@opengeni/sdk 0.52.1 → 1.0.0

package/dist/chunk-V6GIY62B.js

@@ -0,0 +1,229 @@
+// src/errors.ts
+var OpenGeniApiError = class extends Error {
+  status;
+  code;
+  retryable;
+  correlationId;
+  /** True only when an uncontrolled transport failed after a mutation may have been accepted. */
+  outcomeUnknown;
+  body;
+  details;
+  constructor(status, body, options = {}) {
+    const decoded = decodeApiErrorBody(body);
+    const correlationId = decoded?.requestId ?? boundedCorrelationId(options.correlationId);
+    const gatewayFailure = status >= 502 && status <= 504;
+    const fromResponse = options.mutation !== void 0;
+    const message = decoded?.message ?? (fromResponse ? "Request failed." : body || "(empty body)");
+    const displayMessage = options.displayMessage ?? (gatewayFailure && fromResponse ? decoded?.message ?? "Opengeni is temporarily unavailable \u2014 retry." : `OpenGeni API ${status}: ${message}`);
+    super(correlationId ? `${displayMessage} Reference: ${correlationId}.` : displayMessage);
+    this.name = "OpenGeniApiError";
+    this.status = status;
+    this.code = options.code ?? decoded?.code ?? (gatewayFailure && fromResponse ? "upstream_unavailable" : void 0);
+    this.retryable = options.retryable ?? decoded?.retryable ?? retryableApiStatus(status);
+    this.correlationId = correlationId;
+    this.outcomeUnknown = options.outcomeUnknown ?? decoded?.outcomeUnknown ?? (gatewayFailure && !!options.mutation && !decoded);
+    this.body = !fromResponse || decoded ? body : "";
+    this.details = decoded?.details;
+  }
+};
+var OpenGeniSetupError = class extends OpenGeniApiError {
+  constructor(error) {
+    super(error.status, error.body, {
+      code: "OPENGENI_SETUP_REQUIRED",
+      retryable: false,
+      correlationId: error.correlationId,
+      displayMessage: "Private chats require organization_private_session_settings.enabled (migration 0323). An organization owner or admin can enable Only me chats in the web app under Organization settings > Security & data, or use updateOrganizationPrivateSessionSettings from @opengeni/sdk/organization-private-session-settings with enabled: true, the current expectedVersion and a stable operationId (PATCH /v1/organizations/:organizationId/private-session-settings; an organization key needs workspace:admin). If platform readiness is unavailable, ask the deployment operator to activate session tenancy first."
+    });
+    this.name = "OpenGeniSetupError";
+  }
+};
+var OpenGeniAllowanceExhaustedError = class extends OpenGeniApiError {
+  scope;
+  resetsAt;
+  subjectId;
+  constructor(status, body, options = {}) {
+    super(status, body, {
+      ...options,
+      code: "allowance_exhausted",
+      retryable: false,
+      outcomeUnknown: false
+    });
+    this.name = "OpenGeniAllowanceExhaustedError";
+    const refusal = allowanceExhaustedFields(body);
+    this.scope = refusal?.scope ?? "workspace";
+    this.resetsAt = refusal?.resetsAt ?? null;
+    this.subjectId = refusal?.subjectId;
+  }
+};
+function allowanceExhaustedFields(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const root = parsed;
+    const error = root.error && typeof root.error === "object" && !Array.isArray(root.error) ? root.error : root;
+    if (error.code !== "allowance_exhausted") return null;
+    const fields = error.details && typeof error.details === "object" && !Array.isArray(error.details) ? error.details : error;
+    if (fields.scope !== "workspace" && fields.scope !== "member") return null;
+    if (fields.resetsAt !== null && typeof fields.resetsAt !== "string") return null;
+    return {
+      scope: fields.scope,
+      resetsAt: fields.resetsAt,
+      ...typeof fields.subjectId === "string" ? { subjectId: fields.subjectId } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+var OpenGeniSecureContextRequiredError = class extends Error {
+  code = "secure_context_required";
+  retryable = false;
+  reason;
+  constructor(reason) {
+    super(
+      reason === "insecure_context" ? "Couldn\u2019t attach this file because Opengeni is open over HTTP. Attachments require a secure HTTPS connection. Open the secure site or configure HTTPS for this deployment." : "Couldn\u2019t attach this file because secure browser cryptography is unavailable. Attachments require HTTPS and Web Crypto support. Open a secure site in a supported browser or configure HTTPS for this deployment."
+    );
+    this.name = "OpenGeniSecureContextRequiredError";
+    this.reason = reason;
+  }
+};
+function decodeApiErrorBody(body) {
+  if (!body) return null;
+  try {
+    const decoded = JSON.parse(body);
+    if (!decoded || typeof decoded !== "object" || Array.isArray(decoded)) return null;
+    const record = decoded;
+    const nested = record.error && typeof record.error === "object" && !Array.isArray(record.error) ? record.error : record;
+    const code = boundedApiField(nested.code);
+    const message = boundedApiField(nested.message);
+    const requestId = boundedCorrelationId(nested.requestId);
+    const retryable = typeof nested.retryable === "boolean" ? nested.retryable : void 0;
+    const outcomeUnknown = typeof nested.outcomeUnknown === "boolean" ? nested.outcomeUnknown : void 0;
+    const details = boundedApiDetails(nested.details);
+    if (!code && !message && !requestId && retryable === void 0 && outcomeUnknown === void 0 && !details)
+      return null;
+    return {
+      code,
+      message,
+      requestId,
+      retryable,
+      outcomeUnknown,
+      details
+    };
+  } catch {
+    return null;
+  }
+}
+function boundedApiDetails(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return;
+  const entries = Object.entries(value).slice(0, 16);
+  const details = {};
+  for (const [key, entry] of entries) {
+    if (!/^[a-zA-Z][\w.-]{0,63}$/.test(key)) continue;
+    if (typeof entry === "string") {
+      const bounded = boundedApiField(entry);
+      if (bounded !== void 0) details[key] = bounded;
+    } else if (typeof entry === "number" || typeof entry === "boolean" || entry === null) {
+      details[key] = entry;
+    }
+  }
+  return Object.keys(details).length > 0 ? details : void 0;
+}
+function boundedApiField(value) {
+  if (typeof value !== "string") return;
+  const bytes = new TextEncoder().encode(value);
+  return bytes.byteLength <= 512 ? value : new TextDecoder().decode(bytes.slice(0, 512));
+}
+function retryableApiStatus(status) {
+  return status === 408 || status === 409 || status === 425 || status === 429 || status >= 500;
+}
+function boundedCorrelationId(value) {
+  if (typeof value !== "string" || value.length > 128 || !/^[\w.:-]+$/.test(value)) {
+    return;
+  }
+  return value;
+}
+var OpenGeniSessionListCursorError = class extends OpenGeniApiError {
+};
+var OpenGeniApiContractMismatchError = class extends Error {
+  expected;
+  actual;
+  constructor(expected, actual) {
+    super(`OpenGeni API contract mismatch: client expects ${expected}, API serves ${actual}`);
+    this.name = "OpenGeniApiContractMismatchError";
+    this.expected = expected;
+    this.actual = actual;
+  }
+};
+var OpenGeniStreamError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "OpenGeniStreamError";
+  }
+};
+function formatErrorMessage(error, fallback = "The request could not be completed.") {
+  if (error instanceof OpenGeniApiError) {
+    let message;
+    if (error.outcomeUnknown) {
+      message = "The request could not be confirmed. Check its status before retrying.";
+    } else if (error instanceof OpenGeniSetupError || error.code === "OPENGENI_SETUP_REQUIRED" || error.code === "SESSION_TENANCY_NOT_ACTIVATED") {
+      message = "Private conversations are unavailable. Ask an administrator to enable them.";
+    } else if (error.code === "allowance_exhausted") {
+      message = "Usage limit reached. Wait for the reset or ask an administrator for more usage.";
+    } else if (error instanceof OpenGeniSessionListCursorError) {
+      message = "The conversation list changed. Refresh and try again.";
+    } else if (error.status === 401) {
+      message = "Sign in to continue.";
+    } else if (error.status === 403) {
+      message = "You don\u2019t have permission to do that.";
+    } else if (error.status === 404) {
+      message = "The requested item is unavailable.";
+    } else if (error.status === 402 || error.code === "payment_required") {
+      message = "There are not enough credits to continue.";
+    } else if (error.status === 429 || error.code === "rate_limited") {
+      message = error.retryable ? "Too many requests. Wait a moment and try again." : "This request is unavailable. Ask an administrator for help.";
+    } else if (error.status === 409) {
+      message = "The request conflicts with the current state. Refresh and try again.";
+    } else if (error.status === 400 || error.status === 422) {
+      message = "The request could not be accepted. Check your input and try again.";
+    } else if (error.status === 408 || error.status === 425 || error.status === 0) {
+      message = error.retryable ? "The connection could not be completed. Try again later." : fallback;
+    } else if (error.status >= 500) {
+      message = error.retryable ? "The service is temporarily unavailable. Try again later." : "The service is unavailable. Ask an administrator for help.";
+    } else {
+      message = fallback;
+    }
+    return error.correlationId ? `${message} Reference: ${error.correlationId}.` : message;
+  }
+  if (error instanceof OpenGeniSecureContextRequiredError || error instanceof Error && "code" in error && error.code === "secure_context_required") {
+    return "reason" in error && error.reason === "insecure_context" ? "Attachments require HTTPS. Open this page over a secure connection." : "Attachments require secure browser cryptography. Use a supported browser over HTTPS.";
+  }
+  if (error instanceof OpenGeniApiContractMismatchError) {
+    return "This page is out of date. Reload it before trying again.";
+  }
+  if (error instanceof OpenGeniStreamError) {
+    return "The live connection could not be restored. Refresh to check the latest state.";
+  }
+  return fallback;
+}
+function isAbortError(error) {
+  return error instanceof DOMException && error.name === "AbortError" || error instanceof Error && error.name === "AbortError";
+}
+function isRetryableStreamError(error) {
+  if (error instanceof OpenGeniApiError) return error.retryable;
+  return error instanceof TypeError;
+}
+
+export {
+  OpenGeniApiError,
+  OpenGeniSetupError,
+  OpenGeniAllowanceExhaustedError,
+  allowanceExhaustedFields,
+  OpenGeniSecureContextRequiredError,
+  OpenGeniSessionListCursorError,
+  OpenGeniApiContractMismatchError,
+  OpenGeniStreamError,
+  formatErrorMessage,
+  isAbortError,
+  isRetryableStreamError
+};
+//# sourceMappingURL=chunk-V6GIY62B.js.map

package/dist/chunk-V6GIY62B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts"],"sourcesContent":["/** Error for a non-2xx OpenGeni API response. */\nexport class OpenGeniApiError extends Error {\n  readonly status: number;\n  readonly code: string | undefined;\n  readonly retryable: boolean;\n  readonly correlationId: string | undefined;\n  /** True only when an uncontrolled transport failed after a mutation may have been accepted. */\n  readonly outcomeUnknown: boolean;\n  readonly body: string;\n  readonly details: Record<string, unknown> | undefined;\n\n  constructor(\n    status: number,\n    body: string,\n    options: {\n      code?: string | undefined;\n      retryable?: boolean | undefined;\n      correlationId?: string | undefined;\n      outcomeUnknown?: boolean | undefined;\n      displayMessage?: string | undefined;\n      mutation?: boolean | undefined;\n    } = {},\n  ) {\n    const decoded = decodeApiErrorBody(body);\n    const correlationId = decoded?.requestId ?? boundedCorrelationId(options.correlationId);\n    const gatewayFailure = status >= 502 && status <= 504;\n    const fromResponse = options.mutation !== undefined;\n    const message = decoded?.message ?? (fromResponse ? \"Request failed.\" : body || \"(empty body)\");\n    const displayMessage =\n      options.displayMessage ??\n      (gatewayFailure && fromResponse\n        ? (decoded?.message ?? \"Opengeni is temporarily unavailable — retry.\")\n        : `OpenGeni API ${status}: ${message}`);\n    super(correlationId ? `${displayMessage} Reference: ${correlationId}.` : displayMessage);\n    this.name = \"OpenGeniApiError\";\n    this.status = status;\n    this.code =\n      options.code ??\n      decoded?.code ??\n      (gatewayFailure && fromResponse ? \"upstream_unavailable\" : undefined);\n    this.retryable = options.retryable ?? decoded?.retryable ?? retryableApiStatus(status);\n    this.correlationId = correlationId;\n    this.outcomeUnknown =\n      options.outcomeUnknown ??\n      decoded?.outcomeUnknown ??\n      (gatewayFailure && !!options.mutation && !decoded);\n    this.body = !fromResponse || decoded ? body : \"\";\n    this.details = decoded?.details;\n  }\n}\n\n/** Deployment or organization setup must be completed before private chats can be created. */\nexport class OpenGeniSetupError extends OpenGeniApiError {\n  constructor(error: OpenGeniApiError) {\n    super(error.status, error.body, {\n      code: \"OPENGENI_SETUP_REQUIRED\",\n      retryable: false,\n      correlationId: error.correlationId,\n      displayMessage:\n        \"Private chats require organization_private_session_settings.enabled (migration 0323). \" +\n        \"An organization owner or admin can enable Only me chats in the web app under Organization settings > Security & data, \" +\n        \"or use updateOrganizationPrivateSessionSettings from @opengeni/sdk/organization-private-session-settings \" +\n        \"with enabled: true, the current expectedVersion and a stable operationId \" +\n        \"(PATCH /v1/organizations/:organizationId/private-session-settings; an organization key needs workspace:admin). \" +\n        \"If platform readiness is unavailable, ask the deployment operator to activate session tenancy first.\",\n    });\n    this.name = \"OpenGeniSetupError\";\n  }\n}\n\n/** A settled usage ceiling refuses the next call; retry after reset or an authorized grant. */\nexport class OpenGeniAllowanceExhaustedError extends OpenGeniApiError {\n  readonly scope: \"workspace\" | \"member\";\n  readonly resetsAt: string | null;\n  readonly subjectId: string | undefined;\n\n  constructor(\n    status: number,\n    body: string,\n    options: ConstructorParameters<typeof OpenGeniApiError>[2] = {},\n  ) {\n    super(status, body, {\n      ...options,\n      code: \"allowance_exhausted\",\n      retryable: false,\n      outcomeUnknown: false,\n    });\n    this.name = \"OpenGeniAllowanceExhaustedError\";\n    const refusal = allowanceExhaustedFields(body);\n    this.scope = refusal?.scope ?? \"workspace\";\n    this.resetsAt = refusal?.resetsAt ?? null;\n    this.subjectId = refusal?.subjectId;\n  }\n}\n\n/** Accept both the API error envelope and the standalone admission refusal. */\nexport function allowanceExhaustedFields(body: string): {\n  scope: \"workspace\" | \"member\";\n  resetsAt: string | null;\n  subjectId?: string;\n} | null {\n  try {\n    const parsed: unknown = JSON.parse(body);\n    if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return null;\n    const root = parsed as Record<string, unknown>;\n    const error =\n      root.error && typeof root.error === \"object\" && !Array.isArray(root.error)\n        ? (root.error as Record<string, unknown>)\n        : root;\n    if (error.code !== \"allowance_exhausted\") return null;\n    const fields =\n      error.details && typeof error.details === \"object\" && !Array.isArray(error.details)\n        ? (error.details as Record<string, unknown>)\n        : error;\n    if (fields.scope !== \"workspace\" && fields.scope !== \"member\") return null;\n    if (fields.resetsAt !== null && typeof fields.resetsAt !== \"string\") return null;\n    return {\n      scope: fields.scope,\n      resetsAt: fields.resetsAt,\n      ...(typeof fields.subjectId === \"string\" ? { subjectId: fields.subjectId } : {}),\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport type OpenGeniSecureContextRequiredReason = \"insecure_context\" | \"web_crypto_unavailable\";\n\n/**\n * A browser operation requires secure-context-only platform capabilities.\n * Callers may key UI behavior on the stable `secure_context_required` code;\n * `reason` exists only to keep the human guidance truthful.\n */\nexport class OpenGeniSecureContextRequiredError extends Error {\n  readonly code = \"secure_context_required\" as const;\n  readonly retryable = false;\n  readonly reason: OpenGeniSecureContextRequiredReason;\n\n  constructor(reason: OpenGeniSecureContextRequiredReason) {\n    super(\n      reason === \"insecure_context\"\n        ? \"Couldn’t attach this file because Opengeni is open over HTTP. Attachments require a secure HTTPS connection. Open the secure site or configure HTTPS for this deployment.\"\n        : \"Couldn’t attach this file because secure browser cryptography is unavailable. Attachments require HTTPS and Web Crypto support. Open a secure site in a supported browser or configure HTTPS for this deployment.\",\n    );\n    this.name = \"OpenGeniSecureContextRequiredError\";\n    this.reason = reason;\n  }\n}\n\nfunction decodeApiErrorBody(body: string): {\n  code: string | undefined;\n  message: string | undefined;\n  requestId: string | undefined;\n  retryable: boolean | undefined;\n  outcomeUnknown: boolean | undefined;\n  details: Record<string, unknown> | undefined;\n} | null {\n  if (!body) return null;\n  try {\n    const decoded: unknown = JSON.parse(body);\n    if (!decoded || typeof decoded !== \"object\" || Array.isArray(decoded)) return null;\n    const record = decoded as Record<string, unknown>;\n    const nested =\n      record.error && typeof record.error === \"object\" && !Array.isArray(record.error)\n        ? (record.error as Record<string, unknown>)\n        : record;\n    const code = boundedApiField(nested.code);\n    const message = boundedApiField(nested.message);\n    const requestId = boundedCorrelationId(nested.requestId);\n    const retryable = typeof nested.retryable === \"boolean\" ? nested.retryable : undefined;\n    const outcomeUnknown =\n      typeof nested.outcomeUnknown === \"boolean\" ? nested.outcomeUnknown : undefined;\n    const details = boundedApiDetails(nested.details);\n    if (\n      !code &&\n      !message &&\n      !requestId &&\n      retryable === undefined &&\n      outcomeUnknown === undefined &&\n      !details\n    )\n      return null;\n    return {\n      code,\n      message,\n      requestId,\n      retryable,\n      outcomeUnknown,\n      details,\n    };\n  } catch {\n    return null;\n  }\n}\n\nfunction boundedApiDetails(value: unknown): Record<string, unknown> | undefined {\n  if (!value || typeof value !== \"object\" || Array.isArray(value)) return;\n  const entries = Object.entries(value as Record<string, unknown>).slice(0, 16);\n  const details: Record<string, unknown> = {};\n  for (const [key, entry] of entries) {\n    if (!/^[a-zA-Z][\\w.-]{0,63}$/.test(key)) continue;\n    if (typeof entry === \"string\") {\n      const bounded = boundedApiField(entry);\n      if (bounded !== undefined) details[key] = bounded;\n    } else if (typeof entry === \"number\" || typeof entry === \"boolean\" || entry === null) {\n      details[key] = entry;\n    }\n  }\n  return Object.keys(details).length > 0 ? details : undefined;\n}\n\nfunction boundedApiField(value: unknown): string | undefined {\n  if (typeof value !== \"string\") return;\n  const bytes = new TextEncoder().encode(value);\n  return bytes.byteLength <= 512 ? value : new TextDecoder().decode(bytes.slice(0, 512));\n}\n\nfunction retryableApiStatus(status: number): boolean {\n  return status === 408 || status === 409 || status === 425 || status === 429 || status >= 500;\n}\n\nfunction boundedCorrelationId(value: unknown): string | undefined {\n  if (typeof value !== \"string\" || value.length > 128 || !/^[\\w.:-]+$/.test(value)) {\n    return;\n  }\n  return value;\n}\n\n/** A legacy short-lived session-list snapshot cursor can no longer be continued. */\nexport class OpenGeniSessionListCursorError extends OpenGeniApiError {}\n\n/** The browser bundle and API disagree about their state-changing wire contract. */\nexport class OpenGeniApiContractMismatchError extends Error {\n  readonly expected: string;\n  readonly actual: string;\n\n  constructor(expected: string, actual: string) {\n    super(`OpenGeni API contract mismatch: client expects ${expected}, API serves ${actual}`);\n    this.name = \"OpenGeniApiContractMismatchError\";\n    this.expected = expected;\n    this.actual = actual;\n  }\n}\n\n/** Error for an unrecoverable event-stream condition (not a transient drop). */\nexport class OpenGeniStreamError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"OpenGeniStreamError\";\n  }\n}\n\n/**\n * Brand-neutral end-user copy for a failed SDK operation. Error.message, body,\n * details and typed fields remain unchanged for diagnostics and host policy.\n * Never use this to rewrite user, assistant or tool content.\n */\nexport function formatErrorMessage(\n  error: unknown,\n  fallback = \"The request could not be completed.\",\n): string {\n  if (error instanceof OpenGeniApiError) {\n    let message: string;\n    if (error.outcomeUnknown) {\n      message = \"The request could not be confirmed. Check its status before retrying.\";\n    } else if (\n      error instanceof OpenGeniSetupError ||\n      error.code === \"OPENGENI_SETUP_REQUIRED\" ||\n      error.code === \"SESSION_TENANCY_NOT_ACTIVATED\"\n    ) {\n      message = \"Private conversations are unavailable. Ask an administrator to enable them.\";\n    } else if (error.code === \"allowance_exhausted\") {\n      message = \"Usage limit reached. Wait for the reset or ask an administrator for more usage.\";\n    } else if (error instanceof OpenGeniSessionListCursorError) {\n      message = \"The conversation list changed. Refresh and try again.\";\n    } else if (error.status === 401) {\n      message = \"Sign in to continue.\";\n    } else if (error.status === 403) {\n      message = \"You don’t have permission to do that.\";\n    } else if (error.status === 404) {\n      message = \"The requested item is unavailable.\";\n    } else if (error.status === 402 || error.code === \"payment_required\") {\n      message = \"There are not enough credits to continue.\";\n    } else if (error.status === 429 || error.code === \"rate_limited\") {\n      message = error.retryable\n        ? \"Too many requests. Wait a moment and try again.\"\n        : \"This request is unavailable. Ask an administrator for help.\";\n    } else if (error.status === 409) {\n      message = \"The request conflicts with the current state. Refresh and try again.\";\n    } else if (error.status === 400 || error.status === 422) {\n      message = \"The request could not be accepted. Check your input and try again.\";\n    } else if (error.status === 408 || error.status === 425 || error.status === 0) {\n      message = error.retryable\n        ? \"The connection could not be completed. Try again later.\"\n        : fallback;\n    } else if (error.status >= 500) {\n      message = error.retryable\n        ? \"The service is temporarily unavailable. Try again later.\"\n        : \"The service is unavailable. Ask an administrator for help.\";\n    } else {\n      message = fallback;\n    }\n    return error.correlationId ? `${message} Reference: ${error.correlationId}.` : message;\n  }\n  if (\n    error instanceof OpenGeniSecureContextRequiredError ||\n    (error instanceof Error && \"code\" in error && error.code === \"secure_context_required\")\n  ) {\n    return \"reason\" in error && error.reason === \"insecure_context\"\n      ? \"Attachments require HTTPS. Open this page over a secure connection.\"\n      : \"Attachments require secure browser cryptography. Use a supported browser over HTTPS.\";\n  }\n  if (error instanceof OpenGeniApiContractMismatchError) {\n    return \"This page is out of date. Reload it before trying again.\";\n  }\n  if (error instanceof OpenGeniStreamError) {\n    return \"The live connection could not be restored. Refresh to check the latest state.\";\n  }\n  return fallback;\n}\n\nexport function isAbortError(error: unknown): boolean {\n  return (\n    (error instanceof DOMException && error.name === \"AbortError\") ||\n    (error instanceof Error && error.name === \"AbortError\")\n  );\n}\n\n/**\n * Transient conditions worth a reconnect: network-level failures (`fetch`\n * rejects with `TypeError`) and HTTP statuses that signal a temporary server\n * or contention condition. Auth/validation failures (401/403/404/...) are\n * permanent and surface to the caller instead.\n */\nexport function isRetryableStreamError(error: unknown): boolean {\n  if (error instanceof OpenGeniApiError) return error.retryable;\n  return error instanceof TypeError;\n}\n"],"mappings":";AACO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,QACA,MACA,UAOI,CAAC,GACL;AACA,UAAM,UAAU,mBAAmB,IAAI;AACvC,UAAM,gBAAgB,SAAS,aAAa,qBAAqB,QAAQ,aAAa;AACtF,UAAM,iBAAiB,UAAU,OAAO,UAAU;AAClD,UAAM,eAAe,QAAQ,aAAa;AAC1C,UAAM,UAAU,SAAS,YAAY,eAAe,oBAAoB,QAAQ;AAChF,UAAM,iBACJ,QAAQ,mBACP,kBAAkB,eACd,SAAS,WAAW,sDACrB,gBAAgB,MAAM,KAAK,OAAO;AACxC,UAAM,gBAAgB,GAAG,cAAc,eAAe,aAAa,MAAM,cAAc;AACvF,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OACH,QAAQ,QACR,SAAS,SACR,kBAAkB,eAAe,yBAAyB;AAC7D,SAAK,YAAY,QAAQ,aAAa,SAAS,aAAa,mBAAmB,MAAM;AACrF,SAAK,gBAAgB;AACrB,SAAK,iBACH,QAAQ,kBACR,SAAS,mBACR,kBAAkB,CAAC,CAAC,QAAQ,YAAY,CAAC;AAC5C,SAAK,OAAO,CAAC,gBAAgB,UAAU,OAAO;AAC9C,SAAK,UAAU,SAAS;AAAA,EAC1B;AACF;AAGO,IAAM,qBAAN,cAAiC,iBAAiB;AAAA,EACvD,YAAY,OAAyB;AACnC,UAAM,MAAM,QAAQ,MAAM,MAAM;AAAA,MAC9B,MAAM;AAAA,MACN,WAAW;AAAA,MACX,eAAe,MAAM;AAAA,MACrB,gBACE;AAAA,IAMJ,CAAC;AACD,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,kCAAN,cAA8C,iBAAiB;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EAET,YACE,QACA,MACA,UAA6D,CAAC,GAC9D;AACA,UAAM,QAAQ,MAAM;AAAA,MAClB,GAAG;AAAA,MACH,MAAM;AAAA,MACN,WAAW;AAAA,MACX,gBAAgB;AAAA,IAClB,CAAC;AACD,SAAK,OAAO;AACZ,UAAM,UAAU,yBAAyB,IAAI;AAC7C,SAAK,QAAQ,SAAS,SAAS;AAC/B,SAAK,WAAW,SAAS,YAAY;AACrC,SAAK,YAAY,SAAS;AAAA,EAC5B;AACF;AAGO,SAAS,yBAAyB,MAIhC;AACP,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,IAAI;AACvC,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO;AAC3E,UAAM,OAAO;AACb,UAAM,QACJ,KAAK,SAAS,OAAO,KAAK,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,IACpE,KAAK,QACN;AACN,QAAI,MAAM,SAAS,sBAAuB,QAAO;AACjD,UAAM,SACJ,MAAM,WAAW,OAAO,MAAM,YAAY,YAAY,CAAC,MAAM,QAAQ,MAAM,OAAO,IAC7E,MAAM,UACP;AACN,QAAI,OAAO,UAAU,eAAe,OAAO,UAAU,SAAU,QAAO;AACtE,QAAI,OAAO,aAAa,QAAQ,OAAO,OAAO,aAAa,SAAU,QAAO;AAC5E,WAAO;AAAA,MACL,OAAO,OAAO;AAAA,MACd,UAAU,OAAO;AAAA,MACjB,GAAI,OAAO,OAAO,cAAc,WAAW,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAChF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,IAAM,qCAAN,cAAiD,MAAM;AAAA,EACnD,OAAO;AAAA,EACP,YAAY;AAAA,EACZ;AAAA,EAET,YAAY,QAA6C;AACvD;AAAA,MACE,WAAW,qBACP,mLACA;AAAA,IACN;AACA,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEA,SAAS,mBAAmB,MAOnB;AACP,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,UAAmB,KAAK,MAAM,IAAI;AACxC,QAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG,QAAO;AAC9E,UAAM,SAAS;AACf,UAAM,SACJ,OAAO,SAAS,OAAO,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,OAAO,KAAK,IAC1E,OAAO,QACR;AACN,UAAM,OAAO,gBAAgB,OAAO,IAAI;AACxC,UAAM,UAAU,gBAAgB,OAAO,OAAO;AAC9C,UAAM,YAAY,qBAAqB,OAAO,SAAS;AACvD,UAAM,YAAY,OAAO,OAAO,cAAc,YAAY,OAAO,YAAY;AAC7E,UAAM,iBACJ,OAAO,OAAO,mBAAmB,YAAY,OAAO,iBAAiB;AACvE,UAAM,UAAU,kBAAkB,OAAO,OAAO;AAChD,QACE,CAAC,QACD,CAAC,WACD,CAAC,aACD,cAAc,UACd,mBAAmB,UACnB,CAAC;AAED,aAAO;AACT,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,kBAAkB,OAAqD;AAC9E,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG;AACjE,QAAM,UAAU,OAAO,QAAQ,KAAgC,EAAE,MAAM,GAAG,EAAE;AAC5E,QAAM,UAAmC,CAAC;AAC1C,aAAW,CAAC,KAAK,KAAK,KAAK,SAAS;AAClC,QAAI,CAAC,yBAAyB,KAAK,GAAG,EAAG;AACzC,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,UAAU,gBAAgB,KAAK;AACrC,UAAI,YAAY,OAAW,SAAQ,GAAG,IAAI;AAAA,IAC5C,WAAW,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,UAAU,MAAM;AACpF,cAAQ,GAAG,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,UAAU;AACrD;AAEA,SAAS,gBAAgB,OAAoC;AAC3D,MAAI,OAAO,UAAU,SAAU;AAC/B,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK;AAC5C,SAAO,MAAM,cAAc,MAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,MAAM,MAAM,GAAG,GAAG,CAAC;AACvF;AAEA,SAAS,mBAAmB,QAAyB;AACnD,SAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,UAAU;AAC3F;AAEA,SAAS,qBAAqB,OAAoC;AAChE,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,OAAO,CAAC,aAAa,KAAK,KAAK,GAAG;AAChF;AAAA,EACF;AACA,SAAO;AACT;AAGO,IAAM,iCAAN,cAA6C,iBAAiB;AAAC;AAG/D,IAAM,mCAAN,cAA+C,MAAM;AAAA,EACjD;AAAA,EACA;AAAA,EAET,YAAY,UAAkB,QAAgB;AAC5C,UAAM,kDAAkD,QAAQ,gBAAgB,MAAM,EAAE;AACxF,SAAK,OAAO;AACZ,SAAK,WAAW;AAChB,SAAK,SAAS;AAAA,EAChB;AACF;AAGO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAOO,SAAS,mBACd,OACA,WAAW,uCACH;AACR,MAAI,iBAAiB,kBAAkB;AACrC,QAAI;AACJ,QAAI,MAAM,gBAAgB;AACxB,gBAAU;AAAA,IACZ,WACE,iBAAiB,sBACjB,MAAM,SAAS,6BACf,MAAM,SAAS,iCACf;AACA,gBAAU;AAAA,IACZ,WAAW,MAAM,SAAS,uBAAuB;AAC/C,gBAAU;AAAA,IACZ,WAAW,iBAAiB,gCAAgC;AAC1D,gBAAU;AAAA,IACZ,WAAW,MAAM,WAAW,KAAK;AAC/B,gBAAU;AAAA,IACZ,WAAW,MAAM,WAAW,KAAK;AAC/B,gBAAU;AAAA,IACZ,WAAW,MAAM,WAAW,KAAK;AAC/B,gBAAU;AAAA,IACZ,WAAW,MAAM,WAAW,OAAO,MAAM,SAAS,oBAAoB;AACpE,gBAAU;AAAA,IACZ,WAAW,MAAM,WAAW,OAAO,MAAM,SAAS,gBAAgB;AAChE,gBAAU,MAAM,YACZ,oDACA;AAAA,IACN,WAAW,MAAM,WAAW,KAAK;AAC/B,gBAAU;AAAA,IACZ,WAAW,MAAM,WAAW,OAAO,MAAM,WAAW,KAAK;AACvD,gBAAU;AAAA,IACZ,WAAW,MAAM,WAAW,OAAO,MAAM,WAAW,OAAO,MAAM,WAAW,GAAG;AAC7E,gBAAU,MAAM,YACZ,4DACA;AAAA,IACN,WAAW,MAAM,UAAU,KAAK;AAC9B,gBAAU,MAAM,YACZ,6DACA;AAAA,IACN,OAAO;AACL,gBAAU;AAAA,IACZ;AACA,WAAO,MAAM,gBAAgB,GAAG,OAAO,eAAe,MAAM,aAAa,MAAM;AAAA,EACjF;AACA,MACE,iBAAiB,sCAChB,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,2BAC7D;AACA,WAAO,YAAY,SAAS,MAAM,WAAW,qBACzC,wEACA;AAAA,EACN;AACA,MAAI,iBAAiB,kCAAkC;AACrD,WAAO;AAAA,EACT;AACA,MAAI,iBAAiB,qBAAqB;AACxC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,aAAa,OAAyB;AACpD,SACG,iBAAiB,gBAAgB,MAAM,SAAS,gBAChD,iBAAiB,SAAS,MAAM,SAAS;AAE9C;AAQO,SAAS,uBAAuB,OAAyB;AAC9D,MAAI,iBAAiB,iBAAkB,QAAO,MAAM;AACpD,SAAO,iBAAiB;AAC1B;","names":[]}

package/dist/chunk-WU6GQG25.js

@@ -0,0 +1,268 @@
+// ../contracts/src/workspace-integration-wire.ts
+var WORKSPACE_WEBHOOK_EVENT_TYPES = [
+  "turn.completed",
+  "turn.failed",
+  "turn.cancelled",
+  "session.status.changed",
+  "session.requiresAction",
+  "session.humanInput.requested",
+  "usage.threshold_reached",
+  "usage.exhausted",
+  "usage.period_reset"
+];
+var OPENGENI_WEBHOOK_TEST_EVENT_TYPE = "webhook.test";
+var OPENGENI_TEST_REQUEST_NIL_ID = "00000000-0000-0000-0000-000000000000";
+var OPENGENI_SIGNATURE_HEADER = "OpenGeni-Signature";
+var OPENGENI_EVENT_ID_HEADER = "OpenGeni-Event-Id";
+var OPENGENI_DELIVERY_ID_HEADER = "OpenGeni-Delivery-Id";
+var OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;
+var encoder = new TextEncoder();
+async function hmacSha256Hex(secret, message) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(message)));
+  return Array.from(signature, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function constantTimeEqualHex(left, right) {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  }
+  return difference === 0;
+}
+async function signOpenGeniPayload(secret, body, timestampSeconds = Math.floor(Date.now() / 1e3)) {
+  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;
+}
+async function verifyOpenGeniSignature(input) {
+  if (!input.signature) return false;
+  let timestamp = null;
+  const candidates = [];
+  for (const part of input.signature.split(",")) {
+    const [key, value] = part.trim().split("=", 2);
+    if (key === "t" && value && /^\d{1,12}$/.test(value)) timestamp = Number(value);
+    if (key === "v1" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);
+  }
+  if (timestamp === null || candidates.length === 0) return false;
+  const now = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;
+  if (Math.abs(now - timestamp) > tolerance) return false;
+  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);
+  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));
+}
+
+// src/workspace-integrations.ts
+var OpenGeniSignatureError = class extends Error {
+  constructor() {
+    super("Opengeni signature verification failed");
+    this.name = "OpenGeniSignatureError";
+  }
+};
+function header(headers, name) {
+  if (headers instanceof Headers) return headers.get(name);
+  const wanted = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === wanted) {
+      return Array.isArray(value) ? value[0] ?? null : value ?? null;
+    }
+  }
+  return null;
+}
+async function verifiedObject(input) {
+  const valid = await verifyOpenGeniSignature({
+    secret: input.secret,
+    body: input.body,
+    signature: header(input.headers, OPENGENI_SIGNATURE_HEADER),
+    ...input.toleranceSeconds !== void 0 ? { toleranceSeconds: input.toleranceSeconds } : {}
+  });
+  if (!valid) throw new OpenGeniSignatureError();
+  const parsed = JSON.parse(input.body);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new OpenGeniSignatureError();
+  }
+  return parsed;
+}
+async function verifyWebhookEvent(input) {
+  const event = await verifiedObject(input);
+  const usageEvent = typeof event.type === "string" && event.type.startsWith("usage.");
+  const lane = event.lane === void 0 ? "workspace" : event.lane;
+  if (typeof event.id !== "string" || typeof event.type !== "string" || typeof event.workspaceId !== "string" || lane !== "workspace" && lane !== "organization" || usageEvent && lane !== "workspace" || !(typeof event.sessionId === "string" || (event.sessionId === null || event.sessionId === void 0) && [
+    "usage.threshold_reached",
+    "usage.exhausted",
+    "usage.period_reset",
+    OPENGENI_WEBHOOK_TEST_EVENT_TYPE
+  ].includes(event.type))) {
+    throw new OpenGeniSignatureError();
+  }
+  return {
+    event: { ...event, lane },
+    deliveryId: header(input.headers, OPENGENI_DELIVERY_ID_HEADER)
+  };
+}
+async function verifyCredentialProviderRequest(input) {
+  const parsed = await verifiedObject(input);
+  if (parsed.type !== "credentials.request" || typeof parsed.workspaceId !== "string") {
+    throw new OpenGeniSignatureError();
+  }
+  return parsed;
+}
+var OPENGENI_WEBHOOK_HEADERS = {
+  signature: OPENGENI_SIGNATURE_HEADER,
+  eventId: OPENGENI_EVENT_ID_HEADER,
+  deliveryId: OPENGENI_DELIVERY_ID_HEADER
+};
+async function getOrganizationCredentialProvider(client, organizationId) {
+  return client.requestJson(
+    "GET",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`
+  );
+}
+async function putOrganizationCredentialProvider(client, organizationId, request) {
+  return client.requestJson(
+    "PUT",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,
+    request
+  );
+}
+async function deleteOrganizationCredentialProvider(client, organizationId) {
+  await client.requestJson(
+    "DELETE",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,
+    void 0,
+    {},
+    { responseType: "void" }
+  );
+}
+async function listOrganizationWebhooks(client, organizationId) {
+  return client.requestJson(
+    "GET",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`
+  );
+}
+async function createOrganizationWebhook(client, organizationId, request) {
+  return client.requestJson(
+    "POST",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`,
+    request
+  );
+}
+async function getOrganizationWebhook(client, organizationId, webhookId) {
+  return client.requestJson(
+    "GET",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`
+  );
+}
+async function updateOrganizationWebhook(client, organizationId, webhookId, request) {
+  return client.requestJson(
+    "PATCH",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,
+    request
+  );
+}
+async function deleteOrganizationWebhook(client, organizationId, webhookId) {
+  await client.requestJson(
+    "DELETE",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,
+    void 0,
+    {},
+    { responseType: "void" }
+  );
+}
+async function listOrganizationWebhookDeliveries(client, organizationId, webhookId, options = {}) {
+  return client.requestJson(
+    "GET",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries`,
+    void 0,
+    options.limit !== void 0 ? { limit: String(options.limit) } : {}
+  );
+}
+async function redeliverOrganizationWebhookDelivery(client, organizationId, webhookId, deliveryId) {
+  return client.requestJson(
+    "POST",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries/${encodeURIComponent(deliveryId)}/redeliver`
+  );
+}
+async function getWorkspaceWebhook(client, workspaceId, webhookId) {
+  return client.requestJson("GET", `/v1/workspaces/${workspaceId}/webhooks/${webhookId}`);
+}
+async function rotateWorkspaceCredentialProviderSecret(client, workspaceId) {
+  return client.requestJson(
+    "POST",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/rotate-secret`
+  );
+}
+async function rotateOrganizationCredentialProviderSecret(client, organizationId) {
+  return client.requestJson(
+    "POST",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider/rotate-secret`
+  );
+}
+async function rotateOrganizationWebhookSecret(client, organizationId, webhookId) {
+  return client.requestJson(
+    "POST",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`
+  );
+}
+async function rotateWorkspaceWebhookSecret(client, workspaceId, webhookId) {
+  return client.requestJson(
+    "POST",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`
+  );
+}
+async function testWorkspaceWebhook(client, workspaceId, webhookId) {
+  return client.requestJson(
+    "POST",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/test`
+  );
+}
+async function testWorkspaceCredentialProvider(client, workspaceId) {
+  return client.requestJson(
+    "POST",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/test`
+  );
+}
+async function getWorkspaceInheritedIntegrations(client, workspaceId) {
+  return client.requestJson(
+    "GET",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/inherited-integrations`
+  );
+}
+
+export {
+  WORKSPACE_WEBHOOK_EVENT_TYPES,
+  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
+  OPENGENI_TEST_REQUEST_NIL_ID,
+  OPENGENI_SIGNATURE_HEADER,
+  OPENGENI_EVENT_ID_HEADER,
+  OPENGENI_DELIVERY_ID_HEADER,
+  signOpenGeniPayload,
+  verifyOpenGeniSignature,
+  OpenGeniSignatureError,
+  verifyWebhookEvent,
+  verifyCredentialProviderRequest,
+  OPENGENI_WEBHOOK_HEADERS,
+  getOrganizationCredentialProvider,
+  putOrganizationCredentialProvider,
+  deleteOrganizationCredentialProvider,
+  listOrganizationWebhooks,
+  createOrganizationWebhook,
+  getOrganizationWebhook,
+  updateOrganizationWebhook,
+  deleteOrganizationWebhook,
+  listOrganizationWebhookDeliveries,
+  redeliverOrganizationWebhookDelivery,
+  getWorkspaceWebhook,
+  rotateWorkspaceCredentialProviderSecret,
+  rotateOrganizationCredentialProviderSecret,
+  rotateOrganizationWebhookSecret,
+  rotateWorkspaceWebhookSecret,
+  testWorkspaceWebhook,
+  testWorkspaceCredentialProvider,
+  getWorkspaceInheritedIntegrations
+};
+//# sourceMappingURL=chunk-WU6GQG25.js.map

package/dist/chunk-WU6GQG25.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../contracts/src/workspace-integration-wire.ts","../src/workspace-integrations.ts"],"sourcesContent":["/**\n * Dependency-free wire constants and the OpenGeni-Signature scheme shared by\n * workspace webhooks and credential providers. Kept free of zod so browser and\n * React Native bundles can verify signatures without the schema runtime.\n */\n\nexport const WORKSPACE_WEBHOOK_EVENT_TYPES = [\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.humanInput.requested\",\n  \"usage.threshold_reached\",\n  \"usage.exhausted\",\n  \"usage.period_reset\",\n] as const;\n\n/**\n * Sent only when an administrator presses \"Send test event\". It is never a\n * subscribable type: every endpoint can receive it, and a receiver that does\n * not care acknowledges it with any 2xx.\n */\nexport const OPENGENI_WEBHOOK_TEST_EVENT_TYPE = \"webhook.test\";\n\n/**\n * The session, turn and attempt ids of a credential-provider test request\n * (`purpose: \"test\"`). A test is not a run, so no real ids exist.\n */\nexport const OPENGENI_TEST_REQUEST_NIL_ID = \"00000000-0000-0000-0000-000000000000\";\n\nexport const OPENGENI_SIGNATURE_HEADER = \"OpenGeni-Signature\";\nexport const OPENGENI_EVENT_ID_HEADER = \"OpenGeni-Event-Id\";\nexport const OPENGENI_DELIVERY_ID_HEADER = \"OpenGeni-Delivery-Id\";\nexport const OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;\n\nconst encoder = new TextEncoder();\n\nasync function hmacSha256Hex(secret: string, message: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, encoder.encode(message)));\n  return Array.from(signature, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction constantTimeEqualHex(left: string, right: string): boolean {\n  if (left.length !== right.length) return false;\n  let difference = 0;\n  for (let index = 0; index < left.length; index += 1) {\n    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);\n  }\n  return difference === 0;\n}\n\n/**\n * `OpenGeni-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, \"<t>.<body>\")>`.\n * The timestamp is signed so a captured request cannot be replayed later.\n */\nexport async function signOpenGeniPayload(\n  secret: string,\n  body: string,\n  timestampSeconds = Math.floor(Date.now() / 1000),\n): Promise<string> {\n  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;\n}\n\nexport type VerifyOpenGeniSignatureInput = {\n  secret: string;\n  /** The exact raw request body, before JSON parsing. */\n  body: string;\n  /** The `OpenGeni-Signature` header value. */\n  signature: string | null | undefined;\n  toleranceSeconds?: number;\n  nowSeconds?: number;\n};\n\nexport async function verifyOpenGeniSignature(\n  input: VerifyOpenGeniSignatureInput,\n): Promise<boolean> {\n  if (!input.signature) return false;\n  let timestamp: number | null = null;\n  const candidates: string[] = [];\n  for (const part of input.signature.split(\",\")) {\n    const [key, value] = part.trim().split(\"=\", 2);\n    if (key === \"t\" && value && /^\\d{1,12}$/.test(value)) timestamp = Number(value);\n    if (key === \"v1\" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);\n  }\n  if (timestamp === null || candidates.length === 0) return false;\n  const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;\n  if (Math.abs(now - timestamp) > tolerance) return false;\n  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);\n  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));\n}\n","import {\n  OPENGENI_DELIVERY_ID_HEADER,\n  OPENGENI_EVENT_ID_HEADER,\n  OPENGENI_SIGNATURE_HEADER,\n  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n  verifyOpenGeniSignature,\n} from \"@opengeni/contracts/workspace-integration-wire\";\nimport type { CredentialProviderRequest, WorkspaceWebhookEvent } from \"@opengeni/contracts\";\nimport type { OpenGeniClient } from \"./client\";\nimport type {\n  CreateOrganizationWebhookRequest,\n  CreateOrganizationWebhookResponse,\n  GetOrganizationCredentialProviderResponse,\n  ListOrganizationWebhookDeliveriesResponse,\n  ListOrganizationWebhooksResponse,\n  OrganizationWebhook,\n  OrganizationWebhookDelivery,\n  PutOrganizationCredentialProviderRequest,\n  PutOrganizationCredentialProviderResponse,\n  RotateWorkspaceCredentialProviderSecretResponse,\n  RotateOrganizationCredentialProviderSecretResponse,\n  RotateWorkspaceWebhookSecretResponse,\n  RotateOrganizationWebhookSecretResponse,\n  TestWorkspaceCredentialProviderResponse,\n  TestWorkspaceWebhookResponse,\n  UpdateOrganizationWebhookRequest,\n  WorkspaceInheritedIntegrationsResponse,\n  WorkspaceWebhook,\n} from \"@opengeni/contracts\";\n\nexport type {\n  CreateOrganizationWebhookRequest,\n  CreateOrganizationWebhookResponse,\n  CreateWorkspaceWebhookRequest,\n  CreateWorkspaceWebhookResponse,\n  CredentialProviderRequest,\n  CredentialProviderInitiatorContext,\n  CredentialProviderResponse,\n  CredentialProviderMcpHeaders,\n  CredentialProviderMcpMaterial,\n  GetOrganizationCredentialProviderResponse,\n  GetWorkspaceCredentialProviderResponse,\n  InitiatingHuman,\n  IntegrationEndpointTestResult,\n  IntegrationWorkspaceFilter,\n  ListOrganizationWebhookDeliveriesResponse,\n  ListOrganizationWebhooksResponse,\n  ListWorkspaceWebhookDeliveriesResponse,\n  ListWorkspaceWebhooksResponse,\n  PutWorkspaceCredentialProviderRequest,\n  PutWorkspaceCredentialProviderResponse,\n  PutOrganizationCredentialProviderRequest,\n  PutOrganizationCredentialProviderResponse,\n  RotateWorkspaceCredentialProviderSecretResponse,\n  RotateOrganizationCredentialProviderSecretResponse,\n  RotateWorkspaceWebhookSecretResponse,\n  RotateOrganizationWebhookSecretResponse,\n  TestWorkspaceCredentialProviderResponse,\n  TestWorkspaceWebhookResponse,\n  OrganizationCredentialProvider,\n  OrganizationWebhook,\n  OrganizationWebhookDelivery,\n  UpdateOrganizationWebhookRequest,\n  UpdateWorkspaceWebhookRequest,\n  WorkspaceCredentialProvider,\n  WorkspaceInheritedIntegrationsResponse,\n  WorkspaceTestWebhookEvent,\n  WorkspaceWebhook,\n  WorkspaceWebhookDelivery,\n  WorkspaceWebhookEvent,\n  WorkspaceWebhookEventType,\n  SessionWorkspaceWebhookEvent,\n  WorkspaceUsageWebhookEvent,\n} from \"@opengeni/contracts\";\nexport {\n  OPENGENI_DELIVERY_ID_HEADER,\n  OPENGENI_EVENT_ID_HEADER,\n  OPENGENI_SIGNATURE_HEADER,\n  OPENGENI_TEST_REQUEST_NIL_ID,\n  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n  WORKSPACE_WEBHOOK_EVENT_TYPES,\n  signOpenGeniPayload,\n  verifyOpenGeniSignature,\n} from \"@opengeni/contracts/workspace-integration-wire\";\n\nexport type WorkspaceSandboxImages = { images: string[]; selected: string | null };\n\nexport class OpenGeniSignatureError extends Error {\n  constructor() {\n    super(\"Opengeni signature verification failed\");\n    this.name = \"OpenGeniSignatureError\";\n  }\n}\n\ntype SignedRequest = {\n  /** The exact raw request body. Parse it only after verification. */\n  body: string;\n  headers: Headers | Record<string, string | string[] | undefined>;\n  secret: string;\n  toleranceSeconds?: number;\n};\n\nfunction header(headers: SignedRequest[\"headers\"], name: string): string | null {\n  if (headers instanceof Headers) return headers.get(name);\n  const wanted = name.toLowerCase();\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === wanted) {\n      return Array.isArray(value) ? (value[0] ?? null) : (value ?? null);\n    }\n  }\n  return null;\n}\n\nasync function verifiedObject(input: SignedRequest): Promise<Record<string, unknown>> {\n  const valid = await verifyOpenGeniSignature({\n    secret: input.secret,\n    body: input.body,\n    signature: header(input.headers, OPENGENI_SIGNATURE_HEADER),\n    ...(input.toleranceSeconds !== undefined ? { toleranceSeconds: input.toleranceSeconds } : {}),\n  });\n  if (!valid) throw new OpenGeniSignatureError();\n  const parsed: unknown = JSON.parse(input.body);\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new OpenGeniSignatureError();\n  }\n  return parsed as Record<string, unknown>;\n}\n\n/**\n * Verify and parse one webhook delivery. Delivery is at least once: dedupe on\n * `event.id` (also sent as the `OpenGeni-Event-Id` header). A `webhook.test`\n * event (from \"Send test event\") names no session: acknowledge it with 2xx.\n */\nexport async function verifyWebhookEvent(input: SignedRequest): Promise<{\n  event: WorkspaceWebhookEvent;\n  deliveryId: string | null;\n}> {\n  const event = await verifiedObject(input);\n  const usageEvent = typeof event.type === \"string\" && event.type.startsWith(\"usage.\");\n  const lane = event.lane === undefined ? \"workspace\" : event.lane;\n  if (\n    typeof event.id !== \"string\" ||\n    typeof event.type !== \"string\" ||\n    typeof event.workspaceId !== \"string\" ||\n    (lane !== \"workspace\" && lane !== \"organization\") ||\n    (usageEvent && lane !== \"workspace\") ||\n    !(\n      typeof event.sessionId === \"string\" ||\n      ((event.sessionId === null || event.sessionId === undefined) &&\n        [\n          \"usage.threshold_reached\",\n          \"usage.exhausted\",\n          \"usage.period_reset\",\n          OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n        ].includes(event.type))\n    )\n  ) {\n    throw new OpenGeniSignatureError();\n  }\n  return {\n    event: { ...event, lane } as WorkspaceWebhookEvent,\n    deliveryId: header(input.headers, OPENGENI_DELIVERY_ID_HEADER),\n  };\n}\n\n/**\n * Verify the exact bytes and parse a provider request, including its frozen\n * initiatorContext when sent by an upgraded worker. Provenance grants no access.\n */\nexport async function verifyCredentialProviderRequest(\n  input: SignedRequest,\n): Promise<CredentialProviderRequest> {\n  const parsed = await verifiedObject(input);\n  if (parsed.type !== \"credentials.request\" || typeof parsed.workspaceId !== \"string\") {\n    throw new OpenGeniSignatureError();\n  }\n  return parsed as CredentialProviderRequest;\n}\n\n/** Identity header names, for receivers that log or dedupe. */\nexport const OPENGENI_WEBHOOK_HEADERS = {\n  signature: OPENGENI_SIGNATURE_HEADER,\n  eventId: OPENGENI_EVENT_ID_HEADER,\n  deliveryId: OPENGENI_DELIVERY_ID_HEADER,\n} as const;\n\n/** Server-side integration administration is opt-in, outside the eager browser client. */\nexport async function getOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<GetOrganizationCredentialProviderResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n  );\n}\n\n/** Replace configuration; explicit filter required. Store the first returned signing secret. */\nexport async function putOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  request: PutOrganizationCredentialProviderRequest,\n): Promise<PutOrganizationCredentialProviderResponse> {\n  return client.requestJson(\n    \"PUT\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n    request,\n  );\n}\n\nexport async function deleteOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<void> {\n  await client.requestJson<void>(\n    \"DELETE\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n    undefined,\n    {},\n    { responseType: \"void\" },\n  );\n}\n\nexport async function listOrganizationWebhooks(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<ListOrganizationWebhooksResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`,\n  );\n}\n\n/** Create a webhook and return its signing secret once. */\nexport async function createOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  request: CreateOrganizationWebhookRequest,\n): Promise<CreateOrganizationWebhookResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`,\n    request,\n  );\n}\n\nexport async function getOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<OrganizationWebhook> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n  );\n}\n\nexport async function updateOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  request: UpdateOrganizationWebhookRequest,\n): Promise<OrganizationWebhook> {\n  return client.requestJson(\n    \"PATCH\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n    request,\n  );\n}\n\nexport async function deleteOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<void> {\n  await client.requestJson<void>(\n    \"DELETE\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n    undefined,\n    {},\n    { responseType: \"void\" },\n  );\n}\n\nexport async function listOrganizationWebhookDeliveries(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  options: { limit?: number } = {},\n): Promise<ListOrganizationWebhookDeliveriesResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries`,\n    undefined,\n    options.limit !== undefined ? { limit: String(options.limit) } : {},\n  );\n}\n\n/** Requeue a settled delivery with a fresh attempt budget. */\nexport async function redeliverOrganizationWebhookDelivery(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  deliveryId: string,\n): Promise<OrganizationWebhookDelivery> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries/${encodeURIComponent(deliveryId)}/redeliver`,\n  );\n}\n\nexport async function getWorkspaceWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<WorkspaceWebhook> {\n  return client.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/webhooks/${webhookId}`);\n}\n\n/** Rotate immediately. Store the new secret; the old signing secret stops working. */\nexport async function rotateWorkspaceCredentialProviderSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<RotateWorkspaceCredentialProviderSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/rotate-secret`,\n  );\n}\n\nexport async function rotateOrganizationCredentialProviderSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<RotateOrganizationCredentialProviderSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider/rotate-secret`,\n  );\n}\n\nexport async function rotateOrganizationWebhookSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<RotateOrganizationWebhookSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`,\n  );\n}\n\nexport async function rotateWorkspaceWebhookSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<RotateWorkspaceWebhookSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`,\n  );\n}\n\n/**\n * Send one signed `webhook.test` event to a workspace webhook now and return\n * what the endpoint answered. Nothing is queued or retried.\n */\nexport async function testWorkspaceWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<TestWorkspaceWebhookResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/test`,\n  );\n}\n\n/**\n * Send one signed `purpose: \"test\"` request to the credential provider this\n * workspace's runs use (its own, else the organization's). Only the names of\n * returned credentials come back, never their values.\n */\nexport async function testWorkspaceCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<TestWorkspaceCredentialProviderResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/test`,\n  );\n}\n\n/** Organization registrations that reach this workspace. Workspace administrators only. */\nexport async function getWorkspaceInheritedIntegrations(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<WorkspaceInheritedIntegrationsResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/inherited-integrations`,\n  );\n}\n"],"mappings":";AAMO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,mCAAmC;AAMzC,IAAM,+BAA+B;AAErC,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,8BAA8B;AACpC,IAAM,uCAAuC;AAEpD,IAAM,UAAU,IAAI,YAAY;AAEhC,eAAe,cAAc,QAAgB,SAAkC;AAC7E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,OAAO,CAAC,CAAC;AAC/F,SAAO,MAAM,KAAK,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACpF;AAEA,SAAS,qBAAqB,MAAc,OAAwB;AAClE,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,kBAAc,KAAK,WAAW,KAAK,IAAI,MAAM,WAAW,KAAK;AAAA,EAC/D;AACA,SAAO,eAAe;AACxB;AAMA,eAAsB,oBACpB,QACA,MACA,mBAAmB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC9B;AACjB,SAAO,KAAK,gBAAgB,OAAO,MAAM,cAAc,QAAQ,GAAG,gBAAgB,IAAI,IAAI,EAAE,CAAC;AAC/F;AAYA,eAAsB,wBACpB,OACkB;AAClB,MAAI,CAAC,MAAM,UAAW,QAAO;AAC7B,MAAI,YAA2B;AAC/B,QAAM,aAAuB,CAAC;AAC9B,aAAW,QAAQ,MAAM,UAAU,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE,MAAM,KAAK,CAAC;AAC7C,QAAI,QAAQ,OAAO,SAAS,aAAa,KAAK,KAAK,EAAG,aAAY,OAAO,KAAK;AAC9E,QAAI,QAAQ,QAAQ,SAAS,iBAAiB,KAAK,KAAK,EAAG,YAAW,KAAK,KAAK;AAAA,EAClF;AACA,MAAI,cAAc,QAAQ,WAAW,WAAW,EAAG,QAAO;AAC1D,QAAM,MAAM,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5D,QAAM,YAAY,MAAM,oBAAoB;AAC5C,MAAI,KAAK,IAAI,MAAM,SAAS,IAAI,UAAW,QAAO;AAClD,QAAM,WAAW,MAAM,cAAc,MAAM,QAAQ,GAAG,SAAS,IAAI,MAAM,IAAI,EAAE;AAC/E,SAAO,WAAW,KAAK,CAAC,cAAc,qBAAqB,WAAW,QAAQ,CAAC;AACjF;;;ACXO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,cAAc;AACZ,UAAM,wCAAwC;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAUA,SAAS,OAAO,SAAmC,MAA6B;AAC9E,MAAI,mBAAmB,QAAS,QAAO,QAAQ,IAAI,IAAI;AACvD,QAAM,SAAS,KAAK,YAAY;AAChC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,QAAQ;AAChC,aAAO,MAAM,QAAQ,KAAK,IAAK,MAAM,CAAC,KAAK,OAAS,SAAS;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,eAAe,OAAwD;AACpF,QAAM,QAAQ,MAAM,wBAAwB;AAAA,IAC1C,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,WAAW,OAAO,MAAM,SAAS,yBAAyB;AAAA,IAC1D,GAAI,MAAM,qBAAqB,SAAY,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,EAC7F,CAAC;AACD,MAAI,CAAC,MAAO,OAAM,IAAI,uBAAuB;AAC7C,QAAM,SAAkB,KAAK,MAAM,MAAM,IAAI;AAC7C,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AACT;AAOA,eAAsB,mBAAmB,OAGtC;AACD,QAAM,QAAQ,MAAM,eAAe,KAAK;AACxC,QAAM,aAAa,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,WAAW,QAAQ;AACnF,QAAM,OAAO,MAAM,SAAS,SAAY,cAAc,MAAM;AAC5D,MACE,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,SAAS,YACtB,OAAO,MAAM,gBAAgB,YAC5B,SAAS,eAAe,SAAS,kBACjC,cAAc,SAAS,eACxB,EACE,OAAO,MAAM,cAAc,aACzB,MAAM,cAAc,QAAQ,MAAM,cAAc,WAChD;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,MAAM,IAAI,IAEzB;AACA,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AAAA,IACL,OAAO,EAAE,GAAG,OAAO,KAAK;AAAA,IACxB,YAAY,OAAO,MAAM,SAAS,2BAA2B;AAAA,EAC/D;AACF;AAMA,eAAsB,gCACpB,OACoC;AACpC,QAAM,SAAS,MAAM,eAAe,KAAK;AACzC,MAAI,OAAO,SAAS,yBAAyB,OAAO,OAAO,gBAAgB,UAAU;AACnF,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AACT;AAGO,IAAM,2BAA2B;AAAA,EACtC,WAAW;AAAA,EACX,SAAS;AAAA,EACT,YAAY;AACd;AAGA,eAAsB,kCACpB,QACA,gBACoD;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAGA,eAAsB,kCACpB,QACA,gBACA,SACoD;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,qCACpB,QACA,gBACe;AACf,QAAM,OAAO;AAAA,IACX;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,IACA,CAAC;AAAA,IACD,EAAE,cAAc,OAAO;AAAA,EACzB;AACF;AAEA,eAAsB,yBACpB,QACA,gBAC2C;AAC3C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAGA,eAAsB,0BACpB,QACA,gBACA,SAC4C;AAC5C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,uBACpB,QACA,gBACA,WAC8B;AAC9B,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,eAAsB,0BACpB,QACA,gBACA,WACA,SAC8B;AAC9B,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,EACF;AACF;AAEA,eAAsB,0BACpB,QACA,gBACA,WACe;AACf,QAAM,OAAO;AAAA,IACX;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,IACA,CAAC;AAAA,IACD,EAAE,cAAc,OAAO;AAAA,EACzB;AACF;AAEA,eAAsB,kCACpB,QACA,gBACA,WACA,UAA8B,CAAC,GACqB;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,IACA,QAAQ,UAAU,SAAY,EAAE,OAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC;AAAA,EACpE;AACF;AAGA,eAAsB,qCACpB,QACA,gBACA,WACA,YACsC;AACtC,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC,eAAe,mBAAmB,UAAU,CAAC;AAAA,EAChJ;AACF;AAEA,eAAsB,oBACpB,QACA,aACA,WAC2B;AAC3B,SAAO,OAAO,YAAY,OAAO,kBAAkB,WAAW,aAAa,SAAS,EAAE;AACxF;AAGA,eAAsB,wCACpB,QACA,aAC0D;AAC1D,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;AAEA,eAAsB,2CACpB,QACA,gBAC6D;AAC7D,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAEA,eAAsB,gCACpB,QACA,gBACA,WACkD;AAClD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,eAAsB,6BACpB,QACA,aACA,WAC+C;AAC/C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EAC7F;AACF;AAMA,eAAsB,qBACpB,QACA,aACA,WACuC;AACvC,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EAC7F;AACF;AAOA,eAAsB,gCACpB,QACA,aACkD;AAClD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;AAGA,eAAsB,kCACpB,QACA,aACiD;AACjD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;","names":[]}