@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/chunk-2WOWEWXV.js

@@ -0,0 +1,426 @@
+import {
+  VAULT_LIMITS,
+  VaultFieldKind,
+  VaultItemCategory,
+  VaultItemType,
+  VaultProviderOperations,
+  isReservedVaultFieldName,
+  isValidSecretName
+} from "./chunk-G4RKARXZ.js";
+import {
+  boolean,
+  dateTime,
+  nonEmptyString,
+  string,
+  uuid
+} from "./chunk-AQYDZUJV.js";
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/vault-provider-wire.ts
+import { z } from "zod";
+var VAULT_PROVIDER_WIRE_VERSION = "opengeni.vault.v1";
+var VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER = "OpenGeni-Vault-Response-Signature";
+function vaultProviderWireResponseKey(signingSecret) {
+  return `${signingSecret}\0${VAULT_PROVIDER_WIRE_VERSION}.response`;
+}
+var VAULT_PROVIDER_WIRE_LIMITS = {
+  maxRequestBytes: 4 * 1024 * 1024,
+  maxResponseBytes: 4 * 1024 * 1024,
+  /** Sum of returned secret value bytes in one read. */
+  maxReadValueBytes: 3 * 1024 * 1024,
+  pageSizeMax: 100,
+  cursorMaxChars: 1024,
+  snapshotMaxChars: 1024,
+  externalIdMaxChars: 300,
+  vaultNameMaxChars: 300,
+  nativeIdMaxChars: 200,
+  readFieldsMax: VAULT_LIMITS.fieldsPerItem,
+  idempotencyKeyMaxChars: 200,
+  accountIdMaxChars: 300,
+  accountNameMaxChars: 300,
+  versionMaxChars: 300,
+  cacheEpochMaxChars: 200,
+  /** Per request deadline enforced by Opengeni's transport. */
+  defaultTimeoutMs: 15e3,
+  maxTimeoutMs: 6e4,
+  /** Accepted request age; matches `OPENGENI_SIGNATURE_TOLERANCE_SECONDS`. */
+  signatureToleranceSeconds: 300
+};
+var VAULT_PROVIDER_WIRE_ERROR_CODES = [
+  "provider_auth_invalid",
+  "provider_auth_expired",
+  "provider_rate_limited",
+  "provider_unavailable",
+  "provider_conflict",
+  "provider_not_found",
+  "provider_permission_denied",
+  "provider_locked",
+  "provider_inventory_incomplete",
+  "provider_outcome_unknown"
+];
+var VAULT_PROVIDER_WIRE_OPERATIONS = [
+  "describe",
+  "refresh",
+  "list_vaults",
+  "list_items",
+  "read_fields",
+  "write_item",
+  "archive_item"
+];
+function isVaultProviderWireMutation(op) {
+  return op === "write_item" || op === "archive_item";
+}
+var VaultProviderWireProvider = /* @__PURE__ */ defineSchema(() => z.enum(["external"]));
+var CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f]/;
+var encoder = /* @__PURE__ */ new TextEncoder();
+function vaultProviderWireUtf8Bytes(value) {
+  return encoder.encode(value).byteLength;
+}
+function boundedText(max) {
+  return nonEmptyString.max(max).refine((value) => !CONTROL_CHARACTERS.test(value), "control characters are not allowed");
+}
+var ExternalId = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.externalIdMaxChars)
+);
+var NativeId = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.nativeIdMaxChars)
+);
+var ItemName = /* @__PURE__ */ defineSchema(
+  () => string.refine(isValidSecretName, "invalid_secret_name")
+);
+var FieldName = /* @__PURE__ */ defineSchema(
+  () => string.refine(
+    (name) => isValidSecretName(name) && !isReservedVaultFieldName(name),
+    "invalid_secret_name"
+  )
+);
+var Website = /* @__PURE__ */ defineSchema(() => boundedText(VAULT_LIMITS.websiteMaxChars));
+var Version = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.versionMaxChars)
+);
+var Cursor = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.cursorMaxChars)
+);
+var Snapshot = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.snapshotMaxChars)
+);
+var IdempotencyKey = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.idempotencyKeyMaxChars)
+);
+var CacheEpoch = /* @__PURE__ */ defineSchema(
+  () => boundedText(VAULT_PROVIDER_WIRE_LIMITS.cacheEpochMaxChars).nullable()
+);
+function uniqueBy(values, key) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values) {
+    const k = key(value);
+    if (seen.has(k)) return false;
+    seen.add(k);
+  }
+  return true;
+}
+function vaultProviderWireNameKey(name) {
+  return name.normalize("NFC").trim().toLowerCase();
+}
+var VaultProviderWireAuthority = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    accountId: NativeId,
+    workspaceId: NativeId,
+    /** Null for workspace-level background work with no acting human. */
+    subjectId: NativeId.nullable(),
+    /** Workspace that owns the encrypted connection (may differ from the caller). */
+    connectionWorkspaceId: NativeId,
+    sessionId: NativeId.optional(),
+    turnId: NativeId.optional(),
+    attemptId: NativeId.optional(),
+    siteId: NativeId.optional()
+  }).strict()
+);
+var VaultProviderWirePage = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    limit: z.number().int().min(1).max(VAULT_PROVIDER_WIRE_LIMITS.pageSizeMax),
+    cursor: Cursor.optional(),
+    snapshot: Snapshot.optional()
+  }).strict()
+);
+var VaultProviderWireWriteField = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    externalFieldId: ExternalId.optional(),
+    name: FieldName,
+    kind: VaultFieldKind,
+    /** Omitted on an update: keep the current value. */
+    value: string.refine(
+      (value) => vaultProviderWireUtf8Bytes(value) <= VAULT_LIMITS.textValueMaxBytes,
+      "secret_value_too_large"
+    ).optional(),
+    remove: z.literal(true).optional()
+  }).strict().refine((field) => !(field.remove && field.value !== void 0), "remove carries no value").refine((field) => !(field.remove && !field.externalFieldId), "remove needs a field id").refine(
+    (field) => !(field.kind === "file" && field.value !== void 0),
+    "file writes are not supported"
+  )
+);
+var VaultProviderWireWriteItem = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    externalItemId: ExternalId.optional(),
+    expectedVersion: Version.nullable().optional(),
+    name: ItemName,
+    type: VaultItemType.refine((type) => type !== "passkey", "passkeys are hosted only"),
+    category: VaultItemCategory.nullable().optional(),
+    websites: z.array(Website).max(VAULT_LIMITS.websitesPerItem),
+    fields: z.array(VaultProviderWireWriteField).max(VAULT_LIMITS.fieldsPerItem)
+  }).strict().refine(
+    (item) => uniqueBy(
+      item.fields.filter((field) => !field.remove),
+      (field) => vaultProviderWireNameKey(field.name)
+    ) && uniqueBy(
+      item.fields.filter((field) => field.externalFieldId !== void 0),
+      (field) => field.externalFieldId
+    ),
+    "duplicate fields"
+  )
+);
+var ReadContext = {
+  /** Recheck upstream; never bypasses authorization or upstream rate limits. */
+  forceRefresh: boolean,
+  /** Opengeni's mirror freshness epoch, for receiver-side cache invalidation. */
+  cacheEpoch: CacheEpoch
+};
+var VaultProviderWireOperation = /* @__PURE__ */ defineSchema(
+  () => z.discriminatedUnion("op", [
+    z.object({ op: z.literal("describe") }).strict(),
+    z.object({ op: z.literal("refresh") }).strict(),
+    z.object({ op: z.literal("list_vaults"), page: VaultProviderWirePage, ...ReadContext }).strict(),
+    z.object({
+      op: z.literal("list_items"),
+      externalVaultId: ExternalId,
+      page: VaultProviderWirePage,
+      ...ReadContext
+    }).strict(),
+    z.object({
+      op: z.literal("read_fields"),
+      externalVaultId: ExternalId,
+      externalItemId: ExternalId,
+      externalFieldIds: z.array(ExternalId).min(1).max(VAULT_PROVIDER_WIRE_LIMITS.readFieldsMax).refine((ids) => new Set(ids).size === ids.length, "duplicate field ids"),
+      ...ReadContext
+    }).strict(),
+    z.object({
+      op: z.literal("write_item"),
+      externalVaultId: ExternalId,
+      item: VaultProviderWireWriteItem,
+      idempotencyKey: IdempotencyKey
+    }).strict(),
+    z.object({
+      op: z.literal("archive_item"),
+      externalVaultId: ExternalId,
+      externalItemId: ExternalId,
+      idempotencyKey: IdempotencyKey
+    }).strict()
+  ])
+);
+var VaultProviderWireRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    version: z.literal(VAULT_PROVIDER_WIRE_VERSION),
+    type: z.literal("request"),
+    requestId: uuid,
+    sentAt: dateTime,
+    provider: VaultProviderWireProvider,
+    connectionId: uuid,
+    authority: VaultProviderWireAuthority,
+    operation: VaultProviderWireOperation
+  }).strict()
+);
+var VaultProviderWireErrorCode = /* @__PURE__ */ defineSchema(
+  () => z.enum(VAULT_PROVIDER_WIRE_ERROR_CODES)
+);
+var VaultProviderWireFreshness = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    state: z.enum(["current", "stale", "refreshing", "unavailable"]),
+    /** When the receiver last synchronized with its upstream store. */
+    sourceSyncedAt: z.string().datetime().nullable(),
+    source: z.enum(["live", "cache", "unknown"]),
+    errorCode: VaultProviderWireErrorCode.nullable(),
+    retryAt: z.string().datetime().nullable()
+  }).strict()
+);
+var VaultProviderWireVault = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    externalVaultId: ExternalId,
+    name: boundedText(VAULT_PROVIDER_WIRE_LIMITS.vaultNameMaxChars),
+    contentVersion: Version.nullable(),
+    itemCount: z.number().int().nonnegative().nullable(),
+    writeAccess: z.enum(["read_only", "read_write", "unknown"]),
+    /** Narrows the connection operations for this vault; never widens them. */
+    operations: VaultProviderOperations.optional()
+  }).strict()
+);
+var VaultProviderWireFieldMeta = /* @__PURE__ */ defineSchema(
+  () => z.object({ externalFieldId: ExternalId, name: FieldName, kind: VaultFieldKind }).strict()
+);
+var VaultProviderWireItemMeta = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    externalItemId: ExternalId,
+    name: ItemName,
+    type: VaultItemType,
+    username: z.string().max(VAULT_LIMITS.usernameMaxChars).nullable().optional(),
+    category: VaultItemCategory.nullable().optional(),
+    websites: z.array(Website).max(VAULT_LIMITS.websitesPerItem),
+    fields: z.array(VaultProviderWireFieldMeta).max(VAULT_LIMITS.fieldsPerItem).refine(
+      (fields) => uniqueBy(fields, (field) => field.externalFieldId) && uniqueBy(fields, (field) => vaultProviderWireNameKey(field.name)),
+      "duplicate fields"
+    ),
+    version: Version.nullable(),
+    updatedAt: z.string().datetime().nullable()
+  }).strict()
+);
+var BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+var VaultProviderWireFieldValue = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    externalFieldId: ExternalId,
+    value: z.discriminatedUnion("type", [
+      z.object({
+        type: z.literal("text"),
+        value: string.refine(
+          (value) => vaultProviderWireUtf8Bytes(value) <= VAULT_LIMITS.textValueMaxBytes
+        )
+      }).strict(),
+      /** An `otpauth://` URI or Base32 seed; Opengeni computes codes at use. */
+      z.object({ type: z.literal("totp"), value: boundedText(VAULT_LIMITS.websiteMaxChars) }).strict(),
+      z.object({
+        type: z.literal("bytes"),
+        base64: string.max(Math.ceil(VAULT_LIMITS.fileValueMaxBytes / 3) * 4).regex(BASE64)
+      }).strict()
+    ])
+  }).strict()
+);
+function valueBytes(field) {
+  if (field.value.type === "bytes") return Math.floor(field.value.base64.length * 3 / 4);
+  return vaultProviderWireUtf8Bytes(field.value.value);
+}
+var VaultProviderWireDescribeResult = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    /** Stable upstream account or bridge identity; reconnect rejects a change. */
+    accountId: boundedText(VAULT_PROVIDER_WIRE_LIMITS.accountIdMaxChars),
+    accountName: boundedText(VAULT_PROVIDER_WIRE_LIMITS.accountNameMaxChars).nullable(),
+    operations: VaultProviderOperations,
+    capabilities: z.object({ totp: boolean, files: boolean }).strict(),
+    /** One fixed inventory per connection, independent of the acting subject. */
+    inventoryScope: z.literal("connection")
+  }).strict()
+);
+function pageOf(item) {
+  return z.object({
+    items: z.array(item).max(VAULT_PROVIDER_WIRE_LIMITS.pageSizeMax),
+    nextCursor: Cursor.nullable(),
+    /** Null only when the receiver cannot supply snapshot consistency. */
+    snapshot: Snapshot.nullable()
+  }).strict();
+}
+var VaultProviderWireListVaultsResult = /* @__PURE__ */ defineSchema(
+  () => pageOf(VaultProviderWireVault)
+);
+var VaultProviderWireListItemsResult = /* @__PURE__ */ defineSchema(
+  () => pageOf(VaultProviderWireItemMeta)
+);
+var VaultProviderWireReadFieldsResult = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    fields: z.array(VaultProviderWireFieldValue).max(VAULT_PROVIDER_WIRE_LIMITS.readFieldsMax).refine((fields) => uniqueBy(fields, (field) => field.externalFieldId), "duplicate fields").refine(
+      (fields) => fields.reduce((total, field) => total + valueBytes(field), 0) <= VAULT_PROVIDER_WIRE_LIMITS.maxReadValueBytes,
+      "secret values too large"
+    )
+  }).strict()
+);
+var VaultProviderWireRefreshResult = /* @__PURE__ */ defineSchema(
+  () => z.object({ refreshed: z.literal(true) }).strict()
+);
+var VaultProviderWireWriteItemResult = /* @__PURE__ */ defineSchema(
+  () => z.object({ item: VaultProviderWireItemMeta }).strict()
+);
+var VaultProviderWireArchiveItemResult = /* @__PURE__ */ defineSchema(
+  () => z.object({ archived: z.literal(true) }).strict()
+);
+var VaultProviderWireResults = {
+  describe: VaultProviderWireDescribeResult,
+  refresh: VaultProviderWireRefreshResult,
+  list_vaults: VaultProviderWireListVaultsResult,
+  list_items: VaultProviderWireListItemsResult,
+  read_fields: VaultProviderWireReadFieldsResult,
+  write_item: VaultProviderWireWriteItemResult,
+  archive_item: VaultProviderWireArchiveItemResult
+};
+var VaultProviderWireError = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    code: VaultProviderWireErrorCode,
+    retryAfterMs: z.number().int().min(0).max(864e5).nullable()
+  }).strict()
+);
+var VaultProviderWireResponseEnvelope = /* @__PURE__ */ defineSchema(
+  () => z.discriminatedUnion("ok", [
+    z.object({
+      version: z.literal(VAULT_PROVIDER_WIRE_VERSION),
+      type: z.literal("response"),
+      requestId: uuid,
+      ok: z.literal(true),
+      op: z.enum(VAULT_PROVIDER_WIRE_OPERATIONS),
+      result: z.unknown(),
+      freshness: VaultProviderWireFreshness.nullable()
+    }).strict(),
+    z.object({
+      version: z.literal(VAULT_PROVIDER_WIRE_VERSION),
+      type: z.literal("response"),
+      requestId: uuid,
+      ok: z.literal(false),
+      op: z.enum(VAULT_PROVIDER_WIRE_OPERATIONS),
+      error: VaultProviderWireError,
+      freshness: VaultProviderWireFreshness.nullable()
+    }).strict()
+  ])
+);
+function parseVaultProviderWireResponse(value, expected) {
+  const envelope = VaultProviderWireResponseEnvelope.safeParse(value);
+  if (!envelope.success) return null;
+  const response = envelope.data;
+  if (response.requestId !== expected.requestId || response.op !== expected.op) return null;
+  if (!response.ok) return response;
+  const result = VaultProviderWireResults[expected.op].safeParse(response.result);
+  if (!result.success) return null;
+  return { ...response, op: expected.op, result: result.data };
+}
+
+export {
+  VAULT_PROVIDER_WIRE_VERSION,
+  VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER,
+  vaultProviderWireResponseKey,
+  VAULT_PROVIDER_WIRE_LIMITS,
+  VAULT_PROVIDER_WIRE_ERROR_CODES,
+  VAULT_PROVIDER_WIRE_OPERATIONS,
+  isVaultProviderWireMutation,
+  VaultProviderWireProvider,
+  vaultProviderWireUtf8Bytes,
+  vaultProviderWireNameKey,
+  VaultProviderWireAuthority,
+  VaultProviderWirePage,
+  VaultProviderWireWriteField,
+  VaultProviderWireWriteItem,
+  VaultProviderWireOperation,
+  VaultProviderWireRequest,
+  VaultProviderWireErrorCode,
+  VaultProviderWireFreshness,
+  VaultProviderWireVault,
+  VaultProviderWireFieldMeta,
+  VaultProviderWireItemMeta,
+  VaultProviderWireFieldValue,
+  VaultProviderWireDescribeResult,
+  VaultProviderWireListVaultsResult,
+  VaultProviderWireListItemsResult,
+  VaultProviderWireReadFieldsResult,
+  VaultProviderWireRefreshResult,
+  VaultProviderWireWriteItemResult,
+  VaultProviderWireArchiveItemResult,
+  VaultProviderWireResults,
+  VaultProviderWireError,
+  VaultProviderWireResponseEnvelope,
+  parseVaultProviderWireResponse
+};
+//# sourceMappingURL=chunk-2WOWEWXV.js.map

package/dist/chunk-2WOWEWXV.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/vault-provider-wire.ts"],"sourcesContent":["import * as primitives from \"./primitives\";\n/**\n * `opengeni.vault.v1`: the signed remote vault-provider protocol.\n *\n * Opengeni POSTs one JSON request per operation to a registered endpoint,\n * signed over the exact body with the existing `OpenGeni-Signature` scheme\n * (`signOpenGeniPayload`). The receiver verifies the signature, then maps the\n * trusted native authority tuple to its own tenant and user and rechecks\n * access on every operation: a valid MAC authenticates Opengeni, it is not an\n * authorization decision. Responses are signed with a response-only derived\n * key (`vaultProviderWireResponseKey`) so a response can never be replayed as\n * a request.\n *\n * Every shape is strict and bounded. Item metadata may carry a username display\n * hint, but never other field values.\n * Mutations carry an idempotency key; Opengeni never retries a mutation\n * automatically and reports an ambiguous outcome instead.\n */\nimport { z } from \"zod\";\nimport { defineSchema } from \"./define-schema\";\nimport {\n  VAULT_LIMITS,\n  VaultFieldKind,\n  VaultItemCategory,\n  VaultItemType,\n  VaultProviderOperations,\n  isReservedVaultFieldName,\n  isValidSecretName,\n} from \"./vaults\";\n\nexport const VAULT_PROVIDER_WIRE_VERSION = \"opengeni.vault.v1\" as const;\n\n/** Response signature header. Requests use the shared `OpenGeni-Signature` header. */\nexport const VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER = \"OpenGeni-Vault-Response-Signature\";\n\n/**\n * The response signing key is derived from the connection secret with a fixed\n * domain label, so request and response MACs are never interchangeable.\n */\nexport function vaultProviderWireResponseKey(signingSecret: string): string {\n  return `${signingSecret}\\u0000${VAULT_PROVIDER_WIRE_VERSION}.response`;\n}\n\nexport const VAULT_PROVIDER_WIRE_LIMITS = {\n  maxRequestBytes: 4 * 1024 * 1024,\n  maxResponseBytes: 4 * 1024 * 1024,\n  /** Sum of returned secret value bytes in one read. */\n  maxReadValueBytes: 3 * 1024 * 1024,\n  pageSizeMax: 100,\n  cursorMaxChars: 1_024,\n  snapshotMaxChars: 1_024,\n  externalIdMaxChars: 300,\n  vaultNameMaxChars: 300,\n  nativeIdMaxChars: 200,\n  readFieldsMax: VAULT_LIMITS.fieldsPerItem,\n  idempotencyKeyMaxChars: 200,\n  accountIdMaxChars: 300,\n  accountNameMaxChars: 300,\n  versionMaxChars: 300,\n  cacheEpochMaxChars: 200,\n  /** Per request deadline enforced by Opengeni's transport. */\n  defaultTimeoutMs: 15_000,\n  maxTimeoutMs: 60_000,\n  /** Accepted request age; matches `OPENGENI_SIGNATURE_TOLERANCE_SECONDS`. */\n  signatureToleranceSeconds: 300,\n} as const;\n\n/** Mirrors `VAULT_PROVIDER_ERROR_CODES` in `@opengeni/vaults` (parity tested there). */\nexport const VAULT_PROVIDER_WIRE_ERROR_CODES = [\n  \"provider_auth_invalid\",\n  \"provider_auth_expired\",\n  \"provider_rate_limited\",\n  \"provider_unavailable\",\n  \"provider_conflict\",\n  \"provider_not_found\",\n  \"provider_permission_denied\",\n  \"provider_locked\",\n  \"provider_inventory_incomplete\",\n  \"provider_outcome_unknown\",\n] as const;\nexport type VaultProviderWireErrorCode = (typeof VAULT_PROVIDER_WIRE_ERROR_CODES)[number];\n\nexport const VAULT_PROVIDER_WIRE_OPERATIONS = [\n  \"describe\",\n  \"refresh\",\n  \"list_vaults\",\n  \"list_items\",\n  \"read_fields\",\n  \"write_item\",\n  \"archive_item\",\n] as const;\nexport type VaultProviderWireOperationName = (typeof VAULT_PROVIDER_WIRE_OPERATIONS)[number];\n\nexport type VaultProviderWireMutationName = \"write_item\" | \"archive_item\";\nexport function isVaultProviderWireMutation(\n  op: VaultProviderWireOperationName,\n): op is VaultProviderWireMutationName {\n  return op === \"write_item\" || op === \"archive_item\";\n}\n\n/** Remote providers that use this protocol. */\nexport const VaultProviderWireProvider = /* @__PURE__ */ defineSchema(() => z.enum([\"external\"]));\nexport type VaultProviderWireProvider = z.infer<typeof VaultProviderWireProvider>;\n\n// oxlint-disable-next-line no-control-regex\nconst CONTROL_CHARACTERS = /[\\u0000-\\u001f\\u007f-\\u009f]/;\nconst encoder = /* @__PURE__ */ new TextEncoder();\n\nexport function vaultProviderWireUtf8Bytes(value: string): number {\n  return encoder.encode(value).byteLength;\n}\n\nfunction boundedText(max: number) {\n  return primitives.nonEmptyString\n    .max(max)\n    .refine((value) => !CONTROL_CHARACTERS.test(value), \"control characters are not allowed\");\n}\n\nconst ExternalId = /* @__PURE__ */ defineSchema(() =>\n  boundedText(VAULT_PROVIDER_WIRE_LIMITS.externalIdMaxChars),\n);\nconst NativeId = /* @__PURE__ */ defineSchema(() =>\n  boundedText(VAULT_PROVIDER_WIRE_LIMITS.nativeIdMaxChars),\n);\nconst ItemName = /* @__PURE__ */ defineSchema(() =>\n  primitives.string.refine(isValidSecretName, \"invalid_secret_name\"),\n);\nconst FieldName = /* @__PURE__ */ defineSchema(() =>\n  primitives.string.refine(\n    (name) => isValidSecretName(name) && !isReservedVaultFieldName(name),\n    \"invalid_secret_name\",\n  ),\n);\nconst Website = /* @__PURE__ */ defineSchema(() => boundedText(VAULT_LIMITS.websiteMaxChars));\nconst Version = /* @__PURE__ */ defineSchema(() =>\n  boundedText(VAULT_PROVIDER_WIRE_LIMITS.versionMaxChars),\n);\nconst Cursor = /* @__PURE__ */ defineSchema(() =>\n  boundedText(VAULT_PROVIDER_WIRE_LIMITS.cursorMaxChars),\n);\nconst Snapshot = /* @__PURE__ */ defineSchema(() =>\n  boundedText(VAULT_PROVIDER_WIRE_LIMITS.snapshotMaxChars),\n);\nconst IdempotencyKey = /* @__PURE__ */ defineSchema(() =>\n  boundedText(VAULT_PROVIDER_WIRE_LIMITS.idempotencyKeyMaxChars),\n);\nconst CacheEpoch = /* @__PURE__ */ defineSchema(() =>\n  boundedText(VAULT_PROVIDER_WIRE_LIMITS.cacheEpochMaxChars).nullable(),\n);\n\nfunction uniqueBy<T>(values: readonly T[], key: (value: T) => string): boolean {\n  const seen = new Set<string>();\n  for (const value of values) {\n    const k = key(value);\n    if (seen.has(k)) return false;\n    seen.add(k);\n  }\n  return true;\n}\n\n/** Case-insensitive name identity used for field-name uniqueness. */\nexport function vaultProviderWireNameKey(name: string): string {\n  return name.normalize(\"NFC\").trim().toLowerCase();\n}\n\n/**\n * The trusted native caller. Opengeni fills it from the authorized registry,\n * never from model or body-supplied arguments.\n */\nexport const VaultProviderWireAuthority = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      accountId: NativeId,\n      workspaceId: NativeId,\n      /** Null for workspace-level background work with no acting human. */\n      subjectId: NativeId.nullable(),\n      /** Workspace that owns the encrypted connection (may differ from the caller). */\n      connectionWorkspaceId: NativeId,\n      sessionId: NativeId.optional(),\n      turnId: NativeId.optional(),\n      attemptId: NativeId.optional(),\n      siteId: NativeId.optional(),\n    })\n    .strict(),\n);\nexport type VaultProviderWireAuthority = z.infer<typeof VaultProviderWireAuthority>;\n\nexport const VaultProviderWirePage = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      limit: z.number().int().min(1).max(VAULT_PROVIDER_WIRE_LIMITS.pageSizeMax),\n      cursor: Cursor.optional(),\n      snapshot: Snapshot.optional(),\n    })\n    .strict(),\n);\nexport type VaultProviderWirePage = z.infer<typeof VaultProviderWirePage>;\n\nexport const VaultProviderWireWriteField = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      externalFieldId: ExternalId.optional(),\n      name: FieldName,\n      kind: VaultFieldKind,\n      /** Omitted on an update: keep the current value. */\n      value: primitives.string\n        .refine(\n          (value) => vaultProviderWireUtf8Bytes(value) <= VAULT_LIMITS.textValueMaxBytes,\n          \"secret_value_too_large\",\n        )\n        .optional(),\n      remove: z.literal(true).optional(),\n    })\n    .strict()\n    .refine((field) => !(field.remove && field.value !== undefined), \"remove carries no value\")\n    .refine((field) => !(field.remove && !field.externalFieldId), \"remove needs a field id\")\n    .refine(\n      (field) => !(field.kind === \"file\" && field.value !== undefined),\n      \"file writes are not supported\",\n    ),\n);\nexport type VaultProviderWireWriteField = z.infer<typeof VaultProviderWireWriteField>;\n\nexport const VaultProviderWireWriteItem = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      externalItemId: ExternalId.optional(),\n      expectedVersion: Version.nullable().optional(),\n      name: ItemName,\n      type: VaultItemType.refine((type) => type !== \"passkey\", \"passkeys are hosted only\"),\n      category: VaultItemCategory.nullable().optional(),\n      websites: z.array(Website).max(VAULT_LIMITS.websitesPerItem),\n      fields: z.array(VaultProviderWireWriteField).max(VAULT_LIMITS.fieldsPerItem),\n    })\n    .strict()\n    .refine(\n      (item) =>\n        uniqueBy(\n          item.fields.filter((field) => !field.remove),\n          (field) => vaultProviderWireNameKey(field.name),\n        ) &&\n        uniqueBy(\n          item.fields.filter((field) => field.externalFieldId !== undefined),\n          (field) => field.externalFieldId!,\n        ),\n      \"duplicate fields\",\n    ),\n);\nexport type VaultProviderWireWriteItem = z.infer<typeof VaultProviderWireWriteItem>;\n\nconst ReadContext = {\n  /** Recheck upstream; never bypasses authorization or upstream rate limits. */\n  forceRefresh: primitives.boolean,\n  /** Opengeni's mirror freshness epoch, for receiver-side cache invalidation. */\n  cacheEpoch: CacheEpoch,\n};\n\nexport const VaultProviderWireOperation = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"op\", [\n    z.object({ op: z.literal(\"describe\") }).strict(),\n    z.object({ op: z.literal(\"refresh\") }).strict(),\n    z\n      .object({ op: z.literal(\"list_vaults\"), page: VaultProviderWirePage, ...ReadContext })\n      .strict(),\n    z\n      .object({\n        op: z.literal(\"list_items\"),\n        externalVaultId: ExternalId,\n        page: VaultProviderWirePage,\n        ...ReadContext,\n      })\n      .strict(),\n    z\n      .object({\n        op: z.literal(\"read_fields\"),\n        externalVaultId: ExternalId,\n        externalItemId: ExternalId,\n        externalFieldIds: z\n          .array(ExternalId)\n          .min(1)\n          .max(VAULT_PROVIDER_WIRE_LIMITS.readFieldsMax)\n          .refine((ids) => new Set(ids).size === ids.length, \"duplicate field ids\"),\n        ...ReadContext,\n      })\n      .strict(),\n    z\n      .object({\n        op: z.literal(\"write_item\"),\n        externalVaultId: ExternalId,\n        item: VaultProviderWireWriteItem,\n        idempotencyKey: IdempotencyKey,\n      })\n      .strict(),\n    z\n      .object({\n        op: z.literal(\"archive_item\"),\n        externalVaultId: ExternalId,\n        externalItemId: ExternalId,\n        idempotencyKey: IdempotencyKey,\n      })\n      .strict(),\n  ]),\n);\nexport type VaultProviderWireOperation = z.infer<typeof VaultProviderWireOperation>;\nexport type VaultProviderWireOperationOf<Op extends VaultProviderWireOperationName> = Extract<\n  VaultProviderWireOperation,\n  { op: Op }\n>;\n\nexport const VaultProviderWireRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      version: z.literal(VAULT_PROVIDER_WIRE_VERSION),\n      type: z.literal(\"request\"),\n      requestId: primitives.uuid,\n      sentAt: primitives.dateTime,\n      provider: VaultProviderWireProvider,\n      connectionId: primitives.uuid,\n      authority: VaultProviderWireAuthority,\n      operation: VaultProviderWireOperation,\n    })\n    .strict(),\n);\nexport type VaultProviderWireRequest = z.infer<typeof VaultProviderWireRequest>;\n\nexport const VaultProviderWireErrorCode = /* @__PURE__ */ defineSchema(() =>\n  z.enum(VAULT_PROVIDER_WIRE_ERROR_CODES),\n);\n\n/** Receiver freshness. Opengeni adds its own `lastCheckedAt`. */\nexport const VaultProviderWireFreshness = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      state: z.enum([\"current\", \"stale\", \"refreshing\", \"unavailable\"]),\n      /** When the receiver last synchronized with its upstream store. */\n      sourceSyncedAt: z.string().datetime().nullable(),\n      source: z.enum([\"live\", \"cache\", \"unknown\"]),\n      errorCode: VaultProviderWireErrorCode.nullable(),\n      retryAt: z.string().datetime().nullable(),\n    })\n    .strict(),\n);\nexport type VaultProviderWireFreshness = z.infer<typeof VaultProviderWireFreshness>;\n\nexport const VaultProviderWireVault = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      externalVaultId: ExternalId,\n      name: boundedText(VAULT_PROVIDER_WIRE_LIMITS.vaultNameMaxChars),\n      contentVersion: Version.nullable(),\n      itemCount: z.number().int().nonnegative().nullable(),\n      writeAccess: z.enum([\"read_only\", \"read_write\", \"unknown\"]),\n      /** Narrows the connection operations for this vault; never widens them. */\n      operations: VaultProviderOperations.optional(),\n    })\n    .strict(),\n);\nexport type VaultProviderWireVault = z.infer<typeof VaultProviderWireVault>;\n\nexport const VaultProviderWireFieldMeta = /* @__PURE__ */ defineSchema(() =>\n  z.object({ externalFieldId: ExternalId, name: FieldName, kind: VaultFieldKind }).strict(),\n);\nexport type VaultProviderWireFieldMeta = z.infer<typeof VaultProviderWireFieldMeta>;\n\n/** Item metadata, including an optional username display hint but no other values. */\nexport const VaultProviderWireItemMeta = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      externalItemId: ExternalId,\n      name: ItemName,\n      type: VaultItemType,\n      username: z.string().max(VAULT_LIMITS.usernameMaxChars).nullable().optional(),\n      category: VaultItemCategory.nullable().optional(),\n      websites: z.array(Website).max(VAULT_LIMITS.websitesPerItem),\n      fields: z\n        .array(VaultProviderWireFieldMeta)\n        .max(VAULT_LIMITS.fieldsPerItem)\n        .refine(\n          (fields) =>\n            uniqueBy(fields, (field) => field.externalFieldId) &&\n            uniqueBy(fields, (field) => vaultProviderWireNameKey(field.name)),\n          \"duplicate fields\",\n        ),\n      version: Version.nullable(),\n      updatedAt: z.string().datetime().nullable(),\n    })\n    .strict(),\n);\nexport type VaultProviderWireItemMeta = z.infer<typeof VaultProviderWireItemMeta>;\n\nconst BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;\nexport const VaultProviderWireFieldValue = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      externalFieldId: ExternalId,\n      value: z.discriminatedUnion(\"type\", [\n        z\n          .object({\n            type: z.literal(\"text\"),\n            value: primitives.string.refine(\n              (value) => vaultProviderWireUtf8Bytes(value) <= VAULT_LIMITS.textValueMaxBytes,\n            ),\n          })\n          .strict(),\n        /** An `otpauth://` URI or Base32 seed; Opengeni computes codes at use. */\n        z\n          .object({ type: z.literal(\"totp\"), value: boundedText(VAULT_LIMITS.websiteMaxChars) })\n          .strict(),\n        z\n          .object({\n            type: z.literal(\"bytes\"),\n            base64: primitives.string\n              .max(Math.ceil(VAULT_LIMITS.fileValueMaxBytes / 3) * 4)\n              .regex(BASE64),\n          })\n          .strict(),\n      ]),\n    })\n    .strict(),\n);\nexport type VaultProviderWireFieldValue = z.infer<typeof VaultProviderWireFieldValue>;\n\nfunction valueBytes(field: VaultProviderWireFieldValue): number {\n  if (field.value.type === \"bytes\") return Math.floor((field.value.base64.length * 3) / 4);\n  return vaultProviderWireUtf8Bytes(field.value.value);\n}\n\nexport const VaultProviderWireDescribeResult = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      /** Stable upstream account or bridge identity; reconnect rejects a change. */\n      accountId: boundedText(VAULT_PROVIDER_WIRE_LIMITS.accountIdMaxChars),\n      accountName: boundedText(VAULT_PROVIDER_WIRE_LIMITS.accountNameMaxChars).nullable(),\n      operations: VaultProviderOperations,\n      capabilities: z.object({ totp: primitives.boolean, files: primitives.boolean }).strict(),\n      /** One fixed inventory per connection, independent of the acting subject. */\n      inventoryScope: z.literal(\"connection\"),\n    })\n    .strict(),\n);\nexport type VaultProviderWireDescribeResult = z.infer<typeof VaultProviderWireDescribeResult>;\n\nfunction pageOf<T extends z.ZodType>(item: T) {\n  return z\n    .object({\n      items: z.array(item).max(VAULT_PROVIDER_WIRE_LIMITS.pageSizeMax),\n      nextCursor: Cursor.nullable(),\n      /** Null only when the receiver cannot supply snapshot consistency. */\n      snapshot: Snapshot.nullable(),\n    })\n    .strict();\n}\n\nexport const VaultProviderWireListVaultsResult = /* @__PURE__ */ defineSchema(() =>\n  pageOf(VaultProviderWireVault),\n);\nexport const VaultProviderWireListItemsResult = /* @__PURE__ */ defineSchema(() =>\n  pageOf(VaultProviderWireItemMeta),\n);\nexport const VaultProviderWireReadFieldsResult = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      fields: z\n        .array(VaultProviderWireFieldValue)\n        .max(VAULT_PROVIDER_WIRE_LIMITS.readFieldsMax)\n        .refine((fields) => uniqueBy(fields, (field) => field.externalFieldId), \"duplicate fields\")\n        .refine(\n          (fields) =>\n            fields.reduce((total, field) => total + valueBytes(field), 0) <=\n            VAULT_PROVIDER_WIRE_LIMITS.maxReadValueBytes,\n          \"secret values too large\",\n        ),\n    })\n    .strict(),\n);\nexport const VaultProviderWireRefreshResult = /* @__PURE__ */ defineSchema(() =>\n  z.object({ refreshed: z.literal(true) }).strict(),\n);\nexport const VaultProviderWireWriteItemResult = /* @__PURE__ */ defineSchema(() =>\n  z.object({ item: VaultProviderWireItemMeta }).strict(),\n);\nexport const VaultProviderWireArchiveItemResult = /* @__PURE__ */ defineSchema(() =>\n  z.object({ archived: z.literal(true) }).strict(),\n);\n\nexport const VaultProviderWireResults = {\n  describe: VaultProviderWireDescribeResult,\n  refresh: VaultProviderWireRefreshResult,\n  list_vaults: VaultProviderWireListVaultsResult,\n  list_items: VaultProviderWireListItemsResult,\n  read_fields: VaultProviderWireReadFieldsResult,\n  write_item: VaultProviderWireWriteItemResult,\n  archive_item: VaultProviderWireArchiveItemResult,\n} as const;\n\nexport type VaultProviderWireResult<Op extends VaultProviderWireOperationName> = z.infer<\n  (typeof VaultProviderWireResults)[Op]\n>;\n\nexport const VaultProviderWireError = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      code: VaultProviderWireErrorCode,\n      retryAfterMs: z.number().int().min(0).max(86_400_000).nullable(),\n    })\n    .strict(),\n);\nexport type VaultProviderWireError = z.infer<typeof VaultProviderWireError>;\n\n/**\n * Response envelope. `result` is validated separately against\n * `VaultProviderWireResults[op]` for the operation that was requested.\n */\nexport const VaultProviderWireResponseEnvelope = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"ok\", [\n    z\n      .object({\n        version: z.literal(VAULT_PROVIDER_WIRE_VERSION),\n        type: z.literal(\"response\"),\n        requestId: primitives.uuid,\n        ok: z.literal(true),\n        op: z.enum(VAULT_PROVIDER_WIRE_OPERATIONS),\n        result: z.unknown(),\n        freshness: VaultProviderWireFreshness.nullable(),\n      })\n      .strict(),\n    z\n      .object({\n        version: z.literal(VAULT_PROVIDER_WIRE_VERSION),\n        type: z.literal(\"response\"),\n        requestId: primitives.uuid,\n        ok: z.literal(false),\n        op: z.enum(VAULT_PROVIDER_WIRE_OPERATIONS),\n        error: VaultProviderWireError,\n        freshness: VaultProviderWireFreshness.nullable(),\n      })\n      .strict(),\n  ]),\n);\n\nexport type VaultProviderWireSuccess<\n  Op extends VaultProviderWireOperationName = VaultProviderWireOperationName,\n> = {\n  [K in Op]: {\n    version: typeof VAULT_PROVIDER_WIRE_VERSION;\n    type: \"response\";\n    requestId: string;\n    ok: true;\n    op: K;\n    result: VaultProviderWireResult<K>;\n    freshness: VaultProviderWireFreshness | null;\n  };\n}[Op];\n\nexport type VaultProviderWireFailure = {\n  version: typeof VAULT_PROVIDER_WIRE_VERSION;\n  type: \"response\";\n  requestId: string;\n  ok: false;\n  op: VaultProviderWireOperationName;\n  error: VaultProviderWireError;\n  freshness: VaultProviderWireFreshness | null;\n};\n\nexport type VaultProviderWireResponse = VaultProviderWireSuccess | VaultProviderWireFailure;\n\n/** Parse one response envelope and its operation-specific result. */\nexport function parseVaultProviderWireResponse<Op extends VaultProviderWireOperationName>(\n  value: unknown,\n  expected: { requestId: string; op: Op },\n): VaultProviderWireSuccess<Op> | VaultProviderWireFailure | null {\n  const envelope = VaultProviderWireResponseEnvelope.safeParse(value);\n  if (!envelope.success) return null;\n  const response = envelope.data;\n  if (response.requestId !== expected.requestId || response.op !== expected.op) return null;\n  if (!response.ok) return response as VaultProviderWireFailure;\n  const result = VaultProviderWireResults[expected.op].safeParse(response.result);\n  if (!result.success) return null;\n  return { ...response, op: expected.op, result: result.data } as VaultProviderWireSuccess<Op>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkBA,SAAS,SAAS;AAYX,IAAM,8BAA8B;AAGpC,IAAM,gDAAgD;AAMtD,SAAS,6BAA6B,eAA+B;AAC1E,SAAO,GAAG,aAAa,KAAS,2BAA2B;AAC7D;AAEO,IAAM,6BAA6B;AAAA,EACxC,iBAAiB,IAAI,OAAO;AAAA,EAC5B,kBAAkB,IAAI,OAAO;AAAA;AAAA,EAE7B,mBAAmB,IAAI,OAAO;AAAA,EAC9B,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,kBAAkB;AAAA,EAClB,oBAAoB;AAAA,EACpB,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,eAAe,aAAa;AAAA,EAC5B,wBAAwB;AAAA,EACxB,mBAAmB;AAAA,EACnB,qBAAqB;AAAA,EACrB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA;AAAA,EAEpB,kBAAkB;AAAA,EAClB,cAAc;AAAA;AAAA,EAEd,2BAA2B;AAC7B;AAGO,IAAM,kCAAkC;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,iCAAiC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,SAAS,4BACd,IACqC;AACrC,SAAO,OAAO,gBAAgB,OAAO;AACvC;AAGO,IAAM,4BAA4C,6BAAa,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;AAIhG,IAAM,qBAAqB;AAC3B,IAAM,UAA0B,oBAAI,YAAY;AAEzC,SAAS,2BAA2B,OAAuB;AAChE,SAAO,QAAQ,OAAO,KAAK,EAAE;AAC/B;AAEA,SAAS,YAAY,KAAa;AAChC,SAAkB,eACf,IAAI,GAAG,EACP,OAAO,CAAC,UAAU,CAAC,mBAAmB,KAAK,KAAK,GAAG,oCAAoC;AAC5F;AAEA,IAAM,aAA6B;AAAA,EAAa,MAC9C,YAAY,2BAA2B,kBAAkB;AAC3D;AACA,IAAM,WAA2B;AAAA,EAAa,MAC5C,YAAY,2BAA2B,gBAAgB;AACzD;AACA,IAAM,WAA2B;AAAA,EAAa,MACjC,OAAO,OAAO,mBAAmB,qBAAqB;AACnE;AACA,IAAM,YAA4B;AAAA,EAAa,MAClC,OAAO;AAAA,IAChB,CAAC,SAAS,kBAAkB,IAAI,KAAK,CAAC,yBAAyB,IAAI;AAAA,IACnE;AAAA,EACF;AACF;AACA,IAAM,UAA0B,6BAAa,MAAM,YAAY,aAAa,eAAe,CAAC;AAC5F,IAAM,UAA0B;AAAA,EAAa,MAC3C,YAAY,2BAA2B,eAAe;AACxD;AACA,IAAM,SAAyB;AAAA,EAAa,MAC1C,YAAY,2BAA2B,cAAc;AACvD;AACA,IAAM,WAA2B;AAAA,EAAa,MAC5C,YAAY,2BAA2B,gBAAgB;AACzD;AACA,IAAM,iBAAiC;AAAA,EAAa,MAClD,YAAY,2BAA2B,sBAAsB;AAC/D;AACA,IAAM,aAA6B;AAAA,EAAa,MAC9C,YAAY,2BAA2B,kBAAkB,EAAE,SAAS;AACtE;AAEA,SAAS,SAAY,QAAsB,KAAoC;AAC7E,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,SAAS,QAAQ;AAC1B,UAAM,IAAI,IAAI,KAAK;AACnB,QAAI,KAAK,IAAI,CAAC,EAAG,QAAO;AACxB,SAAK,IAAI,CAAC;AAAA,EACZ;AACA,SAAO;AACT;AAGO,SAAS,yBAAyB,MAAsB;AAC7D,SAAO,KAAK,UAAU,KAAK,EAAE,KAAK,EAAE,YAAY;AAClD;AAMO,IAAM,6BAA6C;AAAA,EAAa,MACrE,EACG,OAAO;AAAA,IACN,WAAW;AAAA,IACX,aAAa;AAAA;AAAA,IAEb,WAAW,SAAS,SAAS;AAAA;AAAA,IAE7B,uBAAuB;AAAA,IACvB,WAAW,SAAS,SAAS;AAAA,IAC7B,QAAQ,SAAS,SAAS;AAAA,IAC1B,WAAW,SAAS,SAAS;AAAA,IAC7B,QAAQ,SAAS,SAAS;AAAA,EAC5B,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,wBAAwC;AAAA,EAAa,MAChE,EACG,OAAO;AAAA,IACN,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,2BAA2B,WAAW;AAAA,IACzE,QAAQ,OAAO,SAAS;AAAA,IACxB,UAAU,SAAS,SAAS;AAAA,EAC9B,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,8BAA8C;AAAA,EAAa,MACtE,EACG,OAAO;AAAA,IACN,iBAAiB,WAAW,SAAS;AAAA,IACrC,MAAM;AAAA,IACN,MAAM;AAAA;AAAA,IAEN,OAAkB,OACf;AAAA,MACC,CAAC,UAAU,2BAA2B,KAAK,KAAK,aAAa;AAAA,MAC7D;AAAA,IACF,EACC,SAAS;AAAA,IACZ,QAAQ,EAAE,QAAQ,IAAI,EAAE,SAAS;AAAA,EACnC,CAAC,EACA,OAAO,EACP,OAAO,CAAC,UAAU,EAAE,MAAM,UAAU,MAAM,UAAU,SAAY,yBAAyB,EACzF,OAAO,CAAC,UAAU,EAAE,MAAM,UAAU,CAAC,MAAM,kBAAkB,yBAAyB,EACtF;AAAA,IACC,CAAC,UAAU,EAAE,MAAM,SAAS,UAAU,MAAM,UAAU;AAAA,IACtD;AAAA,EACF;AACJ;AAGO,IAAM,6BAA6C;AAAA,EAAa,MACrE,EACG,OAAO;AAAA,IACN,gBAAgB,WAAW,SAAS;AAAA,IACpC,iBAAiB,QAAQ,SAAS,EAAE,SAAS;AAAA,IAC7C,MAAM;AAAA,IACN,MAAM,cAAc,OAAO,CAAC,SAAS,SAAS,WAAW,0BAA0B;AAAA,IACnF,UAAU,kBAAkB,SAAS,EAAE,SAAS;AAAA,IAChD,UAAU,EAAE,MAAM,OAAO,EAAE,IAAI,aAAa,eAAe;AAAA,IAC3D,QAAQ,EAAE,MAAM,2BAA2B,EAAE,IAAI,aAAa,aAAa;AAAA,EAC7E,CAAC,EACA,OAAO,EACP;AAAA,IACC,CAAC,SACC;AAAA,MACE,KAAK,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,MAAM;AAAA,MAC3C,CAAC,UAAU,yBAAyB,MAAM,IAAI;AAAA,IAChD,KACA;AAAA,MACE,KAAK,OAAO,OAAO,CAAC,UAAU,MAAM,oBAAoB,MAAS;AAAA,MACjE,CAAC,UAAU,MAAM;AAAA,IACnB;AAAA,IACF;AAAA,EACF;AACJ;AAGA,IAAM,cAAc;AAAA;AAAA,EAElB,cAAyB;AAAA;AAAA,EAEzB,YAAY;AACd;AAEO,IAAM,6BAA6C;AAAA,EAAa,MACrE,EAAE,mBAAmB,MAAM;AAAA,IACzB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,UAAU,EAAE,CAAC,EAAE,OAAO;AAAA,IAC/C,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,SAAS,EAAE,CAAC,EAAE,OAAO;AAAA,IAC9C,EACG,OAAO,EAAE,IAAI,EAAE,QAAQ,aAAa,GAAG,MAAM,uBAAuB,GAAG,YAAY,CAAC,EACpF,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,IAAI,EAAE,QAAQ,YAAY;AAAA,MAC1B,iBAAiB;AAAA,MACjB,MAAM;AAAA,MACN,GAAG;AAAA,IACL,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,IAAI,EAAE,QAAQ,aAAa;AAAA,MAC3B,iBAAiB;AAAA,MACjB,gBAAgB;AAAA,MAChB,kBAAkB,EACf,MAAM,UAAU,EAChB,IAAI,CAAC,EACL,IAAI,2BAA2B,aAAa,EAC5C,OAAO,CAAC,QAAQ,IAAI,IAAI,GAAG,EAAE,SAAS,IAAI,QAAQ,qBAAqB;AAAA,MAC1E,GAAG;AAAA,IACL,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,IAAI,EAAE,QAAQ,YAAY;AAAA,MAC1B,iBAAiB;AAAA,MACjB,MAAM;AAAA,MACN,gBAAgB;AAAA,IAClB,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,IAAI,EAAE,QAAQ,cAAc;AAAA,MAC5B,iBAAiB;AAAA,MACjB,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH;AAOO,IAAM,2BAA2C;AAAA,EAAa,MACnE,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,2BAA2B;AAAA,IAC9C,MAAM,EAAE,QAAQ,SAAS;AAAA,IACzB,WAAsB;AAAA,IACtB,QAAmB;AAAA,IACnB,UAAU;AAAA,IACV,cAAyB;AAAA,IACzB,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,6BAA6C;AAAA,EAAa,MACrE,EAAE,KAAK,+BAA+B;AACxC;AAGO,IAAM,6BAA6C;AAAA,EAAa,MACrE,EACG,OAAO;AAAA,IACN,OAAO,EAAE,KAAK,CAAC,WAAW,SAAS,cAAc,aAAa,CAAC;AAAA;AAAA,IAE/D,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC/C,QAAQ,EAAE,KAAK,CAAC,QAAQ,SAAS,SAAS,CAAC;AAAA,IAC3C,WAAW,2BAA2B,SAAS;AAAA,IAC/C,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,yBAAyC;AAAA,EAAa,MACjE,EACG,OAAO;AAAA,IACN,iBAAiB;AAAA,IACjB,MAAM,YAAY,2BAA2B,iBAAiB;AAAA,IAC9D,gBAAgB,QAAQ,SAAS;AAAA,IACjC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,IACnD,aAAa,EAAE,KAAK,CAAC,aAAa,cAAc,SAAS,CAAC;AAAA;AAAA,IAE1D,YAAY,wBAAwB,SAAS;AAAA,EAC/C,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,6BAA6C;AAAA,EAAa,MACrE,EAAE,OAAO,EAAE,iBAAiB,YAAY,MAAM,WAAW,MAAM,eAAe,CAAC,EAAE,OAAO;AAC1F;AAIO,IAAM,4BAA4C;AAAA,EAAa,MACpE,EACG,OAAO;AAAA,IACN,gBAAgB;AAAA,IAChB,MAAM;AAAA,IACN,MAAM;AAAA,IACN,UAAU,EAAE,OAAO,EAAE,IAAI,aAAa,gBAAgB,EAAE,SAAS,EAAE,SAAS;AAAA,IAC5E,UAAU,kBAAkB,SAAS,EAAE,SAAS;AAAA,IAChD,UAAU,EAAE,MAAM,OAAO,EAAE,IAAI,aAAa,eAAe;AAAA,IAC3D,QAAQ,EACL,MAAM,0BAA0B,EAChC,IAAI,aAAa,aAAa,EAC9B;AAAA,MACC,CAAC,WACC,SAAS,QAAQ,CAAC,UAAU,MAAM,eAAe,KACjD,SAAS,QAAQ,CAAC,UAAU,yBAAyB,MAAM,IAAI,CAAC;AAAA,MAClE;AAAA,IACF;AAAA,IACF,SAAS,QAAQ,SAAS;AAAA,IAC1B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,CAAC,EACA,OAAO;AACZ;AAGA,IAAM,SAAS;AACR,IAAM,8BAA8C;AAAA,EAAa,MACtE,EACG,OAAO;AAAA,IACN,iBAAiB;AAAA,IACjB,OAAO,EAAE,mBAAmB,QAAQ;AAAA,MAClC,EACG,OAAO;AAAA,QACN,MAAM,EAAE,QAAQ,MAAM;AAAA,QACtB,OAAkB,OAAO;AAAA,UACvB,CAAC,UAAU,2BAA2B,KAAK,KAAK,aAAa;AAAA,QAC/D;AAAA,MACF,CAAC,EACA,OAAO;AAAA;AAAA,MAEV,EACG,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,GAAG,OAAO,YAAY,aAAa,eAAe,EAAE,CAAC,EACpF,OAAO;AAAA,MACV,EACG,OAAO;AAAA,QACN,MAAM,EAAE,QAAQ,OAAO;AAAA,QACvB,QAAmB,OAChB,IAAI,KAAK,KAAK,aAAa,oBAAoB,CAAC,IAAI,CAAC,EACrD,MAAM,MAAM;AAAA,MACjB,CAAC,EACA,OAAO;AAAA,IACZ,CAAC;AAAA,EACH,CAAC,EACA,OAAO;AACZ;AAGA,SAAS,WAAW,OAA4C;AAC9D,MAAI,MAAM,MAAM,SAAS,QAAS,QAAO,KAAK,MAAO,MAAM,MAAM,OAAO,SAAS,IAAK,CAAC;AACvF,SAAO,2BAA2B,MAAM,MAAM,KAAK;AACrD;AAEO,IAAM,kCAAkD;AAAA,EAAa,MAC1E,EACG,OAAO;AAAA;AAAA,IAEN,WAAW,YAAY,2BAA2B,iBAAiB;AAAA,IACnE,aAAa,YAAY,2BAA2B,mBAAmB,EAAE,SAAS;AAAA,IAClF,YAAY;AAAA,IACZ,cAAc,EAAE,OAAO,EAAE,MAAiB,SAAS,OAAkB,QAAQ,CAAC,EAAE,OAAO;AAAA;AAAA,IAEvF,gBAAgB,EAAE,QAAQ,YAAY;AAAA,EACxC,CAAC,EACA,OAAO;AACZ;AAGA,SAAS,OAA4B,MAAS;AAC5C,SAAO,EACJ,OAAO;AAAA,IACN,OAAO,EAAE,MAAM,IAAI,EAAE,IAAI,2BAA2B,WAAW;AAAA,IAC/D,YAAY,OAAO,SAAS;AAAA;AAAA,IAE5B,UAAU,SAAS,SAAS;AAAA,EAC9B,CAAC,EACA,OAAO;AACZ;AAEO,IAAM,oCAAoD;AAAA,EAAa,MAC5E,OAAO,sBAAsB;AAC/B;AACO,IAAM,mCAAmD;AAAA,EAAa,MAC3E,OAAO,yBAAyB;AAClC;AACO,IAAM,oCAAoD;AAAA,EAAa,MAC5E,EACG,OAAO;AAAA,IACN,QAAQ,EACL,MAAM,2BAA2B,EACjC,IAAI,2BAA2B,aAAa,EAC5C,OAAO,CAAC,WAAW,SAAS,QAAQ,CAAC,UAAU,MAAM,eAAe,GAAG,kBAAkB,EACzF;AAAA,MACC,CAAC,WACC,OAAO,OAAO,CAAC,OAAO,UAAU,QAAQ,WAAW,KAAK,GAAG,CAAC,KAC5D,2BAA2B;AAAA,MAC7B;AAAA,IACF;AAAA,EACJ,CAAC,EACA,OAAO;AACZ;AACO,IAAM,iCAAiD;AAAA,EAAa,MACzE,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,OAAO;AAClD;AACO,IAAM,mCAAmD;AAAA,EAAa,MAC3E,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC,EAAE,OAAO;AACvD;AACO,IAAM,qCAAqD;AAAA,EAAa,MAC7E,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,OAAO;AACjD;AAEO,IAAM,2BAA2B;AAAA,EACtC,UAAU;AAAA,EACV,SAAS;AAAA,EACT,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,cAAc;AAChB;AAMO,IAAM,yBAAyC;AAAA,EAAa,MACjE,EACG,OAAO;AAAA,IACN,MAAM;AAAA,IACN,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAU,EAAE,SAAS;AAAA,EACjE,CAAC,EACA,OAAO;AACZ;AAOO,IAAM,oCAAoD;AAAA,EAAa,MAC5E,EAAE,mBAAmB,MAAM;AAAA,IACzB,EACG,OAAO;AAAA,MACN,SAAS,EAAE,QAAQ,2BAA2B;AAAA,MAC9C,MAAM,EAAE,QAAQ,UAAU;AAAA,MAC1B,WAAsB;AAAA,MACtB,IAAI,EAAE,QAAQ,IAAI;AAAA,MAClB,IAAI,EAAE,KAAK,8BAA8B;AAAA,MACzC,QAAQ,EAAE,QAAQ;AAAA,MAClB,WAAW,2BAA2B,SAAS;AAAA,IACjD,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,SAAS,EAAE,QAAQ,2BAA2B;AAAA,MAC9C,MAAM,EAAE,QAAQ,UAAU;AAAA,MAC1B,WAAsB;AAAA,MACtB,IAAI,EAAE,QAAQ,KAAK;AAAA,MACnB,IAAI,EAAE,KAAK,8BAA8B;AAAA,MACzC,OAAO;AAAA,MACP,WAAW,2BAA2B,SAAS;AAAA,IACjD,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH;AA6BO,SAAS,+BACd,OACA,UACgE;AAChE,QAAM,WAAW,kCAAkC,UAAU,KAAK;AAClE,MAAI,CAAC,SAAS,QAAS,QAAO;AAC9B,QAAM,WAAW,SAAS;AAC1B,MAAI,SAAS,cAAc,SAAS,aAAa,SAAS,OAAO,SAAS,GAAI,QAAO;AACrF,MAAI,CAAC,SAAS,GAAI,QAAO;AACzB,QAAM,SAAS,yBAAyB,SAAS,EAAE,EAAE,UAAU,SAAS,MAAM;AAC9E,MAAI,CAAC,OAAO,QAAS,QAAO;AAC5B,SAAO,EAAE,GAAG,UAAU,IAAI,SAAS,IAAI,QAAQ,OAAO,KAAK;AAC7D;","names":[]}

package/dist/chunk-2ZIHHL72.js

@@ -0,0 +1,153 @@
+// src/model-display.ts
+function modelLogoUrl(input) {
+  const value = typeof input === "string" ? void 0 : input.logoUrl;
+  if (!value || value.length > 2048 || value !== value.trim()) return null;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password ? value : null;
+  } catch {
+    return null;
+  }
+}
+var WORDS = {
+  gpt: "GPT",
+  chatgpt: "ChatGPT",
+  claude: "Claude",
+  grok: "Grok",
+  gemini: "Gemini",
+  gemma: "Gemma",
+  llama: "Llama",
+  deepseek: "DeepSeek",
+  qwen: "Qwen",
+  glm: "GLM",
+  kimi: "Kimi",
+  mistral: "Mistral",
+  codestral: "Codestral",
+  devstral: "Devstral",
+  magistral: "Magistral",
+  nemotron: "Nemotron",
+  oss: "OSS",
+  // Region-pinned gateway routes (Opper `aws/claude-sonnet-4-6-eu`).
+  eu: "EU"
+};
+function modelSlug(value) {
+  const last = value.split("/").filter(Boolean).at(-1) ?? value;
+  return last.replace(/:[^:]*$/, "") || last;
+}
+function upstreamOf(input) {
+  return input.upstreamModelId?.trim() || input.deployment?.upstreamModelId?.trim() || null;
+}
+function titleToken(token, index) {
+  const lower = token.toLowerCase();
+  const word = WORDS[lower];
+  if (word) return word;
+  if (index === 0 && /^o\d+$/.test(lower)) return lower;
+  if (/^\d+(?:\.\d+)?[bkmt]$/.test(lower) || /^[a-z]\d+[a-z\d]*$/.test(lower)) {
+    return lower.toUpperCase();
+  }
+  if (/^\d/.test(token)) return lower;
+  return lower.charAt(0).toUpperCase() + lower.slice(1);
+}
+function humanizeModelSlug(value) {
+  const slug = modelSlug(value.trim()).replace(/[-_](?:\d{8}|\d{4}-\d{2}-\d{2})$/, "").replace(/[-_]latest$/i, "");
+  const raw = slug.split(/[-_\s]+/).filter(Boolean);
+  if (raw.length === 0) return value.trim() || value;
+  const tokens = [];
+  for (const token of raw) {
+    const previous = tokens.at(-1);
+    if (previous !== void 0 && /^\d{1,2}$/.test(token) && /^\d{1,2}$/.test(previous)) {
+      tokens[tokens.length - 1] = `${previous}.${token}`;
+      continue;
+    }
+    tokens.push(token);
+  }
+  const words = tokens.map(titleToken);
+  if (words[0] === "GPT" && words.length > 1 && /^\d/.test(words[1])) {
+    return [`GPT-${words[1]}`, ...words.slice(2)].join(" ");
+  }
+  return words.join(" ");
+}
+function isRawModelLabel(label, ids = []) {
+  const text = label.trim();
+  if (!text) return true;
+  return ids.some((id) => {
+    if (!id) return false;
+    const segments = id.trim().split("/").filter(Boolean);
+    return segments.some((_, index) => {
+      const tail = segments.slice(index).join("/");
+      return tail === text || modelSlug(tail) === text;
+    });
+  });
+}
+function modelDisplayName(input) {
+  if (typeof input === "string") {
+    return input.trim() && !/\s/.test(input.trim()) ? withoutClaudeFamilyPrefix(humanizeModelSlug(input)) : input;
+  }
+  const upstream = upstreamOf(input);
+  const label = input.label?.trim();
+  if (label && !isRawModelLabel(label, [input.id, upstream])) {
+    return withoutClaudeFamilyPrefix(label);
+  }
+  return withoutClaudeFamilyPrefix(humanizeModelSlug(upstream ?? label ?? input.id));
+}
+function withoutClaudeFamilyPrefix(name) {
+  return name.replace(/^Claude\s+(?=(?:Opus|Sonnet|Haiku)\b)/, "");
+}
+var VENDOR_PATTERNS = [
+  ["anthropic", /^claude\b/],
+  ["openai", /^(?:gpt|chatgpt|o\d+|codex|dall-e|sora|text-embedding|whisper)\b/],
+  ["xai", /^grok\b/],
+  ["google", /^(?:gemini|gemma)\b/],
+  ["meta", /^llama\b/],
+  ["mistral", /^(?:mistral|codestral|devstral|magistral|ministral|pixtral)\b/],
+  ["deepseek", /^deepseek\b/],
+  ["moonshot", /^(?:kimi|moonshot)\b/],
+  ["qwen", /^(?:qwen|qwq)\b/],
+  ["zhipu", /^glm\b/],
+  ["nvidia", /^nemotron\b/]
+];
+var VENDOR_SEGMENTS = {
+  anthropic: "anthropic",
+  openai: "openai",
+  "x-ai": "xai",
+  xai: "xai",
+  google: "google",
+  "meta-llama": "meta",
+  mistralai: "mistral",
+  deepseek: "deepseek",
+  moonshotai: "moonshot",
+  qwen: "qwen",
+  "z-ai": "zhipu",
+  nvidia: "nvidia"
+};
+function vendorFromSlug(slug) {
+  for (const [vendor, pattern] of VENDOR_PATTERNS) if (pattern.test(slug)) return vendor;
+  return null;
+}
+function modelVendor(input) {
+  const ids = typeof input === "string" ? [input] : [upstreamOf(input), input.id];
+  for (const id of ids) {
+    if (!id) continue;
+    const lower = id.trim().toLowerCase();
+    if (lower.startsWith("codex/")) return "openai";
+    if (lower.startsWith("supergrok/")) return "xai";
+    const vendor = vendorFromSlug(modelSlug(lower));
+    if (vendor) return vendor;
+    const segment = lower.split("/").filter(Boolean).at(-2);
+    if (segment && Object.hasOwn(VENDOR_SEGMENTS, segment)) return VENDOR_SEGMENTS[segment];
+  }
+  if (typeof input !== "string" && input.label) {
+    return vendorFromSlug(input.label.trim().toLowerCase().replace(/\s+/g, "-"));
+  }
+  return null;
+}
+
+export {
+  modelLogoUrl,
+  modelSlug,
+  humanizeModelSlug,
+  isRawModelLabel,
+  modelDisplayName,
+  modelVendor
+};
+//# sourceMappingURL=chunk-2ZIHHL72.js.map