@tangle-network/agent-core 0.2.0

package/dist/types-DC6OJ1um.js

@@ -0,0 +1,331 @@
+import { t as SDKError } from "./errors-DJ6U6cHY.js";
+import { z } from "zod";
+//#region src/auth/shared-providers.ts
+/**
+* Shared Auth Providers
+*
+* Browser-safe auth classes shared between index.ts and browser.ts.
+* These classes have no node:crypto dependency and work in all environments.
+*/
+/** Simple static token auth */
+var StaticTokenAuth = class {
+	constructor(token) {
+		this.token = token;
+	}
+	async getToken() {
+		return this.token;
+	}
+	setToken(token) {
+		this.token = token;
+	}
+};
+/** Token with refresh capability */
+var RefreshableTokenAuth = class {
+	accessToken;
+	refreshTokenValue;
+	expiresAt;
+	refreshPromise = null;
+	constructor(config) {
+		this.config = config;
+		this.accessToken = config.accessToken;
+		this.refreshTokenValue = config.refreshToken;
+		this.expiresAt = Date.now() + config.expiresIn * 1e3;
+	}
+	async getToken() {
+		const buffer = (this.config.refreshBuffer ?? 60) * 1e3;
+		if (Date.now() > this.expiresAt - buffer) return this.refreshToken();
+		return this.accessToken;
+	}
+	async refreshToken() {
+		if (this.refreshPromise) return this.refreshPromise;
+		this.refreshPromise = this.doRefresh();
+		try {
+			return await this.refreshPromise;
+		} finally {
+			this.refreshPromise = null;
+		}
+	}
+	async doRefresh() {
+		try {
+			const result = await this.config.onRefresh(this.refreshTokenValue);
+			this.accessToken = result.accessToken;
+			if (result.refreshToken) this.refreshTokenValue = result.refreshToken;
+			this.expiresAt = Date.now() + result.expiresIn * 1e3;
+			return this.accessToken;
+		} catch (error) {
+			this.config.onRefreshFailed?.(error instanceof Error ? error : new Error(String(error)));
+			throw new SDKError("Token refresh failed", {
+				code: "AUTH",
+				retryable: false,
+				cause: error instanceof Error ? error : void 0
+			});
+		}
+	}
+	async onTokenRejected(error) {
+		if (error.status === 401) this.expiresAt = 0;
+	}
+	/** Check if token needs refresh */
+	isExpired() {
+		return Date.now() > this.expiresAt;
+	}
+};
+/** No auth (for public endpoints) */
+var NoAuth = class {
+	async getToken() {
+		return null;
+	}
+};
+/**
+* Callback-based auth for dynamic token retrieval.
+* Useful when token comes from external source (user session, secure storage).
+*/
+var CallbackAuth = class {
+	constructor(getTokenFn) {
+		this.getTokenFn = getTokenFn;
+	}
+	async getToken() {
+		return this.getTokenFn();
+	}
+};
+/**
+* Read token auth for WebSocket connections.
+* Wraps a read token with refresh capability.
+*/
+var ReadTokenAuth = class {
+	token;
+	expiresAt;
+	refreshPromise = null;
+	expiryWarned = false;
+	constructor(config) {
+		this.config = config;
+		this.token = config.token;
+		this.expiresAt = config.expiresAt * 1e3;
+	}
+	async getToken() {
+		const now = Date.now();
+		const refreshBuffer = (this.config.refreshBuffer ?? 60) * 1e3;
+		const warningBuffer = (this.config.warningBuffer ?? 60) * 1e3;
+		if (!this.expiryWarned && now > this.expiresAt - warningBuffer) {
+			this.expiryWarned = true;
+			const secondsRemaining = Math.floor((this.expiresAt - now) / 1e3);
+			this.config.onExpiring?.(secondsRemaining);
+		}
+		if (now > this.expiresAt - refreshBuffer) return this.refreshToken();
+		return this.token;
+	}
+	async refreshToken() {
+		if (this.refreshPromise) return this.refreshPromise;
+		this.refreshPromise = this.doRefresh();
+		try {
+			return await this.refreshPromise;
+		} finally {
+			this.refreshPromise = null;
+		}
+	}
+	async doRefresh() {
+		try {
+			const result = await this.config.onRefresh();
+			this.token = result.token;
+			this.expiresAt = result.expiresAt * 1e3;
+			this.expiryWarned = false;
+			return this.token;
+		} catch (error) {
+			this.config.onRefreshFailed?.(error instanceof Error ? error : new Error(String(error)));
+			throw error;
+		}
+	}
+	/** Check if token is expired */
+	isExpired() {
+		return Date.now() > this.expiresAt;
+	}
+	/** Get seconds until expiry */
+	getSecondsRemaining() {
+		return Math.floor((this.expiresAt - Date.now()) / 1e3);
+	}
+};
+//#endregion
+//#region src/auth/types.ts
+/**
+* Auth Types
+*
+* Type definitions for multi-tenant authentication.
+*/
+/**
+* Product configuration for multi-tenant orchestrator.
+*/
+const ProductSchema = z.object({
+	/** Unique product identifier (e.g., "vibecode", "bgagents") */
+	product_id: z.string().min(1).max(64),
+	/** Human-readable name */
+	name: z.string().min(1).max(255),
+	/** API key for backend → orchestrator auth (format: orch_prod_{random}) */
+	api_key: z.string().min(32),
+	/** Signing secrets for JWT tokens */
+	secrets: z.object({
+		current: z.object({
+			secret: z.string().min(32),
+			created_at: z.number()
+		}),
+		previous: z.object({
+			secret: z.string().min(32),
+			created_at: z.number(),
+			expires_at: z.number()
+		}).optional()
+	}),
+	/** Token TTL configuration (minutes) */
+	token_config: z.object({
+		free_ttl_minutes: z.number().min(1).max(2880).default(15),
+		paid_ttl_minutes: z.number().min(1).max(2880).default(240),
+		max_ttl_minutes: z.number().min(1).max(2880).default(480)
+	}),
+	/** Per-product rate limits */
+	rate_limits: z.object({
+		max_concurrent_sessions: z.number().min(1).default(1e4),
+		max_sessions_per_minute: z.number().min(1).default(100),
+		max_requests_per_minute: z.number().min(1).default(1e3)
+	}),
+	/**
+	* When true, skip all quota checks and usage metering.
+	* Rate limits still enforced (DoS protection).
+	* Use for internal/company accounts that don't go through billing.
+	*/
+	unlimited: z.boolean().default(false),
+	/**
+	* Admin-only notes for internal tracking.
+	* Examples: "Engineering team", "Partner: Acme Corp", "Trial until 2024-03"
+	*/
+	internal_notes: z.string().max(1e3).optional(),
+	/** Optional webhook URL for notifications */
+	webhook_url: z.string().url().optional(),
+	/** Product status */
+	status: z.enum([
+		"active",
+		"suspended",
+		"deleted"
+	]).default("active"),
+	/** Deployment type: shared (multi-tenant) or customer-hosted (on-prem) */
+	deployment_type: z.enum(["shared", "customer-hosted"]).default("shared"),
+	/** Customer orchestrator configuration (for on-prem deployments) */
+	customer_orchestrator: z.object({
+		/** Customer's orchestrator URL (e.g., https://orch.customer.internal) */
+		url: z.string().url().startsWith("https://", { message: "Customer orchestrator URL must use HTTPS" }),
+		/** Customer's orchestrator API key */
+		api_key: z.string().min(32)
+	}).optional(),
+	/** Timestamps */
+	created_at: z.string().datetime(),
+	updated_at: z.string().datetime()
+}).refine((data) => {
+	if (data.customer_orchestrator && data.deployment_type !== "customer-hosted") return false;
+	return true;
+}, {
+	message: "customer_orchestrator can only be set when deployment_type is 'customer-hosted'",
+	path: ["customer_orchestrator"]
+});
+/**
+* Base token payload (common fields for all scopes).
+*/
+const BaseTokenPayloadSchema = z.object({
+	/** Subject: User ID */
+	sub: z.string().min(1),
+	/** Product ID (used to look up signing secret) */
+	pid: z.string().min(1),
+	/** Sidecar/Container ID (optional, for direct routing) */
+	cid: z.string().optional(),
+	/** Token type (always "read" for read tokens) */
+	typ: z.literal("read"),
+	/** Issued at (Unix timestamp, seconds) */
+	iat: z.number(),
+	/** Expires at (Unix timestamp, seconds) */
+	exp: z.number()
+});
+/**
+* Session-scoped token payload.
+* Grants access to a single session's events.
+*/
+const SessionScopedTokenPayloadSchema = BaseTokenPayloadSchema.extend({
+	/** Session ID - required for session-scoped tokens */
+	sid: z.string().min(1),
+	/** Project ID - must not be present for session-scoped tokens */
+	projectId: z.undefined().optional(),
+	/** Project IDs - must not be present for session-scoped tokens */
+	projectIds: z.undefined().optional()
+});
+/**
+* Project-scoped token payload.
+* Grants access to all sessions within a single project.
+*/
+const ProjectScopedTokenPayloadSchema = BaseTokenPayloadSchema.extend({
+	/** Session ID - must not be present for project-scoped tokens */
+	sid: z.undefined().optional(),
+	/** Project ID - required for project-scoped tokens */
+	projectId: z.string().min(1),
+	/** Project IDs - must not be present for project-scoped tokens */
+	projectIds: z.undefined().optional()
+});
+/**
+* Batch-scoped token payload.
+* Grants access to multiple projects (organization-level access).
+*/
+const BatchScopedTokenPayloadSchema = BaseTokenPayloadSchema.extend({
+	/** Session ID - must not be present for batch-scoped tokens */
+	sid: z.undefined().optional(),
+	/** Project ID - must not be present for batch-scoped tokens */
+	projectId: z.undefined().optional(),
+	/** Project IDs - required for batch-scoped tokens */
+	projectIds: z.array(z.string().min(1)).min(1)
+});
+/**
+* Read token payload (JWT claims for WebSocket auth).
+*
+* Supports three scopes:
+* - Session: sid present (single session)
+* - Project: projectId present (all sessions in project)
+* - Batch: projectIds present (multiple projects)
+*
+* For backwards compatibility, tokens with sid are session-scoped.
+*/
+const ReadTokenPayloadSchema = z.union([
+	SessionScopedTokenPayloadSchema,
+	ProjectScopedTokenPayloadSchema,
+	BatchScopedTokenPayloadSchema
+]);
+/**
+* Session creation request from product backend.
+*/
+const CreateSessionRequestSchema = z.object({
+	user_id: z.string().min(1),
+	project_ref: z.string().optional(),
+	tier: z.enum([
+		"free",
+		"pro",
+		"enterprise"
+	]).or(z.literal("paid").transform(() => "pro")).default("free"),
+	config: z.object({
+		image: z.string().optional(),
+		env: z.record(z.string(), z.string()).optional(),
+		resources: z.object({
+			cpu: z.number().optional(),
+			memory: z.string().optional()
+		}).optional()
+	}).optional()
+});
+/**
+* Message send request from product backend.
+*
+* `metadata` is intentionally free-form (.passthrough): the wire format
+* accepts arbitrary product-specific keys without requiring a schema bump.
+* Only `model` is named today; legacy gateway-credential fields previously
+* declared here were never read internally and have been dropped — any
+* such fields sent by older callers continue to flow through .passthrough.
+*/
+const SendMessageRequestSchema = z.object({
+	content: z.string(),
+	user_id: z.string().min(1),
+	execution_id: z.string().optional(),
+	metadata: z.object({ model: z.string().optional() }).passthrough().optional()
+});
+//#endregion
+export { ReadTokenPayloadSchema as a, CallbackAuth as c, RefreshableTokenAuth as d, StaticTokenAuth as f, ProjectScopedTokenPayloadSchema as i, NoAuth as l, CreateSessionRequestSchema as n, SendMessageRequestSchema as o, ProductSchema as r, SessionScopedTokenPayloadSchema as s, BatchScopedTokenPayloadSchema as t, ReadTokenAuth as u };
+
+//# sourceMappingURL=types-DC6OJ1um.js.map

package/dist/types-DC6OJ1um.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-DC6OJ1um.js","names":[],"sources":["../src/auth/shared-providers.ts","../src/auth/types.ts"],"sourcesContent":["/**\n * Shared Auth Providers\n *\n * Browser-safe auth classes shared between index.ts and browser.ts.\n * These classes have no node:crypto dependency and work in all environments.\n */\n\nimport { SDKError } from \"../errors/index.js\";\n\n/** Auth provider interface */\nexport interface AuthProvider {\n  /** Get current token (called on each request) */\n  getToken(): Promise<string | null>;\n  /** Refresh expired token */\n  refreshToken?(): Promise<string>;\n  /** Called when token is rejected by server */\n  onTokenRejected?(error: SDKError): Promise<void>;\n}\n\n/** Simple static token auth */\nexport class StaticTokenAuth implements AuthProvider {\n  constructor(private token: string) {}\n\n  async getToken(): Promise<string> {\n    return this.token;\n  }\n\n  setToken(token: string): void {\n    this.token = token;\n  }\n}\n\n/** Token with refresh capability */\nexport class RefreshableTokenAuth implements AuthProvider {\n  private accessToken: string;\n  private refreshTokenValue: string;\n  private expiresAt: number;\n  private refreshPromise: Promise<string> | null = null;\n\n  constructor(\n    private config: {\n      accessToken: string;\n      refreshToken: string;\n      expiresIn: number; // seconds\n      onRefresh: (refreshToken: string) => Promise<{\n        accessToken: string;\n        refreshToken?: string;\n        expiresIn: number;\n      }>;\n      onRefreshFailed?: (error: Error) => void;\n      /** Buffer before expiry to trigger refresh (default: 60s) */\n      refreshBuffer?: number;\n    },\n  ) {\n    this.accessToken = config.accessToken;\n    this.refreshTokenValue = config.refreshToken;\n    this.expiresAt = Date.now() + config.expiresIn * 1000;\n  }\n\n  async getToken(): Promise<string> {\n    const buffer = (this.config.refreshBuffer ?? 60) * 1000;\n\n    // Proactively refresh if close to expiry\n    if (Date.now() > this.expiresAt - buffer) {\n      return this.refreshToken();\n    }\n\n    return this.accessToken;\n  }\n\n  async refreshToken(): Promise<string> {\n    // Deduplicate concurrent refresh calls\n    if (this.refreshPromise) {\n      return this.refreshPromise;\n    }\n\n    this.refreshPromise = this.doRefresh();\n\n    try {\n      return await this.refreshPromise;\n    } finally {\n      this.refreshPromise = null;\n    }\n  }\n\n  private async doRefresh(): Promise<string> {\n    try {\n      const result = await this.config.onRefresh(this.refreshTokenValue);\n      this.accessToken = result.accessToken;\n      if (result.refreshToken) {\n        this.refreshTokenValue = result.refreshToken;\n      }\n      this.expiresAt = Date.now() + result.expiresIn * 1000;\n      return this.accessToken;\n    } catch (error) {\n      this.config.onRefreshFailed?.(\n        error instanceof Error ? error : new Error(String(error)),\n      );\n      throw new SDKError(\"Token refresh failed\", {\n        code: \"AUTH\",\n        retryable: false,\n        cause: error instanceof Error ? error : undefined,\n      });\n    }\n  }\n\n  async onTokenRejected(error: SDKError): Promise<void> {\n    // Force refresh on 401\n    if (error.status === 401) {\n      this.expiresAt = 0; // Mark as expired\n    }\n  }\n\n  /** Check if token needs refresh */\n  isExpired(): boolean {\n    return Date.now() > this.expiresAt;\n  }\n}\n\n/** No auth (for public endpoints) */\nexport class NoAuth implements AuthProvider {\n  async getToken(): Promise<null> {\n    return null;\n  }\n}\n\n/**\n * Callback-based auth for dynamic token retrieval.\n * Useful when token comes from external source (user session, secure storage).\n */\nexport class CallbackAuth implements AuthProvider {\n  constructor(\n    private getTokenFn: () => string | null | Promise<string | null>,\n  ) {}\n\n  async getToken(): Promise<string | null> {\n    return this.getTokenFn();\n  }\n}\n\n/**\n * Read token auth for WebSocket connections.\n * Wraps a read token with refresh capability.\n */\nexport class ReadTokenAuth implements AuthProvider {\n  private token: string;\n  private expiresAt: number;\n  private refreshPromise: Promise<string> | null = null;\n  private expiryWarned = false;\n\n  constructor(\n    private config: {\n      token: string;\n      expiresAt: number; // Unix timestamp (seconds)\n      onRefresh: () => Promise<{ token: string; expiresAt: number }>;\n      onExpiring?: (secondsRemaining: number) => void;\n      onRefreshFailed?: (error: Error) => void;\n      /** Buffer before expiry to trigger refresh (default: 60s) */\n      refreshBuffer?: number;\n      /** Buffer before expiry to trigger warning (default: 60s) */\n      warningBuffer?: number;\n    },\n  ) {\n    this.token = config.token;\n    this.expiresAt = config.expiresAt * 1000; // Convert to ms\n  }\n\n  async getToken(): Promise<string> {\n    const now = Date.now();\n    const refreshBuffer = (this.config.refreshBuffer ?? 60) * 1000;\n    const warningBuffer = (this.config.warningBuffer ?? 60) * 1000;\n\n    // Warn if expiring soon\n    if (!this.expiryWarned && now > this.expiresAt - warningBuffer) {\n      this.expiryWarned = true;\n      const secondsRemaining = Math.floor((this.expiresAt - now) / 1000);\n      this.config.onExpiring?.(secondsRemaining);\n    }\n\n    // Proactively refresh if close to expiry\n    if (now > this.expiresAt - refreshBuffer) {\n      return this.refreshToken();\n    }\n\n    return this.token;\n  }\n\n  async refreshToken(): Promise<string> {\n    // Deduplicate concurrent refresh calls\n    if (this.refreshPromise) {\n      return this.refreshPromise;\n    }\n\n    this.refreshPromise = this.doRefresh();\n\n    try {\n      return await this.refreshPromise;\n    } finally {\n      this.refreshPromise = null;\n    }\n  }\n\n  private async doRefresh(): Promise<string> {\n    try {\n      const result = await this.config.onRefresh();\n      this.token = result.token;\n      this.expiresAt = result.expiresAt * 1000;\n      this.expiryWarned = false;\n      return this.token;\n    } catch (error) {\n      this.config.onRefreshFailed?.(\n        error instanceof Error ? error : new Error(String(error)),\n      );\n      throw error;\n    }\n  }\n\n  /** Check if token is expired */\n  isExpired(): boolean {\n    return Date.now() > this.expiresAt;\n  }\n\n  /** Get seconds until expiry */\n  getSecondsRemaining(): number {\n    return Math.floor((this.expiresAt - Date.now()) / 1000);\n  }\n}\n","/**\n * Auth Types\n *\n * Type definitions for multi-tenant authentication.\n */\n\nimport { z } from \"zod\";\n\n/**\n * Product configuration for multi-tenant orchestrator.\n */\nexport const ProductSchema = z\n  .object({\n    /** Unique product identifier (e.g., \"vibecode\", \"bgagents\") */\n    product_id: z.string().min(1).max(64),\n\n    /** Human-readable name */\n    name: z.string().min(1).max(255),\n\n    /** API key for backend → orchestrator auth (format: orch_prod_{random}) */\n    api_key: z.string().min(32),\n\n    /** Signing secrets for JWT tokens */\n    secrets: z.object({\n      current: z.object({\n        secret: z.string().min(32),\n        created_at: z.number(),\n      }),\n      previous: z\n        .object({\n          secret: z.string().min(32),\n          created_at: z.number(),\n          expires_at: z.number(),\n        })\n        .optional(),\n    }),\n\n    /** Token TTL configuration (minutes) */\n    token_config: z.object({\n      free_ttl_minutes: z.number().min(1).max(2880).default(15),\n      paid_ttl_minutes: z.number().min(1).max(2880).default(240),\n      max_ttl_minutes: z.number().min(1).max(2880).default(480),\n    }),\n\n    /** Per-product rate limits */\n    rate_limits: z.object({\n      max_concurrent_sessions: z.number().min(1).default(10000),\n      max_sessions_per_minute: z.number().min(1).default(100),\n      max_requests_per_minute: z.number().min(1).default(1000),\n    }),\n\n    /**\n     * When true, skip all quota checks and usage metering.\n     * Rate limits still enforced (DoS protection).\n     * Use for internal/company accounts that don't go through billing.\n     */\n    unlimited: z.boolean().default(false),\n\n    /**\n     * Admin-only notes for internal tracking.\n     * Examples: \"Engineering team\", \"Partner: Acme Corp\", \"Trial until 2024-03\"\n     */\n    internal_notes: z.string().max(1000).optional(),\n\n    /** Optional webhook URL for notifications */\n    webhook_url: z.string().url().optional(),\n\n    /** Product status */\n    status: z.enum([\"active\", \"suspended\", \"deleted\"]).default(\"active\"),\n\n    /** Deployment type: shared (multi-tenant) or customer-hosted (on-prem) */\n    deployment_type: z.enum([\"shared\", \"customer-hosted\"]).default(\"shared\"),\n\n    /** Customer orchestrator configuration (for on-prem deployments) */\n    customer_orchestrator: z\n      .object({\n        /** Customer's orchestrator URL (e.g., https://orch.customer.internal) */\n        url: z.string().url().startsWith(\"https://\", {\n          message: \"Customer orchestrator URL must use HTTPS\",\n        }),\n        /** Customer's orchestrator API key */\n        api_key: z.string().min(32),\n      })\n      .optional(),\n\n    /** Timestamps */\n    created_at: z.string().datetime(),\n    updated_at: z.string().datetime(),\n  })\n  .refine(\n    (data) => {\n      if (\n        data.customer_orchestrator &&\n        data.deployment_type !== \"customer-hosted\"\n      ) {\n        return false;\n      }\n      return true;\n    },\n    {\n      message:\n        \"customer_orchestrator can only be set when deployment_type is 'customer-hosted'\",\n      path: [\"customer_orchestrator\"],\n    },\n  );\n\nexport type Product = z.infer<typeof ProductSchema>;\n\n/**\n * Token scope types for multi-tenant access control.\n *\n * - \"session\": Access to a single session (requires sid)\n * - \"project\": Access to all sessions within a project (requires projectId)\n * - \"batch\": Access to multiple projects (requires projectIds array)\n */\nexport type TokenScope = \"session\" | \"project\" | \"batch\";\n\n/**\n * Base token payload (common fields for all scopes).\n */\nconst BaseTokenPayloadSchema = z.object({\n  /** Subject: User ID */\n  sub: z.string().min(1),\n\n  /** Product ID (used to look up signing secret) */\n  pid: z.string().min(1),\n\n  /** Sidecar/Container ID (optional, for direct routing) */\n  cid: z.string().optional(),\n\n  /** Token type (always \"read\" for read tokens) */\n  typ: z.literal(\"read\"),\n\n  /** Issued at (Unix timestamp, seconds) */\n  iat: z.number(),\n\n  /** Expires at (Unix timestamp, seconds) */\n  exp: z.number(),\n});\n\n/**\n * Session-scoped token payload.\n * Grants access to a single session's events.\n */\nexport const SessionScopedTokenPayloadSchema = BaseTokenPayloadSchema.extend({\n  /** Session ID - required for session-scoped tokens */\n  sid: z.string().min(1),\n  /** Project ID - must not be present for session-scoped tokens */\n  projectId: z.undefined().optional(),\n  /** Project IDs - must not be present for session-scoped tokens */\n  projectIds: z.undefined().optional(),\n});\n\n/**\n * Project-scoped token payload.\n * Grants access to all sessions within a single project.\n */\nexport const ProjectScopedTokenPayloadSchema = BaseTokenPayloadSchema.extend({\n  /** Session ID - must not be present for project-scoped tokens */\n  sid: z.undefined().optional(),\n  /** Project ID - required for project-scoped tokens */\n  projectId: z.string().min(1),\n  /** Project IDs - must not be present for project-scoped tokens */\n  projectIds: z.undefined().optional(),\n});\n\n/**\n * Batch-scoped token payload.\n * Grants access to multiple projects (organization-level access).\n */\nexport const BatchScopedTokenPayloadSchema = BaseTokenPayloadSchema.extend({\n  /** Session ID - must not be present for batch-scoped tokens */\n  sid: z.undefined().optional(),\n  /** Project ID - must not be present for batch-scoped tokens */\n  projectId: z.undefined().optional(),\n  /** Project IDs - required for batch-scoped tokens */\n  projectIds: z.array(z.string().min(1)).min(1),\n});\n\n/**\n * Read token payload (JWT claims for WebSocket auth).\n *\n * Supports three scopes:\n * - Session: sid present (single session)\n * - Project: projectId present (all sessions in project)\n * - Batch: projectIds present (multiple projects)\n *\n * For backwards compatibility, tokens with sid are session-scoped.\n */\nexport const ReadTokenPayloadSchema = z.union([\n  SessionScopedTokenPayloadSchema,\n  ProjectScopedTokenPayloadSchema,\n  BatchScopedTokenPayloadSchema,\n]);\n\nexport type ReadTokenPayload = z.infer<typeof ReadTokenPayloadSchema>;\nexport type SessionScopedTokenPayload = z.infer<\n  typeof SessionScopedTokenPayloadSchema\n>;\nexport type ProjectScopedTokenPayload = z.infer<\n  typeof ProjectScopedTokenPayloadSchema\n>;\nexport type BatchScopedTokenPayload = z.infer<\n  typeof BatchScopedTokenPayloadSchema\n>;\n\n/**\n * Token validation result.\n */\nexport interface TokenValidationResult {\n  valid: boolean;\n  payload?: ReadTokenPayload;\n  /** Token scope (session, project, or batch) */\n  scope?: TokenScope;\n  error?: string;\n  errorCode?:\n    | \"TOKEN_MISSING\"\n    | \"TOKEN_INVALID\"\n    | \"TOKEN_EXPIRED\"\n    | \"TOKEN_WRONG_TYPE\"\n    | \"PRODUCT_NOT_FOUND\"\n    | \"PRODUCT_SUSPENDED\"\n    | \"SIGNATURE_INVALID\";\n}\n\n/**\n * Product secrets structure.\n */\nexport interface ProductSecrets {\n  current: {\n    secret: string;\n    created_at: number;\n  };\n  previous?: {\n    secret: string;\n    created_at: number;\n    expires_at: number;\n  };\n}\n\n/**\n * Minimal product info for token validation (avoids full product lookup).\n */\nexport interface ProductAuthInfo {\n  product_id: string;\n  secrets: ProductSecrets;\n  status: \"active\" | \"suspended\" | \"deleted\";\n}\n\n/**\n * Session creation request from product backend.\n */\nexport const CreateSessionRequestSchema = z.object({\n  user_id: z.string().min(1),\n  project_ref: z.string().optional(),\n  tier: z\n    .enum([\"free\", \"pro\", \"enterprise\"])\n    .or(z.literal(\"paid\").transform(() => \"pro\" as const))\n    .default(\"free\"),\n  config: z\n    .object({\n      image: z.string().optional(),\n      env: z.record(z.string(), z.string()).optional(),\n      resources: z\n        .object({\n          cpu: z.number().optional(),\n          memory: z.string().optional(),\n        })\n        .optional(),\n    })\n    .optional(),\n});\n\nexport type CreateSessionRequest = z.infer<typeof CreateSessionRequestSchema>;\n\n/**\n * Session creation response to product backend.\n */\nexport interface CreateSessionResponse {\n  session_id: string;\n  sidecar_id: string;\n  websocket_url: string;\n}\n\n/**\n * Message send request from product backend.\n *\n * `metadata` is intentionally free-form (.passthrough): the wire format\n * accepts arbitrary product-specific keys without requiring a schema bump.\n * Only `model` is named today; legacy gateway-credential fields previously\n * declared here were never read internally and have been dropped — any\n * such fields sent by older callers continue to flow through .passthrough.\n */\nexport const SendMessageRequestSchema = z.object({\n  content: z.string(),\n  user_id: z.string().min(1),\n  execution_id: z.string().optional(),\n  metadata: z\n    .object({\n      model: z.string().optional(),\n    })\n    .passthrough()\n    .optional(),\n});\n\nexport type SendMessageRequest = z.infer<typeof SendMessageRequestSchema>;\n"],"mappings":";;;;;;;;;;AAoBA,IAAa,kBAAb,MAAqD;CACnD,YAAY,OAAuB;AAAf,OAAA,QAAA;;CAEpB,MAAM,WAA4B;AAChC,SAAO,KAAK;;CAGd,SAAS,OAAqB;AAC5B,OAAK,QAAQ;;;;AAKjB,IAAa,uBAAb,MAA0D;CACxD;CACA;CACA;CACA,iBAAiD;CAEjD,YACE,QAaA;AAbQ,OAAA,SAAA;AAcR,OAAK,cAAc,OAAO;AAC1B,OAAK,oBAAoB,OAAO;AAChC,OAAK,YAAY,KAAK,KAAK,GAAG,OAAO,YAAY;;CAGnD,MAAM,WAA4B;EAChC,MAAM,UAAU,KAAK,OAAO,iBAAiB,MAAM;AAGnD,MAAI,KAAK,KAAK,GAAG,KAAK,YAAY,OAChC,QAAO,KAAK,cAAc;AAG5B,SAAO,KAAK;;CAGd,MAAM,eAAgC;AAEpC,MAAI,KAAK,eACP,QAAO,KAAK;AAGd,OAAK,iBAAiB,KAAK,WAAW;AAEtC,MAAI;AACF,UAAO,MAAM,KAAK;YACV;AACR,QAAK,iBAAiB;;;CAI1B,MAAc,YAA6B;AACzC,MAAI;GACF,MAAM,SAAS,MAAM,KAAK,OAAO,UAAU,KAAK,kBAAkB;AAClE,QAAK,cAAc,OAAO;AAC1B,OAAI,OAAO,aACT,MAAK,oBAAoB,OAAO;AAElC,QAAK,YAAY,KAAK,KAAK,GAAG,OAAO,YAAY;AACjD,UAAO,KAAK;WACL,OAAO;AACd,QAAK,OAAO,kBACV,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,CAC1D;AACD,SAAM,IAAI,SAAS,wBAAwB;IACzC,MAAM;IACN,WAAW;IACX,OAAO,iBAAiB,QAAQ,QAAQ,KAAA;IACzC,CAAC;;;CAIN,MAAM,gBAAgB,OAAgC;AAEpD,MAAI,MAAM,WAAW,IACnB,MAAK,YAAY;;;CAKrB,YAAqB;AACnB,SAAO,KAAK,KAAK,GAAG,KAAK;;;;AAK7B,IAAa,SAAb,MAA4C;CAC1C,MAAM,WAA0B;AAC9B,SAAO;;;;;;;AAQX,IAAa,eAAb,MAAkD;CAChD,YACE,YACA;AADQ,OAAA,aAAA;;CAGV,MAAM,WAAmC;AACvC,SAAO,KAAK,YAAY;;;;;;;AAQ5B,IAAa,gBAAb,MAAmD;CACjD;CACA;CACA,iBAAiD;CACjD,eAAuB;CAEvB,YACE,QAWA;AAXQ,OAAA,SAAA;AAYR,OAAK,QAAQ,OAAO;AACpB,OAAK,YAAY,OAAO,YAAY;;CAGtC,MAAM,WAA4B;EAChC,MAAM,MAAM,KAAK,KAAK;EACtB,MAAM,iBAAiB,KAAK,OAAO,iBAAiB,MAAM;EAC1D,MAAM,iBAAiB,KAAK,OAAO,iBAAiB,MAAM;AAG1D,MAAI,CAAC,KAAK,gBAAgB,MAAM,KAAK,YAAY,eAAe;AAC9D,QAAK,eAAe;GACpB,MAAM,mBAAmB,KAAK,OAAO,KAAK,YAAY,OAAO,IAAK;AAClE,QAAK,OAAO,aAAa,iBAAiB;;AAI5C,MAAI,MAAM,KAAK,YAAY,cACzB,QAAO,KAAK,cAAc;AAG5B,SAAO,KAAK;;CAGd,MAAM,eAAgC;AAEpC,MAAI,KAAK,eACP,QAAO,KAAK;AAGd,OAAK,iBAAiB,KAAK,WAAW;AAEtC,MAAI;AACF,UAAO,MAAM,KAAK;YACV;AACR,QAAK,iBAAiB;;;CAI1B,MAAc,YAA6B;AACzC,MAAI;GACF,MAAM,SAAS,MAAM,KAAK,OAAO,WAAW;AAC5C,QAAK,QAAQ,OAAO;AACpB,QAAK,YAAY,OAAO,YAAY;AACpC,QAAK,eAAe;AACpB,UAAO,KAAK;WACL,OAAO;AACd,QAAK,OAAO,kBACV,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC,CAC1D;AACD,SAAM;;;;CAKV,YAAqB;AACnB,SAAO,KAAK,KAAK,GAAG,KAAK;;;CAI3B,sBAA8B;AAC5B,SAAO,KAAK,OAAO,KAAK,YAAY,KAAK,KAAK,IAAI,IAAK;;;;;;;;;;;;;ACrN3D,MAAa,gBAAgB,EAC1B,OAAO;;CAEN,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG;;CAGrC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI;;CAGhC,SAAS,EAAE,QAAQ,CAAC,IAAI,GAAG;;CAG3B,SAAS,EAAE,OAAO;EAChB,SAAS,EAAE,OAAO;GAChB,QAAQ,EAAE,QAAQ,CAAC,IAAI,GAAG;GAC1B,YAAY,EAAE,QAAQ;GACvB,CAAC;EACF,UAAU,EACP,OAAO;GACN,QAAQ,EAAE,QAAQ,CAAC,IAAI,GAAG;GAC1B,YAAY,EAAE,QAAQ;GACtB,YAAY,EAAE,QAAQ;GACvB,CAAC,CACD,UAAU;EACd,CAAC;;CAGF,cAAc,EAAE,OAAO;EACrB,kBAAkB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG;EACzD,kBAAkB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI;EAC1D,iBAAiB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI;EAC1D,CAAC;;CAGF,aAAa,EAAE,OAAO;EACpB,yBAAyB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAM;EACzD,yBAAyB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAI;EACvD,yBAAyB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAK;EACzD,CAAC;;;;;;CAOF,WAAW,EAAE,SAAS,CAAC,QAAQ,MAAM;;;;;CAMrC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,IAAK,CAAC,UAAU;;CAG/C,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU;;CAGxC,QAAQ,EAAE,KAAK;EAAC;EAAU;EAAa;EAAU,CAAC,CAAC,QAAQ,SAAS;;CAGpE,iBAAiB,EAAE,KAAK,CAAC,UAAU,kBAAkB,CAAC,CAAC,QAAQ,SAAS;;CAGxE,uBAAuB,EACpB,OAAO;;EAEN,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,YAAY,EAC3C,SAAS,4CACV,CAAC;;EAEF,SAAS,EAAE,QAAQ,CAAC,IAAI,GAAG;EAC5B,CAAC,CACD,UAAU;;CAGb,YAAY,EAAE,QAAQ,CAAC,UAAU;CACjC,YAAY,EAAE,QAAQ,CAAC,UAAU;CAClC,CAAC,CACD,QACE,SAAS;AACR,KACE,KAAK,yBACL,KAAK,oBAAoB,kBAEzB,QAAO;AAET,QAAO;GAET;CACE,SACE;CACF,MAAM,CAAC,wBAAwB;CAChC,CACF;;;;AAgBH,MAAM,yBAAyB,EAAE,OAAO;;CAEtC,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE;;CAGtB,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE;;CAGtB,KAAK,EAAE,QAAQ,CAAC,UAAU;;CAG1B,KAAK,EAAE,QAAQ,OAAO;;CAGtB,KAAK,EAAE,QAAQ;;CAGf,KAAK,EAAE,QAAQ;CAChB,CAAC;;;;;AAMF,MAAa,kCAAkC,uBAAuB,OAAO;;CAE3E,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE;;CAEtB,WAAW,EAAE,WAAW,CAAC,UAAU;;CAEnC,YAAY,EAAE,WAAW,CAAC,UAAU;CACrC,CAAC;;;;;AAMF,MAAa,kCAAkC,uBAAuB,OAAO;;CAE3E,KAAK,EAAE,WAAW,CAAC,UAAU;;CAE7B,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE;;CAE5B,YAAY,EAAE,WAAW,CAAC,UAAU;CACrC,CAAC;;;;;AAMF,MAAa,gCAAgC,uBAAuB,OAAO;;CAEzE,KAAK,EAAE,WAAW,CAAC,UAAU;;CAE7B,WAAW,EAAE,WAAW,CAAC,UAAU;;CAEnC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;CAC9C,CAAC;;;;;;;;;;;AAYF,MAAa,yBAAyB,EAAE,MAAM;CAC5C;CACA;CACA;CACD,CAAC;;;;AA2DF,MAAa,6BAA6B,EAAE,OAAO;CACjD,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,aAAa,EAAE,QAAQ,CAAC,UAAU;CAClC,MAAM,EACH,KAAK;EAAC;EAAQ;EAAO;EAAa,CAAC,CACnC,GAAG,EAAE,QAAQ,OAAO,CAAC,gBAAgB,MAAe,CAAC,CACrD,QAAQ,OAAO;CAClB,QAAQ,EACL,OAAO;EACN,OAAO,EAAE,QAAQ,CAAC,UAAU;EAC5B,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,UAAU;EAChD,WAAW,EACR,OAAO;GACN,KAAK,EAAE,QAAQ,CAAC,UAAU;GAC1B,QAAQ,EAAE,QAAQ,CAAC,UAAU;GAC9B,CAAC,CACD,UAAU;EACd,CAAC,CACD,UAAU;CACd,CAAC;;;;;;;;;;AAsBF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,SAAS,EAAE,QAAQ;CACnB,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE;CAC1B,cAAc,EAAE,QAAQ,CAAC,UAAU;CACnC,UAAU,EACP,OAAO,EACN,OAAO,EAAE,QAAQ,CAAC,UAAU,EAC7B,CAAC,CACD,aAAa,CACb,UAAU;CACd,CAAC"}