@m8t-stack/api-contract 0.1.0

package/README.md

@@ -0,0 +1,9 @@
+# `@m8t-stack/api-contract`
+
+> 📦 Published on npm: `npm i @m8t-stack/api-contract`
+
+**What:** Shared gateway HTTP request/response types + error reasons (response envelope, errors, reason codes, team, me, binding, inbound-envelope, service-bus). Re-exported in full by [`@m8t-stack/platform-sdk`](../platform-sdk) — most consumers import the SDK rather than this package directly.
+
+**Used by:** the m8t gateway (apps/web), the `@m8t-stack/cli`, and `@m8t-stack/platform-sdk`.
+
+See [the package index](../README.md) for the full map.

package/dist/cjs/a2a-card.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.A2A_CARD_MAX_CHARS = void 0;
+exports.serializeA2aCard = serializeA2aCard;
+exports.parseA2aCard = parseA2aCard;
+/** Foundry agent metadata value max length (REST API project/agents). */
+exports.A2A_CARD_MAX_CHARS = 512;
+function serializeA2aCard(card) {
+    return JSON.stringify(card);
+}
+/** Defensive parse (mirrors parseBrainLink): null on missing/malformed; never throws. */
+function parseA2aCard(raw) {
+    if (!raw)
+        return null;
+    let o;
+    try {
+        o = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (typeof o !== "object" || o === null)
+        return null;
+    const c = o;
+    return {
+        role: typeof c.role === "string" ? c.role : "",
+        summary: typeof c.summary === "string" ? c.summary : "",
+        whenToDelegate: typeof c.whenToDelegate === "string" ? c.whenToDelegate : "",
+        accepts: typeof c.accepts === "string" ? c.accepts : "",
+        returns: typeof c.returns === "string" ? c.returns : "",
+    };
+}
+//# sourceMappingURL=a2a-card.js.map

package/dist/cjs/a2a-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2a-card.js","sourceRoot":"","sources":["../../src/a2a-card.ts"],"names":[],"mappings":";;;AAqBA,4CAEC;AAGD,oCAiBC;AAzBD,yEAAyE;AAC5D,QAAA,kBAAkB,GAAG,GAAG,CAAC;AAEtC,SAAgB,gBAAgB,CAAC,IAAa;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,yFAAyF;AACzF,SAAgB,YAAY,CAAC,GAAuB;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,CAAqB,CAAC;IAChC,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC9C,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACvD,cAAc,EAAE,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;QAC5E,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACvD,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;KACxD,CAAC;AACJ,CAAC"}

package/dist/cjs/binding.js

@@ -0,0 +1,45 @@
+"use strict";
+/**
+ * Wire DTOs for the binding-management API surface.
+ * `/api/bindings` GET/POST, `/api/bindings/[bindingId]` GET/DELETE,
+ * `/api/bindings/cleanup-orphaned` POST.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BINDING_STATUSES = void 0;
+exports.isBindingStatus = isBindingStatus;
+exports.isBindingSecretPayload = isBindingSecretPayload;
+exports.BINDING_STATUSES = ["active", "orphaned"];
+function isBindingStatus(v) {
+    return v === "active" || v === "orphaned";
+}
+/**
+ * Runtime guard for BindingSecretPayload. Used by `lib/gateway/secrets.ts`
+ * to validate JSON.parse output before treating it as a typed payload.
+ *
+ * Strict on `version: 1` and `channel` discriminator; rejects unknown channel
+ * variants so a future schema rename can't silently misroute. Field validation
+ * within each variant is structural (key presence + string type) only — the
+ * caller decides what to do with malformed contents.
+ */
+function isBindingSecretPayload(v) {
+    if (v === null || typeof v !== "object")
+        return false;
+    const obj = v;
+    if (obj.version !== 1)
+        return false;
+    if (typeof obj.channel !== "string")
+        return false;
+    if (obj.channel === "telegram") {
+        return typeof obj.botToken === "string" && typeof obj.webhookSecret === "string";
+    }
+    if (obj.channel === "slack") {
+        return (typeof obj.botToken === "string" &&
+            typeof obj.signingSecret === "string" &&
+            (obj.appLevelToken === undefined || typeof obj.appLevelToken === "string"));
+    }
+    if (obj.channel === "teams") {
+        return typeof obj.appId === "string" && typeof obj.appPassword === "string";
+    }
+    return false;
+}
+//# sourceMappingURL=binding.js.map

package/dist/cjs/binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../../src/binding.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAQH,0CAEC;AAuHD,wDAoBC;AA/IY,QAAA,gBAAgB,GAA6B,CAAC,QAAQ,EAAE,UAAU,CAAU,CAAC;AAE1F,SAAgB,eAAe,CAAC,CAAU;IACxC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,UAAU,CAAC;AAC5C,CAAC;AA8GD;;;;;;;;GAQG;AACH,SAAgB,sBAAsB,CAAC,CAAU;IAC/C,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAElD,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC;IACnF,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,CACL,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAChC,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;YACrC,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cjs/brain-eval.js

@@ -0,0 +1,58 @@
+"use strict";
+// Brain Faculties Evaluation — wire shapes emitted by the Python brain-eval core (camelCase JSON).
+// Mirror of the Brain Faculties Evaluation EPIC §6. The Python dataclasses are authoritative for the
+// running core; these are the typed view consumers (the brain-F3 librarian, future sinks) read.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXAM_EVAL_VERSION = void 0;
+exports.redactForFeed = redactForFeed;
+/** The single exam grader-prose constant (DESIGN §7.6). Distinct from the gate's `f1.x` line.
+ *  Bump on ANY grader-prose change (criteria text, input builders, suite-critique prompt,
+ *  parser semantics); a bump resets the exam-side validation window. Pinned into
+ *  ExamVerdict.evalVersion on every verdict. */
+exports.EXAM_EVAL_VERSION = "exam-f2.0";
+/**
+ * The ONLY permitted producer of an E1-facing feed from a full ExamVerdict (DESIGN §7.6 #1).
+ * Pure + total. Sealed-task runs collapse to aggregates; dev-only verdicts pass through
+ * UNCHANGED (identity). Strips ALL sealed-task TEXT (assertions, evidence, raw turns,
+ * implicitClaims, the runs[] array) AND drops any suiteCritique entry attributed to a
+ * sealed taskId — BY ID, not by substring-matching the taskId inside the text. A grader
+ * FEEDBACK line quotes the sealed assertion TEXT and may name no taskId at all, so a
+ * substring scan leaks it; id-based attribution (set on the entry at the source) closes
+ * the leak (the Law-1 sealed-text fix). KEEPS the version provenance
+ * (rubricVersion / evalVersion / loaderSha / judgeDeployment) — they name THAT something
+ * changed, not WHAT, and are public-safe (§7.6 #2). comparisons[].flips keep
+ * direction + taskId so per-task flip counts survive for the sign test.
+ * Returns RedactedExamVerdict iff ANY arm contains a sealed task, else the verdict unchanged.
+ */
+function redactForFeed(verdict, sealedTaskIds) {
+    // Redact if ANY sealed reference exists — a sealed run in an arm OR a sealed-attributed suiteCritique
+    // entry. The latter guard means a sealed critique can never slip through via the identity path.
+    const hasSealedRun = verdict.arms.some((a) => a.runs.some((r) => sealedTaskIds.has(r.taskId)));
+    const hasSealedCritique = verdict.suiteCritique.some((c) => sealedTaskIds.has(c.taskId));
+    if (!hasSealedRun && !hasSealedCritique)
+        return verdict; // dev-only -> identity pass-through (total + cheap)
+    const redactedArms = verdict.arms.map((a) => {
+        const ra = {
+            arm: a.arm,
+            passRate: a.passRate,
+            stddev: a.stddev,
+            n: a.n,
+            runsRedacted: true,
+        };
+        if (a.recallMetrics !== undefined)
+            ra.recallMetrics = a.recallMetrics; // F3 §5.4: aggregate → feed-safe
+        return ra;
+    });
+    // Drop any suiteCritique entry attributed to a sealed task — BY ID (not substring): the entry's
+    // `text` may quote the sealed assertion verbatim and name no taskId, so id attribution is the
+    // only sound drop (the Law-1 sealed-text leak fix).
+    const cleanedCritique = verdict.suiteCritique.filter((c) => !sealedTaskIds.has(c.taskId));
+    const { arms: _arms, suiteCritique: _sc, ...rest } = verdict;
+    return {
+        ...rest,
+        arms: redactedArms,
+        suiteCritique: cleanedCritique,
+        redacted: true,
+    };
+}
+//# sourceMappingURL=brain-eval.js.map

package/dist/cjs/brain-eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain-eval.js","sourceRoot":"","sources":["../../src/brain-eval.ts"],"names":[],"mappings":";AAAA,mGAAmG;AACnG,qGAAqG;AACrG,gGAAgG;;;AAoRhG,sCAkCC;AAtDD;;;gDAGgD;AACnC,QAAA,iBAAiB,GAAG,WAAW,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,SAAgB,aAAa,CAC3B,OAAoB,EACpB,aAA0B;IAE1B,sGAAsG;IACtG,gGAAgG;IAChG,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACzF,IAAI,CAAC,YAAY,IAAI,CAAC,iBAAiB;QAAE,OAAO,OAAO,CAAC,CAAC,oDAAoD;IAE7G,MAAM,YAAY,GAA2B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAClE,MAAM,EAAE,GAAyB;YAC/B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,YAAY,EAAE,IAAI;SACnB,CAAC;QACF,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS;YAAE,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC,CAAE,iCAAiC;QACzG,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,gGAAgG;IAChG,8FAA8F;IAC9F,oDAAoD;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAE1F,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC7D,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE,YAAY;QAClB,aAAa,EAAE,eAAe;QAC9B,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC"}

package/dist/cjs/brain-link.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IN_CONTAINER_CREDENTIAL_REF = void 0;
+exports.parseBrainLink = parseBrainLink;
+exports.isAppMode = isAppMode;
+exports.isInContainer = isInContainer;
+exports.serializeBrainLink = serializeBrainLink;
+/**
+ * Parse the brain link from Foundry agent metadata. Defensive: absent or
+ * malformed returns undefined and never throws — discovery must not break on
+ * a hand-written or partial `metadata.brain`.
+ */
+function parseBrainLink(metadata) {
+    const raw = metadata?.brain;
+    if (!raw)
+        return undefined;
+    try {
+        const obj = JSON.parse(raw);
+        if (!obj || typeof obj.repo !== "string" || obj.repo.length === 0)
+            return undefined;
+        return {
+            repo: obj.repo,
+            branch: typeof obj.branch === "string" && obj.branch ? obj.branch : "main",
+            topology: obj.topology === "shared" ? "shared" : "per-worker",
+            schemaVersion: typeof obj.schemaVersion === "string" && obj.schemaVersion ? obj.schemaVersion : "1",
+            credentialRef: typeof obj.credentialRef === "string" ? obj.credentialRef : "",
+            ...(typeof obj.installationId === "string" ? { installationId: obj.installationId } : {}),
+            ...(typeof obj.instanceFolder === "string" ? { instanceFolder: obj.instanceFolder } : {}),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** True when the link uses GitHub App authentication (F2 mode). A type guard so
+ *  callers that mint with the installation id narrow it to a present string. */
+function isAppMode(link) {
+    return typeof link.installationId === "string" && link.installationId.length > 0;
+}
+/** Sentinel credentialRef for hosted workers: the token is minted INSIDE the
+ *  container (no Foundry connection). Invoke-path rotation must skip these. */
+exports.IN_CONTAINER_CREDENTIAL_REF = "in-container";
+/** True when the link is a hosted/in-container brain (token minted in-sandbox;
+ *  there is NO Foundry connection to rotate). */
+function isInContainer(link) {
+    return link.credentialRef === exports.IN_CONTAINER_CREDENTIAL_REF;
+}
+/** Serialize a BrainLink to the Foundry-metadata JSON string. */
+function serializeBrainLink(link) {
+    return JSON.stringify(link);
+}
+//# sourceMappingURL=brain-link.js.map

package/dist/cjs/brain-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain-link.js","sourceRoot":"","sources":["../../src/brain-link.ts"],"names":[],"mappings":";;;AAmCA,wCAqBC;AAID,8BAEC;AAQD,sCAEC;AAGD,gDAEC;AA/CD;;;;GAIG;AACH,SAAgB,cAAc,CAC5B,QAA4C;IAE5C,MAAM,GAAG,GAAG,QAAQ,EAAE,KAAK,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAA8B,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;QACpF,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACpF,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC1E,QAAQ,EAAE,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YAC7D,aAAa,EACX,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG;YACtF,aAAa,EAAE,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;YAC7E,GAAG,CAAC,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;gFACgF;AAChF,SAAgB,SAAS,CAAC,IAAe;IACvC,OAAO,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;AACnF,CAAC;AAED;+EAC+E;AAClE,QAAA,2BAA2B,GAAG,cAAc,CAAC;AAE1D;iDACiD;AACjD,SAAgB,aAAa,CAAC,IAAe;IAC3C,OAAO,IAAI,CAAC,aAAa,KAAK,mCAA2B,CAAC;AAC5D,CAAC;AAED,iEAAiE;AACjE,SAAgB,kBAAkB,CAAC,IAAe;IAChD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC"}

package/dist/cjs/errors.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InternalError = exports.UpstreamError = exports.RateLimitedError = exports.ConflictError = exports.NotFoundError = exports.BadRequestError = exports.ForbiddenError = exports.UnauthenticatedError = exports.ApiError = void 0;
+class ApiError extends Error {
+    details;
+    constructor(message, details) {
+        super(message);
+        this.name = this.constructor.name;
+        this.details = details;
+        // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- V8-specific API absent in non-Node environments; typed as always-present in @types/node but runtime presence is not guaranteed
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+    }
+}
+exports.ApiError = ApiError;
+class UnauthenticatedError extends ApiError {
+    code = "UNAUTHENTICATED";
+    status = 401;
+}
+exports.UnauthenticatedError = UnauthenticatedError;
+class ForbiddenError extends ApiError {
+    code = "FORBIDDEN";
+    status = 403;
+}
+exports.ForbiddenError = ForbiddenError;
+class BadRequestError extends ApiError {
+    code = "BAD_REQUEST";
+    status = 400;
+}
+exports.BadRequestError = BadRequestError;
+class NotFoundError extends ApiError {
+    code = "NOT_FOUND";
+    status = 404;
+}
+exports.NotFoundError = NotFoundError;
+class ConflictError extends ApiError {
+    code = "CONFLICT";
+    status = 409;
+}
+exports.ConflictError = ConflictError;
+class RateLimitedError extends ApiError {
+    code = "RATE_LIMITED";
+    status = 429;
+}
+exports.RateLimitedError = RateLimitedError;
+class UpstreamError extends ApiError {
+    code = "UPSTREAM_FAILED";
+    status = 502;
+}
+exports.UpstreamError = UpstreamError;
+class InternalError extends ApiError {
+    code = "INTERNAL";
+    status = 500;
+}
+exports.InternalError = InternalError;
+//# sourceMappingURL=errors.js.map

package/dist/cjs/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":";;;AAAA,MAAsB,QAAS,SAAQ,KAAK;IAGjC,OAAO,CAAW;IAE3B,YAAY,OAAe,EAAE,OAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,yMAAyM;QACzM,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;CACF;AAdD,4BAcC;AAED,MAAa,oBAAqB,SAAQ,QAAQ;IACvC,IAAI,GAAG,iBAAiB,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC;CACvB;AAHD,oDAGC;AAED,MAAa,cAAe,SAAQ,QAAQ;IACjC,IAAI,GAAG,WAAW,CAAC;IACnB,MAAM,GAAG,GAAG,CAAC;CACvB;AAHD,wCAGC;AAED,MAAa,eAAgB,SAAQ,QAAQ;IAClC,IAAI,GAAG,aAAa,CAAC;IACrB,MAAM,GAAG,GAAG,CAAC;CACvB;AAHD,0CAGC;AAED,MAAa,aAAc,SAAQ,QAAQ;IAChC,IAAI,GAAG,WAAW,CAAC;IACnB,MAAM,GAAG,GAAG,CAAC;CACvB;AAHD,sCAGC;AAED,MAAa,aAAc,SAAQ,QAAQ;IAChC,IAAI,GAAG,UAAU,CAAC;IAClB,MAAM,GAAG,GAAG,CAAC;CACvB;AAHD,sCAGC;AAED,MAAa,gBAAiB,SAAQ,QAAQ;IACnC,IAAI,GAAG,cAAc,CAAC;IACtB,MAAM,GAAG,GAAG,CAAC;CACvB;AAHD,4CAGC;AAED,MAAa,aAAc,SAAQ,QAAQ;IAChC,IAAI,GAAG,iBAAiB,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC;CACvB;AAHD,sCAGC;AAED,MAAa,aAAc,SAAQ,QAAQ;IAChC,IAAI,GAAG,UAAU,CAAC;IAClB,MAAM,GAAG,GAAG,CAAC;CACvB;AAHD,sCAGC"}

package/dist/cjs/inbound-envelope.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=inbound-envelope.js.map

package/dist/cjs/inbound-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-envelope.js","sourceRoot":"","sources":["../../src/inbound-envelope.ts"],"names":[],"mappings":""}

package/dist/cjs/index.js

@@ -0,0 +1,37 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.A2A_CARD_MAX_CHARS = exports.parseA2aCard = exports.serializeA2aCard = exports.IN_CONTAINER_CREDENTIAL_REF = exports.isInContainer = exports.serializeBrainLink = exports.isAppMode = exports.parseBrainLink = void 0;
+__exportStar(require("./response.js"), exports);
+__exportStar(require("./errors.js"), exports);
+__exportStar(require("./reasons.js"), exports);
+__exportStar(require("./team.js"), exports);
+__exportStar(require("./me.js"), exports);
+__exportStar(require("./binding.js"), exports);
+__exportStar(require("./inbound-envelope.js"), exports);
+__exportStar(require("./service-bus.js"), exports);
+var brain_link_js_1 = require("./brain-link.js");
+Object.defineProperty(exports, "parseBrainLink", { enumerable: true, get: function () { return brain_link_js_1.parseBrainLink; } });
+Object.defineProperty(exports, "isAppMode", { enumerable: true, get: function () { return brain_link_js_1.isAppMode; } });
+Object.defineProperty(exports, "serializeBrainLink", { enumerable: true, get: function () { return brain_link_js_1.serializeBrainLink; } });
+Object.defineProperty(exports, "isInContainer", { enumerable: true, get: function () { return brain_link_js_1.isInContainer; } });
+Object.defineProperty(exports, "IN_CONTAINER_CREDENTIAL_REF", { enumerable: true, get: function () { return brain_link_js_1.IN_CONTAINER_CREDENTIAL_REF; } });
+var a2a_card_js_1 = require("./a2a-card.js");
+Object.defineProperty(exports, "serializeA2aCard", { enumerable: true, get: function () { return a2a_card_js_1.serializeA2aCard; } });
+Object.defineProperty(exports, "parseA2aCard", { enumerable: true, get: function () { return a2a_card_js_1.parseA2aCard; } });
+Object.defineProperty(exports, "A2A_CARD_MAX_CHARS", { enumerable: true, get: function () { return a2a_card_js_1.A2A_CARD_MAX_CHARS; } });
+__exportStar(require("./brain-eval.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,8CAA4B;AAC5B,+CAA6B;AAC7B,4CAA0B;AAC1B,0CAAwB;AACxB,+CAA6B;AAC7B,wDAAsC;AACtC,mDAAiC;AAEjC,iDAA4H;AAAnH,+GAAA,cAAc,OAAA;AAAE,0GAAA,SAAS,OAAA;AAAE,mHAAA,kBAAkB,OAAA;AAAE,8GAAA,aAAa,OAAA;AAAE,4HAAA,2BAA2B,OAAA;AAElG,6CAAmF;AAA1E,+GAAA,gBAAgB,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAC3D,kDAAgC"}

package/dist/cjs/me.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=me.js.map

package/dist/cjs/me.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/me.ts"],"names":[],"mappings":""}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/cjs/reasons.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * String-literal union types for the `details.reason` field carried in
+ * `ApiResponse.error.details`. Centralizing these prevents drift between
+ * the backend's throws and the CLI's hint-lookup table.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=reasons.js.map

package/dist/cjs/reasons.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reasons.js","sourceRoot":"","sources":["../../src/reasons.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}

package/dist/cjs/response.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isApiResponse = isApiResponse;
+/**
+ * Type guard for callers that received a parsed JSON of unknown shape.
+ */
+function isApiResponse(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const v = value;
+    if (v.ok === true && "data" in v)
+        return true;
+    if (v.ok === false && typeof v.error === "object" && v.error !== null) {
+        const e = v.error;
+        return typeof e.code === "string" && typeof e.message === "string";
+    }
+    return false;
+}
+//# sourceMappingURL=response.js.map

package/dist/cjs/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../src/response.ts"],"names":[],"mappings":";;AAwBA,sCASC;AAZD;;GAEG;AACH,SAAgB,aAAa,CAAc,KAAc;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAgC,CAAC;QAC7C,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC;IACrE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cjs/service-bus.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=service-bus.js.map

package/dist/cjs/service-bus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-bus.js","sourceRoot":"","sources":["../../src/service-bus.ts"],"names":[],"mappings":""}

package/dist/cjs/team.js

@@ -0,0 +1,13 @@
+"use strict";
+/**
+ * Wire DTOs for the team-management API surface.
+ * `/api/team` GET/POST, `/api/team/[handle]` GET/PATCH/DELETE.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHANNELS = void 0;
+exports.isChannel = isChannel;
+exports.CHANNELS = ["telegram", "slack", "teams"];
+function isChannel(v) {
+    return v === "telegram" || v === "slack" || v === "teams";
+}
+//# sourceMappingURL=team.js.map

package/dist/cjs/team.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.js","sourceRoot":"","sources":["../../src/team.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAMH,8BAEC;AAJY,QAAA,QAAQ,GAAuB,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAEpF,SAAgB,SAAS,CAAC,CAAU;IAClC,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,CAAC;AAC5D,CAAC"}

package/dist/esm/a2a-card.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The A2A capability card — authored in a persona's targets.foundry.a2a-card
+ * block, projected into Foundry agent metadata as the `a2aCard` JSON string
+ * (mirrors metadata.brain), and returned by the bridge's discover_workers.
+ *
+ * Foundry agent metadata values are capped at 512 chars, so the serialized
+ * card must fit one value. Maps onto the A2A AgentCard for the future
+ * graduation: summary→description, whenToDelegate→skill description/tags,
+ * accepts/returns→skill I/O modes, role→skill name.
+ */
+export interface A2aCard {
+    role: string;
+    summary: string;
+    whenToDelegate: string;
+    accepts: string;
+    returns: string;
+}
+/** Foundry agent metadata value max length (REST API project/agents). */
+export declare const A2A_CARD_MAX_CHARS = 512;
+export declare function serializeA2aCard(card: A2aCard): string;
+/** Defensive parse (mirrors parseBrainLink): null on missing/malformed; never throws. */
+export declare function parseA2aCard(raw: string | undefined): A2aCard | null;
+//# sourceMappingURL=a2a-card.d.ts.map

package/dist/esm/a2a-card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2a-card.d.ts","sourceRoot":"","sources":["../../src/a2a-card.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,yEAAyE;AACzE,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAEtC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAEtD;AAED,yFAAyF;AACzF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAiBpE"}

package/dist/esm/a2a-card.js

@@ -0,0 +1,28 @@
+/** Foundry agent metadata value max length (REST API project/agents). */
+export const A2A_CARD_MAX_CHARS = 512;
+export function serializeA2aCard(card) {
+    return JSON.stringify(card);
+}
+/** Defensive parse (mirrors parseBrainLink): null on missing/malformed; never throws. */
+export function parseA2aCard(raw) {
+    if (!raw)
+        return null;
+    let o;
+    try {
+        o = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (typeof o !== "object" || o === null)
+        return null;
+    const c = o;
+    return {
+        role: typeof c.role === "string" ? c.role : "",
+        summary: typeof c.summary === "string" ? c.summary : "",
+        whenToDelegate: typeof c.whenToDelegate === "string" ? c.whenToDelegate : "",
+        accepts: typeof c.accepts === "string" ? c.accepts : "",
+        returns: typeof c.returns === "string" ? c.returns : "",
+    };
+}
+//# sourceMappingURL=a2a-card.js.map

package/dist/esm/a2a-card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2a-card.js","sourceRoot":"","sources":["../../src/a2a-card.ts"],"names":[],"mappings":"AAkBA,yEAAyE;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,YAAY,CAAC,GAAuB;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,CAAqB,CAAC;IAChC,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC9C,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACvD,cAAc,EAAE,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;QAC5E,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACvD,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;KACxD,CAAC;AACJ,CAAC"}

package/dist/esm/binding.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Wire DTOs for the binding-management API surface.
+ * `/api/bindings` GET/POST, `/api/bindings/[bindingId]` GET/DELETE,
+ * `/api/bindings/cleanup-orphaned` POST.
+ */
+import type { Channel } from "./team.js";
+export type BindingStatus = "active" | "orphaned";
+export declare const BINDING_STATUSES: readonly BindingStatus[];
+export declare function isBindingStatus(v: unknown): v is BindingStatus;
+export interface Binding {
+    channel: Channel;
+    bindingId: string;
+    agentName: string;
+    /** Key Vault URI for the secret blob (versioned). NEVER the token itself. */
+    botTokenSecretRef: string;
+    botUsername?: string;
+    status: BindingStatus;
+    /** ISO 8601 */
+    createdAt: string;
+    /** Admin UPN who created the binding */
+    createdBy: string;
+}
+export interface ListBindingsResponse {
+    bindings: Binding[];
+}
+export interface CreateBindingRequest {
+    channel: Channel;
+    bindingId: string;
+    agentName: string;
+    /** Plaintext bot token — sent on the wire (HTTPS), never persisted in the row. */
+    botToken: string;
+    botUsername?: string;
+}
+export interface CreateBindingResponse {
+    binding: Binding;
+    /** Constructed from GATEWAY_PUBLIC_URL + channel + bindingId. */
+    webhookUrl: string;
+}
+export interface GetBindingResponse {
+    binding: Binding;
+}
+export interface DeleteBindingResponse {
+    deleted: {
+        bindingId: string;
+        channel: Channel;
+        conversationsCleared: number;
+    };
+}
+export interface CleanupOrphanedResponse {
+    cleaned: {
+        bindingId: string;
+        channel: Channel;
+    }[];
+    failed: {
+        bindingId: string;
+        channel: Channel;
+        originalMessage: string;
+    }[];
+}
+export type CascadeStep = "unregisterWebhook" | "kvSecret" | "conversations" | "bindingsRow";
+/**
+ * Carried in UpstreamError.details.partial when DELETE cascade fails mid-flow.
+ * The CLI's `bind remove` command renders this inline for a structured retry hint.
+ */
+export interface CascadeFailureDetails {
+    bindingId: string;
+    channel: Channel;
+    completedSteps: CascadeStep[];
+    failedStep: CascadeStep;
+    originalMessage: string;
+}
+export interface TelegramSecretPayload {
+    version: 1;
+    channel: "telegram";
+    botToken: string;
+    /** 64 hex chars; set on Telegram's `setWebhook` via the `secret_token` param. */
+    webhookSecret: string;
+}
+export interface SlackSecretPayload {
+    version: 1;
+    channel: "slack";
+    /** `xoxb-...` bot user OAuth token */
+    botToken: string;
+    /** App-level signing secret used to verify Slack request HMACs */
+    signingSecret: string;
+    /** `xapp-...` app-level token, optional, for future Socket Mode */
+    appLevelToken?: string;
+}
+export interface TeamsSecretPayload {
+    version: 1;
+    channel: "teams";
+    appId: string;
+    appPassword: string;
+}
+export type BindingSecretPayload = TelegramSecretPayload | SlackSecretPayload | TeamsSecretPayload;
+/**
+ * Runtime guard for BindingSecretPayload. Used by `lib/gateway/secrets.ts`
+ * to validate JSON.parse output before treating it as a typed payload.
+ *
+ * Strict on `version: 1` and `channel` discriminator; rejects unknown channel
+ * variants so a future schema rename can't silently misroute. Field validation
+ * within each variant is structural (key presence + string type) only — the
+ * caller decides what to do with malformed contents.
+ */
+export declare function isBindingSecretPayload(v: unknown): v is BindingSecretPayload;
+//# sourceMappingURL=binding.d.ts.map

package/dist/esm/binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../src/binding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,CAAC;AAElD,eAAO,MAAM,gBAAgB,EAAE,SAAS,aAAa,EAAoC,CAAC;AAE1F,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,aAAa,CAE9D;AAED,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,aAAa,CAAC;IACtB,eAAe;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,OAAO,CAAC;QACjB,oBAAoB,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IACnD,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5E;AAED,MAAM,MAAM,WAAW,GAAG,mBAAmB,GAAG,UAAU,GAAG,eAAe,GAAG,aAAa,CAAC;AAE7F;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9B,UAAU,EAAE,WAAW,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB;AAeD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,oBAAoB,GAC5B,qBAAqB,GACrB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,oBAAoB,CAoB5E"}

package/dist/esm/binding.js

@@ -0,0 +1,40 @@
+/**
+ * Wire DTOs for the binding-management API surface.
+ * `/api/bindings` GET/POST, `/api/bindings/[bindingId]` GET/DELETE,
+ * `/api/bindings/cleanup-orphaned` POST.
+ */
+export const BINDING_STATUSES = ["active", "orphaned"];
+export function isBindingStatus(v) {
+    return v === "active" || v === "orphaned";
+}
+/**
+ * Runtime guard for BindingSecretPayload. Used by `lib/gateway/secrets.ts`
+ * to validate JSON.parse output before treating it as a typed payload.
+ *
+ * Strict on `version: 1` and `channel` discriminator; rejects unknown channel
+ * variants so a future schema rename can't silently misroute. Field validation
+ * within each variant is structural (key presence + string type) only — the
+ * caller decides what to do with malformed contents.
+ */
+export function isBindingSecretPayload(v) {
+    if (v === null || typeof v !== "object")
+        return false;
+    const obj = v;
+    if (obj.version !== 1)
+        return false;
+    if (typeof obj.channel !== "string")
+        return false;
+    if (obj.channel === "telegram") {
+        return typeof obj.botToken === "string" && typeof obj.webhookSecret === "string";
+    }
+    if (obj.channel === "slack") {
+        return (typeof obj.botToken === "string" &&
+            typeof obj.signingSecret === "string" &&
+            (obj.appLevelToken === undefined || typeof obj.appLevelToken === "string"));
+    }
+    if (obj.channel === "teams") {
+        return typeof obj.appId === "string" && typeof obj.appPassword === "string";
+    }
+    return false;
+}
+//# sourceMappingURL=binding.js.map

package/dist/esm/binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../../src/binding.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,MAAM,CAAC,MAAM,gBAAgB,GAA6B,CAAC,QAAQ,EAAE,UAAU,CAAU,CAAC;AAE1F,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,UAAU,CAAC;AAC5C,CAAC;AA8GD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAU;IAC/C,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAElD,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC;IACnF,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,CACL,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAChC,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;YACrC,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}