@opengeni/sdk 3.1.0 → 3.1.2

package/dist/chunk-6HZGAIUE.js

@@ -0,0 +1,1665 @@
+import {
+  chatDefaults
+} from "./chunk-UM4ZXXJR.js";
+import {
+  mintToolToken,
+  resolveToolTokenSecret
+} from "./chunk-QGEIL4TR.js";
+import {
+  sessionEventStreamCoveredThrough
+} from "./chunk-4AHR4KGA.js";
+import {
+  OPENGENI_API_CONTRACT_HEADER,
+  OPENGENI_API_CONTRACT_REVISION
+} from "./chunk-KADZ5PGG.js";
+import {
+  OpenGeniApiError,
+  OpenGeniSetupError
+} from "./chunk-7EWT3PV6.js";
+
+// src/message-links.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+var EDITABLE_ID = /^[0-9a-f]{32}$/iu;
+var WORKSPACE_SEGMENT = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/u;
+var SANDBOX_SCHEME = "sandbox:";
+var LEGACY_WORKSPACE_PREFIX = "/workspace/";
+var TRAILING_LINE = /:([0-9]+)$/u;
+var TRAILING_INVALID_LINE = /:-(?:[0-9]+)$|:[0-9]+-[0-9]+$/u;
+var CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/u;
+function openGeniLinkScheme(href) {
+  const scheme = /^([a-z]+):/iu.exec(href ?? "")?.[1]?.toLowerCase();
+  return scheme === "artifact" || scheme === "sandbox" ? scheme : null;
+}
+function isReservedOpenGeniLink(href) {
+  if (!href) return false;
+  if (openGeniLinkScheme(href) || href.startsWith(LEGACY_WORKSPACE_PREFIX)) return true;
+  try {
+    return /^\/workspaces\/[^/]+\/artifacts(?:\/|[?#]|$)/u.test(decodeURIComponent(href));
+  } catch {
+    return /^\/workspaces\/[^/]+\/artifacts/u.test(href);
+  }
+}
+function parseSandboxLink(href) {
+  if (!href) return null;
+  const encodedLocation = openGeniLinkScheme(href) === "sandbox" ? href.slice(SANDBOX_SCHEME.length) : href.startsWith(LEGACY_WORKSPACE_PREFIX) ? href : null;
+  if (!encodedLocation || encodedLocation.includes("?") || encodedLocation.includes("#")) {
+    return null;
+  }
+  if (TRAILING_INVALID_LINE.test(encodedLocation)) return null;
+  const lineMatch = TRAILING_LINE.exec(encodedLocation);
+  const encodedPath = lineMatch ? encodedLocation.slice(0, -lineMatch[0].length) : encodedLocation;
+  const line = lineMatch?.[1] ? Number(lineMatch[1]) : null;
+  if (line !== null && (!Number.isSafeInteger(line) || line < 1)) return null;
+  if (!encodedPath) return null;
+  try {
+    const path = decodeURIComponent(encodedPath);
+    return path && !CONTROL_CHARACTER.test(path) ? { path, line } : null;
+  } catch {
+    return null;
+  }
+}
+function parseRetainedFileReference(href) {
+  if (openGeniLinkScheme(href) !== "artifact") return null;
+  if (!href) return null;
+  const id = href.slice("artifact:".length);
+  return UUID.test(id) ? id.toLowerCase() : null;
+}
+function parseOpenGeniLink(href) {
+  if (!href) return null;
+  const fileId = parseRetainedFileReference(href);
+  if (fileId) return { kind: "file", fileId, workspaceId: null };
+  if (openGeniLinkScheme(href) === "sandbox" || href.startsWith(LEGACY_WORKSPACE_PREFIX)) {
+    const location = parseSandboxLink(href);
+    return location ? { kind: "sandbox-file", ...location } : null;
+  }
+  if (!href.startsWith("/workspaces/") || href.includes("#")) return null;
+  const separator = href.indexOf("?");
+  const pathname = separator < 0 ? href : href.slice(0, separator);
+  const search = separator < 0 ? void 0 : href.slice(separator + 1);
+  let fromSession;
+  if (search !== void 0) {
+    const params = new URLSearchParams(search);
+    const keys = [...params.keys()];
+    if (keys.some((key) => key !== "fromSession") || keys.length > 1) return null;
+    if (!UUID.test(params.get("fromSession") ?? "")) return null;
+    fromSession = params.get("fromSession").toLowerCase();
+  }
+  const parts = pathname.split("/");
+  const workspaceId = parts[2] ?? "";
+  if (parts[1] !== "workspaces" || parts[3] !== "artifacts" || !WORKSPACE_SEGMENT.test(workspaceId))
+    return null;
+  if (parts.length === 6 && parts[4] === "editable" && EDITABLE_ID.test(parts[5] ?? "")) {
+    return {
+      kind: "editable-artifact",
+      artifactId: parts[5].toLowerCase(),
+      workspaceId,
+      ...fromSession ? { fromSession } : {}
+    };
+  }
+  if (parts.length === 6 && parts[4] === "files" && UUID.test(parts[5] ?? "")) {
+    return {
+      kind: "file",
+      fileId: parts[5].toLowerCase(),
+      workspaceId,
+      ...fromSession ? { fromSession } : {}
+    };
+  }
+  if (parts.length === 5 && UUID.test(parts[4] ?? "")) {
+    return {
+      kind: "site",
+      artifactId: parts[4].toLowerCase(),
+      workspaceId,
+      ...fromSession ? { fromSession } : {}
+    };
+  }
+  return null;
+}
+function openGeniConsolePath(target, workspaceId) {
+  const workspace = encodeURIComponent(
+    target.kind === "sandbox-file" ? workspaceId : target.workspaceId ?? workspaceId
+  );
+  const search = target.kind !== "sandbox-file" && target.fromSession && UUID.test(target.fromSession) ? `?fromSession=${encodeURIComponent(target.fromSession)}` : "";
+  switch (target.kind) {
+    case "file":
+      return `/workspaces/${workspace}/artifacts/files/${target.fileId}${search}`;
+    case "editable-artifact":
+      return `/workspaces/${workspace}/artifacts/editable/${target.artifactId}${search}`;
+    case "site":
+      return `/workspaces/${workspace}/artifacts/${target.artifactId}${search}`;
+    case "sandbox-file":
+      return null;
+  }
+}
+var SESSION_SCOPE_HEADER = "x-opengeni-session-id";
+
+// src/proxy.ts
+function formatSseEvent(event) {
+  const streamedCoverage = sessionEventStreamCoveredThrough(event);
+  const projectedCoverage = event.coveredThrough;
+  const coveredThrough = streamedCoverage ?? (typeof projectedCoverage === "number" && Number.isSafeInteger(projectedCoverage) && projectedCoverage >= event.sequence ? projectedCoverage : event.sequence);
+  return `id: ${coveredThrough}
+event: ${event.type}
+data: ${JSON.stringify(event)}
+
+`;
+}
+function sessionEventsToSseStream(events, options = {}) {
+  const encoder = new TextEncoder();
+  const iterator = events[Symbol.asyncIterator]();
+  let heartbeat;
+  let cancelled = false;
+  const stopHeartbeat = () => {
+    if (heartbeat !== void 0) {
+      clearInterval(heartbeat);
+      heartbeat = void 0;
+    }
+  };
+  return new ReadableStream({
+    start: (controller) => {
+      if (options.heartbeatMs !== void 0) {
+        heartbeat = setInterval(() => {
+          try {
+            controller.enqueue(encoder.encode(": ping\n\n"));
+          } catch {
+            stopHeartbeat();
+          }
+        }, options.heartbeatMs);
+      }
+    },
+    pull: async (controller) => {
+      let result;
+      try {
+        result = await iterator.next();
+      } catch (error) {
+        stopHeartbeat();
+        throw error;
+      }
+      if (cancelled) {
+        return;
+      }
+      if (result.done) {
+        stopHeartbeat();
+        controller.close();
+        return;
+      }
+      controller.enqueue(encoder.encode(formatSseEvent(result.value)));
+    },
+    cancel: () => {
+      cancelled = true;
+      stopHeartbeat();
+      options.onCancel?.();
+      void Promise.resolve(iterator.return?.(void 0)).then(
+        () => void 0,
+        () => void 0
+      );
+    }
+  });
+}
+function sessionEventsToSseResponse(events, options = {}) {
+  return new Response(sessionEventsToSseStream(events, options), {
+    headers: {
+      "Content-Type": "text/event-stream; charset=utf-8",
+      "Cache-Control": "no-cache, no-transform",
+      Connection: "keep-alive"
+    }
+  });
+}
+function resumeSequenceFromRequest(request) {
+  const url = new URL(request.url);
+  const raw = url.searchParams.get("after") ?? request.headers.get("Last-Event-ID");
+  const parsed = raw === null ? 0 : Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : 0;
+}
+function proxySessionEventStream(client, workspaceId, sessionId, options = {}) {
+  const { after, heartbeatMs, signal, ...streamOptions } = options;
+  const upstream = new AbortController();
+  if (signal?.aborted) {
+    upstream.abort();
+  } else {
+    signal?.addEventListener("abort", () => upstream.abort(), { once: true });
+  }
+  const resolvedAfter = after instanceof Request ? resumeSequenceFromRequest(after) : after ?? 0;
+  const events = client.streamEvents(workspaceId, sessionId, {
+    ...streamOptions,
+    after: resolvedAfter,
+    signal: upstream.signal
+  });
+  return sessionEventsToSseResponse(events, {
+    ...heartbeatMs !== void 0 ? { heartbeatMs } : {},
+    onCancel: () => upstream.abort()
+  });
+}
+
+// src/session-proxy-client.ts
+var SESSION_PROXY_SITE_HTML_MAX_BYTES = 25 * 1024 * 1024;
+var SessionProxySiteHtmlTooLargeError = class extends Error {
+  code = "site_html_too_large";
+  limitBytes = SESSION_PROXY_SITE_HTML_MAX_BYTES;
+  constructor() {
+    super(`Site HTML exceeds the ${SESSION_PROXY_SITE_HTML_MAX_BYTES}-byte proxy limit.`);
+    this.name = "SessionProxySiteHtmlTooLargeError";
+  }
+};
+function getSessionProxyWorkspaceGrant(client, workspaceId, options = {}) {
+  return client.requestJson(
+    "GET",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/access/grant`,
+    void 0,
+    {},
+    options
+  );
+}
+function getSessionProxyArtifactAssociation(client, workspaceId, sessionId, kind, artifactId, options = {}) {
+  return client.requestJson(
+    "GET",
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/sessions/${encodeURIComponent(sessionId)}/artifact-associations/${encodeURIComponent(artifactId)}`,
+    void 0,
+    { kind },
+    options
+  );
+}
+function downloadSessionProxySiteHtml(client, workspaceId, artifactId, options) {
+  return client.requestJsonResponse(
+    `/v1/workspaces/${encodeURIComponent(workspaceId)}/published-artifacts/${encodeURIComponent(artifactId)}/html`,
+    { versionId: options.versionId },
+    options
+  );
+}
+
+// src/session-proxy.ts
+var SESSION_PROXY_DEFAULT_HEARTBEAT_MS = 5e3;
+var DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
+var SEGMENT = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+var QUEUE_OPERATIONS = /* @__PURE__ */ new Set(["move", "edit", "steer", "delete"]);
+var CREATE_FIELDS = /* @__PURE__ */ new Set([
+  "initialMessage",
+  "idempotencyKey",
+  "resources",
+  "startMode"
+]);
+var MODEL_FIELDS = ["model", "reasoningEffort", "latencyMode"];
+var MAX_TRANSCRIPTION_BODY_BYTES = 25 * 1024 * 1024 + 64 * 1024;
+var ProxyRejection = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+};
+function reject(status, code, message) {
+  throw new ProxyRejection(status, code, message);
+}
+function json(body, status = 200, headers = {}) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "Content-Type": "application/json; charset=utf-8",
+      "Cache-Control": "no-store",
+      ...headers
+    }
+  });
+}
+function errorJson(status, code, message) {
+  return json({ error: { code, message } }, status);
+}
+function isFacade(target) {
+  return !("asUser" in target) && "client" in target;
+}
+function createSessionProxyHandler(target, options) {
+  const service = isFacade(target) ? target.client : target;
+  const defaultSource = isFacade(target) ? target.source : "default";
+  const rejectedKeyNotice = { sent: false };
+  const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+  const filesEnabled = options.files ?? true;
+  const voiceInputEnabled = options.voiceInput ?? true;
+  const realtimeVoiceEnabled = options.realtimeVoice ?? true;
+  const sandboxFilesEnabled = options.sandboxFiles === true;
+  const artifactsEnabled = options.artifacts !== void 0 && options.artifacts !== false;
+  const sitesEnabled = options.sites === true;
+  const editableLiveUrl = artifactsEnabled ? liveSocketUrl(
+    (typeof options.artifacts === "object" ? options.artifacts.editableLiveUrl : void 0) ?? service.apiUrl(EDITABLE_ARTIFACT_LIVE_PATH)
+  ) : null;
+  const modelSelection = options.modelSelection ?? true;
+  const heartbeatMs = options.heartbeatMs ?? SESSION_PROXY_DEFAULT_HEARTBEAT_MS;
+  const sessionList = options.sessionList ?? "mine";
+  const archiveEnabled = options.archive ?? true;
+  const chats = options.chats ?? "private";
+  const defaults = chatDefaults(chats);
+  const toolServer = options.toolServer ? normalizeToolServer(options.toolServer) : void 0;
+  const toolSessions = /* @__PURE__ */ new Map();
+  const subjects = /* @__PURE__ */ new Map();
+  const subjectOf = (client, key) => {
+    let subject = subjects.get(key);
+    if (!subject) {
+      subject = client.getAccessContext().then((access) => access.subjectId);
+      subject.catch(() => subjects.delete(key));
+      if (subjects.size >= 1e3) subjects.delete(subjects.keys().next().value);
+      subjects.set(key, subject);
+    }
+    return subject;
+  };
+  return async (request) => {
+    try {
+      const method = request.method;
+      if (!PROXY_METHODS.includes(method)) {
+        return new Response(null, {
+          status: 405,
+          headers: { Allow: PROXY_METHODS.join(", ") }
+        });
+      }
+      const resolved = await options.resolve(request);
+      if (resolved instanceof Response) return resolved;
+      if (typeof resolved?.user !== "string" || !resolved.user) {
+        return errorJson(401, "user_required", "Authentication required.");
+      }
+      const url = new URL(request.url);
+      const segments = routeSegments(url.pathname, options.basePath);
+      if (!segments) return errorJson(404, "route_not_allowed", "Not found.");
+      if (method !== "GET") {
+        const allowed = options.authorizeMutation ? await options.authorizeMutation(request) : request.headers.get("sec-fetch-site") !== "cross-site";
+        if (!allowed) return errorJson(403, "mutation_denied", "Request denied.");
+      }
+      const source = resolved.source ?? defaultSource;
+      let workspaceId;
+      if ("workspaceId" in resolved && !resolved.workspaceId && !resolved.tenant || "tenant" in resolved && !resolved.tenant && !resolved.workspaceId || resolved.workspaceId === "" || resolved.tenant === "") {
+        throw new TypeError(
+          "resolve returned an empty tenant or workspaceId. Return a non-empty id, or omit the key for one workspace per user."
+        );
+      }
+      if (chats === "isolated") {
+        if (resolved.workspaceId || !isFacade(target) || !target.workspaceIdFor) {
+          throw new TypeError(
+            'chats: "isolated" requires the Opengeni facade and a tenant or user resolution.'
+          );
+        }
+        workspaceId = await target.workspaceIdFor(
+          { tenant: resolved.tenant, user: resolved.user, source },
+          { isolation: "user" }
+        );
+      } else if (resolved.workspaceId) {
+        workspaceId = resolved.workspaceId;
+      } else if (resolved.tenant && isFacade(target)) {
+        workspaceId = await target.workspaceId({ tenant: resolved.tenant });
+      } else if (!("tenant" in resolved) && !("workspaceId" in resolved) && isFacade(target) && target.workspaceIdFor) {
+        workspaceId = await target.workspaceIdFor(
+          { user: resolved.user, source },
+          { isolation: "user" }
+        );
+      } else {
+        throw new TypeError(
+          "resolve must return a workspaceId (or a tenant or a user alone when given the Opengeni facade)."
+        );
+      }
+      const uploadsEnabled = filesEnabled && (resolved.visitor !== true || options.visitorUploads === true);
+      const client = service.asUser(resolved.user, { source });
+      const context = {
+        request,
+        workspaceId,
+        user: resolved.user,
+        source,
+        client
+      };
+      const call = { signal: request.signal };
+      const toolToken = async () => await mintToolToken({
+        audience: toolServer.url,
+        user: resolved.user,
+        tenant: resolved.tenant,
+        workspaceId,
+        source,
+        secret: toolServer.secret,
+        ttlSeconds: toolServer.ttlSeconds
+      });
+      const toolServerOwner = (sessionId2) => {
+        const key = `${workspaceId}\0${sessionId2}`;
+        let attached = toolSessions.get(key);
+        if (!attached) {
+          attached = client.getSession(workspaceId, sessionId2, call).then(
+            (session2) => (session2.mcpServers ?? []).some(
+              (server) => server.id === toolServer.id && server.url === toolServer.url
+            ) ? session2.createdBy?.subjectId ?? null : null
+          );
+          attached.catch(() => toolSessions.delete(key));
+          if (toolSessions.size >= 1e3) toolSessions.delete(toolSessions.keys().next().value);
+          toolSessions.set(key, attached);
+        }
+        return attached;
+      };
+      const messageExtras = async (input) => {
+        const extras = options.beforeForwardMessage ? await options.beforeForwardMessage(input, context) : void 0;
+        if (extras instanceof Response || !toolServer || !input.sessionId) return extras;
+        const updates = extras?.mcpCredentialUpdates ?? [];
+        if (updates.some((update) => update.id === toolServer.id)) return extras;
+        const owner = await toolServerOwner(input.sessionId);
+        if (!owner || owner !== await subjectOf(client, `${source}\0${resolved.user}`)) {
+          return extras;
+        }
+        return {
+          ...extras,
+          mcpCredentialUpdates: [
+            ...updates,
+            {
+              id: toolServer.id,
+              headers: { Authorization: `Bearer ${await toolToken()}` }
+            }
+          ]
+        };
+      };
+      const refreshRealtimeCredentials = async (sessionId2, updates) => {
+        if (updates.length === 0) return;
+        try {
+          const servers = (await client.getSession(workspaceId, sessionId2, call)).mcpServers ?? [];
+          const rotations = updates.flatMap((update) => {
+            const server = servers.find((candidate) => candidate.id === update.id);
+            return server ? [
+              {
+                id: update.id,
+                expectedCredentialVersion: server.credentialVersion,
+                expectedServerUrl: server.url,
+                headers: update.headers
+              }
+            ] : [];
+          });
+          if (rotations.length === 0) return;
+          await client.rotateSessionMcpCredentials(workspaceId, sessionId2, {
+            operationKey: crypto.randomUUID(),
+            updates: rotations
+          });
+        } catch (error) {
+          if (!(error instanceof OpenGeniApiError)) throw error;
+        }
+      };
+      const forwardMessage = async (value, input) => {
+        const message = sanitizeMessage(value, modelSelection || input.delivery === "submit");
+        const extras = await messageExtras(input);
+        if (extras instanceof Response) return extras;
+        const modelContext = joinContext(
+          extras?.modelContext,
+          typeof message.modelContext === "string" ? message.modelContext : void 0
+        );
+        return {
+          ...message,
+          ...modelContext ? { modelContext } : {},
+          ...extras?.mcpCredentialUpdates?.length ? { mcpCredentialUpdates: extras.mcpCredentialUpdates } : {}
+        };
+      };
+      const forwardResponse = async (value, input) => {
+        const payload = browserPayload(value);
+        const extras = await messageExtras(input);
+        if (extras instanceof Response) return extras;
+        return {
+          ...payload,
+          ...extras?.mcpCredentialUpdates?.length ? { mcpCredentialUpdates: extras.mcpCredentialUpdates } : {}
+        };
+      };
+      const query = Object.fromEntries(url.searchParams);
+      const read = async (path) => json(await client.requestJson("GET", path, void 0, query, call));
+      const [root, ...rest] = segments;
+      if (root === "config") {
+        if (rest.length === 1 && rest[0] === "client" && method === "GET") {
+          const config = await client.requestJson(
+            "GET",
+            "/v1/config/client",
+            void 0,
+            { ...query, workspaceId },
+            call
+          );
+          let artifacts = null;
+          if (editableLiveUrl) {
+            try {
+              artifacts = {
+                editableLiveUrl,
+                cachePartition: await cachePartition(
+                  await getSessionProxyWorkspaceGrant(client, workspaceId, call),
+                  workspaceId,
+                  source
+                )
+              };
+            } catch (error) {
+              if (!(error instanceof OpenGeniApiError) || error.status !== 404) throw error;
+            }
+          }
+          const {
+            artifacts: _upstreamArtifacts,
+            sessionUsageLimits: _upstreamUsageLimits,
+            ...conversationConfig
+          } = config;
+          const upstreamVoice = config.voiceInput;
+          if (upstreamVoice && typeof upstreamVoice === "object") {
+            const { resumable: _resumable, ...voice } = upstreamVoice;
+            conversationConfig.voiceInput = voiceInputEnabled ? voice : { ...voice, available: false };
+          }
+          const upstreamUploads = config.fileUploads;
+          if (!uploadsEnabled) {
+            conversationConfig.fileUploads = {
+              ...upstreamUploads && typeof upstreamUploads === "object" ? upstreamUploads : {},
+              enabled: false
+            };
+          }
+          return json({
+            ...conversationConfig,
+            apiContractRevision: OPENGENI_API_CONTRACT_REVISION,
+            // The resolved workspace: a browser given only the proxy's baseUrl
+            // reads it here instead of knowing any Opengeni id.
+            workspaceId,
+            sandboxFiles: sandboxFilesEnabled,
+            // Stock UIs show Site previews and the artifact viewer only when
+            // this proxy serves them; `false` keeps them from failing on click.
+            artifacts: artifacts ?? false,
+            // Whether the stock "New chat" and "Archive" actions can succeed.
+            sessionCreation: options.createSession !== void 0,
+            archive: archiveEnabled,
+            // Explicit true also tells stock UIs to show the voice button, which
+            // is otherwise opt-in on the embedded conversation.
+            ...realtimeVoiceEnabled ? options.realtimeVoice === true ? { realtimeVoice: true } : {} : { realtimeVoice: false },
+            // Explicit true also tells stock UIs to offer end users the model picker.
+            ...modelSelection ? options.modelSelection === true ? { modelSelection: true } : {} : { modelSelection: false }
+          });
+        }
+        return errorJson(404, "route_not_allowed", "Not found.");
+      }
+      if (root !== "workspaces" || rest.length < 1) {
+        return errorJson(404, "route_not_allowed", "Not found.");
+      }
+      const [pathWorkspaceId, area, ...tail] = rest;
+      if (pathWorkspaceId !== workspaceId) {
+        return errorJson(403, "workspace_not_allowed", "This workspace is not available.");
+      }
+      const base = `/v1/workspaces/${workspaceId}`;
+      if (area === "usage" && tail.length === 1 && tail[0] === "me" && method === "GET") {
+        if (Object.keys(query).some((key) => key !== "period")) {
+          return errorJson(400, "invalid_usage_query", "Only period is accepted for own usage.");
+        }
+        return await read(`${base}/usage/me`);
+      }
+      if (area === void 0 && method === "GET") return await read(base);
+      if (area === "model-catalog" && tail.length === 0 && method === "GET") {
+        return await read(`${base}/model-catalog`);
+      }
+      if (area === "realtime-model-catalog" && tail.length === 0 && method === "GET") {
+        if (!realtimeVoiceEnabled) return errorJson(404, "route_not_allowed", "Not found.");
+        return await read(`${base}/realtime-model-catalog`);
+      }
+      if (area === "live-events" && tail.length === 1 && tail[0] === "stream" && method === "GET") {
+        await client.requestJson("GET", base, void 0, {}, call);
+        return workspaceLiveStream(client, workspaceId, url.searchParams, request, heartbeatMs);
+      }
+      if (area === "inference-control" && tail.length === 0 && method === "POST") {
+        const body2 = await readJsonBody(request, maxBodyBytes);
+        if (body2?.action !== "resume") {
+          reject(403, "control_not_allowed", "Only workspace resume is available.");
+        }
+        return json(await client.requestJson("POST", `${base}/inference-control`, body2));
+      }
+      if (area === "files" && filesEnabled && method === "POST") {
+        if (tail[0] === "uploads" && !uploadsEnabled) {
+          return errorJson(404, "route_not_allowed", "Not found.");
+        }
+        if (tail.length === 1 && tail[0] === "uploads") {
+          const body2 = await readJsonBody(request, maxBodyBytes);
+          return json(
+            await client.requestJson("POST", `${base}/files/uploads`, pick(body2, UPLOAD_FIELDS))
+          );
+        }
+        if (tail.length === 3 && tail[0] === "uploads" && tail[2] === "complete") {
+          return json(
+            await client.requestJson("POST", `${base}/files/uploads/${tail[1]}/complete`)
+          );
+        }
+        if (tail.length === 2 && tail[1] === "download-url") {
+          return json(
+            await client.requestJson(
+              "POST",
+              `${base}/files/${tail[0]}/download-url`,
+              void 0,
+              query,
+              call
+            )
+          );
+        }
+        return errorJson(404, "route_not_allowed", "Not found.");
+      }
+      if (area === "artifacts") {
+        const [artifactId, ...artifactOp] = tail;
+        const route2 = `${method} ${artifactOp.join("/")}`;
+        if (!filesEnabled || !artifactId || !SEGMENT.test(artifactId) || route2 !== "GET content" && route2 !== "POST playback-source") {
+          return errorJson(404, "route_not_allowed", "Not found.");
+        }
+        const sessionId2 = request.headers.get(SESSION_SCOPE_HEADER)?.trim() ?? "";
+        if (!SEGMENT.test(sessionId2)) {
+          reject(400, "session_scope_required", "Artifact reads must name their session.");
+        }
+        if (options.authorizeSession && !await options.authorizeSession(sessionId2, context)) {
+          return errorJson(404, "session_not_found", "Session not found.");
+        }
+        await getSessionProxyArtifactAssociation(
+          client,
+          workspaceId,
+          sessionId2,
+          "retained",
+          artifactId,
+          call
+        );
+        if (route2 === "POST playback-source") {
+          return json(
+            await client.requestJson(
+              "POST",
+              `${base}/artifacts/${artifactId}/playback-source`,
+              void 0,
+              {},
+              call
+            )
+          );
+        }
+        return retainedContent(
+          await client.getRetainedArtifactContent(workspaceId, artifactId, {
+            ...retainedRange(request),
+            signal: request.signal
+          })
+        );
+      }
+      if (area === "transcriptions" && tail.length === 0 && method === "POST") {
+        if (!voiceInputEnabled) return errorJson(404, "route_not_allowed", "Not found.");
+        return json(await client.transcribeAudio(workspaceId, await transcriptionInput(request)));
+      }
+      if (area === "editable-artifacts" || area === "published-artifacts") {
+        if (area === "published-artifacts" && sitesEnabled && !request.headers.get(SESSION_SCOPE_HEADER)) {
+          const [siteId, ...siteOp] = tail;
+          const op2 = siteOp.join("/");
+          if (method !== "GET") return errorJson(404, "route_not_allowed", "Not found.");
+          if (siteId === void 0) {
+            return json(
+              await client.requestJson(
+                "GET",
+                `${base}/published-artifacts`,
+                void 0,
+                pick(query, SITE_LIST_FIELDS),
+                call
+              )
+            );
+          }
+          if (!SEGMENT.test(siteId) || op2 !== "" && op2 !== "content" && op2 !== "html") {
+            return errorJson(404, "route_not_allowed", "Not found.");
+          }
+          const versionId2 = query.versionId;
+          if (versionId2 !== void 0 && (typeof versionId2 !== "string" || !SEGMENT.test(versionId2))) {
+            reject(400, "version_invalid", "versionId is invalid.");
+          }
+          if (op2 === "html") {
+            if (typeof versionId2 !== "string") {
+              reject(400, "version_required", "versionId is required.");
+            }
+            const html2 = await downloadSessionProxySiteHtml(client, workspaceId, siteId, {
+              versionId: versionId2,
+              signal: request.signal
+            });
+            return new Response(boundedSiteHtml(html2.body, request.signal), {
+              headers: SITE_HTML_HEADERS
+            });
+          }
+          const item2 = `${base}/published-artifacts/${siteId}`;
+          return json(
+            await client.requestJson(
+              "GET",
+              op2 === "content" ? `${item2}/content` : item2,
+              void 0,
+              op2 === "content" && typeof versionId2 === "string" ? { versionId: versionId2 } : {},
+              call
+            )
+          );
+        }
+        if (!artifactsEnabled) return errorJson(404, "route_not_allowed", "Not found.");
+        const [artifactId, ...artifactOp] = tail;
+        const route2 = `${method} ${artifactOp.join("/")}`;
+        const editable = area === "editable-artifacts";
+        const allowed = editable ? route2 === "GET " || route2 === "POST live-ticket" : route2 === "GET " || route2 === "GET html";
+        if (!artifactId || !SEGMENT.test(artifactId) || !allowed) {
+          return errorJson(404, "route_not_allowed", "Not found.");
+        }
+        const sessionId2 = request.headers.get(SESSION_SCOPE_HEADER)?.trim() ?? "";
+        if (!SEGMENT.test(sessionId2)) {
+          reject(400, "session_scope_required", "Artifact reads must name their session.");
+        }
+        if (options.authorizeSession && !await options.authorizeSession(sessionId2, context)) {
+          return errorJson(404, "session_not_found", "Session not found.");
+        }
+        await getSessionProxyArtifactAssociation(
+          client,
+          workspaceId,
+          sessionId2,
+          editable ? "editable" : "site",
+          artifactId,
+          call
+        );
+        const item = `${base}/${area}/${artifactId}`;
+        if (route2 === "GET ") {
+          const replicaId = editable ? query.replicaId : void 0;
+          return json(
+            await client.requestJson(
+              "GET",
+              item,
+              void 0,
+              typeof replicaId === "string" ? { replicaId } : {},
+              call
+            )
+          );
+        }
+        if (route2 === "POST live-ticket") {
+          const body2 = await readJsonBody(request, maxBodyBytes);
+          return json(
+            await client.requestJson("POST", `${item}/live-ticket`, {
+              ...pick(body2, TICKET_FIELDS),
+              sourceSessionId: sessionId2
+            }),
+            201
+          );
+        }
+        const versionId = query.versionId;
+        if (typeof versionId !== "string" || !SEGMENT.test(versionId)) {
+          reject(400, "version_required", "versionId is required.");
+        }
+        const html = await downloadSessionProxySiteHtml(client, workspaceId, artifactId, {
+          versionId,
+          signal: request.signal
+        });
+        return new Response(boundedSiteHtml(html.body, request.signal), {
+          headers: SITE_HTML_HEADERS
+        });
+      }
+      if (area !== "sessions") return errorJson(404, "route_not_allowed", "Not found.");
+      if (tail.length === 0 && method === "GET") {
+        if (!sessionList) return errorJson(404, "route_not_allowed", "Not found.");
+        if (query.view !== "page") {
+          reject(400, "page_view_required", "List sessions with listSessionPage.");
+        }
+        const listQuery = { ...query };
+        if (sessionList === "mine") {
+          listQuery.createdByKind = "subject";
+          listQuery.createdBySubjectId = await subjectOf(client, `${source}\0${resolved.user}`);
+        }
+        const page = await client.requestJson(
+          "GET",
+          `${base}/sessions`,
+          void 0,
+          listQuery,
+          call
+        );
+        return json(sessionList === "mine" ? { ...page, pinned: [] } : page);
+      }
+      if (tail.length === 0) {
+        if (method !== "POST" || !options.createSession) {
+          return errorJson(404, "route_not_allowed", "Not found.");
+        }
+        const input = createInput(await readJsonBody(request, maxBodyBytes), modelSelection);
+        if (input.startMode === "realtime" && !realtimeVoiceEnabled) {
+          return errorJson(404, "route_not_allowed", "Not found.");
+        }
+        const hooked = await options.createSession(input, context);
+        if (hooked instanceof Response) return hooked;
+        const created = withBrowserCreateChoices(
+          toolServer ? withToolServer(hooked, toolServer, await toolToken()) : hooked,
+          input
+        );
+        const extras = await messageExtras({
+          delivery: "create",
+          ...input.startMode ? { startMode: input.startMode } : {}
+        });
+        if (extras instanceof Response) return extras;
+        const modelContext = joinContext(extras?.modelContext, created.modelContext);
+        return json(
+          await client.createSession(workspaceId, {
+            ...created,
+            visibility: created.visibility ?? defaults.visibility,
+            agentAccess: created.agentAccess ?? defaults.agentAccess,
+            memoryScope: created.memoryScope ?? defaults.memoryScope,
+            ...modelContext ? { modelContext } : {}
+          })
+        );
+      }
+      const [sessionId, ...op] = tail;
+      if (options.authorizeSession && !await options.authorizeSession(sessionId, context)) {
+        return errorJson(404, "session_not_found", "Session not found.");
+      }
+      const session = `${base}/sessions/${sessionId}`;
+      const route = `${method} ${op.join("/")}`;
+      const body = method === "GET" ? void 0 : await readJsonBody(request, maxBodyBytes, true);
+      const sanitize = (value) => sanitizeMessage(value, modelSelection);
+      const saveDraftPolicy = async (message) => {
+        if (modelSelection) return message;
+        const draft = await client.getComposerDraft(workspaceId, sessionId, call);
+        return {
+          ...message,
+          model: draft.model,
+          reasoningEffort: draft.reasoningEffort,
+          latencyMode: draft.latencyMode
+        };
+      };
+      const forward = async (path, payload) => payload instanceof Response ? payload : json(await client.requestJson("POST", path, payload));
+      if (op[0] === "realtime") {
+        if (!realtimeVoiceEnabled) return errorJson(404, "route_not_allowed", "Not found.");
+        const realtime = realtimeRoute(method, op.slice(1));
+        if (!realtime) return errorJson(404, "route_not_allowed", "Not found.");
+        if (!body) reject(400, "invalid_body", "A JSON object body is required.");
+        const path = `${session}/${op.join("/")}`;
+        if (realtime === "begin") {
+          const extras = await messageExtras({
+            sessionId,
+            delivery: "realtime"
+          });
+          if (extras instanceof Response) return extras;
+          await refreshRealtimeCredentials(sessionId, extras?.mcpCredentialUpdates ?? []);
+        }
+        let payload = body;
+        if (realtime === "sync" && options.beforeForwardMessage && hasRealtimeMessages(body)) {
+          const extras = await options.beforeForwardMessage(
+            { sessionId, delivery: "realtime" },
+            context
+          );
+          if (extras instanceof Response) return extras;
+          payload = withRealtimeContext(body, extras?.modelContext);
+        }
+        return json(await client.requestJson(method, path, payload));
+      }
+      switch (route) {
+        case "GET ":
+          return await read(session);
+        case "PUT archive": {
+          if (!archiveEnabled) return errorJson(404, "route_not_allowed", "Not found.");
+          const archived = body?.archived;
+          const expectedVersion = body?.expectedVersion;
+          if (typeof archived !== "boolean") reject(400, "invalid_body", "archived is required.");
+          return json(
+            await client.requestJson("PUT", `${session}/archive`, {
+              archived,
+              ...typeof expectedVersion === "number" ? { expectedVersion } : {}
+            })
+          );
+        }
+        case "PATCH ": {
+          const title = body?.title;
+          if (typeof title !== "string" || Object.keys(body ?? {}).length !== 1) {
+            reject(400, "invalid_body", "Only { title } may be updated.");
+          }
+          return json(await client.requestJson("PATCH", session, { title }));
+        }
+        case "GET events":
+          return await listEvents(client, `${session}/events`, query, call);
+        case "GET events/stream":
+          await client.getSession(workspaceId, sessionId, call);
+          return proxySessionEventStream(client, workspaceId, sessionId, {
+            after: request,
+            signal: request.signal,
+            heartbeatMs
+          });
+        case "POST events": {
+          const event = clientEvent(body);
+          const payload = event.type === "user.message" ? await forwardMessage(event.payload, {
+            sessionId,
+            delivery: "send"
+          }) : await forwardResponse(event.payload, {
+            sessionId,
+            delivery: "send"
+          });
+          return await forward(
+            `${session}/events`,
+            payload instanceof Response ? payload : { ...event, payload }
+          );
+        }
+        case "POST steer":
+          return await forward(
+            `${session}/steer`,
+            await forwardMessage(body, { sessionId, delivery: "steer" })
+          );
+        case "GET queue":
+          return await read(`${session}/queue`);
+        case "GET composer-draft":
+          return await read(`${session}/composer-draft`);
+        case "PUT composer-draft":
+          return json(
+            await client.requestJson(
+              "PUT",
+              `${session}/composer-draft`,
+              await saveDraftPolicy(sanitize(body))
+            )
+          );
+        case "POST composer-draft/submit": {
+          const message = await forwardMessage(body, {
+            sessionId,
+            delivery: "submit"
+          });
+          return await forward(`${session}/composer-draft/submit`, message);
+        }
+        case "POST control": {
+          if (body?.action !== "pause" && body?.action !== "resume") {
+            reject(403, "control_not_allowed", "Only pause and resume are available.");
+          }
+          return json(await client.requestJson("POST", `${session}/control`, body));
+        }
+        case "GET human-input-requests":
+          return await read(`${session}/human-input-requests`);
+        case "GET goal":
+          return await read(`${session}/goal`);
+        case "PATCH goal": {
+          const status = body?.status;
+          if (status !== "paused" && status !== "active" || Object.keys(body ?? {}).some((key) => key !== "status" && key !== "rationale")) {
+            reject(
+              403,
+              "goal_update_not_allowed",
+              "Only { status: paused | active } is available."
+            );
+          }
+          return json(await client.requestJson("PATCH", `${session}/goal`, { status }));
+        }
+        case "DELETE goal":
+          await client.deleteGoal(workspaceId, sessionId);
+          return new Response(null, { status: 204 });
+        case "POST fs/read":
+        case "POST fs/read-workspace": {
+          if (!sandboxFilesEnabled) return errorJson(404, "route_not_allowed", "Not found.");
+          return json(
+            await client.requestJson("POST", `${session}/fs/read-workspace`, sandboxRead(body))
+          );
+        }
+      }
+      if (op[0] === "artifacts" && (op.length === 2 || op[2] === "content") && method === "GET") {
+        if (!filesEnabled || op.length > 3) {
+          return errorJson(404, "route_not_allowed", "Not found.");
+        }
+        await client.getSession(workspaceId, sessionId, call);
+        if (op.length === 2) return await read(`${session}/artifacts/${op[1]}`);
+        return retainedContent(
+          await client.getSessionRetainedArtifactContent(workspaceId, sessionId, op[1], {
+            ...retainedRange(request),
+            signal: request.signal
+          })
+        );
+      }
+      if (op.length === 2 && op[0] === "human-input-requests" && method === "GET") {
+        return await read(`${session}/human-input-requests/${op[1]}`);
+      }
+      if (op.length === 3 && op[0] === "queue" && QUEUE_OPERATIONS.has(op[2]) && method === "POST") {
+        return json(await client.requestJson("POST", `${session}/queue/${op[1]}/${op[2]}`, body));
+      }
+      return errorJson(404, "route_not_allowed", "Not found.");
+    } catch (error) {
+      return errorResponse(error, rejectedKeyNotice);
+    }
+  };
+}
+var PROXY_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+var UPLOAD_FIELDS = ["scope", "filename", "contentType", "sizeBytes", "sha256"];
+var REALTIME_CONNECT_ROUTES = /* @__PURE__ */ new Set(["webrtc", "gateway", "supergrok"]);
+var REALTIME_MESSAGE_KINDS = /* @__PURE__ */ new Set([
+  "delegation_call",
+  "user_transcript",
+  "assistant_transcript"
+]);
+function realtimeRoute(method, rest) {
+  if (rest.length === 0) return method === "POST" ? "begin" : null;
+  if (rest.length === 1) {
+    if (REALTIME_CONNECT_ROUTES.has(rest[0])) return method === "POST" ? "connect" : null;
+    return method === "DELETE" ? "end" : null;
+  }
+  if (rest.length === 2 && rest[1] === "heartbeat") return method === "PATCH" ? "heartbeat" : null;
+  if (rest.length === 2 && rest[1] === "sync") return method === "POST" ? "sync" : null;
+  if (rest.length === 4 && rest[1] === "connections" && rest[3] === "activate") {
+    return method === "POST" ? "activate" : null;
+  }
+  return null;
+}
+function hasRealtimeMessages(body) {
+  return Array.isArray(body.entries) && body.entries.some(
+    (entry) => entry !== null && typeof entry === "object" && REALTIME_MESSAGE_KINDS.has(entry.kind)
+  );
+}
+function withRealtimeContext(body, serverContext) {
+  if (!serverContext?.trim() || !Array.isArray(body.entries)) return body;
+  return {
+    ...body,
+    entries: body.entries.map((entry) => {
+      if (entry === null || typeof entry !== "object") return entry;
+      const record = entry;
+      if (!REALTIME_MESSAGE_KINDS.has(record.kind)) return entry;
+      const modelContext = joinContext(
+        serverContext,
+        typeof record.modelContext === "string" ? record.modelContext : void 0
+      );
+      return modelContext ? { ...record, modelContext } : entry;
+    })
+  };
+}
+function normalizeToolServer(toolServer) {
+  const configured = toolServer.url ?? globalThis.process?.env?.OPENGENI_TOOL_SERVER_URL;
+  let url;
+  try {
+    url = new URL(configured ?? "");
+  } catch {
+    throw new TypeError(
+      "toolServer.url (or OPENGENI_TOOL_SERVER_URL) must be an absolute https:// URL."
+    );
+  }
+  if (url.protocol !== "https:") {
+    throw new TypeError("toolServer.url must be an absolute https:// URL.");
+  }
+  const id = toolServer.id ?? "app";
+  if (!/^[A-Za-z0-9_-]+$/.test(id)) {
+    throw new TypeError("toolServer.id may contain only letters, digits, _ and -.");
+  }
+  const ask = toolServer.approvals?.ask;
+  if (ask !== void 0 && ask !== true && !(Array.isArray(ask) && ask.every(isToolName))) {
+    throw new TypeError("toolServer.approvals.ask must be true or a list of tool names.");
+  }
+  return {
+    ...toolServer,
+    url: configured,
+    id,
+    secret: resolveToolTokenSecret(toolServer.secret)
+  };
+}
+function isToolName(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function withToolServer(created, toolServer, token) {
+  const servers = created.mcpServers ?? [];
+  if (servers.some((server) => server.id === toolServer.id)) {
+    throw new TypeError(
+      `createSession already attaches an MCP server with the toolServer id "${toolServer.id}".`
+    );
+  }
+  const ask = toolServer.approvals?.ask;
+  const tools = created.tools;
+  return {
+    ...created,
+    mcpServers: [
+      ...servers,
+      {
+        id: toolServer.id,
+        ...toolServer.name ? { name: toolServer.name } : {},
+        url: toolServer.url,
+        headers: { Authorization: `Bearer ${token}` },
+        ...ask === true ? { requireApproval: true } : ask?.length ? { requireApproval: ask } : {}
+      }
+    ],
+    // Omitted tools keep workspace defaults; the attachment alone selects the
+    // server. An explicit allow-list gets the server's tools on the first request.
+    ...Array.isArray(tools) && !tools.some((tool) => tool.id === toolServer.id) ? {
+      tools: [...tools, { kind: "mcp", id: toolServer.id, eager: true }]
+    } : {}
+  };
+}
+var EDITABLE_ARTIFACT_LIVE_PATH = "/v1/editable-artifacts/live";
+var SITE_LIST_FIELDS = ["limit", "cursor", "status"];
+var TICKET_FIELDS = [
+  "replicaId",
+  "modality",
+  "liveProtocolVersion",
+  "kernelVersion",
+  "modelSchemaVersion",
+  "snapshotVersion",
+  "commandProtocolVersion",
+  "committedTransactionProtocolVersion"
+];
+var SITE_HTML_HEADERS = {
+  "Content-Type": "text/html; charset=utf-8",
+  "Cache-Control": "private, no-store",
+  "Content-Security-Policy": "sandbox allow-scripts",
+  "Cross-Origin-Resource-Policy": "same-origin",
+  "X-Content-Type-Options": "nosniff",
+  "Content-Disposition": 'attachment; filename="site.html"'
+};
+function liveSocketUrl(value) {
+  const url = new URL(value);
+  if (url.protocol === "https:") url.protocol = "wss:";
+  else if (url.protocol === "http:") url.protocol = "ws:";
+  if (url.protocol !== "wss:" && url.protocol !== "ws:") {
+    throw new TypeError("editableLiveUrl must be an HTTP(S) or WS(S) URL");
+  }
+  return url.href;
+}
+function boundedSiteHtml(body, signal) {
+  const reader = body?.getReader();
+  let bytes = 0;
+  let settled = false;
+  let controller;
+  const cleanup = () => signal.removeEventListener("abort", abort);
+  const cancel = async (reason) => {
+    if (settled) return;
+    settled = true;
+    cleanup();
+    await reader?.cancel(reason).catch(() => void 0);
+    reader?.releaseLock();
+  };
+  const abort = () => {
+    if (settled) return;
+    controller.error(signal.reason);
+    void cancel(signal.reason);
+  };
+  return new ReadableStream(
+    {
+      start(value) {
+        controller = value;
+        if (signal.aborted) abort();
+        else signal.addEventListener("abort", abort, { once: true });
+      },
+      async pull(value) {
+        if (settled) return;
+        try {
+          const chunk = await reader?.read();
+          if (settled) return;
+          if (!chunk || chunk.done) {
+            settled = true;
+            cleanup();
+            reader?.releaseLock();
+            value.close();
+            return;
+          }
+          bytes += chunk.value.byteLength;
+          if (bytes > SESSION_PROXY_SITE_HTML_MAX_BYTES) {
+            const error = new SessionProxySiteHtmlTooLargeError();
+            value.error(error);
+            await cancel(error);
+            return;
+          }
+          value.enqueue(chunk.value);
+        } catch (error) {
+          if (settled) return;
+          value.error(error);
+          await cancel(error);
+        }
+      },
+      cancel
+    },
+    // Read only when the downstream consumer requests a chunk.
+    { highWaterMark: 0 }
+  );
+}
+async function artifactViewerCapability(input) {
+  return {
+    editableLiveUrl: liveSocketUrl(
+      input.editableLiveUrl ?? input.client.apiUrl(EDITABLE_ARTIFACT_LIVE_PATH)
+    ),
+    cachePartition: await cachePartition(
+      input.client.requestJson ? await getSessionProxyWorkspaceGrant(
+        input.client,
+        input.workspaceId
+      ) : await legacyViewerGrant(input.client, input.workspaceId),
+      input.workspaceId,
+      input.source ?? "default"
+    )
+  };
+}
+async function cachePartition(grant, workspaceId, source) {
+  if (grant.workspaceId !== workspaceId) {
+    reject(403, "workspace_not_allowed", "This workspace is not available.");
+  }
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(
+      JSON.stringify({
+        source,
+        subjectId: grant.subjectId,
+        accountId: grant.accountId,
+        workspaceId,
+        permissions: [...grant.permissions].sort(),
+        // Effective external grants carry live identity/link revisions. Include
+        // them even when a revoke/regrant restores an identical permission set.
+        externalActor: grant.metadata?.externalActor ?? null
+      })
+    )
+  );
+  return {
+    accountId: grant.accountId,
+    principalId: grant.subjectId,
+    authorizationEpoch: `sha256:${[...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`
+  };
+}
+async function legacyViewerGrant(client, workspaceId) {
+  const access = await client.getAccessContext();
+  const grant = access.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId);
+  if (!grant) reject(403, "workspace_not_allowed", "This workspace is not available.");
+  return grant;
+}
+function retainedRange(request) {
+  const range = request.headers.get("range");
+  if (range === null) return {};
+  if (range.length > 128 || /[^\x20-\x7e]/.test(range)) {
+    reject(400, "invalid_range", "Range must be at most 128 printable ASCII bytes.");
+  }
+  return { range };
+}
+function retainedContent(content) {
+  return new Response(content.bytes, {
+    status: content.status,
+    headers: {
+      "Content-Type": content.contentType,
+      "Content-Length": String(content.contentLength),
+      ...content.contentRange ? { "Content-Range": content.contentRange } : {},
+      "Accept-Ranges": "bytes",
+      "Cache-Control": "private, no-store",
+      // Bytes for the conversation's own reader; never rendered on this origin.
+      "Content-Security-Policy": "sandbox",
+      "Content-Disposition": "attachment",
+      "Cross-Origin-Resource-Policy": "same-origin",
+      "X-Content-Type-Options": "nosniff"
+    }
+  });
+}
+function sandboxRead(body) {
+  const path = body?.path;
+  const encoding = body?.encoding;
+  const maxBytes = body?.maxBytes;
+  if (typeof path !== "string" || !path || path.length > 4096) {
+    reject(400, "invalid_body", "path is required.");
+  }
+  if (encoding !== void 0 && encoding !== "utf8" && encoding !== "base64") {
+    reject(400, "invalid_body", "encoding must be utf8 or base64.");
+  }
+  if (maxBytes !== void 0 && (typeof maxBytes !== "number" || !Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > 25 * 1024 * 1024)) {
+    reject(400, "invalid_body", "maxBytes must be an integer from 1 to 26214400.");
+  }
+  return {
+    path,
+    workspaceOnly: true,
+    ...encoding === void 0 ? {} : { encoding },
+    ...maxBytes === void 0 ? {} : { maxBytes }
+  };
+}
+function routeSegments(pathname, basePath) {
+  let rest;
+  if (basePath !== void 0) {
+    const prefix = basePath.replace(/\/+$/, "");
+    if (!pathname.startsWith(`${prefix}/`)) return null;
+    rest = pathname.slice(prefix.length);
+  } else {
+    const index = pathname.indexOf("/v1/");
+    if (index < 0) return null;
+    rest = pathname.slice(index);
+  }
+  const raw = rest.replace(/\/+$/, "").split("/").slice(1);
+  if (raw[0] !== "v1" || raw.length < 2) return null;
+  const segments = [];
+  for (const part of raw.slice(1)) {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(part);
+    } catch {
+      return null;
+    }
+    if (!SEGMENT.test(decoded)) return null;
+    segments.push(decoded);
+  }
+  return segments;
+}
+async function readJsonBody(request, maxBytes, optional = false) {
+  const bytes = await readBoundedBytes(request, maxBytes);
+  if (bytes.byteLength === 0) {
+    if (optional) return void 0;
+    reject(400, "invalid_body", "A JSON object body is required.");
+  }
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!/^application\/json\b/i.test(contentType)) {
+    reject(415, "unsupported_media_type", "Send application/json.");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(bytes));
+  } catch {
+    reject(400, "invalid_body", "Body is not valid JSON.");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    reject(400, "invalid_body", "A JSON object body is required.");
+  }
+  return parsed;
+}
+async function readBoundedBytes(request, maxBytes) {
+  const declared = Number(request.headers.get("content-length") ?? "0");
+  if (declared > maxBytes) reject(413, "body_too_large", "Request body is too large.");
+  const reader = request.body?.getReader();
+  const chunks = [];
+  let total = 0;
+  if (reader) {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      total += value.byteLength;
+      if (total > maxBytes) {
+        void reader.cancel().catch(() => void 0);
+        reject(413, "body_too_large", "Request body is too large.");
+      }
+      chunks.push(value);
+    }
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return bytes;
+}
+function pick(body, fields) {
+  const picked = {};
+  for (const field of fields) {
+    if (body && Object.hasOwn(body, field)) picked[field] = body[field];
+  }
+  return picked;
+}
+function createInput(body, modelSelection) {
+  for (const key of Object.keys(body ?? {})) {
+    if (!CREATE_FIELDS.has(key) && !(modelSelection && isModelField(key))) {
+      reject(
+        400,
+        "create_field_not_allowed",
+        `The server chooses session configuration; "${key}" cannot be set from the browser.`
+      );
+    }
+  }
+  const initialMessage = body?.initialMessage;
+  const idempotencyKey = body?.idempotencyKey;
+  const startMode = body?.startMode;
+  if (startMode !== void 0 && startMode !== "realtime") {
+    reject(400, "invalid_start_mode", "startMode must be realtime when supplied.");
+  }
+  if (startMode === "realtime" && initialMessage !== void 0 && initialMessage !== "") {
+    reject(
+      400,
+      "initial_message_not_allowed",
+      "Voice-first creation does not send an initial message."
+    );
+  }
+  if (startMode !== "realtime" && (typeof initialMessage !== "string" || !initialMessage.trim())) {
+    reject(400, "initial_message_required", "initialMessage is required.");
+  }
+  if (idempotencyKey !== void 0 && (typeof idempotencyKey !== "string" || !idempotencyKey)) {
+    reject(400, "invalid_idempotency_key", "idempotencyKey must be a non-empty string.");
+  }
+  const resources = createResources(body?.resources);
+  if (startMode === "realtime" && resources.length > 0) {
+    reject(400, "resource_not_allowed", "Keep attachments in the draft until a message is sent.");
+  }
+  const policy = {};
+  for (const field of MODEL_FIELDS) {
+    const value = body?.[field];
+    if (value === void 0) continue;
+    if (typeof value !== "string" || !value) {
+      reject(400, "invalid_model_policy", `${field} must be a non-empty string.`);
+    }
+    policy[field] = value;
+  }
+  return {
+    initialMessage: startMode === "realtime" ? "" : initialMessage,
+    ...startMode === "realtime" ? { startMode } : {},
+    ...idempotencyKey ? { idempotencyKey } : {},
+    ...resources.length > 0 ? { resources } : {},
+    ...policy
+  };
+}
+function isModelField(key) {
+  return MODEL_FIELDS.includes(key);
+}
+function createResources(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) {
+    reject(403, "resource_not_allowed", "Only file attachments may be added from the browser.");
+  }
+  return value.map((resource) => {
+    const file = resource;
+    if (!file || typeof file !== "object" || file.kind !== "file" || typeof file.fileId !== "string" || !file.fileId || file.mountPath !== void 0 && typeof file.mountPath !== "string") {
+      reject(403, "resource_not_allowed", "Only file attachments may be added from the browser.");
+    }
+    return {
+      kind: "file",
+      fileId: file.fileId,
+      ...file.mountPath !== void 0 ? { mountPath: file.mountPath } : {}
+    };
+  });
+}
+function withBrowserCreateChoices(created, input) {
+  const existing = created.resources ?? [];
+  const attached = new Set(
+    existing.flatMap((resource) => resource.kind === "file" ? [resource.fileId] : [])
+  );
+  const added = (input.resources ?? []).filter((resource) => !attached.has(resource.fileId));
+  return {
+    ...created,
+    // Preserve browser retry identity even when a simple host hook omits it;
+    // an explicit server-owned key continues to take precedence.
+    ...created.idempotencyKey === void 0 && input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {},
+    ...input.startMode === "realtime" ? { startMode: "realtime", initialMessage: void 0 } : {},
+    ...added.length > 0 ? { resources: [...existing, ...added] } : {},
+    ...input.model ? { model: input.model } : {},
+    ...input.reasoningEffort ? { reasoningEffort: input.reasoningEffort } : {},
+    ...input.latencyMode ? { latencyMode: input.latencyMode } : {}
+  };
+}
+async function transcriptionInput(request) {
+  const contentType = request.headers.get("content-type") ?? "";
+  if (!/^multipart\/form-data\b/i.test(contentType)) {
+    reject(415, "unsupported_media_type", "Send multipart/form-data.");
+  }
+  const bytes = await readBoundedBytes(request, MAX_TRANSCRIPTION_BODY_BYTES);
+  let form;
+  try {
+    form = await new Response(bytes, {
+      headers: { "Content-Type": contentType }
+    }).formData();
+  } catch {
+    reject(400, "invalid_audio", "The recording could not be read.");
+  }
+  const audio = form.get("audio");
+  const mimeType = form.get("mimeType");
+  const duration = form.get("durationSeconds");
+  if (!(audio instanceof File)) reject(400, "invalid_audio", "Audio file is required.");
+  const durationSeconds = typeof duration === "string" && duration ? Number(duration) : void 0;
+  if (durationSeconds !== void 0 && !(Number.isFinite(durationSeconds) && durationSeconds >= 0)) {
+    reject(400, "invalid_audio", "durationSeconds must be a non-negative number.");
+  }
+  return {
+    audio,
+    mimeType: typeof mimeType === "string" && mimeType ? mimeType : audio.type,
+    ...durationSeconds !== void 0 ? { durationSeconds } : {},
+    signal: request.signal
+  };
+}
+function browserPayload(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    reject(400, "invalid_body", "A JSON object body is required.");
+  }
+  const input = { ...value };
+  if (Object.hasOwn(input, "mcpCredentialUpdates")) {
+    reject(403, "credential_update_not_allowed", "MCP credentials are server-owned.");
+  }
+  return input;
+}
+function sanitizeMessage(value, modelSelection) {
+  const input = browserPayload(value);
+  if (input.resources !== void 0) {
+    if (!Array.isArray(input.resources) || input.resources.some(
+      (resource) => !resource || typeof resource !== "object" || resource.kind !== "file"
+    )) {
+      reject(403, "resource_not_allowed", "Only file attachments may be added from the browser.");
+    }
+  }
+  if (!modelSelection) {
+    for (const field of MODEL_FIELDS) delete input[field];
+  }
+  return input;
+}
+function clientEvent(body) {
+  switch (body?.type) {
+    case "user.message":
+    case "user.approvalDecision":
+    case "user.humanInputResponse":
+      return body;
+    default:
+      return reject(403, "event_not_allowed", "This session event type is not available.");
+  }
+}
+function joinContext(...parts) {
+  const joined = parts.map((part) => part?.trim()).filter(Boolean).join("\n\n");
+  return joined || void 0;
+}
+async function listEvents(client, path, query, call) {
+  if (query.mode === "forensic") {
+    reject(403, "forensic_events_not_allowed", "Forensic event reads are not proxied.");
+  }
+  const upstream = await client.requestJsonResponse(path, query, call);
+  const headers = {};
+  upstream.headers.forEach((value, name) => {
+    const lower = name.toLowerCase();
+    if (lower.startsWith("x-opengeni-") && lower !== OPENGENI_API_CONTRACT_HEADER) {
+      headers[name] = value;
+    }
+  });
+  return new Response(await upstream.text(), {
+    headers: {
+      "Content-Type": "application/json; charset=utf-8",
+      "Cache-Control": "no-store",
+      ...headers
+    }
+  });
+}
+function workspaceLiveStream(client, workspaceId, params, request, heartbeatMs) {
+  const cursor = (name) => {
+    const value = Number(params.get(name) ?? "0");
+    return Number.isSafeInteger(value) && value > 0 ? value : 0;
+  };
+  const upstream = new AbortController();
+  if (request.signal.aborted) upstream.abort();
+  else
+    request.signal.addEventListener("abort", () => upstream.abort(), {
+      once: true
+    });
+  const events = client.streamWorkspaceLiveEvents(workspaceId, {
+    controlAfter: cursor("controlAfter"),
+    interactionAfter: cursor("interactionAfter"),
+    signal: upstream.signal
+  });
+  const iterator = events[Symbol.asyncIterator]();
+  const encoder = new TextEncoder();
+  let heartbeat;
+  const stop = () => {
+    if (heartbeat !== void 0) clearInterval(heartbeat);
+    heartbeat = void 0;
+  };
+  const body = new ReadableStream({
+    start: (controller) => {
+      heartbeat = setInterval(() => {
+        try {
+          controller.enqueue(encoder.encode(": ping\n\n"));
+        } catch {
+          stop();
+        }
+      }, heartbeatMs);
+    },
+    pull: async (controller) => {
+      const next = await iterator.next().catch((error) => {
+        stop();
+        throw error;
+      });
+      if (next.done) {
+        stop();
+        controller.close();
+        return;
+      }
+      const event = next.value;
+      controller.enqueue(
+        encoder.encode(
+          `id: ${event.sequence}
+event: ${event.type}
+data: ${JSON.stringify(event)}
+
+`
+        )
+      );
+    },
+    cancel: () => {
+      stop();
+      upstream.abort();
+      void Promise.resolve(iterator.return?.(void 0)).catch(() => void 0);
+    }
+  });
+  return new Response(body, {
+    headers: {
+      "Content-Type": "text/event-stream; charset=utf-8",
+      "Cache-Control": "no-cache, no-transform",
+      Connection: "keep-alive"
+    }
+  });
+}
+function warnRejectedApiKey(error, notice) {
+  if (notice.sent) return;
+  notice.sent = true;
+  console.warn(
+    `[@opengeni/sdk] Opengeni rejected the session proxy's API key (401${error.correlationId ? `, reference ${error.correlationId}` : ""}). It may be expired, revoked or mistyped: create a new key in Opengeni under Organization settings > Developer and update OPENGENI_API_KEY on the server.`
+  );
+}
+function errorResponse(error, rejectedKeyNotice) {
+  if (error instanceof ProxyRejection) return errorJson(error.status, error.code, error.message);
+  if (error instanceof OpenGeniSetupError) {
+    return json(
+      {
+        error: {
+          code: error.code,
+          message: error.message,
+          retryable: false,
+          ...error.correlationId ? { requestId: error.correlationId } : {}
+        }
+      },
+      error.status
+    );
+  }
+  if (error instanceof OpenGeniApiError) {
+    if (error.status === 401) warnRejectedApiKey(error, rejectedKeyNotice);
+    const status = error.status >= 400 && error.status <= 599 ? error.status : 502;
+    if (error.body) {
+      return new Response(error.body, {
+        status,
+        headers: {
+          "Content-Type": "application/json; charset=utf-8",
+          "Cache-Control": "no-store"
+        }
+      });
+    }
+    return json(
+      {
+        error: {
+          code: error.code ?? "opengeni_api_error",
+          message: error.message,
+          retryable: error.retryable,
+          outcomeUnknown: error.outcomeUnknown,
+          ...error.correlationId ? { requestId: error.correlationId } : {},
+          ...error.details ? { details: error.details } : {}
+        }
+      },
+      status
+    );
+  }
+  if (error instanceof Error && error.name === "AbortError") {
+    return errorJson(499, "aborted", "The request was aborted.");
+  }
+  console.error("[@opengeni/sdk] Session proxy request failed:", error);
+  return errorJson(500, "proxy_error", "Request could not be completed.");
+}
+
+export {
+  openGeniLinkScheme,
+  isReservedOpenGeniLink,
+  parseSandboxLink,
+  parseRetainedFileReference,
+  parseOpenGeniLink,
+  openGeniConsolePath,
+  SESSION_SCOPE_HEADER,
+  formatSseEvent,
+  sessionEventsToSseStream,
+  sessionEventsToSseResponse,
+  resumeSequenceFromRequest,
+  proxySessionEventStream,
+  SESSION_PROXY_SITE_HTML_MAX_BYTES,
+  SessionProxySiteHtmlTooLargeError,
+  getSessionProxyWorkspaceGrant,
+  getSessionProxyArtifactAssociation,
+  downloadSessionProxySiteHtml,
+  createSessionProxyHandler,
+  artifactViewerCapability
+};
+//# sourceMappingURL=chunk-6HZGAIUE.js.map