@opengeni/sdk 3.1.2 → 3.2.2

package/dist/{chunk-YDVPI7WT.js → chunk-JP62FZSI.js}

@@ -1,6 +1,6 @@
 import {
   OpenGeniClient
-} from "./chunk-NEM5N6C6.js";
+} from "./chunk-JKG75TTU.js";
 
 // src/document-authority-client.ts
 var OpenGeniDocumentAuthorityClient = class extends OpenGeniClient {
@@ -147,4 +147,4 @@ var OpenGeniDocumentAuthorityClient = class extends OpenGeniClient {
 export {
   OpenGeniDocumentAuthorityClient
 };
-//# sourceMappingURL=chunk-YDVPI7WT.js.map
+//# sourceMappingURL=chunk-JP62FZSI.js.map

package/dist/chunk-KGEABAID.js

@@ -0,0 +1,71 @@
+// ../contracts/src/workspace-integration-wire.ts
+var WORKSPACE_WEBHOOK_EVENT_TYPES = [
+  "turn.completed",
+  "turn.failed",
+  "turn.cancelled",
+  "session.status.changed",
+  "session.requiresAction",
+  "session.humanInput.requested",
+  "session.notification.posted",
+  "session.notification.withdrawn",
+  "usage.threshold_reached",
+  "usage.exhausted",
+  "usage.period_reset"
+];
+var OPENGENI_WEBHOOK_TEST_EVENT_TYPE = "webhook.test";
+var OPENGENI_TEST_REQUEST_NIL_ID = "00000000-0000-0000-0000-000000000000";
+var OPENGENI_SIGNATURE_HEADER = "OpenGeni-Signature";
+var OPENGENI_EVENT_ID_HEADER = "OpenGeni-Event-Id";
+var OPENGENI_DELIVERY_ID_HEADER = "OpenGeni-Delivery-Id";
+var OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;
+var encoder = new TextEncoder();
+async function hmacSha256Hex(secret, message) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(message)));
+  return Array.from(signature, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function constantTimeEqualHex(left, right) {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  }
+  return difference === 0;
+}
+async function signOpenGeniPayload(secret, body, timestampSeconds = Math.floor(Date.now() / 1e3)) {
+  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;
+}
+async function verifyOpenGeniSignature(input) {
+  if (!input.signature) return false;
+  let timestamp = null;
+  const candidates = [];
+  for (const part of input.signature.split(",")) {
+    const [key, value] = part.trim().split("=", 2);
+    if (key === "t" && value && /^\d{1,12}$/.test(value)) timestamp = Number(value);
+    if (key === "v1" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);
+  }
+  if (timestamp === null || candidates.length === 0) return false;
+  const now = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;
+  if (Math.abs(now - timestamp) > tolerance) return false;
+  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);
+  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));
+}
+
+export {
+  WORKSPACE_WEBHOOK_EVENT_TYPES,
+  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
+  OPENGENI_TEST_REQUEST_NIL_ID,
+  OPENGENI_SIGNATURE_HEADER,
+  OPENGENI_EVENT_ID_HEADER,
+  OPENGENI_DELIVERY_ID_HEADER,
+  signOpenGeniPayload,
+  verifyOpenGeniSignature
+};
+//# sourceMappingURL=chunk-KGEABAID.js.map

package/dist/chunk-KGEABAID.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../contracts/src/workspace-integration-wire.ts"],"sourcesContent":["/**\n * Dependency-free wire constants and the OpenGeni-Signature scheme shared by\n * workspace webhooks and credential providers. Kept free of zod so browser and\n * React Native bundles can verify signatures without the schema runtime.\n */\n\nexport const WORKSPACE_WEBHOOK_EVENT_TYPES = [\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.humanInput.requested\",\n  \"session.notification.posted\",\n  \"session.notification.withdrawn\",\n  \"usage.threshold_reached\",\n  \"usage.exhausted\",\n  \"usage.period_reset\",\n] as const;\n\n/**\n * Sent only when an administrator presses \"Send test event\". It is never a\n * subscribable type: every endpoint can receive it, and a receiver that does\n * not care acknowledges it with any 2xx.\n */\nexport const OPENGENI_WEBHOOK_TEST_EVENT_TYPE = \"webhook.test\";\n\n/**\n * The session, turn and attempt ids of a credential-provider test request\n * (`purpose: \"test\"`). A test is not a run, so no real ids exist.\n */\nexport const OPENGENI_TEST_REQUEST_NIL_ID = \"00000000-0000-0000-0000-000000000000\";\n\nexport const OPENGENI_SIGNATURE_HEADER = \"OpenGeni-Signature\";\nexport const OPENGENI_EVENT_ID_HEADER = \"OpenGeni-Event-Id\";\nexport const OPENGENI_DELIVERY_ID_HEADER = \"OpenGeni-Delivery-Id\";\nexport const OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;\n\nconst encoder = new TextEncoder();\n\nasync function hmacSha256Hex(secret: string, message: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, encoder.encode(message)));\n  return Array.from(signature, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction constantTimeEqualHex(left: string, right: string): boolean {\n  if (left.length !== right.length) return false;\n  let difference = 0;\n  for (let index = 0; index < left.length; index += 1) {\n    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);\n  }\n  return difference === 0;\n}\n\n/**\n * `OpenGeni-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, \"<t>.<body>\")>`.\n * The timestamp is signed so a captured request cannot be replayed later.\n */\nexport async function signOpenGeniPayload(\n  secret: string,\n  body: string,\n  timestampSeconds = Math.floor(Date.now() / 1000),\n): Promise<string> {\n  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;\n}\n\nexport type VerifyOpenGeniSignatureInput = {\n  secret: string;\n  /** The exact raw request body, before JSON parsing. */\n  body: string;\n  /** The `OpenGeni-Signature` header value. */\n  signature: string | null | undefined;\n  toleranceSeconds?: number;\n  nowSeconds?: number;\n};\n\nexport async function verifyOpenGeniSignature(\n  input: VerifyOpenGeniSignatureInput,\n): Promise<boolean> {\n  if (!input.signature) return false;\n  let timestamp: number | null = null;\n  const candidates: string[] = [];\n  for (const part of input.signature.split(\",\")) {\n    const [key, value] = part.trim().split(\"=\", 2);\n    if (key === \"t\" && value && /^\\d{1,12}$/.test(value)) timestamp = Number(value);\n    if (key === \"v1\" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);\n  }\n  if (timestamp === null || candidates.length === 0) return false;\n  const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;\n  if (Math.abs(now - timestamp) > tolerance) return false;\n  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);\n  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));\n}\n"],"mappings":";AAMO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,mCAAmC;AAMzC,IAAM,+BAA+B;AAErC,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,8BAA8B;AACpC,IAAM,uCAAuC;AAEpD,IAAM,UAAU,IAAI,YAAY;AAEhC,eAAe,cAAc,QAAgB,SAAkC;AAC7E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,OAAO,CAAC,CAAC;AAC/F,SAAO,MAAM,KAAK,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACpF;AAEA,SAAS,qBAAqB,MAAc,OAAwB;AAClE,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,kBAAc,KAAK,WAAW,KAAK,IAAI,MAAM,WAAW,KAAK;AAAA,EAC/D;AACA,SAAO,eAAe;AACxB;AAMA,eAAsB,oBACpB,QACA,MACA,mBAAmB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC9B;AACjB,SAAO,KAAK,gBAAgB,OAAO,MAAM,cAAc,QAAQ,GAAG,gBAAgB,IAAI,IAAI,EAAE,CAAC;AAC/F;AAYA,eAAsB,wBACpB,OACkB;AAClB,MAAI,CAAC,MAAM,UAAW,QAAO;AAC7B,MAAI,YAA2B;AAC/B,QAAM,aAAuB,CAAC;AAC9B,aAAW,QAAQ,MAAM,UAAU,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE,MAAM,KAAK,CAAC;AAC7C,QAAI,QAAQ,OAAO,SAAS,aAAa,KAAK,KAAK,EAAG,aAAY,OAAO,KAAK;AAC9E,QAAI,QAAQ,QAAQ,SAAS,iBAAiB,KAAK,KAAK,EAAG,YAAW,KAAK,KAAK;AAAA,EAClF;AACA,MAAI,cAAc,QAAQ,WAAW,WAAW,EAAG,QAAO;AAC1D,QAAM,MAAM,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5D,QAAM,YAAY,MAAM,oBAAoB;AAC5C,MAAI,KAAK,IAAI,MAAM,SAAS,IAAI,UAAW,QAAO;AAClD,QAAM,WAAW,MAAM,cAAc,MAAM,QAAQ,GAAG,SAAS,IAAI,MAAM,IAAI,EAAE;AAC/E,SAAO,WAAW,KAAK,CAAC,cAAc,qBAAqB,WAAW,QAAQ,CAAC;AACjF;","names":[]}

package/dist/{chunk-S3D75WSQ.js → chunk-N2I422X4.js}

@@ -1,6 +1,6 @@
 import {
   OpenGeniClient
-} from "./chunk-OAKHWFSV.js";
+} from "./chunk-PDU6EU2M.js";
 
 // src/embedding-client.ts
 function hasStaticHeader(options, names) {
@@ -337,4 +337,4 @@ export {
   EMPTY_FINAL_REPLY_NOTICE,
   turnCompletedWithEmptyFinalReply
 };
-//# sourceMappingURL=chunk-S3D75WSQ.js.map
+//# sourceMappingURL=chunk-N2I422X4.js.map

package/dist/{chunk-JXXCTW5W.js → chunk-PBVUAXSU.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-P7UWKORG.js";
 import {
   OpenGeniClient
-} from "./chunk-NEM5N6C6.js";
+} from "./chunk-JKG75TTU.js";
 import {
   OpenGeniApiError
 } from "./chunk-7EWT3PV6.js";
@@ -1389,4 +1389,4 @@ export {
   sanitizeOpenGeniSiteToolCallRequest,
   sanitizeOpenGeniSiteToolInvokeRequest
 };
-//# sourceMappingURL=chunk-JXXCTW5W.js.map
+//# sourceMappingURL=chunk-PBVUAXSU.js.map

package/dist/{chunk-OAKHWFSV.js → chunk-PDU6EU2M.js}

@@ -1,6 +1,6 @@
 import {
   OpenGeniDocumentAuthorityClient
-} from "./chunk-YDVPI7WT.js";
+} from "./chunk-JP62FZSI.js";
 
 // src/artifact-client.ts
 var OpenGeniClient = class extends OpenGeniDocumentAuthorityClient {
@@ -121,4 +121,4 @@ var OpenGeniClient = class extends OpenGeniDocumentAuthorityClient {
 export {
   OpenGeniClient
 };
-//# sourceMappingURL=chunk-OAKHWFSV.js.map
+//# sourceMappingURL=chunk-PDU6EU2M.js.map

package/dist/{chunk-RJHCBZF7.js → chunk-VT4YM4XQ.js}

@@ -1,62 +1,10 @@
-// ../contracts/src/workspace-integration-wire.ts
-var WORKSPACE_WEBHOOK_EVENT_TYPES = [
-  "turn.completed",
-  "turn.failed",
-  "turn.cancelled",
-  "session.status.changed",
-  "session.requiresAction",
-  "session.humanInput.requested",
-  "session.notification.posted",
-  "session.notification.withdrawn",
-  "usage.threshold_reached",
-  "usage.exhausted",
-  "usage.period_reset"
-];
-var OPENGENI_WEBHOOK_TEST_EVENT_TYPE = "webhook.test";
-var OPENGENI_TEST_REQUEST_NIL_ID = "00000000-0000-0000-0000-000000000000";
-var OPENGENI_SIGNATURE_HEADER = "OpenGeni-Signature";
-var OPENGENI_EVENT_ID_HEADER = "OpenGeni-Event-Id";
-var OPENGENI_DELIVERY_ID_HEADER = "OpenGeni-Delivery-Id";
-var OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;
-var encoder = new TextEncoder();
-async function hmacSha256Hex(secret, message) {
-  const key = await crypto.subtle.importKey(
-    "raw",
-    encoder.encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(message)));
-  return Array.from(signature, (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function constantTimeEqualHex(left, right) {
-  if (left.length !== right.length) return false;
-  let difference = 0;
-  for (let index = 0; index < left.length; index += 1) {
-    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
-  }
-  return difference === 0;
-}
-async function signOpenGeniPayload(secret, body, timestampSeconds = Math.floor(Date.now() / 1e3)) {
-  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;
-}
-async function verifyOpenGeniSignature(input) {
-  if (!input.signature) return false;
-  let timestamp = null;
-  const candidates = [];
-  for (const part of input.signature.split(",")) {
-    const [key, value] = part.trim().split("=", 2);
-    if (key === "t" && value && /^\d{1,12}$/.test(value)) timestamp = Number(value);
-    if (key === "v1" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);
-  }
-  if (timestamp === null || candidates.length === 0) return false;
-  const now = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
-  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;
-  if (Math.abs(now - timestamp) > tolerance) return false;
-  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);
-  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));
-}
+import {
+  OPENGENI_DELIVERY_ID_HEADER,
+  OPENGENI_EVENT_ID_HEADER,
+  OPENGENI_SIGNATURE_HEADER,
+  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
+  verifyOpenGeniSignature
+} from "./chunk-KGEABAID.js";
 
 // src/workspace-integrations.ts
 var OpenGeniSignatureError = class extends Error {
@@ -236,14 +184,6 @@ async function getWorkspaceInheritedIntegrations(client, workspaceId) {
 }
 
 export {
-  WORKSPACE_WEBHOOK_EVENT_TYPES,
-  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
-  OPENGENI_TEST_REQUEST_NIL_ID,
-  OPENGENI_SIGNATURE_HEADER,
-  OPENGENI_EVENT_ID_HEADER,
-  OPENGENI_DELIVERY_ID_HEADER,
-  signOpenGeniPayload,
-  verifyOpenGeniSignature,
   OpenGeniSignatureError,
   verifyWebhookEvent,
   verifyCredentialProviderRequest,
@@ -267,4 +207,4 @@ export {
   testWorkspaceCredentialProvider,
   getWorkspaceInheritedIntegrations
 };
-//# sourceMappingURL=chunk-RJHCBZF7.js.map
+//# sourceMappingURL=chunk-VT4YM4XQ.js.map

package/dist/{chunk-RJHCBZF7.js.map → chunk-VT4YM4XQ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../../contracts/src/workspace-integration-wire.ts","../src/workspace-integrations.ts"],"sourcesContent":["/**\n * Dependency-free wire constants and the OpenGeni-Signature scheme shared by\n * workspace webhooks and credential providers. Kept free of zod so browser and\n * React Native bundles can verify signatures without the schema runtime.\n */\n\nexport const WORKSPACE_WEBHOOK_EVENT_TYPES = [\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.humanInput.requested\",\n  \"session.notification.posted\",\n  \"session.notification.withdrawn\",\n  \"usage.threshold_reached\",\n  \"usage.exhausted\",\n  \"usage.period_reset\",\n] as const;\n\n/**\n * Sent only when an administrator presses \"Send test event\". It is never a\n * subscribable type: every endpoint can receive it, and a receiver that does\n * not care acknowledges it with any 2xx.\n */\nexport const OPENGENI_WEBHOOK_TEST_EVENT_TYPE = \"webhook.test\";\n\n/**\n * The session, turn and attempt ids of a credential-provider test request\n * (`purpose: \"test\"`). A test is not a run, so no real ids exist.\n */\nexport const OPENGENI_TEST_REQUEST_NIL_ID = \"00000000-0000-0000-0000-000000000000\";\n\nexport const OPENGENI_SIGNATURE_HEADER = \"OpenGeni-Signature\";\nexport const OPENGENI_EVENT_ID_HEADER = \"OpenGeni-Event-Id\";\nexport const OPENGENI_DELIVERY_ID_HEADER = \"OpenGeni-Delivery-Id\";\nexport const OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;\n\nconst encoder = new TextEncoder();\n\nasync function hmacSha256Hex(secret: string, message: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, encoder.encode(message)));\n  return Array.from(signature, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction constantTimeEqualHex(left: string, right: string): boolean {\n  if (left.length !== right.length) return false;\n  let difference = 0;\n  for (let index = 0; index < left.length; index += 1) {\n    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);\n  }\n  return difference === 0;\n}\n\n/**\n * `OpenGeni-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, \"<t>.<body>\")>`.\n * The timestamp is signed so a captured request cannot be replayed later.\n */\nexport async function signOpenGeniPayload(\n  secret: string,\n  body: string,\n  timestampSeconds = Math.floor(Date.now() / 1000),\n): Promise<string> {\n  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;\n}\n\nexport type VerifyOpenGeniSignatureInput = {\n  secret: string;\n  /** The exact raw request body, before JSON parsing. */\n  body: string;\n  /** The `OpenGeni-Signature` header value. */\n  signature: string | null | undefined;\n  toleranceSeconds?: number;\n  nowSeconds?: number;\n};\n\nexport async function verifyOpenGeniSignature(\n  input: VerifyOpenGeniSignatureInput,\n): Promise<boolean> {\n  if (!input.signature) return false;\n  let timestamp: number | null = null;\n  const candidates: string[] = [];\n  for (const part of input.signature.split(\",\")) {\n    const [key, value] = part.trim().split(\"=\", 2);\n    if (key === \"t\" && value && /^\\d{1,12}$/.test(value)) timestamp = Number(value);\n    if (key === \"v1\" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);\n  }\n  if (timestamp === null || candidates.length === 0) return false;\n  const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;\n  if (Math.abs(now - timestamp) > tolerance) return false;\n  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);\n  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));\n}\n","import {\n  OPENGENI_DELIVERY_ID_HEADER,\n  OPENGENI_EVENT_ID_HEADER,\n  OPENGENI_SIGNATURE_HEADER,\n  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n  verifyOpenGeniSignature,\n} from \"@opengeni/contracts/workspace-integration-wire\";\nimport type { CredentialProviderRequest, WorkspaceWebhookEvent } from \"@opengeni/contracts\";\nimport type { OpenGeniClient } from \"./client\";\nimport type {\n  CreateOrganizationWebhookRequest,\n  CreateOrganizationWebhookResponse,\n  GetOrganizationCredentialProviderResponse,\n  ListOrganizationWebhookDeliveriesResponse,\n  ListOrganizationWebhooksResponse,\n  OrganizationWebhook,\n  OrganizationWebhookDelivery,\n  PutOrganizationCredentialProviderRequest,\n  PutOrganizationCredentialProviderResponse,\n  RotateWorkspaceCredentialProviderSecretResponse,\n  RotateOrganizationCredentialProviderSecretResponse,\n  RotateWorkspaceWebhookSecretResponse,\n  RotateOrganizationWebhookSecretResponse,\n  TestWorkspaceCredentialProviderResponse,\n  TestWorkspaceWebhookResponse,\n  UpdateOrganizationWebhookRequest,\n  WorkspaceInheritedIntegrationsResponse,\n  WorkspaceWebhook,\n} from \"@opengeni/contracts\";\n\nexport type {\n  CreateOrganizationWebhookRequest,\n  CreateOrganizationWebhookResponse,\n  CreateWorkspaceWebhookRequest,\n  CreateWorkspaceWebhookResponse,\n  CredentialProviderRequest,\n  CredentialProviderInitiatorContext,\n  CredentialProviderResponse,\n  CredentialProviderMcpHeaders,\n  CredentialProviderMcpMaterial,\n  GetOrganizationCredentialProviderResponse,\n  GetWorkspaceCredentialProviderResponse,\n  InitiatingHuman,\n  IntegrationEndpointTestResult,\n  IntegrationWorkspaceFilter,\n  ListOrganizationWebhookDeliveriesResponse,\n  ListOrganizationWebhooksResponse,\n  ListWorkspaceWebhookDeliveriesResponse,\n  ListWorkspaceWebhooksResponse,\n  PutWorkspaceCredentialProviderRequest,\n  PutWorkspaceCredentialProviderResponse,\n  PutOrganizationCredentialProviderRequest,\n  PutOrganizationCredentialProviderResponse,\n  RotateWorkspaceCredentialProviderSecretResponse,\n  RotateOrganizationCredentialProviderSecretResponse,\n  RotateWorkspaceWebhookSecretResponse,\n  RotateOrganizationWebhookSecretResponse,\n  TestWorkspaceCredentialProviderResponse,\n  TestWorkspaceWebhookResponse,\n  OrganizationCredentialProvider,\n  OrganizationWebhook,\n  OrganizationWebhookDelivery,\n  UpdateOrganizationWebhookRequest,\n  UpdateWorkspaceWebhookRequest,\n  WorkspaceCredentialProvider,\n  WorkspaceInheritedIntegrationsResponse,\n  WorkspaceTestWebhookEvent,\n  WorkspaceWebhook,\n  WorkspaceWebhookDelivery,\n  WorkspaceWebhookEvent,\n  WorkspaceWebhookEventType,\n  SessionWorkspaceWebhookEvent,\n  WorkspaceUsageWebhookEvent,\n} from \"@opengeni/contracts\";\nexport {\n  OPENGENI_DELIVERY_ID_HEADER,\n  OPENGENI_EVENT_ID_HEADER,\n  OPENGENI_SIGNATURE_HEADER,\n  OPENGENI_TEST_REQUEST_NIL_ID,\n  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n  WORKSPACE_WEBHOOK_EVENT_TYPES,\n  signOpenGeniPayload,\n  verifyOpenGeniSignature,\n} from \"@opengeni/contracts/workspace-integration-wire\";\n\nexport type WorkspaceSandboxImages = { images: string[]; selected: string | null };\n\nexport class OpenGeniSignatureError extends Error {\n  constructor() {\n    super(\"Opengeni signature verification failed\");\n    this.name = \"OpenGeniSignatureError\";\n  }\n}\n\ntype SignedRequest = {\n  /** The exact raw request body. Parse it only after verification. */\n  body: string;\n  headers: Headers | Record<string, string | string[] | undefined>;\n  secret: string;\n  toleranceSeconds?: number;\n};\n\nfunction header(headers: SignedRequest[\"headers\"], name: string): string | null {\n  if (headers instanceof Headers) return headers.get(name);\n  const wanted = name.toLowerCase();\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === wanted) {\n      return Array.isArray(value) ? (value[0] ?? null) : (value ?? null);\n    }\n  }\n  return null;\n}\n\nasync function verifiedObject(input: SignedRequest): Promise<Record<string, unknown>> {\n  const valid = await verifyOpenGeniSignature({\n    secret: input.secret,\n    body: input.body,\n    signature: header(input.headers, OPENGENI_SIGNATURE_HEADER),\n    ...(input.toleranceSeconds !== undefined ? { toleranceSeconds: input.toleranceSeconds } : {}),\n  });\n  if (!valid) throw new OpenGeniSignatureError();\n  const parsed: unknown = JSON.parse(input.body);\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new OpenGeniSignatureError();\n  }\n  return parsed as Record<string, unknown>;\n}\n\n/**\n * Verify and parse one webhook delivery. Delivery is at least once: dedupe on\n * `event.id` (also sent as the `OpenGeni-Event-Id` header). A `webhook.test`\n * event (from \"Send test event\") names no session: acknowledge it with 2xx.\n */\nexport async function verifyWebhookEvent(input: SignedRequest): Promise<{\n  event: WorkspaceWebhookEvent;\n  deliveryId: string | null;\n}> {\n  const event = await verifiedObject(input);\n  const usageEvent = typeof event.type === \"string\" && event.type.startsWith(\"usage.\");\n  const lane = event.lane === undefined ? \"workspace\" : event.lane;\n  if (\n    typeof event.id !== \"string\" ||\n    typeof event.type !== \"string\" ||\n    typeof event.workspaceId !== \"string\" ||\n    (lane !== \"workspace\" && lane !== \"organization\") ||\n    (usageEvent && lane !== \"workspace\") ||\n    !(\n      typeof event.sessionId === \"string\" ||\n      ((event.sessionId === null || event.sessionId === undefined) &&\n        [\n          \"usage.threshold_reached\",\n          \"usage.exhausted\",\n          \"usage.period_reset\",\n          OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n        ].includes(event.type))\n    )\n  ) {\n    throw new OpenGeniSignatureError();\n  }\n  return {\n    event: { ...event, lane } as WorkspaceWebhookEvent,\n    deliveryId: header(input.headers, OPENGENI_DELIVERY_ID_HEADER),\n  };\n}\n\n/**\n * Verify the exact bytes and parse a provider request, including its frozen\n * initiatorContext when sent by an upgraded worker. Provenance grants no access.\n */\nexport async function verifyCredentialProviderRequest(\n  input: SignedRequest,\n): Promise<CredentialProviderRequest> {\n  const parsed = await verifiedObject(input);\n  if (parsed.type !== \"credentials.request\" || typeof parsed.workspaceId !== \"string\") {\n    throw new OpenGeniSignatureError();\n  }\n  return parsed as CredentialProviderRequest;\n}\n\n/** Identity header names, for receivers that log or dedupe. */\nexport const OPENGENI_WEBHOOK_HEADERS = {\n  signature: OPENGENI_SIGNATURE_HEADER,\n  eventId: OPENGENI_EVENT_ID_HEADER,\n  deliveryId: OPENGENI_DELIVERY_ID_HEADER,\n} as const;\n\n/** Server-side integration administration is opt-in, outside the eager browser client. */\nexport async function getOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<GetOrganizationCredentialProviderResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n  );\n}\n\n/** Replace configuration; explicit filter required. Store the first returned signing secret. */\nexport async function putOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  request: PutOrganizationCredentialProviderRequest,\n): Promise<PutOrganizationCredentialProviderResponse> {\n  return client.requestJson(\n    \"PUT\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n    request,\n  );\n}\n\nexport async function deleteOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<void> {\n  await client.requestJson<void>(\n    \"DELETE\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n    undefined,\n    {},\n    { responseType: \"void\" },\n  );\n}\n\nexport async function listOrganizationWebhooks(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<ListOrganizationWebhooksResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`,\n  );\n}\n\n/** Create a webhook and return its signing secret once. */\nexport async function createOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  request: CreateOrganizationWebhookRequest,\n): Promise<CreateOrganizationWebhookResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`,\n    request,\n  );\n}\n\nexport async function getOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<OrganizationWebhook> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n  );\n}\n\nexport async function updateOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  request: UpdateOrganizationWebhookRequest,\n): Promise<OrganizationWebhook> {\n  return client.requestJson(\n    \"PATCH\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n    request,\n  );\n}\n\nexport async function deleteOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<void> {\n  await client.requestJson<void>(\n    \"DELETE\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n    undefined,\n    {},\n    { responseType: \"void\" },\n  );\n}\n\nexport async function listOrganizationWebhookDeliveries(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  options: { limit?: number } = {},\n): Promise<ListOrganizationWebhookDeliveriesResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries`,\n    undefined,\n    options.limit !== undefined ? { limit: String(options.limit) } : {},\n  );\n}\n\n/** Requeue a settled delivery with a fresh attempt budget. */\nexport async function redeliverOrganizationWebhookDelivery(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  deliveryId: string,\n): Promise<OrganizationWebhookDelivery> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries/${encodeURIComponent(deliveryId)}/redeliver`,\n  );\n}\n\nexport async function getWorkspaceWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<WorkspaceWebhook> {\n  return client.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/webhooks/${webhookId}`);\n}\n\n/** Rotate immediately. Store the new secret; the old signing secret stops working. */\nexport async function rotateWorkspaceCredentialProviderSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<RotateWorkspaceCredentialProviderSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/rotate-secret`,\n  );\n}\n\nexport async function rotateOrganizationCredentialProviderSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<RotateOrganizationCredentialProviderSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider/rotate-secret`,\n  );\n}\n\nexport async function rotateOrganizationWebhookSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<RotateOrganizationWebhookSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`,\n  );\n}\n\nexport async function rotateWorkspaceWebhookSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<RotateWorkspaceWebhookSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`,\n  );\n}\n\n/**\n * Send one signed `webhook.test` event to a workspace webhook now and return\n * what the endpoint answered. Nothing is queued or retried.\n */\nexport async function testWorkspaceWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<TestWorkspaceWebhookResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/test`,\n  );\n}\n\n/**\n * Send one signed `purpose: \"test\"` request to the credential provider this\n * workspace's runs use (its own, else the organization's). Only the names of\n * returned credentials come back, never their values.\n */\nexport async function testWorkspaceCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<TestWorkspaceCredentialProviderResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/test`,\n  );\n}\n\n/** Organization registrations that reach this workspace. Workspace administrators only. */\nexport async function getWorkspaceInheritedIntegrations(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<WorkspaceInheritedIntegrationsResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/inherited-integrations`,\n  );\n}\n"],"mappings":";AAMO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,mCAAmC;AAMzC,IAAM,+BAA+B;AAErC,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,8BAA8B;AACpC,IAAM,uCAAuC;AAEpD,IAAM,UAAU,IAAI,YAAY;AAEhC,eAAe,cAAc,QAAgB,SAAkC;AAC7E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,OAAO,CAAC,CAAC;AAC/F,SAAO,MAAM,KAAK,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACpF;AAEA,SAAS,qBAAqB,MAAc,OAAwB;AAClE,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,kBAAc,KAAK,WAAW,KAAK,IAAI,MAAM,WAAW,KAAK;AAAA,EAC/D;AACA,SAAO,eAAe;AACxB;AAMA,eAAsB,oBACpB,QACA,MACA,mBAAmB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC9B;AACjB,SAAO,KAAK,gBAAgB,OAAO,MAAM,cAAc,QAAQ,GAAG,gBAAgB,IAAI,IAAI,EAAE,CAAC;AAC/F;AAYA,eAAsB,wBACpB,OACkB;AAClB,MAAI,CAAC,MAAM,UAAW,QAAO;AAC7B,MAAI,YAA2B;AAC/B,QAAM,aAAuB,CAAC;AAC9B,aAAW,QAAQ,MAAM,UAAU,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE,MAAM,KAAK,CAAC;AAC7C,QAAI,QAAQ,OAAO,SAAS,aAAa,KAAK,KAAK,EAAG,aAAY,OAAO,KAAK;AAC9E,QAAI,QAAQ,QAAQ,SAAS,iBAAiB,KAAK,KAAK,EAAG,YAAW,KAAK,KAAK;AAAA,EAClF;AACA,MAAI,cAAc,QAAQ,WAAW,WAAW,EAAG,QAAO;AAC1D,QAAM,MAAM,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5D,QAAM,YAAY,MAAM,oBAAoB;AAC5C,MAAI,KAAK,IAAI,MAAM,SAAS,IAAI,UAAW,QAAO;AAClD,QAAM,WAAW,MAAM,cAAc,MAAM,QAAQ,GAAG,SAAS,IAAI,MAAM,IAAI,EAAE;AAC/E,SAAO,WAAW,KAAK,CAAC,cAAc,qBAAqB,WAAW,QAAQ,CAAC;AACjF;;;ACbO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,cAAc;AACZ,UAAM,wCAAwC;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAUA,SAAS,OAAO,SAAmC,MAA6B;AAC9E,MAAI,mBAAmB,QAAS,QAAO,QAAQ,IAAI,IAAI;AACvD,QAAM,SAAS,KAAK,YAAY;AAChC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,QAAQ;AAChC,aAAO,MAAM,QAAQ,KAAK,IAAK,MAAM,CAAC,KAAK,OAAS,SAAS;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,eAAe,OAAwD;AACpF,QAAM,QAAQ,MAAM,wBAAwB;AAAA,IAC1C,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,WAAW,OAAO,MAAM,SAAS,yBAAyB;AAAA,IAC1D,GAAI,MAAM,qBAAqB,SAAY,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,EAC7F,CAAC;AACD,MAAI,CAAC,MAAO,OAAM,IAAI,uBAAuB;AAC7C,QAAM,SAAkB,KAAK,MAAM,MAAM,IAAI;AAC7C,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AACT;AAOA,eAAsB,mBAAmB,OAGtC;AACD,QAAM,QAAQ,MAAM,eAAe,KAAK;AACxC,QAAM,aAAa,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,WAAW,QAAQ;AACnF,QAAM,OAAO,MAAM,SAAS,SAAY,cAAc,MAAM;AAC5D,MACE,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,SAAS,YACtB,OAAO,MAAM,gBAAgB,YAC5B,SAAS,eAAe,SAAS,kBACjC,cAAc,SAAS,eACxB,EACE,OAAO,MAAM,cAAc,aACzB,MAAM,cAAc,QAAQ,MAAM,cAAc,WAChD;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,MAAM,IAAI,IAEzB;AACA,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AAAA,IACL,OAAO,EAAE,GAAG,OAAO,KAAK;AAAA,IACxB,YAAY,OAAO,MAAM,SAAS,2BAA2B;AAAA,EAC/D;AACF;AAMA,eAAsB,gCACpB,OACoC;AACpC,QAAM,SAAS,MAAM,eAAe,KAAK;AACzC,MAAI,OAAO,SAAS,yBAAyB,OAAO,OAAO,gBAAgB,UAAU;AACnF,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AACT;AAGO,IAAM,2BAA2B;AAAA,EACtC,WAAW;AAAA,EACX,SAAS;AAAA,EACT,YAAY;AACd;AAGA,eAAsB,kCACpB,QACA,gBACoD;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAGA,eAAsB,kCACpB,QACA,gBACA,SACoD;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,qCACpB,QACA,gBACe;AACf,QAAM,OAAO;AAAA,IACX;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,IACA,CAAC;AAAA,IACD,EAAE,cAAc,OAAO;AAAA,EACzB;AACF;AAEA,eAAsB,yBACpB,QACA,gBAC2C;AAC3C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAGA,eAAsB,0BACpB,QACA,gBACA,SAC4C;AAC5C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,uBACpB,QACA,gBACA,WAC8B;AAC9B,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,eAAsB,0BACpB,QACA,gBACA,WACA,SAC8B;AAC9B,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,EACF;AACF;AAEA,eAAsB,0BACpB,QACA,gBACA,WACe;AACf,QAAM,OAAO;AAAA,IACX;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,IACA,CAAC;AAAA,IACD,EAAE,cAAc,OAAO;AAAA,EACzB;AACF;AAEA,eAAsB,kCACpB,QACA,gBACA,WACA,UAA8B,CAAC,GACqB;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,IACA,QAAQ,UAAU,SAAY,EAAE,OAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC;AAAA,EACpE;AACF;AAGA,eAAsB,qCACpB,QACA,gBACA,WACA,YACsC;AACtC,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC,eAAe,mBAAmB,UAAU,CAAC;AAAA,EAChJ;AACF;AAEA,eAAsB,oBACpB,QACA,aACA,WAC2B;AAC3B,SAAO,OAAO,YAAY,OAAO,kBAAkB,WAAW,aAAa,SAAS,EAAE;AACxF;AAGA,eAAsB,wCACpB,QACA,aAC0D;AAC1D,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;AAEA,eAAsB,2CACpB,QACA,gBAC6D;AAC7D,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAEA,eAAsB,gCACpB,QACA,gBACA,WACkD;AAClD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,eAAsB,6BACpB,QACA,aACA,WAC+C;AAC/C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EAC7F;AACF;AAMA,eAAsB,qBACpB,QACA,aACA,WACuC;AACvC,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EAC7F;AACF;AAOA,eAAsB,gCACpB,QACA,aACkD;AAClD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;AAGA,eAAsB,kCACpB,QACA,aACiD;AACjD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;","names":[]}
+{"version":3,"sources":["../src/workspace-integrations.ts"],"sourcesContent":["import {\n  OPENGENI_DELIVERY_ID_HEADER,\n  OPENGENI_EVENT_ID_HEADER,\n  OPENGENI_SIGNATURE_HEADER,\n  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n  verifyOpenGeniSignature,\n} from \"@opengeni/contracts/workspace-integration-wire\";\nimport type { CredentialProviderRequest, WorkspaceWebhookEvent } from \"@opengeni/contracts\";\nimport type { OpenGeniClient } from \"./client\";\nimport type {\n  CreateOrganizationWebhookRequest,\n  CreateOrganizationWebhookResponse,\n  GetOrganizationCredentialProviderResponse,\n  ListOrganizationWebhookDeliveriesResponse,\n  ListOrganizationWebhooksResponse,\n  OrganizationWebhook,\n  OrganizationWebhookDelivery,\n  PutOrganizationCredentialProviderRequest,\n  PutOrganizationCredentialProviderResponse,\n  RotateWorkspaceCredentialProviderSecretResponse,\n  RotateOrganizationCredentialProviderSecretResponse,\n  RotateWorkspaceWebhookSecretResponse,\n  RotateOrganizationWebhookSecretResponse,\n  TestWorkspaceCredentialProviderResponse,\n  TestWorkspaceWebhookResponse,\n  UpdateOrganizationWebhookRequest,\n  WorkspaceInheritedIntegrationsResponse,\n  WorkspaceWebhook,\n} from \"@opengeni/contracts\";\n\nexport type {\n  CreateOrganizationWebhookRequest,\n  CreateOrganizationWebhookResponse,\n  CreateWorkspaceWebhookRequest,\n  CreateWorkspaceWebhookResponse,\n  CredentialProviderRequest,\n  CredentialProviderInitiatorContext,\n  CredentialProviderResponse,\n  CredentialProviderMcpHeaders,\n  CredentialProviderMcpMaterial,\n  GetOrganizationCredentialProviderResponse,\n  GetWorkspaceCredentialProviderResponse,\n  InitiatingHuman,\n  IntegrationEndpointTestResult,\n  IntegrationWorkspaceFilter,\n  ListOrganizationWebhookDeliveriesResponse,\n  ListOrganizationWebhooksResponse,\n  ListWorkspaceWebhookDeliveriesResponse,\n  ListWorkspaceWebhooksResponse,\n  PutWorkspaceCredentialProviderRequest,\n  PutWorkspaceCredentialProviderResponse,\n  PutOrganizationCredentialProviderRequest,\n  PutOrganizationCredentialProviderResponse,\n  RotateWorkspaceCredentialProviderSecretResponse,\n  RotateOrganizationCredentialProviderSecretResponse,\n  RotateWorkspaceWebhookSecretResponse,\n  RotateOrganizationWebhookSecretResponse,\n  TestWorkspaceCredentialProviderResponse,\n  TestWorkspaceWebhookResponse,\n  OrganizationCredentialProvider,\n  OrganizationWebhook,\n  OrganizationWebhookDelivery,\n  UpdateOrganizationWebhookRequest,\n  UpdateWorkspaceWebhookRequest,\n  WorkspaceCredentialProvider,\n  WorkspaceInheritedIntegrationsResponse,\n  WorkspaceTestWebhookEvent,\n  WorkspaceWebhook,\n  WorkspaceWebhookDelivery,\n  WorkspaceWebhookEvent,\n  WorkspaceWebhookEventType,\n  SessionWorkspaceWebhookEvent,\n  WorkspaceUsageWebhookEvent,\n} from \"@opengeni/contracts\";\nexport {\n  OPENGENI_DELIVERY_ID_HEADER,\n  OPENGENI_EVENT_ID_HEADER,\n  OPENGENI_SIGNATURE_HEADER,\n  OPENGENI_TEST_REQUEST_NIL_ID,\n  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n  WORKSPACE_WEBHOOK_EVENT_TYPES,\n  signOpenGeniPayload,\n  verifyOpenGeniSignature,\n} from \"@opengeni/contracts/workspace-integration-wire\";\n\nexport type WorkspaceSandboxImages = { images: string[]; selected: string | null };\n\nexport class OpenGeniSignatureError extends Error {\n  constructor() {\n    super(\"Opengeni signature verification failed\");\n    this.name = \"OpenGeniSignatureError\";\n  }\n}\n\ntype SignedRequest = {\n  /** The exact raw request body. Parse it only after verification. */\n  body: string;\n  headers: Headers | Record<string, string | string[] | undefined>;\n  secret: string;\n  toleranceSeconds?: number;\n};\n\nfunction header(headers: SignedRequest[\"headers\"], name: string): string | null {\n  if (headers instanceof Headers) return headers.get(name);\n  const wanted = name.toLowerCase();\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === wanted) {\n      return Array.isArray(value) ? (value[0] ?? null) : (value ?? null);\n    }\n  }\n  return null;\n}\n\nasync function verifiedObject(input: SignedRequest): Promise<Record<string, unknown>> {\n  const valid = await verifyOpenGeniSignature({\n    secret: input.secret,\n    body: input.body,\n    signature: header(input.headers, OPENGENI_SIGNATURE_HEADER),\n    ...(input.toleranceSeconds !== undefined ? { toleranceSeconds: input.toleranceSeconds } : {}),\n  });\n  if (!valid) throw new OpenGeniSignatureError();\n  const parsed: unknown = JSON.parse(input.body);\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    throw new OpenGeniSignatureError();\n  }\n  return parsed as Record<string, unknown>;\n}\n\n/**\n * Verify and parse one webhook delivery. Delivery is at least once: dedupe on\n * `event.id` (also sent as the `OpenGeni-Event-Id` header). A `webhook.test`\n * event (from \"Send test event\") names no session: acknowledge it with 2xx.\n */\nexport async function verifyWebhookEvent(input: SignedRequest): Promise<{\n  event: WorkspaceWebhookEvent;\n  deliveryId: string | null;\n}> {\n  const event = await verifiedObject(input);\n  const usageEvent = typeof event.type === \"string\" && event.type.startsWith(\"usage.\");\n  const lane = event.lane === undefined ? \"workspace\" : event.lane;\n  if (\n    typeof event.id !== \"string\" ||\n    typeof event.type !== \"string\" ||\n    typeof event.workspaceId !== \"string\" ||\n    (lane !== \"workspace\" && lane !== \"organization\") ||\n    (usageEvent && lane !== \"workspace\") ||\n    !(\n      typeof event.sessionId === \"string\" ||\n      ((event.sessionId === null || event.sessionId === undefined) &&\n        [\n          \"usage.threshold_reached\",\n          \"usage.exhausted\",\n          \"usage.period_reset\",\n          OPENGENI_WEBHOOK_TEST_EVENT_TYPE,\n        ].includes(event.type))\n    )\n  ) {\n    throw new OpenGeniSignatureError();\n  }\n  return {\n    event: { ...event, lane } as WorkspaceWebhookEvent,\n    deliveryId: header(input.headers, OPENGENI_DELIVERY_ID_HEADER),\n  };\n}\n\n/**\n * Verify the exact bytes and parse a provider request, including its frozen\n * initiatorContext when sent by an upgraded worker. Provenance grants no access.\n */\nexport async function verifyCredentialProviderRequest(\n  input: SignedRequest,\n): Promise<CredentialProviderRequest> {\n  const parsed = await verifiedObject(input);\n  if (parsed.type !== \"credentials.request\" || typeof parsed.workspaceId !== \"string\") {\n    throw new OpenGeniSignatureError();\n  }\n  return parsed as CredentialProviderRequest;\n}\n\n/** Identity header names, for receivers that log or dedupe. */\nexport const OPENGENI_WEBHOOK_HEADERS = {\n  signature: OPENGENI_SIGNATURE_HEADER,\n  eventId: OPENGENI_EVENT_ID_HEADER,\n  deliveryId: OPENGENI_DELIVERY_ID_HEADER,\n} as const;\n\n/** Server-side integration administration is opt-in, outside the eager browser client. */\nexport async function getOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<GetOrganizationCredentialProviderResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n  );\n}\n\n/** Replace configuration; explicit filter required. Store the first returned signing secret. */\nexport async function putOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  request: PutOrganizationCredentialProviderRequest,\n): Promise<PutOrganizationCredentialProviderResponse> {\n  return client.requestJson(\n    \"PUT\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n    request,\n  );\n}\n\nexport async function deleteOrganizationCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<void> {\n  await client.requestJson<void>(\n    \"DELETE\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider`,\n    undefined,\n    {},\n    { responseType: \"void\" },\n  );\n}\n\nexport async function listOrganizationWebhooks(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<ListOrganizationWebhooksResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`,\n  );\n}\n\n/** Create a webhook and return its signing secret once. */\nexport async function createOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  request: CreateOrganizationWebhookRequest,\n): Promise<CreateOrganizationWebhookResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks`,\n    request,\n  );\n}\n\nexport async function getOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<OrganizationWebhook> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n  );\n}\n\nexport async function updateOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  request: UpdateOrganizationWebhookRequest,\n): Promise<OrganizationWebhook> {\n  return client.requestJson(\n    \"PATCH\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n    request,\n  );\n}\n\nexport async function deleteOrganizationWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<void> {\n  await client.requestJson<void>(\n    \"DELETE\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}`,\n    undefined,\n    {},\n    { responseType: \"void\" },\n  );\n}\n\nexport async function listOrganizationWebhookDeliveries(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  options: { limit?: number } = {},\n): Promise<ListOrganizationWebhookDeliveriesResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries`,\n    undefined,\n    options.limit !== undefined ? { limit: String(options.limit) } : {},\n  );\n}\n\n/** Requeue a settled delivery with a fresh attempt budget. */\nexport async function redeliverOrganizationWebhookDelivery(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n  deliveryId: string,\n): Promise<OrganizationWebhookDelivery> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/deliveries/${encodeURIComponent(deliveryId)}/redeliver`,\n  );\n}\n\nexport async function getWorkspaceWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<WorkspaceWebhook> {\n  return client.requestJson(\"GET\", `/v1/workspaces/${workspaceId}/webhooks/${webhookId}`);\n}\n\n/** Rotate immediately. Store the new secret; the old signing secret stops working. */\nexport async function rotateWorkspaceCredentialProviderSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<RotateWorkspaceCredentialProviderSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/rotate-secret`,\n  );\n}\n\nexport async function rotateOrganizationCredentialProviderSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n): Promise<RotateOrganizationCredentialProviderSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/credential-provider/rotate-secret`,\n  );\n}\n\nexport async function rotateOrganizationWebhookSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  organizationId: string,\n  webhookId: string,\n): Promise<RotateOrganizationWebhookSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/organizations/${encodeURIComponent(organizationId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`,\n  );\n}\n\nexport async function rotateWorkspaceWebhookSecret(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<RotateWorkspaceWebhookSecretResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/rotate-secret`,\n  );\n}\n\n/**\n * Send one signed `webhook.test` event to a workspace webhook now and return\n * what the endpoint answered. Nothing is queued or retried.\n */\nexport async function testWorkspaceWebhook(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n  webhookId: string,\n): Promise<TestWorkspaceWebhookResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/webhooks/${encodeURIComponent(webhookId)}/test`,\n  );\n}\n\n/**\n * Send one signed `purpose: \"test\"` request to the credential provider this\n * workspace's runs use (its own, else the organization's). Only the names of\n * returned credentials come back, never their values.\n */\nexport async function testWorkspaceCredentialProvider(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<TestWorkspaceCredentialProviderResponse> {\n  return client.requestJson(\n    \"POST\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/credential-provider/test`,\n  );\n}\n\n/** Organization registrations that reach this workspace. Workspace administrators only. */\nexport async function getWorkspaceInheritedIntegrations(\n  client: Pick<OpenGeniClient, \"requestJson\">,\n  workspaceId: string,\n): Promise<WorkspaceInheritedIntegrationsResponse> {\n  return client.requestJson(\n    \"GET\",\n    `/v1/workspaces/${encodeURIComponent(workspaceId)}/inherited-integrations`,\n  );\n}\n"],"mappings":";;;;;;;;;AAuFO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,cAAc;AACZ,UAAM,wCAAwC;AAC9C,SAAK,OAAO;AAAA,EACd;AACF;AAUA,SAAS,OAAO,SAAmC,MAA6B;AAC9E,MAAI,mBAAmB,QAAS,QAAO,QAAQ,IAAI,IAAI;AACvD,QAAM,SAAS,KAAK,YAAY;AAChC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,QAAQ;AAChC,aAAO,MAAM,QAAQ,KAAK,IAAK,MAAM,CAAC,KAAK,OAAS,SAAS;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,eAAe,OAAwD;AACpF,QAAM,QAAQ,MAAM,wBAAwB;AAAA,IAC1C,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,WAAW,OAAO,MAAM,SAAS,yBAAyB;AAAA,IAC1D,GAAI,MAAM,qBAAqB,SAAY,EAAE,kBAAkB,MAAM,iBAAiB,IAAI,CAAC;AAAA,EAC7F,CAAC;AACD,MAAI,CAAC,MAAO,OAAM,IAAI,uBAAuB;AAC7C,QAAM,SAAkB,KAAK,MAAM,MAAM,IAAI;AAC7C,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG;AAClE,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AACT;AAOA,eAAsB,mBAAmB,OAGtC;AACD,QAAM,QAAQ,MAAM,eAAe,KAAK;AACxC,QAAM,aAAa,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,WAAW,QAAQ;AACnF,QAAM,OAAO,MAAM,SAAS,SAAY,cAAc,MAAM;AAC5D,MACE,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,SAAS,YACtB,OAAO,MAAM,gBAAgB,YAC5B,SAAS,eAAe,SAAS,kBACjC,cAAc,SAAS,eACxB,EACE,OAAO,MAAM,cAAc,aACzB,MAAM,cAAc,QAAQ,MAAM,cAAc,WAChD;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,SAAS,MAAM,IAAI,IAEzB;AACA,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AAAA,IACL,OAAO,EAAE,GAAG,OAAO,KAAK;AAAA,IACxB,YAAY,OAAO,MAAM,SAAS,2BAA2B;AAAA,EAC/D;AACF;AAMA,eAAsB,gCACpB,OACoC;AACpC,QAAM,SAAS,MAAM,eAAe,KAAK;AACzC,MAAI,OAAO,SAAS,yBAAyB,OAAO,OAAO,gBAAgB,UAAU;AACnF,UAAM,IAAI,uBAAuB;AAAA,EACnC;AACA,SAAO;AACT;AAGO,IAAM,2BAA2B;AAAA,EACtC,WAAW;AAAA,EACX,SAAS;AAAA,EACT,YAAY;AACd;AAGA,eAAsB,kCACpB,QACA,gBACoD;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAGA,eAAsB,kCACpB,QACA,gBACA,SACoD;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,qCACpB,QACA,gBACe;AACf,QAAM,OAAO;AAAA,IACX;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,IACA,CAAC;AAAA,IACD,EAAE,cAAc,OAAO;AAAA,EACzB;AACF;AAEA,eAAsB,yBACpB,QACA,gBAC2C;AAC3C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAGA,eAAsB,0BACpB,QACA,gBACA,SAC4C;AAC5C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,uBACpB,QACA,gBACA,WAC8B;AAC9B,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,eAAsB,0BACpB,QACA,gBACA,WACA,SAC8B;AAC9B,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,EACF;AACF;AAEA,eAAsB,0BACpB,QACA,gBACA,WACe;AACf,QAAM,OAAO;AAAA,IACX;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,IACA,CAAC;AAAA,IACD,EAAE,cAAc,OAAO;AAAA,EACzB;AACF;AAEA,eAAsB,kCACpB,QACA,gBACA,WACA,UAA8B,CAAC,GACqB;AACpD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,IACjG;AAAA,IACA,QAAQ,UAAU,SAAY,EAAE,OAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC;AAAA,EACpE;AACF;AAGA,eAAsB,qCACpB,QACA,gBACA,WACA,YACsC;AACtC,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC,eAAe,mBAAmB,UAAU,CAAC;AAAA,EAChJ;AACF;AAEA,eAAsB,oBACpB,QACA,aACA,WAC2B;AAC3B,SAAO,OAAO,YAAY,OAAO,kBAAkB,WAAW,aAAa,SAAS,EAAE;AACxF;AAGA,eAAsB,wCACpB,QACA,aAC0D;AAC1D,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;AAEA,eAAsB,2CACpB,QACA,gBAC6D;AAC7D,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC;AAAA,EACzD;AACF;AAEA,eAAsB,gCACpB,QACA,gBACA,WACkD;AAClD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,qBAAqB,mBAAmB,cAAc,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EACnG;AACF;AAEA,eAAsB,6BACpB,QACA,aACA,WAC+C;AAC/C,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EAC7F;AACF;AAMA,eAAsB,qBACpB,QACA,aACA,WACuC;AACvC,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC,aAAa,mBAAmB,SAAS,CAAC;AAAA,EAC7F;AACF;AAOA,eAAsB,gCACpB,QACA,aACkD;AAClD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;AAGA,eAAsB,kCACpB,QACA,aACiD;AACjD,SAAO,OAAO;AAAA,IACZ;AAAA,IACA,kBAAkB,mBAAmB,WAAW,CAAC;AAAA,EACnD;AACF;","names":[]}

package/dist/core.js

@@ -1,6 +1,6 @@
 import {
   OpenGeniDocumentAuthorityClient
-} from "./chunk-YDVPI7WT.js";
+} from "./chunk-JP62FZSI.js";
 import {
   resolveWorkspaceVoiceInputEnabled
 } from "./chunk-GZQSWAKD.js";
@@ -11,7 +11,7 @@ import {
 } from "./chunk-P7UWKORG.js";
 import {
   parseDeprecationNotice
-} from "./chunk-NEM5N6C6.js";
+} from "./chunk-JKG75TTU.js";
 import "./chunk-VPVMLM7Q.js";
 import "./chunk-4AHR4KGA.js";
 import {

package/dist/document-authority.js

@@ -1,7 +1,7 @@
 import {
   OpenGeniDocumentAuthorityClient
-} from "./chunk-YDVPI7WT.js";
-import "./chunk-NEM5N6C6.js";
+} from "./chunk-JP62FZSI.js";
+import "./chunk-JKG75TTU.js";
 import "./chunk-VPVMLM7Q.js";
 import "./chunk-4AHR4KGA.js";
 import "./chunk-KADZ5PGG.js";

package/dist/external-vault-receiver.d.ts

@@ -0,0 +1,203 @@
+import { VaultProviderWireFreshness, VaultProviderWireRequest, type VaultProviderWireAuthority, type VaultProviderWireErrorCode, type VaultProviderWireOperationName, type VaultProviderWirePage, type VaultProviderWireProvider, type VaultProviderWireResult, type VaultProviderWireWriteItem } from "@opengeni/contracts/vault-provider-wire";
+export { VAULT_PROVIDER_WIRE_ERROR_CODES, VAULT_PROVIDER_WIRE_LIMITS, VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER, VAULT_PROVIDER_WIRE_VERSION, vaultProviderWireResponseKey, } from "@opengeni/contracts/vault-provider-wire";
+export type { VaultProviderWireAuthority, VaultProviderWireDescribeResult, VaultProviderWireErrorCode, VaultProviderWireFieldMeta, VaultProviderWireFieldValue, VaultProviderWireFreshness, VaultProviderWireItemMeta, VaultProviderWireOperation, VaultProviderWireOperationName, VaultProviderWirePage, VaultProviderWireProvider, VaultProviderWireRequest, VaultProviderWireResponse, VaultProviderWireResult, VaultProviderWireVault, VaultProviderWireWriteField, VaultProviderWireWriteItem, } from "@opengeni/contracts/vault-provider-wire";
+/** A definite, safe receiver failure. Its message is never sent to Opengeni. */
+export declare class ExternalVaultReceiverError extends Error {
+    readonly code: VaultProviderWireErrorCode;
+    readonly retryAfterMs: number | null;
+    readonly freshness: VaultProviderWireFreshness | null;
+    constructor(code: VaultProviderWireErrorCode, options?: {
+        retryAfterMs?: number;
+        freshness?: VaultProviderWireFreshness;
+        message?: string;
+    });
+}
+export interface ExternalVaultReceiverConnection<TConnection> {
+    provider: VaultProviderWireProvider;
+    /**
+     * Accepted signing secrets: the current one first, then a previous one
+     * during rotation. Responses are signed with the secret that verified.
+     */
+    signingSecrets: readonly string[];
+    /** When set, requests for any other Opengeni account are refused. */
+    accountId?: string;
+    /** When set, requests for a connection owned by another workspace are refused. */
+    connectionWorkspaceId?: string;
+    /** Host data for this connection: its fixed inventory scope, not a user. */
+    context: TConnection;
+}
+export type ExternalVaultMutationClaim = {
+    state: "claimed";
+} | {
+    state: "completed";
+    result: unknown;
+}
+/** In flight, or uncertain after a failure: report an unknown outcome. */
+ | {
+    state: "pending";
+}
+/** Same key, different operation or caller. */
+ | {
+    state: "mismatch";
+};
+/**
+ * Caller-owned replay and idempotency storage. Use durable shared storage
+ * (for example a database table with unique keys) when the receiver runs in
+ * more than one process or must survive restarts.
+ */
+export interface ExternalVaultReceiverStore {
+    /** Atomically record a request id. False when it was already recorded. */
+    rememberRequest(input: {
+        connectionId: string;
+        requestId: string;
+        expiresAt: Date;
+    }): Promise<boolean>;
+    /** Atomically claim a mutation key, or report its existing state. */
+    claimMutation(input: {
+        connectionId: string;
+        idempotencyKey: string;
+        digest: string;
+        expiresAt: Date;
+    }): Promise<ExternalVaultMutationClaim>;
+    /** Record the metadata-only result of a confirmed mutation. */
+    completeMutation(input: {
+        connectionId: string;
+        idempotencyKey: string;
+        digest: string;
+        result: unknown;
+    }): Promise<void>;
+    /** The handler definitely changed nothing: allow the key to be claimed again. */
+    releaseMutation(input: {
+        connectionId: string;
+        idempotencyKey: string;
+        digest: string;
+    }): Promise<void>;
+}
+export interface ExternalVaultHandlerOutput<R> {
+    result: R;
+    freshness?: VaultProviderWireFreshness | null;
+}
+type ReadContext = {
+    forceRefresh: boolean;
+    cacheEpoch: string | null;
+};
+export interface ExternalVaultCallContext<TConnection, TPrincipal> {
+    connectionId: string;
+    connection: TConnection;
+    /** The host principal returned by `authorize` for this exact request. */
+    principal: TPrincipal;
+    authority: VaultProviderWireAuthority;
+    requestId: string;
+    signal?: AbortSignal;
+}
+/**
+ * Inventory handlers receive the connection, not the acting principal: one
+ * connection has one fixed inventory, so listings must not vary by subject.
+ */
+export interface ExternalVaultInventoryContext<TConnection> {
+    connectionId: string;
+    connection: TConnection;
+    requestId: string;
+    signal?: AbortSignal;
+}
+export interface ExternalVaultReceiverHandlers<TConnection, TPrincipal> {
+    describe(ctx: ExternalVaultInventoryContext<TConnection>): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<"describe">>>;
+    /** Deliberate upstream refresh; omit when the store is always live. */
+    refresh?(ctx: ExternalVaultInventoryContext<TConnection>): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<"refresh">>>;
+    listVaults(ctx: ExternalVaultInventoryContext<TConnection>, input: {
+        page: VaultProviderWirePage;
+    } & ReadContext): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<"list_vaults">>>;
+    listItems(ctx: ExternalVaultInventoryContext<TConnection>, input: {
+        externalVaultId: string;
+        page: VaultProviderWirePage;
+    } & ReadContext): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<"list_items">>>;
+    readFields(ctx: ExternalVaultCallContext<TConnection, TPrincipal>, input: {
+        externalVaultId: string;
+        externalItemId: string;
+        externalFieldIds: readonly string[];
+    } & ReadContext): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<"read_fields">>>;
+    /** Omit when the connection is read-only. Throw only definite failures. */
+    writeItem?(ctx: ExternalVaultCallContext<TConnection, TPrincipal>, input: {
+        externalVaultId: string;
+        item: VaultProviderWireWriteItem;
+        idempotencyKey: string;
+    }): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<"write_item">>>;
+    archiveItem?(ctx: ExternalVaultCallContext<TConnection, TPrincipal>, input: {
+        externalVaultId: string;
+        externalItemId: string;
+        idempotencyKey: string;
+    }): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<"archive_item">>>;
+}
+export interface ExternalVaultAuthorizeInput<TConnection> {
+    connectionId: string;
+    connection: TConnection;
+    authority: VaultProviderWireAuthority;
+    operation: {
+        op: VaultProviderWireOperationName;
+        externalVaultId?: string;
+        externalItemId?: string;
+    };
+    requestId: string;
+}
+export interface ExternalVaultReceiverOptions<TConnection, TPrincipal> {
+    /** Unknown connections are indistinguishable from bad signatures. */
+    resolveConnection(connectionId: string): Promise<ExternalVaultReceiverConnection<TConnection> | null>;
+    /**
+     * Map Opengeni's native account/workspace/subject to the host tenant and
+     * user and recheck access for this operation. Return null to refuse.
+     * Called for every request, including inventory reads.
+     */
+    authorize(input: ExternalVaultAuthorizeInput<TConnection>): Promise<TPrincipal | null>;
+    handlers: ExternalVaultReceiverHandlers<TConnection, TPrincipal>;
+    store: ExternalVaultReceiverStore;
+    /** How long mutation results stay replayable. Default 24 hours. */
+    mutationRetentionMs?: number;
+    now?: () => number;
+    /** Host diagnostics. Never forward these errors to Opengeni. */
+    onError?(event: {
+        stage: "authorize" | "handler" | "store" | "output";
+        op: VaultProviderWireOperationName;
+        connectionId: string;
+        error: unknown;
+    }): void;
+}
+export interface ExternalVaultReceiverHttpRequest {
+    /** The exact raw request body; parse nothing before calling `handle`. */
+    body: string;
+    headers: Headers | Record<string, string | string[] | undefined>;
+    signal?: AbortSignal;
+}
+export interface ExternalVaultReceiverHttpResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+}
+export interface ExternalVaultReceiver {
+    handle(request: ExternalVaultReceiverHttpRequest): Promise<ExternalVaultReceiverHttpResponse>;
+    /** Fetch-style adapter: POST only, bounded body, then `handle`. */
+    fetch(request: Request): Promise<Response>;
+}
+/**
+ * Keyed digest of one mutation's exact scope: connection, provider, trusted
+ * caller tuple and operation (without its idempotency key). Keyed so the
+ * store never holds a plain hash of submitted secret values.
+ */
+export declare function externalVaultMutationDigest(input: {
+    signingSecret: string;
+    request: VaultProviderWireRequest;
+}): Promise<string>;
+/** Mirrors Opengeni's secret-name rule: usable item/field names from upstream titles. */
+export declare function safeExternalVaultName(raw: string, fallback?: string): string;
+/** A safe field name, unique case-insensitively within `taken` (which it updates). */
+export declare function uniqueExternalVaultFieldName(raw: string, taken: Set<string>, fallback?: string): string;
+/**
+ * Process-local store for tests, development and a single-process bridge
+ * that accepts losing replay/idempotency memory on restart. It is not durable.
+ */
+export declare function createInMemoryExternalVaultReceiverStore(options?: {
+    maxEntries?: number;
+    now?: () => number;
+}): ExternalVaultReceiverStore & {
+    size(): number;
+};
+export declare function createExternalVaultReceiver<TConnection, TPrincipal>(options: ExternalVaultReceiverOptions<TConnection, TPrincipal>): ExternalVaultReceiver;