@tangle-network/agent-app 0.43.25 → 0.43.26

package/dist/chunk-I2R2XT4M.js

@@ -0,0 +1,62 @@
+// src/chat-store/parts.ts
+function toChatMessageParts(parts) {
+  const out = [];
+  for (const part of parts) {
+    const typed = toChatMessagePart(part);
+    if (typed) out.push(typed);
+  }
+  return out;
+}
+var str = (value) => typeof value === "string";
+function toChatMessagePart(part) {
+  if (!part || typeof part !== "object") return null;
+  const type = part.type;
+  switch (type) {
+    case "text":
+    case "reasoning":
+      return str(part.text) ? part : null;
+    case "tool":
+      return str(part.id) && str(part.tool) && part.state && typeof part.state === "object" ? part : null;
+    case "file":
+    case "image":
+      return part;
+    case "subtask":
+      return str(part.prompt) && str(part.description) && str(part.agent) ? part : null;
+    case "step-start":
+      return { type: "step-start" };
+    case "step-finish":
+      return part;
+    case "interaction":
+      return str(part.id) && str(part.kind) && str(part.title) && str(part.status) && part.answerSpec && typeof part.answerSpec === "object" ? part : null;
+    case "notice":
+      return str(part.id) && str(part.noticeKind) && str(part.text) ? part : null;
+    case void 0:
+      return null;
+    default: {
+      const _exhaustive = type;
+      void _exhaustive;
+      return null;
+    }
+  }
+}
+function isChatToolPart(part) {
+  return part.type === "tool";
+}
+function isChatTextPart(part) {
+  return part.type === "text";
+}
+function isChatInteractionPart(part) {
+  return part.type === "interaction";
+}
+function isChatStepFinishPart(part) {
+  return part.type === "step-finish";
+}
+
+export {
+  toChatMessageParts,
+  isChatToolPart,
+  isChatTextPart,
+  isChatInteractionPart,
+  isChatStepFinishPart
+};
+//# sourceMappingURL=chunk-I2R2XT4M.js.map

package/dist/chunk-I2R2XT4M.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/chat-store/parts.ts"],"sourcesContent":["/**\n * The stored shape of `message.parts` — one typed vocabulary for every part a\n * product persists into a chat transcript. NOT an ad-hoc union reverse-\n * engineered from product schemas; each member is matched field-for-field to\n * its canonical source:\n *\n * - `text` / `reasoning` / `tool`: the persisted projection `/stream`'s\n *   `normalizePersistedPart` produces from the harness lane's\n *   `message.part.updated` events (ADC sidecar\n *   `apps/sidecar/src/events/session-events.ts:56` wraps the canonical part in\n *   an `{id, sessionID, messageID}` envelope; the projection strips the\n *   session/message ids and keeps the per-segment part id).\n * - `file` / `image` / `step-start` / `step-finish`: the sidecar's canonical\n *   `MessagePartSchema` members (ADC\n *   `apps/sidecar/src/schemas/agent-schemas.ts:50-154`); `step-finish` carries\n *   the harness's per-step usage receipt — tokens\n *   `{total, input, output, reasoning, cache{write, read}}` + `cost` — which is\n *   also the shape the message-level token/cost columns mirror.\n * - `subtask`: `@tangle-network/agent-interface`'s `SubtaskPart` (a spawned\n *   sub-agent task).\n * - `interaction` / `notice`: the persisted-part codecs in\n *   `/web-react`'s chat-interactions contract (`interactionToPersistedPart`,\n *   `noticePart`) — type-only imports, one source of truth for their statuses\n *   and field shapes.\n *\n * `@tangle-network/agent-interface` exports the canonical wire `Part` union,\n * but its `PartBase` requires the `sessionID`/`messageID` stream envelope that\n * is deliberately NOT persisted, so the stored union is defined here as the\n * envelope-free projection (a type-level coverage check against the peer's\n * `Part['type']` lives in the tests). Contribute-down candidate: if\n * agent-interface grows envelope-free persisted-part types, re-export them\n * here and delete these definitions.\n *\n * Two transport lanes serialize into this SAME stored shape:\n * - harness lane: canonical `message.part.updated` parts, merged/normalized by\n *   `/stream` (`mergePersistedPart`, `finalizeAssistantParts`);\n * - router/openai-compat lane: `text_delta`/`tool_call` stream events are\n *   mapped INTO canonical part events first (`/runtime`'s `toLoopEvents` +\n *   `/stream`'s `normalizeToolEvent`) and then persisted identically — the\n *   store never sees a router-specific shape.\n */\n\nimport type { Part as HarnessWirePart } from '@tangle-network/agent-interface'\nimport type {\n  ChatInteractionField,\n  ChatInteractionStatus,\n  InteractionPersistedPart,\n  NoticeKind,\n  NoticePersistedPart,\n} from '../web-react/chat-interactions'\n\n/** Start/end wall-clock millis, as normalized by `/stream`'s `normalizeTime`. */\nexport interface ChatPartTime {\n  start?: number\n  end?: number\n}\n\n/** `id` is the harness's per-segment identity; absent on legacy/router parts,\n *  which collapse to a single logical text stream. Never invented client-side. */\nexport interface ChatTextPart {\n  type: 'text'\n  text: string\n  id?: string\n}\n\nexport interface ChatReasoningPart {\n  type: 'reasoning'\n  text: string\n  id?: string\n  time?: ChatPartTime\n}\n\n/** Superset of the sidecar's status enum (`pending|running|completed|failed`)\n *  and agent-interface's `ToolState` statuses; `error` is the persisted\n *  terminal form `/stream`'s `normalizePersistedPart` settles on. */\nexport type ChatToolStatus = 'pending' | 'running' | 'completed' | 'error' | 'failed'\n\nexport interface ChatToolState {\n  status: ChatToolStatus\n  input?: unknown\n  output?: unknown\n  error?: string\n  title?: string\n  metadata?: Record<string, unknown>\n  time?: ChatPartTime\n}\n\nexport interface ChatToolPart {\n  type: 'tool'\n  id: string\n  tool: string\n  callID?: string\n  state: ChatToolState\n}\n\n/** Union of the sidecar's legacy (path-based) and AI-SDK (url-based) file\n *  shapes; response-side every field besides `type` is optional. */\nexport interface ChatFilePart {\n  type: 'file'\n  id?: string\n  filename?: string\n  mediaType?: string\n  url?: string\n  path?: string\n  content?: string\n}\n\nexport interface ChatImagePart {\n  type: 'image'\n  filename?: string\n  mediaType?: string\n  url?: string\n  path?: string\n}\n\nexport interface ChatSubtaskPart {\n  type: 'subtask'\n  prompt: string\n  description: string\n  agent: string\n  id?: string\n}\n\n/** OpenCode step-boundary marker — no renderable text; preserved so mappers\n *  never coerce it into a \"[object Object]\" text part. */\nexport interface ChatStepStartPart {\n  type: 'step-start'\n}\n\n/** Per-step usage receipt as the harness reports it (sidecar\n *  `StepFinishPartSchema`). The message-level token/cost columns are this\n *  shape flattened. */\nexport interface ChatUsageTokens {\n  total?: number\n  input?: number\n  output?: number\n  reasoning?: number\n  cache?: {\n    write?: number\n    read?: number\n  }\n}\n\nexport interface ChatStepFinishPart {\n  type: 'step-finish'\n  reason?: string\n  tokens?: ChatUsageTokens\n  cost?: number\n}\n\n/** Persisted human-in-the-loop ask — byte-matches\n *  `interactionToPersistedPart` in `/web-react`'s chat-interactions contract. */\nexport interface ChatInteractionPart {\n  type: 'interaction'\n  id: string\n  kind: string\n  title: string\n  body?: string\n  answerSpec: { fields: ChatInteractionField[] }\n  status: ChatInteractionStatus\n  cancelReason?: string\n}\n\n/** Persisted one-line transcript notice — byte-matches `noticePart` in\n *  `/web-react`'s chat-interactions contract. */\nexport interface ChatNoticePart {\n  type: 'notice'\n  id: string\n  noticeKind: NoticeKind\n  text: string\n}\n\n// The \"byte-matches\" claims above, enforced at compile time: the interaction\n// contract's codec output types and the stored part types must stay mutually\n// assignable, so a codec field added on one side without the other fails here.\ntype MutuallyAssignable<A extends B, B> = A\ntype _CodecEmitsStorableInteractionPart = MutuallyAssignable<InteractionPersistedPart, ChatInteractionPart>\ntype _StoredInteractionPartFeedsCodec = MutuallyAssignable<ChatInteractionPart, InteractionPersistedPart>\ntype _CodecEmitsStorableNoticePart = MutuallyAssignable<NoticePersistedPart, ChatNoticePart>\ntype _StoredNoticePartFeedsCodec = MutuallyAssignable<ChatNoticePart, NoticePersistedPart>\n\nexport type ChatMessagePart =\n  | ChatTextPart\n  | ChatReasoningPart\n  | ChatToolPart\n  | ChatFilePart\n  | ChatImagePart\n  | ChatSubtaskPart\n  | ChatStepStartPart\n  | ChatStepFinishPart\n  | ChatInteractionPart\n  | ChatNoticePart\n\n/** Every canonical harness wire-part kind must be storable — compile-time\n *  guarantee that a new agent-interface part kind cannot silently fall out of\n *  the persisted vocabulary. */\nexport type StorableHarnessPartKind = HarnessWirePart['type'] & ChatMessagePart['type']\n\n/**\n * The typed projection at the `/stream` → `/chat-store` boundary. The stream\n * normalizers (`normalizePersistedPart`/`mergePersistedPart`/\n * `finalizeAssistantParts`) deliberately produce untyped `JsonRecord`s — they\n * normalize wire shapes and do not own the stored vocabulary. THIS module\n * owns it, so this is where rows gain the `ChatMessagePart` type: each entry\n * is validated against its kind's required fields and narrowed, junk is\n * dropped, and — enforced by the exhaustiveness check below — no storable\n * kind can silently fall out (the step-finish/interaction trap).\n */\nexport function toChatMessageParts(parts: Array<Record<string, unknown>>): ChatMessagePart[] {\n  const out: ChatMessagePart[] = []\n  for (const part of parts) {\n    const typed = toChatMessagePart(part)\n    if (typed) out.push(typed)\n  }\n  return out\n}\n\nconst str = (value: unknown): value is string => typeof value === 'string'\n\nfunction toChatMessagePart(part: Record<string, unknown>): ChatMessagePart | null {\n  if (!part || typeof part !== 'object') return null\n  const type = part.type as ChatMessagePart['type'] | undefined\n  switch (type) {\n    case 'text':\n    case 'reasoning':\n      return str(part.text) ? (part as unknown as ChatTextPart | ChatReasoningPart) : null\n    case 'tool':\n      return str(part.id) && str(part.tool) && part.state && typeof part.state === 'object'\n        ? (part as unknown as ChatToolPart)\n        : null\n    case 'file':\n    case 'image':\n      return part as unknown as ChatFilePart | ChatImagePart\n    case 'subtask':\n      return str(part.prompt) && str(part.description) && str(part.agent)\n        ? (part as unknown as ChatSubtaskPart)\n        : null\n    case 'step-start':\n      return { type: 'step-start' }\n    case 'step-finish':\n      return part as unknown as ChatStepFinishPart\n    case 'interaction':\n      return str(part.id) && str(part.kind) && str(part.title) && str(part.status) &&\n        part.answerSpec && typeof part.answerSpec === 'object'\n        ? (part as unknown as ChatInteractionPart)\n        : null\n    case 'notice':\n      return str(part.id) && str(part.noticeKind) && str(part.text)\n        ? (part as unknown as ChatNoticePart)\n        : null\n    case undefined:\n      return null\n    default: {\n      // Compile-time exhaustiveness: a new ChatMessagePart kind that is not\n      // handled above makes `type` non-never here and this line fails.\n      const _exhaustive: never = type\n      void _exhaustive\n      return null\n    }\n  }\n}\n\nexport function isChatToolPart(part: ChatMessagePart): part is ChatToolPart {\n  return part.type === 'tool'\n}\n\nexport function isChatTextPart(part: ChatMessagePart): part is ChatTextPart {\n  return part.type === 'text'\n}\n\nexport function isChatInteractionPart(part: ChatMessagePart): part is ChatInteractionPart {\n  return part.type === 'interaction'\n}\n\nexport function isChatStepFinishPart(part: ChatMessagePart): part is ChatStepFinishPart {\n  return part.type === 'step-finish'\n}\n"],"mappings":";AAgNO,SAAS,mBAAmB,OAA0D;AAC3F,QAAM,MAAyB,CAAC;AAChC,aAAW,QAAQ,OAAO;AACxB,UAAM,QAAQ,kBAAkB,IAAI;AACpC,QAAI,MAAO,KAAI,KAAK,KAAK;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,IAAM,MAAM,CAAC,UAAoC,OAAO,UAAU;AAElE,SAAS,kBAAkB,MAAuD;AAChF,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,OAAO,KAAK;AAClB,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AACH,aAAO,IAAI,KAAK,IAAI,IAAK,OAAuD;AAAA,IAClF,KAAK;AACH,aAAO,IAAI,KAAK,EAAE,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,SAAS,OAAO,KAAK,UAAU,WACxE,OACD;AAAA,IACN,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,IAAI,KAAK,MAAM,KAAK,IAAI,KAAK,WAAW,KAAK,IAAI,KAAK,KAAK,IAC7D,OACD;AAAA,IACN,KAAK;AACH,aAAO,EAAE,MAAM,aAAa;AAAA,IAC9B,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,IAAI,KAAK,EAAE,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,MAAM,KACzE,KAAK,cAAc,OAAO,KAAK,eAAe,WAC3C,OACD;AAAA,IACN,KAAK;AACH,aAAO,IAAI,KAAK,EAAE,KAAK,IAAI,KAAK,UAAU,KAAK,IAAI,KAAK,IAAI,IACvD,OACD;AAAA,IACN,KAAK;AACH,aAAO;AAAA,IACT,SAAS;AAGP,YAAM,cAAqB;AAC3B,WAAK;AACL,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEO,SAAS,eAAe,MAA6C;AAC1E,SAAO,KAAK,SAAS;AACvB;AAEO,SAAS,eAAe,MAA6C;AAC1E,SAAO,KAAK,SAAS;AACvB;AAEO,SAAS,sBAAsB,MAAoD;AACxF,SAAO,KAAK,SAAS;AACvB;AAEO,SAAS,qBAAqB,MAAmD;AACtF,SAAO,KAAK,SAAS;AACvB;","names":[]}

package/dist/{chunk-AVBANQ67.js → chunk-TKVJE63N.js}

@@ -254,6 +254,14 @@ function createAuthGuard(opts) {
     getOptionalSession: async (request) => await opts.getSession(request) ?? null
   };
 }
+async function guardResolution(run) {
+  try {
+    return { ok: true, value: await run() };
+  } catch (err) {
+    if (err instanceof Response) return { ok: false, response: err };
+    throw err;
+  }
+}
 function parseAdminEmails(raw) {
   return (raw ?? "").split(/[,\s]+/).map((e) => e.trim().toLowerCase()).filter(Boolean);
 }
@@ -288,8 +296,9 @@ export {
   createBetterAuthSessionCookieMinter,
   createTangleSsoHandlers,
   createAuthGuard,
+  guardResolution,
   parseAdminEmails,
   createAdminGuard,
   assertBillableBalance
 };
-//# sourceMappingURL=chunk-AVBANQ67.js.map
+//# sourceMappingURL=chunk-TKVJE63N.js.map

package/dist/{chunk-AVBANQ67.js.map → chunk-TKVJE63N.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/platform/sso.ts","../src/platform/guards.ts"],"sourcesContent":["/**\n * Cross-site Tangle SSO for agent apps: signed-state CSRF cookies plus the\n * full start/callback orchestration against the platform's /cross-site\n * bridge. The platform wire client and account persistence are structural\n * seams (`TangleSsoAuthClient` / `TangleSsoAccountStore`), so this module\n * never imports agent-runtime, an auth framework, or a database driver.\n * WebCrypto only — runs in workerd without node compatibility flags.\n */\n\nimport { clearCookieHeader, readCookieValue, serializeCookie } from '../web/index'\n\nconst DEFAULT_STATE_TTL_SECONDS = 600\nconst DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 7\nconst DEFAULT_REDIRECT_PATH = '/app'\nconst DEFAULT_LOGIN_PATH = '/login'\nconst DEFAULT_SESSION_COOKIE = 'better-auth.session_token'\n\n// ── Signed state ────────────────────────────────────────────────────────────\n\nexport interface SsoStateConfig {\n  /** HMAC-SHA256 secret (e.g. the app's auth secret). */\n  secret: string\n  /** State lifetime in ms. Default 600 000. */\n  ttlMs?: number\n  /** Injectable clock (ms since epoch). Default Date.now. */\n  now?: () => number\n}\n\nfunction randomHex(bytes: number): string {\n  const buf = new Uint8Array(bytes)\n  crypto.getRandomValues(buf)\n  return Array.from(buf, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nasync function hmacBytes(secret: string, value: string): Promise<Uint8Array> {\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  return new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(value)))\n}\n\nasync function hmacHex(secret: string, value: string): Promise<string> {\n  return Array.from(await hmacBytes(secret, value), (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return diff === 0\n}\n\n/** Mint a `<randomHex32>.<timestamp36>.<hmacHex>` state value. The timestamp\n *  is inside the signed payload, so expiry survives cookie-attribute tampering. */\nexport async function createSignedSsoState(config: SsoStateConfig): Promise<string> {\n  if (!config.secret) throw new Error('SsoStateConfig.secret is required')\n  const now = config.now ?? Date.now\n  const payload = `${randomHex(16)}.${now().toString(36)}`\n  return `${payload}.${await hmacHex(config.secret, payload)}`\n}\n\n/** Verify the MAC (constant-time) and the signed TTL. */\nexport async function verifySignedSsoState(state: string, config: SsoStateConfig): Promise<boolean> {\n  if (!config.secret) throw new Error('SsoStateConfig.secret is required')\n  const parts = state.split('.')\n  if (parts.length !== 3) return false\n  const [random, timestamp, mac] = parts\n  if (!random || !timestamp || !mac) return false\n  const expected = await hmacHex(config.secret, `${random}.${timestamp}`)\n  if (!constantTimeEqual(mac, expected)) return false\n  const mintedAt = parseInt(timestamp, 36)\n  if (!Number.isFinite(mintedAt)) return false\n  const now = config.now ?? Date.now\n  const ttlMs = config.ttlMs ?? DEFAULT_STATE_TTL_SECONDS * 1000\n  return now() - mintedAt <= ttlMs\n}\n\n// ── Seams ───────────────────────────────────────────────────────────────────\n\nexport interface TangleSsoExchangeResult {\n  apiKey: string\n  user: { id: string; email: string; name?: string | null }\n  plan?: { tier: string } | null\n}\n\n/** Structural mirror of the platform auth wire client — any object with these\n *  two methods satisfies it without this module importing the concrete class. */\nexport interface TangleSsoAuthClient {\n  authorizeUrl(options: { state: string; redirectUri?: string }): string\n  exchange(code: string): Promise<TangleSsoExchangeResult>\n}\n\n/** Thrown by `upsertUserByEmail` when the app-local user row cannot be\n *  created; the callback handler maps it to `?error=tangle_user_create_failed`.\n *  Any other store error propagates. */\nexport class TangleSsoUserCreateError extends Error {\n  constructor(message = 'Failed to create local user for Tangle SSO') {\n    super(message)\n    this.name = 'TangleSsoUserCreateError'\n  }\n}\n\n/**\n * Account persistence seam. Covers both storage styles in use: link-table\n * apps (a per-user platform-link row) and session-column apps (the key on the\n * session row) — `saveTangleLink` receives both `userId` and `sessionToken`,\n * and each app persists with the key it needs. `createSession` runs first so\n * the token is always available to `saveTangleLink`.\n */\nexport interface TangleSsoAccountStore {\n  /** Find-or-create the app-local user. `tangleUserId` is the platform's\n   *  stable user id — match on it first when the app stores it (emails are\n   *  mutable on the platform; the id is not), falling back to email for\n   *  first-time logins. */\n  upsertUserByEmail(input: { email: string; name: string | null; tangleUserId: string }): Promise<{ userId: string }>\n  /** Create an app session row; returns the session-cookie token value. */\n  createSession(input: {\n    userId: string\n    expiresAt: Date\n    ipAddress: string | null\n    userAgent: string | null\n  }): Promise<{ token: string }>\n  /** Persist the platform link (API key + platform identity). */\n  saveTangleLink(input: {\n    userId: string\n    sessionToken: string\n    tangleUserId: string\n    email: string\n    name: string | null\n    apiKey: string\n    planTier: string | null\n  }): Promise<void>\n}\n\n// ── Session cookie ──────────────────────────────────────────────────────────\n\n/** Successful-login context handed to the `setSessionCookie` seam. */\nexport interface TangleSsoSessionCookieArgs {\n  /** Session token returned by `store.createSession`. */\n  token: string\n  /** Session expiry (now + `sessionTtlSeconds`). */\n  expiresAt: Date\n  /** Mirrors `sessionTtlSeconds` after defaulting. */\n  ttlSeconds: number\n  /** Mirrors `TangleSsoHandlerOptions.secureCookies`. */\n  secure: boolean\n}\n\n/**\n * Sign a session token to better-call's signed-cookie contract — the value\n * better-auth's `getSignedCookie` verifies: `<token>.<signature>` where the\n * signature is the raw HMAC-SHA256 of the token under `secret`, encoded as\n * STANDARD base64 WITH padding (32 bytes → 44 chars ending `=`; better-call\n * rejects any other length or suffix, so url-safe/unpadded variants read back\n * as a null session). The joined value is percent-encoded once at cookie\n * serialization, matching better-call's `serializeSignedCookie` byte-exactly.\n */\nexport async function signSessionCookieValue(token: string, secret: string): Promise<string> {\n  if (!secret) throw new Error('signSessionCookieValue requires a non-empty secret')\n  const sig = await hmacBytes(secret, token)\n  let bin = ''\n  for (const byte of sig) bin += String.fromCharCode(byte)\n  return `${token}.${btoa(bin)}`\n}\n\n/** Structural slice of a `betterAuth()` instance — only what cookie minting\n *  reads. No better-auth import: the signing contract is implemented by\n *  `signSessionCookieValue`, byte-compatible with better-auth's own\n *  `makeSignature`. */\nexport interface BetterAuthSessionCookieSource {\n  $context: PromiseLike<{\n    secret: string\n    authCookies: {\n      sessionToken: {\n        /** Final cookie name — better-auth decides the `__Secure-` prefix\n         *  (and any `advanced.cookiePrefix`) once at `betterAuth()` init. */\n        name: string\n        attributes: {\n          secure?: boolean\n          sameSite?: string\n          path?: string\n          httpOnly?: boolean\n          domain?: string\n        }\n      }\n    }\n  }>\n}\n\nexport interface BetterAuthSessionCookieMinterOptions {\n  /** Receives the shadowed-cookie-name warning (see below). Default\n   *  console.warn. */\n  warn?: (message: string) => void\n}\n\n/**\n * Canonical `setSessionCookie` wiring for better-auth apps: mint the session\n * Set-Cookie exactly as better-auth's own login flows do — name + attributes\n * from `auth.$context.authCookies.sessionToken` (better-auth stays\n * authoritative over prefix/name/attributes) and the value signed to\n * better-call's `getSignedCookie` contract. A raw unprefixed\n * `better-auth.session_token` left by an earlier login is explicitly expired\n * so it cannot shadow the real cookie.\n *\n * Warns when the app's session cookie still has better-auth's DEFAULT name:\n * the Tangle platform (id.tangle.tools) sets a `Domain=.tangle.tools` cookie\n * under that exact name, and equal-path cookies are sent oldest-first — the\n * platform's cookie is always older (the user signs in there before the app's\n * callback runs), so the app reads the platform's token, fails its own\n * signature check, and every fresh login lands logged-out. Per-app\n * `advanced.cookiePrefix` is the fix.\n *\n * Throws on a domain-scoped session cookie for the same reason: a\n * `Domain=`-wide session cookie is exactly the shadowing footgun.\n */\nexport function createBetterAuthSessionCookieMinter(\n  auth: BetterAuthSessionCookieSource,\n  options: BetterAuthSessionCookieMinterOptions = {},\n): (args: TangleSsoSessionCookieArgs) => Promise<string[]> {\n  const warn = options.warn ?? ((message: string) => console.warn(message))\n  return async ({ token, ttlSeconds }) => {\n    const ctx = await auth.$context\n    if (!ctx.secret) {\n      throw new Error('createBetterAuthSessionCookieMinter: auth context has no secret')\n    }\n    const { name, attributes } = ctx.authCookies.sessionToken\n    if (attributes.domain) {\n      throw new Error(\n        `createBetterAuthSessionCookieMinter: refusing a domain-scoped session cookie (Domain=${attributes.domain}) — ` +\n          'a domain-wide session cookie shadows sibling apps that share the parent domain',\n      )\n    }\n    if (name === DEFAULT_SESSION_COOKIE || name === `__Secure-${DEFAULT_SESSION_COOKIE}`) {\n      warn(\n        `[tangle-sso] session cookie is named \"${name}\" — better-auth's default. ` +\n          'The Tangle platform (id.tangle.tools) sets a Domain=.tangle.tools cookie under the same name, ' +\n          \"and the platform's (older) cookie wins the Cookie-header order, so this app's sessions read back null. \" +\n          \"Set a per-app prefix: betterAuth({ advanced: { cookiePrefix: '<app>' } }).\",\n      )\n    }\n    const sameSite = typeof attributes.sameSite === 'string' ? attributes.sameSite : 'lax'\n    const cookieOptions = {\n      name,\n      path: typeof attributes.path === 'string' ? attributes.path : '/',\n      httpOnly: attributes.httpOnly !== false,\n      sameSite: (sameSite.charAt(0).toUpperCase() + sameSite.slice(1)) as 'Lax' | 'Strict' | 'None',\n      secure: Boolean(attributes.secure) || name.startsWith('__Secure-'),\n      maxAgeSeconds: ttlSeconds,\n    }\n    const cookies = [serializeCookie(await signSessionCookieValue(token, ctx.secret), cookieOptions)]\n    if (name !== DEFAULT_SESSION_COOKIE) {\n      cookies.push(clearCookieHeader({ ...cookieOptions, name: DEFAULT_SESSION_COOKIE }))\n    }\n    return cookies\n  }\n}\n\n// ── Handlers ────────────────────────────────────────────────────────────────\n\nexport interface TangleSsoHandlerOptions {\n  auth: TangleSsoAuthClient\n  store: TangleSsoAccountStore\n  /** HMAC secret for the state cookie. */\n  stateSecret: string\n  /** Absolute callback URL registered with the platform. */\n  callbackUrl: string\n  stateCookieName: string\n  /** Default 'better-auth.session_token'. Ignored when `setSessionCookie` is\n   *  provided. The default path prepends `__Secure-` iff `secureCookies`. */\n  sessionCookieName?: string\n  /** Mint the host auth framework's own session cookie(s); return complete\n   *  Set-Cookie header values (the handler appends them verbatim and sets no\n   *  session cookie itself). Supply this when the framework should stay\n   *  authoritative over name/prefix/signing/attributes — e.g. better-auth:\n   *  `auth.$context.authCookies.sessionToken` + `makeSignature`. */\n  setSessionCookie?: (\n    args: TangleSsoSessionCookieArgs,\n  ) => readonly string[] | Promise<readonly string[]>\n  /** HMAC-SHA256 secret the host auth framework verifies session cookies with\n   *  (better-auth: its `secret`). Required when `setSessionCookie` is absent —\n   *  the default cookie is minted to better-call's signed contract via\n   *  `signSessionCookieValue`; an unsigned or mis-signed value reads back as a\n   *  null session, so there is deliberately no fallback to `stateSecret`\n   *  (which is not guaranteed to be the auth secret). */\n  sessionCookieSecret?: string\n  /** Adds `Secure` to every cookie this module sets, and (default session\n   *  cookie only) the `__Secure-` name prefix. Must match the auth\n   *  framework's own secure-cookie decision (better-auth: https `baseURL` /\n   *  `advanced.useSecureCookies`), or it will look up a different cookie name\n   *  than the one set here. */\n  secureCookies: boolean\n  /** Default 604 800 (7 days). */\n  sessionTtlSeconds?: number\n  /** Default 600. Applies to both the cookie Max-Age and the signed TTL. */\n  stateTtlSeconds?: number\n  /** Default '/app'. */\n  defaultRedirectPath?: string\n  /** Default '/login'. */\n  loginPath?: string\n  /** Failure log hook (e.g. console.error). Default no-op. */\n  log?: (message: string, error?: unknown) => void\n  now?: () => number\n}\n\nexport interface TangleSsoHandlers {\n  /** GET start route: mint + sign state, set the state cookie, 302 to the\n   *  platform authorize URL. `?redirect=` carries the post-login path. */\n  start(request: Request): Promise<Response>\n  /** GET callback route: verify state, exchange the code, upsert the user,\n   *  create the session, save the platform link, set the session cookie\n   *  (via the `setSessionCookie` seam, else signed to better-call's contract\n   *  with `sessionCookieSecret`), 302 to the saved redirect. Every failure\n   *  302s to `loginPath?error=…` with the state cookie cleared. */\n  callback(request: Request): Promise<Response>\n}\n\n/** Accept only same-origin absolute paths (rejects `//host` protocol-relative URLs). */\nfunction sanitizeRedirectPath(value: string | null, fallback: string): string {\n  if (value && value.startsWith('/') && !value.startsWith('//')) return value\n  return fallback\n}\n\nfunction redirectResponse(location: string, headers = new Headers()): Response {\n  headers.set('Location', location)\n  return new Response(null, { status: 302, headers })\n}\n\n/** Real client IP: `CF-Connecting-IP` behind Cloudflare, else the first\n *  `x-forwarded-for` hop (the rest of the list is sender-controlled). */\nfunction clientIp(request: Request): string | null {\n  return (\n    request.headers.get('CF-Connecting-IP') ??\n    request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ??\n    null\n  )\n}\n\ninterface StateCookiePayload {\n  s: string\n  r: string\n}\n\nfunction parseStateCookiePayload(raw: string | null): StateCookiePayload | null {\n  if (!raw) return null\n  try {\n    const parsed = JSON.parse(raw) as unknown\n    if (parsed === null || typeof parsed !== 'object') return null\n    const { s, r } = parsed as Record<string, unknown>\n    if (typeof s !== 'string' || typeof r !== 'string') return null\n    return { s, r }\n  } catch {\n    return null\n  }\n}\n\nexport function createTangleSsoHandlers(opts: TangleSsoHandlerOptions): TangleSsoHandlers {\n  if (!opts.stateSecret) throw new Error('TangleSsoHandlerOptions.stateSecret is required')\n  if (!opts.callbackUrl) throw new Error('TangleSsoHandlerOptions.callbackUrl is required')\n  if (!opts.stateCookieName) throw new Error('TangleSsoHandlerOptions.stateCookieName is required')\n\n  const sessionCookieName = opts.sessionCookieName ?? DEFAULT_SESSION_COOKIE\n\n  let mintSessionCookies: (args: TangleSsoSessionCookieArgs) => Promise<readonly string[]>\n  if (opts.setSessionCookie) {\n    const seam = opts.setSessionCookie\n    mintSessionCookies = async (args) => await seam(args)\n  } else if (opts.sessionCookieSecret) {\n    const secret = opts.sessionCookieSecret\n    mintSessionCookies = async ({ token, secure, ttlSeconds }) => [\n      serializeCookie(await signSessionCookieValue(token, secret), {\n        name: secure ? `__Secure-${sessionCookieName}` : sessionCookieName,\n        secure,\n        maxAgeSeconds: ttlSeconds,\n      }),\n    ]\n  } else {\n    throw new Error(\n      'TangleSsoHandlerOptions requires setSessionCookie or sessionCookieSecret: ' +\n        'better-auth only accepts HMAC-signed (and, on https, __Secure--prefixed) session cookies, ' +\n        'so an unsigned default would mint sessions that read back null',\n    )\n  }\n  const sessionTtlSeconds = opts.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS\n  const stateTtlSeconds = opts.stateTtlSeconds ?? DEFAULT_STATE_TTL_SECONDS\n  const defaultRedirectPath = opts.defaultRedirectPath ?? DEFAULT_REDIRECT_PATH\n  const loginPath = opts.loginPath ?? DEFAULT_LOGIN_PATH\n  const log = opts.log ?? (() => {})\n  const now = opts.now ?? Date.now\n  const stateConfig: SsoStateConfig = { secret: opts.stateSecret, ttlMs: stateTtlSeconds * 1000, now }\n\n  const stateCookieOpts = { name: opts.stateCookieName, secure: opts.secureCookies }\n\n  function loginErrorRedirect(code: string): Response {\n    const headers = new Headers()\n    headers.append('Set-Cookie', clearCookieHeader(stateCookieOpts))\n    return redirectResponse(`${loginPath}?error=${code}`, headers)\n  }\n\n  return {\n    async start(request) {\n      const url = new URL(request.url)\n      const redirectPath = sanitizeRedirectPath(url.searchParams.get('redirect'), defaultRedirectPath)\n      const state = await createSignedSsoState(stateConfig)\n      const cookie = serializeCookie(JSON.stringify({ s: state, r: redirectPath }), {\n        ...stateCookieOpts,\n        maxAgeSeconds: stateTtlSeconds,\n      })\n      const headers = new Headers()\n      headers.append('Set-Cookie', cookie)\n      return redirectResponse(opts.auth.authorizeUrl({ state, redirectUri: opts.callbackUrl }), headers)\n    },\n\n    async callback(request) {\n      const url = new URL(request.url)\n      const code = url.searchParams.get('code')\n      const stateFromPlatform = url.searchParams.get('state')\n      if (!code || !stateFromPlatform) return loginErrorRedirect('tangle_callback_missing')\n\n      const payload = parseStateCookiePayload(readCookieValue(request.headers.get('cookie'), opts.stateCookieName))\n      if (!payload || payload.s !== stateFromPlatform) return loginErrorRedirect('tangle_state_mismatch')\n      if (!(await verifySignedSsoState(payload.s, stateConfig))) return loginErrorRedirect('tangle_state_mismatch')\n\n      let exchanged: TangleSsoExchangeResult\n      try {\n        exchanged = await opts.auth.exchange(code)\n      } catch (err) {\n        log('[tangle-sso] exchange failed', err)\n        return loginErrorRedirect('tangle_exchange_failed')\n      }\n\n      let userId: string\n      try {\n        ;({ userId } = await opts.store.upsertUserByEmail({\n          email: exchanged.user.email,\n          name: exchanged.user.name ?? null,\n          tangleUserId: exchanged.user.id,\n        }))\n      } catch (err) {\n        if (err instanceof TangleSsoUserCreateError) return loginErrorRedirect('tangle_user_create_failed')\n        throw err\n      }\n\n      const expiresAt = new Date(now() + sessionTtlSeconds * 1000)\n      const { token } = await opts.store.createSession({\n        userId,\n        expiresAt,\n        ipAddress: clientIp(request),\n        userAgent: request.headers.get('user-agent'),\n      })\n\n      await opts.store.saveTangleLink({\n        userId,\n        sessionToken: token,\n        tangleUserId: exchanged.user.id,\n        email: exchanged.user.email,\n        name: exchanged.user.name ?? null,\n        apiKey: exchanged.apiKey,\n        planTier: exchanged.plan?.tier ?? null,\n      })\n\n      const headers = new Headers()\n      headers.append('Set-Cookie', clearCookieHeader(stateCookieOpts))\n      const sessionCookies = await mintSessionCookies({\n        token,\n        expiresAt,\n        ttlSeconds: sessionTtlSeconds,\n        secure: opts.secureCookies,\n      })\n      for (const cookie of sessionCookies) headers.append('Set-Cookie', cookie)\n      return redirectResponse(sanitizeRedirectPath(payload.r, defaultRedirectPath), headers)\n    },\n  }\n}\n","/**\n * Request guards for agent-app routes: session auth (302 redirect for pages,\n * JSON 401 for APIs), admin allowlisting (404 — the route stays invisible to\n * non-admins), and the billable-balance gate (402 with a stable code).\n * Session resolution is a seam; thrown Responses follow the router convention\n * of surfacing a thrown Response as the route result.\n */\n\nimport { isTangleBillingEnforcementDisabled } from '../runtime/model'\n\nexport interface AuthGuardOptions<Session> {\n  /** e.g. a better-auth `auth.api.getSession` wrapped by the app. */\n  getSession(request: Request): Promise<Session | null | undefined>\n  /** Default '/login'. */\n  loginPath?: string\n}\n\nexport interface AuthGuard<Session> {\n  /** Page guard — throws a 302 redirect Response to `loginPath`. */\n  requireUser(request: Request): Promise<Session>\n  /** API guard — throws JSON 401 `{ error: 'Unauthorized', code: 'auth.unauthenticated' }`. */\n  requireApiUser(request: Request): Promise<Session>\n  /** `apiResponse` selects the 401 JSON path over the redirect. */\n  requireSession(request: Request, opts?: { apiResponse?: boolean }): Promise<Session>\n  getOptionalSession(request: Request): Promise<Session | null>\n}\n\nexport function createAuthGuard<Session>(opts: AuthGuardOptions<Session>): AuthGuard<Session> {\n  const loginPath = opts.loginPath ?? '/login'\n\n  async function requireSession(request: Request, o: { apiResponse?: boolean } = {}): Promise<Session> {\n    const session = await opts.getSession(request)\n    if (!session) {\n      if (o.apiResponse) {\n        throw Response.json({ error: 'Unauthorized', code: 'auth.unauthenticated' }, { status: 401 })\n      }\n      throw new Response(null, { status: 302, headers: { Location: loginPath } })\n    }\n    return session\n  }\n\n  return {\n    requireSession,\n    requireUser: (request) => requireSession(request),\n    requireApiUser: (request) => requireSession(request, { apiResponse: true }),\n    getOptionalSession: async (request) => (await opts.getSession(request)) ?? null,\n  }\n}\n\n/** Comma/whitespace separated → trimmed, lowercased, empties dropped. */\nexport function parseAdminEmails(raw: string | null | undefined): string[] {\n  return (raw ?? '')\n    .split(/[,\\s]+/)\n    .map((e) => e.trim().toLowerCase())\n    .filter(Boolean)\n}\n\nexport interface AdminGuardOptions<Session> {\n  requireUser(request: Request): Promise<Session>\n  emailOf(session: Session): string | null | undefined\n  /** Resolved per request; an EMPTY allowlist refuses everyone. */\n  allowedEmails(): string[]\n}\n\n/** Non-admins (and empty allowlists) get 404, keeping the route invisible —\n *  better than a \"forbidden\" footprint that advertises its existence. */\nexport function createAdminGuard<Session>(opts: AdminGuardOptions<Session>): (request: Request) => Promise<Session> {\n  return async (request) => {\n    const session = await opts.requireUser(request)\n    const allowed = opts.allowedEmails()\n    if (allowed.length === 0) throw new Response('Not found', { status: 404 })\n    const email = (opts.emailOf(session) ?? '').toLowerCase()\n    if (!allowed.includes(email)) throw new Response('Not found', { status: 404 })\n    return session\n  }\n}\n\nexport interface BillableBalanceState {\n  overageAllowed: boolean\n  remainingBalanceUsd: number\n}\n\nexport interface AssertBillableBalanceOptions {\n  env?: Record<string, string | undefined>\n  /** App-specific enforcement override flag (e.g. 'GTM_BILLING_ENFORCEMENT'),\n   *  fed to `isTangleBillingEnforcementDisabled`. */\n  enforcementEnvVar?: string\n  /** Default 'Add balance or upgrade your plan to invoke this agent.'. */\n  errorMessage?: string\n  /** Merged into the 402 JSON body (e.g. `{ organizationId }`). */\n  errorBody?: Record<string, unknown>\n}\n\n/**\n * Gate a billable turn: passes when enforcement is disabled (dev default),\n * the tier allows overage, or remaining balance is positive. Otherwise throws\n * a 402 Response with the stable `billing.balance_required` code so clients\n * can route to the billing screen.\n */\nexport function assertBillableBalance(state: BillableBalanceState, opts: AssertBillableBalanceOptions = {}): void {\n  if (isTangleBillingEnforcementDisabled({ env: opts.env, enforcementEnvVar: opts.enforcementEnvVar })) return\n  if (state.overageAllowed || state.remainingBalanceUsd > 0) return\n  // errorBody first: the stable error/code contract always wins over caller extras.\n  throw Response.json(\n    {\n      ...opts.errorBody,\n      error: opts.errorMessage ?? 'Add balance or upgrade your plan to invoke this agent.',\n      code: 'billing.balance_required',\n    },\n    { status: 402 },\n  )\n}\n"],"mappings":";;;;;;;;;;AAWA,IAAM,4BAA4B;AAClC,IAAM,8BAA8B,KAAK,KAAK,KAAK;AACnD,IAAM,wBAAwB;AAC9B,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAa/B,SAAS,UAAU,OAAuB;AACxC,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACxE;AAEA,eAAe,UAAU,QAAgB,OAAoC;AAC3E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;AAC9F;AAEA,eAAe,QAAQ,QAAgB,OAAgC;AACrE,SAAO,MAAM,KAAK,MAAM,UAAU,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACnG;AAEA,SAAS,kBAAkB,GAAW,GAAoB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,SAAS;AAClB;AAIA,eAAsB,qBAAqB,QAAyC;AAClF,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AACvE,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,UAAU,GAAG,UAAU,EAAE,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;AACtD,SAAO,GAAG,OAAO,IAAI,MAAM,QAAQ,OAAO,QAAQ,OAAO,CAAC;AAC5D;AAGA,eAAsB,qBAAqB,OAAe,QAA0C;AAClG,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AACvE,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,CAAC,QAAQ,WAAW,GAAG,IAAI;AACjC,MAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAK,QAAO;AAC1C,QAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,GAAG,MAAM,IAAI,SAAS,EAAE;AACtE,MAAI,CAAC,kBAAkB,KAAK,QAAQ,EAAG,QAAO;AAC9C,QAAM,WAAW,SAAS,WAAW,EAAE;AACvC,MAAI,CAAC,OAAO,SAAS,QAAQ,EAAG,QAAO;AACvC,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,QAAQ,OAAO,SAAS,4BAA4B;AAC1D,SAAO,IAAI,IAAI,YAAY;AAC7B;AAoBO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,UAAU,8CAA8C;AAClE,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAyDA,eAAsB,uBAAuB,OAAe,QAAiC;AAC3F,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,oDAAoD;AACjF,QAAM,MAAM,MAAM,UAAU,QAAQ,KAAK;AACzC,MAAI,MAAM;AACV,aAAW,QAAQ,IAAK,QAAO,OAAO,aAAa,IAAI;AACvD,SAAO,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC;AAC9B;AAoDO,SAAS,oCACd,MACA,UAAgD,CAAC,GACQ;AACzD,QAAM,OAAO,QAAQ,SAAS,CAAC,YAAoB,QAAQ,KAAK,OAAO;AACvE,SAAO,OAAO,EAAE,OAAO,WAAW,MAAM;AACtC,UAAM,MAAM,MAAM,KAAK;AACvB,QAAI,CAAC,IAAI,QAAQ;AACf,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AACA,UAAM,EAAE,MAAM,WAAW,IAAI,IAAI,YAAY;AAC7C,QAAI,WAAW,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wFAAwF,WAAW,MAAM;AAAA,MAE3G;AAAA,IACF;AACA,QAAI,SAAS,0BAA0B,SAAS,YAAY,sBAAsB,IAAI;AACpF;AAAA,QACE,yCAAyC,IAAI;AAAA,MAI/C;AAAA,IACF;AACA,UAAM,WAAW,OAAO,WAAW,aAAa,WAAW,WAAW,WAAW;AACjF,UAAM,gBAAgB;AAAA,MACpB;AAAA,MACA,MAAM,OAAO,WAAW,SAAS,WAAW,WAAW,OAAO;AAAA,MAC9D,UAAU,WAAW,aAAa;AAAA,MAClC,UAAW,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,SAAS,MAAM,CAAC;AAAA,MAC9D,QAAQ,QAAQ,WAAW,MAAM,KAAK,KAAK,WAAW,WAAW;AAAA,MACjE,eAAe;AAAA,IACjB;AACA,UAAM,UAAU,CAAC,gBAAgB,MAAM,uBAAuB,OAAO,IAAI,MAAM,GAAG,aAAa,CAAC;AAChG,QAAI,SAAS,wBAAwB;AACnC,cAAQ,KAAK,kBAAkB,EAAE,GAAG,eAAe,MAAM,uBAAuB,CAAC,CAAC;AAAA,IACpF;AACA,WAAO;AAAA,EACT;AACF;AA8DA,SAAS,qBAAqB,OAAsB,UAA0B;AAC5E,MAAI,SAAS,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAEA,SAAS,iBAAiB,UAAkB,UAAU,IAAI,QAAQ,GAAa;AAC7E,UAAQ,IAAI,YAAY,QAAQ;AAChC,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AACpD;AAIA,SAAS,SAAS,SAAiC;AACjD,SACE,QAAQ,QAAQ,IAAI,kBAAkB,KACtC,QAAQ,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC5D;AAEJ;AAOA,SAAS,wBAAwB,KAA+C;AAC9E,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,WAAW,QAAQ,OAAO,WAAW,SAAU,QAAO;AAC1D,UAAM,EAAE,GAAG,EAAE,IAAI;AACjB,QAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,WAAO,EAAE,GAAG,EAAE;AAAA,EAChB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,wBAAwB,MAAkD;AACxF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,iDAAiD;AACxF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,iDAAiD;AACxF,MAAI,CAAC,KAAK,gBAAiB,OAAM,IAAI,MAAM,qDAAqD;AAEhG,QAAM,oBAAoB,KAAK,qBAAqB;AAEpD,MAAI;AACJ,MAAI,KAAK,kBAAkB;AACzB,UAAM,OAAO,KAAK;AAClB,yBAAqB,OAAO,SAAS,MAAM,KAAK,IAAI;AAAA,EACtD,WAAW,KAAK,qBAAqB;AACnC,UAAM,SAAS,KAAK;AACpB,yBAAqB,OAAO,EAAE,OAAO,QAAQ,WAAW,MAAM;AAAA,MAC5D,gBAAgB,MAAM,uBAAuB,OAAO,MAAM,GAAG;AAAA,QAC3D,MAAM,SAAS,YAAY,iBAAiB,KAAK;AAAA,QACjD;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF,OAAO;AACL,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,QAAM,oBAAoB,KAAK,qBAAqB;AACpD,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,QAAM,sBAAsB,KAAK,uBAAuB;AACxD,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,MAAM,KAAK,QAAQ,MAAM;AAAA,EAAC;AAChC,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cAA8B,EAAE,QAAQ,KAAK,aAAa,OAAO,kBAAkB,KAAM,IAAI;AAEnG,QAAM,kBAAkB,EAAE,MAAM,KAAK,iBAAiB,QAAQ,KAAK,cAAc;AAEjF,WAAS,mBAAmB,MAAwB;AAClD,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,OAAO,cAAc,kBAAkB,eAAe,CAAC;AAC/D,WAAO,iBAAiB,GAAG,SAAS,UAAU,IAAI,IAAI,OAAO;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,MAAM,MAAM,SAAS;AACnB,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,YAAM,eAAe,qBAAqB,IAAI,aAAa,IAAI,UAAU,GAAG,mBAAmB;AAC/F,YAAM,QAAQ,MAAM,qBAAqB,WAAW;AACpD,YAAM,SAAS,gBAAgB,KAAK,UAAU,EAAE,GAAG,OAAO,GAAG,aAAa,CAAC,GAAG;AAAA,QAC5E,GAAG;AAAA,QACH,eAAe;AAAA,MACjB,CAAC;AACD,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,OAAO,cAAc,MAAM;AACnC,aAAO,iBAAiB,KAAK,KAAK,aAAa,EAAE,OAAO,aAAa,KAAK,YAAY,CAAC,GAAG,OAAO;AAAA,IACnG;AAAA,IAEA,MAAM,SAAS,SAAS;AACtB,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,oBAAoB,IAAI,aAAa,IAAI,OAAO;AACtD,UAAI,CAAC,QAAQ,CAAC,kBAAmB,QAAO,mBAAmB,yBAAyB;AAEpF,YAAM,UAAU,wBAAwB,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ,GAAG,KAAK,eAAe,CAAC;AAC5G,UAAI,CAAC,WAAW,QAAQ,MAAM,kBAAmB,QAAO,mBAAmB,uBAAuB;AAClG,UAAI,CAAE,MAAM,qBAAqB,QAAQ,GAAG,WAAW,EAAI,QAAO,mBAAmB,uBAAuB;AAE5G,UAAI;AACJ,UAAI;AACF,oBAAY,MAAM,KAAK,KAAK,SAAS,IAAI;AAAA,MAC3C,SAAS,KAAK;AACZ,YAAI,gCAAgC,GAAG;AACvC,eAAO,mBAAmB,wBAAwB;AAAA,MACpD;AAEA,UAAI;AACJ,UAAI;AACF;AAAC,SAAC,EAAE,OAAO,IAAI,MAAM,KAAK,MAAM,kBAAkB;AAAA,UAChD,OAAO,UAAU,KAAK;AAAA,UACtB,MAAM,UAAU,KAAK,QAAQ;AAAA,UAC7B,cAAc,UAAU,KAAK;AAAA,QAC/B,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,YAAI,eAAe,yBAA0B,QAAO,mBAAmB,2BAA2B;AAClG,cAAM;AAAA,MACR;AAEA,YAAM,YAAY,IAAI,KAAK,IAAI,IAAI,oBAAoB,GAAI;AAC3D,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,cAAc;AAAA,QAC/C;AAAA,QACA;AAAA,QACA,WAAW,SAAS,OAAO;AAAA,QAC3B,WAAW,QAAQ,QAAQ,IAAI,YAAY;AAAA,MAC7C,CAAC;AAED,YAAM,KAAK,MAAM,eAAe;AAAA,QAC9B;AAAA,QACA,cAAc;AAAA,QACd,cAAc,UAAU,KAAK;AAAA,QAC7B,OAAO,UAAU,KAAK;AAAA,QACtB,MAAM,UAAU,KAAK,QAAQ;AAAA,QAC7B,QAAQ,UAAU;AAAA,QAClB,UAAU,UAAU,MAAM,QAAQ;AAAA,MACpC,CAAC;AAED,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,OAAO,cAAc,kBAAkB,eAAe,CAAC;AAC/D,YAAM,iBAAiB,MAAM,mBAAmB;AAAA,QAC9C;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,UAAU,eAAgB,SAAQ,OAAO,cAAc,MAAM;AACxE,aAAO,iBAAiB,qBAAqB,QAAQ,GAAG,mBAAmB,GAAG,OAAO;AAAA,IACvF;AAAA,EACF;AACF;;;ACjcO,SAAS,gBAAyB,MAAqD;AAC5F,QAAM,YAAY,KAAK,aAAa;AAEpC,iBAAe,eAAe,SAAkB,IAA+B,CAAC,GAAqB;AACnG,UAAM,UAAU,MAAM,KAAK,WAAW,OAAO;AAC7C,QAAI,CAAC,SAAS;AACZ,UAAI,EAAE,aAAa;AACjB,cAAM,SAAS,KAAK,EAAE,OAAO,gBAAgB,MAAM,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC9F;AACA,YAAM,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,UAAU,EAAE,CAAC;AAAA,IAC5E;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,CAAC,YAAY,eAAe,OAAO;AAAA,IAChD,gBAAgB,CAAC,YAAY,eAAe,SAAS,EAAE,aAAa,KAAK,CAAC;AAAA,IAC1E,oBAAoB,OAAO,YAAa,MAAM,KAAK,WAAW,OAAO,KAAM;AAAA,EAC7E;AACF;AAGO,SAAS,iBAAiB,KAA0C;AACzE,UAAQ,OAAO,IACZ,MAAM,QAAQ,EACd,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EACjC,OAAO,OAAO;AACnB;AAWO,SAAS,iBAA0B,MAA0E;AAClH,SAAO,OAAO,YAAY;AACxB,UAAM,UAAU,MAAM,KAAK,YAAY,OAAO;AAC9C,UAAM,UAAU,KAAK,cAAc;AACnC,QAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AACzE,UAAM,SAAS,KAAK,QAAQ,OAAO,KAAK,IAAI,YAAY;AACxD,QAAI,CAAC,QAAQ,SAAS,KAAK,EAAG,OAAM,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAC7E,WAAO;AAAA,EACT;AACF;AAwBO,SAAS,sBAAsB,OAA6B,OAAqC,CAAC,GAAS;AAChH,MAAI,mCAAmC,EAAE,KAAK,KAAK,KAAK,mBAAmB,KAAK,kBAAkB,CAAC,EAAG;AACtG,MAAI,MAAM,kBAAkB,MAAM,sBAAsB,EAAG;AAE3D,QAAM,SAAS;AAAA,IACb;AAAA,MACE,GAAG,KAAK;AAAA,MACR,OAAO,KAAK,gBAAgB;AAAA,MAC5B,MAAM;AAAA,IACR;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;","names":[]}
+{"version":3,"sources":["../src/platform/sso.ts","../src/platform/guards.ts"],"sourcesContent":["/**\n * Cross-site Tangle SSO for agent apps: signed-state CSRF cookies plus the\n * full start/callback orchestration against the platform's /cross-site\n * bridge. The platform wire client and account persistence are structural\n * seams (`TangleSsoAuthClient` / `TangleSsoAccountStore`), so this module\n * never imports agent-runtime, an auth framework, or a database driver.\n * WebCrypto only — runs in workerd without node compatibility flags.\n */\n\nimport { clearCookieHeader, readCookieValue, serializeCookie } from '../web/index'\n\nconst DEFAULT_STATE_TTL_SECONDS = 600\nconst DEFAULT_SESSION_TTL_SECONDS = 60 * 60 * 24 * 7\nconst DEFAULT_REDIRECT_PATH = '/app'\nconst DEFAULT_LOGIN_PATH = '/login'\nconst DEFAULT_SESSION_COOKIE = 'better-auth.session_token'\n\n// ── Signed state ────────────────────────────────────────────────────────────\n\nexport interface SsoStateConfig {\n  /** HMAC-SHA256 secret (e.g. the app's auth secret). */\n  secret: string\n  /** State lifetime in ms. Default 600 000. */\n  ttlMs?: number\n  /** Injectable clock (ms since epoch). Default Date.now. */\n  now?: () => number\n}\n\nfunction randomHex(bytes: number): string {\n  const buf = new Uint8Array(bytes)\n  crypto.getRandomValues(buf)\n  return Array.from(buf, (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nasync function hmacBytes(secret: string, value: string): Promise<Uint8Array> {\n  const key = await crypto.subtle.importKey(\n    'raw',\n    new TextEncoder().encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  return new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(value)))\n}\n\nasync function hmacHex(secret: string, value: string): Promise<string> {\n  return Array.from(await hmacBytes(secret, value), (b) => b.toString(16).padStart(2, '0')).join('')\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return diff === 0\n}\n\n/** Mint a `<randomHex32>.<timestamp36>.<hmacHex>` state value. The timestamp\n *  is inside the signed payload, so expiry survives cookie-attribute tampering. */\nexport async function createSignedSsoState(config: SsoStateConfig): Promise<string> {\n  if (!config.secret) throw new Error('SsoStateConfig.secret is required')\n  const now = config.now ?? Date.now\n  const payload = `${randomHex(16)}.${now().toString(36)}`\n  return `${payload}.${await hmacHex(config.secret, payload)}`\n}\n\n/** Verify the MAC (constant-time) and the signed TTL. */\nexport async function verifySignedSsoState(state: string, config: SsoStateConfig): Promise<boolean> {\n  if (!config.secret) throw new Error('SsoStateConfig.secret is required')\n  const parts = state.split('.')\n  if (parts.length !== 3) return false\n  const [random, timestamp, mac] = parts\n  if (!random || !timestamp || !mac) return false\n  const expected = await hmacHex(config.secret, `${random}.${timestamp}`)\n  if (!constantTimeEqual(mac, expected)) return false\n  const mintedAt = parseInt(timestamp, 36)\n  if (!Number.isFinite(mintedAt)) return false\n  const now = config.now ?? Date.now\n  const ttlMs = config.ttlMs ?? DEFAULT_STATE_TTL_SECONDS * 1000\n  return now() - mintedAt <= ttlMs\n}\n\n// ── Seams ───────────────────────────────────────────────────────────────────\n\nexport interface TangleSsoExchangeResult {\n  apiKey: string\n  user: { id: string; email: string; name?: string | null }\n  plan?: { tier: string } | null\n}\n\n/** Structural mirror of the platform auth wire client — any object with these\n *  two methods satisfies it without this module importing the concrete class. */\nexport interface TangleSsoAuthClient {\n  authorizeUrl(options: { state: string; redirectUri?: string }): string\n  exchange(code: string): Promise<TangleSsoExchangeResult>\n}\n\n/** Thrown by `upsertUserByEmail` when the app-local user row cannot be\n *  created; the callback handler maps it to `?error=tangle_user_create_failed`.\n *  Any other store error propagates. */\nexport class TangleSsoUserCreateError extends Error {\n  constructor(message = 'Failed to create local user for Tangle SSO') {\n    super(message)\n    this.name = 'TangleSsoUserCreateError'\n  }\n}\n\n/**\n * Account persistence seam. Covers both storage styles in use: link-table\n * apps (a per-user platform-link row) and session-column apps (the key on the\n * session row) — `saveTangleLink` receives both `userId` and `sessionToken`,\n * and each app persists with the key it needs. `createSession` runs first so\n * the token is always available to `saveTangleLink`.\n */\nexport interface TangleSsoAccountStore {\n  /** Find-or-create the app-local user. `tangleUserId` is the platform's\n   *  stable user id — match on it first when the app stores it (emails are\n   *  mutable on the platform; the id is not), falling back to email for\n   *  first-time logins. */\n  upsertUserByEmail(input: { email: string; name: string | null; tangleUserId: string }): Promise<{ userId: string }>\n  /** Create an app session row; returns the session-cookie token value. */\n  createSession(input: {\n    userId: string\n    expiresAt: Date\n    ipAddress: string | null\n    userAgent: string | null\n  }): Promise<{ token: string }>\n  /** Persist the platform link (API key + platform identity). */\n  saveTangleLink(input: {\n    userId: string\n    sessionToken: string\n    tangleUserId: string\n    email: string\n    name: string | null\n    apiKey: string\n    planTier: string | null\n  }): Promise<void>\n}\n\n// ── Session cookie ──────────────────────────────────────────────────────────\n\n/** Successful-login context handed to the `setSessionCookie` seam. */\nexport interface TangleSsoSessionCookieArgs {\n  /** Session token returned by `store.createSession`. */\n  token: string\n  /** Session expiry (now + `sessionTtlSeconds`). */\n  expiresAt: Date\n  /** Mirrors `sessionTtlSeconds` after defaulting. */\n  ttlSeconds: number\n  /** Mirrors `TangleSsoHandlerOptions.secureCookies`. */\n  secure: boolean\n}\n\n/**\n * Sign a session token to better-call's signed-cookie contract — the value\n * better-auth's `getSignedCookie` verifies: `<token>.<signature>` where the\n * signature is the raw HMAC-SHA256 of the token under `secret`, encoded as\n * STANDARD base64 WITH padding (32 bytes → 44 chars ending `=`; better-call\n * rejects any other length or suffix, so url-safe/unpadded variants read back\n * as a null session). The joined value is percent-encoded once at cookie\n * serialization, matching better-call's `serializeSignedCookie` byte-exactly.\n */\nexport async function signSessionCookieValue(token: string, secret: string): Promise<string> {\n  if (!secret) throw new Error('signSessionCookieValue requires a non-empty secret')\n  const sig = await hmacBytes(secret, token)\n  let bin = ''\n  for (const byte of sig) bin += String.fromCharCode(byte)\n  return `${token}.${btoa(bin)}`\n}\n\n/** Structural slice of a `betterAuth()` instance — only what cookie minting\n *  reads. No better-auth import: the signing contract is implemented by\n *  `signSessionCookieValue`, byte-compatible with better-auth's own\n *  `makeSignature`. */\nexport interface BetterAuthSessionCookieSource {\n  $context: PromiseLike<{\n    secret: string\n    authCookies: {\n      sessionToken: {\n        /** Final cookie name — better-auth decides the `__Secure-` prefix\n         *  (and any `advanced.cookiePrefix`) once at `betterAuth()` init. */\n        name: string\n        attributes: {\n          secure?: boolean\n          sameSite?: string\n          path?: string\n          httpOnly?: boolean\n          domain?: string\n        }\n      }\n    }\n  }>\n}\n\nexport interface BetterAuthSessionCookieMinterOptions {\n  /** Receives the shadowed-cookie-name warning (see below). Default\n   *  console.warn. */\n  warn?: (message: string) => void\n}\n\n/**\n * Canonical `setSessionCookie` wiring for better-auth apps: mint the session\n * Set-Cookie exactly as better-auth's own login flows do — name + attributes\n * from `auth.$context.authCookies.sessionToken` (better-auth stays\n * authoritative over prefix/name/attributes) and the value signed to\n * better-call's `getSignedCookie` contract. A raw unprefixed\n * `better-auth.session_token` left by an earlier login is explicitly expired\n * so it cannot shadow the real cookie.\n *\n * Warns when the app's session cookie still has better-auth's DEFAULT name:\n * the Tangle platform (id.tangle.tools) sets a `Domain=.tangle.tools` cookie\n * under that exact name, and equal-path cookies are sent oldest-first — the\n * platform's cookie is always older (the user signs in there before the app's\n * callback runs), so the app reads the platform's token, fails its own\n * signature check, and every fresh login lands logged-out. Per-app\n * `advanced.cookiePrefix` is the fix.\n *\n * Throws on a domain-scoped session cookie for the same reason: a\n * `Domain=`-wide session cookie is exactly the shadowing footgun.\n */\nexport function createBetterAuthSessionCookieMinter(\n  auth: BetterAuthSessionCookieSource,\n  options: BetterAuthSessionCookieMinterOptions = {},\n): (args: TangleSsoSessionCookieArgs) => Promise<string[]> {\n  const warn = options.warn ?? ((message: string) => console.warn(message))\n  return async ({ token, ttlSeconds }) => {\n    const ctx = await auth.$context\n    if (!ctx.secret) {\n      throw new Error('createBetterAuthSessionCookieMinter: auth context has no secret')\n    }\n    const { name, attributes } = ctx.authCookies.sessionToken\n    if (attributes.domain) {\n      throw new Error(\n        `createBetterAuthSessionCookieMinter: refusing a domain-scoped session cookie (Domain=${attributes.domain}) — ` +\n          'a domain-wide session cookie shadows sibling apps that share the parent domain',\n      )\n    }\n    if (name === DEFAULT_SESSION_COOKIE || name === `__Secure-${DEFAULT_SESSION_COOKIE}`) {\n      warn(\n        `[tangle-sso] session cookie is named \"${name}\" — better-auth's default. ` +\n          'The Tangle platform (id.tangle.tools) sets a Domain=.tangle.tools cookie under the same name, ' +\n          \"and the platform's (older) cookie wins the Cookie-header order, so this app's sessions read back null. \" +\n          \"Set a per-app prefix: betterAuth({ advanced: { cookiePrefix: '<app>' } }).\",\n      )\n    }\n    const sameSite = typeof attributes.sameSite === 'string' ? attributes.sameSite : 'lax'\n    const cookieOptions = {\n      name,\n      path: typeof attributes.path === 'string' ? attributes.path : '/',\n      httpOnly: attributes.httpOnly !== false,\n      sameSite: (sameSite.charAt(0).toUpperCase() + sameSite.slice(1)) as 'Lax' | 'Strict' | 'None',\n      secure: Boolean(attributes.secure) || name.startsWith('__Secure-'),\n      maxAgeSeconds: ttlSeconds,\n    }\n    const cookies = [serializeCookie(await signSessionCookieValue(token, ctx.secret), cookieOptions)]\n    if (name !== DEFAULT_SESSION_COOKIE) {\n      cookies.push(clearCookieHeader({ ...cookieOptions, name: DEFAULT_SESSION_COOKIE }))\n    }\n    return cookies\n  }\n}\n\n// ── Handlers ────────────────────────────────────────────────────────────────\n\nexport interface TangleSsoHandlerOptions {\n  auth: TangleSsoAuthClient\n  store: TangleSsoAccountStore\n  /** HMAC secret for the state cookie. */\n  stateSecret: string\n  /** Absolute callback URL registered with the platform. */\n  callbackUrl: string\n  stateCookieName: string\n  /** Default 'better-auth.session_token'. Ignored when `setSessionCookie` is\n   *  provided. The default path prepends `__Secure-` iff `secureCookies`. */\n  sessionCookieName?: string\n  /** Mint the host auth framework's own session cookie(s); return complete\n   *  Set-Cookie header values (the handler appends them verbatim and sets no\n   *  session cookie itself). Supply this when the framework should stay\n   *  authoritative over name/prefix/signing/attributes — e.g. better-auth:\n   *  `auth.$context.authCookies.sessionToken` + `makeSignature`. */\n  setSessionCookie?: (\n    args: TangleSsoSessionCookieArgs,\n  ) => readonly string[] | Promise<readonly string[]>\n  /** HMAC-SHA256 secret the host auth framework verifies session cookies with\n   *  (better-auth: its `secret`). Required when `setSessionCookie` is absent —\n   *  the default cookie is minted to better-call's signed contract via\n   *  `signSessionCookieValue`; an unsigned or mis-signed value reads back as a\n   *  null session, so there is deliberately no fallback to `stateSecret`\n   *  (which is not guaranteed to be the auth secret). */\n  sessionCookieSecret?: string\n  /** Adds `Secure` to every cookie this module sets, and (default session\n   *  cookie only) the `__Secure-` name prefix. Must match the auth\n   *  framework's own secure-cookie decision (better-auth: https `baseURL` /\n   *  `advanced.useSecureCookies`), or it will look up a different cookie name\n   *  than the one set here. */\n  secureCookies: boolean\n  /** Default 604 800 (7 days). */\n  sessionTtlSeconds?: number\n  /** Default 600. Applies to both the cookie Max-Age and the signed TTL. */\n  stateTtlSeconds?: number\n  /** Default '/app'. */\n  defaultRedirectPath?: string\n  /** Default '/login'. */\n  loginPath?: string\n  /** Failure log hook (e.g. console.error). Default no-op. */\n  log?: (message: string, error?: unknown) => void\n  now?: () => number\n}\n\nexport interface TangleSsoHandlers {\n  /** GET start route: mint + sign state, set the state cookie, 302 to the\n   *  platform authorize URL. `?redirect=` carries the post-login path. */\n  start(request: Request): Promise<Response>\n  /** GET callback route: verify state, exchange the code, upsert the user,\n   *  create the session, save the platform link, set the session cookie\n   *  (via the `setSessionCookie` seam, else signed to better-call's contract\n   *  with `sessionCookieSecret`), 302 to the saved redirect. Every failure\n   *  302s to `loginPath?error=…` with the state cookie cleared. */\n  callback(request: Request): Promise<Response>\n}\n\n/** Accept only same-origin absolute paths (rejects `//host` protocol-relative URLs). */\nfunction sanitizeRedirectPath(value: string | null, fallback: string): string {\n  if (value && value.startsWith('/') && !value.startsWith('//')) return value\n  return fallback\n}\n\nfunction redirectResponse(location: string, headers = new Headers()): Response {\n  headers.set('Location', location)\n  return new Response(null, { status: 302, headers })\n}\n\n/** Real client IP: `CF-Connecting-IP` behind Cloudflare, else the first\n *  `x-forwarded-for` hop (the rest of the list is sender-controlled). */\nfunction clientIp(request: Request): string | null {\n  return (\n    request.headers.get('CF-Connecting-IP') ??\n    request.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ??\n    null\n  )\n}\n\ninterface StateCookiePayload {\n  s: string\n  r: string\n}\n\nfunction parseStateCookiePayload(raw: string | null): StateCookiePayload | null {\n  if (!raw) return null\n  try {\n    const parsed = JSON.parse(raw) as unknown\n    if (parsed === null || typeof parsed !== 'object') return null\n    const { s, r } = parsed as Record<string, unknown>\n    if (typeof s !== 'string' || typeof r !== 'string') return null\n    return { s, r }\n  } catch {\n    return null\n  }\n}\n\nexport function createTangleSsoHandlers(opts: TangleSsoHandlerOptions): TangleSsoHandlers {\n  if (!opts.stateSecret) throw new Error('TangleSsoHandlerOptions.stateSecret is required')\n  if (!opts.callbackUrl) throw new Error('TangleSsoHandlerOptions.callbackUrl is required')\n  if (!opts.stateCookieName) throw new Error('TangleSsoHandlerOptions.stateCookieName is required')\n\n  const sessionCookieName = opts.sessionCookieName ?? DEFAULT_SESSION_COOKIE\n\n  let mintSessionCookies: (args: TangleSsoSessionCookieArgs) => Promise<readonly string[]>\n  if (opts.setSessionCookie) {\n    const seam = opts.setSessionCookie\n    mintSessionCookies = async (args) => await seam(args)\n  } else if (opts.sessionCookieSecret) {\n    const secret = opts.sessionCookieSecret\n    mintSessionCookies = async ({ token, secure, ttlSeconds }) => [\n      serializeCookie(await signSessionCookieValue(token, secret), {\n        name: secure ? `__Secure-${sessionCookieName}` : sessionCookieName,\n        secure,\n        maxAgeSeconds: ttlSeconds,\n      }),\n    ]\n  } else {\n    throw new Error(\n      'TangleSsoHandlerOptions requires setSessionCookie or sessionCookieSecret: ' +\n        'better-auth only accepts HMAC-signed (and, on https, __Secure--prefixed) session cookies, ' +\n        'so an unsigned default would mint sessions that read back null',\n    )\n  }\n  const sessionTtlSeconds = opts.sessionTtlSeconds ?? DEFAULT_SESSION_TTL_SECONDS\n  const stateTtlSeconds = opts.stateTtlSeconds ?? DEFAULT_STATE_TTL_SECONDS\n  const defaultRedirectPath = opts.defaultRedirectPath ?? DEFAULT_REDIRECT_PATH\n  const loginPath = opts.loginPath ?? DEFAULT_LOGIN_PATH\n  const log = opts.log ?? (() => {})\n  const now = opts.now ?? Date.now\n  const stateConfig: SsoStateConfig = { secret: opts.stateSecret, ttlMs: stateTtlSeconds * 1000, now }\n\n  const stateCookieOpts = { name: opts.stateCookieName, secure: opts.secureCookies }\n\n  function loginErrorRedirect(code: string): Response {\n    const headers = new Headers()\n    headers.append('Set-Cookie', clearCookieHeader(stateCookieOpts))\n    return redirectResponse(`${loginPath}?error=${code}`, headers)\n  }\n\n  return {\n    async start(request) {\n      const url = new URL(request.url)\n      const redirectPath = sanitizeRedirectPath(url.searchParams.get('redirect'), defaultRedirectPath)\n      const state = await createSignedSsoState(stateConfig)\n      const cookie = serializeCookie(JSON.stringify({ s: state, r: redirectPath }), {\n        ...stateCookieOpts,\n        maxAgeSeconds: stateTtlSeconds,\n      })\n      const headers = new Headers()\n      headers.append('Set-Cookie', cookie)\n      return redirectResponse(opts.auth.authorizeUrl({ state, redirectUri: opts.callbackUrl }), headers)\n    },\n\n    async callback(request) {\n      const url = new URL(request.url)\n      const code = url.searchParams.get('code')\n      const stateFromPlatform = url.searchParams.get('state')\n      if (!code || !stateFromPlatform) return loginErrorRedirect('tangle_callback_missing')\n\n      const payload = parseStateCookiePayload(readCookieValue(request.headers.get('cookie'), opts.stateCookieName))\n      if (!payload || payload.s !== stateFromPlatform) return loginErrorRedirect('tangle_state_mismatch')\n      if (!(await verifySignedSsoState(payload.s, stateConfig))) return loginErrorRedirect('tangle_state_mismatch')\n\n      let exchanged: TangleSsoExchangeResult\n      try {\n        exchanged = await opts.auth.exchange(code)\n      } catch (err) {\n        log('[tangle-sso] exchange failed', err)\n        return loginErrorRedirect('tangle_exchange_failed')\n      }\n\n      let userId: string\n      try {\n        ;({ userId } = await opts.store.upsertUserByEmail({\n          email: exchanged.user.email,\n          name: exchanged.user.name ?? null,\n          tangleUserId: exchanged.user.id,\n        }))\n      } catch (err) {\n        if (err instanceof TangleSsoUserCreateError) return loginErrorRedirect('tangle_user_create_failed')\n        throw err\n      }\n\n      const expiresAt = new Date(now() + sessionTtlSeconds * 1000)\n      const { token } = await opts.store.createSession({\n        userId,\n        expiresAt,\n        ipAddress: clientIp(request),\n        userAgent: request.headers.get('user-agent'),\n      })\n\n      await opts.store.saveTangleLink({\n        userId,\n        sessionToken: token,\n        tangleUserId: exchanged.user.id,\n        email: exchanged.user.email,\n        name: exchanged.user.name ?? null,\n        apiKey: exchanged.apiKey,\n        planTier: exchanged.plan?.tier ?? null,\n      })\n\n      const headers = new Headers()\n      headers.append('Set-Cookie', clearCookieHeader(stateCookieOpts))\n      const sessionCookies = await mintSessionCookies({\n        token,\n        expiresAt,\n        ttlSeconds: sessionTtlSeconds,\n        secure: opts.secureCookies,\n      })\n      for (const cookie of sessionCookies) headers.append('Set-Cookie', cookie)\n      return redirectResponse(sanitizeRedirectPath(payload.r, defaultRedirectPath), headers)\n    },\n  }\n}\n","/**\n * Request guards for agent-app routes: session auth (302 redirect for pages,\n * JSON 401 for APIs), admin allowlisting (404 — the route stays invisible to\n * non-admins), and the billable-balance gate (402 with a stable code).\n * Session resolution is a seam; thrown Responses follow the router convention\n * of surfacing a thrown Response as the route result.\n */\n\nimport { isTangleBillingEnforcementDisabled } from '../runtime/model'\n\nexport interface AuthGuardOptions<Session> {\n  /** e.g. a better-auth `auth.api.getSession` wrapped by the app. */\n  getSession(request: Request): Promise<Session | null | undefined>\n  /** Default '/login'. */\n  loginPath?: string\n}\n\nexport interface AuthGuard<Session> {\n  /** Page guard — throws a 302 redirect Response to `loginPath`. */\n  requireUser(request: Request): Promise<Session>\n  /** API guard — throws JSON 401 `{ error: 'Unauthorized', code: 'auth.unauthenticated' }`. */\n  requireApiUser(request: Request): Promise<Session>\n  /** `apiResponse` selects the 401 JSON path over the redirect. */\n  requireSession(request: Request, opts?: { apiResponse?: boolean }): Promise<Session>\n  getOptionalSession(request: Request): Promise<Session | null>\n}\n\nexport function createAuthGuard<Session>(opts: AuthGuardOptions<Session>): AuthGuard<Session> {\n  const loginPath = opts.loginPath ?? '/login'\n\n  async function requireSession(request: Request, o: { apiResponse?: boolean } = {}): Promise<Session> {\n    const session = await opts.getSession(request)\n    if (!session) {\n      if (o.apiResponse) {\n        throw Response.json({ error: 'Unauthorized', code: 'auth.unauthenticated' }, { status: 401 })\n      }\n      throw new Response(null, { status: 302, headers: { Location: loginPath } })\n    }\n    return session\n  }\n\n  return {\n    requireSession,\n    requireUser: (request) => requireSession(request),\n    requireApiUser: (request) => requireSession(request, { apiResponse: true }),\n    getOptionalSession: async (request) => (await opts.getSession(request)) ?? null,\n  }\n}\n\nexport type GuardResolution<T> = { ok: true; value: T } | { ok: false; response: Response }\n\n/**\n * Adapt a guard that THROWS a Response (the quartet above — the router\n * convention) to the `{ok: true, value} | {ok: false, response}` resolution\n * shape the route factories take (`/chat-routes` `authorize`,\n * `/interactions` `resolveConnection`, `/chat-routes` upload `authorize`).\n * Every product wrote this try/catch by hand; it lives here once.\n */\nexport async function guardResolution<T>(run: () => Promise<T>): Promise<GuardResolution<T>> {\n  try {\n    return { ok: true, value: await run() }\n  } catch (err) {\n    if (err instanceof Response) return { ok: false, response: err }\n    throw err\n  }\n}\n\n/** Comma/whitespace separated → trimmed, lowercased, empties dropped. */\nexport function parseAdminEmails(raw: string | null | undefined): string[] {\n  return (raw ?? '')\n    .split(/[,\\s]+/)\n    .map((e) => e.trim().toLowerCase())\n    .filter(Boolean)\n}\n\nexport interface AdminGuardOptions<Session> {\n  requireUser(request: Request): Promise<Session>\n  emailOf(session: Session): string | null | undefined\n  /** Resolved per request; an EMPTY allowlist refuses everyone. */\n  allowedEmails(): string[]\n}\n\n/** Non-admins (and empty allowlists) get 404, keeping the route invisible —\n *  better than a \"forbidden\" footprint that advertises its existence. */\nexport function createAdminGuard<Session>(opts: AdminGuardOptions<Session>): (request: Request) => Promise<Session> {\n  return async (request) => {\n    const session = await opts.requireUser(request)\n    const allowed = opts.allowedEmails()\n    if (allowed.length === 0) throw new Response('Not found', { status: 404 })\n    const email = (opts.emailOf(session) ?? '').toLowerCase()\n    if (!allowed.includes(email)) throw new Response('Not found', { status: 404 })\n    return session\n  }\n}\n\nexport interface BillableBalanceState {\n  overageAllowed: boolean\n  remainingBalanceUsd: number\n}\n\nexport interface AssertBillableBalanceOptions {\n  env?: Record<string, string | undefined>\n  /** App-specific enforcement override flag (e.g. 'GTM_BILLING_ENFORCEMENT'),\n   *  fed to `isTangleBillingEnforcementDisabled`. */\n  enforcementEnvVar?: string\n  /** Default 'Add balance or upgrade your plan to invoke this agent.'. */\n  errorMessage?: string\n  /** Merged into the 402 JSON body (e.g. `{ organizationId }`). */\n  errorBody?: Record<string, unknown>\n}\n\n/**\n * Gate a billable turn: passes when enforcement is disabled (dev default),\n * the tier allows overage, or remaining balance is positive. Otherwise throws\n * a 402 Response with the stable `billing.balance_required` code so clients\n * can route to the billing screen.\n */\nexport function assertBillableBalance(state: BillableBalanceState, opts: AssertBillableBalanceOptions = {}): void {\n  if (isTangleBillingEnforcementDisabled({ env: opts.env, enforcementEnvVar: opts.enforcementEnvVar })) return\n  if (state.overageAllowed || state.remainingBalanceUsd > 0) return\n  // errorBody first: the stable error/code contract always wins over caller extras.\n  throw Response.json(\n    {\n      ...opts.errorBody,\n      error: opts.errorMessage ?? 'Add balance or upgrade your plan to invoke this agent.',\n      code: 'billing.balance_required',\n    },\n    { status: 402 },\n  )\n}\n"],"mappings":";;;;;;;;;;AAWA,IAAM,4BAA4B;AAClC,IAAM,8BAA8B,KAAK,KAAK,KAAK;AACnD,IAAM,wBAAwB;AAC9B,IAAM,qBAAqB;AAC3B,IAAM,yBAAyB;AAa/B,SAAS,UAAU,OAAuB;AACxC,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACxE;AAEA,eAAe,UAAU,QAAgB,OAAoC;AAC3E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,MAAM;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC,CAAC;AAC9F;AAEA,eAAe,QAAQ,QAAgB,OAAgC;AACrE,SAAO,MAAM,KAAK,MAAM,UAAU,QAAQ,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACnG;AAEA,SAAS,kBAAkB,GAAW,GAAoB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC3E,SAAO,SAAS;AAClB;AAIA,eAAsB,qBAAqB,QAAyC;AAClF,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AACvE,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,UAAU,GAAG,UAAU,EAAE,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;AACtD,SAAO,GAAG,OAAO,IAAI,MAAM,QAAQ,OAAO,QAAQ,OAAO,CAAC;AAC5D;AAGA,eAAsB,qBAAqB,OAAe,QAA0C;AAClG,MAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AACvE,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,CAAC,QAAQ,WAAW,GAAG,IAAI;AACjC,MAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAK,QAAO;AAC1C,QAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,GAAG,MAAM,IAAI,SAAS,EAAE;AACtE,MAAI,CAAC,kBAAkB,KAAK,QAAQ,EAAG,QAAO;AAC9C,QAAM,WAAW,SAAS,WAAW,EAAE;AACvC,MAAI,CAAC,OAAO,SAAS,QAAQ,EAAG,QAAO;AACvC,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,QAAQ,OAAO,SAAS,4BAA4B;AAC1D,SAAO,IAAI,IAAI,YAAY;AAC7B;AAoBO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EAClD,YAAY,UAAU,8CAA8C;AAClE,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAyDA,eAAsB,uBAAuB,OAAe,QAAiC;AAC3F,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,oDAAoD;AACjF,QAAM,MAAM,MAAM,UAAU,QAAQ,KAAK;AACzC,MAAI,MAAM;AACV,aAAW,QAAQ,IAAK,QAAO,OAAO,aAAa,IAAI;AACvD,SAAO,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC;AAC9B;AAoDO,SAAS,oCACd,MACA,UAAgD,CAAC,GACQ;AACzD,QAAM,OAAO,QAAQ,SAAS,CAAC,YAAoB,QAAQ,KAAK,OAAO;AACvE,SAAO,OAAO,EAAE,OAAO,WAAW,MAAM;AACtC,UAAM,MAAM,MAAM,KAAK;AACvB,QAAI,CAAC,IAAI,QAAQ;AACf,YAAM,IAAI,MAAM,iEAAiE;AAAA,IACnF;AACA,UAAM,EAAE,MAAM,WAAW,IAAI,IAAI,YAAY;AAC7C,QAAI,WAAW,QAAQ;AACrB,YAAM,IAAI;AAAA,QACR,wFAAwF,WAAW,MAAM;AAAA,MAE3G;AAAA,IACF;AACA,QAAI,SAAS,0BAA0B,SAAS,YAAY,sBAAsB,IAAI;AACpF;AAAA,QACE,yCAAyC,IAAI;AAAA,MAI/C;AAAA,IACF;AACA,UAAM,WAAW,OAAO,WAAW,aAAa,WAAW,WAAW,WAAW;AACjF,UAAM,gBAAgB;AAAA,MACpB;AAAA,MACA,MAAM,OAAO,WAAW,SAAS,WAAW,WAAW,OAAO;AAAA,MAC9D,UAAU,WAAW,aAAa;AAAA,MAClC,UAAW,SAAS,OAAO,CAAC,EAAE,YAAY,IAAI,SAAS,MAAM,CAAC;AAAA,MAC9D,QAAQ,QAAQ,WAAW,MAAM,KAAK,KAAK,WAAW,WAAW;AAAA,MACjE,eAAe;AAAA,IACjB;AACA,UAAM,UAAU,CAAC,gBAAgB,MAAM,uBAAuB,OAAO,IAAI,MAAM,GAAG,aAAa,CAAC;AAChG,QAAI,SAAS,wBAAwB;AACnC,cAAQ,KAAK,kBAAkB,EAAE,GAAG,eAAe,MAAM,uBAAuB,CAAC,CAAC;AAAA,IACpF;AACA,WAAO;AAAA,EACT;AACF;AA8DA,SAAS,qBAAqB,OAAsB,UAA0B;AAC5E,MAAI,SAAS,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,EAAG,QAAO;AACtE,SAAO;AACT;AAEA,SAAS,iBAAiB,UAAkB,UAAU,IAAI,QAAQ,GAAa;AAC7E,UAAQ,IAAI,YAAY,QAAQ;AAChC,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AACpD;AAIA,SAAS,SAAS,SAAiC;AACjD,SACE,QAAQ,QAAQ,IAAI,kBAAkB,KACtC,QAAQ,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,KAC5D;AAEJ;AAOA,SAAS,wBAAwB,KAA+C;AAC9E,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,WAAW,QAAQ,OAAO,WAAW,SAAU,QAAO;AAC1D,UAAM,EAAE,GAAG,EAAE,IAAI;AACjB,QAAI,OAAO,MAAM,YAAY,OAAO,MAAM,SAAU,QAAO;AAC3D,WAAO,EAAE,GAAG,EAAE;AAAA,EAChB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,wBAAwB,MAAkD;AACxF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,iDAAiD;AACxF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM,iDAAiD;AACxF,MAAI,CAAC,KAAK,gBAAiB,OAAM,IAAI,MAAM,qDAAqD;AAEhG,QAAM,oBAAoB,KAAK,qBAAqB;AAEpD,MAAI;AACJ,MAAI,KAAK,kBAAkB;AACzB,UAAM,OAAO,KAAK;AAClB,yBAAqB,OAAO,SAAS,MAAM,KAAK,IAAI;AAAA,EACtD,WAAW,KAAK,qBAAqB;AACnC,UAAM,SAAS,KAAK;AACpB,yBAAqB,OAAO,EAAE,OAAO,QAAQ,WAAW,MAAM;AAAA,MAC5D,gBAAgB,MAAM,uBAAuB,OAAO,MAAM,GAAG;AAAA,QAC3D,MAAM,SAAS,YAAY,iBAAiB,KAAK;AAAA,QACjD;AAAA,QACA,eAAe;AAAA,MACjB,CAAC;AAAA,IACH;AAAA,EACF,OAAO;AACL,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,QAAM,oBAAoB,KAAK,qBAAqB;AACpD,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,QAAM,sBAAsB,KAAK,uBAAuB;AACxD,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,MAAM,KAAK,QAAQ,MAAM;AAAA,EAAC;AAChC,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,cAA8B,EAAE,QAAQ,KAAK,aAAa,OAAO,kBAAkB,KAAM,IAAI;AAEnG,QAAM,kBAAkB,EAAE,MAAM,KAAK,iBAAiB,QAAQ,KAAK,cAAc;AAEjF,WAAS,mBAAmB,MAAwB;AAClD,UAAM,UAAU,IAAI,QAAQ;AAC5B,YAAQ,OAAO,cAAc,kBAAkB,eAAe,CAAC;AAC/D,WAAO,iBAAiB,GAAG,SAAS,UAAU,IAAI,IAAI,OAAO;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,MAAM,MAAM,SAAS;AACnB,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,YAAM,eAAe,qBAAqB,IAAI,aAAa,IAAI,UAAU,GAAG,mBAAmB;AAC/F,YAAM,QAAQ,MAAM,qBAAqB,WAAW;AACpD,YAAM,SAAS,gBAAgB,KAAK,UAAU,EAAE,GAAG,OAAO,GAAG,aAAa,CAAC,GAAG;AAAA,QAC5E,GAAG;AAAA,QACH,eAAe;AAAA,MACjB,CAAC;AACD,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,OAAO,cAAc,MAAM;AACnC,aAAO,iBAAiB,KAAK,KAAK,aAAa,EAAE,OAAO,aAAa,KAAK,YAAY,CAAC,GAAG,OAAO;AAAA,IACnG;AAAA,IAEA,MAAM,SAAS,SAAS;AACtB,YAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,oBAAoB,IAAI,aAAa,IAAI,OAAO;AACtD,UAAI,CAAC,QAAQ,CAAC,kBAAmB,QAAO,mBAAmB,yBAAyB;AAEpF,YAAM,UAAU,wBAAwB,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ,GAAG,KAAK,eAAe,CAAC;AAC5G,UAAI,CAAC,WAAW,QAAQ,MAAM,kBAAmB,QAAO,mBAAmB,uBAAuB;AAClG,UAAI,CAAE,MAAM,qBAAqB,QAAQ,GAAG,WAAW,EAAI,QAAO,mBAAmB,uBAAuB;AAE5G,UAAI;AACJ,UAAI;AACF,oBAAY,MAAM,KAAK,KAAK,SAAS,IAAI;AAAA,MAC3C,SAAS,KAAK;AACZ,YAAI,gCAAgC,GAAG;AACvC,eAAO,mBAAmB,wBAAwB;AAAA,MACpD;AAEA,UAAI;AACJ,UAAI;AACF;AAAC,SAAC,EAAE,OAAO,IAAI,MAAM,KAAK,MAAM,kBAAkB;AAAA,UAChD,OAAO,UAAU,KAAK;AAAA,UACtB,MAAM,UAAU,KAAK,QAAQ;AAAA,UAC7B,cAAc,UAAU,KAAK;AAAA,QAC/B,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,YAAI,eAAe,yBAA0B,QAAO,mBAAmB,2BAA2B;AAClG,cAAM;AAAA,MACR;AAEA,YAAM,YAAY,IAAI,KAAK,IAAI,IAAI,oBAAoB,GAAI;AAC3D,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,cAAc;AAAA,QAC/C;AAAA,QACA;AAAA,QACA,WAAW,SAAS,OAAO;AAAA,QAC3B,WAAW,QAAQ,QAAQ,IAAI,YAAY;AAAA,MAC7C,CAAC;AAED,YAAM,KAAK,MAAM,eAAe;AAAA,QAC9B;AAAA,QACA,cAAc;AAAA,QACd,cAAc,UAAU,KAAK;AAAA,QAC7B,OAAO,UAAU,KAAK;AAAA,QACtB,MAAM,UAAU,KAAK,QAAQ;AAAA,QAC7B,QAAQ,UAAU;AAAA,QAClB,UAAU,UAAU,MAAM,QAAQ;AAAA,MACpC,CAAC;AAED,YAAM,UAAU,IAAI,QAAQ;AAC5B,cAAQ,OAAO,cAAc,kBAAkB,eAAe,CAAC;AAC/D,YAAM,iBAAiB,MAAM,mBAAmB;AAAA,QAC9C;AAAA,QACA;AAAA,QACA,YAAY;AAAA,QACZ,QAAQ,KAAK;AAAA,MACf,CAAC;AACD,iBAAW,UAAU,eAAgB,SAAQ,OAAO,cAAc,MAAM;AACxE,aAAO,iBAAiB,qBAAqB,QAAQ,GAAG,mBAAmB,GAAG,OAAO;AAAA,IACvF;AAAA,EACF;AACF;;;ACjcO,SAAS,gBAAyB,MAAqD;AAC5F,QAAM,YAAY,KAAK,aAAa;AAEpC,iBAAe,eAAe,SAAkB,IAA+B,CAAC,GAAqB;AACnG,UAAM,UAAU,MAAM,KAAK,WAAW,OAAO;AAC7C,QAAI,CAAC,SAAS;AACZ,UAAI,EAAE,aAAa;AACjB,cAAM,SAAS,KAAK,EAAE,OAAO,gBAAgB,MAAM,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC9F;AACA,YAAM,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,UAAU,EAAE,CAAC;AAAA,IAC5E;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,CAAC,YAAY,eAAe,OAAO;AAAA,IAChD,gBAAgB,CAAC,YAAY,eAAe,SAAS,EAAE,aAAa,KAAK,CAAC;AAAA,IAC1E,oBAAoB,OAAO,YAAa,MAAM,KAAK,WAAW,OAAO,KAAM;AAAA,EAC7E;AACF;AAWA,eAAsB,gBAAmB,KAAoD;AAC3F,MAAI;AACF,WAAO,EAAE,IAAI,MAAM,OAAO,MAAM,IAAI,EAAE;AAAA,EACxC,SAAS,KAAK;AACZ,QAAI,eAAe,SAAU,QAAO,EAAE,IAAI,OAAO,UAAU,IAAI;AAC/D,UAAM;AAAA,EACR;AACF;AAGO,SAAS,iBAAiB,KAA0C;AACzE,UAAQ,OAAO,IACZ,MAAM,QAAQ,EACd,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,EACjC,OAAO,OAAO;AACnB;AAWO,SAAS,iBAA0B,MAA0E;AAClH,SAAO,OAAO,YAAY;AACxB,UAAM,UAAU,MAAM,KAAK,YAAY,OAAO;AAC9C,UAAM,UAAU,KAAK,cAAc;AACnC,QAAI,QAAQ,WAAW,EAAG,OAAM,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AACzE,UAAM,SAAS,KAAK,QAAQ,OAAO,KAAK,IAAI,YAAY;AACxD,QAAI,CAAC,QAAQ,SAAS,KAAK,EAAG,OAAM,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAC7E,WAAO;AAAA,EACT;AACF;AAwBO,SAAS,sBAAsB,OAA6B,OAAqC,CAAC,GAAS;AAChH,MAAI,mCAAmC,EAAE,KAAK,KAAK,KAAK,mBAAmB,KAAK,kBAAkB,CAAC,EAAG;AACtG,MAAI,MAAM,kBAAkB,MAAM,sBAAsB,EAAG;AAE3D,QAAM,SAAS;AAAA,IACb;AAAA,MACE,GAAG,KAAK;AAAA,MACR,OAAO,KAAK,gBAAgB;AAAA,MAC5B,MAAM;AAAA,IACR;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;","names":[]}

package/dist/{chunk-U7DLCPJ6.js → chunk-Y4QHNQ75.js}

@@ -200,4 +200,4 @@ export {
   mapInteractionRespondFailure,
   createInteractionAnswerRoute
 };
-//# sourceMappingURL=chunk-U7DLCPJ6.js.map
+//# sourceMappingURL=chunk-Y4QHNQ75.js.map

package/dist/core-7qIM7svy.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Pure (drizzle-free) pieces of the chat store: thread-title derivation, the
+ * bulk-delete bound, and the typed input error. Split from `./schema`/`./store`
+ * so the root barrel can re-export them without dragging the optional
+ * drizzle-orm peer into every root-entry consumer.
+ */
+/** Bounds a single bulk-delete request's write set; product surfaces cap
+ *  thread lists at far fewer, so a larger batch is a malformed or hostile
+ *  request. (Lifted from legal's api.threads.bulk-delete route.) */
+declare const BULK_DELETE_MAX_THREADS = 200;
+/** Invalid caller input (missing/oversized ids, empty title). Products map it
+ *  to a 400; anything else out of the store is a real failure. */
+declare class ChatStoreInputError extends Error {
+    constructor(message: string);
+}
+/** Thread titles come from the first message — keep the list scannable by
+ *  storing only its first non-empty line, capped at 80 chars, never the whole
+ *  multi-page prompt. (Lifted verbatim from legal's chat.new route.) */
+declare function threadTitleFromMessage(message: string): string;
+
+export { BULK_DELETE_MAX_THREADS as B, ChatStoreInputError as C, threadTitleFromMessage as t };

package/dist/index.d.ts

@@ -14,7 +14,8 @@ export { DEFAULT_HARNESS, Harness, KNOWN_HARNESSES, ResolveSessionHarnessInput,
 export { AgentAppConfig, AgentIdentityConfig, AgentIntegrationsConfig, AgentKnowledgeConfig, AgentTaxonomyConfig, AgentUiConfig, KnowledgeLoopConfig, KnowledgeSourceSpec, agentAppConfigJsonSchema, defineAgentApp } from './config/index.js';
 export { D1Like, D1PreparedLike, DrizzleColumnLike, DrizzleSqliteCoreLike, PRESET_MIGRATION_SQL, PRESET_TABLES, PresetBillingOptions, PresetKnowledgeAccessorOptions, PresetToolHandlerOptions, VaultKv, createD1KnowledgeStateAccessor, createPresetDrizzleSchema, createPresetFieldCrypto, createPresetToolHandlers, createPresetWorkspaceKeyManager, createPresetWorkspaceKeyStore } from './preset-cloudflare/index.js';
 export { KeyCrypto, KeyProvisioner, PlanLimit, PlatformBalanceInfo, PlatformBalanceManager, PlatformBalanceManagerOptions, PlatformBillingClient, PlatformIdentity, PlatformProductUsage, SharedBillingState, TcloudKeyClient, WorkspaceKeyManager, WorkspaceKeyManagerOptions, WorkspaceKeyRecord, WorkspaceKeyStore, WorkspaceModelKeyUsage, createPlatformBalanceManager, createTcloudKeyProvisioner, createWorkspaceKeyManager } from './billing/index.js';
-export { B as BULK_DELETE_MAX_THREADS, C as ChatFilePart, a as ChatImagePart, b as ChatInteractionPart, c as ChatMessagePart, d as ChatNoticePart, e as ChatPartTime, f as ChatReasoningPart, g as ChatStepFinishPart, h as ChatStepStartPart, i as ChatStoreInputError, j as ChatSubtaskPart, k as ChatTextPart, l as ChatToolPart, m as ChatToolState, n as ChatToolStatus, o as ChatUsageTokens, S as StorableHarnessPartKind, p as isChatInteractionPart, q as isChatStepFinishPart, r as isChatTextPart, s as isChatToolPart, t as threadTitleFromMessage } from './parts-BeRnK54I.js';
+export { B as BULK_DELETE_MAX_THREADS, C as ChatStoreInputError, t as threadTitleFromMessage } from './core-7qIM7svy.js';
+export { C as ChatFilePart, a as ChatImagePart, b as ChatInteractionPart, c as ChatMessagePart, d as ChatNoticePart, e as ChatPartTime, f as ChatReasoningPart, g as ChatStepFinishPart, h as ChatStepStartPart, i as ChatSubtaskPart, j as ChatTextPart, k as ChatToolPart, l as ChatToolState, m as ChatToolStatus, n as ChatUsageTokens, S as StorableHarnessPartKind, o as isChatInteractionPart, p as isChatStepFinishPart, q as isChatTextPart, r as isChatToolPart, t as toChatMessageParts } from './parts-BcbitSNp.js';
 export { DeriveKeyOptions, createFieldCrypto, decodeHexKey, decryptAesGcm, decryptBytes, decryptWithKey, deriveKey, encryptAesGcm, encryptBytes, encryptWithKey } from './crypto/index.js';
 export { BufferedTurnEvent, BufferedTurnOptions, BufferedTurnTap, D1LikeForTurns, JsonRecord, PersistedChatMessageForTurn, PumpBufferedTurnOptions, ReplayTurnEventsOptions, ResolvedChatTurn, StreamEvent, TURN_EVENTS_MIGRATION_SQL, TURN_STATUS_SCOPE_MIGRATION_SQL, TurnEventStore, TurnStatus, asRecord, asString, buildUserTextParts, coalesceChatStreamEvents, coalesceDeltas, createBufferedTurnTap, createD1TurnEventStore, createMemoryTurnEventStore, encodeEvent, finalizeAssistantParts, getPartKey, mergePersistedPart, messageHasTurnId, normalizeClientTurnId, normalizePersistedPart, normalizeTime, normalizeToolEvent, pumpBufferedTurn, replayTurnEvents, resolveChatTurn, resolveToolId, resolveToolName } from './stream/index.js';
 export { HubExecClient, HubExecClientOptions, HubExecErrorCode, HubExecResult, HubInvokeDeps, HubInvokeInput, HubInvokeOutcome, ParsedIntegrationAction, invokeIntegrationHub, resolveIntegrationAction } from './integrations/index.js';

package/dist/index.js

@@ -138,6 +138,7 @@ import {
   snapshotFrame,
   trackIntervals
 } from "./chunk-ZYBWGSAZ.js";
+import "./chunk-7LNGJDNA.js";
 import {
   DEFAULT_MISSION_STEP_KINDS,
   MISSION_CONTROL_CHANNEL_ID,
@@ -161,17 +162,6 @@ import {
   stepGateProposalId,
   volumeGateProposalId
 } from "./chunk-YNALYIQ3.js";
-import {
-  addSecurityHeaders,
-  assertMediaUrl,
-  checkRateLimit,
-  clearCookieHeader,
-  extractRequestContext,
-  parseJsonObjectBody,
-  readCookieValue,
-  requireString,
-  serializeCookie
-} from "./chunk-HFC4BTWJ.js";
 import {
   composeMissionFlowTrace,
   delegationActivityToFlowSpans,
@@ -200,12 +190,56 @@ import {
 import {
   BULK_DELETE_MAX_THREADS,
   ChatStoreInputError,
+  threadTitleFromMessage
+} from "./chunk-5EQCITY3.js";
+import {
+  createInteractionAnswerRoute,
+  listSessionInteractions,
+  mapInteractionRespondFailure,
+  respondToSessionInteraction,
+  validateInteractionAnswerBody
+} from "./chunk-Y4QHNQ75.js";
+import {
+  addSecurityHeaders,
+  assertMediaUrl,
+  checkRateLimit,
+  clearCookieHeader,
+  extractRequestContext,
+  parseJsonObjectBody,
+  readCookieValue,
+  requireString,
+  serializeCookie
+} from "./chunk-HFC4BTWJ.js";
+import {
+  INTERACTION_CANCEL_EVENT,
+  INTERACTION_EVENT,
+  INTERACTION_RESOLVED_EVENT,
+  canTransitionInteractionStatus,
+  cancelStatusFor,
+  composerAnswerData,
+  composerAnswerDeliveries,
+  dedupeQuestionInteractionsByContent,
+  fieldAcceptsFreeText,
+  interactionFromWireRequest,
+  interactionPartKey,
+  interactionToPersistedPart,
+  isRenderableInteractionKind,
+  isSafeInteractionFieldKey,
+  isTerminalInteractionStatus,
+  noticePart,
+  noticePartKey,
+  parseInteractionCancel,
+  parseInteractionRequest,
+  persistedPartToInteraction,
+  questionInteractionContentSignature
+} from "./chunk-4TXDD6P2.js";
+import {
   isChatInteractionPart,
   isChatStepFinishPart,
   isChatTextPart,
   isChatToolPart,
-  threadTitleFromMessage
-} from "./chunk-4H77LX3V.js";
+  toChatMessageParts
+} from "./chunk-I2R2XT4M.js";
 import {
   createFieldCrypto,
   decodeHexKey,
@@ -242,42 +276,12 @@ import {
   resolveChatTurn,
   resolveToolId,
   resolveToolName
-} from "./chunk-77RLNLFP.js";
+} from "./chunk-ATRJULKZ.js";
 import {
   HubExecClient,
   invokeIntegrationHub,
   resolveIntegrationAction
 } from "./chunk-L2TG5DBW.js";
-import {
-  createInteractionAnswerRoute,
-  listSessionInteractions,
-  mapInteractionRespondFailure,
-  respondToSessionInteraction,
-  validateInteractionAnswerBody
-} from "./chunk-U7DLCPJ6.js";
-import {
-  INTERACTION_CANCEL_EVENT,
-  INTERACTION_EVENT,
-  INTERACTION_RESOLVED_EVENT,
-  canTransitionInteractionStatus,
-  cancelStatusFor,
-  composerAnswerData,
-  composerAnswerDeliveries,
-  dedupeQuestionInteractionsByContent,
-  fieldAcceptsFreeText,
-  interactionFromWireRequest,
-  interactionPartKey,
-  interactionToPersistedPart,
-  isRenderableInteractionKind,
-  isSafeInteractionFieldKey,
-  isTerminalInteractionStatus,
-  noticePart,
-  noticePartKey,
-  parseInteractionCancel,
-  parseInteractionRequest,
-  persistedPartToInteraction,
-  questionInteractionContentSignature
-} from "./chunk-4TXDD6P2.js";
 import {
   createKnowledgeLoop,
   createReviewerDecider,
@@ -771,6 +775,7 @@ export {
   themeToCssVars,
   threadTitleFromMessage,
   timedEventsFromLines,
+  toChatMessageParts,
   toLoopEvents,
   traceEnv,
   trackIntervals,

package/dist/interactions/index.js

@@ -1,10 +1,11 @@
+import "../chunk-7LNGJDNA.js";
 import {
   createInteractionAnswerRoute,
   listSessionInteractions,
   mapInteractionRespondFailure,
   respondToSessionInteraction,
   validateInteractionAnswerBody
-} from "../chunk-U7DLCPJ6.js";
+} from "../chunk-Y4QHNQ75.js";
 import {
   INTERACTION_CANCEL_EVENT,
   INTERACTION_EVENT,

package/dist/{parts-BeRnK54I.d.ts → parts-BcbitSNp.d.ts}

@@ -1,26 +1,6 @@
 import { Part } from '@tangle-network/agent-interface';
 import { a as ChatInteractionField, b as ChatInteractionStatus, N as NoticeKind } from './contract-DYbTzEDf.js';
 
-/**
- * Pure (drizzle-free) pieces of the chat store: thread-title derivation, the
- * bulk-delete bound, and the typed input error. Split from `./schema`/`./store`
- * so the root barrel can re-export them without dragging the optional
- * drizzle-orm peer into every root-entry consumer.
- */
-/** Bounds a single bulk-delete request's write set; product surfaces cap
- *  thread lists at far fewer, so a larger batch is a malformed or hostile
- *  request. (Lifted from legal's api.threads.bulk-delete route.) */
-declare const BULK_DELETE_MAX_THREADS = 200;
-/** Invalid caller input (missing/oversized ids, empty title). Products map it
- *  to a 400; anything else out of the store is a real failure. */
-declare class ChatStoreInputError extends Error {
-    constructor(message: string);
-}
-/** Thread titles come from the first message — keep the list scannable by
- *  storing only its first non-empty line, capped at 80 chars, never the whole
- *  multi-page prompt. (Lifted verbatim from legal's chat.new route.) */
-declare function threadTitleFromMessage(message: string): string;
-
 /**
  * The stored shape of `message.parts` — one typed vocabulary for every part a
  * product persists into a chat transcript. NOT an ad-hoc union reverse-
@@ -177,9 +157,20 @@ type ChatMessagePart = ChatTextPart | ChatReasoningPart | ChatToolPart | ChatFil
  *  guarantee that a new agent-interface part kind cannot silently fall out of
  *  the persisted vocabulary. */
 type StorableHarnessPartKind = Part['type'] & ChatMessagePart['type'];
+/**
+ * The typed projection at the `/stream` → `/chat-store` boundary. The stream
+ * normalizers (`normalizePersistedPart`/`mergePersistedPart`/
+ * `finalizeAssistantParts`) deliberately produce untyped `JsonRecord`s — they
+ * normalize wire shapes and do not own the stored vocabulary. THIS module
+ * owns it, so this is where rows gain the `ChatMessagePart` type: each entry
+ * is validated against its kind's required fields and narrowed, junk is
+ * dropped, and — enforced by the exhaustiveness check below — no storable
+ * kind can silently fall out (the step-finish/interaction trap).
+ */
+declare function toChatMessageParts(parts: Array<Record<string, unknown>>): ChatMessagePart[];
 declare function isChatToolPart(part: ChatMessagePart): part is ChatToolPart;
 declare function isChatTextPart(part: ChatMessagePart): part is ChatTextPart;
 declare function isChatInteractionPart(part: ChatMessagePart): part is ChatInteractionPart;
 declare function isChatStepFinishPart(part: ChatMessagePart): part is ChatStepFinishPart;
 
-export { BULK_DELETE_MAX_THREADS as B, type ChatFilePart as C, type StorableHarnessPartKind as S, type ChatImagePart as a, type ChatInteractionPart as b, type ChatMessagePart as c, type ChatNoticePart as d, type ChatPartTime as e, type ChatReasoningPart as f, type ChatStepFinishPart as g, type ChatStepStartPart as h, ChatStoreInputError as i, type ChatSubtaskPart as j, type ChatTextPart as k, type ChatToolPart as l, type ChatToolState as m, type ChatToolStatus as n, type ChatUsageTokens as o, isChatInteractionPart as p, isChatStepFinishPart as q, isChatTextPart as r, isChatToolPart as s, threadTitleFromMessage as t };
+export { type ChatFilePart as C, type StorableHarnessPartKind as S, type ChatImagePart as a, type ChatInteractionPart as b, type ChatMessagePart as c, type ChatNoticePart as d, type ChatPartTime as e, type ChatReasoningPart as f, type ChatStepFinishPart as g, type ChatStepStartPart as h, type ChatSubtaskPart as i, type ChatTextPart as j, type ChatToolPart as k, type ChatToolState as l, type ChatToolStatus as m, type ChatUsageTokens as n, isChatInteractionPart as o, isChatStepFinishPart as p, isChatTextPart as q, isChatToolPart as r, toChatMessageParts as t };

package/dist/platform/index.d.ts

@@ -1,4 +1,4 @@
-export { c as AdminGuardOptions, d as AssertBillableBalanceOptions, A as AuthGuard, e as AuthGuardOptions, B as BetterAuthSessionCookieMinterOptions, f as BetterAuthSessionCookieSource, g as BillableBalanceState, S as SsoStateConfig, b as TangleSsoAccountStore, a as TangleSsoAuthClient, h as TangleSsoExchangeResult, i as TangleSsoHandlerOptions, T as TangleSsoHandlers, j as TangleSsoSessionCookieArgs, k as TangleSsoUserCreateError, l as assertBillableBalance, m as createAdminGuard, n as createAuthGuard, o as createBetterAuthSessionCookieMinter, p as createSignedSsoState, q as createTangleSsoHandlers, r as parseAdminEmails, s as signSessionCookieValue, v as verifySignedSsoState } from '../sso-Df4wtL8D.js';
+export { c as AdminGuardOptions, d as AssertBillableBalanceOptions, A as AuthGuard, e as AuthGuardOptions, B as BetterAuthSessionCookieMinterOptions, f as BetterAuthSessionCookieSource, g as BillableBalanceState, G as GuardResolution, S as SsoStateConfig, b as TangleSsoAccountStore, a as TangleSsoAuthClient, h as TangleSsoExchangeResult, i as TangleSsoHandlerOptions, T as TangleSsoHandlers, j as TangleSsoSessionCookieArgs, k as TangleSsoUserCreateError, l as assertBillableBalance, m as createAdminGuard, n as createAuthGuard, o as createBetterAuthSessionCookieMinter, p as createSignedSsoState, q as createTangleSsoHandlers, r as guardResolution, s as parseAdminEmails, t as signSessionCookieValue, v as verifySignedSsoState } from '../sso-CNOsARMJ.js';
 import { f as TangleExecutionEnvironment, j as TangleExecutionKeySource } from '../model-dF2h4xT9.js';
 import { PlatformIdentity, PlatformBillingClient } from '../billing/index.js';
 

package/dist/platform/index.js

@@ -6,10 +6,11 @@ import {
   createBetterAuthSessionCookieMinter,
   createSignedSsoState,
   createTangleSsoHandlers,
+  guardResolution,
   parseAdminEmails,
   signSessionCookieValue,
   verifySignedSsoState
-} from "../chunk-AVBANQ67.js";
+} from "../chunk-TKVJE63N.js";
 import "../chunk-HFC4BTWJ.js";
 import {
   resolveTangleDevOrUserKey
@@ -301,6 +302,7 @@ export {
   createTanglePlatformBillingClient,
   createTangleSsoHandlers,
   getProductEntitlement,
+  guardResolution,
   isPlatformBillingHttpError,
   isPlatformHubErrorLike,
   isProductEntitled,