@opengeni/contracts 5.4.0-canary.36844267522001 → 5.4.0

package/dist/atlassian.js

@@ -17,20 +17,18 @@ import {
   AtlassianSyncCadence,
   SaveAtlassianSourcesRequest,
   atlassianScopesAllowRead
-} from "./chunk-WOE2F32M.js";
+} from "./chunk-U56WR2ES.js";
 import "./chunk-5IXYF6XN.js";
 import "./chunk-HHZSZYYF.js";
 import "./chunk-NRMCVHAU.js";
 import "./chunk-WYBDERIY.js";
 import "./chunk-P3HLDT77.js";
 import "./chunk-4JGHSSB7.js";
-import "./chunk-5Q54VCCH.js";
-import "./chunk-EK7NDGFR.js";
-import "./chunk-2CFJCZ6Q.js";
+import "./chunk-IABHGRIB.js";
 import "./chunk-NVJMJWLL.js";
 import "./chunk-SIOU2K4U.js";
 import "./chunk-YRKRZ6OF.js";
-import "./chunk-YBW5JSA3.js";
+import "./chunk-5Q54VCCH.js";
 import "./chunk-3SIZGL3O.js";
 import "./chunk-RIY7GYQS.js";
 import "./chunk-JUFK3T4Q.js";
@@ -43,6 +41,7 @@ import "./chunk-RKX3NQYS.js";
 import "./chunk-Y3KNXVTD.js";
 import "./chunk-TXTQIYCV.js";
 import "./chunk-PX3VCKAU.js";
+import "./chunk-YBW5JSA3.js";
 export {
   ATLASSIAN_CREDENTIAL_LABEL,
   ATLASSIAN_CREDENTIAL_ROLE,

package/dist/{chunk-2CFJCZ6Q.js → chunk-IABHGRIB.js}

@@ -5,10 +5,7 @@ var WORKSPACE_WEBHOOK_EVENT_TYPES = [
   "turn.cancelled",
   "session.status.changed",
   "session.requiresAction",
-  "session.humanInput.requested",
-  "usage.threshold_reached",
-  "usage.exhausted",
-  "usage.period_reset"
+  "session.humanInput.requested"
 ];
 var OPENGENI_SIGNATURE_HEADER = "OpenGeni-Signature";
 var OPENGENI_EVENT_ID_HEADER = "OpenGeni-Event-Id";
@@ -63,4 +60,4 @@ export {
   signOpenGeniPayload,
   verifyOpenGeniSignature
 };
-//# sourceMappingURL=chunk-2CFJCZ6Q.js.map
+//# sourceMappingURL=chunk-IABHGRIB.js.map

package/dist/chunk-IABHGRIB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/workspace-integration-wire.ts"],"sourcesContent":["/**\n * Dependency-free wire constants and the OpenGeni-Signature scheme shared by\n * workspace webhooks and credential providers. Kept free of zod so browser and\n * React Native bundles can verify signatures without the schema runtime.\n */\n\nexport const WORKSPACE_WEBHOOK_EVENT_TYPES = [\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.humanInput.requested\",\n] as const;\n\nexport const OPENGENI_SIGNATURE_HEADER = \"OpenGeni-Signature\";\nexport const OPENGENI_EVENT_ID_HEADER = \"OpenGeni-Event-Id\";\nexport const OPENGENI_DELIVERY_ID_HEADER = \"OpenGeni-Delivery-Id\";\nexport const OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;\n\nconst encoder = new TextEncoder();\n\nasync function hmacSha256Hex(secret: string, message: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, encoder.encode(message)));\n  return Array.from(signature, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction constantTimeEqualHex(left: string, right: string): boolean {\n  if (left.length !== right.length) return false;\n  let difference = 0;\n  for (let index = 0; index < left.length; index += 1) {\n    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);\n  }\n  return difference === 0;\n}\n\n/**\n * `OpenGeni-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, \"<t>.<body>\")>`.\n * The timestamp is signed so a captured request cannot be replayed later.\n */\nexport async function signOpenGeniPayload(\n  secret: string,\n  body: string,\n  timestampSeconds = Math.floor(Date.now() / 1000),\n): Promise<string> {\n  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;\n}\n\nexport type VerifyOpenGeniSignatureInput = {\n  secret: string;\n  /** The exact raw request body, before JSON parsing. */\n  body: string;\n  /** The `OpenGeni-Signature` header value. */\n  signature: string | null | undefined;\n  toleranceSeconds?: number;\n  nowSeconds?: number;\n};\n\nexport async function verifyOpenGeniSignature(\n  input: VerifyOpenGeniSignatureInput,\n): Promise<boolean> {\n  if (!input.signature) return false;\n  let timestamp: number | null = null;\n  const candidates: string[] = [];\n  for (const part of input.signature.split(\",\")) {\n    const [key, value] = part.trim().split(\"=\", 2);\n    if (key === \"t\" && value && /^\\d{1,12}$/.test(value)) timestamp = Number(value);\n    if (key === \"v1\" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);\n  }\n  if (timestamp === null || candidates.length === 0) return false;\n  const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;\n  if (Math.abs(now - timestamp) > tolerance) return false;\n  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);\n  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));\n}\n"],"mappings":";AAMO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,8BAA8B;AACpC,IAAM,uCAAuC;AAEpD,IAAM,UAAU,IAAI,YAAY;AAEhC,eAAe,cAAc,QAAgB,SAAkC;AAC7E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,OAAO,CAAC,CAAC;AAC/F,SAAO,MAAM,KAAK,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACpF;AAEA,SAAS,qBAAqB,MAAc,OAAwB;AAClE,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,kBAAc,KAAK,WAAW,KAAK,IAAI,MAAM,WAAW,KAAK;AAAA,EAC/D;AACA,SAAO,eAAe;AACxB;AAMA,eAAsB,oBACpB,QACA,MACA,mBAAmB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC9B;AACjB,SAAO,KAAK,gBAAgB,OAAO,MAAM,cAAc,QAAQ,GAAG,gBAAgB,IAAI,IAAI,EAAE,CAAC;AAC/F;AAYA,eAAsB,wBACpB,OACkB;AAClB,MAAI,CAAC,MAAM,UAAW,QAAO;AAC7B,MAAI,YAA2B;AAC/B,QAAM,aAAuB,CAAC;AAC9B,aAAW,QAAQ,MAAM,UAAU,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE,MAAM,KAAK,CAAC;AAC7C,QAAI,QAAQ,OAAO,SAAS,aAAa,KAAK,KAAK,EAAG,aAAY,OAAO,KAAK;AAC9E,QAAI,QAAQ,QAAQ,SAAS,iBAAiB,KAAK,KAAK,EAAG,YAAW,KAAK,KAAK;AAAA,EAClF;AACA,MAAI,cAAc,QAAQ,WAAW,WAAW,EAAG,QAAO;AAC1D,QAAM,MAAM,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5D,QAAM,YAAY,MAAM,oBAAoB;AAC5C,MAAI,KAAK,IAAI,MAAM,SAAS,IAAI,UAAW,QAAO;AAClD,QAAM,WAAW,MAAM,cAAc,MAAM,QAAQ,GAAG,SAAS,IAAI,MAAM,IAAI,EAAE;AAC/E,SAAO,WAAW,KAAK,CAAC,cAAc,qBAAqB,WAAW,QAAQ,CAAC;AACjF;","names":[]}

package/dist/{chunk-PAX4LXRZ.js → chunk-RSYFTR5M.js}

@@ -1,7 +1,7 @@
 import {
   ConnectionKind,
   SessionTenancyVisibility
-} from "./chunk-WOE2F32M.js";
+} from "./chunk-U56WR2ES.js";
 
 // src/connection-authority.ts
 import { z } from "zod";
@@ -183,4 +183,4 @@ export {
   ConnectionUseAuditFact,
   ConnectionUseAuthorizationResult
 };
-//# sourceMappingURL=chunk-PAX4LXRZ.js.map
+//# sourceMappingURL=chunk-RSYFTR5M.js.map