenAIModelPricing, az as OpenAITokenSpend, aF as OpenAIUsageSpendEvent, aY as OpenEnvironmentOptions, bg as PermissionProfile, bi as PermissionProfileListResponse, bf as PermissionRules, aN as PolicyOperator, aP as PolicyOrigin, aM as PolicyPredicateSource, aQ as PolicyRuleIR, aL as PolicySource, bG as ProjectionChange, Z as PromptFeedItem, c1 as PublishEffectsResult, ar as PublishFeedbackOptions, q as PublishToolsResult, as as PublishTransientFeedbackOptions, b9 as QuotaLineItemFilter, b6 as QuotaPeriod, b5 as QuotaScopeType, b7 as QuotaStatus, di as RPCRequest, dl as RPCRequestFromServer, dj as RPCResponse, dH as RecordImport, dG as RecordImportItem, dE as RecordImportItemStatus, dC as RecordImportOptions, dF as RecordImportStats, dD as RecordImportStatus, dB as RecordImportWriteMode, cT as RecordManualActionInput, d4 as RecordMentionInput, dy as RecordObjectResult, ds as RecordObjectStateValue, dz as RecordObjectsChunkInfo, dA as RecordObjectsOptions, aG as RecordOpenAIUsageSpendOptions, aH as RecordOpenAIUsageSpendResult, d3 as RecordSearchOptions, d2 as RecordSearchResult, aW as RecordUserOptions, dq as RelationshipInfo, bE as RelationshipProjectionChange, bU as ResolvedEffectApprovalRequired, bS as ResolvedEffectDryRun, bR as ResolvedEffectPostCondition, bT as ResolvedEffectReverse, dJ as RunEnvironmentImporterOptions, bc as Sandbox, be as SandboxListResponse, bx as SemanticVersionDiff, bw as SemanticVersionDiffEntry, cJ as SessionArtifactApprovalOptions, cx as SessionArtifactAutonomyPolicy, cI as SessionArtifactExecutionOptions, cH as SessionArtifactExecutionResult, cz as SessionArtifactFieldProvenance, cy as SessionArtifactFieldProvenanceSource, cw as SessionArtifactKind, cB as SessionArtifactListOptions, cA as SessionArtifactRecord, cG as SessionArtifactRelationshipCreateInput, cE as SessionArtifactRelationshipOption, cD as SessionArtifactRelationshipOptionsInput, cF as SessionArtifactRelationshipOptionsResult, cv as SessionArtifactStatus, cC as SessionArtifactValidationResult, d6 as SessionCollectionListOptions, d8 as SessionCollectionListResult, d5 as SessionDocumentResult, a7 as SessionFeedApi, aq as SessionFeedController, aj as SessionFeedControllerOptions, cs as SessionFileKind, cu as SessionFileRecord, cr as SessionFileSource, ct as SessionFileStatus, cZ as SessionFileUploadOptions, c$ as SessionHeapFieldType, d0 as SessionHeapFieldValue, d1 as SessionHeapVariable, d7 as SessionJobListOptions, c_ as SessionJobRecord, bP as SessionMutationView, cq as SessionTimelineEvent, co as SessionTranscriptActionSuggestion, cp as SessionTranscriptShowRefs, at as SettleTransientFeedbackOptions, dk as SnapshotResetMessage, bz as SourceAcknowledgement, b4 as SpendLineItemType, b8 as SpendSummary, bF as StateObservationProjectionChange, ej as StreamEvent, el as StreamStats, ek as StreamSubscription, aX as Subject, Q as TableFeedItem, r as ToolHandler, c3 as ToolInfo, dm as ToolInvokeParams, dn as ToolResultParams, p as ToolSchema, c5 as ToolsChangedEvent, a1 as TransientFeedItem, _ as TransientFeedItemBase, a0 as TransientFeedbackFeedItem, au as TransientFeedbackHandle, $ as TransientMessageFeedItem, bB as TransitionOutcomeProjection, bJ as TransitionProjectionResult, aV as User, da as UserEnvironmentMessagePreview, d9 as UserEnvironmentPrompt, db as UserEnvironmentSessionState, dc as UserEnvironmentState, dd as UserEnvironmentStateOptions, cl as UserMessageAppendResult, ck as UserMessageInput, ci as UserMessageShowRefs, cj as UserMessageTarget, bu as Version, bn as VersionTag, bm as VersionTracking, dh as WSClientOptions, df as WSDisconnectInfo, dg as WSReconnectErrorInfo, aJ as buildOpenAISpendEventId, aD as calculateOpenAITokenSpend, aw as createFeedPublisher, ai as emitFeedDiagnostic, ah as emitFeedDiagnosticToDefaultSink, al as emptyFeedSnapshot, aB as getOpenAIModelPricing, am as hasCanonicalSessionFeedActivation, an as isCanonicalSessionFeedDocument, a8 as mergeFeedItemsBySequence, ag as normalizeFeedDiagnostic, af as normalizeFeedDiagnosticKind, ap as normalizeFeedPage, aC as normalizeOpenAIUsage, a9 as orderTransientFeedItems, ao as readSessionFeedSnapshot, aK as recordOpenAIUsageSpend, aI as toGranularHttpBase } from './spend-B-IQmp7F.mjs';
 export { BuildGranularAgentSystemPromptInput, GeneratedJobCodeIssue, GranularAgentExecutionCheckpoint, GranularAgentHeapSummaryOptions, GranularAgentManualActionMemorySuggestion, GranularAgentPromptCapabilities, GranularAgentReferentFocus, GranularAgentSessionContext, GranularAgentToolInfo, GranularAgentWorkflowFocus, GranularReasoningTraceChunkResult, GranularReasoningTraceOptions, HarnessContinuationDecision, HarnessControllerBudgets, HarnessProjectionOptions, HarnessPromptLike, HarnessRenderedContinuation, HarnessRenderedPrompt, HarnessTemplate, HarnessTemplateManifest, HarnessTemplateSelectionOptions, HarnessTemplateStatus, HarnessVerifierSnapshot, HarnessVerifierSnapshotInput, ReviewGeneratedJobCodeOptions, buildContinuationInstruction, buildContinuationInstructionFromTemplate, buildGranularAgentCheckpointBlock, buildGranularAgentDomainBlock, buildGranularAgentFileBlock, buildGranularAgentHeapBlock, buildGranularAgentLoopBlock, buildGranularAgentManualActionBlock, buildGranularAgentManualActionMemorySummary, buildGranularAgentReferentBlock, buildGranularAgentRuntimeImportsBlock, buildGranularAgentSessionBlock, buildGranularAgentSystemPrompt, buildGranularAgentSystemPromptFromTemplate, buildGranularAgentToolBlock, buildGranularAgentWorkflowBlock, consumeGranularReasoningOnlyChunk, consumeGranularReasoningTraceChunk, createHarnessVerifierSnapshot, evaluateContinuation, getCurrentClosureId, getDefaultHarnessTemplateId, getExclusivePromptTarget, hasOpenPrompt, hashHarnessTemplateValue, listHarnessTemplates, projectConversationReferentFocus, projectConversationReferentSummary, projectHeapSummary, projectLoopSummary, projectSessionFileSummary, projectWorkflowFocus, projectWorkflowSummary, renderContinuationInstructionFromTemplate, renderGranularAgentSystemPromptFromTemplate, resolveHarnessTemplate, reviewGeneratedJobCode, stripGranularReasoningTrace, validateHarnessTemplateManifest } from './agent-harness.mjs';
 import '@automerge/automerge';
 import '@automerge/automerge/slim';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { E as Environment, a as EnvironmentSession, G as Granular, O as OntologyHandle, S as Session, W as WSClient, i as isGraphQLMutationDocument } from './client-C-GYQSJC.js';
-import { E as EnvironmentData, a as EnvironmentRecordImportSummary, b as EndpointMode, c as EffectCommitRequest, C as CommitReceipt, T as ToolWithHandler, P as ProjectionResult, d as ProjectionMapper, e as CommitTransitionOutcomeDeclaration, f as CommitDeclaration, g as EffectHandlerContext, F as FeedPublishTransport, M as ManifestEffectMetamodelSpec, R as ResolvedEffectBehaviors, h as RecordObjectOptions, i as ManifestContent, j as CommitTransitionInvocation, S as SessionHeapEntry, k as SessionHeapList, l as FeedItem, m as SessionHeapSnapshot, n as Prompt, o as SessionTranscriptEntry } from './spend-BDGtgZtl.js';
-export { ef as APIError, aS as AccessTokenProvider, Y as ActionSuggestionFeedItem, aZ as AdoptEnvironmentOptions, bK as AgentCommitStatus, cL as ArtifactApprovalDecisionInput, cM as ArtifactApprovalDecisionResult, cJ as ArtifactApprovalTask, cK as ArtifactApprovalTaskListOptions, cI as ArtifactApprovalTaskStatus, U as ArtifactFeedItem, b_ as ArtifactOptionsHandler, bj as Assignment, bk as AssignmentListResponse, cm as AssistantReplyPublicationInput, cn as AssistantReplyPublicationResult, bH as BaseProjectionResult, bt as Build, bv as BuildListResponse, bl as BuildPolicy, bs as BuildStatus, bC as CanonicalProjectedRecord, bL as CommitChangeReceipt, bA as CommitSafeError, bM as CommitTransitionReceipt, aO as ConditionIR, a_ as ConnectOptions, b0 as ConversationSessionInfo, b2 as ConversationSessionListOptions, b3 as ConversationSessionListResponse, b1 as ConversationSessionListStatus, bo as CreateEnvironmentData, bh as CreatePermissionProfileData, bd as CreateSandboxData, a$ as CreateSessionOptions, dp as DefineRelationshipOptions, eg as DeleteResponse, D as DomainState, bW as EffectArtifactOptionsInvocation, bY as EffectArtifactRelationshipOption, bZ as EffectArtifactRelationshipOptionsResult, bQ as EffectCommitContext, c7 as EffectHandler, c4 as EffectInfo, bX as EffectInvocationMetadata, bV as EffectInvocationMode, bI as EffectProjectionResult, b$ as EffectSchema, c2 as EffectVersionSelector, c0 as EffectWithHandler, c6 as EffectsChangedEvent, cf as EnvironmentFeedbackRecord, dM as EnvironmentImporter, dL as EnvironmentImporterImportOptions, bp as EnvironmentListResponse, dK as EnvironmentSetupImporterClaim, dI as EnvironmentSetupLifecycleStatus, dJ as EnvironmentSetupSummary, dG as EnvironmentSetupTriggerReason, du as EnvironmentStateMachineProxy, ds as EnvironmentStateObservationInput, dv as EnvironmentStateProxy, dr as EnvironmentStateTarget, dt as EnvironmentStateUpdateInput, bN as ExternalCommitOptions, ac as FeedDiagnostic, ad as FeedDiagnosticListener, ak as FeedDocumentState, v as FeedFeedbackTone, V as FeedFileSource, u as FeedIconToken, z as FeedItemBase, x as FeedItemKind, a3 as FeedListOptions, aa as FeedListTransport, G as FeedObjectReference, a4 as FeedPage, av as FeedPublisher, a2 as FeedSnapshot, ab as FeedSnapshotRegressionReason, t as FeedSource, s as FeedSourceActor, a5 as FeedSubscribeOptions, a6 as FeedSubscriptionChange, H as FeedTableCell, J as FeedTableColumn, N as FeedTableProjection, L as FeedTableRow, K as FeedTableRowReference, y as FeedTarget, w as FeedTransientFeedbackTone, B as FeedbackFeedItem, W as FileFeedItem, ae as GRANULAR_FEED_DIAGNOSTIC_EVENT, aU as GranularAuth, aT as GranularOptions, ba as GranularQuotaPolicy, bb as GranularQuotaProgress, aE as GranularSpendContext, ee as GraphQLResult, c8 as InstanceEffectHandler, I as InstanceToolHandler, ch as Job, cd as JobFeedbackInput, cc as JobFeedbackMetadata, ce as JobFeedbackRecord, ca as JobFeedbackSentiment, cb as JobFeedbackToolCall, c9 as JobStatus, cg as JobSubmitResult, bq as Manifest, e4 as ManifestApprovalRequiredSpec, e5 as ManifestCreatesSpec, e2 as ManifestDryRunSpec, e8 as ManifestEffectDeclaration, e7 as ManifestEffectSchema, dP as ManifestEnumRuleSpec, ea as ManifestEventStreamDef, e9 as ManifestEventTypeDef, dQ as ManifestFilterBySpec, ec as ManifestImport, br as ManifestListResponse, eb as ManifestOperation, e1 as ManifestPostConditionSpec, dN as ManifestPropertySpec, e6 as ManifestRelationshipDef, e3 as ManifestReverseSpec, e0 as ManifestStateMachineSpec, dS as ManifestStateMachineStateSpec, d$ as ManifestStateMachineTransitionSpec, dU as ManifestStateTransitionActionSpec, dV as ManifestStateTransitionAssigneeSpec, dZ as ManifestStateTransitionExpectedOutcomeSpec, dT as ManifestStateTransitionInputBinding, d_ as ManifestStateTransitionOutcomeSpec, dY as ManifestStateTransitionPermissionSpec, dW as ManifestStateTransitionRelatedStateRequirementSpec, dX as ManifestStateTransitionRequirementsSpec, dO as ManifestValidationOperator, dR as ManifestValidationRuleSpec, ed as ManifestVolume, cU as ManualActionListOptions, cS as ManualActionOccurrence, cT as ManualActionRecordResult, cQ as ManualActionRelatedRecord, cO as ManualActionSource, cN as ManualActionStatus, cV as ManualActionSuggestion, cW as ManualActionSuggestionOptions, cP as ManualActionTarget, dc as MarkUserEnvironmentReadOptions, aR as MatchedPolicy, A as MessageFeedItem, dm as ModelRef, ay as NormalizedOpenAIUsage, X as NormalizedSuggestedArtifact, aA as OPENAI_MODEL_PRICING_USD_PER_MILLION, bD as ObjectProjectionChange, by as ObjectReference, O as ObjectsFeedItem, bO as ObservationReceipt, ax as OpenAIModelPricing, az as OpenAITokenSpend, aF as OpenAIUsageSpendEvent, aY as OpenEnvironmentOptions, bg as PermissionProfile, bi as PermissionProfileListResponse, bf as PermissionRules, aN as PolicyOperator, aP as PolicyOrigin, aM as PolicyPredicateSource, aQ as PolicyRuleIR, aL as PolicySource, bG as ProjectionChange, Z as PromptFeedItem, c1 as PublishEffectsResult, ar as PublishFeedbackOptions, q as PublishToolsResult, as as PublishTransientFeedbackOptions, b9 as QuotaLineItemFilter, b6 as QuotaPeriod, b5 as QuotaScopeType, b7 as QuotaStatus, dg as RPCRequest, dj as RPCRequestFromServer, dh as RPCResponse, dF as RecordImport, dE as RecordImportItem, dC as RecordImportItemStatus, dA as RecordImportOptions, dD as RecordImportStats, dB as RecordImportStatus, dz as RecordImportWriteMode, cR as RecordManualActionInput, d2 as RecordMentionInput, dw as RecordObjectResult, dq as RecordObjectStateValue, dx as RecordObjectsChunkInfo, dy as RecordObjectsOptions, aG as RecordOpenAIUsageSpendOptions, aH as RecordOpenAIUsageSpendResult, d1 as RecordSearchOptions, d0 as RecordSearchResult, aW as RecordUserOptions, dn as RelationshipInfo, bE as RelationshipProjectionChange, bU as ResolvedEffectApprovalRequired, bS as ResolvedEffectDryRun, bR as ResolvedEffectPostCondition, bT as ResolvedEffectReverse, dH as RunEnvironmentImporterOptions, bc as Sandbox, be as SandboxListResponse, bx as SemanticVersionDiff, bw as SemanticVersionDiffEntry, cH as SessionArtifactApprovalOptions, cx as SessionArtifactAutonomyPolicy, cG as SessionArtifactExecutionOptions, cF as SessionArtifactExecutionResult, cw as SessionArtifactKind, cz as SessionArtifactListOptions, cy as SessionArtifactRecord, cE as SessionArtifactRelationshipCreateInput, cC as SessionArtifactRelationshipOption, cB as SessionArtifactRelationshipOptionsInput, cD as SessionArtifactRelationshipOptionsResult, cv as SessionArtifactStatus, cA as SessionArtifactValidationResult, d4 as SessionCollectionListOptions, d6 as SessionCollectionListResult, d3 as SessionDocumentResult, a7 as SessionFeedApi, aq as SessionFeedController, aj as SessionFeedControllerOptions, cs as SessionFileKind, cu as SessionFileRecord, cr as SessionFileSource, ct as SessionFileStatus, cX as SessionFileUploadOptions, cZ as SessionHeapFieldType, c_ as SessionHeapFieldValue, c$ as SessionHeapVariable, d5 as SessionJobListOptions, cY as SessionJobRecord, bP as SessionMutationView, cq as SessionTimelineEvent, co as SessionTranscriptActionSuggestion, cp as SessionTranscriptShowRefs, at as SettleTransientFeedbackOptions, di as SnapshotResetMessage, bz as SourceAcknowledgement, b4 as SpendLineItemType, b8 as SpendSummary, bF as StateObservationProjectionChange, eh as StreamEvent, ej as StreamStats, ei as StreamSubscription, aX as Subject, Q as TableFeedItem, r as ToolHandler, c3 as ToolInfo, dk as ToolInvokeParams, dl as ToolResultParams, p as ToolSchema, c5 as ToolsChangedEvent, a1 as TransientFeedItem, _ as TransientFeedItemBase, a0 as TransientFeedbackFeedItem, au as TransientFeedbackHandle, $ as TransientMessageFeedItem, bB as TransitionOutcomeProjection, bJ as TransitionProjectionResult, aV as User, d8 as UserEnvironmentMessagePreview, d7 as UserEnvironmentPrompt, d9 as UserEnvironmentSessionState, da as UserEnvironmentState, db as UserEnvironmentStateOptions, cl as UserMessageAppendResult, ck as UserMessageInput, ci as UserMessageShowRefs, cj as UserMessageTarget, bu as Version, bn as VersionTag, bm as VersionTracking, df as WSClientOptions, dd as WSDisconnectInfo, de as WSReconnectErrorInfo, aJ as buildOpenAISpendEventId, aD as calculateOpenAITokenSpend, aw as createFeedPublisher, ai as emitFeedDiagnostic, ah as emitFeedDiagnosticToDefaultSink, al as emptyFeedSnapshot, aB as getOpenAIModelPricing, am as hasCanonicalSessionFeedActivation, an as isCanonicalSessionFeedDocument, a8 as mergeFeedItemsBySequence, ag as normalizeFeedDiagnostic, af as normalizeFeedDiagnosticKind, ap as normalizeFeedPage, aC as normalizeOpenAIUsage, a9 as orderTransientFeedItems, ao as readSessionFeedSnapshot, aK as recordOpenAIUsageSpend, aI as toGranularHttpBase } from './spend-BDGtgZtl.js';
+export { E as Environment, a as EnvironmentSession, G as Granular, O as OntologyHandle, S as Session, W as WSClient, i as isGraphQLMutationDocument } from './client-D1gq4TO4.js';
+import { E as EnvironmentData, a as EnvironmentRecordImportSummary, b as EndpointMode, c as EffectCommitRequest, C as CommitReceipt, T as ToolWithHandler, P as ProjectionResult, d as ProjectionMapper, e as CommitTransitionOutcomeDeclaration, f as CommitDeclaration, g as EffectHandlerContext, F as FeedPublishTransport, M as ManifestEffectMetamodelSpec, R as ResolvedEffectBehaviors, h as RecordObjectOptions, i as ManifestContent, j as CommitTransitionInvocation, S as SessionHeapEntry, k as SessionHeapList, l as FeedItem, m as SessionHeapSnapshot, n as Prompt, o as SessionTranscriptEntry } from './spend-B-IQmp7F.js';
+export { eh as APIError, aS as AccessTokenProvider, Y as ActionSuggestionFeedItem, aZ as AdoptEnvironmentOptions, bK as AgentCommitStatus, cN as ArtifactApprovalDecisionInput, cO as ArtifactApprovalDecisionResult, cL as ArtifactApprovalTask, cM as ArtifactApprovalTaskListOptions, cK as ArtifactApprovalTaskStatus, U as ArtifactFeedItem, b_ as ArtifactOptionsHandler, bj as Assignment, bk as AssignmentListResponse, cm as AssistantReplyPublicationInput, cn as AssistantReplyPublicationResult, bH as BaseProjectionResult, bt as Build, bv as BuildListResponse, bl as BuildPolicy, bs as BuildStatus, bC as CanonicalProjectedRecord, bL as CommitChangeReceipt, bA as CommitSafeError, bM as CommitTransitionReceipt, aO as ConditionIR, a_ as ConnectOptions, b0 as ConversationSessionInfo, b2 as ConversationSessionListOptions, b3 as ConversationSessionListResponse, b1 as ConversationSessionListStatus, bo as CreateEnvironmentData, bh as CreatePermissionProfileData, bd as CreateSandboxData, a$ as CreateSessionOptions, dr as DefineRelationshipOptions, ei as DeleteResponse, D as DomainState, bW as EffectArtifactOptionsInvocation, bY as EffectArtifactRelationshipOption, bZ as EffectArtifactRelationshipOptionsResult, bQ as EffectCommitContext, c7 as EffectHandler, c4 as EffectInfo, bX as EffectInvocationMetadata, bV as EffectInvocationMode, bI as EffectProjectionResult, b$ as EffectSchema, c2 as EffectVersionSelector, c0 as EffectWithHandler, c6 as EffectsChangedEvent, cf as EnvironmentFeedbackRecord, dO as EnvironmentImporter, dN as EnvironmentImporterImportOptions, bp as EnvironmentListResponse, dM as EnvironmentSetupImporterClaim, dK as EnvironmentSetupLifecycleStatus, dL as EnvironmentSetupSummary, dI as EnvironmentSetupTriggerReason, dw as EnvironmentStateMachineProxy, du as EnvironmentStateObservationInput, dx as EnvironmentStateProxy, dt as EnvironmentStateTarget, dv as EnvironmentStateUpdateInput, bN as ExternalCommitOptions, ac as FeedDiagnostic, ad as FeedDiagnosticListener, ak as FeedDocumentState, v as FeedFeedbackTone, V as FeedFileSource, u as FeedIconToken, z as FeedItemBase, x as FeedItemKind, a3 as FeedListOptions, aa as FeedListTransport, G as FeedObjectReference, a4 as FeedPage, av as FeedPublisher, a2 as FeedSnapshot, ab as FeedSnapshotRegressionReason, t as FeedSource, s as FeedSourceActor, a5 as FeedSubscribeOptions, a6 as FeedSubscriptionChange, H as FeedTableCell, J as FeedTableColumn, N as FeedTableProjection, L as FeedTableRow, K as FeedTableRowReference, y as FeedTarget, w as FeedTransientFeedbackTone, B as FeedbackFeedItem, W as FileFeedItem, ae as GRANULAR_FEED_DIAGNOSTIC_EVENT, aU as GranularAuth, aT as GranularOptions, ba as GranularQuotaPolicy, bb as GranularQuotaProgress, aE as GranularSpendContext, eg as GraphQLResult, c8 as InstanceEffectHandler, I as InstanceToolHandler, ch as Job, cd as JobFeedbackInput, cc as JobFeedbackMetadata, ce as JobFeedbackRecord, ca as JobFeedbackSentiment, cb as JobFeedbackToolCall, c9 as JobStatus, cg as JobSubmitResult, bq as Manifest, e6 as ManifestApprovalRequiredSpec, e7 as ManifestCreatesSpec, e4 as ManifestDryRunSpec, ea as ManifestEffectDeclaration, e9 as ManifestEffectSchema, dR as ManifestEnumRuleSpec, ec as ManifestEventStreamDef, eb as ManifestEventTypeDef, dS as ManifestFilterBySpec, ee as ManifestImport, br as ManifestListResponse, ed as ManifestOperation, e3 as ManifestPostConditionSpec, dP as ManifestPropertySpec, e8 as ManifestRelationshipDef, e5 as ManifestReverseSpec, e2 as ManifestStateMachineSpec, dU as ManifestStateMachineStateSpec, e1 as ManifestStateMachineTransitionSpec, dW as ManifestStateTransitionActionSpec, dX as ManifestStateTransitionAssigneeSpec, d$ as ManifestStateTransitionExpectedOutcomeSpec, dV as ManifestStateTransitionInputBinding, e0 as ManifestStateTransitionOutcomeSpec, d_ as ManifestStateTransitionPermissionSpec, dY as ManifestStateTransitionRelatedStateRequirementSpec, dZ as ManifestStateTransitionRequirementsSpec, dQ as ManifestValidationOperator, dT as ManifestValidationRuleSpec, ef as ManifestVolume, cW as ManualActionListOptions, cU as ManualActionOccurrence, cV as ManualActionRecordResult, cS as ManualActionRelatedRecord, cQ as ManualActionSource, cP as ManualActionStatus, cX as ManualActionSuggestion, cY as ManualActionSuggestionOptions, cR as ManualActionTarget, de as MarkUserEnvironmentReadOptions, aR as MatchedPolicy, A as MessageFeedItem, dp as ModelRef, ay as NormalizedOpenAIUsage, X as NormalizedSuggestedArtifact, aA as OPENAI_MODEL_PRICING_USD_PER_MILLION, bD as ObjectProjectionChange, by as ObjectReference, O as ObjectsFeedItem, bO as ObservationReceipt, ax as OpenAIModelPricing, az as OpenAITokenSpend, aF as OpenAIUsageSpendEvent, aY as OpenEnvironmentOptions, bg as PermissionProfile, bi as PermissionProfileListResponse, bf as PermissionRules, aN as PolicyOperator, aP as PolicyOrigin, aM as PolicyPredicateSource, aQ as PolicyRuleIR, aL as PolicySource, bG as ProjectionChange, Z as PromptFeedItem, c1 as PublishEffectsResult, ar as PublishFeedbackOptions, q as PublishToolsResult, as as PublishTransientFeedbackOptions, b9 as QuotaLineItemFilter, b6 as QuotaPeriod, b5 as QuotaScopeType, b7 as QuotaStatus, di as RPCRequest, dl as RPCRequestFromServer, dj as RPCResponse, dH as RecordImport, dG as RecordImportItem, dE as RecordImportItemStatus, dC as RecordImportOptions, dF as RecordImportStats, dD as RecordImportStatus, dB as RecordImportWriteMode, cT as RecordManualActionInput, d4 as RecordMentionInput, dy as RecordObjectResult, ds as RecordObjectStateValue, dz as RecordObjectsChunkInfo, dA as RecordObjectsOptions, aG as RecordOpenAIUsageSpendOptions, aH as RecordOpenAIUsageSpendResult, d3 as RecordSearchOptions, d2 as RecordSearchResult, aW as RecordUserOptions, dq as RelationshipInfo, bE as RelationshipProjectionChange, bU as ResolvedEffectApprovalRequired, bS as ResolvedEffectDryRun, bR as ResolvedEffectPostCondition, bT as ResolvedEffectReverse, dJ as RunEnvironmentImporterOptions, bc as Sandbox, be as SandboxListResponse, bx as SemanticVersionDiff, bw as SemanticVersionDiffEntry, cJ as SessionArtifactApprovalOptions, cx as SessionArtifactAutonomyPolicy, cI as SessionArtifactExecutionOptions, cH as SessionArtifactExecutionResult, cz as SessionArtifactFieldProvenance, cy as SessionArtifactFieldProvenanceSource, cw as SessionArtifactKind, cB as SessionArtifactListOptions, cA as SessionArtifactRecord, cG as SessionArtifactRelationshipCreateInput, cE as SessionArtifactRelationshipOption, cD as SessionArtifactRelationshipOptionsInput, cF as SessionArtifactRelationshipOptionsResult, cv as SessionArtifactStatus, cC as SessionArtifactValidationResult, d6 as SessionCollectionListOptions, d8 as SessionCollectionListResult, d5 as SessionDocumentResult, a7 as SessionFeedApi, aq as SessionFeedController, aj as SessionFeedControllerOptions, cs as SessionFileKind, cu as SessionFileRecord, cr as SessionFileSource, ct as SessionFileStatus, cZ as SessionFileUploadOptions, c$ as SessionHeapFieldType, d0 as SessionHeapFieldValue, d1 as SessionHeapVariable, d7 as SessionJobListOptions, c_ as SessionJobRecord, bP as SessionMutationView, cq as SessionTimelineEvent, co as SessionTranscriptActionSuggestion, cp as SessionTranscriptShowRefs, at as SettleTransientFeedbackOptions, dk as SnapshotResetMessage, bz as SourceAcknowledgement, b4 as SpendLineItemType, b8 as SpendSummary, bF as StateObservationProjectionChange, ej as StreamEvent, el as StreamStats, ek as StreamSubscription, aX as Subject, Q as TableFeedItem, r as ToolHandler, c3 as ToolInfo, dm as ToolInvokeParams, dn as ToolResultParams, p as ToolSchema, c5 as ToolsChangedEvent, a1 as TransientFeedItem, _ as TransientFeedItemBase, a0 as TransientFeedbackFeedItem, au as TransientFeedbackHandle, $ as TransientMessageFeedItem, bB as TransitionOutcomeProjection, bJ as TransitionProjectionResult, aV as User, da as UserEnvironmentMessagePreview, d9 as UserEnvironmentPrompt, db as UserEnvironmentSessionState, dc as UserEnvironmentState, dd as UserEnvironmentStateOptions, cl as UserMessageAppendResult, ck as UserMessageInput, ci as UserMessageShowRefs, cj as UserMessageTarget, bu as Version, bn as VersionTag, bm as VersionTracking, dh as WSClientOptions, df as WSDisconnectInfo, dg as WSReconnectErrorInfo, aJ as buildOpenAISpendEventId, aD as calculateOpenAITokenSpend, aw as createFeedPublisher, ai as emitFeedDiagnostic, ah as emitFeedDiagnosticToDefaultSink, al as emptyFeedSnapshot, aB as getOpenAIModelPricing, am as hasCanonicalSessionFeedActivation, an as isCanonicalSessionFeedDocument, a8 as mergeFeedItemsBySequence, ag as normalizeFeedDiagnostic, af as normalizeFeedDiagnosticKind, ap as normalizeFeedPage, aC as normalizeOpenAIUsage, a9 as orderTransientFeedItems, ao as readSessionFeedSnapshot, aK as recordOpenAIUsageSpend, aI as toGranularHttpBase } from './spend-B-IQmp7F.js';
 export { BuildGranularAgentSystemPromptInput, GeneratedJobCodeIssue, GranularAgentExecutionCheckpoint, GranularAgentHeapSummaryOptions, GranularAgentManualActionMemorySuggestion, GranularAgentPromptCapabilities, GranularAgentReferentFocus, GranularAgentSessionContext, GranularAgentToolInfo, GranularAgentWorkflowFocus, GranularReasoningTraceChunkResult, GranularReasoningTraceOptions, HarnessContinuationDecision, HarnessControllerBudgets, HarnessProjectionOptions, HarnessPromptLike, HarnessRenderedContinuation, HarnessRenderedPrompt, HarnessTemplate, HarnessTemplateManifest, HarnessTemplateSelectionOptions, HarnessTemplateStatus, HarnessVerifierSnapshot, HarnessVerifierSnapshotInput, ReviewGeneratedJobCodeOptions, buildContinuationInstruction, buildContinuationInstructionFromTemplate, buildGranularAgentCheckpointBlock, buildGranularAgentDomainBlock, buildGranularAgentFileBlock, buildGranularAgentHeapBlock, buildGranularAgentLoopBlock, buildGranularAgentManualActionBlock, buildGranularAgentManualActionMemorySummary, buildGranularAgentReferentBlock, buildGranularAgentRuntimeImportsBlock, buildGranularAgentSessionBlock, buildGranularAgentSystemPrompt, buildGranularAgentSystemPromptFromTemplate, buildGranularAgentToolBlock, buildGranularAgentWorkflowBlock, consumeGranularReasoningOnlyChunk, consumeGranularReasoningTraceChunk, createHarnessVerifierSnapshot, evaluateContinuation, getCurrentClosureId, getDefaultHarnessTemplateId, getExclusivePromptTarget, hasOpenPrompt, hashHarnessTemplateValue, listHarnessTemplates, projectConversationReferentFocus, projectConversationReferentSummary, projectHeapSummary, projectLoopSummary, projectSessionFileSummary, projectWorkflowFocus, projectWorkflowSummary, renderContinuationInstructionFromTemplate, renderGranularAgentSystemPromptFromTemplate, resolveHarnessTemplate, reviewGeneratedJobCode, stripGranularReasoningTrace, validateHarnessTemplateManifest } from './agent-harness.js';
 import '@automerge/automerge';
 import '@automerge/automerge/slim';