@opengeni/sdk 3.1.0 → 3.1.2

package/dist/chunk-QGEIL4TR.js

@@ -0,0 +1,195 @@
+// src/tool-auth.ts
+var TOOL_TOKEN_ISSUER = "opengeni-session-proxy";
+var TOOL_TOKEN_KEY_LABEL = "opengeni-tool-token:v1";
+var TOOL_TOKEN_DEFAULT_TTL_SECONDS = 24 * 60 * 60;
+var MAX_TTL_SECONDS = 7 * 24 * 60 * 60;
+var MAX_HEADER_VALUE_LENGTH = 4096;
+var TOOL_SERVER_URL_ENV = "OPENGENI_TOOL_SERVER_URL";
+var CLOCK_SKEW_SECONDS = 60;
+var ToolRequestError = class extends Error {
+  constructor(code) {
+    super("Tool request is not authorized.");
+    this.code = code;
+    this.name = "ToolRequestError";
+  }
+  status = 401;
+  /** A ready 401 response with a `WWW-Authenticate: Bearer` challenge. */
+  toResponse() {
+    return new Response(JSON.stringify({ error: { code: this.code, message: this.message } }), {
+      status: 401,
+      headers: {
+        "Content-Type": "application/json; charset=utf-8",
+        "WWW-Authenticate": 'Bearer error="invalid_token"'
+      }
+    });
+  }
+};
+async function verifyToolRequest(request, options = {}) {
+  const key = await signingKey(resolveToolTokenSecret(options.secret));
+  const audience = options.audience ?? environment(TOOL_SERVER_URL_ENV);
+  if (!audience) {
+    throw new TypeError(
+      `verifyToolRequest needs the tool server URL: pass { audience } or set ${TOOL_SERVER_URL_ENV}.`
+    );
+  }
+  const authorization = requestAuthorization(request);
+  const match = /^Bearer[ ]+([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)$/i.exec(
+    authorization?.trim() ?? ""
+  );
+  if (!match) throw new ToolRequestError("token_missing");
+  const [header, payload, signature] = match[1].split(".");
+  let protectedHeader;
+  let claims;
+  let signatureBytes;
+  try {
+    signatureBytes = base64UrlDecode(signature);
+    protectedHeader = JSON.parse(utf8(base64UrlDecode(header)));
+    claims = JSON.parse(utf8(base64UrlDecode(payload)));
+  } catch {
+    throw new ToolRequestError("token_malformed");
+  }
+  if (!protectedHeader || typeof protectedHeader !== "object" || protectedHeader.alg !== "HS256" || !claims || typeof claims !== "object" || Array.isArray(claims)) {
+    throw new ToolRequestError("token_malformed");
+  }
+  const valid = await crypto.subtle.verify(
+    "HMAC",
+    key,
+    signatureBytes,
+    new TextEncoder().encode(`${header}.${payload}`)
+  );
+  if (!valid) throw new ToolRequestError("token_invalid");
+  const now = Math.floor(Date.now() / 1e3);
+  const { iss, aud, sub, exp, iat, workspace_id, source, tenant } = claims;
+  if (iss !== TOOL_TOKEN_ISSUER) throw new ToolRequestError("token_invalid");
+  if (typeof exp !== "number" || exp <= now) throw new ToolRequestError("token_expired");
+  if (typeof iat !== "number" || iat > now + CLOCK_SKEW_SECONDS) {
+    throw new ToolRequestError("token_invalid");
+  }
+  if (aud !== audience) {
+    throw new ToolRequestError("token_audience");
+  }
+  if (typeof sub !== "string" || !sub || typeof workspace_id !== "string" || !workspace_id || typeof source !== "string" || tenant !== void 0 && typeof tenant !== "string") {
+    throw new ToolRequestError("token_invalid");
+  }
+  return {
+    user: sub,
+    ...tenant !== void 0 ? { tenant } : {},
+    workspaceId: workspace_id,
+    source,
+    expiresAt: new Date(exp * 1e3)
+  };
+}
+async function mintToolToken(input) {
+  const ttl = input.ttlSeconds ?? TOOL_TOKEN_DEFAULT_TTL_SECONDS;
+  if (!Number.isSafeInteger(ttl) || ttl < 1 || ttl > MAX_TTL_SECONDS) {
+    throw new TypeError(`ttlSeconds must be an integer from 1 to ${MAX_TTL_SECONDS}.`);
+  }
+  const key = await signingKey(resolveToolTokenSecret(input.secret));
+  const now = Math.floor(Date.now() / 1e3);
+  const header = base64UrlJson({ alg: "HS256", typ: "JWT" });
+  const payload = base64UrlJson({
+    iss: TOOL_TOKEN_ISSUER,
+    aud: input.audience,
+    sub: input.user,
+    workspace_id: input.workspaceId,
+    source: input.source,
+    ...input.tenant !== void 0 ? { tenant: input.tenant } : {},
+    iat: now,
+    exp: now + ttl
+  });
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    new TextEncoder().encode(`${header}.${payload}`)
+  );
+  const token = `${header}.${payload}.${base64UrlEncode(new Uint8Array(signature))}`;
+  if (`Bearer ${token}`.length > MAX_HEADER_VALUE_LENGTH) {
+    throw new TypeError(
+      `Tool token exceeds Opengeni's ${MAX_HEADER_VALUE_LENGTH}-character header limit; shorten the user, tenant, or URL.`
+    );
+  }
+  return token;
+}
+async function deriveToolTokenKey(secret) {
+  return [...await derivedKeyBytes(resolveToolTokenSecret(secret))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function resolveToolTokenSecret(secret) {
+  const resolved = secret ?? environment("OPENGENI_API_KEY");
+  if (!resolved) {
+    throw new TypeError(
+      "Tool tokens need a signing secret: set OPENGENI_API_KEY, or pass the same `secret` to the session proxy's toolServer and verifyToolRequest."
+    );
+  }
+  return resolved;
+}
+function environment(name) {
+  return globalThis.process?.env?.[name] || void 0;
+}
+async function derivedKeyBytes(secret) {
+  const root = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return new Uint8Array(
+    await crypto.subtle.sign("HMAC", root, new TextEncoder().encode(TOOL_TOKEN_KEY_LABEL))
+  );
+}
+var keys = /* @__PURE__ */ new Map();
+function signingKey(secret) {
+  let key = keys.get(secret);
+  if (!key) {
+    key = (async () => await crypto.subtle.importKey(
+      "raw",
+      await derivedKeyBytes(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign", "verify"]
+    ))();
+    key.catch(() => keys.delete(secret));
+    if (keys.size >= 16) keys.delete(keys.keys().next().value);
+    keys.set(secret, key);
+  }
+  return key;
+}
+function requestAuthorization(request) {
+  if (typeof Request !== "undefined" && request instanceof Request) {
+    return request.headers.get("authorization") ?? void 0;
+  }
+  const headers = request.headers;
+  const raw = headers && typeof headers.get === "function" ? headers.get("authorization") ?? void 0 : headers?.authorization;
+  return Array.isArray(raw) ? void 0 : raw;
+}
+function base64UrlJson(value) {
+  return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));
+}
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(value) {
+  const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+  return bytes;
+}
+function utf8(bytes) {
+  return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+}
+
+export {
+  TOOL_TOKEN_ISSUER,
+  TOOL_TOKEN_KEY_LABEL,
+  TOOL_TOKEN_DEFAULT_TTL_SECONDS,
+  TOOL_SERVER_URL_ENV,
+  ToolRequestError,
+  verifyToolRequest,
+  mintToolToken,
+  deriveToolTokenKey,
+  resolveToolTokenSecret
+};
+//# sourceMappingURL=chunk-QGEIL4TR.js.map

package/dist/chunk-QGEIL4TR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tool-auth.ts"],"sourcesContent":["/**\n * Per-user credentials for a product's own MCP tool server.\n *\n * `createSessionProxyHandler({ toolServer })` mints a short-lived token for the\n * user its `resolve` hook authenticated, attaches it to each session it creates,\n * and refreshes it on every message, approval, and answer. The product's MCP\n * endpoint calls {@link verifyToolRequest} on every request and scopes all data\n * access to the returned identity, never to ids the model supplied.\n *\n * Wire format (for non-Node verifiers): an HS256 JWT in `Authorization: Bearer`,\n * signed with the hex key from {@link deriveToolTokenKey} (`HMAC-SHA256(key =\n * secret, message = \"opengeni-tool-token:v1\")`, where `secret` is\n * `OPENGENI_API_KEY` unless configured). Give a non-Node verifier that derived\n * key, never the organization key. Claims: `iss` = `\"opengeni-session-proxy\"`,\n * `aud` = the tool server URL, `sub` = the external user id, `workspace_id`,\n * `source`, optional `tenant`, `iat`, `exp`.\n */\n\n/** `iss` of every tool token. */\nexport const TOOL_TOKEN_ISSUER = \"opengeni-session-proxy\";\n/** HMAC message used to derive the signing key from the secret. */\nexport const TOOL_TOKEN_KEY_LABEL = \"opengeni-tool-token:v1\";\n/** Default token lifetime: 24 hours, refreshed on every message, approval, and answer. */\nexport const TOOL_TOKEN_DEFAULT_TTL_SECONDS = 24 * 60 * 60;\nconst MAX_TTL_SECONDS = 7 * 24 * 60 * 60;\n/** Opengeni's per-value limit for session MCP credential headers. */\nconst MAX_HEADER_VALUE_LENGTH = 4096;\n/** Default `toolServer.url` and `verifyToolRequest` audience. */\nexport const TOOL_SERVER_URL_ENV = \"OPENGENI_TOOL_SERVER_URL\";\nconst CLOCK_SKEW_SECONDS = 60;\n\n/** The user a verified tool request acts for. */\nexport type ToolRequestIdentity = {\n  /** External user id the session proxy's `resolve` hook authenticated. */\n  user: string;\n  /** Tenant from `resolve`, when it returned one. */\n  tenant?: string | undefined;\n  workspaceId: string;\n  /** External identity source (same as the proxy's `asUser` source). */\n  source: string;\n  expiresAt: Date;\n};\n\nexport type VerifyToolRequestOptions = {\n  /** Signing secret. Defaults to `OPENGENI_API_KEY`; must match the proxy's. */\n  secret?: string | undefined;\n  /**\n   * Exact tool server URL the token must be issued for (the proxy's\n   * `toolServer.url`). Defaults to `OPENGENI_TOOL_SERVER_URL`.\n   */\n  audience?: string | undefined;\n};\n\n/** A Web `Request`, or a Node/Express request (`headers` plus `originalUrl`/`url`). */\nexport type ToolRequestLike =\n  | Request\n  | {\n      headers: Record<string, string | string[] | undefined>;\n      originalUrl?: string | undefined;\n      url?: string | undefined;\n    };\n\n/** Missing, expired, forged, or misdirected tool token. Respond with `status` (401). */\nexport class ToolRequestError extends Error {\n  readonly status = 401;\n  constructor(readonly code: string) {\n    super(\"Tool request is not authorized.\");\n    this.name = \"ToolRequestError\";\n  }\n  /** A ready 401 response with a `WWW-Authenticate: Bearer` challenge. */\n  toResponse(): Response {\n    return new Response(JSON.stringify({ error: { code: this.code, message: this.message } }), {\n      status: 401,\n      headers: {\n        \"Content-Type\": \"application/json; charset=utf-8\",\n        \"WWW-Authenticate\": 'Bearer error=\"invalid_token\"',\n      },\n    });\n  }\n}\n\n/**\n * Verify the tool token on one MCP request and return who it acts for.\n * Throws {@link ToolRequestError} (401) for every invalid token. Call it on\n * every request, before any tool runs.\n *\n * ```ts\n * const user = await verifyToolRequest(request); // { user, tenant, workspaceId }\n * ```\n */\nexport async function verifyToolRequest(\n  request: ToolRequestLike,\n  options: VerifyToolRequestOptions = {},\n): Promise<ToolRequestIdentity> {\n  const key = await signingKey(resolveToolTokenSecret(options.secret));\n  const audience = options.audience ?? environment(TOOL_SERVER_URL_ENV);\n  if (!audience) {\n    throw new TypeError(\n      `verifyToolRequest needs the tool server URL: pass { audience } or set ${TOOL_SERVER_URL_ENV}.`,\n    );\n  }\n  const authorization = requestAuthorization(request);\n  const match = /^Bearer[ ]+([A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+)$/i.exec(\n    authorization?.trim() ?? \"\",\n  );\n  if (!match) throw new ToolRequestError(\"token_missing\");\n  const [header, payload, signature] = match[1]!.split(\".\") as [string, string, string];\n  let protectedHeader: unknown;\n  let claims: Record<string, unknown>;\n  let signatureBytes: Uint8Array<ArrayBuffer>;\n  try {\n    signatureBytes = base64UrlDecode(signature);\n    protectedHeader = JSON.parse(utf8(base64UrlDecode(header)));\n    claims = JSON.parse(utf8(base64UrlDecode(payload)));\n  } catch {\n    throw new ToolRequestError(\"token_malformed\");\n  }\n  if (\n    !protectedHeader ||\n    typeof protectedHeader !== \"object\" ||\n    (protectedHeader as { alg?: unknown }).alg !== \"HS256\" ||\n    !claims ||\n    typeof claims !== \"object\" ||\n    Array.isArray(claims)\n  ) {\n    throw new ToolRequestError(\"token_malformed\");\n  }\n  const valid = await crypto.subtle.verify(\n    \"HMAC\",\n    key,\n    signatureBytes,\n    new TextEncoder().encode(`${header}.${payload}`),\n  );\n  if (!valid) throw new ToolRequestError(\"token_invalid\");\n  const now = Math.floor(Date.now() / 1000);\n  const { iss, aud, sub, exp, iat, workspace_id, source, tenant } = claims;\n  if (iss !== TOOL_TOKEN_ISSUER) throw new ToolRequestError(\"token_invalid\");\n  if (typeof exp !== \"number\" || exp <= now) throw new ToolRequestError(\"token_expired\");\n  if (typeof iat !== \"number\" || iat > now + CLOCK_SKEW_SECONDS) {\n    throw new ToolRequestError(\"token_invalid\");\n  }\n  if (aud !== audience) {\n    throw new ToolRequestError(\"token_audience\");\n  }\n  if (\n    typeof sub !== \"string\" ||\n    !sub ||\n    typeof workspace_id !== \"string\" ||\n    !workspace_id ||\n    typeof source !== \"string\" ||\n    (tenant !== undefined && typeof tenant !== \"string\")\n  ) {\n    throw new ToolRequestError(\"token_invalid\");\n  }\n  return {\n    user: sub,\n    ...(tenant !== undefined ? { tenant } : {}),\n    workspaceId: workspace_id,\n    source,\n    expiresAt: new Date(exp * 1000),\n  };\n}\n\n/** Mint one tool token. The session proxy calls this; products rarely need to. */\nexport async function mintToolToken(input: {\n  /** Tool server URL; becomes `aud`. */\n  audience: string;\n  user: string;\n  tenant?: string | undefined;\n  workspaceId: string;\n  source: string;\n  secret?: string | undefined;\n  ttlSeconds?: number | undefined;\n}): Promise<string> {\n  const ttl = input.ttlSeconds ?? TOOL_TOKEN_DEFAULT_TTL_SECONDS;\n  if (!Number.isSafeInteger(ttl) || ttl < 1 || ttl > MAX_TTL_SECONDS) {\n    throw new TypeError(`ttlSeconds must be an integer from 1 to ${MAX_TTL_SECONDS}.`);\n  }\n  const key = await signingKey(resolveToolTokenSecret(input.secret));\n  const now = Math.floor(Date.now() / 1000);\n  const header = base64UrlJson({ alg: \"HS256\", typ: \"JWT\" });\n  const payload = base64UrlJson({\n    iss: TOOL_TOKEN_ISSUER,\n    aud: input.audience,\n    sub: input.user,\n    workspace_id: input.workspaceId,\n    source: input.source,\n    ...(input.tenant !== undefined ? { tenant: input.tenant } : {}),\n    iat: now,\n    exp: now + ttl,\n  });\n  const signature = await crypto.subtle.sign(\n    \"HMAC\",\n    key,\n    new TextEncoder().encode(`${header}.${payload}`),\n  );\n  const token = `${header}.${payload}.${base64UrlEncode(new Uint8Array(signature))}`;\n  if (`Bearer ${token}`.length > MAX_HEADER_VALUE_LENGTH) {\n    throw new TypeError(\n      `Tool token exceeds Opengeni's ${MAX_HEADER_VALUE_LENGTH}-character header limit; shorten the user, tenant, or URL.`,\n    );\n  }\n  return token;\n}\n\n/**\n * The hex HS256 key tool tokens are signed with. Give this (not the\n * organization key) to a tool server written in Python, Ruby, Go, and so on.\n */\nexport async function deriveToolTokenKey(secret?: string): Promise<string> {\n  return [...(await derivedKeyBytes(resolveToolTokenSecret(secret)))]\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n\n/** The configured secret, else `OPENGENI_API_KEY`. Throws when neither is set. */\nexport function resolveToolTokenSecret(secret: string | undefined): string {\n  const resolved = secret ?? environment(\"OPENGENI_API_KEY\");\n  if (!resolved) {\n    throw new TypeError(\n      \"Tool tokens need a signing secret: set OPENGENI_API_KEY, or pass the same `secret` to the session proxy's toolServer and verifyToolRequest.\",\n    );\n  }\n  return resolved;\n}\n\nfunction environment(name: string): string | undefined {\n  return (\n    (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env?.[\n      name\n    ] || undefined\n  );\n}\n\nasync function derivedKeyBytes(secret: string): Promise<Uint8Array<ArrayBuffer>> {\n  const root = await crypto.subtle.importKey(\n    \"raw\",\n    new TextEncoder().encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  return new Uint8Array(\n    await crypto.subtle.sign(\"HMAC\", root, new TextEncoder().encode(TOOL_TOKEN_KEY_LABEL)),\n  );\n}\n\nconst keys = new Map<string, Promise<CryptoKey>>();\n\n/** HS256 key derived from the secret, so the raw secret never signs tokens itself. */\nfunction signingKey(secret: string): Promise<CryptoKey> {\n  let key = keys.get(secret);\n  if (!key) {\n    key = (async () =>\n      await crypto.subtle.importKey(\n        \"raw\",\n        await derivedKeyBytes(secret),\n        { name: \"HMAC\", hash: \"SHA-256\" },\n        false,\n        [\"sign\", \"verify\"],\n      ))();\n    key.catch(() => keys.delete(secret));\n    if (keys.size >= 16) keys.delete(keys.keys().next().value!);\n    keys.set(secret, key);\n  }\n  return key;\n}\n\nfunction requestAuthorization(request: ToolRequestLike): string | undefined {\n  if (typeof Request !== \"undefined\" && request instanceof Request) {\n    return request.headers.get(\"authorization\") ?? undefined;\n  }\n  const headers = (request as Exclude<ToolRequestLike, Request>).headers as unknown;\n  const raw =\n    headers && typeof (headers as Headers).get === \"function\"\n      ? ((headers as Headers).get(\"authorization\") ?? undefined)\n      : (headers as Record<string, string | string[] | undefined>)?.authorization;\n  return Array.isArray(raw) ? undefined : raw;\n}\n\nfunction base64UrlJson(value: unknown): string {\n  return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));\n}\n\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (const byte of bytes) binary += String.fromCharCode(byte);\n  return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction base64UrlDecode(value: string): Uint8Array<ArrayBuffer> {\n  const base64 = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n  const binary = atob(base64 + \"=\".repeat((4 - (base64.length % 4)) % 4));\n  const bytes = new Uint8Array(binary.length);\n  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);\n  return bytes;\n}\n\nfunction utf8(bytes: Uint8Array): string {\n  return new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n}\n"],"mappings":";AAmBO,IAAM,oBAAoB;AAE1B,IAAM,uBAAuB;AAE7B,IAAM,iCAAiC,KAAK,KAAK;AACxD,IAAM,kBAAkB,IAAI,KAAK,KAAK;AAEtC,IAAM,0BAA0B;AAEzB,IAAM,sBAAsB;AACnC,IAAM,qBAAqB;AAkCpB,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAE1C,YAAqB,MAAc;AACjC,UAAM,iCAAiC;AADpB;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAJS,SAAS;AAAA;AAAA,EAMlB,aAAuB;AACrB,WAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,EAAE,MAAM,KAAK,MAAM,SAAS,KAAK,QAAQ,EAAE,CAAC,GAAG;AAAA,MACzF,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,QAChB,oBAAoB;AAAA,MACtB;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAWA,eAAsB,kBACpB,SACA,UAAoC,CAAC,GACP;AAC9B,QAAM,MAAM,MAAM,WAAW,uBAAuB,QAAQ,MAAM,CAAC;AACnE,QAAM,WAAW,QAAQ,YAAY,YAAY,mBAAmB;AACpE,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR,yEAAyE,mBAAmB;AAAA,IAC9F;AAAA,EACF;AACA,QAAM,gBAAgB,qBAAqB,OAAO;AAClD,QAAM,QAAQ,gEAAgE;AAAA,IAC5E,eAAe,KAAK,KAAK;AAAA,EAC3B;AACA,MAAI,CAAC,MAAO,OAAM,IAAI,iBAAiB,eAAe;AACtD,QAAM,CAAC,QAAQ,SAAS,SAAS,IAAI,MAAM,CAAC,EAAG,MAAM,GAAG;AACxD,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,qBAAiB,gBAAgB,SAAS;AAC1C,sBAAkB,KAAK,MAAM,KAAK,gBAAgB,MAAM,CAAC,CAAC;AAC1D,aAAS,KAAK,MAAM,KAAK,gBAAgB,OAAO,CAAC,CAAC;AAAA,EACpD,QAAQ;AACN,UAAM,IAAI,iBAAiB,iBAAiB;AAAA,EAC9C;AACA,MACE,CAAC,mBACD,OAAO,oBAAoB,YAC1B,gBAAsC,QAAQ,WAC/C,CAAC,UACD,OAAO,WAAW,YAClB,MAAM,QAAQ,MAAM,GACpB;AACA,UAAM,IAAI,iBAAiB,iBAAiB;AAAA,EAC9C;AACA,QAAM,QAAQ,MAAM,OAAO,OAAO;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,EACjD;AACA,MAAI,CAAC,MAAO,OAAM,IAAI,iBAAiB,eAAe;AACtD,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,EAAE,KAAK,KAAK,KAAK,KAAK,KAAK,cAAc,QAAQ,OAAO,IAAI;AAClE,MAAI,QAAQ,kBAAmB,OAAM,IAAI,iBAAiB,eAAe;AACzE,MAAI,OAAO,QAAQ,YAAY,OAAO,IAAK,OAAM,IAAI,iBAAiB,eAAe;AACrF,MAAI,OAAO,QAAQ,YAAY,MAAM,MAAM,oBAAoB;AAC7D,UAAM,IAAI,iBAAiB,eAAe;AAAA,EAC5C;AACA,MAAI,QAAQ,UAAU;AACpB,UAAM,IAAI,iBAAiB,gBAAgB;AAAA,EAC7C;AACA,MACE,OAAO,QAAQ,YACf,CAAC,OACD,OAAO,iBAAiB,YACxB,CAAC,gBACD,OAAO,WAAW,YACjB,WAAW,UAAa,OAAO,WAAW,UAC3C;AACA,UAAM,IAAI,iBAAiB,eAAe;AAAA,EAC5C;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,IACzC,aAAa;AAAA,IACb;AAAA,IACA,WAAW,IAAI,KAAK,MAAM,GAAI;AAAA,EAChC;AACF;AAGA,eAAsB,cAAc,OAShB;AAClB,QAAM,MAAM,MAAM,cAAc;AAChC,MAAI,CAAC,OAAO,cAAc,GAAG,KAAK,MAAM,KAAK,MAAM,iBAAiB;AAClE,UAAM,IAAI,UAAU,2CAA2C,eAAe,GAAG;AAAA,EACnF;AACA,QAAM,MAAM,MAAM,WAAW,uBAAuB,MAAM,MAAM,CAAC;AACjE,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,SAAS,cAAc,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC;AACzD,QAAM,UAAU,cAAc;AAAA,IAC5B,KAAK;AAAA,IACL,KAAK,MAAM;AAAA,IACX,KAAK,MAAM;AAAA,IACX,cAAc,MAAM;AAAA,IACpB,QAAQ,MAAM;AAAA,IACd,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC7D,KAAK;AAAA,IACL,KAAK,MAAM;AAAA,EACb,CAAC;AACD,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,GAAG,MAAM,IAAI,OAAO,EAAE;AAAA,EACjD;AACA,QAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,IAAI,gBAAgB,IAAI,WAAW,SAAS,CAAC,CAAC;AAChF,MAAI,UAAU,KAAK,GAAG,SAAS,yBAAyB;AACtD,UAAM,IAAI;AAAA,MACR,iCAAiC,uBAAuB;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAsB,mBAAmB,QAAkC;AACzE,SAAO,CAAC,GAAI,MAAM,gBAAgB,uBAAuB,MAAM,CAAC,CAAE,EAC/D,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAChD,KAAK,EAAE;AACZ;AAGO,SAAS,uBAAuB,QAAoC;AACzE,QAAM,WAAW,UAAU,YAAY,kBAAkB;AACzD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAAkC;AACrD,SACG,WAA0E,SAAS,MAClF,IACF,KAAK;AAET;AAEA,eAAe,gBAAgB,QAAkD;AAC/E,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,IAAI;AAAA,IACT,MAAM,OAAO,OAAO,KAAK,QAAQ,MAAM,IAAI,YAAY,EAAE,OAAO,oBAAoB,CAAC;AAAA,EACvF;AACF;AAEA,IAAM,OAAO,oBAAI,IAAgC;AAGjD,SAAS,WAAW,QAAoC;AACtD,MAAI,MAAM,KAAK,IAAI,MAAM;AACzB,MAAI,CAAC,KAAK;AACR,WAAO,YACL,MAAM,OAAO,OAAO;AAAA,MAClB;AAAA,MACA,MAAM,gBAAgB,MAAM;AAAA,MAC5B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,MAChC;AAAA,MACA,CAAC,QAAQ,QAAQ;AAAA,IACnB,GAAG;AACL,QAAI,MAAM,MAAM,KAAK,OAAO,MAAM,CAAC;AACnC,QAAI,KAAK,QAAQ,GAAI,MAAK,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,KAAM;AAC1D,SAAK,IAAI,QAAQ,GAAG;AAAA,EACtB;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,SAA8C;AAC1E,MAAI,OAAO,YAAY,eAAe,mBAAmB,SAAS;AAChE,WAAO,QAAQ,QAAQ,IAAI,eAAe,KAAK;AAAA,EACjD;AACA,QAAM,UAAW,QAA8C;AAC/D,QAAM,MACJ,WAAW,OAAQ,QAAoB,QAAQ,aACzC,QAAoB,IAAI,eAAe,KAAK,SAC7C,SAA2D;AAClE,SAAO,MAAM,QAAQ,GAAG,IAAI,SAAY;AAC1C;AAEA,SAAS,cAAc,OAAwB;AAC7C,SAAO,gBAAgB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC;AACxE;AAEA,SAAS,gBAAgB,OAA2B;AAClD,MAAI,SAAS;AACb,aAAW,QAAQ,MAAO,WAAU,OAAO,aAAa,IAAI;AAC5D,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAEA,SAAS,gBAAgB,OAAwC;AAC/D,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACzD,QAAM,SAAS,KAAK,SAAS,IAAI,QAAQ,IAAK,OAAO,SAAS,KAAM,CAAC,CAAC;AACtE,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,EAAG,OAAM,KAAK,IAAI,OAAO,WAAW,KAAK;AAC7F,SAAO;AACT;AAEA,SAAS,KAAK,OAA2B;AACvC,SAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAC/D;","names":[]}

package/dist/chunk-RJHCBZF7.js

@@ -0,0 +1,270 @@
+// ../contracts/src/workspace-integration-wire.ts
+var WORKSPACE_WEBHOOK_EVENT_TYPES = [
+  "turn.completed",
+  "turn.failed",
+  "turn.cancelled",
+  "session.status.changed",
+  "session.requiresAction",
+  "session.humanInput.requested",
+  "session.notification.posted",
+  "session.notification.withdrawn",
+  "usage.threshold_reached",
+  "usage.exhausted",
+  "usage.period_reset"
+];
+var OPENGENI_WEBHOOK_TEST_EVENT_TYPE = "webhook.test";
+var OPENGENI_TEST_REQUEST_NIL_ID = "00000000-0000-0000-0000-000000000000";
+var OPENGENI_SIGNATURE_HEADER = "OpenGeni-Signature";
+var OPENGENI_EVENT_ID_HEADER = "OpenGeni-Event-Id";
+var OPENGENI_DELIVERY_ID_HEADER = "OpenGeni-Delivery-Id";
+var OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;
+var encoder = new TextEncoder();
+async function hmacSha256Hex(secret, message) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(message)));
+  return Array.from(signature, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function constantTimeEqualHex(left, right) {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  }
+  return difference === 0;
+}
+async function signOpenGeniPayload(secret, body, timestampSeconds = Math.floor(Date.now() / 1e3)) {
+  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;
+}
+async function verifyOpenGeniSignature(input) {
+  if (!input.signature) return false;
+  let timestamp = null;
+  const candidates = [];
+  for (const part of input.signature.split(",")) {
+    const [key, value] = part.trim().split("=", 2);
+    if (key === "t" && value && /^\d{1,12}$/.test(value)) timestamp = Number(value);
+    if (key === "v1" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);
+  }
+  if (timestamp === null || candidates.length === 0) return false;
+  const now = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;
+  if (Math.abs(now - timestamp) > tolerance) return false;
+  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);
+  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));
+}
+
+// src/workspace-integrations.ts
+var OpenGeniSignatureError = class extends Error {
+  constructor() {
+    super("Opengeni signature verification failed");
+    this.name = "OpenGeniSignatureError";
+  }
+};
+function header(headers, name) {
+  if (headers instanceof Headers) return headers.get(name);
+  const wanted = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === wanted) {
+      return Array.isArray(value) ? value[0] ?? null : value ?? null;
+    }
+  }
+  return null;
+}
+async function verifiedObject(input) {
+  const valid = await verifyOpenGeniSignature({
+    secret: input.secret,
+    body: input.body,
+    signature: header(input.headers, OPENGENI_SIGNATURE_HEADER),
+    ...input.toleranceSeconds !== void 0 ? { toleranceSeconds: input.toleranceSeconds } : {}
+  });
+  if (!valid) throw new OpenGeniSignatureError();
+  const parsed = JSON.parse(input.body);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new OpenGeniSignatureError();
+  }
+  return parsed;
+}
+async function verifyWebhookEvent(input) {
+  const event = await verifiedObject(input);
+  const usageEvent = typeof event.type === "string" && event.type.startsWith("usage.");
+  const lane = event.lane === void 0 ? "workspace" : event.lane;
+  if (typeof event.id !== "string" || typeof event.type !== "string" || typeof event.workspaceId !== "string" || lane !== "workspace" && lane !== "organization" || usageEvent && lane !== "workspace" || !(typeof event.sessionId === "string" || (event.sessionId === null || event.sessionId === void 0) && [
+    "usage.threshold_reached",
+    "usage.exhausted",
+    "usage.period_reset",
+    OPENGENI_WEBHOOK_TEST_EVENT_TYPE
+  ].includes(event.type))) {
+    throw new OpenGeniSignatureError();
+  }
+  return {
+    event: { ...event, lane },
+    deliveryId: header(input.headers, OPENGENI_DELIVERY_ID_HEADER)
+  };
+}
+async function verifyCredentialProviderRequest(input) {
+  const parsed = await verifiedObject(input);
+  if (parsed.type !== "credentials.request" || typeof parsed.workspaceId !== "string") {
+    throw new OpenGeniSignatureError();
+  }
+  return parsed;
+}
+var OPENGENI_WEBHOOK_HEADERS = {
+  signature: OPENGENI_SIGNATURE_HEADER,
+  eventId: OPENGENI_EVENT_ID_HEADER,
+  deliveryId: OPENGENI_DELIVERY_ID_HEADER
+};
+async function getOrganizationCredentialProvider(client, organizationId) {
+  return client.requestJson(
+    "GET",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`
+  );
+}
+async function putOrganizationCredentialProvider(client, organizationId, request) {
+  return client.requestJson(
+    "PUT",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,
+    request
+  );
+}
+async function deleteOrganizationCredentialProvider(client, organizationId) {
+  await client.requestJson(
+    "DELETE",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,
+    void 0,
+    {},
+    { responseType: "void" }
+  );
+}
+async function listOrganizationWebhooks(client, organizationId) {
+  return client.requestJson(
+    "GET",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`
+  );
+}
+async function createOrganizationWebhook(client, organizationId, request) {
+  return client.requestJson(
+    "POST",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`,
+    request
+  );
+}
+async function getOrganizationWebhook(client, organizationId, webhookId) {
+  return client.requestJson(
+    "GET",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`
+  );
+}
+async function updateOrganizationWebhook(client, organizationId, webhookId, request) {
+  return client.requestJson(
+    "PATCH",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,
+    request
+  );
+}
+async function deleteOrganizationWebhook(client, organizationId, webhookId) {
+  await client.requestJson(
+    "DELETE",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,
+    void 0,
+    {},
+    { responseType: "void" }
+  );
+}
+async function listOrganizationWebhookDeliveries(client, organizationId, webhookId, options = {}) {
+  return client.requestJson(
+    "GET",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries`,
+    void 0,
+    options.limit !== void 0 ? { limit: String(options.limit) } : {}
+  );
+}
+async function redeliverOrganizationWebhookDelivery(client, organizationId, webhookId, deliveryId) {
+  return client.requestJson(
+    "POST",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries/${encodeURIComponent(deliveryId)}/redeliver`
+  );
+}
+async function getWorkspaceWebhook(client, workspaceId, webhookId) {
+  return client.requestJson("GET", `/v1/workspaces/${workspaceId}/webhooks/${webhookId}`);
+}
+async function rotateWorkspaceCredentialProviderSecret(client, workspaceId) {
+  return client.requestJson(
+    "POST",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/rotate-secret`
+  );
+}
+async function rotateOrganizationCredentialProviderSecret(client, organizationId) {
+  return client.requestJson(
+    "POST",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider/rotate-secret`
+  );
+}
+async function rotateOrganizationWebhookSecret(client, organizationId, webhookId) {
+  return client.requestJson(
+    "POST",
+    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`
+  );
+}
+async function rotateWorkspaceWebhookSecret(client, workspaceId, webhookId) {
+  return client.requestJson(
+    "POST",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`
+  );
+}
+async function testWorkspaceWebhook(client, workspaceId, webhookId) {
+  return client.requestJson(
+    "POST",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/test`
+  );
+}
+async function testWorkspaceCredentialProvider(client, workspaceId) {
+  return client.requestJson(
+    "POST",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/test`
+  );
+}
+async function getWorkspaceInheritedIntegrations(client, workspaceId) {
+  return client.requestJson(
+    "GET",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/inherited-integrations`
+  );
+}
+
+export {
+  WORKSPACE_WEBHOOK_EVENT_TYPES,
+  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
+  OPENGENI_TEST_REQUEST_NIL_ID,
+  OPENGENI_SIGNATURE_HEADER,
+  OPENGENI_EVENT_ID_HEADER,
+  OPENGENI_DELIVERY_ID_HEADER,
+  signOpenGeniPayload,
+  verifyOpenGeniSignature,
+  OpenGeniSignatureError,
+  verifyWebhookEvent,
+  verifyCredentialProviderRequest,
+  OPENGENI_WEBHOOK_HEADERS,
+  getOrganizationCredentialProvider,
+  putOrganizationCredentialProvider,
+  deleteOrganizationCredentialProvider,
+  listOrganizationWebhooks,
+  createOrganizationWebhook,
+  getOrganizationWebhook,
+  updateOrganizationWebhook,
+  deleteOrganizationWebhook,
+  listOrganizationWebhookDeliveries,
+  redeliverOrganizationWebhookDelivery,
+  getWorkspaceWebhook,
+  rotateWorkspaceCredentialProviderSecret,
+  rotateOrganizationCredentialProviderSecret,
+  rotateOrganizationWebhookSecret,
+  rotateWorkspaceWebhookSecret,
+  testWorkspaceWebhook,
+  testWorkspaceCredentialProvider,
+  getWorkspaceInheritedIntegrations
+};
+//# sourceMappingURL=chunk-RJHCBZF7.js.map

package/dist/chunk-RJHCBZF7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../contracts/src/workspace-integration-wire.ts","../src/workspace-integrations.ts"],"sourcesContent":["/**\n * Dependency-free wire constants and the OpenGeni-Signature scheme shared by\n * workspace webhooks and credential providers. Kept free of zod so browser and\n * React Native bundles can verify signatures without the schema runtime.\n */\n\nexport const WORKSPACE_WEBHOOK_EVENT_TYPES = [\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.humanInput.requested\",\n  \"session.notification.posted\",\n  \"session.notification.withdrawn\",\n  \"usage.threshold_reached\",\n  \"usage.exhausted\",\n  \"usage.period_reset\",\n] as const;\n\n/**\n * Sent only when an administrator presses \"Send test event\". It is never a\n * subscribable type: every endpoint can receive it, and a receiver that does\n * not care acknowledges it with any 2xx.\n */\nexport const OPENGENI_WEBHOOK_TEST_EVENT_TYPE = \"webhook.test\";\n\n/**\n * The session, turn and attempt ids of a credential-provider test request\n * (`purpose: \"test\"`). A test is not a run, so no real ids exist.\n */\nexport const OPENGENI_TEST_REQUEST_NIL_ID = \"00000000-0000-0000-0000-000000000000\";\n\nexport const OPENGENI_SIGNATURE_HEADER = \"OpenGeni-Signature\";\nexport const OPENGENI_EVENT_ID_HEADER = \"OpenGeni-Event-Id\";\nexport const OPENGENI_DELIVERY_ID_HEADER = \"OpenGeni-Delivery-Id\";\nexport const OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;\n\nconst encoder = new TextEncoder();\n\nasync function hmacSha256Hex(secret: string, message: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, encoder.encode(message)));\n  return Array.from(signature, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction constantTimeEqualHex(left: string, right: string): boolean {\n  if (left.length !== right.length) return false;\n  let difference = 0;\n  for (let index = 0; index < left.length; index += 1) {\n    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);\n  }\n  return difference === 0;\n}\n\n/**\n * `OpenGeni-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, \"<t>.<body>\")>`.\n * The timestamp is signed so a captured request cannot be replayed later.\n */\nexport async function signOpenGeniPayload(\n  secret: string,\n  body: string,\n  timestampSeconds = Math.floor(Date.now() / 1000),\n): Promise<string> {\n  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;\n}\n\nexport type VerifyOpenGeniSignatureInput = {\n  secret: string;\n  /** The exact raw request body, before JSON parsing. */\n  body: string;\n  /** The `OpenGeni-Signature` header value. */\n  signature: string | null | undefined;\n  toleranceSeconds?: number;\n  nowSeconds?: number;\n};\n\nexport async function verifyOpenGeniSignature(\n  input: VerifyOpenGeniSignatureInput,\n): Promise<boolean> {\n  if (!input.signature) return false;\n  let timestamp: number | null = null;\n  const candidates: string[] = [];\n  for (const part of input.signature.split(\",\")) {\n    const [key, value] = part.trim().split(\"=\", 2);\n    if (key === \"t\" && value && /^\\d{1,12}$/.test(value)) timestamp = Number(value);\n    if (key === \"v1\" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);\n  }\n  if (timestamp === null || candidates.length === 0) return false;\n  const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;\n  if (Math.abs(now - timestamp) > tolerance) return false;\n  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);\n  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));\n}\n","import {\n  OPENGENI_DELIVERY_ID_HEADER,\n  OPENGENI_EVENT_ID_HEADER,\n  OPENGENI_SIGNATURE_HEADER,\n  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n  verifyOpenGeniSignature,\n} from \"@opengeni/contracts/workspace-integration-wire\";\nimport type { CredentialProviderRequest, WorkspaceWebhookEvent } from \"@opengeni/contracts\";\nimport type { OpenGeniClient } from \"./client\";\nimport type {\n  CreateOrganizationWebhookRequest,\n  CreateOrganizationWebhookResponse,\n  GetOrganizationCredentialProviderResponse,\n  ListOrganizationWebhookDeliveriesResponse,\n  ListOrganizationWebhooksResponse,\n  OrganizationWebhook,\n  OrganizationWebhookDelivery,\n  PutOrganizationCredentialProviderRequest,\n  PutOrganizationCredentialProviderResponse,\n  RotateWorkspaceCredentialProviderSecretResponse,\n  RotateOrganizationCredentialProviderSecretResponse,\n  RotateWorkspaceWebhookSecretResponse,\n  RotateOrganizationWebhookSecretResponse,\n  TestWorkspaceCredentialProviderResponse,\n  TestWorkspaceWebhookResponse,\n  UpdateOrganizationWebhookRequest,\n  WorkspaceInheritedIntegrationsResponse,\n  WorkspaceWebhook,\n} from \"@opengeni/contracts\";\n\nexport type {\n  CreateOrganizationWebhookRequest,\n  CreateOrganizationWebhookResponse,\n  CreateWorkspaceWebhookRequest,\n  CreateWorkspaceWebhookResponse,\n  CredentialProviderRequest,\n  CredentialProviderInitiatorContext,\n  CredentialProviderResponse,\n  CredentialProviderMcpHeaders,\n  CredentialProviderMcpMaterial,\n  GetOrganizationCredentialProviderResponse,\n  GetWorkspaceCredentialProviderResponse,\n  InitiatingHuman,\n  IntegrationEndpointTestResult,\n  IntegrationWorkspaceFilter,\n  ListOrganizationWebhookDeliveriesResponse,\n  ListOrganizationWebhooksResponse,\n  ListWorkspaceWebhookDeliveriesResponse,\n  ListWorkspaceWebhooksResponse,\n  PutWorkspaceCredentialProviderRequest,\n  PutWorkspaceCredentialProviderResponse,\n  PutOrganizationCredentialProviderRequest,\n  PutOrganizationCredentialProviderResponse,\n  RotateWorkspaceCredentialProviderSecretResponse,\n  RotateOrganizationCredentialProviderSecretResponse,\n  RotateWorkspaceWebhookSecretResponse,\n  RotateOrganizationWebhookSecretResponse,\n  TestWorkspaceCredentialProviderResponse,\n  TestWorkspaceWebhookResponse,\n  OrganizationCredentialProvider,\n  OrganizationWebhook,\n  OrganizationWebhookDelivery,\n  UpdateOrganizationWebhookRequest,\n  UpdateWorkspaceWebhookRequest,\n  WorkspaceCredentialProvider,\n  WorkspaceInheritedIntegrationsResponse,\n  WorkspaceTestWebhookEvent,\n  WorkspaceWebhook,\n  WorkspaceWebhookDelivery,\n  WorkspaceWebhookEvent,\n  WorkspaceWebhookEventType,\n  SessionWorkspaceWebhookEvent,\n  WorkspaceUsageWebhookEvent,\n} from \"@opengeni/contracts\";\nexport {\n  OPENGENI_DELIVERY_ID_HEADER,\n  OPENGENI_EVENT_ID_HEADER,\n  OPENGENI_SIGNATURE_HEADER,\n  OPENGENI_TEST_REQUEST_NIL_ID,\n  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n  WORKSPACE_WEBHOOK_EVENT_TYPES,\n  signOpenGeniPayload,\n  verifyOpenGeniSignature,\n} from \"@opengeni/contracts/workspace-integration-wire\";\n\nexport type WorkspaceSandboxImages = { images: string[]; selected: string | null };\n\nexport class OpenGeniSignatureError extends Error {\n  constructor() {\n    super(\"Opengeni signature verification failed\");\n    this.name = \"OpenGeniSignatureError\";\n  }\n}\n\ntype SignedRequest = {\n  /** The exact raw request body. Parse it only after verification. */\n  body: string;\n  headers: Headers | Record<string, string | string[] | undefined>;\n  secret: string;\n  toleranceSeconds?: number;\n};\n\nfunction header(headers: SignedRequest[\"headers\"], name: string): string | null {\n  if (headers instanceof Headers) return headers.get(name);\n  const wanted = name.toLowerCase();\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === wanted) {\n      return Array.isArray(value) ? (value[0] ?? null) : (value ?? null);\n    }\n  }\n  return null;\n}\n\nasync function verifiedObject(input: SignedRequest): Promise<Record<string, unknown>> {\n  const valid = await verifyOpenGeniSignature({\n    secret: input.secret,\n    body: input.body,\n    signature: header(input.headers, OPENGENI_SIGNATURE_HEADER),\n    ...(input.toleranceSeconds !== undefined ? { toleranceSeconds: input.toleranceSeconds } : {}),\n  });\n  if (!valid) throw new OpenGeniSignatureError();\n  const parsed: unknown = JSON.parse(input.body);\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new OpenGeniSignatureError();\n  }\n  return parsed as Record<string, unknown>;\n}\n\n/**\n * Verify and parse one webhook delivery. Delivery is at least once: dedupe on\n * `event.id` (also sent as the `OpenGeni-Event-Id` header). A `webhook.test`\n * event (from \"Send test event\") names no session: acknowledge it with 2xx.\n */\nexport async function verifyWebhookEvent(input: SignedRequest): Promise<{\n  event: WorkspaceWebhookEvent;\n  deliveryId: string | null;\n}> {\n  const event = await verifiedObject(input);\n  const usageEvent = typeof event.type === \"string\" && event.type.startsWith(\"usage.\");\n  const lane = event.lane === undefined ? \"workspace\" : event.lane;\n  if (\n    typeof event.id !== \"string\" ||\n    typeof event.type !== \"string\" ||\n    typeof event.workspaceId !== \"string\" ||\n    (lane !== \"workspace\" && lane !== \"organization\") ||\n    (usageEvent && lane !== \"workspace\") ||\n    !(\n      typeof event.sessionId === \"string\" ||\n      ((event.sessionId === null || event.sessionId === undefined) &&\n        [\n          \"usage.threshold_reached\",\n          \"usage.exhausted\",\n          \"usage.period_reset\",\n          OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n        ].includes(event.type))\n    )\n  ) {\n    throw new OpenGeniSignatureError();\n  }\n  return {\n    event: { ...event, lane } as WorkspaceWebhookEvent,\n    deliveryId: header(input.headers, OPENGENI_DELIVERY_ID_HEADER),\n  };\n}\n\n/**\n * Verify the exact bytes and parse a provider request, including its frozen\n * initiatorContext when sent by an upgraded worker. Provenance grants no access.\n */\nexport async function verifyCredentialProviderRequest(\n  input: SignedRequest,\n): Promise<CredentialProviderRequest> {\n  const parsed = await verifiedObject(input);\n  if (parsed.type !== \"credentials.request\" || typeof parsed.workspaceId !== \"string\") {\n    throw new OpenGeniSignatureError();\n  }\n  return parsed as CredentialProviderRequest;\n}\n\n/** Identity header names, for receivers that log or dedupe. */\nexport const OPENGENI_WEBHOOK_HEADERS = {\n  signature: OPENGENI_SIGNATURE_HEADER,\n  eventId: OPENGENI_EVENT_ID_HEADER,\n  deliveryId: OPENGENI_DELIVERY_ID_HEADER,\n} as const;\n\n/** Server-side integration administration is opt-in, outside the eager browser client. */\nexport async function getOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<GetOrganizationCredentialProviderResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n  );\n}\n\n/** Replace configuration; explicit filter required. Store the first returned signing secret. */\nexport async function putOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  request: PutOrganizationCredentialProviderRequest,\n): Promise<PutOrganizationCredentialProviderResponse> {\n  return client.requestJson(\n    \"PUT\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n    request,\n  );\n}\n\nexport async function deleteOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<void> {\n  await client.requestJson<void>(\n    \"DELETE\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n    undefined,\n    {},\n    { responseType: \"void\" },\n  );\n}\n\nexport async function listOrganizationWebhooks(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<ListOrganizationWebhooksResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`,\n  );\n}\n\n/** Create a webhook and return its signing secret once. */\nexport async function createOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  request: CreateOrganizationWebhookRequest,\n): Promise<CreateOrganizationWebhookResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`,\n    request,\n  );\n}\n\nexport async function getOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<OrganizationWebhook> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n  );\n}\n\nexport async function updateOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  request: UpdateOrganizationWebhookRequest,\n): Promise<OrganizationWebhook> {\n  return client.requestJson(\n    \"PATCH\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n    request,\n  );\n}\n\nexport async function deleteOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<void> {\n  await client.requestJson<void>(\n    \"DELETE\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n    undefined,\n    {},\n    { responseType: \"void\" },\n  );\n}\n\nexport async function listOrganizationWebhookDeliveries(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  options: { limit?: number } = {},\n): Promise<ListOrganizationWebhookDeliveriesResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries`,\n    undefined,\n    options.limit !== undefined ? { limit: String(options.limit) } : {},\n  );\n}\n\n/** Requeue a settled delivery with a fresh attempt budget. */\nexport async function redeliverOrganizationWebhookDelivery(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  deliveryId: string,\n): Promise<OrganizationWebhookDelivery> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries/${encodeURIComponent(deliveryId)}/redeliver`,\n  );\n}\n\nexport async function getWorkspaceWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<WorkspaceWebhook> {\n  return client.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/webhooks/${webhookId}`);\n}\n\n/** Rotate immediately. Store the new secret; the old signing secret stops working. */\nexport async function rotateWorkspaceCredentialProviderSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<RotateWorkspaceCredentialProviderSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/rotate-secret`,\n  );\n}\n\nexport async function rotateOrganizationCredentialProviderSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<RotateOrganizationCredentialProviderSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider/rotate-secret`,\n  );\n}\n\nexport async function rotateOrganizationWebhookSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<RotateOrganizationWebhookSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`,\n  );\n}\n\nexport async function rotateWorkspaceWebhookSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<RotateWorkspaceWebhookSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`,\n  );\n}\n\n/**\n * Send one signed `webhook.test` event to a workspace webhook now and return\n * what the endpoint answered. Nothing is queued or retried.\n */\nexport async function testWorkspaceWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<TestWorkspaceWebhookResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/test`,\n  );\n}\n\n/**\n * Send one signed `purpose: \"test\"` request to the credential provider this\n * workspace's runs use (its own, else the organization's). Only the names of\n * returned credentials come back, never their values.\n */\nexport async function testWorkspaceCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<TestWorkspaceCredentialProviderResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/test`,\n  );\n}\n\n/** Organization registrations that reach this workspace. Workspace administrators only. */\nexport async function getWorkspaceInheritedIntegrations(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<WorkspaceInheritedIntegrationsResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/inherited-integrations`,\n  );\n}\n"],"mappings":";AAMO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,mCAAmC;AAMzC,IAAM,+BAA+B;AAErC,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,8BAA8B;AACpC,IAAM,uCAAuC;AAEpD,IAAM,UAAU,IAAI,YAAY;AAEhC,eAAe,cAAc,QAAgB,SAAkC;AAC7E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,OAAO,CAAC,CAAC;AAC/F,SAAO,MAAM,KAAK,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACpF;AAEA,SAAS,qBAAqB,MAAc,OAAwB;AAClE,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,kBAAc,KAAK,WAAW,KAAK,IAAI,MAAM,WAAW,KAAK;AAAA,EAC/D;AACA,SAAO,eAAe;AACxB;AAMA,eAAsB,oBACpB,QACA,MACA,mBAAmB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC9B;AACjB,SAAO,KAAK,gBAAgB,OAAO,MAAM,cAAc,QAAQ,GAAG,gBAAgB,IAAI,IAAI,EAAE,CAAC;AAC/F;AAYA,eAAsB,wBACpB,OACkB;AAClB,MAAI,CAAC,MAAM,UAAW,QAAO;AAC7B,MAAI,YAA2B;AAC/B,QAAM,aAAuB,CAAC;AAC9B,aAAW,QAAQ,MAAM,UAAU,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE,MAAM,KAAK,CAAC;AAC7C,QAAI,QAAQ,OAAO,SAAS,aAAa,KAAK,KAAK,EAAG,aAAY,OAAO,KAAK;AAC9E,QAAI,QAAQ,QAAQ,SAAS,iBAAiB,KAAK,KAAK,EAAG,YAAW,KAAK,KAAK;AAAA,EAClF;AACA,MAAI,cAAc,QAAQ,WAAW,WAAW,EAAG,QAAO;AAC1D,QAAM,MAAM,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5D,QAAM,YAAY,MAAM,oBAAoB;AAC5C,MAAI,KAAK,IAAI,MAAM,SAAS,IAAI,UAAW,QAAO;AAClD,QAAM,WAAW,MAAM,cAAc,MAAM,QAAQ,GAAG,SAAS,IAAI,MAAM,IAAI,EAAE;AAC/E,SAAO,WAAW,KAAK,CAAC,cAAc,qBAAqB,WAAW,QAAQ,CAAC;AACjF;;;ACbO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,cAAc;AACZ,UAAM,wCAAwC;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAUA,SAAS,OAAO,SAAmC,MAA6B;AAC9E,MAAI,mBAAmB,QAAS,QAAO,QAAQ,IAAI,IAAI;AACvD,QAAM,SAAS,KAAK,YAAY;AAChC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,QAAQ;AAChC,aAAO,MAAM,QAAQ,KAAK,IAAK,MAAM,CAAC,KAAK,OAAS,SAAS;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,eAAe,OAAwD;AACpF,QAAM,QAAQ,MAAM,wBAAwB;AAAA,IAC1C,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,WAAW,OAAO,MAAM,SAAS,yBAAyB;AAAA,IAC1D,GAAI,MAAM,qBAAqB,SAAY,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,EAC7F,CAAC;AACD,MAAI,CAAC,MAAO,OAAM,IAAI,uBAAuB;AAC7C,QAAM,SAAkB,KAAK,MAAM,MAAM,IAAI;AAC7C,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AACT;AAOA,eAAsB,mBAAmB,OAGtC;AACD,QAAM,QAAQ,MAAM,eAAe,KAAK;AACxC,QAAM,aAAa,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,WAAW,QAAQ;AACnF,QAAM,OAAO,MAAM,SAAS,SAAY,cAAc,MAAM;AAC5D,MACE,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,SAAS,YACtB,OAAO,MAAM,gBAAgB,YAC5B,SAAS,eAAe,SAAS,kBACjC,cAAc,SAAS,eACxB,EACE,OAAO,MAAM,cAAc,aACzB,MAAM,cAAc,QAAQ,MAAM,cAAc,WAChD;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,MAAM,IAAI,IAEzB;AACA,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AAAA,IACL,OAAO,EAAE,GAAG,OAAO,KAAK;AAAA,IACxB,YAAY,OAAO,MAAM,SAAS,2BAA2B;AAAA,EAC/D;AACF;AAMA,eAAsB,gCACpB,OACoC;AACpC,QAAM,SAAS,MAAM,eAAe,KAAK;AACzC,MAAI,OAAO,SAAS,yBAAyB,OAAO,OAAO,gBAAgB,UAAU;AACnF,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AACT;AAGO,IAAM,2BAA2B;AAAA,EACtC,WAAW;AAAA,EACX,SAAS;AAAA,EACT,YAAY;AACd;AAGA,eAAsB,kCACpB,QACA,gBACoD;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAGA,eAAsB,kCACpB,QACA,gBACA,SACoD;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,qCACpB,QACA,gBACe;AACf,QAAM,OAAO;AAAA,IACX;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,IACA,CAAC;AAAA,IACD,EAAE,cAAc,OAAO;AAAA,EACzB;AACF;AAEA,eAAsB,yBACpB,QACA,gBAC2C;AAC3C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAGA,eAAsB,0BACpB,QACA,gBACA,SAC4C;AAC5C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,uBACpB,QACA,gBACA,WAC8B;AAC9B,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,eAAsB,0BACpB,QACA,gBACA,WACA,SAC8B;AAC9B,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,EACF;AACF;AAEA,eAAsB,0BACpB,QACA,gBACA,WACe;AACf,QAAM,OAAO;AAAA,IACX;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,IACA,CAAC;AAAA,IACD,EAAE,cAAc,OAAO;AAAA,EACzB;AACF;AAEA,eAAsB,kCACpB,QACA,gBACA,WACA,UAA8B,CAAC,GACqB;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,IACA,QAAQ,UAAU,SAAY,EAAE,OAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC;AAAA,EACpE;AACF;AAGA,eAAsB,qCACpB,QACA,gBACA,WACA,YACsC;AACtC,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC,eAAe,mBAAmB,UAAU,CAAC;AAAA,EAChJ;AACF;AAEA,eAAsB,oBACpB,QACA,aACA,WAC2B;AAC3B,SAAO,OAAO,YAAY,OAAO,kBAAkB,WAAW,aAAa,SAAS,EAAE;AACxF;AAGA,eAAsB,wCACpB,QACA,aAC0D;AAC1D,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;AAEA,eAAsB,2CACpB,QACA,gBAC6D;AAC7D,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAEA,eAAsB,gCACpB,QACA,gBACA,WACkD;AAClD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,eAAsB,6BACpB,QACA,aACA,WAC+C;AAC/C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EAC7F;AACF;AAMA,eAAsB,qBACpB,QACA,aACA,WACuC;AACvC,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EAC7F;AACF;AAOA,eAAsB,gCACpB,QACA,aACkD;AAClD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;AAGA,eAAsB,kCACpB,QACA,aACiD;AACjD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;","names":[]}