@mayiapp/eve 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Aaron HS
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,272 @@
+# `@mayiapp/eve`
+
+Durable Mayi approval channel for [Eve](https://github.com/vercel/eve) agents.
+
+## Quick start
+
+```sh
+npm install @mayiapp/eve eve
+```
+
+Create the Mayi channel in the root agent:
+
+```ts
+// agent/channels/mayi.ts
+import { mayiChannel } from "@mayiapp/eve";
+import { credentials } from "../credentials.server";
+
+export default mayiChannel({
+  getAccessToken: () => credentials.getAccessToken("mayi"),
+});
+```
+
+The host owns Mayi's Authorization Code + PKCE flow, securely stores and
+refreshes the OAuth grant, and returns a current access token from
+`getAccessToken`. The adapter and `@mayiapp/sdk` do not store tokens. Do not put an
+access token, refresh token, static API key, or webhook endpoint ID in agent code.
+Eden's generated integration supplies this credential binding; see the complete
+[Eden agent template](https://github.com/asiraky/mayi/tree/main/packages/eve/examples/eden-agent).
+
+An approval-gated tool remains ordinary Eve code:
+
+```ts
+// agent/tools/deploy-production.ts
+import { defineTool } from "eve/tools";
+import { always } from "eve/tools/approval";
+import { z } from "zod";
+
+export default defineTool({
+  description: "Deploy a version to production.",
+  inputSchema: z.object({ version: z.string() }),
+  approval: always(),
+  async execute({ version }) {
+    return deployToProduction(version);
+  },
+});
+```
+
+## Approval evidence
+
+Approval happens before Eve calls the gated tool's `execute()` function. An
+evidence hook can render from the proposed tool input, fetch an existing object,
+or read a file created by an earlier tool. It cannot use the gated tool's result,
+because that result does not exist until after the human approves.
+
+Configure `artefacts` when an approval should include a PDF or image:
+
+```ts
+export default mayiChannel({
+  getAccessToken: () => credentials.getAccessToken("mayi"),
+  async artefacts({ request, signal }) {
+    const pdf = await renderDeploymentPlan(request.action.input, { signal });
+    return [{
+      filename: "deployment-plan.pdf",
+      mediaType: "application/pdf",
+      body: pdf,
+    }];
+  },
+});
+```
+
+The hook receives the complete Eve input request, a read-only session snapshot,
+`getSandbox()`, and an abort signal. For evidence already in object storage:
+
+```ts
+async artefacts({ request, signal }) {
+  const response = await fetch(String(request.action.input.previewUrl), { signal });
+  return [{ filename: "preview.webp", mediaType: "image/webp", body: response.body! }];
+}
+```
+
+For a file produced by an earlier tool, read through Eve's supported sandbox
+API and return the bytes:
+
+```ts
+async artefacts({ getSandbox }) {
+  const sandbox = await getSandbox();
+  const body = await sandbox.readBinaryFile("/workspace/output/report.pdf");
+  return [{ filename: "report.pdf", mediaType: "application/pdf", body }];
+}
+```
+
+`undefined`, `null`, and an empty array all mean no evidence and preserve the
+ordinary one-call approval path. A request may return at most 20 artefacts;
+each must be a PDF, PNG, JPEG, or WebP no larger than 25 MiB. Returned order is
+the order shown to the approver and bound into the approval manifest. Hook,
+validation, timeout, or upload failures fail closed: Mayi does not create an
+approval with silently missing evidence. `artefactTimeoutMs` defaults to 30
+seconds and its signal should be passed to rendering, fetch, and file work.
+
+## Scheduled and cross-channel handoff
+
+Mayi handles `input.requested` only for sessions owned by the Mayi channel. It
+does not intercept a session that belongs to Slack, Discord, the default HTTP
+channel, or another custom channel. Start work on Mayi with Eve's
+`receive(mayi, ...)` whenever that work may need a Mayi approval.
+
+Task-mode schedules cannot park for human input. Use the handler form of an Eve
+schedule and hand the run to Mayi:
+
+```ts
+// agent/schedules/check-production.ts
+import { defineSchedule } from "eve/schedules";
+import mayi from "../channels/mayi";
+
+export default defineSchedule({
+  cron: "0 * * * *",
+  run({ receive, waitUntil, appAuth }) {
+    waitUntil(receive(mayi, {
+      message: "Check production and deploy if needed.",
+      target: { mayiUserId: "AbCdEfGhIjKl" },
+      auth: appAuth,
+    }));
+  },
+});
+```
+
+The same rule applies to cross-channel work. A custom channel route receives an
+Eve `receive` helper; import the Mayi channel and hand the new session to it:
+
+```ts
+import { defineChannel, POST } from "eve/channels";
+import mayi from "./mayi";
+
+export default defineChannel({
+  routes: [
+    POST("/deploy-request", async (request, { receive, waitUntil }) => {
+      const deployment = await request.json();
+      waitUntil(receive(mayi, {
+        message: `Review and deploy ${deployment.version}.`,
+        target: { mayiUserId: deployment.approverId },
+        auth: {
+          authenticator: "eden",
+          principalType: "service",
+          principalId: deployment.requestedBy,
+          attributes: {},
+        },
+      }));
+      return new Response("accepted", { status: 202 });
+    }),
+  ],
+});
+```
+
+`target.mayiUserId` is optional. When supplied, it must be a 12-letter Mayi user
+ID and is sent as the suggested approver. The caller supplies the initial
+message, target, and Eve authentication context; the adapter owns the raw
+continuation token and durable channel state.
+
+## Callback route and resume semantics
+
+`mayiChannel()` registers this route in the deployed Eve service:
+
+```text
+POST /eve/v1/mayi/approval-resolved
+```
+
+Authors do not create that route, its URL, encrypted state, a correlation table,
+or a signature verifier. The adapter builds the callback URL from the stable
+public Eve origin. Register that exact HTTPS URL as an
+entry in `approval_callback_uris` for the Eden/host OAuth client.
+
+The explicit `POST()` route is intentional. Eve 0.24.2 compiles a channel
+`route.path` verbatim; it does not prepend a channel namespace. Inventing a
+`/channels/mayi/...` prefix registers the wrong OAuth callback and produces a
+404 instead of a resume.
+
+For every delivery, the adapter verifies Mayi's EdDSA JWS against Mayi's JWKS
+before it touches encrypted state or resumes Eve. It then opens the authenticated
+state and submits the response against the original Eve request ID and the
+original channel-local continuation token. An `approved` result chooses Eve's
+`approve` option. `denied`, `expired`, and `cancelled` choose `deny`, so the
+parked session resumes but the gated tool does not run.
+
+Callback delivery is at least once. A `2xx` response means Eve accepted the
+resume or had already accepted the same verified event. The adapter does not
+acknowledge before Eve accepts. Eve's continuation fence and event stream let
+the adapter recognize an already-accepted resume, so retrying the same stable
+event ID cannot execute the tool twice. Verification, decryption, or resume
+failures return a non-`2xx` response so Mayi continues its durable retry policy.
+The signed event and encrypted callback state remain acceptable for seven days
+after resolution. Manual replay keeps the original event ID and occurrence time,
+so operators must replay a dead letter within that window and consumers retain
+the same duplicate-safety identity.
+
+Hosts that already have a durable event store may pass `eventStore` with
+`isProcessed(eventId)` and `markProcessed(eventId)` methods. The duplicate check
+runs only after webhook verification, and `markProcessed` runs only after Eve
+accepts the resume. A crash before acceptance therefore leaves the event
+retryable. The hook is optional; ordinary Eden-generated integrations can rely
+on Eve's durable acceptance check without adding a consumer database. The
+advanced `webhookFetch` option can inject the fetch implementation used to load
+Mayi's JWKS; normal deployments use the runtime's global `fetch`.
+
+## Deployment configuration
+
+The deployment host provisions:
+
+- `EVE_PUBLIC_ORIGIN`: the stable public HTTPS origin of the deployed Eve agent,
+  such as `https://agent.example`. Do not use a transient preview URL.
+- `MAYI_CALLBACK_STATE_KEY_ID`: the identifier for the current callback-state
+  encryption key.
+- `MAYI_CALLBACK_STATE_KEY`: a stable base64url-encoded 32-byte encryption key.
+- `MAYI_CALLBACK_STATE_PREVIOUS_KEYS` (optional): a JSON array of decrypt-only
+  `{ "kid", "key" }` entries retained while approvals and callback retries made
+  with older keys may still be outstanding.
+- `MAYI_ORIGIN` (optional): the Mayi API and JWKS origin. It defaults to
+  `https://app.mayi.sh`.
+
+Keep callback-state keys stable across process restarts and deploys. Rotate by
+installing a new current key and retaining the old key in
+`MAYI_CALLBACK_STATE_PREVIOUS_KEYS` until its approvals and the seven-day
+callback acceptance window have elapsed. Never derive these keys from OAuth
+credentials.
+
+For local development, pass a public HTTPS tunnel origin as `publicOrigin` to
+`mayiChannel()`, and register the resulting callback URL on the development
+OAuth client. This override is refused in production. Mayi signing keys are
+read from `${MAYI_ORIGIN}/.well-known/jwks.json` and cached with bounded refresh;
+they are not copied into the agent's environment.
+
+Never log decrypted callback state, continuation tokens, OAuth credentials,
+receipts, or sensitive tool input.
+
+## Troubleshooting
+
+- **Public origin:** set `EVE_PUBLIC_ORIGIN` to one stable public HTTPS origin.
+  Vercel production can use `VERCEL_PROJECT_PRODUCTION_URL`; preview URLs,
+  localhost, paths, ports, and private hosts are refused.
+- **Origin changes:** `approval_callback_uris` are immutable. Register a new
+  OAuth client with the new callback, reconnect through Authorization Code +
+  PKCE, confirm the new agent works, then revoke the old agent connection.
+- **Local tunnels:** pass the tunnel origin through `publicOrigin` only in local
+  development and register its exact callback on a development OAuth client.
+  Tunnel rotation requires updating that development registration.
+- **State rotation:** install a new callback-state key and retain old decrypt-only
+  keys until every outstanding approval plus Mayi's seven-day acceptance window has
+  elapsed. Unknown, tampered, expired, or wrong-key state fails closed.
+- **Signing rotation:** Mayi publishes current and retained Ed25519 public keys at
+  `/.well-known/jwks.json`. Keep old signing public keys available through the
+  callback retry/event-age window; bounded JWKS refresh handles a newly seen key.
+- **Retries and recovery:** non-`2xx` responses remain retryable according to
+  Mayi's outbox policy. Inspect the Mayi callback job, correct the receiver, and
+  replay only a `DEAD_LETTER` job through the authenticated replay endpoint. The
+  stable event ID makes duplicate delivery safe.
+
+## Eve 0.24.2 limitation for unsupported input
+
+Phase one supports approval-shaped confirmation requests only. A freeform or
+select `ask_question` produces a descriptive `UnsupportedMayiInputError`; it is
+never converted into an approval and is never treated as a successful no-op.
+
+Eve 0.24.2 catches, logs, and swallows exceptions thrown by channel event
+handlers, and exposes no public send/resume operation inside an event handler.
+Consequently this rejection is visible in Eve's server logs but cannot currently
+be propagated to the author or used to fail the session through Eve's public
+contract; the session remains parked. Treat this as an unsupported-input error
+and monitor Eve logs. It is a residual Eve contract gap, not approval behavior.
+
+The package is ESM-only, supports Node.js 24 and later (matching Eve), and pins
+its Eve peer to the tested `eve@0.24.2` contract.
+
+Licensed under the [Apache License 2.0](LICENSE).

package/dist/index.d.ts

@@ -0,0 +1,109 @@
+import { GetAccessToken, MayiFetch, ArtefactMediaType, ArtefactBody, WebhookVerifierFetch, CallbackStateCodec } from '@mayiapp/sdk';
+import { SessionHandle, Channel } from 'eve/channels';
+import { SandboxSession } from 'eve/sandbox';
+
+declare const MAYI_CALLBACK_PATH = "/eve/v1/mayi/approval-resolved";
+interface MayiEnvironment {
+    readonly EVE_PUBLIC_ORIGIN?: string;
+    readonly MAYI_CALLBACK_STATE_KEY?: string;
+    readonly MAYI_CALLBACK_STATE_KEY_ID?: string;
+    readonly MAYI_CALLBACK_STATE_PREVIOUS_KEYS?: string;
+    readonly MAYI_ORIGIN?: string;
+    readonly NODE_ENV?: string;
+    readonly VERCEL_BRANCH_URL?: string;
+    readonly VERCEL_ENV?: string;
+    readonly VERCEL_PROJECT_PRODUCTION_URL?: string;
+    readonly VERCEL_URL?: string;
+}
+type MayiEveConfigurationErrorCode = "CALLBACK_STATE_KEY_UNAVAILABLE" | "INVALID_CALLBACK_STATE_KEYS" | "INVALID_CONFIG" | "INVALID_PUBLIC_ORIGIN" | "INVALID_RECEIVE_TARGET" | "PREVIEW_ORIGIN_REFUSED" | "PUBLIC_ORIGIN_UNAVAILABLE";
+declare class MayiEveConfigurationError extends Error {
+    readonly code: MayiEveConfigurationErrorCode;
+    constructor(code: MayiEveConfigurationErrorCode, message: string);
+}
+interface ResolvePublicOriginOptions {
+    readonly environment?: MayiEnvironment;
+    /** Explicit local-development or tunnel origin. Ignored in production. */
+    readonly developmentOverride?: string;
+}
+/** Resolves the stable origin Eve exposes publicly for durable callbacks. */
+declare function resolvePublicOrigin(options?: ResolvePublicOriginOptions): string;
+
+interface MayiReceiveTarget {
+    /** Mayi user to suggest as the approver for approvals started by this session. */
+    readonly mayiUserId?: string;
+}
+interface MayiChannelState {
+    /** The channel-local token passed to Eve send(); never derive this by stripping a namespace. */
+    rawContinuationToken: string | null;
+    target: MayiReceiveTarget | null;
+    /** Opaque callback material retained so a redelivered Eve event is retry-compatible. */
+    callbackRequests?: Record<string, MayiCallbackRequestState>;
+}
+interface MayiCallbackRequestState {
+    readonly state: string;
+    readonly approvalExpiresAt: string;
+}
+interface MayiWebhookEventStore {
+    /** Returns true only after Eve has accepted this event's resume. */
+    readonly isProcessed: (eventId: string) => boolean | Promise<boolean>;
+    /** Durably records an event after Eve has accepted its resume. */
+    readonly markProcessed: (eventId: string) => void | Promise<void>;
+}
+type MayiArtefactMediaType = ArtefactMediaType;
+type MayiArtefactBody = ArtefactBody;
+interface MayiApprovalArtefact {
+    readonly filename: string;
+    readonly mediaType: MayiArtefactMediaType;
+    readonly body: MayiArtefactBody;
+    readonly size?: number;
+}
+interface MayiArtefactsContext {
+    readonly request: Readonly<EveInputRequest>;
+    readonly session: Readonly<Pick<SessionHandle, "id" | "continuationToken" | "auth">>;
+    readonly getSandbox: () => Promise<SandboxSession>;
+    readonly signal: AbortSignal;
+}
+type MayiArtefactsHook = (context: MayiArtefactsContext) => readonly MayiApprovalArtefact[] | null | undefined | Promise<readonly MayiApprovalArtefact[] | null | undefined>;
+interface MayiChannelConfig {
+    readonly getAccessToken: GetAccessToken;
+    /** Mayi API origin. Defaults to MAYI_ORIGIN, then https://app.mayi.sh. */
+    readonly mayiOrigin?: string;
+    /** Explicit HTTPS origin for local development or a tunnel. Never used in production. */
+    readonly publicOrigin?: string;
+    readonly approvalExpiresInSeconds?: number;
+    readonly fetch?: MayiFetch;
+    /** Produces evidence before the gated tool executes. Omit to preserve the no-evidence path. */
+    readonly artefacts?: MayiArtefactsHook;
+    /** Maximum time for one request's hook and uploads. Defaults to 30 seconds. */
+    readonly artefactTimeoutMs?: number;
+    /** Optional durable duplicate fence. Both hooks must be backed by the same store. */
+    readonly eventStore?: MayiWebhookEventStore;
+    /** Advanced host/testing injection for Mayi's public webhook JWKS request. */
+    readonly webhookFetch?: WebhookVerifierFetch;
+    /** Advanced host/testing injection. Normal deployments use the host-provisioned key environment. */
+    readonly callbackStateCodec?: CallbackStateCodec;
+    /** Advanced host/testing injection for runtimes that do not expose process.env. */
+    readonly environment?: MayiEnvironment;
+}
+interface EveInputRequest {
+    readonly action: {
+        readonly kind: "tool-call";
+        readonly toolName: string;
+        readonly callId: string;
+        readonly input: Record<string, unknown>;
+    };
+    readonly allowFreeform?: boolean;
+    readonly display?: "confirmation" | "select" | "text";
+    readonly options?: readonly {
+        readonly id: string;
+    }[];
+    readonly prompt: string;
+    readonly requestId: string;
+}
+declare class UnsupportedMayiInputError extends Error {
+    readonly requestId: string;
+    constructor(requestId: string, display?: string);
+}
+declare function mayiChannel(config: MayiChannelConfig): Channel<MayiChannelState, MayiReceiveTarget>;
+
+export { MAYI_CALLBACK_PATH, type MayiChannelConfig, type MayiChannelState, type MayiEnvironment, MayiEveConfigurationError, type MayiEveConfigurationErrorCode, type MayiReceiveTarget, type MayiWebhookEventStore, type ResolvePublicOriginOptions, UnsupportedMayiInputError, mayiChannel, resolvePublicOrigin };

package/dist/index.js

@@ -0,0 +1,584 @@
+// src/channel.ts
+import {
+  CallbackStateError,
+  CALLBACK_ACCEPTANCE_WINDOW_SECONDS,
+  MAYI_SIGNATURE_HEADER,
+  MAX_WEBHOOK_BODY_BYTES,
+  MayiClient,
+  WebhookConfigurationError,
+  WebhookVerificationError,
+  createCallbackStateCodec,
+  createWebhookVerifier
+} from "@mayiapp/sdk";
+import {
+  POST,
+  defineChannel
+} from "eve/channels";
+
+// src/origin.ts
+var MAYI_CALLBACK_PATH = "/eve/v1/mayi/approval-resolved";
+var MayiEveConfigurationError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "MayiEveConfigurationError";
+    this.code = code;
+  }
+};
+function runtimeEnvironment() {
+  const runtime = globalThis;
+  return runtime.process?.env ?? {};
+}
+function hostnameFromEnvironmentUrl(value) {
+  if (!value) return void 0;
+  try {
+    const candidate = value.includes("://") ? value : `https://${value}`;
+    return new URL(candidate).hostname.toLowerCase();
+  } catch {
+    return void 0;
+  }
+}
+function isNonPublicHostname(hostname) {
+  const lower = hostname.toLowerCase();
+  if (lower === "localhost" || lower.endsWith(".localhost") || lower.endsWith(".local") || lower.endsWith(".internal") || !lower.includes(".")) return true;
+  return /^\d{1,3}(?:\.\d{1,3}){3}$/.test(lower) || lower.includes(":");
+}
+function normalizePublicHttpsOrigin(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash || url.port || isNonPublicHostname(url.hostname)) throw new Error("invalid origin");
+    return url.origin;
+  } catch {
+    throw new MayiEveConfigurationError(
+      "INVALID_PUBLIC_ORIGIN",
+      "The Eve public origin must be a public HTTPS origin without credentials, a path, query, fragment, or non-default port"
+    );
+  }
+}
+function assertNotTransientPreview(origin, environment) {
+  const hostname = new URL(origin).hostname.toLowerCase();
+  const productionHostname = hostnameFromEnvironmentUrl(environment.VERCEL_PROJECT_PRODUCTION_URL);
+  const transientHostnames = [environment.VERCEL_URL, environment.VERCEL_BRANCH_URL].map(hostnameFromEnvironmentUrl).filter((item) => item !== void 0 && item !== productionHostname);
+  if (transientHostnames.includes(hostname)) {
+    throw new MayiEveConfigurationError(
+      "PREVIEW_ORIGIN_REFUSED",
+      "Transient Vercel preview URLs cannot be used for durable Mayi approval callbacks"
+    );
+  }
+}
+function resolvePublicOrigin(options = {}) {
+  const environment = options.environment ?? runtimeEnvironment();
+  if (environment.EVE_PUBLIC_ORIGIN !== void 0) {
+    const origin = normalizePublicHttpsOrigin(environment.EVE_PUBLIC_ORIGIN);
+    assertNotTransientPreview(origin, environment);
+    return origin;
+  }
+  if (environment.VERCEL_ENV === "production" && environment.VERCEL_PROJECT_PRODUCTION_URL) {
+    const value = environment.VERCEL_PROJECT_PRODUCTION_URL;
+    const origin = normalizePublicHttpsOrigin(value.includes("://") ? value : `https://${value}`);
+    assertNotTransientPreview(origin, environment);
+    return origin;
+  }
+  const production = environment.NODE_ENV === "production" || environment.VERCEL_ENV === "production";
+  if (!production && options.developmentOverride !== void 0) {
+    const origin = normalizePublicHttpsOrigin(options.developmentOverride);
+    assertNotTransientPreview(origin, environment);
+    return origin;
+  }
+  throw new MayiEveConfigurationError(
+    "PUBLIC_ORIGIN_UNAVAILABLE",
+    "A stable public Eve origin is required; provision EVE_PUBLIC_ORIGIN for this deployment"
+  );
+}
+function getRuntimeEnvironment() {
+  return runtimeEnvironment();
+}
+
+// src/channel.ts
+var DEFAULT_MAYI_ORIGIN = "https://app.mayi.sh";
+var DEFAULT_APPROVAL_EXPIRES_IN_SECONDS = 60 * 60;
+var MAYI_USER_ID_PATTERN = /^[A-Za-z]{12}$/;
+var MAX_CONTINUATION_TOKEN_LENGTH = 4096;
+var MAX_CORRELATION_ID_LENGTH = 512;
+var MAX_EXPIRY_LENGTH = 64;
+var ACCEPTANCE_RECONCILIATION_TIMEOUT_MS = 2e3;
+var DEFAULT_ARTEFACT_TIMEOUT_MS = 3e4;
+var MAX_ARTEFACTS = 20;
+var ARTEFACT_CONCURRENCY = 3;
+var MAX_CALLBACK_BODY_BYTES = MAX_WEBHOOK_BODY_BYTES;
+var Semaphore = class {
+  constructor(maximum) {
+    this.maximum = maximum;
+  }
+  maximum;
+  active = 0;
+  waiting = [];
+  async run(task) {
+    if (this.active >= this.maximum) await new Promise((resolve) => this.waiting.push(resolve));
+    this.active++;
+    try {
+      return await task();
+    } finally {
+      this.active--;
+      this.waiting.shift()?.();
+    }
+  }
+};
+var UnsupportedMayiInputError = class extends Error {
+  requestId;
+  constructor(requestId, display = "unspecified") {
+    super(
+      `@mayiapp/eve supports only tool approval confirmations; Eve input request "${requestId}" uses unsupported display "${display}"`
+    );
+    this.name = "UnsupportedMayiInputError";
+    this.requestId = requestId;
+  }
+};
+function parsePreviousKeys(value) {
+  if (!value) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new MayiEveConfigurationError(
+      "INVALID_CALLBACK_STATE_KEYS",
+      "MAYI_CALLBACK_STATE_PREVIOUS_KEYS must be a JSON array of callback-state keys"
+    );
+  }
+  if (!Array.isArray(parsed) || parsed.some((item) => !item || typeof item !== "object" || Array.isArray(item) || Object.keys(item).some((key) => key !== "kid" && key !== "key") || typeof item.kid !== "string" || typeof item.key !== "string")) {
+    throw new MayiEveConfigurationError(
+      "INVALID_CALLBACK_STATE_KEYS",
+      "MAYI_CALLBACK_STATE_PREVIOUS_KEYS must be a JSON array of callback-state keys"
+    );
+  }
+  return parsed;
+}
+async function callbackStateCodecFromEnvironment(environment) {
+  const kid = environment.MAYI_CALLBACK_STATE_KEY_ID;
+  const key = environment.MAYI_CALLBACK_STATE_KEY;
+  if (!kid || !key) {
+    throw new MayiEveConfigurationError(
+      "CALLBACK_STATE_KEY_UNAVAILABLE",
+      "The host must provision MAYI_CALLBACK_STATE_KEY_ID and MAYI_CALLBACK_STATE_KEY"
+    );
+  }
+  try {
+    return await createCallbackStateCodec({
+      currentKey: { kid, key },
+      previousKeys: parsePreviousKeys(environment.MAYI_CALLBACK_STATE_PREVIOUS_KEYS),
+      maximumRetryWindowSeconds: CALLBACK_ACCEPTANCE_WINDOW_SECONDS
+    });
+  } catch (error) {
+    if (error instanceof MayiEveConfigurationError) throw error;
+    throw new MayiEveConfigurationError(
+      "INVALID_CALLBACK_STATE_KEYS",
+      "The host-provisioned callback-state key configuration is invalid"
+    );
+  }
+}
+function createRuntime(config, dependencies = {}) {
+  if (!config || typeof config !== "object" || typeof config.getAccessToken !== "function") {
+    throw new MayiEveConfigurationError("INVALID_CONFIG", "mayiChannel requires getAccessToken");
+  }
+  const expiresInSeconds = config.approvalExpiresInSeconds ?? DEFAULT_APPROVAL_EXPIRES_IN_SECONDS;
+  if (!Number.isInteger(expiresInSeconds) || expiresInSeconds < 60 || expiresInSeconds > 7 * 24 * 60 * 60) {
+    throw new MayiEveConfigurationError(
+      "INVALID_CONFIG",
+      "approvalExpiresInSeconds must be an integer between 60 and 604800"
+    );
+  }
+  if (config.eventStore !== void 0 && (!config.eventStore || typeof config.eventStore !== "object" || typeof config.eventStore.isProcessed !== "function" || typeof config.eventStore.markProcessed !== "function")) {
+    throw new MayiEveConfigurationError(
+      "INVALID_CONFIG",
+      "eventStore must provide both isProcessed and markProcessed"
+    );
+  }
+  const artefactTimeoutMs = config.artefactTimeoutMs ?? DEFAULT_ARTEFACT_TIMEOUT_MS;
+  if (!Number.isInteger(artefactTimeoutMs) || artefactTimeoutMs < 1 || artefactTimeoutMs > 5 * 60 * 1e3) {
+    throw new MayiEveConfigurationError(
+      "INVALID_CONFIG",
+      "artefactTimeoutMs must be an integer between 1 and 300000"
+    );
+  }
+  if (config.artefacts !== void 0 && typeof config.artefacts !== "function") {
+    throw new MayiEveConfigurationError("INVALID_CONFIG", "artefacts must be a function");
+  }
+  const environment = config.environment ?? getRuntimeEnvironment();
+  const mayiOrigin = config.mayiOrigin ?? environment.MAYI_ORIGIN ?? DEFAULT_MAYI_ORIGIN;
+  const client = new MayiClient({
+    origin: mayiOrigin,
+    getAccessToken: config.getAccessToken,
+    ...config.fetch === void 0 ? {} : { fetch: config.fetch }
+  });
+  let codecPromise;
+  let verifier;
+  return {
+    ...config.artefacts === void 0 ? {} : { artefacts: config.artefacts },
+    artefactSemaphore: new Semaphore(ARTEFACT_CONCURRENCY),
+    artefactTimeoutMs,
+    client,
+    environment,
+    ...config.eventStore === void 0 ? {} : { eventStore: config.eventStore },
+    expiresInSeconds,
+    now: dependencies.now ?? Date.now,
+    ...config.publicOrigin === void 0 ? {} : { publicOriginOverride: config.publicOrigin },
+    codec() {
+      codecPromise ??= config.callbackStateCodec ? Promise.resolve(config.callbackStateCodec) : callbackStateCodecFromEnvironment(environment);
+      return codecPromise;
+    },
+    verifier() {
+      verifier ??= createWebhookVerifier({
+        mayiOrigin,
+        maximumEventAgeSeconds: CALLBACK_ACCEPTANCE_WINDOW_SECONDS,
+        now: dependencies.now ?? Date.now,
+        ...config.webhookFetch === void 0 ? {} : { fetch: config.webhookFetch },
+        ...config.eventStore === void 0 ? {} : { isProcessed: config.eventStore.isProcessed }
+      });
+      return verifier;
+    }
+  };
+}
+function isApprovalRequest(request) {
+  if (request.display !== "confirmation" || request.allowFreeform === true) return false;
+  const optionIds = request.options?.map((option) => option.id) ?? [];
+  return optionIds.length === 2 && optionIds.includes("approve") && optionIds.includes("deny");
+}
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+async function createMayiIdempotencyKey(sessionId, requestId) {
+  const material = new TextEncoder().encode(JSON.stringify(["mayi-eve-v1", sessionId, requestId]));
+  const digest = await crypto.subtle.digest("SHA-256", material);
+  return `mayi:eve:v1:${bytesToBase64Url(new Uint8Array(digest))}`;
+}
+async function submitOneRequest(request, channel, context, runtime) {
+  if (!isApprovalRequest(request)) {
+    throw new UnsupportedMayiInputError(request.requestId, request.display);
+  }
+  const rawContinuationToken = channel.state.rawContinuationToken;
+  if (!rawContinuationToken || !channel.state.target) {
+    throw new MayiEveConfigurationError(
+      "INVALID_CONFIG",
+      "The Mayi channel is missing its durable receive state"
+    );
+  }
+  let callbackRequest = channel.state.callbackRequests?.[request.requestId];
+  if (!callbackRequest) {
+    const now = runtime.now();
+    const approvalExpiresAt = new Date(now + runtime.expiresInSeconds * 1e3).toISOString();
+    const stateExpiresAt = new Date(
+      now + (runtime.expiresInSeconds + CALLBACK_ACCEPTANCE_WINDOW_SECONDS) * 1e3
+    ).toISOString();
+    const codec = await runtime.codec();
+    const state = await codec.seal({
+      version: 1,
+      rawContinuationToken,
+      requestId: request.requestId,
+      sessionId: context.session.id,
+      expiresAt: stateExpiresAt
+    }, { approvalExpiresAt });
+    callbackRequest = { state, approvalExpiresAt };
+    channel.state.callbackRequests ??= {};
+    channel.state.callbackRequests[request.requestId] = callbackRequest;
+  }
+  const publicOrigin = resolvePublicOrigin({
+    environment: runtime.environment,
+    ...runtime.publicOriginOverride === void 0 ? {} : { developmentOverride: runtime.publicOriginOverride }
+  });
+  const idempotencyKey = await createMayiIdempotencyKey(context.session.id, request.requestId);
+  const artefactIds = await stageRequestArtefacts(request, channel, context, runtime, idempotencyKey);
+  await runtime.client.approvals.request({
+    action: request.action,
+    explanation: request.prompt,
+    expiresInSeconds: runtime.expiresInSeconds,
+    ...channel.state.target.mayiUserId === void 0 ? {} : { suggestedApproverId: channel.state.target.mayiUserId },
+    callback: {
+      url: `${publicOrigin}${MAYI_CALLBACK_PATH}`,
+      state: callbackRequest.state
+    },
+    ...artefactIds === void 0 ? {} : { artefactIds }
+  }, { idempotencyKey });
+}
+async function stageRequestArtefacts(request, channel, context, runtime, idempotencyKey) {
+  if (!runtime.artefacts) return void 0;
+  if (!channel.session || !context.getSandbox) {
+    throw new MayiEveConfigurationError("INVALID_CONFIG", "Eve did not provide the artefact hook context");
+  }
+  const session = channel.session;
+  const getSandbox = context.getSandbox;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(new Error("Mayi artefact preparation timed out")), runtime.artefactTimeoutMs);
+  try {
+    return await Promise.race([
+      runtime.artefactSemaphore.run(async () => {
+        const artefacts = await runtime.artefacts({
+          request,
+          session,
+          getSandbox,
+          signal: controller.signal
+        });
+        if (controller.signal.aborted) throw controller.signal.reason;
+        if (artefacts == null || artefacts.length === 0) return void 0;
+        if (!Array.isArray(artefacts) || artefacts.length > MAX_ARTEFACTS) {
+          throw new MayiEveConfigurationError("INVALID_CONFIG", "artefacts must return at most 20 items");
+        }
+        const ids = [];
+        for (const [ordinal, artefact] of artefacts.entries()) {
+          if (controller.signal.aborted) throw controller.signal.reason;
+          const staged = await runtime.client.stageRequestArtefact(
+            idempotencyKey,
+            ordinal,
+            artefact.filename,
+            artefact.mediaType,
+            artefact.body,
+            {
+              signal: controller.signal,
+              ...artefact.size === void 0 ? {} : { size: artefact.size }
+            }
+          );
+          ids.push(staged.id);
+        }
+        return ids;
+      }),
+      new Promise((_, reject) => {
+        controller.signal.addEventListener("abort", () => reject(controller.signal.reason), { once: true });
+      })
+    ]);
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function createInputRequestedHandler(runtime) {
+  return async (data, channel, context) => {
+    const results = await Promise.allSettled(
+      data.requests.map((request) => submitOneRequest(request, channel, context, runtime))
+    );
+    const failures = results.filter((result) => result.status === "rejected").map((result) => result.reason);
+    if (failures.length) throw new AggregateError(failures, "One or more Mayi approval requests failed");
+  };
+}
+function genericResponse(status, message) {
+  return Response.json({ error: message }, {
+    status,
+    headers: { "cache-control": "no-store" }
+  });
+}
+async function readCallbackBody(request) {
+  const contentLength = request.headers.get("content-length");
+  if (contentLength !== null && (!/^\d+$/.test(contentLength) || Number(contentLength) > MAX_CALLBACK_BODY_BYTES)) throw new Error("Invalid callback request");
+  if (!request.body) return "";
+  const reader = request.body.getReader();
+  const chunks = [];
+  let length = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      length += value.byteLength;
+      if (length > MAX_CALLBACK_BODY_BYTES) {
+        await reader.cancel();
+        throw new Error("Invalid callback request");
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new Error("Invalid callback request");
+  }
+}
+function validBoundedString(value, maximumLength) {
+  return typeof value === "string" && value.length > 0 && value.length <= maximumLength;
+}
+function parseContinuationState(value, currentTime) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).length !== 5 || value.version !== 1 || !validBoundedString(
+    value.rawContinuationToken,
+    MAX_CONTINUATION_TOKEN_LENGTH
+  ) || !validBoundedString(value.requestId, MAX_CORRELATION_ID_LENGTH) || !validBoundedString(value.sessionId, MAX_CORRELATION_ID_LENGTH) || !validBoundedString(value.expiresAt, MAX_EXPIRY_LENGTH)) throw new CallbackStateError("INVALID_STATE");
+  const state = value;
+  const expiresAt = Date.parse(state.expiresAt);
+  if (!Number.isFinite(expiresAt)) throw new CallbackStateError("INVALID_STATE");
+  if (expiresAt <= currentTime) throw new CallbackStateError("EXPIRED");
+  return state;
+}
+async function requestWasAccepted(getSession, sessionId, requestId) {
+  let callId;
+  try {
+    const stream = await getSession(sessionId).getEventStream();
+    const reader = stream.getReader();
+    try {
+      const deadline = Date.now() + ACCEPTANCE_RECONCILIATION_TIMEOUT_MS;
+      while (true) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+          await reader.cancel();
+          return false;
+        }
+        let timeout;
+        const result = await Promise.race([
+          reader.read(),
+          new Promise((resolve) => {
+            timeout = setTimeout(() => resolve(null), remaining);
+          })
+        ]).finally(() => clearTimeout(timeout));
+        if (result === null) {
+          await reader.cancel();
+          return false;
+        }
+        const { done, value } = result;
+        if (done) return false;
+        if (value.type === "input.requested") {
+          const request = value.data.requests.find((candidate) => candidate.requestId === requestId);
+          if (request?.action.kind === "tool-call") callId = request.action.callId;
+        } else if (callId !== void 0 && value.type === "action.result" && value.data.result.kind === "tool-result" && value.data.result.callId === callId) {
+          return true;
+        }
+      }
+    } finally {
+      reader.releaseLock();
+    }
+  } catch {
+    return false;
+  }
+}
+async function markProcessed(eventId, runtime) {
+  if (!runtime.eventStore) return true;
+  try {
+    await runtime.eventStore.markProcessed(eventId);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function alreadyProcessed(eventId, runtime) {
+  if (!runtime.eventStore) return false;
+  try {
+    return await runtime.eventStore.isProcessed(eventId) === true;
+  } catch {
+    return false;
+  }
+}
+function createApprovalResolvedHandler(runtime) {
+  return async (request, args) => {
+    let body;
+    try {
+      body = await readCallbackBody(request);
+    } catch {
+      return genericResponse(400, "Invalid callback request");
+    }
+    let verification;
+    try {
+      verification = await runtime.verifier().verify({
+        body,
+        signature: request.headers.get(MAYI_SIGNATURE_HEADER)
+      });
+    } catch (error) {
+      if (error instanceof WebhookConfigurationError) {
+        return genericResponse(503, "Callback verification is temporarily unavailable");
+      }
+      if (error instanceof WebhookVerificationError && (error.code === "KEY_SET_UNAVAILABLE" || error.code === "DUPLICATE_CHECK_FAILED")) return genericResponse(503, "Callback verification is temporarily unavailable");
+      return genericResponse(401, "Callback verification failed");
+    }
+    if (verification.duplicate) {
+      return new Response(null, { status: 208, headers: { "cache-control": "no-store" } });
+    }
+    let state;
+    let codec;
+    try {
+      codec = await runtime.codec();
+    } catch {
+      return genericResponse(503, "Callback state handling is temporarily unavailable");
+    }
+    try {
+      state = parseContinuationState(
+        await codec.open(verification.event.state),
+        runtime.now()
+      );
+    } catch {
+      return genericResponse(400, "Callback state is invalid");
+    }
+    const optionId = verification.event.status === "approved" ? "approve" : "deny";
+    try {
+      const session = await args.send({
+        inputResponses: [{ requestId: state.requestId, optionId }]
+      }, {
+        auth: null,
+        continuationToken: state.rawContinuationToken,
+        state: { rawContinuationToken: state.rawContinuationToken, target: null }
+      });
+      if (session.id !== state.sessionId) throw new Error("resume session mismatch");
+    } catch {
+      if (await alreadyProcessed(verification.event.id, runtime)) {
+        return new Response(null, { status: 208, headers: { "cache-control": "no-store" } });
+      }
+      if (!await requestWasAccepted(args.getSession, state.sessionId, state.requestId)) {
+        return genericResponse(503, "Eve did not accept the callback resume");
+      }
+      if (!await markProcessed(verification.event.id, runtime)) {
+        return genericResponse(503, "Callback acknowledgement is temporarily unavailable");
+      }
+      return new Response(null, { status: 208, headers: { "cache-control": "no-store" } });
+    }
+    if (!await markProcessed(verification.event.id, runtime)) {
+      return genericResponse(503, "Callback acknowledgement is temporarily unavailable");
+    }
+    return new Response(null, { status: 202, headers: { "cache-control": "no-store" } });
+  };
+}
+function createRawContinuationToken() {
+  if (!globalThis.crypto || typeof globalThis.crypto.randomUUID !== "function") {
+    throw new MayiEveConfigurationError("INVALID_CONFIG", "A cryptographically secure random UUID source is required");
+  }
+  return `mayi:${globalThis.crypto.randomUUID()}`;
+}
+function mayiChannel(config) {
+  const runtime = createRuntime(config);
+  const inputRequested = createInputRequestedHandler(runtime);
+  return defineChannel({
+    kindHint: "mayi",
+    state: { rawContinuationToken: null, target: null, callbackRequests: {} },
+    context(state, session) {
+      return {
+        state,
+        session: { id: session.id, continuationToken: session.continuationToken, auth: session.auth }
+      };
+    },
+    routes: [POST(MAYI_CALLBACK_PATH, createApprovalResolvedHandler(runtime))],
+    async receive(input, { send }) {
+      const mayiUserId = input.target.mayiUserId;
+      if (mayiUserId !== void 0 && !MAYI_USER_ID_PATTERN.test(mayiUserId)) {
+        throw new MayiEveConfigurationError(
+          "INVALID_RECEIVE_TARGET",
+          "target.mayiUserId must be exactly 12 ASCII letters"
+        );
+      }
+      const rawContinuationToken = createRawContinuationToken();
+      const target = mayiUserId === void 0 ? {} : { mayiUserId };
+      return send(input.message, {
+        auth: input.auth,
+        continuationToken: rawContinuationToken,
+        state: { rawContinuationToken, target, callbackRequests: {} }
+      });
+    },
+    events: { "input.requested": inputRequested }
+  });
+}
+export {
+  MAYI_CALLBACK_PATH,
+  MayiEveConfigurationError,
+  UnsupportedMayiInputError,
+  mayiChannel,
+  resolvePublicOrigin
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["https://raw.githubusercontent.com/asiraky/mayi/main/packages/eve/src/channel.ts","https://raw.githubusercontent.com/asiraky/mayi/main/packages/eve/src/origin.ts"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OASK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAKK;;;AC1BA,IAAM,qBAAqB;AAwB3B,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAC1C;AAAA,EAET,YAAY,MAAqC,SAAiB;AAChE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AAAA,EACd;AACF;AAQA,SAAS,qBAAsC;AAC7C,QAAM,UAAU;AAGhB,SAAO,QAAQ,SAAS,OAAO,CAAC;AAClC;AAEA,SAAS,2BAA2B,OAA+C;AACjF,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,YAAY,MAAM,SAAS,KAAK,IAAI,QAAQ,WAAW,KAAK;AAClE,WAAO,IAAI,IAAI,SAAS,EAAE,SAAS,YAAY;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,UAA2B;AACtD,QAAM,QAAQ,SAAS,YAAY;AACnC,MACE,UAAU,eACP,MAAM,SAAS,YAAY,KAC3B,MAAM,SAAS,QAAQ,KACvB,MAAM,SAAS,WAAW,KAC1B,CAAC,MAAM,SAAS,GAAG,EACtB,QAAO;AAIT,SAAO,4BAA4B,KAAK,KAAK,KAAK,MAAM,SAAS,GAAG;AACtE;AAEA,SAAS,2BAA2B,OAAuB;AACzD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QACE,IAAI,aAAa,YACd,IAAI,YACJ,IAAI,YACJ,IAAI,aAAa,OACjB,IAAI,UACJ,IAAI,QACJ,IAAI,QACJ,oBAAoB,IAAI,QAAQ,EACnC,OAAM,IAAI,MAAM,gBAAgB;AAClC,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,0BAA0B,QAAgB,aAAoC;AACrF,QAAM,WAAW,IAAI,IAAI,MAAM,EAAE,SAAS,YAAY;AACtD,QAAM,qBAAqB,2BAA2B,YAAY,6BAA6B;AAC/F,QAAM,qBAAqB,CAAC,YAAY,YAAY,YAAY,iBAAiB,EAC9E,IAAI,0BAA0B,EAC9B,OAAO,CAAC,SAAyB,SAAS,UAAa,SAAS,kBAAkB;AACrF,MAAI,mBAAmB,SAAS,QAAQ,GAAG;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAGO,SAAS,oBAAoB,UAAsC,CAAC,GAAW;AACpF,QAAM,cAAc,QAAQ,eAAe,mBAAmB;AAC9D,MAAI,YAAY,sBAAsB,QAAW;AAC/C,UAAM,SAAS,2BAA2B,YAAY,iBAAiB;AACvE,8BAA0B,QAAQ,WAAW;AAC7C,WAAO;AAAA,EACT;AAEA,MAAI,YAAY,eAAe,gBAAgB,YAAY,+BAA+B;AACxF,UAAM,QAAQ,YAAY;AAC1B,UAAM,SAAS,2BAA2B,MAAM,SAAS,KAAK,IAAI,QAAQ,WAAW,KAAK,EAAE;AAC5F,8BAA0B,QAAQ,WAAW;AAC7C,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,YAAY,aAAa,gBAAgB,YAAY,eAAe;AACvF,MAAI,CAAC,cAAc,QAAQ,wBAAwB,QAAW;AAC5D,UAAM,SAAS,2BAA2B,QAAQ,mBAAmB;AACrE,8BAA0B,QAAQ,WAAW;AAC7C,WAAO;AAAA,EACT;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,wBAAyC;AACvD,SAAO,mBAAmB;AAC5B;;;ADvGA,IAAM,sBAAsB;AAC5B,IAAM,sCAAsC,KAAK;AACjD,IAAM,uBAAuB;AAC7B,IAAM,gCAAgC;AACtC,IAAM,4BAA4B;AAClC,IAAM,oBAAoB;AAC1B,IAAM,uCAAuC;AAC7C,IAAM,8BAA8B;AACpC,IAAM,gBAAgB;AACtB,IAAM,uBAAuB;AACtB,IAAM,0BAA0B;AA+GvC,IAAM,YAAN,MAAgB;AAAA,EAId,YAA6B,SAAiB;AAAjB;AAAA,EAAkB;AAAA,EAAlB;AAAA,EAHrB,SAAS;AAAA,EACA,UAA6B,CAAC;AAAA,EAI/C,MAAM,IAAO,MAAoC;AAC/C,QAAI,KAAK,UAAU,KAAK,QAAS,OAAM,IAAI,QAAc,CAAC,YAAY,KAAK,QAAQ,KAAK,OAAO,CAAC;AAChG,SAAK;AACL,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK;AACL,WAAK,QAAQ,MAAM,IAAI;AAAA,IACzB;AAAA,EACF;AACF;AAgBO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EAC1C;AAAA,EAET,YAAY,WAAmB,UAAU,eAAe;AACtD;AAAA,MACE,8EAA8E,SAAS,+BAA+B,OAAO;AAAA,IAC/H;AACA,SAAK,OAAO;AACZ,SAAK,YAAY;AAAA,EACnB;AACF;AAEA,SAAS,kBAAkB,OAA+C;AACxE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,KAAK;AAAA,EAC3B,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MACE,CAAC,MAAM,QAAQ,MAAM,KAClB,OAAO,KAAK,CAAC,SACd,CAAC,QACE,OAAO,SAAS,YAChB,MAAM,QAAQ,IAAI,KAClB,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC,QAAQ,QAAQ,SAAS,QAAQ,KAAK,KAC9D,OAAQ,KAAiC,QAAQ,YACjD,OAAQ,KAAiC,QAAQ,QACrD,GACD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,kCAAkC,aAA2D;AAC1G,QAAM,MAAM,YAAY;AACxB,QAAM,MAAM,YAAY;AACxB,MAAI,CAAC,OAAO,CAAC,KAAK;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACF,WAAO,MAAM,yBAAyB;AAAA,MACpC,YAAY,EAAE,KAAK,IAAI;AAAA,MACvB,cAAc,kBAAkB,YAAY,iCAAiC;AAAA,MAC7E,2BAA2B;AAAA,IAC7B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA2B,OAAM;AACtD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,cACd,QACA,eAAgD,CAAC,GAC7B;AACpB,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO,mBAAmB,YAAY;AACxF,UAAM,IAAI,0BAA0B,kBAAkB,qCAAqC;AAAA,EAC7F;AACA,QAAM,mBAAmB,OAAO,4BAA4B;AAC5D,MAAI,CAAC,OAAO,UAAU,gBAAgB,KAAK,mBAAmB,MAAM,mBAAmB,IAAI,KAAK,KAAK,IAAI;AACvG,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MACE,OAAO,eAAe,WAEpB,CAAC,OAAO,cACL,OAAO,OAAO,eAAe,YAC7B,OAAO,OAAO,WAAW,gBAAgB,cACzC,OAAO,OAAO,WAAW,kBAAkB,aAEhD;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,oBAAoB,OAAO,qBAAqB;AACtD,MAAI,CAAC,OAAO,UAAU,iBAAiB,KAAK,oBAAoB,KAAK,oBAAoB,IAAI,KAAK,KAAO;AACvG,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,cAAc,UAAa,OAAO,OAAO,cAAc,YAAY;AAC5E,UAAM,IAAI,0BAA0B,kBAAkB,8BAA8B;AAAA,EACtF;AACA,QAAM,cAAc,OAAO,eAAe,sBAAsB;AAChE,QAAM,aAAa,OAAO,cAAc,YAAY,eAAe;AACnE,QAAM,SAAS,IAAI,WAAW;AAAA,IAC5B,QAAQ;AAAA,IACR,gBAAgB,OAAO;AAAA,IACvB,GAAI,OAAO,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM;AAAA,EAC9D,CAAC;AACD,MAAI;AACJ,MAAI;AACJ,SAAO;AAAA,IACL,GAAI,OAAO,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,OAAO,UAAU;AAAA,IACxE,mBAAmB,IAAI,UAAU,oBAAoB;AAAA,IACrD;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,OAAO,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,OAAO,WAAW;AAAA,IAC3E;AAAA,IACA,KAAK,aAAa,OAAO,KAAK;AAAA,IAC9B,GAAI,OAAO,iBAAiB,SAAY,CAAC,IAAI,EAAE,sBAAsB,OAAO,aAAa;AAAA,IACzF,QAAQ;AACN,uBAAiB,OAAO,qBACpB,QAAQ,QAAQ,OAAO,kBAAkB,IACzC,kCAAkC,WAAW;AACjD,aAAO;AAAA,IACT;AAAA,IACA,WAAW;AACT,mBAAa,sBAAsB;AAAA,QACjC;AAAA,QACA,wBAAwB;AAAA,QACxB,KAAK,aAAa,OAAO,KAAK;AAAA,QAC9B,GAAI,OAAO,iBAAiB,SAAY,CAAC,IAAI,EAAE,OAAO,OAAO,aAAa;AAAA,QAC1E,GAAI,OAAO,eAAe,SAAY,CAAC,IAAI,EAAE,aAAa,OAAO,WAAW,YAAY;AAAA,MAC1F,CAAC;AACD,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,SAAmC;AAC5D,MAAI,QAAQ,YAAY,kBAAkB,QAAQ,kBAAkB,KAAM,QAAO;AACjF,QAAM,YAAY,QAAQ,SAAS,IAAI,CAAC,WAAW,OAAO,EAAE,KAAK,CAAC;AAClE,SAAO,UAAU,WAAW,KAAK,UAAU,SAAS,SAAS,KAAK,UAAU,SAAS,MAAM;AAC7F;AAEA,SAAS,iBAAiB,OAA2B;AACnD,MAAI,SAAS;AACb,aAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,QAAQ,EAAE;AAChF;AAEA,eAAsB,yBAAyB,WAAmB,WAAoC;AACpG,QAAM,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,CAAC,eAAe,WAAW,SAAS,CAAC,CAAC;AAC/F,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ;AAC7D,SAAO,eAAe,iBAAiB,IAAI,WAAW,MAAM,CAAC,CAAC;AAChE;AAEA,eAAe,iBACb,SACA,SACA,SACA,SACe;AACf,MAAI,CAAC,kBAAkB,OAAO,GAAG;AAC/B,UAAM,IAAI,0BAA0B,QAAQ,WAAW,QAAQ,OAAO;AAAA,EACxE;AACA,QAAM,uBAAuB,QAAQ,MAAM;AAC3C,MAAI,CAAC,wBAAwB,CAAC,QAAQ,MAAM,QAAQ;AAClD,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,kBAAkB,QAAQ,MAAM,mBAAmB,QAAQ,SAAS;AACxE,MAAI,CAAC,iBAAiB;AACpB,UAAM,MAAM,QAAQ,IAAI;AACxB,UAAM,oBAAoB,IAAI,KAAK,MAAM,QAAQ,mBAAmB,GAAK,EAAE,YAAY;AACvF,UAAM,iBAAiB,IAAI;AAAA,MACzB,OAAO,QAAQ,mBAAmB,sCAAsC;AAAA,IAC1E,EAAE,YAAY;AACd,UAAM,QAAQ,MAAM,QAAQ,MAAM;AAClC,UAAM,QAAQ,MAAM,MAAM,KAAK;AAAA,MAC7B,SAAS;AAAA,MACT;AAAA,MACA,WAAW,QAAQ;AAAA,MACnB,WAAW,QAAQ,QAAQ;AAAA,MAC3B,WAAW;AAAA,IACb,GAAqC,EAAE,kBAAkB,CAAC;AAC1D,sBAAkB,EAAE,OAAO,kBAAkB;AAC7C,YAAQ,MAAM,qBAAqB,CAAC;AACpC,YAAQ,MAAM,iBAAiB,QAAQ,SAAS,IAAI;AAAA,EACtD;AACA,QAAM,eAAe,oBAAoB;AAAA,IACvC,aAAa,QAAQ;AAAA,IACrB,GAAI,QAAQ,yBAAyB,SACjC,CAAC,IACD,EAAE,qBAAqB,QAAQ,qBAAqB;AAAA,EAC1D,CAAC;AACD,QAAM,iBAAiB,MAAM,yBAAyB,QAAQ,QAAQ,IAAI,QAAQ,SAAS;AAC3F,QAAM,cAAc,MAAM,sBAAsB,SAAS,SAAS,SAAS,SAAS,cAAc;AAClG,QAAM,QAAQ,OAAO,UAAU,QAAQ;AAAA,IACrC,QAAQ,QAAQ;AAAA,IAChB,aAAa,QAAQ;AAAA,IACrB,kBAAkB,QAAQ;AAAA,IAC1B,GAAI,QAAQ,MAAM,OAAO,eAAe,SACpC,CAAC,IACD,EAAE,qBAAqB,QAAQ,MAAM,OAAO,WAAW;AAAA,IAC3D,UAAU;AAAA,MACR,KAAK,GAAG,YAAY,GAAG,kBAAkB;AAAA,MACzC,OAAO,gBAAgB;AAAA,IACzB;AAAA,IACA,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,EACrD,GAAG,EAAE,eAAe,CAAC;AACvB;AAEA,eAAe,sBACb,SACA,SACA,SACA,SACA,gBAC+B;AAC/B,MAAI,CAAC,QAAQ,UAAW,QAAO;AAC/B,MAAI,CAAC,QAAQ,WAAW,CAAC,QAAQ,YAAY;AAC3C,UAAM,IAAI,0BAA0B,kBAAkB,+CAA+C;AAAA,EACvG;AACA,QAAM,UAAU,QAAQ;AACxB,QAAM,aAAa,QAAQ;AAC3B,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,UAAU,WAAW,MAAM,WAAW,MAAM,IAAI,MAAM,qCAAqC,CAAC,GAAG,QAAQ,iBAAiB;AAC9H,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK;AAAA,MACxB,QAAQ,kBAAkB,IAAI,YAAY;AACxC,cAAM,YAAY,MAAM,QAAQ,UAAW;AAAA,UACzC;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ,WAAW;AAAA,QACrB,CAAC;AACD,YAAI,WAAW,OAAO,QAAS,OAAM,WAAW,OAAO;AACvD,YAAI,aAAa,QAAQ,UAAU,WAAW,EAAG,QAAO;AACxD,YAAI,CAAC,MAAM,QAAQ,SAAS,KAAK,UAAU,SAAS,eAAe;AACjE,gBAAM,IAAI,0BAA0B,kBAAkB,wCAAwC;AAAA,QAChG;AACA,cAAM,MAAgB,CAAC;AACvB,mBAAW,CAAC,SAAS,QAAQ,KAAK,UAAU,QAAQ,GAAG;AACrD,cAAI,WAAW,OAAO,QAAS,OAAM,WAAW,OAAO;AACvD,gBAAM,SAAS,MAAM,QAAQ,OAAO;AAAA,YAClC;AAAA,YACA;AAAA,YACA,SAAS;AAAA,YACT,SAAS;AAAA,YACT,SAAS;AAAA,YACT;AAAA,cACE,QAAQ,WAAW;AAAA,cACnB,GAAI,SAAS,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,SAAS,KAAK;AAAA,YAC/D;AAAA,UACF;AACA,cAAI,KAAK,OAAO,EAAE;AAAA,QACpB;AACA,eAAO;AAAA,MACT,CAAC;AAAA,MACD,IAAI,QAAe,CAAC,GAAG,WAAW;AAChC,mBAAW,OAAO,iBAAiB,SAAS,MAAM,OAAO,WAAW,OAAO,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,MACpG,CAAC;AAAA,IACH,CAAC;AAAA,EACH,UAAE;AACA,iBAAa,OAAO;AAAA,EACtB;AACF;AAEO,SAAS,4BAA4B,SAA6B;AACvE,SAAO,OAAO,MAAwB,SAA2B,YAA6C;AAC5G,UAAM,UAAU,MAAM,QAAQ;AAAA,MAC5B,KAAK,SAAS,IAAI,CAAC,YAAY,iBAAiB,SAAS,SAAS,SAAS,OAAO,CAAC;AAAA,IACrF;AACA,UAAM,WAAW,QACd,OAAO,CAAC,WAA4C,OAAO,WAAW,UAAU,EAChF,IAAI,CAAC,WAAW,OAAO,MAAM;AAChC,QAAI,SAAS,OAAQ,OAAM,IAAI,eAAe,UAAU,2CAA2C;AAAA,EACrG;AACF;AAEA,SAAS,gBAAgB,QAAgB,SAA2B;AAClE,SAAO,SAAS,KAAK,EAAE,OAAO,QAAQ,GAAG;AAAA,IACvC;AAAA,IACA,SAAS,EAAE,iBAAiB,WAAW;AAAA,EACzC,CAAC;AACH;AAEA,eAAsB,iBAAiB,SAAmC;AACxE,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,gBAAgB;AAC1D,MACE,kBAAkB,SACd,CAAC,QAAQ,KAAK,aAAa,KAAK,OAAO,aAAa,IAAI,yBAC5D,OAAM,IAAI,MAAM,0BAA0B;AAC5C,MAAI,CAAC,QAAQ,KAAM,QAAO;AAE1B,QAAM,SAAS,QAAQ,KAAK,UAAU;AACtC,QAAM,SAAuB,CAAC;AAC9B,MAAI,SAAS;AACb,MAAI;AACF,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,gBAAU,MAAM;AAChB,UAAI,SAAS,yBAAyB;AACpC,cAAM,OAAO,OAAO;AACpB,cAAM,IAAI,MAAM,0BAA0B;AAAA,MAC5C;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACA,QAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,UAAM,IAAI,OAAO,MAAM;AACvB,cAAU,MAAM;AAAA,EAClB;AACA,MAAI;AACF,WAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAAA,EAC/D,QAAQ;AACN,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AACF;AAEA,SAAS,mBAAmB,OAAgB,eAAwC;AAClF,SAAO,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU;AAC1E;AAEA,SAAS,uBAAuB,OAAgB,aAA8C;AAC5F,MACE,CAAC,SACE,OAAO,UAAU,YACjB,MAAM,QAAQ,KAAK,KACnB,OAAO,KAAK,KAAK,EAAE,WAAW,KAC7B,MAAkC,YAAY,KAC/C,CAAC;AAAA,IACD,MAAkC;AAAA,IACnC;AAAA,EACF,KACG,CAAC,mBAAoB,MAAkC,WAAW,yBAAyB,KAC3F,CAAC,mBAAoB,MAAkC,WAAW,yBAAyB,KAC3F,CAAC,mBAAoB,MAAkC,WAAW,iBAAiB,EACtF,OAAM,IAAI,mBAAmB,eAAe;AAC9C,QAAM,QAAQ;AACd,QAAM,YAAY,KAAK,MAAM,MAAM,SAAS;AAC5C,MAAI,CAAC,OAAO,SAAS,SAAS,EAAG,OAAM,IAAI,mBAAmB,eAAe;AAC7E,MAAI,aAAa,YAAa,OAAM,IAAI,mBAAmB,SAAS;AACpE,SAAO;AACT;AAEA,eAAe,mBACb,YACA,WACA,WACkB;AAClB,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,WAAW,SAAS,EAAE,eAAe;AAC1D,UAAM,SAAS,OAAO,UAAU;AAChC,QAAI;AACF,YAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,aAAO,MAAM;AACX,cAAM,YAAY,WAAW,KAAK,IAAI;AACtC,YAAI,aAAa,GAAG;AAClB,gBAAM,OAAO,OAAO;AACpB,iBAAO;AAAA,QACT;AACA,YAAI;AACJ,cAAM,SAAS,MAAM,QAAQ,KAAK;AAAA,UAChC,OAAO,KAAK;AAAA,UACZ,IAAI,QAAc,CAAC,YAAY;AAC7B,sBAAU,WAAW,MAAM,QAAQ,IAAI,GAAG,SAAS;AAAA,UACrD,CAAC;AAAA,QACH,CAAC,EAAE,QAAQ,MAAM,aAAa,OAAO,CAAC;AACtC,YAAI,WAAW,MAAM;AACnB,gBAAM,OAAO,OAAO;AACpB,iBAAO;AAAA,QACT;AACA,cAAM,EAAE,MAAM,MAAM,IAAI;AACxB,YAAI,KAAM,QAAO;AACjB,YAAI,MAAM,SAAS,mBAAmB;AACpC,gBAAM,UAAU,MAAM,KAAK,SAAS,KAAK,CAAC,cAAc,UAAU,cAAc,SAAS;AACzF,cAAI,SAAS,OAAO,SAAS,YAAa,UAAS,QAAQ,OAAO;AAAA,QACpE,WACE,WAAW,UACR,MAAM,SAAS,mBACf,MAAM,KAAK,OAAO,SAAS,iBAC3B,MAAM,KAAK,OAAO,WAAW,QAChC;AACA,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF,UAAE;AACA,aAAO,YAAY;AAAA,IACrB;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,cAAc,SAAiB,SAA+C;AAC3F,MAAI,CAAC,QAAQ,WAAY,QAAO;AAChC,MAAI;AACF,UAAM,QAAQ,WAAW,cAAc,OAAO;AAC9C,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,SAAiB,SAA+C;AAC9F,MAAI,CAAC,QAAQ,WAAY,QAAO;AAChC,MAAI;AACF,WAAO,MAAM,QAAQ,WAAW,YAAY,OAAO,MAAM;AAAA,EAC3D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,8BAA8B,SAA6B;AACzE,SAAO,OACL,SACA,SACsB;AACtB,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,iBAAiB,OAAO;AAAA,IACvC,QAAQ;AACN,aAAO,gBAAgB,KAAK,0BAA0B;AAAA,IACxD;AAEA,QAAI;AACJ,QAAI;AACF,qBAAe,MAAM,QAAQ,SAAS,EAAE,OAAO;AAAA,QAC7C;AAAA,QACA,WAAW,QAAQ,QAAQ,IAAI,qBAAqB;AAAA,MACtD,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,iBAAiB,2BAA2B;AAC9C,eAAO,gBAAgB,KAAK,kDAAkD;AAAA,MAChF;AACA,UACE,iBAAiB,6BACb,MAAM,SAAS,yBAAyB,MAAM,SAAS,0BAC3D,QAAO,gBAAgB,KAAK,kDAAkD;AAChF,aAAO,gBAAgB,KAAK,8BAA8B;AAAA,IAC5D;AACA,QAAI,aAAa,WAAW;AAC1B,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAAC;AAAA,IACrF;AAEA,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,QAAQ,MAAM;AAAA,IAC9B,QAAQ;AACN,aAAO,gBAAgB,KAAK,oDAAoD;AAAA,IAClF;AACA,QAAI;AACF,cAAQ;AAAA,QACN,MAAM,MAAM,KAAc,aAAa,MAAM,KAAK;AAAA,QAClD,QAAQ,IAAI;AAAA,MACd;AAAA,IACF,QAAQ;AACN,aAAO,gBAAgB,KAAK,2BAA2B;AAAA,IACzD;AAEA,UAAM,WAAW,aAAa,MAAM,WAAW,aAAa,YAAY;AACxE,QAAI;AACF,YAAM,UAAU,MAAM,KAAK,KAAK;AAAA,QAC9B,gBAAgB,CAAC,EAAE,WAAW,MAAM,WAAW,SAAS,CAAC;AAAA,MAC3D,GAAG;AAAA,QACD,MAAM;AAAA,QACN,mBAAmB,MAAM;AAAA,QACzB,OAAO,EAAE,sBAAsB,MAAM,sBAAsB,QAAQ,KAAK;AAAA,MAC1E,CAAC;AACD,UAAI,QAAQ,OAAO,MAAM,UAAW,OAAM,IAAI,MAAM,yBAAyB;AAAA,IAC/E,QAAQ;AACN,UAAI,MAAM,iBAAiB,aAAa,MAAM,IAAI,OAAO,GAAG;AAC1D,eAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAAC;AAAA,MACrF;AACA,UAAI,CAAC,MAAM,mBAAmB,KAAK,YAAY,MAAM,WAAW,MAAM,SAAS,GAAG;AAChF,eAAO,gBAAgB,KAAK,wCAAwC;AAAA,MACtE;AACA,UAAI,CAAC,MAAM,cAAc,aAAa,MAAM,IAAI,OAAO,GAAG;AACxD,eAAO,gBAAgB,KAAK,qDAAqD;AAAA,MACnF;AACA,aAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAAC;AAAA,IACrF;AAEA,QAAI,CAAC,MAAM,cAAc,aAAa,MAAM,IAAI,OAAO,GAAG;AACxD,aAAO,gBAAgB,KAAK,qDAAqD;AAAA,IACnF;AACA,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAAC;AAAA,EACrF;AACF;AAEA,SAAS,6BAAqC;AAC5C,MAAI,CAAC,WAAW,UAAU,OAAO,WAAW,OAAO,eAAe,YAAY;AAC5E,UAAM,IAAI,0BAA0B,kBAAkB,2DAA2D;AAAA,EACnH;AAGA,SAAO,QAAQ,WAAW,OAAO,WAAW,CAAC;AAC/C;AAEO,SAAS,YAAY,QAAyE;AACnG,QAAM,UAAU,cAAc,MAAM;AACpC,QAAM,iBAAiB,4BAA4B,OAAO;AAI1D,SAAO,cAAuE;AAAA,IAC5E,UAAU;AAAA,IACV,OAAO,EAAE,sBAAsB,MAAM,QAAQ,MAAM,kBAAkB,CAAC,EAAE;AAAA,IACxE,QAAQ,OAAO,SAAS;AACtB,aAAO;AAAA,QACL;AAAA,QACA,SAAS,EAAE,IAAI,QAAQ,IAAI,mBAAmB,QAAQ,mBAAmB,MAAM,QAAQ,KAAK;AAAA,MAC9F;AAAA,IACF;AAAA,IACA,QAAQ,CAAC,KAAuB,oBAAoB,8BAA8B,OAAO,CAAC,CAAC;AAAA,IAC3F,MAAM,QAAQ,OAAO,EAAE,KAAK,GAAG;AAC7B,YAAM,aAAa,MAAM,OAAO;AAChC,UAAI,eAAe,UAAa,CAAC,qBAAqB,KAAK,UAAU,GAAG;AACtE,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,YAAM,uBAAuB,2BAA2B;AACxD,YAAM,SAAS,eAAe,SAAY,CAAC,IAAI,EAAE,WAAW;AAC5D,aAAO,KAAK,MAAM,SAAS;AAAA,QACzB,MAAM,MAAM;AAAA,QACZ,mBAAmB;AAAA,QACnB,OAAO,EAAE,sBAAsB,QAAQ,kBAAkB,CAAC,EAAE;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,IACA,QAAQ,EAAE,mBAAmB,eAAe;AAAA,EAC9C,CAAC;AACH;","names":[]}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@mayiapp/eve",
+  "version": "0.1.0",
+  "description": "Durable Mayi approval channel for Eve agents",
+  "type": "module",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "sideEffects": false,
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/asiraky/mayi",
+    "directory": "packages/eve"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@mayiapp/sdk": "^0.1.0"
+  },
+  "peerDependencies": {
+    "eve": "0.24.2"
+  },
+  "devDependencies": {
+    "eve": "0.24.2",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.0",
+    "zod": "^4.4.3"
+  },
+  "scripts": {
+    "build": "tsup && node ./scripts/normalize-source-maps.mjs",
+    "test:harness": "cd test-fixtures/approval-harness && eve eval --skip-report --timeout 30000 --max-concurrency 1",
+    "test:package": "node ./scripts/test-package.mjs",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  }
+}