@tangle-network/agent-app 0.43.38 → 0.43.40

package/dist/chat-routes/index.js

@@ -6,19 +6,6 @@ import {
   parseChatTurnParts,
   promptPartsByteSize
 } from "../chunk-5SV5PSU7.js";
-import {
-  createInteractionAnswerRoute
-} from "../chunk-Y4QHNQ75.js";
-import {
-  parseJsonObjectBody
-} from "../chunk-HFC4BTWJ.js";
-import {
-  isRenderableInteractionKind,
-  parseInteractionRequest
-} from "../chunk-4TXDD6P2.js";
-import {
-  toChatMessageParts
-} from "../chunk-I2R2XT4M.js";
 import {
   asRecord,
   asString,
@@ -33,6 +20,19 @@ import {
   replayTurnEvents,
   resolveChatTurn
 } from "../chunk-XYWCGFII.js";
+import {
+  createInteractionAnswerRoute
+} from "../chunk-Y4QHNQ75.js";
+import {
+  parseJsonObjectBody
+} from "../chunk-HFC4BTWJ.js";
+import {
+  isRenderableInteractionKind,
+  parseInteractionRequest
+} from "../chunk-4TXDD6P2.js";
+import {
+  toChatMessageParts
+} from "../chunk-I2R2XT4M.js";
 
 // src/chat-routes/turn-routes.ts
 import { deriveExecutionId, handleChatTurn } from "@tangle-network/agent-runtime";

package/dist/{chunk-H4WCEZE3.js → chunk-5GWXCSLQ.js}

@@ -1,15 +1,15 @@
 import {
   assertHarnessModelCompatible
 } from "./chunk-E7QYOOON.js";
+import {
+  buildAppToolMcpServer
+} from "./chunk-7EVZUIHW.js";
 import {
   base64UrlDecodeText,
   base64UrlEncodeText,
   constantTimeEqual,
   hmacSha256Base64Url
-} from "./chunk-3II3AWHY.js";
-import {
-  buildAppToolMcpServer
-} from "./chunk-7EVZUIHW.js";
+} from "./chunk-S5SRJJQG.js";
 import {
   resolveTangleExecutionEnvironment,
   trimOrNull
@@ -1547,4 +1547,4 @@ export {
   isTerminalPromptEvent,
   detectInteractiveQuestion
 };
-//# sourceMappingURL=chunk-H4WCEZE3.js.map
+//# sourceMappingURL=chunk-5GWXCSLQ.js.map

package/dist/{chunk-3II3AWHY.js → chunk-PJC4NXPA.js}

@@ -1,40 +1,17 @@
 import {
   authenticateToolRequest
 } from "./chunk-7EVZUIHW.js";
+import {
+  base64UrlDecodeText,
+  base64UrlEncodeText,
+  constantTimeEqual,
+  hmacSha256Base64Url
+} from "./chunk-S5SRJJQG.js";
 import {
   dispatchAppTool,
   outcomeStatus
 } from "./chunk-MFRCM32T.js";
 
-// src/crypto/web-token.ts
-function base64UrlEncode(bytes) {
-  let bin = "";
-  for (const b of bytes) bin += String.fromCharCode(b);
-  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function base64UrlEncodeText(text) {
-  return base64UrlEncode(new TextEncoder().encode(text));
-}
-function base64UrlDecodeText(value) {
-  const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
-  const bin = atob(padded);
-  const bytes = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i += 1) bytes[i] = bin.charCodeAt(i);
-  return new TextDecoder().decode(bytes);
-}
-async function hmacSha256Base64Url(message, secret) {
-  const enc = new TextEncoder();
-  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(message));
-  return base64UrlEncode(new Uint8Array(sig));
-}
-function constantTimeEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i += 1) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-
 // src/tools/capability.ts
 async function createCapabilityToken(userId, opts) {
   const secret = opts.secret?.trim();
@@ -141,10 +118,6 @@ async function handleAppToolRequest(request, opts) {
 }
 
 export {
-  base64UrlEncodeText,
-  base64UrlDecodeText,
-  hmacSha256Base64Url,
-  constantTimeEqual,
   createCapabilityToken,
   verifyCapabilityToken,
   createExpiringCapabilityToken,
@@ -153,4 +126,4 @@ export {
   restrictTaxonomy,
   handleAppToolRequest
 };
-//# sourceMappingURL=chunk-3II3AWHY.js.map
+//# sourceMappingURL=chunk-PJC4NXPA.js.map

package/dist/chunk-PJC4NXPA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tools/capability.ts","../src/tools/gating.ts","../src/tools/http.ts"],"sourcesContent":["/**\n * Per-user capability token — the sandbox→app auth primitive behind the\n * `verifyToken` seam in {@link authenticateToolRequest}.\n *\n * An app-agent runs inside the sandbox and reaches the host app back over HTTP\n * (the app tools, the integration-invoke bridge). The route must act AS the\n * connecting user without trusting any model-supplied identity, so the turn\n * mints a short HMAC token bound to the user id and bakes it into the per-turn\n * MCP server header; the route verifies it to recover the user.\n *\n * `HMAC-SHA256(secret, \"user:<userId>\")`, base64url, with an app-chosen prefix.\n * The token encodes no scopes — the hub's policy engine authorizes per action.\n * Fail-closed: with no secret, no token is minted (the caller MUST omit the MCP\n * server rather than fake an authorized call). WebCrypto only — runs on\n * Workers, Node, and the browser with no Node `crypto` dependency.\n */\n\nimport {\n  base64UrlDecodeText,\n  base64UrlEncodeText,\n  constantTimeEqual,\n  hmacSha256Base64Url,\n} from '../crypto/web-token'\n\nexport interface CapabilityTokenOptions {\n  /** Shared HMAC secret. When absent, mint returns undefined / verify returns false. */\n  secret?: string\n  /** Token prefix (namespaces the credential; lets verify reject foreign tokens\n   *  cheaply). Default `cap_`. */\n  prefix?: string\n}\n\n/** Mint a capability token for `userId`, or `undefined` when no secret is\n *  configured (fail-closed — the caller omits the MCP server rather than fake it). */\nexport async function createCapabilityToken(userId: string, opts: CapabilityTokenOptions): Promise<string | undefined> {\n  const secret = opts.secret?.trim()\n  if (!secret) return undefined\n  const prefix = opts.prefix ?? 'cap_'\n  return `${prefix}${await sign(userId, secret)}`\n}\n\n/** Verify a capability token against `userId`. Returns false (never throws) for\n *  an unconfigured secret, a wrong prefix, a malformed token, or a mismatch. */\nexport async function verifyCapabilityToken(userId: string, token: string, opts: CapabilityTokenOptions): Promise<boolean> {\n  const secret = opts.secret?.trim()\n  const prefix = opts.prefix ?? 'cap_'\n  if (!secret || !token.startsWith(prefix)) return false\n  const expected = `${prefix}${await sign(userId, secret)}`\n  return constantTimeEqual(token, expected)\n}\n\nexport interface ExpiringCapabilityTokenOptions extends CapabilityTokenOptions {\n  /** Token lifetime. Expired tokens verify false regardless of signature. */\n  expiresInMs: number\n  /** Clock injection for tests; defaults to Date.now. */\n  now?: () => number\n}\n\n/**\n * Mint an EXPIRING capability token: `<prefix><base64url(payload)>.<sig>` where\n * the payload carries `{ sub, exp, n }` (subject, epoch-ms expiry, random\n * nonce) and the signature is HMAC-SHA256 over the encoded payload. Use this\n * for user-initiated scoped channels (e.g. a per-sequence MCP endpoint) where\n * a captured token must not stay valid past its window; the bare\n * {@link createCapabilityToken} remains for turn-scoped tool bridges whose\n * mint+verify happen inside one request cycle. Fail-closed like the bare\n * variant: no secret → no token.\n */\nexport async function createExpiringCapabilityToken(subject: string, opts: ExpiringCapabilityTokenOptions): Promise<string | undefined> {\n  const secret = opts.secret?.trim()\n  if (!secret) return undefined\n  if (!Number.isFinite(opts.expiresInMs) || opts.expiresInMs <= 0) throw new Error('expiresInMs must be a positive number')\n  const prefix = opts.prefix ?? 'cap_'\n  const now = opts.now ?? Date.now\n  const payload = base64UrlEncodeText(JSON.stringify({ sub: subject, exp: now() + opts.expiresInMs, n: crypto.randomUUID() }))\n  return `${prefix}${payload}.${await hmacSha256Base64Url(payload, secret)}`\n}\n\n/** Verify an expiring token against `subject`: prefix, payload integrity,\n *  subject match, and expiry all checked; returns false (never throws) on any\n *  failure including a malformed payload. */\nexport async function verifyExpiringCapabilityToken(subject: string, token: string, opts: CapabilityTokenOptions & { now?: () => number }): Promise<boolean> {\n  const secret = opts.secret?.trim()\n  const prefix = opts.prefix ?? 'cap_'\n  if (!secret || !token.startsWith(prefix)) return false\n  const body = token.slice(prefix.length)\n  const dot = body.lastIndexOf('.')\n  if (dot <= 0 || dot === body.length - 1) return false\n  const payload = body.slice(0, dot)\n  const sig = body.slice(dot + 1)\n  if (!constantTimeEqual(sig, await hmacSha256Base64Url(payload, secret))) return false\n  let parsed: { sub?: unknown; exp?: unknown }\n  try {\n    parsed = JSON.parse(base64UrlDecodeText(payload)) as { sub?: unknown; exp?: unknown }\n  } catch {\n    return false\n  }\n  if (parsed.sub !== subject) return false\n  if (typeof parsed.exp !== 'number') return false\n  const now = opts.now ?? Date.now\n  return parsed.exp > now()\n}\n\nasync function sign(userId: string, secret: string): Promise<string> {\n  return hmacSha256Base64Url(`user:${userId}`, secret)\n}\n","/**\n * Capability gating — compose an agent session's tool surface from a\n * product-defined capability registry.\n *\n * Products that let users pick what an agent can do (a \"Studio\" agent with the\n * full build toolset vs a clean \"Assistant\" with none) all need the same\n * mechanics: a registry of named capabilities, each unlocking proposal types\n * and/or named tool groups, resolved against the product's\n * {@link AppToolTaxonomy} into the concrete tools to expose. The mechanics are\n * generic and live here; the capability VOCABULARY (ids, labels, which\n * proposal types, which tool groups) is the product's.\n */\n\nimport type { AppToolTaxonomy } from './types'\n\n/** One toggleable tool group in a product's capability registry. */\nexport interface ToolCapability {\n  id: string\n  label: string\n  description: string\n  /** Proposal types this capability unlocks (intersected with the taxonomy,\n   *  so a capability can never widen the product's proposal surface). */\n  proposalTypes?: readonly string[]\n  /** Unlocks every taxonomy proposal type beyond the base set — the domain's\n   *  specialized long tail (risk_assessment, vuln_report, …). */\n  domainActions?: boolean\n  /** Named product tool groups (e.g. 'sandbox', 'integrations') this\n   *  capability unlocks. The vocabulary is the product's; the resolver only\n   *  unions them. */\n  toolGroups?: readonly string[]\n}\n\nexport interface ResolveToolCapabilitiesOptions {\n  taxonomy: AppToolTaxonomy\n  /** The product's full capability registry. */\n  capabilities: readonly ToolCapability[]\n  /** Enabled capability ids. `undefined` means full access (legacy callers\n   *  that don't send a capability set); an explicit `[]` means a pure chat\n   *  agent with no tools. Unknown ids are ignored. */\n  enabled: readonly string[] | undefined\n  /** The shared base proposal types `domainActions` excludes. Defaults to\n   *  every type some capability names explicitly via `proposalTypes` — i.e.\n   *  \"domain actions\" are the taxonomy types no capability claims. */\n  baseProposalTypes?: readonly string[]\n}\n\nexport interface ResolvedToolCapabilities {\n  /** Proposal types to keep — feed to {@link restrictTaxonomy}. */\n  proposalTypes: string[]\n  /** Product tool groups to expose (deduped union across enabled caps). */\n  toolGroups: string[]\n}\n\n/**\n * Resolve an enabled capability-id set against a taxonomy into the concrete\n * tool surface. Fail-closed: only types present in the taxonomy survive, and\n * an empty `enabled` set yields no tools at all.\n */\nexport function resolveToolCapabilities(\n  opts: ResolveToolCapabilitiesOptions,\n): ResolvedToolCapabilities {\n  const { taxonomy, capabilities, enabled } = opts\n  if (enabled === undefined) {\n    return {\n      proposalTypes: [...taxonomy.proposalTypes],\n      toolGroups: [...new Set(capabilities.flatMap((c) => c.toolGroups ?? []))],\n    }\n  }\n  const base = new Set(\n    opts.baseProposalTypes ?? capabilities.flatMap((c) => c.proposalTypes ?? []),\n  )\n  const domainTypes = taxonomy.proposalTypes.filter((t) => !base.has(t))\n  const byId = new Map(capabilities.map((c) => [c.id, c]))\n\n  const proposalTypes = new Set<string>()\n  const toolGroups = new Set<string>()\n  for (const id of enabled) {\n    const cap = byId.get(id)\n    if (!cap) continue\n    for (const t of cap.proposalTypes ?? []) {\n      if (taxonomy.proposalTypes.includes(t)) proposalTypes.add(t)\n    }\n    if (cap.domainActions) for (const t of domainTypes) proposalTypes.add(t)\n    for (const g of cap.toolGroups ?? []) toolGroups.add(g)\n  }\n  return { proposalTypes: [...proposalTypes], toolGroups: [...toolGroups] }\n}\n\n/**\n * Restrict a taxonomy to a subset of proposal types, intersecting the\n * regulated subset too — the regulated label survives restriction, so a\n * narrowed agent can never launder a regulated type into an unregulated one.\n */\nexport function restrictTaxonomy(\n  taxonomy: AppToolTaxonomy,\n  allowed: readonly string[],\n): AppToolTaxonomy {\n  const allow = new Set(allowed)\n  return {\n    proposalTypes: taxonomy.proposalTypes.filter((t) => allow.has(t)),\n    regulatedTypes: taxonomy.regulatedTypes.filter((t) => allow.has(t)),\n  }\n}\n","import { authenticateToolRequest, type ToolHeaderNames } from './auth'\nimport { dispatchAppTool, outcomeStatus, type DispatchOptions } from './dispatch'\nimport type { AppToolName } from './openai'\nimport type { AppToolDefinition } from './registry'\n\nexport interface HandleToolRequestOptions extends DispatchOptions {\n  /** Which app tool this route serves — a built-in name or a product-registered\n   *  {@link AppToolDefinition} (auto-added to `customTools` for dispatch). */\n  tool: AppToolName | AppToolDefinition\n  /** Verify the bearer capability token belongs to the header user. */\n  verifyToken: (userId: string, bearer: string) => Promise<boolean>\n  headerNames?: ToolHeaderNames\n  /** Optional success-message builder for a friendlier tool result. */\n  message?: (result: unknown) => string\n}\n\n/**\n * Handle one app-tool HTTP request end to end — the sandbox MCP path. The\n * agent's per-turn HTTP MCP server POSTs here; this authenticates (header user\n * + capability token), reads the args (MCP-alias tolerant), dispatches to the\n * product handler, and returns a JSON Response. A product's route file becomes\n * a one-liner: `export const action = ({ request }) => handleAppToolRequest(request, cfg)`.\n */\nexport async function handleAppToolRequest(request: Request, opts: HandleToolRequestOptions): Promise<Response> {\n  if (request.method !== 'POST') return Response.json({ error: 'Method not allowed' }, { status: 405 })\n\n  const auth = await authenticateToolRequest(request, { verifyToken: opts.verifyToken, headerNames: opts.headerNames })\n  if (!auth.ok) return auth.response\n\n  let body: { args?: Record<string, unknown>; arguments?: Record<string, unknown> } & Record<string, unknown>\n  try {\n    body = (await request.json()) as typeof body\n  } catch {\n    return Response.json({ error: 'Invalid JSON' }, { status: 400 })\n  }\n  const args = (body.args ?? body.arguments ?? body) as Record<string, unknown>\n\n  // A custom tool passed as `tool` is registered for this dispatch so the route\n  // file stays a one-liner (no separate customTools wiring needed).\n  const toolName = typeof opts.tool === 'string' ? opts.tool : opts.tool.name\n  const customTools =\n    typeof opts.tool === 'string' ? opts.customTools : [...(opts.customTools ?? []), opts.tool]\n  const outcome = await dispatchAppTool(toolName, args, auth.ctx, { ...opts, customTools })\n  if (!outcome.ok) {\n    return Response.json({ error: outcome.code, message: outcome.message }, { status: outcomeStatus(outcome) })\n  }\n  const payload = outcome.result as Record<string, unknown>\n  return Response.json({ ok: true, ...payload, ...(opts.message ? { message: opts.message(outcome.result) } : {}) })\n}\n"],"mappings":";;;;;;;;;;;;;;;AAkCA,eAAsB,sBAAsB,QAAgB,MAA2D;AACrH,QAAM,SAAS,KAAK,QAAQ,KAAK;AACjC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,SAAS,KAAK,UAAU;AAC9B,SAAO,GAAG,MAAM,GAAG,MAAM,KAAK,QAAQ,MAAM,CAAC;AAC/C;AAIA,eAAsB,sBAAsB,QAAgB,OAAe,MAAgD;AACzH,QAAM,SAAS,KAAK,QAAQ,KAAK;AACjC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,UAAU,CAAC,MAAM,WAAW,MAAM,EAAG,QAAO;AACjD,QAAM,WAAW,GAAG,MAAM,GAAG,MAAM,KAAK,QAAQ,MAAM,CAAC;AACvD,SAAO,kBAAkB,OAAO,QAAQ;AAC1C;AAmBA,eAAsB,8BAA8B,SAAiB,MAAmE;AACtI,QAAM,SAAS,KAAK,QAAQ,KAAK;AACjC,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,CAAC,OAAO,SAAS,KAAK,WAAW,KAAK,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,uCAAuC;AACxH,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,UAAU,oBAAoB,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,IAAI,IAAI,KAAK,aAAa,GAAG,OAAO,WAAW,EAAE,CAAC,CAAC;AAC3H,SAAO,GAAG,MAAM,GAAG,OAAO,IAAI,MAAM,oBAAoB,SAAS,MAAM,CAAC;AAC1E;AAKA,eAAsB,8BAA8B,SAAiB,OAAe,MAAyE;AAC3J,QAAM,SAAS,KAAK,QAAQ,KAAK;AACjC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,UAAU,CAAC,MAAM,WAAW,MAAM,EAAG,QAAO;AACjD,QAAM,OAAO,MAAM,MAAM,OAAO,MAAM;AACtC,QAAM,MAAM,KAAK,YAAY,GAAG;AAChC,MAAI,OAAO,KAAK,QAAQ,KAAK,SAAS,EAAG,QAAO;AAChD,QAAM,UAAU,KAAK,MAAM,GAAG,GAAG;AACjC,QAAM,MAAM,KAAK,MAAM,MAAM,CAAC;AAC9B,MAAI,CAAC,kBAAkB,KAAK,MAAM,oBAAoB,SAAS,MAAM,CAAC,EAAG,QAAO;AAChF,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,oBAAoB,OAAO,CAAC;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,QAAS,QAAO;AACnC,MAAI,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC3C,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,SAAO,OAAO,MAAM,IAAI;AAC1B;AAEA,eAAe,KAAK,QAAgB,QAAiC;AACnE,SAAO,oBAAoB,QAAQ,MAAM,IAAI,MAAM;AACrD;;;AC/CO,SAAS,wBACd,MAC0B;AAC1B,QAAM,EAAE,UAAU,cAAc,QAAQ,IAAI;AAC5C,MAAI,YAAY,QAAW;AACzB,WAAO;AAAA,MACL,eAAe,CAAC,GAAG,SAAS,aAAa;AAAA,MACzC,YAAY,CAAC,GAAG,IAAI,IAAI,aAAa,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AAAA,IAC1E;AAAA,EACF;AACA,QAAM,OAAO,IAAI;AAAA,IACf,KAAK,qBAAqB,aAAa,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAAA,EAC7E;AACA,QAAM,cAAc,SAAS,cAAc,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;AACrE,QAAM,OAAO,IAAI,IAAI,aAAa,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAEvD,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,MAAM,SAAS;AACxB,UAAM,MAAM,KAAK,IAAI,EAAE;AACvB,QAAI,CAAC,IAAK;AACV,eAAW,KAAK,IAAI,iBAAiB,CAAC,GAAG;AACvC,UAAI,SAAS,cAAc,SAAS,CAAC,EAAG,eAAc,IAAI,CAAC;AAAA,IAC7D;AACA,QAAI,IAAI,cAAe,YAAW,KAAK,YAAa,eAAc,IAAI,CAAC;AACvE,eAAW,KAAK,IAAI,cAAc,CAAC,EAAG,YAAW,IAAI,CAAC;AAAA,EACxD;AACA,SAAO,EAAE,eAAe,CAAC,GAAG,aAAa,GAAG,YAAY,CAAC,GAAG,UAAU,EAAE;AAC1E;AAOO,SAAS,iBACd,UACA,SACiB;AACjB,QAAM,QAAQ,IAAI,IAAI,OAAO;AAC7B,SAAO;AAAA,IACL,eAAe,SAAS,cAAc,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC;AAAA,IAChE,gBAAgB,SAAS,eAAe,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC;AAAA,EACpE;AACF;;;AC/EA,eAAsB,qBAAqB,SAAkB,MAAmD;AAC9G,MAAI,QAAQ,WAAW,OAAQ,QAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEpG,QAAM,OAAO,MAAM,wBAAwB,SAAS,EAAE,aAAa,KAAK,aAAa,aAAa,KAAK,YAAY,CAAC;AACpH,MAAI,CAAC,KAAK,GAAI,QAAO,KAAK;AAE1B,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,QAAQ,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO,SAAS,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjE;AACA,QAAM,OAAQ,KAAK,QAAQ,KAAK,aAAa;AAI7C,QAAM,WAAW,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,KAAK,KAAK;AACvE,QAAM,cACJ,OAAO,KAAK,SAAS,WAAW,KAAK,cAAc,CAAC,GAAI,KAAK,eAAe,CAAC,GAAI,KAAK,IAAI;AAC5F,QAAM,UAAU,MAAM,gBAAgB,UAAU,MAAM,KAAK,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC;AACxF,MAAI,CAAC,QAAQ,IAAI;AACf,WAAO,SAAS,KAAK,EAAE,OAAO,QAAQ,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,OAAO,EAAE,CAAC;AAAA,EAC5G;AACA,QAAM,UAAU,QAAQ;AACxB,SAAO,SAAS,KAAK,EAAE,IAAI,MAAM,GAAG,SAAS,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,QAAQ,MAAM,EAAE,IAAI,CAAC,EAAG,CAAC;AACnH;","names":[]}

package/dist/chunk-S5SRJJQG.js

@@ -0,0 +1,36 @@
+// src/crypto/web-token.ts
+function base64UrlEncode(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlEncodeText(text) {
+  return base64UrlEncode(new TextEncoder().encode(text));
+}
+function base64UrlDecodeText(value) {
+  const padded = value.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(value.length / 4) * 4, "=");
+  const bin = atob(padded);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i += 1) bytes[i] = bin.charCodeAt(i);
+  return new TextDecoder().decode(bytes);
+}
+async function hmacSha256Base64Url(message, secret) {
+  const enc = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(message));
+  return base64UrlEncode(new Uint8Array(sig));
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+
+export {
+  base64UrlEncodeText,
+  base64UrlDecodeText,
+  hmacSha256Base64Url,
+  constantTimeEqual
+};
+//# sourceMappingURL=chunk-S5SRJJQG.js.map

package/dist/chunk-S5SRJJQG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/crypto/web-token.ts"],"sourcesContent":["/**\n * Dependency-free WebCrypto primitives for HMAC-signed, base64url-encoded\n * tokens — base64url encode/decode, HMAC-SHA256, and a constant-time compare.\n * Runs on Cloudflare Workers, Node, and the browser with no Node `crypto`\n * dependency. Shared by the sandbox terminal-proxy token, the WS-upgrade token\n * parser, and the app-tool capability token so the logic lives in one place\n * rather than three near-identical private copies.\n *\n * Internal leaf: not exported from the `/crypto` barrel (that subpath is the\n * AES-GCM field-crypto surface); imported directly by the modules that need it.\n */\n\n/** base64url-encode raw bytes (RFC 4648 §5, no padding). */\nexport function base64UrlEncode(bytes: Uint8Array): string {\n  let bin = ''\n  for (const b of bytes) bin += String.fromCharCode(b)\n  return btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\n/** base64url-encode a UTF-8 string. */\nexport function base64UrlEncodeText(text: string): string {\n  return base64UrlEncode(new TextEncoder().encode(text))\n}\n\n/** Decode a base64url string back to its UTF-8 text. Re-pads before `atob` so\n *  unpadded input decodes correctly regardless of the runtime's leniency. */\nexport function base64UrlDecodeText(value: string): string {\n  const padded = value.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(value.length / 4) * 4, '=')\n  const bin = atob(padded)\n  const bytes = new Uint8Array(bin.length)\n  for (let i = 0; i < bin.length; i += 1) bytes[i] = bin.charCodeAt(i)\n  return new TextDecoder().decode(bytes)\n}\n\n/** HMAC-SHA256 `message` under `secret`, returned base64url-encoded. */\nexport async function hmacSha256Base64Url(message: string, secret: string): Promise<string> {\n  const enc = new TextEncoder()\n  const key = await crypto.subtle.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  const sig = await crypto.subtle.sign('HMAC', key, enc.encode(message))\n  return base64UrlEncode(new Uint8Array(sig))\n}\n\n/** Length-independent-leak-free compare of two same-charset strings. */\nexport function constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i += 1) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return diff === 0\n}\n"],"mappings":";AAaO,SAAS,gBAAgB,OAA2B;AACzD,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,OAAO,aAAa,CAAC;AACnD,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAGO,SAAS,oBAAoB,MAAsB;AACxD,SAAO,gBAAgB,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AACvD;AAIO,SAAS,oBAAoB,OAAuB;AACzD,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,EAAE,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC,IAAI,GAAG,GAAG;AACtG,QAAM,MAAM,KAAK,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,IAAI,MAAM;AACvC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,EAAG,OAAM,CAAC,IAAI,IAAI,WAAW,CAAC;AACnE,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAGA,eAAsB,oBAAoB,SAAiB,QAAiC;AAC1F,QAAM,MAAM,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,IAAI,OAAO,MAAM,GAAG,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AACvH,QAAM,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,OAAO,OAAO,CAAC;AACrE,SAAO,gBAAgB,IAAI,WAAW,GAAG,CAAC;AAC5C;AAGO,SAAS,kBAAkB,GAAW,GAAoB;AAC/D,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK,EAAG,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC9E,SAAO,SAAS;AAClB;","names":[]}

package/dist/chunk-UMSOSUEU.js

@@ -0,0 +1,124 @@
+import {
+  constantTimeEqual,
+  hmacSha256Base64Url
+} from "./chunk-S5SRJJQG.js";
+
+// src/object-store/index.ts
+function createR2ObjectStore({ bucket }) {
+  return {
+    async put(key, body, opts) {
+      const options = opts?.contentType ? { httpMetadata: { contentType: opts.contentType } } : void 0;
+      await bucket.put(key, body, options);
+    },
+    async get(key) {
+      const obj = await bucket.get(key);
+      if (!obj) return null;
+      return {
+        stream: () => obj.body,
+        size: obj.size,
+        contentType: obj.httpMetadata?.contentType
+      };
+    },
+    async head(key) {
+      const obj = await bucket.head(key);
+      if (!obj) return null;
+      return { size: obj.size, contentType: obj.httpMetadata?.contentType };
+    },
+    async delete(key) {
+      await bucket.delete(key);
+    }
+  };
+}
+function assertSafeKeySegment(s) {
+  if (s.length === 0) throw new Error("object-store: empty key segment");
+  if (s.includes("..")) throw new Error(`object-store: unsafe key segment (contains "..") \u2014 ${s}`);
+  if (s.startsWith("/")) throw new Error(`object-store: unsafe key segment (leading "/") \u2014 ${s}`);
+  if (s.includes("\\")) throw new Error(`object-store: unsafe key segment (backslash) \u2014 ${s}`);
+  return s;
+}
+function sanitizeFilename(filename) {
+  const leaf = filename.split(/[/\\]/).pop() ?? "";
+  const cleaned = leaf.replace(/[^A-Za-z0-9._-]/g, "_").replace(/^\.+/, "");
+  return cleaned.length > 0 ? cleaned : "file";
+}
+function objectKey({ operatorId, customerId, uploadId, filename }) {
+  const operator = assertSafeKeySegment(operatorId);
+  const customer = customerId == null ? "_unattributed" : assertSafeKeySegment(customerId);
+  const upload = assertSafeKeySegment(uploadId);
+  return `${operator}/${customer}/${upload}-${sanitizeFilename(filename)}`;
+}
+function canonicalizeObjectKey(raw) {
+  let decoded;
+  try {
+    decoded = decodeURIComponent(raw);
+  } catch {
+    throw new Error("object-store: malformed key encoding");
+  }
+  for (const segment of decoded.split("/")) assertSafeKeySegment(segment);
+  return decoded;
+}
+function signingMessage(canonicalKey, exp) {
+  return JSON.stringify({ v: 1, exp, key: canonicalKey });
+}
+async function signObjectUrl({ key, exp, secret }) {
+  if (!secret) throw new Error("object-store: signObjectUrl requires a non-empty secret (fail-closed)");
+  const canonical = canonicalizeObjectKey(key);
+  const sig = await hmacSha256Base64Url(signingMessage(canonical, exp), secret);
+  const params = new URLSearchParams({ key: canonical, exp: String(exp), sig });
+  return `?${params.toString()}`;
+}
+async function verifyObjectUrl(request, { secret }) {
+  if (!secret) return { ok: false };
+  const url = new URL(request.url);
+  const rawKey = url.searchParams.get("key");
+  const expRaw = url.searchParams.get("exp");
+  const sig = url.searchParams.get("sig");
+  if (!rawKey || !expRaw || !sig) return { ok: false };
+  let key;
+  try {
+    key = canonicalizeObjectKey(rawKey);
+  } catch {
+    return { ok: false };
+  }
+  const exp = Number(expRaw);
+  if (!Number.isFinite(exp)) return { ok: false };
+  const expected = await hmacSha256Base64Url(signingMessage(key, exp), secret);
+  if (!constantTimeEqual(expected, sig)) return { ok: false };
+  if (Date.now() > exp) return { ok: false };
+  return { ok: true, key };
+}
+function createProxiedArtifactRoute({
+  store,
+  secret
+}) {
+  return async (request) => {
+    const rawKey = new URL(request.url).searchParams.get("key");
+    if (!rawKey) return new Response("Missing key", { status: 400 });
+    try {
+      canonicalizeObjectKey(rawKey);
+    } catch {
+      return new Response("Malformed key", { status: 400 });
+    }
+    const verified = await verifyObjectUrl(request, { secret });
+    if (!verified.ok) return new Response("Forbidden", { status: 403 });
+    const obj = await store.get(verified.key);
+    if (!obj) return new Response("Not found", { status: 404 });
+    const headers = {
+      "Content-Type": "application/octet-stream",
+      "Content-Disposition": "attachment",
+      "X-Content-Type-Options": "nosniff"
+    };
+    if (Number.isFinite(obj.size) && obj.size >= 0) headers["Content-Length"] = String(obj.size);
+    return new Response(obj.stream(), { status: 200, headers });
+  };
+}
+
+export {
+  createR2ObjectStore,
+  assertSafeKeySegment,
+  objectKey,
+  signObjectUrl,
+  verifyObjectUrl,
+  createProxiedArtifactRoute
+};
+//# sourceMappingURL=chunk-UMSOSUEU.js.map

package/dist/chunk-UMSOSUEU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/object-store/index.ts"],"sourcesContent":["/**\n * `/object-store` — a portable, secure object store for durable large\n * attachments (uploaded PDFs, images, exports) that are too big to ride a chat\n * turn body or live in KV.\n *\n * SECURITY POSTURE (this module guards a legal privilege wall). Every object key\n * carries an operator segment and a customer segment, and access is by a\n * short-lived HMAC-signed URL whose signature covers the EXACT key (operator +\n * customer + upload id + filename) AND the expiry. A tampered key, a swapped\n * customer segment, or a replayed-after-expiry URL all fail the signature or the\n * expiry check and are refused. The signing secret is a PARAMETER on every call\n * — this module reads NOTHING global (no `process.env`, no ambient config); if a\n * product forgets to bind the secret, {@link verifyObjectUrl} fails closed and\n * {@link signObjectUrl} throws rather than minting an unsigned URL.\n *\n * PURE MECHANISM behind two seams: an {@link ObjectStore} port (the R2 impl maps\n * 1:1 to a bucket held behind the structural {@link R2LikeBucket} — so\n * `@cloudflare/workers-types` never leaks into this package's public `.d.ts`)\n * and the signing `secret`. Reads and writes STREAM: {@link createR2ObjectStore}\n * returns the R2 object's `.body` stream directly and never calls\n * `.text()`/`.arrayBuffer()`, so a 15 MB PDF flows through the worker without\n * buffering the whole file into the isolate's heap.\n *\n * RECONCILIATION with the sandbox `storage` seam (`../sandbox` →\n * `SandboxRuntimeConfig.storage`): that is BYOS3/R2 *snapshot* storage — it\n * checkpoints and restores a sandbox box's filesystem for durable session\n * execution. This is a DIFFERENT concern: a content-addressed store for\n * user-facing attachments gated by a signed-URL privilege wall. They are not\n * interchangeable and must not be merged: one persists agent runtime state, the\n * other serves per-operator/per-customer documents to browsers. Do not route\n * artifact downloads through the snapshot bucket, or vice versa.\n */\n\nimport { constantTimeEqual, hmacSha256Base64Url } from '../crypto/web-token'\n\n// ── The store port + R2 impl ────────────────────────────────────────────────\n\n/** Options for a single {@link ObjectStore.put}. Both fields are optional; a\n *  store that needs a fixed content length (e.g. R2 with a `ReadableStream`\n *  body) uses `contentLength` when present. */\nexport interface PutObjectOptions {\n  /** MIME type recorded with the object (returned by `get`/`head`). Advisory:\n   *  the proxied download route always serves `application/octet-stream`. */\n  contentType?: string\n  /** Byte length of `body`, when known. Some backends require it for a\n   *  streamed body; the R2 impl passes a known length through when supplied. */\n  contentLength?: number\n}\n\n/** A retrieved object. `stream()` is the ONLY way to read the bytes — there is\n *  deliberately no `text()`/`arrayBuffer()`, so a large object never buffers\n *  into the isolate heap. */\nexport interface ObjectBody {\n  /** The object's bytes as a `ReadableStream` (backed by R2's `.body`). */\n  stream(): ReadableStream\n  /** Size in bytes. */\n  size: number\n  /** Recorded MIME type, if any. */\n  contentType?: string\n}\n\n/**\n * Portable object-store port. `get`/`head` return `null` on a miss and NEVER\n * throw for a missing key (a miss is a normal control-flow outcome, not an\n * error); `delete` is idempotent.\n */\nexport interface ObjectStore {\n  put(key: string, body: ReadableStream | Uint8Array, opts?: PutObjectOptions): Promise<void>\n  /** `null` on a miss — never throws for a missing key. */\n  get(key: string): Promise<ObjectBody | null>\n  /** `null` on a miss — never throws for a missing key. */\n  head(key: string): Promise<{ size: number; contentType?: string } | null>\n  delete(key: string): Promise<void>\n}\n\n/** Head/metadata shape of a stored object (structural match of R2's `R2Object`). */\nexport interface R2LikeObjectHead {\n  size: number\n  httpMetadata?: { contentType?: string }\n}\n\n/** Body shape of a retrieved object (structural match of R2's `R2ObjectBody`).\n *  `body` is the streamed content — the impl reads this, never `.text()`. */\nexport interface R2LikeObjectBody extends R2LikeObjectHead {\n  body: ReadableStream\n}\n\n/**\n * The minimal slice of Cloudflare's `R2Bucket` this module calls. A real\n * `R2Bucket` satisfies it structurally, so the consumer passes its binding\n * without this package ever importing `@cloudflare/workers-types` (which would\n * otherwise leak into the public `.d.ts`).\n */\nexport interface R2LikeBucket {\n  put(\n    key: string,\n    value: ReadableStream | Uint8Array | ArrayBuffer,\n    options?: { httpMetadata?: { contentType?: string } },\n  ): Promise<unknown>\n  get(key: string): Promise<R2LikeObjectBody | null>\n  head(key: string): Promise<R2LikeObjectHead | null>\n  delete(key: string): Promise<void>\n}\n\n/**\n * Map the {@link ObjectStore} port onto an R2 bucket 1:1. `get` STREAMS: it\n * returns the R2 object's `.body` behind `ObjectBody.stream()` and never calls\n * `.text()`/`.arrayBuffer()`, so a large file flows through the worker rather\n * than buffering into the isolate.\n */\nexport function createR2ObjectStore({ bucket }: { bucket: R2LikeBucket }): ObjectStore {\n  return {\n    async put(key, body, opts) {\n      const options = opts?.contentType ? { httpMetadata: { contentType: opts.contentType } } : undefined\n      await bucket.put(key, body, options)\n    },\n    async get(key) {\n      const obj = await bucket.get(key)\n      if (!obj) return null\n      return {\n        stream: () => obj.body,\n        size: obj.size,\n        contentType: obj.httpMetadata?.contentType,\n      }\n    },\n    async head(key) {\n      const obj = await bucket.head(key)\n      if (!obj) return null\n      return { size: obj.size, contentType: obj.httpMetadata?.contentType }\n    },\n    async delete(key) {\n      await bucket.delete(key)\n    },\n  }\n}\n\n// ── Key construction + safety ───────────────────────────────────────────────\n\n/**\n * Assert a single object-key path SEGMENT (an operator id, customer id, or\n * upload id) is safe to interpolate into a key, and return it. Throws on the\n * traversal / injection shapes: `..` anywhere, a leading `/`, a backslash, or an\n * empty segment. Consumers should call this on caller-supplied identifiers\n * BEFORE any `get`/`put` so an attacker-controlled id can never widen the key\n * beyond its own operator+customer prefix.\n */\nexport function assertSafeKeySegment(s: string): string {\n  if (s.length === 0) throw new Error('object-store: empty key segment')\n  if (s.includes('..')) throw new Error(`object-store: unsafe key segment (contains \"..\") — ${s}`)\n  if (s.startsWith('/')) throw new Error(`object-store: unsafe key segment (leading \"/\") — ${s}`)\n  if (s.includes('\\\\')) throw new Error(`object-store: unsafe key segment (backslash) — ${s}`)\n  return s\n}\n\n/** Strip a filename down to a safe leaf: drop any path, keep only\n *  `[A-Za-z0-9._-]`, and remove leading dots so a `..`/`.hidden`/dot-only name\n *  can neither traverse nor vanish. Never returns an empty string. */\nfunction sanitizeFilename(filename: string): string {\n  const leaf = filename.split(/[/\\\\]/).pop() ?? ''\n  const cleaned = leaf.replace(/[^A-Za-z0-9._-]/g, '_').replace(/^\\.+/, '')\n  return cleaned.length > 0 ? cleaned : 'file'\n}\n\n/** Inputs to {@link objectKey}. `customerId` is optional — an unattributed\n *  upload lands under the reserved `_unattributed` customer segment. */\nexport interface ObjectKeyParts {\n  operatorId: string\n  /** Optional — omitted/undefined groups the upload under `_unattributed`. */\n  customerId?: string\n  uploadId: string\n  filename: string\n}\n\n/**\n * Build the canonical object key: `operator/customer/upload-filename`. The\n * operator, customer, and upload segments are asserted safe (throwing on\n * traversal); the filename is sanitized to a safe leaf. The customer segment\n * falls back to `_unattributed` when no customer is attributed. Because a signed\n * URL binds the EXACT key, the operator and customer segments are part of the\n * privilege wall — a caller cannot later swap them without breaking the\n * signature.\n */\nexport function objectKey({ operatorId, customerId, uploadId, filename }: ObjectKeyParts): string {\n  const operator = assertSafeKeySegment(operatorId)\n  const customer = customerId == null ? '_unattributed' : assertSafeKeySegment(customerId)\n  const upload = assertSafeKeySegment(uploadId)\n  return `${operator}/${customer}/${upload}-${sanitizeFilename(filename)}`\n}\n\n/**\n * Decode a key ONCE and assert every `/`-delimited segment is safe. Slash- and\n * percent-encoded forms of the same key canonicalize identically (`a/b` and\n * `a%2Fb` both → `a/b`), so a signature binds the key's MEANING, not its\n * on-the-wire spelling. Throws on malformed percent-encoding or an unsafe\n * segment. Our own keys never contain `%`, so the single decode is idempotent.\n */\nfunction canonicalizeObjectKey(raw: string): string {\n  let decoded: string\n  try {\n    decoded = decodeURIComponent(raw)\n  } catch {\n    throw new Error('object-store: malformed key encoding')\n  }\n  for (const segment of decoded.split('/')) assertSafeKeySegment(segment)\n  return decoded\n}\n\n// ── Signed URLs ─────────────────────────────────────────────────────────────\n\n/** The exact string the signature covers: a versioned JSON of the canonical key\n *  and the expiry. JSON escaping makes it delimiter-injection-proof (a key\n *  cannot forge the `exp` field). Both sign and verify build it identically. */\nfunction signingMessage(canonicalKey: string, exp: number): string {\n  return JSON.stringify({ v: 1, exp, key: canonicalKey })\n}\n\n/** Arguments to {@link signObjectUrl}. */\nexport interface SignObjectUrlArgs {\n  /** The exact object key to authorize (from {@link objectKey}). */\n  key: string\n  /** Absolute expiry in epoch MILLISECONDS (e.g. `Date.now() + 5 * 60_000` for a\n   *  ~5-minute TTL — the recommended default; keep it short). */\n  exp: number\n  /** HMAC signing secret. Must be non-empty — signing fails closed otherwise. */\n  secret: string\n}\n\n/**\n * Mint a signed query string (`?key=…&exp=…&sig=…`) authorizing a download of\n * `key` until `exp`. The product appends it to its artifact route path\n * (`` `/artifacts${await signObjectUrl(...)}` ``); {@link createProxiedArtifactRoute}\n * / {@link verifyObjectUrl} read it straight off the request URL, so the route's\n * own mount path never matters.\n *\n * FAIL-CLOSED: throws if `secret` is empty (never mints an unsigned URL) and if\n * `key` is unsafe (traversal). Async because the HMAC primitive is WebCrypto.\n *\n * TTL: `exp` is caller-supplied on purpose (the caller knows the sensitivity);\n * keep it SHORT — ~5 minutes is the recommended default for a privilege-walled\n * document.\n */\nexport async function signObjectUrl({ key, exp, secret }: SignObjectUrlArgs): Promise<string> {\n  if (!secret) throw new Error('object-store: signObjectUrl requires a non-empty secret (fail-closed)')\n  const canonical = canonicalizeObjectKey(key)\n  const sig = await hmacSha256Base64Url(signingMessage(canonical, exp), secret)\n  const params = new URLSearchParams({ key: canonical, exp: String(exp), sig })\n  return `?${params.toString()}`\n}\n\n/** Result of {@link verifyObjectUrl}: the canonical key on success, nothing\n *  distinguishing on failure (so a rejection leaks no detail). */\nexport type VerifyObjectUrlResult = { ok: true; key: string } | { ok: false }\n\n/**\n * Verify a signed download request. Reads `key`/`exp`/`sig` off the request URL,\n * canonicalizes the key identically to the signer, recomputes the HMAC and\n * constant-time-compares it, and checks the expiry. Returns the canonical key on\n * success.\n *\n * FAIL-CLOSED everywhere: an empty `secret`, a missing/ malformed parameter, a\n * non-finite expiry, a signature mismatch, or an expired URL all return\n * `{ ok: false }` — and the mismatch path uses a constant-time compare so a\n * near-correct signature is not distinguishable by timing. Async because the\n * HMAC primitive is WebCrypto.\n */\nexport async function verifyObjectUrl(\n  request: Request,\n  { secret }: { secret: string },\n): Promise<VerifyObjectUrlResult> {\n  if (!secret) return { ok: false }\n  const url = new URL(request.url)\n  const rawKey = url.searchParams.get('key')\n  const expRaw = url.searchParams.get('exp')\n  const sig = url.searchParams.get('sig')\n  if (!rawKey || !expRaw || !sig) return { ok: false }\n\n  let key: string\n  try {\n    key = canonicalizeObjectKey(rawKey)\n  } catch {\n    return { ok: false }\n  }\n\n  const exp = Number(expRaw)\n  if (!Number.isFinite(exp)) return { ok: false }\n\n  const expected = await hmacSha256Base64Url(signingMessage(key, exp), secret)\n  if (!constantTimeEqual(expected, sig)) return { ok: false }\n  // Signature is valid; enforce expiry last so the constant-time compare always\n  // runs (an expired-but-otherwise-valid URL is refused just the same).\n  if (Date.now() > exp) return { ok: false }\n  return { ok: true, key }\n}\n\n// ── Proxied download route ──────────────────────────────────────────────────\n\n/**\n * Build a download handler that verifies a signed request and STREAMS the object\n * back with a conservative, non-executable content type. Status contract:\n *\n * - `400` — the `key` is missing or malformed (bad encoding / traversal). This\n *   is an unauthenticated client error and leaks NOTHING about object existence.\n * - `403` — the signature is missing, wrong, or expired.\n * - `404` — the signature was valid but no object exists at that key (existence\n *   is only ever revealed to a validly-signed request).\n * - `200` — streams the bytes with `Content-Disposition: attachment`,\n *   `Content-Type: application/octet-stream`, and `X-Content-Type-Options:\n *   nosniff`, so the worker never serves active/inline content.\n */\nexport function createProxiedArtifactRoute({\n  store,\n  secret,\n}: {\n  store: ObjectStore\n  secret: string\n}): (request: Request) => Promise<Response> {\n  return async (request) => {\n    // 1. Malformed/missing key → 400, decided BEFORE auth so it leaks no\n    //    existence signal (a malformed key can never carry a valid signature).\n    const rawKey = new URL(request.url).searchParams.get('key')\n    if (!rawKey) return new Response('Missing key', { status: 400 })\n    try {\n      canonicalizeObjectKey(rawKey)\n    } catch {\n      return new Response('Malformed key', { status: 400 })\n    }\n\n    // 2. Bad / expired signature → 403.\n    const verified = await verifyObjectUrl(request, { secret })\n    if (!verified.ok) return new Response('Forbidden', { status: 403 })\n\n    // 3. Fetch by the VERIFIED canonical key. Miss → 404 (only reachable behind\n    //    a valid signature). Hit → stream with a conservative content type.\n    const obj = await store.get(verified.key)\n    if (!obj) return new Response('Not found', { status: 404 })\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/octet-stream',\n      'Content-Disposition': 'attachment',\n      'X-Content-Type-Options': 'nosniff',\n    }\n    if (Number.isFinite(obj.size) && obj.size >= 0) headers['Content-Length'] = String(obj.size)\n    return new Response(obj.stream(), { status: 200, headers })\n  }\n}\n"],"mappings":";;;;;;AA8GO,SAAS,oBAAoB,EAAE,OAAO,GAA0C;AACrF,SAAO;AAAA,IACL,MAAM,IAAI,KAAK,MAAM,MAAM;AACzB,YAAM,UAAU,MAAM,cAAc,EAAE,cAAc,EAAE,aAAa,KAAK,YAAY,EAAE,IAAI;AAC1F,YAAM,OAAO,IAAI,KAAK,MAAM,OAAO;AAAA,IACrC;AAAA,IACA,MAAM,IAAI,KAAK;AACb,YAAM,MAAM,MAAM,OAAO,IAAI,GAAG;AAChC,UAAI,CAAC,IAAK,QAAO;AACjB,aAAO;AAAA,QACL,QAAQ,MAAM,IAAI;AAAA,QAClB,MAAM,IAAI;AAAA,QACV,aAAa,IAAI,cAAc;AAAA,MACjC;AAAA,IACF;AAAA,IACA,MAAM,KAAK,KAAK;AACd,YAAM,MAAM,MAAM,OAAO,KAAK,GAAG;AACjC,UAAI,CAAC,IAAK,QAAO;AACjB,aAAO,EAAE,MAAM,IAAI,MAAM,aAAa,IAAI,cAAc,YAAY;AAAA,IACtE;AAAA,IACA,MAAM,OAAO,KAAK;AAChB,YAAM,OAAO,OAAO,GAAG;AAAA,IACzB;AAAA,EACF;AACF;AAYO,SAAS,qBAAqB,GAAmB;AACtD,MAAI,EAAE,WAAW,EAAG,OAAM,IAAI,MAAM,iCAAiC;AACrE,MAAI,EAAE,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,2DAAsD,CAAC,EAAE;AAC/F,MAAI,EAAE,WAAW,GAAG,EAAG,OAAM,IAAI,MAAM,yDAAoD,CAAC,EAAE;AAC9F,MAAI,EAAE,SAAS,IAAI,EAAG,OAAM,IAAI,MAAM,uDAAkD,CAAC,EAAE;AAC3F,SAAO;AACT;AAKA,SAAS,iBAAiB,UAA0B;AAClD,QAAM,OAAO,SAAS,MAAM,OAAO,EAAE,IAAI,KAAK;AAC9C,QAAM,UAAU,KAAK,QAAQ,oBAAoB,GAAG,EAAE,QAAQ,QAAQ,EAAE;AACxE,SAAO,QAAQ,SAAS,IAAI,UAAU;AACxC;AAqBO,SAAS,UAAU,EAAE,YAAY,YAAY,UAAU,SAAS,GAA2B;AAChG,QAAM,WAAW,qBAAqB,UAAU;AAChD,QAAM,WAAW,cAAc,OAAO,kBAAkB,qBAAqB,UAAU;AACvF,QAAM,SAAS,qBAAqB,QAAQ;AAC5C,SAAO,GAAG,QAAQ,IAAI,QAAQ,IAAI,MAAM,IAAI,iBAAiB,QAAQ,CAAC;AACxE;AASA,SAAS,sBAAsB,KAAqB;AAClD,MAAI;AACJ,MAAI;AACF,cAAU,mBAAmB,GAAG;AAAA,EAClC,QAAQ;AACN,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AACA,aAAW,WAAW,QAAQ,MAAM,GAAG,EAAG,sBAAqB,OAAO;AACtE,SAAO;AACT;AAOA,SAAS,eAAe,cAAsB,KAAqB;AACjE,SAAO,KAAK,UAAU,EAAE,GAAG,GAAG,KAAK,KAAK,aAAa,CAAC;AACxD;AA2BA,eAAsB,cAAc,EAAE,KAAK,KAAK,OAAO,GAAuC;AAC5F,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,uEAAuE;AACpG,QAAM,YAAY,sBAAsB,GAAG;AAC3C,QAAM,MAAM,MAAM,oBAAoB,eAAe,WAAW,GAAG,GAAG,MAAM;AAC5E,QAAM,SAAS,IAAI,gBAAgB,EAAE,KAAK,WAAW,KAAK,OAAO,GAAG,GAAG,IAAI,CAAC;AAC5E,SAAO,IAAI,OAAO,SAAS,CAAC;AAC9B;AAkBA,eAAsB,gBACpB,SACA,EAAE,OAAO,GACuB;AAChC,MAAI,CAAC,OAAQ,QAAO,EAAE,IAAI,MAAM;AAChC,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,SAAS,IAAI,aAAa,IAAI,KAAK;AACzC,QAAM,SAAS,IAAI,aAAa,IAAI,KAAK;AACzC,QAAM,MAAM,IAAI,aAAa,IAAI,KAAK;AACtC,MAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAK,QAAO,EAAE,IAAI,MAAM;AAEnD,MAAI;AACJ,MAAI;AACF,UAAM,sBAAsB,MAAM;AAAA,EACpC,QAAQ;AACN,WAAO,EAAE,IAAI,MAAM;AAAA,EACrB;AAEA,QAAM,MAAM,OAAO,MAAM;AACzB,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO,EAAE,IAAI,MAAM;AAE9C,QAAM,WAAW,MAAM,oBAAoB,eAAe,KAAK,GAAG,GAAG,MAAM;AAC3E,MAAI,CAAC,kBAAkB,UAAU,GAAG,EAAG,QAAO,EAAE,IAAI,MAAM;AAG1D,MAAI,KAAK,IAAI,IAAI,IAAK,QAAO,EAAE,IAAI,MAAM;AACzC,SAAO,EAAE,IAAI,MAAM,IAAI;AACzB;AAiBO,SAAS,2BAA2B;AAAA,EACzC;AAAA,EACA;AACF,GAG4C;AAC1C,SAAO,OAAO,YAAY;AAGxB,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,IAAI,KAAK;AAC1D,QAAI,CAAC,OAAQ,QAAO,IAAI,SAAS,eAAe,EAAE,QAAQ,IAAI,CAAC;AAC/D,QAAI;AACF,4BAAsB,MAAM;AAAA,IAC9B,QAAQ;AACN,aAAO,IAAI,SAAS,iBAAiB,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtD;AAGA,UAAM,WAAW,MAAM,gBAAgB,SAAS,EAAE,OAAO,CAAC;AAC1D,QAAI,CAAC,SAAS,GAAI,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAIlE,UAAM,MAAM,MAAM,MAAM,IAAI,SAAS,GAAG;AACxC,QAAI,CAAC,IAAK,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAE1D,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,MACvB,0BAA0B;AAAA,IAC5B;AACA,QAAI,OAAO,SAAS,IAAI,IAAI,KAAK,IAAI,QAAQ,EAAG,SAAQ,gBAAgB,IAAI,OAAO,IAAI,IAAI;AAC3F,WAAO,IAAI,SAAS,IAAI,OAAO,GAAG,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,EAC5D;AACF;","names":[]}

package/dist/design-canvas-react/index.js

@@ -42,6 +42,10 @@ import {
   formatRulerLabel,
   selectTickStep
 } from "../chunk-H5FM75MR.js";
+import {
+  DesignCanvasChromeLazy,
+  DesignCanvasLazy
+} from "../chunk-R4NOKZMD.js";
 import "../chunk-ZN5J47UX.js";
 import {
   DEFAULT_INSERT_TEMPLATES,
@@ -82,10 +86,6 @@ import {
   setPagePropsCommand,
   ungroupElementCommand
 } from "../chunk-XWJXZ6WE.js";
-import {
-  DesignCanvasChromeLazy,
-  DesignCanvasLazy
-} from "../chunk-R4NOKZMD.js";
 import "../chunk-47C6PJCW.js";
 import {
   assertSceneMediaSrc,

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export { AgentAppConfig, AgentIdentityConfig, AgentIntegrationsConfig, AgentKnow
 export { D1Like, D1PreparedLike, DrizzleColumnLike, DrizzleSqliteCoreLike, PRESET_MIGRATION_SQL, PRESET_TABLES, PresetBillingOptions, PresetKnowledgeAccessorOptions, PresetToolHandlerOptions, VaultKv, createD1KnowledgeStateAccessor, createPresetDrizzleSchema, createPresetFieldCrypto, createPresetToolHandlers, createPresetWorkspaceKeyManager, createPresetWorkspaceKeyStore } from './preset-cloudflare/index.js';
 export { KeyCrypto, KeyProvisioner, PlanLimit, PlatformBalanceInfo, PlatformBalanceManager, PlatformBalanceManagerOptions, PlatformBillingClient, PlatformIdentity, PlatformProductUsage, SharedBillingState, TcloudKeyClient, WorkspaceKeyManager, WorkspaceKeyManagerOptions, WorkspaceKeyRecord, WorkspaceKeyStore, WorkspaceModelKeyUsage, createPlatformBalanceManager, createTcloudKeyProvisioner, createWorkspaceKeyManager } from './billing/index.js';
 export { HttpHeadProbeConfig, PreflightProbe, PreflightProbeResult, PreflightProbeVerdict, PreflightReport, RouterChatProbeConfig, SandboxAuthProbeConfig, formatPreflightReport, httpHeadProbe, routerChatProbe, runPreflight, sandboxAuthProbe } from './preflight/index.js';
+export { ObjectBody, ObjectKeyParts, ObjectStore, PutObjectOptions, R2LikeBucket, R2LikeObjectBody, R2LikeObjectHead, SignObjectUrlArgs, VerifyObjectUrlResult, assertSafeKeySegment, createProxiedArtifactRoute, createR2ObjectStore, objectKey, signObjectUrl, verifyObjectUrl } from './object-store/index.js';
 export { B as BULK_DELETE_MAX_THREADS, C as ChatStoreInputError, t as threadTitleFromMessage } from './core-7qIM7svy.js';
 export { C as ChatFilePart, a as ChatImagePart, b as ChatInteractionPart, c as ChatMessagePart, d as ChatNoticePart, e as ChatPartTime, f as ChatReasoningPart, g as ChatStepFinishPart, h as ChatStepStartPart, i as ChatSubtaskPart, j as ChatTextPart, k as ChatToolPart, l as ChatToolState, m as ChatToolStatus, n as ChatUsageTokens, S as StorableHarnessPartKind, o as isChatInteractionPart, p as isChatStepFinishPart, q as isChatTextPart, r as isChatToolPart, t as toChatMessageParts } from './parts-BcbitSNp.js';
 export { DeriveKeyOptions, createFieldCrypto, decodeHexKey, decryptAesGcm, decryptBytes, decryptWithKey, deriveKey, encryptAesGcm, encryptBytes, encryptWithKey } from './crypto/index.js';

package/dist/index.js

@@ -202,11 +202,45 @@ import {
   runPreflight,
   sandboxAuthProbe
 } from "./chunk-Q4TKVF3L.js";
+import {
+  assertSafeKeySegment,
+  createProxiedArtifactRoute,
+  createR2ObjectStore,
+  objectKey,
+  signObjectUrl,
+  verifyObjectUrl
+} from "./chunk-UMSOSUEU.js";
 import {
   BULK_DELETE_MAX_THREADS,
   ChatStoreInputError,
   threadTitleFromMessage
 } from "./chunk-5EQCITY3.js";
+import {
+  TURN_EVENTS_MIGRATION_SQL,
+  TURN_STATUS_SCOPE_MIGRATION_SQL,
+  asRecord,
+  asString,
+  buildUserTextParts,
+  coalesceChatStreamEvents,
+  coalesceDeltas,
+  createBufferedTurnTap,
+  createD1TurnEventStore,
+  createMemoryTurnEventStore,
+  encodeEvent,
+  finalizeAssistantParts,
+  getPartKey,
+  mergePersistedPart,
+  messageHasTurnId,
+  normalizeClientTurnId,
+  normalizePersistedPart,
+  normalizeTime,
+  normalizeToolEvent,
+  pumpBufferedTurn,
+  replayTurnEvents,
+  resolveChatTurn,
+  resolveToolId,
+  resolveToolName
+} from "./chunk-XYWCGFII.js";
 import {
   createInteractionAnswerRoute,
   listSessionInteractions,
@@ -266,32 +300,6 @@ import {
   encryptBytes,
   encryptWithKey
 } from "./chunk-TA5Q4I2K.js";
-import {
-  TURN_EVENTS_MIGRATION_SQL,
-  TURN_STATUS_SCOPE_MIGRATION_SQL,
-  asRecord,
-  asString,
-  buildUserTextParts,
-  coalesceChatStreamEvents,
-  coalesceDeltas,
-  createBufferedTurnTap,
-  createD1TurnEventStore,
-  createMemoryTurnEventStore,
-  encodeEvent,
-  finalizeAssistantParts,
-  getPartKey,
-  mergePersistedPart,
-  messageHasTurnId,
-  normalizeClientTurnId,
-  normalizePersistedPart,
-  normalizeTime,
-  normalizeToolEvent,
-  pumpBufferedTurn,
-  replayTurnEvents,
-  resolveChatTurn,
-  resolveToolId,
-  resolveToolName
-} from "./chunk-XYWCGFII.js";
 import {
   createKnowledgeLoop,
   createReviewerDecider,
@@ -353,7 +361,7 @@ import {
   verifySandboxTerminalToken,
   verifyTerminalProxyToken,
   writeProfileFilesToBox
-} from "./chunk-H4WCEZE3.js";
+} from "./chunk-5GWXCSLQ.js";
 import {
   DEFAULT_HARNESS,
   KNOWN_HARNESSES,
@@ -374,7 +382,7 @@ import {
   restrictTaxonomy,
   verifyCapabilityToken,
   verifyExpiringCapabilityToken
-} from "./chunk-3II3AWHY.js";
+} from "./chunk-PJC4NXPA.js";
 import {
   DEFAULT_APP_TOOL_PATHS,
   DEFAULT_HEADER_NAMES,
@@ -386,6 +394,7 @@ import {
   createMcpToolHandler,
   readToolArgs
 } from "./chunk-7EVZUIHW.js";
+import "./chunk-S5SRJJQG.js";
 import {
   buildConsentUrl,
   createBrokerTokenProvider
@@ -523,6 +532,7 @@ export {
   assertMediaUrl,
   assertPositiveFinite,
   assertProvisionPayloadWithinCap,
+  assertSafeKeySegment,
   assertSceneMediaSrc,
   assertSequenceMediaUrl,
   attachReasoningEffort,
@@ -604,6 +614,8 @@ export {
   createPresetToolHandlers,
   createPresetWorkspaceKeyManager,
   createPresetWorkspaceKeyStore,
+  createProxiedArtifactRoute,
+  createR2ObjectStore,
   createReviewerDecider,
   createSandboxTerminalToken,
   createSequencesMcpHandler,
@@ -711,6 +723,7 @@ export {
   normalizeToolEvent,
   noticePart,
   noticePartKey,
+  objectKey,
   outcomeStatus,
   parseAssetSpec,
   parseInteractionCancel,
@@ -772,6 +785,7 @@ export {
   secondsToFrames,
   secretStoreFromClient,
   serializeCookie,
+  signObjectUrl,
   snapHarnessToModel,
   snapModelToHarness,
   snapshotFrame,
@@ -819,6 +833,7 @@ export {
   verifyCapabilityToken,
   verifyCompletion,
   verifyExpiringCapabilityToken,
+  verifyObjectUrl,
   verifySandboxTerminalToken,
   verifyTerminalProxyToken,
   volumeGateProposalId,

package/dist/object-store/index.d.ts

@@ -0,0 +1,202 @@
+/**
+ * `/object-store` — a portable, secure object store for durable large
+ * attachments (uploaded PDFs, images, exports) that are too big to ride a chat
+ * turn body or live in KV.
+ *
+ * SECURITY POSTURE (this module guards a legal privilege wall). Every object key
+ * carries an operator segment and a customer segment, and access is by a
+ * short-lived HMAC-signed URL whose signature covers the EXACT key (operator +
+ * customer + upload id + filename) AND the expiry. A tampered key, a swapped
+ * customer segment, or a replayed-after-expiry URL all fail the signature or the
+ * expiry check and are refused. The signing secret is a PARAMETER on every call
+ * — this module reads NOTHING global (no `process.env`, no ambient config); if a
+ * product forgets to bind the secret, {@link verifyObjectUrl} fails closed and
+ * {@link signObjectUrl} throws rather than minting an unsigned URL.
+ *
+ * PURE MECHANISM behind two seams: an {@link ObjectStore} port (the R2 impl maps
+ * 1:1 to a bucket held behind the structural {@link R2LikeBucket} — so
+ * `@cloudflare/workers-types` never leaks into this package's public `.d.ts`)
+ * and the signing `secret`. Reads and writes STREAM: {@link createR2ObjectStore}
+ * returns the R2 object's `.body` stream directly and never calls
+ * `.text()`/`.arrayBuffer()`, so a 15 MB PDF flows through the worker without
+ * buffering the whole file into the isolate's heap.
+ *
+ * RECONCILIATION with the sandbox `storage` seam (`../sandbox` →
+ * `SandboxRuntimeConfig.storage`): that is BYOS3/R2 *snapshot* storage — it
+ * checkpoints and restores a sandbox box's filesystem for durable session
+ * execution. This is a DIFFERENT concern: a content-addressed store for
+ * user-facing attachments gated by a signed-URL privilege wall. They are not
+ * interchangeable and must not be merged: one persists agent runtime state, the
+ * other serves per-operator/per-customer documents to browsers. Do not route
+ * artifact downloads through the snapshot bucket, or vice versa.
+ */
+/** Options for a single {@link ObjectStore.put}. Both fields are optional; a
+ *  store that needs a fixed content length (e.g. R2 with a `ReadableStream`
+ *  body) uses `contentLength` when present. */
+interface PutObjectOptions {
+    /** MIME type recorded with the object (returned by `get`/`head`). Advisory:
+     *  the proxied download route always serves `application/octet-stream`. */
+    contentType?: string;
+    /** Byte length of `body`, when known. Some backends require it for a
+     *  streamed body; the R2 impl passes a known length through when supplied. */
+    contentLength?: number;
+}
+/** A retrieved object. `stream()` is the ONLY way to read the bytes — there is
+ *  deliberately no `text()`/`arrayBuffer()`, so a large object never buffers
+ *  into the isolate heap. */
+interface ObjectBody {
+    /** The object's bytes as a `ReadableStream` (backed by R2's `.body`). */
+    stream(): ReadableStream;
+    /** Size in bytes. */
+    size: number;
+    /** Recorded MIME type, if any. */
+    contentType?: string;
+}
+/**
+ * Portable object-store port. `get`/`head` return `null` on a miss and NEVER
+ * throw for a missing key (a miss is a normal control-flow outcome, not an
+ * error); `delete` is idempotent.
+ */
+interface ObjectStore {
+    put(key: string, body: ReadableStream | Uint8Array, opts?: PutObjectOptions): Promise<void>;
+    /** `null` on a miss — never throws for a missing key. */
+    get(key: string): Promise<ObjectBody | null>;
+    /** `null` on a miss — never throws for a missing key. */
+    head(key: string): Promise<{
+        size: number;
+        contentType?: string;
+    } | null>;
+    delete(key: string): Promise<void>;
+}
+/** Head/metadata shape of a stored object (structural match of R2's `R2Object`). */
+interface R2LikeObjectHead {
+    size: number;
+    httpMetadata?: {
+        contentType?: string;
+    };
+}
+/** Body shape of a retrieved object (structural match of R2's `R2ObjectBody`).
+ *  `body` is the streamed content — the impl reads this, never `.text()`. */
+interface R2LikeObjectBody extends R2LikeObjectHead {
+    body: ReadableStream;
+}
+/**
+ * The minimal slice of Cloudflare's `R2Bucket` this module calls. A real
+ * `R2Bucket` satisfies it structurally, so the consumer passes its binding
+ * without this package ever importing `@cloudflare/workers-types` (which would
+ * otherwise leak into the public `.d.ts`).
+ */
+interface R2LikeBucket {
+    put(key: string, value: ReadableStream | Uint8Array | ArrayBuffer, options?: {
+        httpMetadata?: {
+            contentType?: string;
+        };
+    }): Promise<unknown>;
+    get(key: string): Promise<R2LikeObjectBody | null>;
+    head(key: string): Promise<R2LikeObjectHead | null>;
+    delete(key: string): Promise<void>;
+}
+/**
+ * Map the {@link ObjectStore} port onto an R2 bucket 1:1. `get` STREAMS: it
+ * returns the R2 object's `.body` behind `ObjectBody.stream()` and never calls
+ * `.text()`/`.arrayBuffer()`, so a large file flows through the worker rather
+ * than buffering into the isolate.
+ */
+declare function createR2ObjectStore({ bucket }: {
+    bucket: R2LikeBucket;
+}): ObjectStore;
+/**
+ * Assert a single object-key path SEGMENT (an operator id, customer id, or
+ * upload id) is safe to interpolate into a key, and return it. Throws on the
+ * traversal / injection shapes: `..` anywhere, a leading `/`, a backslash, or an
+ * empty segment. Consumers should call this on caller-supplied identifiers
+ * BEFORE any `get`/`put` so an attacker-controlled id can never widen the key
+ * beyond its own operator+customer prefix.
+ */
+declare function assertSafeKeySegment(s: string): string;
+/** Inputs to {@link objectKey}. `customerId` is optional — an unattributed
+ *  upload lands under the reserved `_unattributed` customer segment. */
+interface ObjectKeyParts {
+    operatorId: string;
+    /** Optional — omitted/undefined groups the upload under `_unattributed`. */
+    customerId?: string;
+    uploadId: string;
+    filename: string;
+}
+/**
+ * Build the canonical object key: `operator/customer/upload-filename`. The
+ * operator, customer, and upload segments are asserted safe (throwing on
+ * traversal); the filename is sanitized to a safe leaf. The customer segment
+ * falls back to `_unattributed` when no customer is attributed. Because a signed
+ * URL binds the EXACT key, the operator and customer segments are part of the
+ * privilege wall — a caller cannot later swap them without breaking the
+ * signature.
+ */
+declare function objectKey({ operatorId, customerId, uploadId, filename }: ObjectKeyParts): string;
+/** Arguments to {@link signObjectUrl}. */
+interface SignObjectUrlArgs {
+    /** The exact object key to authorize (from {@link objectKey}). */
+    key: string;
+    /** Absolute expiry in epoch MILLISECONDS (e.g. `Date.now() + 5 * 60_000` for a
+     *  ~5-minute TTL — the recommended default; keep it short). */
+    exp: number;
+    /** HMAC signing secret. Must be non-empty — signing fails closed otherwise. */
+    secret: string;
+}
+/**
+ * Mint a signed query string (`?key=…&exp=…&sig=…`) authorizing a download of
+ * `key` until `exp`. The product appends it to its artifact route path
+ * (`` `/artifacts${await signObjectUrl(...)}` ``); {@link createProxiedArtifactRoute}
+ * / {@link verifyObjectUrl} read it straight off the request URL, so the route's
+ * own mount path never matters.
+ *
+ * FAIL-CLOSED: throws if `secret` is empty (never mints an unsigned URL) and if
+ * `key` is unsafe (traversal). Async because the HMAC primitive is WebCrypto.
+ *
+ * TTL: `exp` is caller-supplied on purpose (the caller knows the sensitivity);
+ * keep it SHORT — ~5 minutes is the recommended default for a privilege-walled
+ * document.
+ */
+declare function signObjectUrl({ key, exp, secret }: SignObjectUrlArgs): Promise<string>;
+/** Result of {@link verifyObjectUrl}: the canonical key on success, nothing
+ *  distinguishing on failure (so a rejection leaks no detail). */
+type VerifyObjectUrlResult = {
+    ok: true;
+    key: string;
+} | {
+    ok: false;
+};
+/**
+ * Verify a signed download request. Reads `key`/`exp`/`sig` off the request URL,
+ * canonicalizes the key identically to the signer, recomputes the HMAC and
+ * constant-time-compares it, and checks the expiry. Returns the canonical key on
+ * success.
+ *
+ * FAIL-CLOSED everywhere: an empty `secret`, a missing/ malformed parameter, a
+ * non-finite expiry, a signature mismatch, or an expired URL all return
+ * `{ ok: false }` — and the mismatch path uses a constant-time compare so a
+ * near-correct signature is not distinguishable by timing. Async because the
+ * HMAC primitive is WebCrypto.
+ */
+declare function verifyObjectUrl(request: Request, { secret }: {
+    secret: string;
+}): Promise<VerifyObjectUrlResult>;
+/**
+ * Build a download handler that verifies a signed request and STREAMS the object
+ * back with a conservative, non-executable content type. Status contract:
+ *
+ * - `400` — the `key` is missing or malformed (bad encoding / traversal). This
+ *   is an unauthenticated client error and leaks NOTHING about object existence.
+ * - `403` — the signature is missing, wrong, or expired.
+ * - `404` — the signature was valid but no object exists at that key (existence
+ *   is only ever revealed to a validly-signed request).
+ * - `200` — streams the bytes with `Content-Disposition: attachment`,
+ *   `Content-Type: application/octet-stream`, and `X-Content-Type-Options:
+ *   nosniff`, so the worker never serves active/inline content.
+ */
+declare function createProxiedArtifactRoute({ store, secret, }: {
+    store: ObjectStore;
+    secret: string;
+}): (request: Request) => Promise<Response>;
+
+export { type ObjectBody, type ObjectKeyParts, type ObjectStore, type PutObjectOptions, type R2LikeBucket, type R2LikeObjectBody, type R2LikeObjectHead, type SignObjectUrlArgs, type VerifyObjectUrlResult, assertSafeKeySegment, createProxiedArtifactRoute, createR2ObjectStore, objectKey, signObjectUrl, verifyObjectUrl };

package/dist/object-store/index.js

@@ -0,0 +1,18 @@
+import {
+  assertSafeKeySegment,
+  createProxiedArtifactRoute,
+  createR2ObjectStore,
+  objectKey,
+  signObjectUrl,
+  verifyObjectUrl
+} from "../chunk-UMSOSUEU.js";
+import "../chunk-S5SRJJQG.js";
+export {
+  assertSafeKeySegment,
+  createProxiedArtifactRoute,
+  createR2ObjectStore,
+  objectKey,
+  signObjectUrl,
+  verifyObjectUrl
+};
+//# sourceMappingURL=index.js.map

package/dist/object-store/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/sandbox/index.js

@@ -54,10 +54,11 @@ import {
   verifySandboxTerminalToken,
   verifyTerminalProxyToken,
   writeProfileFilesToBox
-} from "../chunk-H4WCEZE3.js";
+} from "../chunk-5GWXCSLQ.js";
 import "../chunk-E7QYOOON.js";
-import "../chunk-3II3AWHY.js";
+import "../chunk-PJC4NXPA.js";
 import "../chunk-7EVZUIHW.js";
+import "../chunk-S5SRJJQG.js";
 import "../chunk-7W5XSTUF.js";
 import "../chunk-MFRCM32T.js";
 export {

package/dist/teams-react/index.js

@@ -1,12 +1,12 @@
+import {
+  MembersPanel
+} from "../chunk-GNL3MG5J.js";
 import {
   InvitationsPanel
 } from "../chunk-7C64WKAH.js";
 import {
   InviteAcceptPage
 } from "../chunk-VCPZ3HTN.js";
-import {
-  MembersPanel
-} from "../chunk-GNL3MG5J.js";
 import "../chunk-63CE7FEZ.js";
 export {
   InvitationsPanel,

package/dist/tools/index.js

@@ -6,7 +6,7 @@ import {
   restrictTaxonomy,
   verifyCapabilityToken,
   verifyExpiringCapabilityToken
-} from "../chunk-3II3AWHY.js";
+} from "../chunk-PJC4NXPA.js";
 import {
   DEFAULT_APP_TOOL_PATHS,
   DEFAULT_HEADER_NAMES,
@@ -18,6 +18,7 @@ import {
   createMcpToolHandler,
   readToolArgs
 } from "../chunk-7EVZUIHW.js";
+import "../chunk-S5SRJJQG.js";
 import {
   APP_TOOL_NAMES,
   ToolInputError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-app",
-  "version": "0.43.38",
+  "version": "0.43.40",
   "packageManager": "pnpm@10.33.4",
   "description": "Application-shell framework for Tangle agent products: a bounded tool loop, the structured agent→app tool side channel, integration-hub client, per-workspace billing, and crypto — composed over the Tangle agent substrate through typed seams.",
   "keywords": [
@@ -147,6 +147,11 @@
       "import": "./dist/preflight/index.js",
       "default": "./dist/preflight/index.js"
     },
+    "./object-store": {
+      "types": "./dist/object-store/index.d.ts",
+      "import": "./dist/object-store/index.js",
+      "default": "./dist/object-store/index.js"
+    },
     "./chat-store": {
       "types": "./dist/chat-store/index.d.ts",
       "import": "./dist/chat-store/index.js",

package/dist/chunk-3II3AWHY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/crypto/web-token.ts","../src/tools/capability.ts","../src/tools/gating.ts","../src/tools/http.ts"],"sourcesContent":["/**\n * Dependency-free WebCrypto primitives for HMAC-signed, base64url-encoded\n * tokens — base64url encode/decode, HMAC-SHA256, and a constant-time compare.\n * Runs on Cloudflare Workers, Node, and the browser with no Node `crypto`\n * dependency. Shared by the sandbox terminal-proxy token, the WS-upgrade token\n * parser, and the app-tool capability token so the logic lives in one place\n * rather than three near-identical private copies.\n *\n * Internal leaf: not exported from the `/crypto` barrel (that subpath is the\n * AES-GCM field-crypto surface); imported directly by the modules that need it.\n */\n\n/** base64url-encode raw bytes (RFC 4648 §5, no padding). */\nexport function base64UrlEncode(bytes: Uint8Array): string {\n  let bin = ''\n  for (const b of bytes) bin += String.fromCharCode(b)\n  return btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\n/** base64url-encode a UTF-8 string. */\nexport function base64UrlEncodeText(text: string): string {\n  return base64UrlEncode(new TextEncoder().encode(text))\n}\n\n/** Decode a base64url string back to its UTF-8 text. Re-pads before `atob` so\n *  unpadded input decodes correctly regardless of the runtime's leniency. */\nexport function base64UrlDecodeText(value: string): string {\n  const padded = value.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(value.length / 4) * 4, '=')\n  const bin = atob(padded)\n  const bytes = new Uint8Array(bin.length)\n  for (let i = 0; i < bin.length; i += 1) bytes[i] = bin.charCodeAt(i)\n  return new TextDecoder().decode(bytes)\n}\n\n/** HMAC-SHA256 `message` under `secret`, returned base64url-encoded. */\nexport async function hmacSha256Base64Url(message: string, secret: string): Promise<string> {\n  const enc = new TextEncoder()\n  const key = await crypto.subtle.importKey('raw', enc.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n  const sig = await crypto.subtle.sign('HMAC', key, enc.encode(message))\n  return base64UrlEncode(new Uint8Array(sig))\n}\n\n/** Length-independent-leak-free compare of two same-charset strings. */\nexport function constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let diff = 0\n  for (let i = 0; i < a.length; i += 1) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return diff === 0\n}\n","/**\n * Per-user capability token — the sandbox→app auth primitive behind the\n * `verifyToken` seam in {@link authenticateToolRequest}.\n *\n * An app-agent runs inside the sandbox and reaches the host app back over HTTP\n * (the app tools, the integration-invoke bridge). The route must act AS the\n * connecting user without trusting any model-supplied identity, so the turn\n * mints a short HMAC token bound to the user id and bakes it into the per-turn\n * MCP server header; the route verifies it to recover the user.\n *\n * `HMAC-SHA256(secret, \"user:<userId>\")`, base64url, with an app-chosen prefix.\n * The token encodes no scopes — the hub's policy engine authorizes per action.\n * Fail-closed: with no secret, no token is minted (the caller MUST omit the MCP\n * server rather than fake an authorized call). WebCrypto only — runs on\n * Workers, Node, and the browser with no Node `crypto` dependency.\n */\n\nimport {\n  base64UrlDecodeText,\n  base64UrlEncodeText,\n  constantTimeEqual,\n  hmacSha256Base64Url,\n} from '../crypto/web-token'\n\nexport interface CapabilityTokenOptions {\n  /** Shared HMAC secret. When absent, mint returns undefined / verify returns false. */\n  secret?: string\n  /** Token prefix (namespaces the credential; lets verify reject foreign tokens\n   *  cheaply). Default `cap_`. */\n  prefix?: string\n}\n\n/** Mint a capability token for `userId`, or `undefined` when no secret is\n *  configured (fail-closed — the caller omits the MCP server rather than fake it). */\nexport async function createCapabilityToken(userId: string, opts: CapabilityTokenOptions): Promise<string | undefined> {\n  const secret = opts.secret?.trim()\n  if (!secret) return undefined\n  const prefix = opts.prefix ?? 'cap_'\n  return `${prefix}${await sign(userId, secret)}`\n}\n\n/** Verify a capability token against `userId`. Returns false (never throws) for\n *  an unconfigured secret, a wrong prefix, a malformed token, or a mismatch. */\nexport async function verifyCapabilityToken(userId: string, token: string, opts: CapabilityTokenOptions): Promise<boolean> {\n  const secret = opts.secret?.trim()\n  const prefix = opts.prefix ?? 'cap_'\n  if (!secret || !token.startsWith(prefix)) return false\n  const expected = `${prefix}${await sign(userId, secret)}`\n  return constantTimeEqual(token, expected)\n}\n\nexport interface ExpiringCapabilityTokenOptions extends CapabilityTokenOptions {\n  /** Token lifetime. Expired tokens verify false regardless of signature. */\n  expiresInMs: number\n  /** Clock injection for tests; defaults to Date.now. */\n  now?: () => number\n}\n\n/**\n * Mint an EXPIRING capability token: `<prefix><base64url(payload)>.<sig>` where\n * the payload carries `{ sub, exp, n }` (subject, epoch-ms expiry, random\n * nonce) and the signature is HMAC-SHA256 over the encoded payload. Use this\n * for user-initiated scoped channels (e.g. a per-sequence MCP endpoint) where\n * a captured token must not stay valid past its window; the bare\n * {@link createCapabilityToken} remains for turn-scoped tool bridges whose\n * mint+verify happen inside one request cycle. Fail-closed like the bare\n * variant: no secret → no token.\n */\nexport async function createExpiringCapabilityToken(subject: string, opts: ExpiringCapabilityTokenOptions): Promise<string | undefined> {\n  const secret = opts.secret?.trim()\n  if (!secret) return undefined\n  if (!Number.isFinite(opts.expiresInMs) || opts.expiresInMs <= 0) throw new Error('expiresInMs must be a positive number')\n  const prefix = opts.prefix ?? 'cap_'\n  const now = opts.now ?? Date.now\n  const payload = base64UrlEncodeText(JSON.stringify({ sub: subject, exp: now() + opts.expiresInMs, n: crypto.randomUUID() }))\n  return `${prefix}${payload}.${await hmacSha256Base64Url(payload, secret)}`\n}\n\n/** Verify an expiring token against `subject`: prefix, payload integrity,\n *  subject match, and expiry all checked; returns false (never throws) on any\n *  failure including a malformed payload. */\nexport async function verifyExpiringCapabilityToken(subject: string, token: string, opts: CapabilityTokenOptions & { now?: () => number }): Promise<boolean> {\n  const secret = opts.secret?.trim()\n  const prefix = opts.prefix ?? 'cap_'\n  if (!secret || !token.startsWith(prefix)) return false\n  const body = token.slice(prefix.length)\n  const dot = body.lastIndexOf('.')\n  if (dot <= 0 || dot === body.length - 1) return false\n  const payload = body.slice(0, dot)\n  const sig = body.slice(dot + 1)\n  if (!constantTimeEqual(sig, await hmacSha256Base64Url(payload, secret))) return false\n  let parsed: { sub?: unknown; exp?: unknown }\n  try {\n    parsed = JSON.parse(base64UrlDecodeText(payload)) as { sub?: unknown; exp?: unknown }\n  } catch {\n    return false\n  }\n  if (parsed.sub !== subject) return false\n  if (typeof parsed.exp !== 'number') return false\n  const now = opts.now ?? Date.now\n  return parsed.exp > now()\n}\n\nasync function sign(userId: string, secret: string): Promise<string> {\n  return hmacSha256Base64Url(`user:${userId}`, secret)\n}\n","/**\n * Capability gating — compose an agent session's tool surface from a\n * product-defined capability registry.\n *\n * Products that let users pick what an agent can do (a \"Studio\" agent with the\n * full build toolset vs a clean \"Assistant\" with none) all need the same\n * mechanics: a registry of named capabilities, each unlocking proposal types\n * and/or named tool groups, resolved against the product's\n * {@link AppToolTaxonomy} into the concrete tools to expose. The mechanics are\n * generic and live here; the capability VOCABULARY (ids, labels, which\n * proposal types, which tool groups) is the product's.\n */\n\nimport type { AppToolTaxonomy } from './types'\n\n/** One toggleable tool group in a product's capability registry. */\nexport interface ToolCapability {\n  id: string\n  label: string\n  description: string\n  /** Proposal types this capability unlocks (intersected with the taxonomy,\n   *  so a capability can never widen the product's proposal surface). */\n  proposalTypes?: readonly string[]\n  /** Unlocks every taxonomy proposal type beyond the base set — the domain's\n   *  specialized long tail (risk_assessment, vuln_report, …). */\n  domainActions?: boolean\n  /** Named product tool groups (e.g. 'sandbox', 'integrations') this\n   *  capability unlocks. The vocabulary is the product's; the resolver only\n   *  unions them. */\n  toolGroups?: readonly string[]\n}\n\nexport interface ResolveToolCapabilitiesOptions {\n  taxonomy: AppToolTaxonomy\n  /** The product's full capability registry. */\n  capabilities: readonly ToolCapability[]\n  /** Enabled capability ids. `undefined` means full access (legacy callers\n   *  that don't send a capability set); an explicit `[]` means a pure chat\n   *  agent with no tools. Unknown ids are ignored. */\n  enabled: readonly string[] | undefined\n  /** The shared base proposal types `domainActions` excludes. Defaults to\n   *  every type some capability names explicitly via `proposalTypes` — i.e.\n   *  \"domain actions\" are the taxonomy types no capability claims. */\n  baseProposalTypes?: readonly string[]\n}\n\nexport interface ResolvedToolCapabilities {\n  /** Proposal types to keep — feed to {@link restrictTaxonomy}. */\n  proposalTypes: string[]\n  /** Product tool groups to expose (deduped union across enabled caps). */\n  toolGroups: string[]\n}\n\n/**\n * Resolve an enabled capability-id set against a taxonomy into the concrete\n * tool surface. Fail-closed: only types present in the taxonomy survive, and\n * an empty `enabled` set yields no tools at all.\n */\nexport function resolveToolCapabilities(\n  opts: ResolveToolCapabilitiesOptions,\n): ResolvedToolCapabilities {\n  const { taxonomy, capabilities, enabled } = opts\n  if (enabled === undefined) {\n    return {\n      proposalTypes: [...taxonomy.proposalTypes],\n      toolGroups: [...new Set(capabilities.flatMap((c) => c.toolGroups ?? []))],\n    }\n  }\n  const base = new Set(\n    opts.baseProposalTypes ?? capabilities.flatMap((c) => c.proposalTypes ?? []),\n  )\n  const domainTypes = taxonomy.proposalTypes.filter((t) => !base.has(t))\n  const byId = new Map(capabilities.map((c) => [c.id, c]))\n\n  const proposalTypes = new Set<string>()\n  const toolGroups = new Set<string>()\n  for (const id of enabled) {\n    const cap = byId.get(id)\n    if (!cap) continue\n    for (const t of cap.proposalTypes ?? []) {\n      if (taxonomy.proposalTypes.includes(t)) proposalTypes.add(t)\n    }\n    if (cap.domainActions) for (const t of domainTypes) proposalTypes.add(t)\n    for (const g of cap.toolGroups ?? []) toolGroups.add(g)\n  }\n  return { proposalTypes: [...proposalTypes], toolGroups: [...toolGroups] }\n}\n\n/**\n * Restrict a taxonomy to a subset of proposal types, intersecting the\n * regulated subset too — the regulated label survives restriction, so a\n * narrowed agent can never launder a regulated type into an unregulated one.\n */\nexport function restrictTaxonomy(\n  taxonomy: AppToolTaxonomy,\n  allowed: readonly string[],\n): AppToolTaxonomy {\n  const allow = new Set(allowed)\n  return {\n    proposalTypes: taxonomy.proposalTypes.filter((t) => allow.has(t)),\n    regulatedTypes: taxonomy.regulatedTypes.filter((t) => allow.has(t)),\n  }\n}\n","import { authenticateToolRequest, type ToolHeaderNames } from './auth'\nimport { dispatchAppTool, outcomeStatus, type DispatchOptions } from './dispatch'\nimport type { AppToolName } from './openai'\nimport type { AppToolDefinition } from './registry'\n\nexport interface HandleToolRequestOptions extends DispatchOptions {\n  /** Which app tool this route serves — a built-in name or a product-registered\n   *  {@link AppToolDefinition} (auto-added to `customTools` for dispatch). */\n  tool: AppToolName | AppToolDefinition\n  /** Verify the bearer capability token belongs to the header user. */\n  verifyToken: (userId: string, bearer: string) => Promise<boolean>\n  headerNames?: ToolHeaderNames\n  /** Optional success-message builder for a friendlier tool result. */\n  message?: (result: unknown) => string\n}\n\n/**\n * Handle one app-tool HTTP request end to end — the sandbox MCP path. The\n * agent's per-turn HTTP MCP server POSTs here; this authenticates (header user\n * + capability token), reads the args (MCP-alias tolerant), dispatches to the\n * product handler, and returns a JSON Response. A product's route file becomes\n * a one-liner: `export const action = ({ request }) => handleAppToolRequest(request, cfg)`.\n */\nexport async function handleAppToolRequest(request: Request, opts: HandleToolRequestOptions): Promise<Response> {\n  if (request.method !== 'POST') return Response.json({ error: 'Method not allowed' }, { status: 405 })\n\n  const auth = await authenticateToolRequest(request, { verifyToken: opts.verifyToken, headerNames: opts.headerNames })\n  if (!auth.ok) return auth.response\n\n  let body: { args?: Record<string, unknown>; arguments?: Record<string, unknown> } & Record<string, unknown>\n  try {\n    body = (await request.json()) as typeof body\n  } catch {\n    return Response.json({ error: 'Invalid JSON' }, { status: 400 })\n  }\n  const args = (body.args ?? body.arguments ?? body) as Record<string, unknown>\n\n  // A custom tool passed as `tool` is registered for this dispatch so the route\n  // file stays a one-liner (no separate customTools wiring needed).\n  const toolName = typeof opts.tool === 'string' ? opts.tool : opts.tool.name\n  const customTools =\n    typeof opts.tool === 'string' ? opts.customTools : [...(opts.customTools ?? []), opts.tool]\n  const outcome = await dispatchAppTool(toolName, args, auth.ctx, { ...opts, customTools })\n  if (!outcome.ok) {\n    return Response.json({ error: outcome.code, message: outcome.message }, { status: outcomeStatus(outcome) })\n  }\n  const payload = outcome.result as Record<string, unknown>\n  return Response.json({ ok: true, ...payload, ...(opts.message ? { message: opts.message(outcome.result) } : {}) })\n}\n"],"mappings":";;;;;;;;;AAaO,SAAS,gBAAgB,OAA2B;AACzD,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,OAAO,aAAa,CAAC;AACnD,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAGO,SAAS,oBAAoB,MAAsB;AACxD,SAAO,gBAAgB,IAAI,YAAY,EAAE,OAAO,IAAI,CAAC;AACvD;AAIO,SAAS,oBAAoB,OAAuB;AACzD,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,EAAE,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC,IAAI,GAAG,GAAG;AACtG,QAAM,MAAM,KAAK,MAAM;AACvB,QAAM,QAAQ,IAAI,WAAW,IAAI,MAAM;AACvC,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK,EAAG,OAAM,CAAC,IAAI,IAAI,WAAW,CAAC;AACnE,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAGA,eAAsB,oBAAoB,SAAiB,QAAiC;AAC1F,QAAM,MAAM,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,IAAI,OAAO,MAAM,GAAG,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AACvH,QAAM,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,OAAO,OAAO,CAAC;AACrE,SAAO,gBAAgB,IAAI,WAAW,GAAG,CAAC;AAC5C;AAGO,SAAS,kBAAkB,GAAW,GAAoB;AAC/D,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK,EAAG,SAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAC9E,SAAO,SAAS;AAClB;;;ACdA,eAAsB,sBAAsB,QAAgB,MAA2D;AACrH,QAAM,SAAS,KAAK,QAAQ,KAAK;AACjC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,SAAS,KAAK,UAAU;AAC9B,SAAO,GAAG,MAAM,GAAG,MAAM,KAAK,QAAQ,MAAM,CAAC;AAC/C;AAIA,eAAsB,sBAAsB,QAAgB,OAAe,MAAgD;AACzH,QAAM,SAAS,KAAK,QAAQ,KAAK;AACjC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,UAAU,CAAC,MAAM,WAAW,MAAM,EAAG,QAAO;AACjD,QAAM,WAAW,GAAG,MAAM,GAAG,MAAM,KAAK,QAAQ,MAAM,CAAC;AACvD,SAAO,kBAAkB,OAAO,QAAQ;AAC1C;AAmBA,eAAsB,8BAA8B,SAAiB,MAAmE;AACtI,QAAM,SAAS,KAAK,QAAQ,KAAK;AACjC,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,CAAC,OAAO,SAAS,KAAK,WAAW,KAAK,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,uCAAuC;AACxH,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,QAAM,UAAU,oBAAoB,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,IAAI,IAAI,KAAK,aAAa,GAAG,OAAO,WAAW,EAAE,CAAC,CAAC;AAC3H,SAAO,GAAG,MAAM,GAAG,OAAO,IAAI,MAAM,oBAAoB,SAAS,MAAM,CAAC;AAC1E;AAKA,eAAsB,8BAA8B,SAAiB,OAAe,MAAyE;AAC3J,QAAM,SAAS,KAAK,QAAQ,KAAK;AACjC,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,UAAU,CAAC,MAAM,WAAW,MAAM,EAAG,QAAO;AACjD,QAAM,OAAO,MAAM,MAAM,OAAO,MAAM;AACtC,QAAM,MAAM,KAAK,YAAY,GAAG;AAChC,MAAI,OAAO,KAAK,QAAQ,KAAK,SAAS,EAAG,QAAO;AAChD,QAAM,UAAU,KAAK,MAAM,GAAG,GAAG;AACjC,QAAM,MAAM,KAAK,MAAM,MAAM,CAAC;AAC9B,MAAI,CAAC,kBAAkB,KAAK,MAAM,oBAAoB,SAAS,MAAM,CAAC,EAAG,QAAO;AAChF,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,oBAAoB,OAAO,CAAC;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,QAAQ,QAAS,QAAO;AACnC,MAAI,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC3C,QAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,SAAO,OAAO,MAAM,IAAI;AAC1B;AAEA,eAAe,KAAK,QAAgB,QAAiC;AACnE,SAAO,oBAAoB,QAAQ,MAAM,IAAI,MAAM;AACrD;;;AC/CO,SAAS,wBACd,MAC0B;AAC1B,QAAM,EAAE,UAAU,cAAc,QAAQ,IAAI;AAC5C,MAAI,YAAY,QAAW;AACzB,WAAO;AAAA,MACL,eAAe,CAAC,GAAG,SAAS,aAAa;AAAA,MACzC,YAAY,CAAC,GAAG,IAAI,IAAI,aAAa,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;AAAA,IAC1E;AAAA,EACF;AACA,QAAM,OAAO,IAAI;AAAA,IACf,KAAK,qBAAqB,aAAa,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAAA,EAC7E;AACA,QAAM,cAAc,SAAS,cAAc,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;AACrE,QAAM,OAAO,IAAI,IAAI,aAAa,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAEvD,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,MAAM,SAAS;AACxB,UAAM,MAAM,KAAK,IAAI,EAAE;AACvB,QAAI,CAAC,IAAK;AACV,eAAW,KAAK,IAAI,iBAAiB,CAAC,GAAG;AACvC,UAAI,SAAS,cAAc,SAAS,CAAC,EAAG,eAAc,IAAI,CAAC;AAAA,IAC7D;AACA,QAAI,IAAI,cAAe,YAAW,KAAK,YAAa,eAAc,IAAI,CAAC;AACvE,eAAW,KAAK,IAAI,cAAc,CAAC,EAAG,YAAW,IAAI,CAAC;AAAA,EACxD;AACA,SAAO,EAAE,eAAe,CAAC,GAAG,aAAa,GAAG,YAAY,CAAC,GAAG,UAAU,EAAE;AAC1E;AAOO,SAAS,iBACd,UACA,SACiB;AACjB,QAAM,QAAQ,IAAI,IAAI,OAAO;AAC7B,SAAO;AAAA,IACL,eAAe,SAAS,cAAc,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC;AAAA,IAChE,gBAAgB,SAAS,eAAe,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC;AAAA,EACpE;AACF;;;AC/EA,eAAsB,qBAAqB,SAAkB,MAAmD;AAC9G,MAAI,QAAQ,WAAW,OAAQ,QAAO,SAAS,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEpG,QAAM,OAAO,MAAM,wBAAwB,SAAS,EAAE,aAAa,KAAK,aAAa,aAAa,KAAK,YAAY,CAAC;AACpH,MAAI,CAAC,KAAK,GAAI,QAAO,KAAK;AAE1B,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,QAAQ,KAAK;AAAA,EAC7B,QAAQ;AACN,WAAO,SAAS,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjE;AACA,QAAM,OAAQ,KAAK,QAAQ,KAAK,aAAa;AAI7C,QAAM,WAAW,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,KAAK,KAAK;AACvE,QAAM,cACJ,OAAO,KAAK,SAAS,WAAW,KAAK,cAAc,CAAC,GAAI,KAAK,eAAe,CAAC,GAAI,KAAK,IAAI;AAC5F,QAAM,UAAU,MAAM,gBAAgB,UAAU,MAAM,KAAK,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC;AACxF,MAAI,CAAC,QAAQ,IAAI;AACf,WAAO,SAAS,KAAK,EAAE,OAAO,QAAQ,MAAM,SAAS,QAAQ,QAAQ,GAAG,EAAE,QAAQ,cAAc,OAAO,EAAE,CAAC;AAAA,EAC5G;AACA,QAAM,UAAU,QAAQ;AACxB,SAAO,SAAS,KAAK,EAAE,IAAI,MAAM,GAAG,SAAS,GAAI,KAAK,UAAU,EAAE,SAAS,KAAK,QAAQ,QAAQ,MAAM,EAAE,IAAI,CAAC,EAAG,CAAC;AACnH;","names":[]}