@tangle-network/agent-runtime 0.274.0 → 0.279.0

package/dist/mcp/index.d.ts

@@ -1,9 +1,9 @@
-import { At as createPropagatingTraceEmitter, Mt as readTraceContextFromEnv, Nt as traceContextToEnv, Ta as SandboxClient, jt as mergeTraceEnv, kt as TraceContext, ma as LoopSandboxPlacement } from "../types-r7Fzum3M.js";
-import { $d as DefinedAnalystRecord, $f as DelegateResult, $p as DelegateUiAuditArgs, Af as downMessageRefusalReasons, Am as DelegationPersistenceError, Ap as detachedTurnEvents, Bd as AnalystToolGroupName, Bf as environmentReader, Bp as DelegationTaskQueue, Cm as DelegationTraceCaps, Cp as DetachedSessionRefParts, Df as analystToolGroupNames, Dm as capDelegationTrace, Dp as DriveTurnTick, Ef as WorkerWatchOptions, Em as buildDelegationTraceSpans, Ep as DriveTurnCapableBox, Fd as AnalystDefinitionIssue, Ff as ResolvedSpawnResourcePath, Fm as InMemoryDelegationStore, Fp as DelegationRecord, Gd as AuthorizedDownMessage, Gf as createInProcessTransport, Gp as DelegateCodeArgs, Hd as AuthoredAnalystDefinition, Hf as resolveSpawnResourcePaths, Hp as SubmitInput, Id as AnalystFindingEvent, If as SPAWN_RESOURCE_PATH_MAX_BYTES, Im as CoderOutput, Ip as DelegationResumeContext, Jd as CoordinationEvent, Jf as DELEGATE_INPUT_SCHEMA, Jp as DelegateFeedbackArgs, Kd as ContinuationInstruction, Kf as createMcpServer, Kp as DelegateCodeConfig, Ld as AnalystKind, Lf as SpawnResourceBytes, Lp as DelegationResumeDriver, Mf as parseAuthoredAnalystDefinition, Mm as DelegationStore, Mp as parseDetachedSessionRef, Nf as questionEscalationTargets, Nm as FileDelegationStore, Np as runDetachedTurn, Om as composeLoopTraceEmitters, Op as RunDetachedTurnOptions, Pd as ANALYST_DEFINITION_BOUNDS, Pf as ResolveSpawnResourcePathsResult, Pm as FileDelegationStoreOptions, Pp as DelegationArgs, Qd as DEFAULT_AWAIT_EVENT_TIMEOUT_MS, Qf as DelegateHandlerOptions, Qp as DelegateResearchResult, Rf as SpawnResourceRead, Rp as DelegationResumeTick, Sm as DELEGATION_TRACE_MAX_SPANS, Sp as createSiblingSandboxExecutor, Tf as WorkerSpawnContext, Tm as DelegationTraceSpan, Tp as DetachedTurnResumeDriverOptions, Ud as AuthoredAnalystLimits, Uf as McpServer, Up as SubmitOutput, Vf as hostDirectoryReader, Vp as DelegationTaskQueueOptions, Wd as AuthorizeDownMessage, Wf as McpServerOptions, Wp as hashIdempotencyInput, Xd as CoordinationTools, Xf as DelegateArgs, Xp as DelegateResearchArgs, Yf as DELEGATE_TOOL_NAME, Yp as DelegateFeedbackResult, Zd as CoordinationToolsOptions, Zf as DelegateError, Zp as DelegateResearchConfig, _f as QuestionUrgency, _m as UiAuditLensFilter, _p as DelegationExecutor, af as EventAcknowledgement, am as DelegationHistoryArgs, ap as eventToSnapshot, bm as CappedDelegationTrace, bp as SiblingSandboxExecutorOptions, cf as Question, cm as DelegationProfile, cp as CoderReviewer, df as QuestionEscalationRecord, dm as DelegationStatus, dp as DetachedWinnerSelection, ef as DownMessageAuthorizationInput, em as DelegateUiAuditConfig, ep as createDelegateHandler, ff as QuestionEscalationTarget, fm as DelegationStatusArgs, fp as SettleDetachedCoderTurnOptions, gf as QuestionRecord, gm as ResearchOutputShape, gp as settleDetachedCoderTurn, hf as QuestionPolicy, hm as FeedbackRefersTo, hp as detachedSessionDelegate, if as EscalateQuestion, im as DelegationFeedbackSnapshot, ip as InMemoryFeedbackStore, jm as DelegationStateCorruptError, jp as formatDetachedSessionRef, kf as createCoordinationTools, km as createDelegationTraceCollector, kp as createDetachedTurnResumeDriver, lf as QuestionDecision, lm as DelegationProgress, lp as DelegateRunCtx, mf as QuestionOption, mm as FeedbackRating, mp as coderTaskFromArgs, nf as DownMessageDeliveryOutcome, nm as DelegateUiAuditRoute, np as FeedbackEvent, of as MakeWorkerAgent, om as DelegationHistoryEntry, op as CoderDelegate, pf as QuestionLevel, pm as DelegationStatusResult, pp as UiAuditorDelegate, qf as DELEGATE_DESCRIPTION, qp as DelegateCodeResult, rf as DownMessageEvent, rm as DelegationError, rp as FeedbackStore, sf as ManagerReentryState, sm as DelegationHistoryResult, sp as CoderReview, tf as DownMessageDeliveryAttempt, tm as DelegateUiAuditResult, tp as validateDelegateArgs, uf as QuestionEscalationOutcome, um as DelegationResultPayload, up as DetachedSessionDelegateOptions, vf as SettledWorker, vm as UiAuditorDelegationOutput, vp as FleetHandle, wm as DelegationTraceCollector, wp as DetachedTurn, xm as DELEGATION_TRACE_MAX_BYTES, xp as createFleetWorkspaceExecutor, ym as delegationProfiles, yp as FleetWorkspaceExecutorOptions, zd as AnalystRegistry, zf as SpawnResourceReader, zp as DelegationRunContext } from "../index-CjLtO4B3.js";
-import { An as DEFAULT_LOCAL_HARNESS, Cn as WorktreeHandle, Dn as CodexExecutionEvidence, En as removeWorktree, Fn as harnessSupportsReasoningEffort, In as localHarnessExecutable, Ln as parseCodexTokenUsage, Mn as LocalHarness, Nn as LocalHarnessResult, On as CodexExecutionPolicy, Pn as RunLocalHarnessOptions, Rn as runLocalHarness, Sn as RemoveWorktreeOptions, Tn as createWorktree, bn as DiffResult, dr as JsonRpcMessage, fr as JsonRpcResponse, hr as McpTransport, jn as LOCAL_HARNESSES, kn as CodexTokenUsage, mr as McpToolDescriptor, pr as McpToolAnnotations, vn as CreateWorktreeOptions, wn as captureWorktreeDiff, xn as GitRunner, yn as DiffOptions } from "../stream-agent-turn-C2rtL6P2.js";
-import { d as ResearchSource, o as UiLens } from "../substrate-DPIUXsZ5.js";
+import { At as TraceContext, Mt as mergeTraceEnv, Nt as readTraceContextFromEnv, Pt as traceContextToEnv, ba as SandboxClient, jt as createPropagatingTraceEmitter, la as LoopSandboxPlacement } from "../types-D56jQad-.js";
+import { $d as DEFAULT_AWAIT_EVENT_TIMEOUT_MS, $f as DelegateHandlerOptions, $p as DelegateResearchResult, Af as createCoordinationTools, Am as createDelegationTraceCollector, Ap as createDetachedTurnResumeDriver, Bd as AnalystRegistry, Bf as SpawnResourceReader, Bp as DelegationRunContext, Cm as DELEGATION_TRACE_MAX_SPANS, Cp as createSiblingSandboxExecutor, Df as WorkerWatchOptions, Dm as buildDelegationTraceSpans, Dp as DriveTurnCapableBox, Ef as WorkerSpawnContext, Em as DelegationTraceSpan, Ep as DetachedTurnResumeDriverOptions, Fd as ANALYST_DEFINITION_BOUNDS, Ff as ResolveSpawnResourcePathsResult, Fm as FileDelegationStoreOptions, Fp as DelegationArgs, Gd as AuthorizeDownMessage, Gf as McpServerOptions, Gp as hashIdempotencyInput, Hf as hostDirectoryReader, Hp as DelegationTaskQueueOptions, Id as AnalystDefinitionIssue, If as ResolvedSpawnResourcePath, Im as InMemoryDelegationStore, Ip as DelegationRecord, Jf as DELEGATE_DESCRIPTION, Jp as DelegateCodeResult, Kd as AuthorizedDownMessage, Kf as createInProcessTransport, Kp as DelegateCodeArgs, Ld as AnalystFindingEvent, Lf as SPAWN_RESOURCE_PATH_MAX_BYTES, Lm as CoderOutput, Lp as DelegationResumeContext, Mm as DelegationStateCorruptError, Mp as formatDetachedSessionRef, Nf as parseAuthoredAnalystDefinition, Nm as DelegationStore, Np as parseDetachedSessionRef, Of as analystToolGroupNames, Om as capDelegationTrace, Op as DriveTurnTick, Pf as questionEscalationTargets, Pm as FileDelegationStore, Pp as runDetachedTurn, Qd as CoordinationToolsOptions, Qf as DelegateError, Qp as DelegateResearchConfig, Rd as AnalystKind, Rf as SpawnResourceBytes, Rp as DelegationResumeDriver, Sm as DELEGATION_TRACE_MAX_BYTES, Sp as createFleetWorkspaceExecutor, Tm as DelegationTraceCollector, Tp as DetachedTurn, Ud as AuthoredAnalystDefinition, Uf as resolveSpawnResourcePaths, Up as SubmitInput, Vd as AnalystToolGroupName, Vf as environmentReader, Vp as DelegationTaskQueue, Wd as AuthoredAnalystLimits, Wf as McpServer, Wp as SubmitOutput, Xf as DELEGATE_TOOL_NAME, Xp as DelegateFeedbackResult, Yd as CoordinationEvent, Yf as DELEGATE_INPUT_SCHEMA, Yp as DelegateFeedbackArgs, Zd as CoordinationTools, Zf as DelegateArgs, Zp as DelegateResearchArgs, _f as QuestionRecord, _m as ResearchOutputShape, _p as settleDetachedCoderTurn, af as EscalateQuestion, am as DelegationFeedbackSnapshot, ap as InMemoryFeedbackStore, bm as delegationProfiles, bp as FleetWorkspaceExecutorOptions, cf as ManagerReentryState, cm as DelegationHistoryResult, cp as CoderReview, df as QuestionEscalationOutcome, dm as DelegationResultPayload, dp as DetachedSessionDelegateOptions, ef as DefinedAnalystRecord, em as DelegateUiAuditArgs, ep as DelegateResult, ff as QuestionEscalationRecord, fm as DelegationStatus, fp as DetachedWinnerSelection, gf as QuestionPolicy, gm as FeedbackRefersTo, gp as detachedSessionDelegate, hf as QuestionOption, hm as FeedbackRating, hp as coderTaskFromArgs, if as DownMessageEvent, im as DelegationError, ip as FeedbackStore, jf as downMessageRefusalReasons, jm as DelegationPersistenceError, jp as detachedTurnEvents, km as composeLoopTraceEmitters, kp as RunDetachedTurnOptions, lf as Question, lm as DelegationProfile, lp as CoderReviewer, mf as QuestionLevel, mm as DelegationStatusResult, mp as UiAuditorDelegate, nf as DownMessageDeliveryAttempt, nm as DelegateUiAuditResult, np as validateDelegateArgs, of as EventAcknowledgement, om as DelegationHistoryArgs, op as eventToSnapshot, pf as QuestionEscalationTarget, pm as DelegationStatusArgs, pp as SettleDetachedCoderTurnOptions, qd as ContinuationInstruction, qf as createMcpServer, qp as DelegateCodeConfig, rf as DownMessageDeliveryOutcome, rm as DelegateUiAuditRoute, rp as FeedbackEvent, sf as MakeWorkerAgent, sm as DelegationHistoryEntry, sp as CoderDelegate, tf as DownMessageAuthorizationInput, tm as DelegateUiAuditConfig, tp as createDelegateHandler, uf as QuestionDecision, um as DelegationProgress, up as DelegateRunCtx, vf as QuestionUrgency, vm as UiAuditLensFilter, vp as DelegationExecutor, wm as DelegationTraceCaps, wp as DetachedSessionRefParts, xm as CappedDelegationTrace, xp as SiblingSandboxExecutorOptions, yf as SettledWorker, ym as UiAuditorDelegationOutput, yp as FleetHandle, zf as SpawnResourceRead, zp as DelegationResumeTick } from "../index-Dm8SHDGW.js";
+import { An as DEFAULT_LOCAL_HARNESS, Cn as WorktreeHandle, Dn as CodexExecutionEvidence, En as removeWorktree, Fn as harnessSupportsReasoningEffort, In as localHarnessExecutable, Ln as parseCodexTokenUsage, Mn as LocalHarness, Nn as LocalHarnessResult, On as CodexExecutionPolicy, Pn as RunLocalHarnessOptions, Rn as runLocalHarness, Sn as RemoveWorktreeOptions, Tn as createWorktree, bn as DiffResult, dr as JsonRpcMessage, fr as JsonRpcResponse, hr as McpTransport, jn as LOCAL_HARNESSES, kn as CodexTokenUsage, mr as McpToolDescriptor, pr as McpToolAnnotations, vn as CreateWorktreeOptions, wn as captureWorktreeDiff, xn as GitRunner, yn as DiffOptions } from "../stream-agent-turn-Bk79CnTw.js";
+import { d as ResearchSource, o as UiLens } from "../substrate-CHQ5GYnU.js";
 import { a as KbGateResult, i as FactJudgeVerdict, n as FactCandidate, o as createKbGate, r as FactJudge, t as CreateKbGateOptions } from "../kb-gate-C8z2juK8.js";
-import { n as mcpToolsForRuntimeMcpSubset, t as mcpToolsForRuntimeMcp } from "../openai-tools-D8ZYHReZ.js";
+import { n as mcpToolsForRuntimeMcpSubset, t as mcpToolsForRuntimeMcp } from "../openai-tools-H8QPhTVE.js";
 import { AgentProfileMcpServer, HarnessType } from "@tangle-network/agent-interface";
 //#region src/mcp/codex-diagnostics.d.ts
 /** Bounded, credential-redacted process context attached when reproducible Codex output fails

package/dist/mcp/index.js

@@ -1,14 +1,14 @@
-import { $r as runWorktreeHarness, Ar as createPropagatingTraceEmitter, Bn as runAgentRounds, Ln as createSandboxForSpec, Mr as readTraceContextFromEnv, Nr as traceContextToEnv, Sa as sleep, Ta as throwIfAborted, Wn as assertBoxlessPromptOptions, _a as deleteBoxSafe, ci as parseCodexTokenUsage, ct as environmentReader, ei as captureWorktreeDiff, ii as LOCAL_HARNESSES, jr as mergeTraceEnv, li as CodexExecutionDiagnosticError, lt as hostDirectoryReader, ni as removeWorktree, oi as harnessSupportsReasoningEffort, ri as DEFAULT_LOCAL_HARNESS, si as localHarnessExecutable, st as SPAWN_RESOURCE_PATH_MAX_BYTES, ti as createWorktree, ut as resolveSpawnResourcePaths, wa as throwAbort } from "../supervisor-C50SI_Ww.js";
+import { $r as runWorktreeHarness, Fr as traceContextToEnv, Hn as runAgentRounds, Kn as assertBoxlessPromptOptions, Mr as createPropagatingTraceEmitter, Nr as mergeTraceEnv, Pr as readTraceContextFromEnv, Sa as sleep, Ta as throwIfAborted, _a as deleteBoxSafe, ci as parseCodexTokenUsage, dt as hostDirectoryReader, ei as captureWorktreeDiff, ft as resolveSpawnResourcePaths, ii as LOCAL_HARNESSES, li as CodexExecutionDiagnosticError, lt as SPAWN_RESOURCE_PATH_MAX_BYTES, ni as removeWorktree, oi as harnessSupportsReasoningEffort, ri as DEFAULT_LOCAL_HARNESS, si as localHarnessExecutable, ti as createWorktree, ut as environmentReader, wa as throwAbort, zn as createSandboxForSpec } from "../supervisor-DtlPj9me.js";
 import { i as ConfigError, m as ValidationError } from "../errors-DodWX-cb.js";
 import { t as assertExecutableAgentProfile } from "../model-policy-BbSCSak0.js";
-import { O as runCoderChecks, mt as selectValidWinner } from "../runtime-CtrgIqQm.js";
-import { A as createCoordinationTools, D as analystToolGroupNames, E as DEFAULT_AWAIT_EVENT_TIMEOUT_MS, F as questionEscalationTargets, M as downMessageRefusalReasons, P as parseAuthoredAnalystDefinition, T as ANALYST_DEFINITION_BOUNDS } from "../coordination-driver-B2GTcMvx.js";
+import { O as runCoderChecks, mt as selectValidWinner } from "../runtime-DsAHXig2.js";
+import { A as createCoordinationTools, D as analystToolGroupNames, E as DEFAULT_AWAIT_EVENT_TIMEOUT_MS, F as questionEscalationTargets, M as downMessageRefusalReasons, P as parseAuthoredAnalystDefinition, T as ANALYST_DEFINITION_BOUNDS } from "../coordination-driver-BBL_OgRw.js";
 import { n as SUPPORTED_PROTOCOL_VERSIONS, r as createStdioToolServer } from "../tool-server-Dqer2M4_.js";
 import { t as createKbGate } from "../kb-gate-DpaSwXVx.js";
 import { _ as InMemoryFeedbackStore, a as validateDelegationStatusArgs, c as DELEGATION_HISTORY_TOOL_NAME, d as delegationProfiles, f as DELEGATE_FEEDBACK_DESCRIPTION, g as validateDelegateFeedbackArgs, h as createDelegateFeedbackHandler, i as createDelegationStatusHandler, l as createDelegationHistoryHandler, m as DELEGATE_FEEDBACK_TOOL_NAME, n as DELEGATION_STATUS_INPUT_SCHEMA, o as DELEGATION_HISTORY_DESCRIPTION, p as DELEGATE_FEEDBACK_INPUT_SCHEMA, r as DELEGATION_STATUS_TOOL_NAME, s as DELEGATION_HISTORY_INPUT_SCHEMA, t as DELEGATION_STATUS_DESCRIPTION, u as validateDelegationHistoryArgs, v as eventToSnapshot } from "../delegation-status-CF4D0NZ_.js";
 import { n as mcpToolsForRuntimeMcpSubset, t as mcpToolsForRuntimeMcp } from "../openai-tools-DoQ32vpe.js";
 import { t as coderTaskToPrompt } from "../coder-yhVWbdWc.js";
-import { C as composeLoopTraceEmitters, S as capDelegationTrace, _ as FileDelegationStore, a as DELEGATE_UI_AUDIT_TOOL_NAME, b as DELEGATION_TRACE_MAX_SPANS, c as DELEGATE_DESCRIPTION, d as createDelegateHandler, f as validateDelegateArgs, g as DelegationStateCorruptError, h as DelegationPersistenceError, i as DELEGATE_UI_AUDIT_INPUT_SCHEMA, l as DELEGATE_INPUT_SCHEMA, m as hashIdempotencyInput, n as createMcpServer, o as createDelegateUiAuditHandler, p as DelegationTaskQueue, r as DELEGATE_UI_AUDIT_DESCRIPTION, s as validateDelegateUiAuditArgs, t as createInProcessTransport, u as DELEGATE_TOOL_NAME, v as InMemoryDelegationStore, w as createDelegationTraceCollector, x as buildDelegationTraceSpans, y as DELEGATION_TRACE_MAX_BYTES } from "../server-DnSzxChA.js";
+import { C as composeLoopTraceEmitters, S as capDelegationTrace, _ as FileDelegationStore, a as DELEGATE_UI_AUDIT_TOOL_NAME, b as DELEGATION_TRACE_MAX_SPANS, c as DELEGATE_DESCRIPTION, d as createDelegateHandler, f as validateDelegateArgs, g as DelegationStateCorruptError, h as DelegationPersistenceError, i as DELEGATE_UI_AUDIT_INPUT_SCHEMA, l as DELEGATE_INPUT_SCHEMA, m as hashIdempotencyInput, n as createMcpServer, o as createDelegateUiAuditHandler, p as DelegationTaskQueue, r as DELEGATE_UI_AUDIT_DESCRIPTION, s as validateDelegateUiAuditArgs, t as createInProcessTransport, u as DELEGATE_TOOL_NAME, v as InMemoryDelegationStore, w as createDelegationTraceCollector, x as buildDelegationTraceSpans, y as DELEGATION_TRACE_MAX_BYTES } from "../server-Dyc1zvug.js";
 import { a as createMemoryToolServer, c as resolveMemoryFromEnv, i as MEMORY_NAME_ENV, n as MEMORY_ITEMS_ENV, o as parseMemoryItems, r as MEMORY_LOG_ENV, s as readMemoryItemsFile, t as MEMORY_FILE_ENV } from "../memory-server-DXQ8IxGR.js";
 import { agentProfileSchema } from "@tangle-network/agent-interface";
 import { randomUUID } from "node:crypto";

package/dist/{openai-tools-D8ZYHReZ.d.ts → openai-tools-H8QPhTVE.d.ts}

@@ -1,4 +1,4 @@
-import { Za as OpenAIChatTool } from "./types-r7Fzum3M.js";
+import { Ka as OpenAIChatTool } from "./types-D56jQad-.js";
 //#region src/mcp/openai-tools.d.ts
 /**
  *
@@ -21,4 +21,4 @@ declare function mcpToolsForRuntimeMcp(): OpenAIChatTool[];
 declare function mcpToolsForRuntimeMcpSubset(names: ReadonlyArray<string>): OpenAIChatTool[];
 //#endregion
 export { mcpToolsForRuntimeMcpSubset as n, mcpToolsForRuntimeMcp as t };
-//# sourceMappingURL=openai-tools-D8ZYHReZ.d.ts.map
+//# sourceMappingURL=openai-tools-H8QPhTVE.d.ts.map

package/dist/platform.d.ts

@@ -260,5 +260,95 @@ declare class PlatformHubClient {
   private request;
 }
 //#endregion
-export { type AuthorizeUrlOptions, type CatalogResult, type ConnectionHealth, type ConnectionHealthResult, type ExchangeCodeResult, type ExecInput, type HealthCheck, type MintTokenInput, type MintTokenResult, PlatformAuthClient, type PlatformAuthClientOptions, PlatformAuthError, type PlatformCatalogProvider, type PlatformConnection, PlatformHubClient, type PlatformHubClientOptions, PlatformHubError, type PlatformHubStatus, type StartAuthInput, type StartAuthResult };
+//#region src/platform/oidc.d.ts
+/**
+ * Server-side OpenID Connect client for the Tangle authorization server
+ * (Better Auth `oauthProvider`, mounted at `/api/auth/oauth2/*`).
+ *
+ * This is the standard authorization-code + S256 PKCE path. It returns OIDC
+ * tokens and a verified identity, not the `sk-tan` API key that
+ * {@link PlatformAuthClient} returns. Identity scopes do not authorize paid
+ * platform calls, so a consumer that uses the legacy API key as its Hub
+ * bearer must keep {@link PlatformAuthClient} until it no longer needs one.
+ *
+ * The client id and redirect URI must be registered in the platform's
+ * `oauthClient` registry. The legacy `TRUSTED_APPS` registration does not
+ * carry over.
+ */
+interface PlatformOidcClientOptions {
+  /** Platform base URL, e.g. `https://id.tangle.tools`. */
+  baseUrl: string;
+  /** Client id from the platform `oauthClient` registry. */
+  clientId: string;
+  /**
+   * Client secret for a confidential client. Sent with HTTP Basic, the
+   * provider's default `client_secret_basic` method. Omit for a public client
+   * registered with `token_endpoint_auth_method: none`.
+   */
+  clientSecret?: string;
+  /** Registered callback URI. */
+  redirectUri: string;
+  /** Requested scopes. Defaults to `openid profile email offline_access`. */
+  scope?: string;
+  /** Override the global fetch (useful for tests + edge runtimes). */
+  fetchImpl?: typeof fetch;
+}
+interface OidcAuthorizeUrlOptions {
+  /** Required CSRF token; the consumer verifies it on the callback. */
+  state: string;
+  /** RFC 7636 S256 code challenge. See {@link createPkcePair}. */
+  codeChallenge: string;
+  /** OIDC nonce; the consumer checks it against the ID token. */
+  nonce?: string;
+  prompt?: 'login' | 'consent' | 'none';
+  /** Pre-fill the email field on the login screen. */
+  loginHint?: string;
+}
+interface OidcTokens {
+  accessToken: string;
+  tokenType: string;
+  expiresIn?: number;
+  refreshToken?: string;
+  idToken?: string;
+  scope?: string;
+}
+interface OidcUser {
+  id: string;
+  email: string;
+  emailVerified: true;
+  name?: string;
+}
+interface OidcExchangeResult {
+  tokens: OidcTokens;
+  user: OidcUser;
+}
+/** Create an RFC 7636 verifier and its S256 challenge with Web Crypto. */
+declare function createPkcePair(): Promise<{
+  verifier: string;
+  challenge: string;
+}>;
+/** Standard OIDC authorization-code + PKCE client for "Sign in with Tangle". */
+declare class PlatformOidcClient {
+  private readonly baseUrl;
+  private readonly clientId;
+  private readonly clientSecret;
+  private readonly redirectUri;
+  private readonly scope;
+  private readonly fetchImpl;
+  constructor(options: PlatformOidcClientOptions);
+  /** Build the `/api/auth/oauth2/authorize` URL for a browser redirect. */
+  authorizeUrl(options: OidcAuthorizeUrlOptions): string;
+  /** Exchange the callback code, then resolve the verified identity from userinfo. */
+  exchange(code: string, codeVerifier: string): Promise<OidcExchangeResult>;
+  /** Redeem a refresh token. Store the returned refresh token; the provider rotates it. */
+  refresh(refreshToken: string): Promise<OidcTokens>;
+  /** Read the verified identity behind an access token. */
+  userinfo(accessToken: string): Promise<OidcUser>;
+  /** Revoke an access or refresh token (RFC 7009). Disconnect revokes the refresh token. */
+  revoke(token: string, tokenTypeHint?: 'access_token' | 'refresh_token'): Promise<void>;
+  private token;
+  private post;
+}
+//#endregion
+export { type AuthorizeUrlOptions, type CatalogResult, type ConnectionHealth, type ConnectionHealthResult, type ExchangeCodeResult, type ExecInput, type HealthCheck, type MintTokenInput, type MintTokenResult, type OidcAuthorizeUrlOptions, type OidcExchangeResult, type OidcTokens, type OidcUser, PlatformAuthClient, type PlatformAuthClientOptions, PlatformAuthError, type PlatformCatalogProvider, type PlatformConnection, PlatformHubClient, type PlatformHubClientOptions, PlatformHubError, type PlatformHubStatus, PlatformOidcClient, type PlatformOidcClientOptions, type StartAuthInput, type StartAuthResult, createPkcePair };
 //# sourceMappingURL=platform.d.ts.map

package/dist/platform.js

@@ -10,10 +10,10 @@ var PlatformAuthError = class extends Error {
 		this.name = "PlatformAuthError";
 	}
 };
-function isRecord(value) {
+function isRecord$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function isNonemptyString(value) {
+function isNonemptyString$1(value) {
 	return typeof value === "string" && value.trim().length > 0;
 }
 /** Validate the platform's verified identity before consumers create a local session. */
@@ -21,15 +21,15 @@ function parseExchangeResult(body, status) {
 	const invalid = () => {
 		throw new PlatformAuthError("Platform exchange response has no valid verified identity", status, { code: "INVALID_EXCHANGE_RESPONSE" });
 	};
-	if (!isRecord(body) || !isNonemptyString(body.apiKey) || body.emailVerified !== true || !isRecord(body.user)) return invalid();
+	if (!isRecord$1(body) || !isNonemptyString$1(body.apiKey) || body.emailVerified !== true || !isRecord$1(body.user)) return invalid();
 	const user = body.user;
-	if (!isNonemptyString(user.id) || !isNonemptyString(user.email)) return invalid();
+	if (!isNonemptyString$1(user.id) || !isNonemptyString$1(user.email)) return invalid();
 	const email = user.email.trim();
 	if (email.length > 320 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) || /(?:@users\.noreply\.tangle\.tools$|^0x[a-f0-9]{40}@tangle\.tools$)/i.test(email)) return invalid();
 	if (user.name !== void 0 && user.name !== null && typeof user.name !== "string") return invalid();
 	let plan = null;
 	if (body.subscription !== void 0) {
-		if (!isRecord(body.subscription) || !isNonemptyString(body.subscription.plan)) return invalid();
+		if (!isRecord$1(body.subscription) || !isNonemptyString$1(body.subscription.plan)) return invalid();
 		plan = { tier: body.subscription.plan };
 	}
 	return {
@@ -220,6 +220,162 @@ var PlatformHubClient = class {
 	}
 };
 //#endregion
-export { PlatformAuthClient, PlatformAuthError, PlatformHubClient, PlatformHubError };
+//#region src/platform/oidc.ts
+/**
+* Server-side OpenID Connect client for the Tangle authorization server
+* (Better Auth `oauthProvider`, mounted at `/api/auth/oauth2/*`).
+*
+* This is the standard authorization-code + S256 PKCE path. It returns OIDC
+* tokens and a verified identity, not the `sk-tan` API key that
+* {@link PlatformAuthClient} returns. Identity scopes do not authorize paid
+* platform calls, so a consumer that uses the legacy API key as its Hub
+* bearer must keep {@link PlatformAuthClient} until it no longer needs one.
+*
+* The client id and redirect URI must be registered in the platform's
+* `oauthClient` registry. The legacy `TRUSTED_APPS` registration does not
+* carry over.
+*/
+const DEFAULT_SCOPE = "openid profile email offline_access";
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isNonemptyString(value) {
+	return typeof value === "string" && value.trim().length > 0;
+}
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** Create an RFC 7636 verifier and its S256 challenge with Web Crypto. */
+async function createPkcePair() {
+	const verifier = base64url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return {
+		verifier,
+		challenge: base64url(new Uint8Array(digest))
+	};
+}
+function oauthError(body, fallback) {
+	if (!isRecord(body)) return fallback;
+	if (isNonemptyString(body.error_description)) return body.error_description;
+	if (isNonemptyString(body.error)) return body.error;
+	return fallback;
+}
+function parseTokens(body, status) {
+	if (!isRecord(body) || !isNonemptyString(body.access_token)) throw new PlatformAuthError("Platform token response is malformed", status, { code: "INVALID_TOKEN_RESPONSE" });
+	return {
+		accessToken: body.access_token,
+		tokenType: isNonemptyString(body.token_type) ? body.token_type : "Bearer",
+		...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {},
+		...isNonemptyString(body.refresh_token) ? { refreshToken: body.refresh_token } : {},
+		...isNonemptyString(body.id_token) ? { idToken: body.id_token } : {},
+		...isNonemptyString(body.scope) ? { scope: body.scope } : {}
+	};
+}
+/** Standard OIDC authorization-code + PKCE client for "Sign in with Tangle". */
+var PlatformOidcClient = class {
+	baseUrl;
+	clientId;
+	clientSecret;
+	redirectUri;
+	scope;
+	fetchImpl;
+	constructor(options) {
+		if (!options.baseUrl) throw new Error("PlatformOidcClient: baseUrl is required");
+		if (!options.clientId) throw new Error("PlatformOidcClient: clientId is required");
+		if (!options.redirectUri) throw new Error("PlatformOidcClient: redirectUri is required");
+		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+		this.clientId = options.clientId;
+		this.clientSecret = options.clientSecret || void 0;
+		this.redirectUri = options.redirectUri;
+		this.scope = options.scope ?? DEFAULT_SCOPE;
+		this.fetchImpl = options.fetchImpl ?? ((url, init) => fetch(url, init));
+	}
+	/** Build the `/api/auth/oauth2/authorize` URL for a browser redirect. */
+	authorizeUrl(options) {
+		if (!options.state) throw new Error("PlatformOidcClient.authorizeUrl: state is required for CSRF");
+		if (!options.codeChallenge) throw new Error("PlatformOidcClient.authorizeUrl: codeChallenge is required for PKCE");
+		const url = new URL("/api/auth/oauth2/authorize", this.baseUrl);
+		url.searchParams.set("client_id", this.clientId);
+		url.searchParams.set("redirect_uri", this.redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", this.scope);
+		url.searchParams.set("state", options.state);
+		url.searchParams.set("code_challenge", options.codeChallenge);
+		url.searchParams.set("code_challenge_method", "S256");
+		if (options.nonce) url.searchParams.set("nonce", options.nonce);
+		if (options.prompt) url.searchParams.set("prompt", options.prompt);
+		if (options.loginHint) url.searchParams.set("login_hint", options.loginHint);
+		return url.toString();
+	}
+	/** Exchange the callback code, then resolve the verified identity from userinfo. */
+	async exchange(code, codeVerifier) {
+		if (!code) throw new Error("PlatformOidcClient.exchange: code is required");
+		if (!codeVerifier) throw new Error("PlatformOidcClient.exchange: codeVerifier is required for PKCE");
+		const tokens = await this.token({
+			grant_type: "authorization_code",
+			code,
+			redirect_uri: this.redirectUri,
+			code_verifier: codeVerifier
+		});
+		return {
+			tokens,
+			user: await this.userinfo(tokens.accessToken)
+		};
+	}
+	/** Redeem a refresh token. Store the returned refresh token; the provider rotates it. */
+	async refresh(refreshToken) {
+		if (!refreshToken) throw new Error("PlatformOidcClient.refresh: refreshToken is required");
+		return this.token({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken
+		});
+	}
+	/** Read the verified identity behind an access token. */
+	async userinfo(accessToken) {
+		const res = await this.fetchImpl(`${this.baseUrl}/api/auth/oauth2/userinfo`, { headers: { authorization: `Bearer ${accessToken}` } });
+		const body = await res.json().catch(() => null);
+		if (!res.ok) throw new PlatformAuthError(oauthError(body, `Platform userinfo failed (${res.status})`), res.status, body);
+		if (!isRecord(body) || !isNonemptyString(body.sub) || !isNonemptyString(body.email) || body.email_verified !== true) throw new PlatformAuthError("Platform userinfo has no verified identity", res.status, { code: "INVALID_USERINFO_RESPONSE" });
+		return {
+			id: body.sub,
+			email: body.email,
+			emailVerified: true,
+			...isNonemptyString(body.name) ? { name: body.name } : {}
+		};
+	}
+	/** Revoke an access or refresh token (RFC 7009). Disconnect revokes the refresh token. */
+	async revoke(token, tokenTypeHint) {
+		if (!token) throw new Error("PlatformOidcClient.revoke: token is required");
+		const res = await this.post("/api/auth/oauth2/revoke", {
+			token,
+			...tokenTypeHint ? { token_type_hint: tokenTypeHint } : {}
+		});
+		if (!res.ok) {
+			const body = await res.json().catch(() => null);
+			throw new PlatformAuthError(oauthError(body, `Platform revoke failed (${res.status})`), res.status, body);
+		}
+	}
+	async token(params) {
+		const res = await this.post("/api/auth/oauth2/token", params);
+		const body = await res.json().catch(() => null);
+		if (!res.ok) throw new PlatformAuthError(oauthError(body, `Platform token request failed (${res.status})`), res.status, body);
+		return parseTokens(body, res.status);
+	}
+	post(path, params) {
+		const body = new URLSearchParams(params);
+		const headers = { "content-type": "application/x-www-form-urlencoded" };
+		if (this.clientSecret) headers.authorization = `Basic ${btoa(`${this.clientId}:${this.clientSecret}`)}`;
+		else body.set("client_id", this.clientId);
+		return this.fetchImpl(`${this.baseUrl}${path}`, {
+			method: "POST",
+			headers,
+			body
+		});
+	}
+};
+//#endregion
+export { PlatformAuthClient, PlatformAuthError, PlatformHubClient, PlatformHubError, PlatformOidcClient, createPkcePair };
 
 //# sourceMappingURL=platform.js.map

package/dist/platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform.js","names":[],"sources":["../src/platform/auth.ts","../src/platform/integrations.ts"],"sourcesContent":["/**\n * Server-side client for the Tangle platform's cross-site SSO bridge.\n *\n * Consumer apps (gtm-agent, tax-agent, legal-agent, creative-agent, …)\n * use this to:\n *   1. Build an /authorize URL that lands the user on id.tangle.tools\n *      and brings them back with a single-use code.\n *   2. Exchange that code for an API key + the user's identity.\n *\n * The platform endpoint contract is documented in\n * `products/platform/api/src/routes/cross-site.ts`. This client only\n * speaks HTTP — no SDK weight, no transitive deps.\n */\n\nexport interface PlatformAuthClientOptions {\n  /** Platform base URL, e.g. `https://id.tangle.tools`. */\n  baseUrl: string\n  /** App id as registered in the platform's TRUSTED_APPS registry. */\n  appId: string\n  /** Override the global fetch (useful for tests + edge runtimes). */\n  fetchImpl?: typeof fetch\n}\n\nexport interface AuthorizeUrlOptions {\n  /** Required CSRF token; the consumer verifies it on the callback. */\n  state: string\n  /**\n   * Final redirect URI. Must be one of the URIs registered for `appId`\n   * on the platform. Omit to use the first registered URI.\n   */\n  redirectUri?: string\n  /** Force the login screen even if a session is already active. */\n  prompt?: 'login'\n  /** Pre-fill the email field on the login screen. */\n  email?: string\n}\n\nexport interface ExchangeCodeResult {\n  apiKey: string\n  emailVerified: true\n  user: {\n    id: string\n    email: string\n    name?: string | null\n  }\n  /** Null when the platform could not provide a subscription. This is not a paid-access grant. */\n  plan: {\n    tier: string\n  } | null\n}\n\n/** Thrown when a `PlatformAuthClient` request returns a non-success status. */\nexport class PlatformAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly body: unknown,\n  ) {\n    super(message)\n    this.name = 'PlatformAuthError'\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\nfunction isNonemptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.trim().length > 0\n}\n\n/** Validate the platform's verified identity before consumers create a local session. */\nfunction parseExchangeResult(body: unknown, status: number): ExchangeCodeResult {\n  const invalid = (): never => {\n    // A successful but malformed response can contain the one-time API secret.\n    throw new PlatformAuthError(\n      'Platform exchange response has no valid verified identity',\n      status,\n      { code: 'INVALID_EXCHANGE_RESPONSE' },\n    )\n  }\n  if (\n    !isRecord(body) ||\n    !isNonemptyString(body.apiKey) ||\n    body.emailVerified !== true ||\n    !isRecord(body.user)\n  )\n    return invalid()\n  const user = body.user\n  if (!isNonemptyString(user.id) || !isNonemptyString(user.email)) return invalid()\n  const email = user.email.trim()\n  if (\n    email.length > 320 ||\n    !/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email) ||\n    /(?:@users\\.noreply\\.tangle\\.tools$|^0x[a-f0-9]{40}@tangle\\.tools$)/i.test(email)\n  )\n    return invalid()\n  if (user.name !== undefined && user.name !== null && typeof user.name !== 'string')\n    return invalid()\n  let plan: ExchangeCodeResult['plan'] = null\n  if (body.subscription !== undefined) {\n    if (!isRecord(body.subscription) || !isNonemptyString(body.subscription.plan)) return invalid()\n    plan = { tier: body.subscription.plan }\n  }\n  return {\n    apiKey: body.apiKey,\n    emailVerified: true,\n    user: { id: user.id, email, ...(user.name !== undefined ? { name: user.name } : {}) },\n    plan,\n  }\n}\n\n/** HTTP client for the Tangle Platform SSO: builds authorize URLs and exchanges auth codes for API keys. */\nexport class PlatformAuthClient {\n  private readonly baseUrl: string\n  private readonly appId: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: PlatformAuthClientOptions) {\n    if (!options.baseUrl) throw new Error('PlatformAuthClient: baseUrl is required')\n    if (!options.appId) throw new Error('PlatformAuthClient: appId is required')\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, '')\n    this.appId = options.appId\n    this.fetchImpl =\n      options.fetchImpl ??\n      ((url: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => fetch(url, init))\n  }\n\n  /**\n   * Build the URL the user is redirected to in order to start SSO.\n   * The platform redirects back to one of `appId`'s registered\n   * `redirectUris` with `?code=...&app=...&state=...`.\n   */\n  authorizeUrl(options: AuthorizeUrlOptions): string {\n    if (!options.state) {\n      throw new Error('PlatformAuthClient.authorizeUrl: state is required for CSRF')\n    }\n    const url = new URL('/cross-site/authorize', this.baseUrl)\n    url.searchParams.set('app', this.appId)\n    url.searchParams.set('state', options.state)\n    if (options.redirectUri) url.searchParams.set('redirect', options.redirectUri)\n    if (options.prompt) url.searchParams.set('prompt', options.prompt)\n    if (options.email) url.searchParams.set('email', options.email)\n    return url.toString()\n  }\n\n  /**\n   * Exchange a single-use auth code (delivered to the consumer's\n   * callback by the platform) for an API key + the user's identity.\n   * Codes are single-use and expire ~5 minutes after issue.\n   */\n  async exchange(code: string): Promise<ExchangeCodeResult> {\n    if (!code) throw new Error('PlatformAuthClient.exchange: code is required')\n    const res = await this.fetchImpl(`${this.baseUrl}/cross-site/exchange`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ code, app: this.appId }),\n    })\n    const body = await res.json().catch(() => null)\n    if (!res.ok) {\n      const message =\n        body && typeof body === 'object' && 'error' in body && typeof body.error === 'string'\n          ? body.error\n          : `Platform exchange failed (${res.status})`\n      throw new PlatformAuthError(message, res.status, body)\n    }\n    return parseExchangeResult(body, res.status)\n  }\n}\n","/**\n * Server-side client for the Tangle platform's integration hub\n * (`/v1/hub/*`). Consumer apps use this instead of rolling their own\n * OAuth + connection tables.\n *\n * Auth: the caller supplies a bearer (either the user's API key from\n * cross-site exchange, or a platform service token) on construction.\n *\n * Endpoint contract (authoritative): the platform's `src/lib/hub-contract.ts`\n * + `src/routes/hub.ts`. The platform wraps every response in\n * `{ success, data }`; non-2xx or `success:false` surfaces as `PlatformHubError`\n * carrying the real upstream status.\n */\n\nexport interface PlatformHubClientOptions {\n  /** Platform base URL, e.g. `https://id.tangle.tools`. */\n  baseUrl: string\n  /** Bearer credential — user API key or service token. */\n  bearer: string\n  /** Override fetch (tests + edge runtimes). */\n  fetchImpl?: typeof fetch\n}\n\n/** A live integration connection, as returned by `/v1/hub/connections`. */\nexport interface PlatformConnection {\n  id: string\n  providerId: string\n  displayName: string\n  accountDisplay: string | null\n  scopes: string[]\n  status: 'active' | 'revoked' | 'unhealthy' | 'reconnect_required' | (string & {})\n  health: 'unknown' | 'healthy' | 'unhealthy' | 'rate_limited' | (string & {})\n  createdAt: string\n  updatedAt: string\n  lastUsedAt: string | null\n}\n\n/** A connectable provider in the catalog (`/v1/hub/providers`). */\nexport interface PlatformCatalogProvider {\n  providerId: string\n  title?: string\n  authKind?: string\n  category?: string\n  scopes?: string[]\n  capabilityCount?: number\n  native?: boolean\n  /** Whether the OAuth app's credentials are wired — the UI offers Connect\n   *  only when true. */\n  configured?: boolean\n  [k: string]: unknown\n}\n\nexport interface CatalogResult {\n  providers: PlatformCatalogProvider[]\n  /** Count of substrate-bundled connectors behind the catalog. */\n  substrateBundled?: number\n  [k: string]: unknown\n}\n\nexport interface StartAuthInput {\n  /** The provider to connect (goes in the URL path). */\n  providerId: string\n  /** Accepted for interface compatibility; the platform's start endpoint is\n   *  provider-level and does not consume a connector id. */\n  connectorId?: string\n  /** Where the platform redirects the user back to after OAuth. */\n  returnUrl: string\n  /** Accepted for interface compatibility; not consumed by the start endpoint. */\n  requestedScopes?: string[]\n  /** CLI flow flag — affects the platform's post-auth redirect handling. */\n  cli?: boolean\n}\n\nexport interface StartAuthResult {\n  /** The URL to send the user to. Normalized across the platform's two start\n   *  branches: github returns `authorizationUrl`, substrate returns\n   *  `redirectUrl`. */\n  authorizationUrl: string\n  state: string\n  expiresAt?: string\n  scopes?: string[]\n}\n\nexport interface ConnectionHealth {\n  status: 'unknown' | 'healthy' | 'unhealthy' | 'rate_limited' | (string & {})\n  checkedAt: string\n  error?: { code: string; message: string }\n}\n\nexport interface ConnectionHealthResult {\n  connection: PlatformConnection\n  health: ConnectionHealth\n}\n\n/** Last-known health for a connection, derived from the connection row. */\nexport interface HealthCheck {\n  connectionId: string\n  providerId: string\n  /** Mirrors `PlatformConnection.health`. */\n  status: ConnectionHealth['status']\n  checkedAt?: string\n}\n\nexport interface MintTokenInput {\n  /** The hub action the token authorizes (e.g. `slack.chat.postMessage`). */\n  actionPath: string\n  /** Bind to a specific connection, or … */\n  connectionId?: string\n  /** … resolve the connection by provider for the calling user. */\n  provider?: string\n}\n\nexport interface MintTokenResult {\n  tokenId: string\n  token: string\n  expiresAt: string\n}\n\nexport interface ExecInput {\n  /** The hub action path to execute. */\n  path: string\n  input?: unknown\n  connectionId?: string\n}\n\nexport interface PlatformHubStatus {\n  contract?: unknown\n  principal: { kind: string; userId: string; [k: string]: unknown }\n  connections: { connectedProviderCount: number; unhealthyProviderCount: number }\n}\n\n/** Thrown when a `PlatformHubClient` request returns a non-success status. */\nexport class PlatformHubError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code: string | undefined,\n    public readonly body: unknown,\n  ) {\n    super(message)\n    this.name = 'PlatformHubError'\n  }\n}\n\ninterface PlatformEnvelope<T> {\n  success: boolean\n  data?: T\n  error?: { code?: string; message?: string } | string\n}\n\n/** HTTP client for the Tangle Platform Hub API: provider catalog, connection flow, and status. */\nexport class PlatformHubClient {\n  private readonly baseUrl: string\n  private readonly bearer: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: PlatformHubClientOptions) {\n    if (!options.baseUrl) throw new Error('PlatformHubClient: baseUrl is required')\n    if (!options.bearer) throw new Error('PlatformHubClient: bearer is required')\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, '')\n    this.bearer = options.bearer\n    this.fetchImpl =\n      options.fetchImpl ??\n      ((url: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => fetch(url, init))\n  }\n\n  /** GET /v1/hub/providers — the connectable provider catalog. */\n  catalog(): Promise<CatalogResult> {\n    return this.request('GET', '/v1/hub/providers')\n  }\n\n  /** GET /v1/hub/connections — the calling user's live connections. */\n  async listConnections(): Promise<PlatformConnection[]> {\n    const data = await this.request<{ connections: PlatformConnection[] }>(\n      'GET',\n      '/v1/hub/connections',\n    )\n    return data.connections\n  }\n\n  /** DELETE /v1/hub/connections/:connectionId — revoke + disable a connection. */\n  revokeConnection(connectionId: string): Promise<{ connection: PlatformConnection }> {\n    return this.request('DELETE', `/v1/hub/connections/${encodeURIComponent(connectionId)}`)\n  }\n\n  /**\n   * POST /v1/hub/connections/:provider/start — begin OAuth/grant. The provider\n   * is taken from the URL; the body carries `returnUrl` (+ `cli`). The platform's\n   * two start branches name the URL field differently (github → `authorizationUrl`,\n   * substrate → `redirectUrl`); this normalizes to `authorizationUrl`.\n   */\n  async startAuth(input: StartAuthInput): Promise<StartAuthResult> {\n    const body: { returnUrl: string; cli?: boolean } = { returnUrl: input.returnUrl }\n    if (input.cli !== undefined) body.cli = input.cli\n    const data = await this.request<{\n      authorizationUrl?: string\n      redirectUrl?: string\n      state: string\n      expiresAt?: string\n      scopes?: string[]\n    }>('POST', `/v1/hub/connections/${encodeURIComponent(input.providerId)}/start`, body)\n    const authorizationUrl = data.authorizationUrl ?? data.redirectUrl\n    if (!authorizationUrl) {\n      throw new PlatformHubError(\n        'Platform hub start response missing an authorization URL',\n        502,\n        'HUB_INVALID_START_RESPONSE',\n        data,\n      )\n    }\n    return { authorizationUrl, state: data.state, expiresAt: data.expiresAt, scopes: data.scopes }\n  }\n\n  /**\n   * Last-known health for every connection. The platform has no global\n   * healthcheck listing — health rides on each connection row — so this derives\n   * the list from `listConnections()` (one request, no extra round-trips).\n   */\n  async listHealthchecks(): Promise<HealthCheck[]> {\n    const connections = await this.listConnections()\n    return connections.map((c) => ({\n      connectionId: c.id,\n      providerId: c.providerId,\n      status: c.health,\n      checkedAt: c.updatedAt,\n    }))\n  }\n\n  /**\n   * POST /v1/hub/connections/:connectionId/health — trigger a fresh health\n   * probe for one connection and return its updated state.\n   */\n  checkConnectionHealth(connectionId: string): Promise<ConnectionHealthResult> {\n    return this.request('POST', `/v1/hub/connections/${encodeURIComponent(connectionId)}/health`)\n  }\n\n  /**\n   * Trigger a fresh health probe across all of the user's connections. The\n   * platform exposes health per-connection only, so this fans out over\n   * `listConnections()`. `scheduled` is the number of probes dispatched.\n   */\n  async runHealthchecks(): Promise<{ scheduled: number }> {\n    const connections = await this.listConnections()\n    await Promise.allSettled(connections.map((c) => this.checkConnectionHealth(c.id)))\n    return { scheduled: connections.length }\n  }\n\n  /** GET /v1/hub/status — principal + aggregate connection counts. */\n  status(): Promise<PlatformHubStatus> {\n    return this.request('GET', '/v1/hub/status')\n  }\n\n  /**\n   * POST /v1/hub/tokens — mint a short-lived, action-scoped capability token a\n   * sandbox can use to invoke one hub action on the user's behalf without\n   * seeing the underlying provider credential.\n   */\n  mintToken(input: MintTokenInput): Promise<MintTokenResult> {\n    return this.request('POST', '/v1/hub/tokens', input)\n  }\n\n  /** POST /v1/hub/exec — execute a hub action and return its result. */\n  async exec(input: ExecInput): Promise<unknown> {\n    const data = await this.request<{ result: unknown }>('POST', '/v1/hub/exec', input)\n    return data.result\n  }\n\n  private async request<T>(\n    method: 'GET' | 'POST' | 'DELETE' | 'PUT',\n    path: string,\n    body?: unknown,\n  ): Promise<T> {\n    const headers: Record<string, string> = {\n      authorization: `Bearer ${this.bearer}`,\n      accept: 'application/json',\n    }\n    if (body !== undefined) headers['content-type'] = 'application/json'\n\n    const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n      method,\n      headers,\n      body: body !== undefined ? JSON.stringify(body) : undefined,\n    })\n    const text = await res.text()\n    let parsed: PlatformEnvelope<T> | null = null\n    if (text) {\n      try {\n        parsed = JSON.parse(text)\n      } catch {\n        // fall through to error handling below\n      }\n    }\n    if (!res.ok || (parsed && parsed.success === false)) {\n      const code = parsed?.error && typeof parsed.error === 'object' ? parsed.error.code : undefined\n      const message =\n        (parsed?.error && typeof parsed.error === 'object' && parsed.error.message) ||\n        (typeof parsed?.error === 'string' ? parsed.error : `Platform hub error (${res.status})`)\n      throw new PlatformHubError(message, res.status, code, parsed ?? text)\n    }\n    if (!parsed) {\n      throw new PlatformHubError(\n        `Platform hub returned non-JSON success (${res.status})`,\n        res.status,\n        undefined,\n        text,\n      )\n    }\n    if (parsed.data === undefined) {\n      throw new PlatformHubError(\n        'Platform hub envelope missing `data`',\n        res.status,\n        undefined,\n        parsed,\n      )\n    }\n    return parsed.data\n  }\n}\n"],"mappings":";;AAoDA,IAAa,oBAAb,cAAuC,MAAM;CAGzB;CACA;CAHlB,YACE,SACA,QACA,MACA;EACA,MAAM,OAAO;EAHG,KAAA,SAAA;EACA,KAAA,OAAA;EAGhB,KAAK,OAAO;CACd;AACF;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS;AAC5D;;AAGA,SAAS,oBAAoB,MAAe,QAAoC;CAC9E,MAAM,gBAAuB;EAE3B,MAAM,IAAI,kBACR,6DACA,QACA,EAAE,MAAM,4BAA4B,CACtC;CACF;CACA,IACE,CAAC,SAAS,IAAI,KACd,CAAC,iBAAiB,KAAK,MAAM,KAC7B,KAAK,kBAAkB,QACvB,CAAC,SAAS,KAAK,IAAI,GAEnB,OAAO,QAAQ;CACjB,MAAM,OAAO,KAAK;CAClB,IAAI,CAAC,iBAAiB,KAAK,EAAE,KAAK,CAAC,iBAAiB,KAAK,KAAK,GAAG,OAAO,QAAQ;CAChF,MAAM,QAAQ,KAAK,MAAM,KAAK;CAC9B,IACE,MAAM,SAAS,OACf,CAAC,6BAA6B,KAAK,KAAK,KACxC,sEAAsE,KAAK,KAAK,GAEhF,OAAO,QAAQ;CACjB,IAAI,KAAK,SAAS,KAAA,KAAa,KAAK,SAAS,QAAQ,OAAO,KAAK,SAAS,UACxE,OAAO,QAAQ;CACjB,IAAI,OAAmC;CACvC,IAAI,KAAK,iBAAiB,KAAA,GAAW;EACnC,IAAI,CAAC,SAAS,KAAK,YAAY,KAAK,CAAC,iBAAiB,KAAK,aAAa,IAAI,GAAG,OAAO,QAAQ;EAC9F,OAAO,EAAE,MAAM,KAAK,aAAa,KAAK;CACxC;CACA,OAAO;EACL,QAAQ,KAAK;EACb,eAAe;EACf,MAAM;GAAE,IAAI,KAAK;GAAI;GAAO,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;EAAG;EACpF;CACF;AACF;;AAGA,IAAa,qBAAb,MAAgC;CAC9B;CACA;CACA;CAEA,YAAY,SAAoC;EAC9C,IAAI,CAAC,QAAQ,SAAS,MAAM,IAAI,MAAM,yCAAyC;EAC/E,IAAI,CAAC,QAAQ,OAAO,MAAM,IAAI,MAAM,uCAAuC;EAC3E,KAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;EACjD,KAAK,QAAQ,QAAQ;EACrB,KAAK,YACH,QAAQ,eACN,KAAkC,SAAuC,MAAM,KAAK,IAAI;CAC9F;;;;;;CAOA,aAAa,SAAsC;EACjD,IAAI,CAAC,QAAQ,OACX,MAAM,IAAI,MAAM,6DAA6D;EAE/E,MAAM,MAAM,IAAI,IAAI,yBAAyB,KAAK,OAAO;EACzD,IAAI,aAAa,IAAI,OAAO,KAAK,KAAK;EACtC,IAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;EAC3C,IAAI,QAAQ,aAAa,IAAI,aAAa,IAAI,YAAY,QAAQ,WAAW;EAC7E,IAAI,QAAQ,QAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;EACjE,IAAI,QAAQ,OAAO,IAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;EAC9D,OAAO,IAAI,SAAS;CACtB;;;;;;CAOA,MAAM,SAAS,MAA2C;EACxD,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,+CAA+C;EAC1E,MAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,uBAAuB;GACtE,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU;IAAE;IAAM,KAAK,KAAK;GAAM,CAAC;EAChD,CAAC;EACD,MAAM,OAAO,MAAM,IAAI,KAAK,CAAC,CAAC,YAAY,IAAI;EAC9C,IAAI,CAAC,IAAI,IAKP,MAAM,IAAI,kBAHR,QAAQ,OAAO,SAAS,YAAY,WAAW,QAAQ,OAAO,KAAK,UAAU,WACzE,KAAK,QACL,6BAA6B,IAAI,OAAO,IACT,IAAI,QAAQ,IAAI;EAEvD,OAAO,oBAAoB,MAAM,IAAI,MAAM;CAC7C;AACF;;;;ACpCA,IAAa,mBAAb,cAAsC,MAAM;CAGxB;CACA;CACA;CAJlB,YACE,SACA,QACA,MACA,MACA;EACA,MAAM,OAAO;EAJG,KAAA,SAAA;EACA,KAAA,OAAA;EACA,KAAA,OAAA;EAGhB,KAAK,OAAO;CACd;AACF;;AASA,IAAa,oBAAb,MAA+B;CAC7B;CACA;CACA;CAEA,YAAY,SAAmC;EAC7C,IAAI,CAAC,QAAQ,SAAS,MAAM,IAAI,MAAM,wCAAwC;EAC9E,IAAI,CAAC,QAAQ,QAAQ,MAAM,IAAI,MAAM,uCAAuC;EAC5E,KAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;EACjD,KAAK,SAAS,QAAQ;EACtB,KAAK,YACH,QAAQ,eACN,KAAkC,SAAuC,MAAM,KAAK,IAAI;CAC9F;;CAGA,UAAkC;EAChC,OAAO,KAAK,QAAQ,OAAO,mBAAmB;CAChD;;CAGA,MAAM,kBAAiD;EAKrD,QAAO,MAJY,KAAK,QACtB,OACA,qBACF,EAAA,CACY;CACd;;CAGA,iBAAiB,cAAmE;EAClF,OAAO,KAAK,QAAQ,UAAU,uBAAuB,mBAAmB,YAAY,GAAG;CACzF;;;;;;;CAQA,MAAM,UAAU,OAAiD;EAC/D,MAAM,OAA6C,EAAE,WAAW,MAAM,UAAU;EAChF,IAAI,MAAM,QAAQ,KAAA,GAAW,KAAK,MAAM,MAAM;EAC9C,MAAM,OAAO,MAAM,KAAK,QAMrB,QAAQ,uBAAuB,mBAAmB,MAAM,UAAU,EAAE,SAAS,IAAI;EACpF,MAAM,mBAAmB,KAAK,oBAAoB,KAAK;EACvD,IAAI,CAAC,kBACH,MAAM,IAAI,iBACR,4DACA,KACA,8BACA,IACF;EAEF,OAAO;GAAE;GAAkB,OAAO,KAAK;GAAO,WAAW,KAAK;GAAW,QAAQ,KAAK;EAAO;CAC/F;;;;;;CAOA,MAAM,mBAA2C;EAE/C,QAAO,MADmB,KAAK,gBAAgB,EAAA,CAC5B,KAAK,OAAO;GAC7B,cAAc,EAAE;GAChB,YAAY,EAAE;GACd,QAAQ,EAAE;GACV,WAAW,EAAE;EACf,EAAE;CACJ;;;;;CAMA,sBAAsB,cAAuD;EAC3E,OAAO,KAAK,QAAQ,QAAQ,uBAAuB,mBAAmB,YAAY,EAAE,QAAQ;CAC9F;;;;;;CAOA,MAAM,kBAAkD;EACtD,MAAM,cAAc,MAAM,KAAK,gBAAgB;EAC/C,MAAM,QAAQ,WAAW,YAAY,KAAK,MAAM,KAAK,sBAAsB,EAAE,EAAE,CAAC,CAAC;EACjF,OAAO,EAAE,WAAW,YAAY,OAAO;CACzC;;CAGA,SAAqC;EACnC,OAAO,KAAK,QAAQ,OAAO,gBAAgB;CAC7C;;;;;;CAOA,UAAU,OAAiD;EACzD,OAAO,KAAK,QAAQ,QAAQ,kBAAkB,KAAK;CACrD;;CAGA,MAAM,KAAK,OAAoC;EAE7C,QAAO,MADY,KAAK,QAA6B,QAAQ,gBAAgB,KAAK,EAAA,CACtE;CACd;CAEA,MAAc,QACZ,QACA,MACA,MACY;EACZ,MAAM,UAAkC;GACtC,eAAe,UAAU,KAAK;GAC9B,QAAQ;EACV;EACA,IAAI,SAAS,KAAA,GAAW,QAAQ,kBAAkB;EAElD,MAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GACzD;GACA;GACA,MAAM,SAAS,KAAA,IAAY,KAAK,UAAU,IAAI,IAAI,KAAA;EACpD,CAAC;EACD,MAAM,OAAO,MAAM,IAAI,KAAK;EAC5B,IAAI,SAAqC;EACzC,IAAI,MACF,IAAI;GACF,SAAS,KAAK,MAAM,IAAI;EAC1B,QAAQ,CAER;EAEF,IAAI,CAAC,IAAI,MAAO,UAAU,OAAO,YAAY,OAAQ;GACnD,MAAM,OAAO,QAAQ,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,OAAO,KAAA;GAIrF,MAAM,IAAI,iBAFP,QAAQ,SAAS,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,YAClE,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ,uBAAuB,IAAI,OAAO,KACpD,IAAI,QAAQ,MAAM,UAAU,IAAI;EACtE;EACA,IAAI,CAAC,QACH,MAAM,IAAI,iBACR,2CAA2C,IAAI,OAAO,IACtD,IAAI,QACJ,KAAA,GACA,IACF;EAEF,IAAI,OAAO,SAAS,KAAA,GAClB,MAAM,IAAI,iBACR,wCACA,IAAI,QACJ,KAAA,GACA,MACF;EAEF,OAAO,OAAO;CAChB;AACF"}
+{"version":3,"file":"platform.js","names":["isRecord","isNonemptyString"],"sources":["../src/platform/auth.ts","../src/platform/integrations.ts","../src/platform/oidc.ts"],"sourcesContent":["/**\n * Server-side client for the Tangle platform's cross-site SSO bridge.\n *\n * Consumer apps (gtm-agent, tax-agent, legal-agent, creative-agent, …)\n * use this to:\n *   1. Build an /authorize URL that lands the user on id.tangle.tools\n *      and brings them back with a single-use code.\n *   2. Exchange that code for an API key + the user's identity.\n *\n * The platform endpoint contract is documented in\n * `products/platform/api/src/routes/cross-site.ts`. This client only\n * speaks HTTP — no SDK weight, no transitive deps.\n */\n\nexport interface PlatformAuthClientOptions {\n  /** Platform base URL, e.g. `https://id.tangle.tools`. */\n  baseUrl: string\n  /** App id as registered in the platform's TRUSTED_APPS registry. */\n  appId: string\n  /** Override the global fetch (useful for tests + edge runtimes). */\n  fetchImpl?: typeof fetch\n}\n\nexport interface AuthorizeUrlOptions {\n  /** Required CSRF token; the consumer verifies it on the callback. */\n  state: string\n  /**\n   * Final redirect URI. Must be one of the URIs registered for `appId`\n   * on the platform. Omit to use the first registered URI.\n   */\n  redirectUri?: string\n  /** Force the login screen even if a session is already active. */\n  prompt?: 'login'\n  /** Pre-fill the email field on the login screen. */\n  email?: string\n}\n\nexport interface ExchangeCodeResult {\n  apiKey: string\n  emailVerified: true\n  user: {\n    id: string\n    email: string\n    name?: string | null\n  }\n  /** Null when the platform could not provide a subscription. This is not a paid-access grant. */\n  plan: {\n    tier: string\n  } | null\n}\n\n/** Thrown when a `PlatformAuthClient` request returns a non-success status. */\nexport class PlatformAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly body: unknown,\n  ) {\n    super(message)\n    this.name = 'PlatformAuthError'\n  }\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\nfunction isNonemptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.trim().length > 0\n}\n\n/** Validate the platform's verified identity before consumers create a local session. */\nfunction parseExchangeResult(body: unknown, status: number): ExchangeCodeResult {\n  const invalid = (): never => {\n    // A successful but malformed response can contain the one-time API secret.\n    throw new PlatformAuthError(\n      'Platform exchange response has no valid verified identity',\n      status,\n      { code: 'INVALID_EXCHANGE_RESPONSE' },\n    )\n  }\n  if (\n    !isRecord(body) ||\n    !isNonemptyString(body.apiKey) ||\n    body.emailVerified !== true ||\n    !isRecord(body.user)\n  )\n    return invalid()\n  const user = body.user\n  if (!isNonemptyString(user.id) || !isNonemptyString(user.email)) return invalid()\n  const email = user.email.trim()\n  if (\n    email.length > 320 ||\n    !/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email) ||\n    /(?:@users\\.noreply\\.tangle\\.tools$|^0x[a-f0-9]{40}@tangle\\.tools$)/i.test(email)\n  )\n    return invalid()\n  if (user.name !== undefined && user.name !== null && typeof user.name !== 'string')\n    return invalid()\n  let plan: ExchangeCodeResult['plan'] = null\n  if (body.subscription !== undefined) {\n    if (!isRecord(body.subscription) || !isNonemptyString(body.subscription.plan)) return invalid()\n    plan = { tier: body.subscription.plan }\n  }\n  return {\n    apiKey: body.apiKey,\n    emailVerified: true,\n    user: { id: user.id, email, ...(user.name !== undefined ? { name: user.name } : {}) },\n    plan,\n  }\n}\n\n/** HTTP client for the Tangle Platform SSO: builds authorize URLs and exchanges auth codes for API keys. */\nexport class PlatformAuthClient {\n  private readonly baseUrl: string\n  private readonly appId: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: PlatformAuthClientOptions) {\n    if (!options.baseUrl) throw new Error('PlatformAuthClient: baseUrl is required')\n    if (!options.appId) throw new Error('PlatformAuthClient: appId is required')\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, '')\n    this.appId = options.appId\n    this.fetchImpl =\n      options.fetchImpl ??\n      ((url: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => fetch(url, init))\n  }\n\n  /**\n   * Build the URL the user is redirected to in order to start SSO.\n   * The platform redirects back to one of `appId`'s registered\n   * `redirectUris` with `?code=...&app=...&state=...`.\n   */\n  authorizeUrl(options: AuthorizeUrlOptions): string {\n    if (!options.state) {\n      throw new Error('PlatformAuthClient.authorizeUrl: state is required for CSRF')\n    }\n    const url = new URL('/cross-site/authorize', this.baseUrl)\n    url.searchParams.set('app', this.appId)\n    url.searchParams.set('state', options.state)\n    if (options.redirectUri) url.searchParams.set('redirect', options.redirectUri)\n    if (options.prompt) url.searchParams.set('prompt', options.prompt)\n    if (options.email) url.searchParams.set('email', options.email)\n    return url.toString()\n  }\n\n  /**\n   * Exchange a single-use auth code (delivered to the consumer's\n   * callback by the platform) for an API key + the user's identity.\n   * Codes are single-use and expire ~5 minutes after issue.\n   */\n  async exchange(code: string): Promise<ExchangeCodeResult> {\n    if (!code) throw new Error('PlatformAuthClient.exchange: code is required')\n    const res = await this.fetchImpl(`${this.baseUrl}/cross-site/exchange`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ code, app: this.appId }),\n    })\n    const body = await res.json().catch(() => null)\n    if (!res.ok) {\n      const message =\n        body && typeof body === 'object' && 'error' in body && typeof body.error === 'string'\n          ? body.error\n          : `Platform exchange failed (${res.status})`\n      throw new PlatformAuthError(message, res.status, body)\n    }\n    return parseExchangeResult(body, res.status)\n  }\n}\n","/**\n * Server-side client for the Tangle platform's integration hub\n * (`/v1/hub/*`). Consumer apps use this instead of rolling their own\n * OAuth + connection tables.\n *\n * Auth: the caller supplies a bearer (either the user's API key from\n * cross-site exchange, or a platform service token) on construction.\n *\n * Endpoint contract (authoritative): the platform's `src/lib/hub-contract.ts`\n * + `src/routes/hub.ts`. The platform wraps every response in\n * `{ success, data }`; non-2xx or `success:false` surfaces as `PlatformHubError`\n * carrying the real upstream status.\n */\n\nexport interface PlatformHubClientOptions {\n  /** Platform base URL, e.g. `https://id.tangle.tools`. */\n  baseUrl: string\n  /** Bearer credential — user API key or service token. */\n  bearer: string\n  /** Override fetch (tests + edge runtimes). */\n  fetchImpl?: typeof fetch\n}\n\n/** A live integration connection, as returned by `/v1/hub/connections`. */\nexport interface PlatformConnection {\n  id: string\n  providerId: string\n  displayName: string\n  accountDisplay: string | null\n  scopes: string[]\n  status: 'active' | 'revoked' | 'unhealthy' | 'reconnect_required' | (string & {})\n  health: 'unknown' | 'healthy' | 'unhealthy' | 'rate_limited' | (string & {})\n  createdAt: string\n  updatedAt: string\n  lastUsedAt: string | null\n}\n\n/** A connectable provider in the catalog (`/v1/hub/providers`). */\nexport interface PlatformCatalogProvider {\n  providerId: string\n  title?: string\n  authKind?: string\n  category?: string\n  scopes?: string[]\n  capabilityCount?: number\n  native?: boolean\n  /** Whether the OAuth app's credentials are wired — the UI offers Connect\n   *  only when true. */\n  configured?: boolean\n  [k: string]: unknown\n}\n\nexport interface CatalogResult {\n  providers: PlatformCatalogProvider[]\n  /** Count of substrate-bundled connectors behind the catalog. */\n  substrateBundled?: number\n  [k: string]: unknown\n}\n\nexport interface StartAuthInput {\n  /** The provider to connect (goes in the URL path). */\n  providerId: string\n  /** Accepted for interface compatibility; the platform's start endpoint is\n   *  provider-level and does not consume a connector id. */\n  connectorId?: string\n  /** Where the platform redirects the user back to after OAuth. */\n  returnUrl: string\n  /** Accepted for interface compatibility; not consumed by the start endpoint. */\n  requestedScopes?: string[]\n  /** CLI flow flag — affects the platform's post-auth redirect handling. */\n  cli?: boolean\n}\n\nexport interface StartAuthResult {\n  /** The URL to send the user to. Normalized across the platform's two start\n   *  branches: github returns `authorizationUrl`, substrate returns\n   *  `redirectUrl`. */\n  authorizationUrl: string\n  state: string\n  expiresAt?: string\n  scopes?: string[]\n}\n\nexport interface ConnectionHealth {\n  status: 'unknown' | 'healthy' | 'unhealthy' | 'rate_limited' | (string & {})\n  checkedAt: string\n  error?: { code: string; message: string }\n}\n\nexport interface ConnectionHealthResult {\n  connection: PlatformConnection\n  health: ConnectionHealth\n}\n\n/** Last-known health for a connection, derived from the connection row. */\nexport interface HealthCheck {\n  connectionId: string\n  providerId: string\n  /** Mirrors `PlatformConnection.health`. */\n  status: ConnectionHealth['status']\n  checkedAt?: string\n}\n\nexport interface MintTokenInput {\n  /** The hub action the token authorizes (e.g. `slack.chat.postMessage`). */\n  actionPath: string\n  /** Bind to a specific connection, or … */\n  connectionId?: string\n  /** … resolve the connection by provider for the calling user. */\n  provider?: string\n}\n\nexport interface MintTokenResult {\n  tokenId: string\n  token: string\n  expiresAt: string\n}\n\nexport interface ExecInput {\n  /** The hub action path to execute. */\n  path: string\n  input?: unknown\n  connectionId?: string\n}\n\nexport interface PlatformHubStatus {\n  contract?: unknown\n  principal: { kind: string; userId: string; [k: string]: unknown }\n  connections: { connectedProviderCount: number; unhealthyProviderCount: number }\n}\n\n/** Thrown when a `PlatformHubClient` request returns a non-success status. */\nexport class PlatformHubError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code: string | undefined,\n    public readonly body: unknown,\n  ) {\n    super(message)\n    this.name = 'PlatformHubError'\n  }\n}\n\ninterface PlatformEnvelope<T> {\n  success: boolean\n  data?: T\n  error?: { code?: string; message?: string } | string\n}\n\n/** HTTP client for the Tangle Platform Hub API: provider catalog, connection flow, and status. */\nexport class PlatformHubClient {\n  private readonly baseUrl: string\n  private readonly bearer: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: PlatformHubClientOptions) {\n    if (!options.baseUrl) throw new Error('PlatformHubClient: baseUrl is required')\n    if (!options.bearer) throw new Error('PlatformHubClient: bearer is required')\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, '')\n    this.bearer = options.bearer\n    this.fetchImpl =\n      options.fetchImpl ??\n      ((url: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => fetch(url, init))\n  }\n\n  /** GET /v1/hub/providers — the connectable provider catalog. */\n  catalog(): Promise<CatalogResult> {\n    return this.request('GET', '/v1/hub/providers')\n  }\n\n  /** GET /v1/hub/connections — the calling user's live connections. */\n  async listConnections(): Promise<PlatformConnection[]> {\n    const data = await this.request<{ connections: PlatformConnection[] }>(\n      'GET',\n      '/v1/hub/connections',\n    )\n    return data.connections\n  }\n\n  /** DELETE /v1/hub/connections/:connectionId — revoke + disable a connection. */\n  revokeConnection(connectionId: string): Promise<{ connection: PlatformConnection }> {\n    return this.request('DELETE', `/v1/hub/connections/${encodeURIComponent(connectionId)}`)\n  }\n\n  /**\n   * POST /v1/hub/connections/:provider/start — begin OAuth/grant. The provider\n   * is taken from the URL; the body carries `returnUrl` (+ `cli`). The platform's\n   * two start branches name the URL field differently (github → `authorizationUrl`,\n   * substrate → `redirectUrl`); this normalizes to `authorizationUrl`.\n   */\n  async startAuth(input: StartAuthInput): Promise<StartAuthResult> {\n    const body: { returnUrl: string; cli?: boolean } = { returnUrl: input.returnUrl }\n    if (input.cli !== undefined) body.cli = input.cli\n    const data = await this.request<{\n      authorizationUrl?: string\n      redirectUrl?: string\n      state: string\n      expiresAt?: string\n      scopes?: string[]\n    }>('POST', `/v1/hub/connections/${encodeURIComponent(input.providerId)}/start`, body)\n    const authorizationUrl = data.authorizationUrl ?? data.redirectUrl\n    if (!authorizationUrl) {\n      throw new PlatformHubError(\n        'Platform hub start response missing an authorization URL',\n        502,\n        'HUB_INVALID_START_RESPONSE',\n        data,\n      )\n    }\n    return { authorizationUrl, state: data.state, expiresAt: data.expiresAt, scopes: data.scopes }\n  }\n\n  /**\n   * Last-known health for every connection. The platform has no global\n   * healthcheck listing — health rides on each connection row — so this derives\n   * the list from `listConnections()` (one request, no extra round-trips).\n   */\n  async listHealthchecks(): Promise<HealthCheck[]> {\n    const connections = await this.listConnections()\n    return connections.map((c) => ({\n      connectionId: c.id,\n      providerId: c.providerId,\n      status: c.health,\n      checkedAt: c.updatedAt,\n    }))\n  }\n\n  /**\n   * POST /v1/hub/connections/:connectionId/health — trigger a fresh health\n   * probe for one connection and return its updated state.\n   */\n  checkConnectionHealth(connectionId: string): Promise<ConnectionHealthResult> {\n    return this.request('POST', `/v1/hub/connections/${encodeURIComponent(connectionId)}/health`)\n  }\n\n  /**\n   * Trigger a fresh health probe across all of the user's connections. The\n   * platform exposes health per-connection only, so this fans out over\n   * `listConnections()`. `scheduled` is the number of probes dispatched.\n   */\n  async runHealthchecks(): Promise<{ scheduled: number }> {\n    const connections = await this.listConnections()\n    await Promise.allSettled(connections.map((c) => this.checkConnectionHealth(c.id)))\n    return { scheduled: connections.length }\n  }\n\n  /** GET /v1/hub/status — principal + aggregate connection counts. */\n  status(): Promise<PlatformHubStatus> {\n    return this.request('GET', '/v1/hub/status')\n  }\n\n  /**\n   * POST /v1/hub/tokens — mint a short-lived, action-scoped capability token a\n   * sandbox can use to invoke one hub action on the user's behalf without\n   * seeing the underlying provider credential.\n   */\n  mintToken(input: MintTokenInput): Promise<MintTokenResult> {\n    return this.request('POST', '/v1/hub/tokens', input)\n  }\n\n  /** POST /v1/hub/exec — execute a hub action and return its result. */\n  async exec(input: ExecInput): Promise<unknown> {\n    const data = await this.request<{ result: unknown }>('POST', '/v1/hub/exec', input)\n    return data.result\n  }\n\n  private async request<T>(\n    method: 'GET' | 'POST' | 'DELETE' | 'PUT',\n    path: string,\n    body?: unknown,\n  ): Promise<T> {\n    const headers: Record<string, string> = {\n      authorization: `Bearer ${this.bearer}`,\n      accept: 'application/json',\n    }\n    if (body !== undefined) headers['content-type'] = 'application/json'\n\n    const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n      method,\n      headers,\n      body: body !== undefined ? JSON.stringify(body) : undefined,\n    })\n    const text = await res.text()\n    let parsed: PlatformEnvelope<T> | null = null\n    if (text) {\n      try {\n        parsed = JSON.parse(text)\n      } catch {\n        // fall through to error handling below\n      }\n    }\n    if (!res.ok || (parsed && parsed.success === false)) {\n      const code = parsed?.error && typeof parsed.error === 'object' ? parsed.error.code : undefined\n      const message =\n        (parsed?.error && typeof parsed.error === 'object' && parsed.error.message) ||\n        (typeof parsed?.error === 'string' ? parsed.error : `Platform hub error (${res.status})`)\n      throw new PlatformHubError(message, res.status, code, parsed ?? text)\n    }\n    if (!parsed) {\n      throw new PlatformHubError(\n        `Platform hub returned non-JSON success (${res.status})`,\n        res.status,\n        undefined,\n        text,\n      )\n    }\n    if (parsed.data === undefined) {\n      throw new PlatformHubError(\n        'Platform hub envelope missing `data`',\n        res.status,\n        undefined,\n        parsed,\n      )\n    }\n    return parsed.data\n  }\n}\n","/**\n * Server-side OpenID Connect client for the Tangle authorization server\n * (Better Auth `oauthProvider`, mounted at `/api/auth/oauth2/*`).\n *\n * This is the standard authorization-code + S256 PKCE path. It returns OIDC\n * tokens and a verified identity, not the `sk-tan` API key that\n * {@link PlatformAuthClient} returns. Identity scopes do not authorize paid\n * platform calls, so a consumer that uses the legacy API key as its Hub\n * bearer must keep {@link PlatformAuthClient} until it no longer needs one.\n *\n * The client id and redirect URI must be registered in the platform's\n * `oauthClient` registry. The legacy `TRUSTED_APPS` registration does not\n * carry over.\n */\n\nimport { PlatformAuthError } from './auth.js'\n\nexport interface PlatformOidcClientOptions {\n  /** Platform base URL, e.g. `https://id.tangle.tools`. */\n  baseUrl: string\n  /** Client id from the platform `oauthClient` registry. */\n  clientId: string\n  /**\n   * Client secret for a confidential client. Sent with HTTP Basic, the\n   * provider's default `client_secret_basic` method. Omit for a public client\n   * registered with `token_endpoint_auth_method: none`.\n   */\n  clientSecret?: string\n  /** Registered callback URI. */\n  redirectUri: string\n  /** Requested scopes. Defaults to `openid profile email offline_access`. */\n  scope?: string\n  /** Override the global fetch (useful for tests + edge runtimes). */\n  fetchImpl?: typeof fetch\n}\n\nexport interface OidcAuthorizeUrlOptions {\n  /** Required CSRF token; the consumer verifies it on the callback. */\n  state: string\n  /** RFC 7636 S256 code challenge. See {@link createPkcePair}. */\n  codeChallenge: string\n  /** OIDC nonce; the consumer checks it against the ID token. */\n  nonce?: string\n  prompt?: 'login' | 'consent' | 'none'\n  /** Pre-fill the email field on the login screen. */\n  loginHint?: string\n}\n\nexport interface OidcTokens {\n  accessToken: string\n  tokenType: string\n  expiresIn?: number\n  refreshToken?: string\n  idToken?: string\n  scope?: string\n}\n\nexport interface OidcUser {\n  id: string\n  email: string\n  emailVerified: true\n  name?: string\n}\n\nexport interface OidcExchangeResult {\n  tokens: OidcTokens\n  user: OidcUser\n}\n\nconst DEFAULT_SCOPE = 'openid profile email offline_access'\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\nfunction isNonemptyString(value: unknown): value is string {\n  return typeof value === 'string' && value.trim().length > 0\n}\n\nfunction base64url(bytes: Uint8Array): string {\n  let binary = ''\n  for (const byte of bytes) binary += String.fromCharCode(byte)\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\n/** Create an RFC 7636 verifier and its S256 challenge with Web Crypto. */\nexport async function createPkcePair(): Promise<{ verifier: string; challenge: string }> {\n  const verifier = base64url(crypto.getRandomValues(new Uint8Array(32)))\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))\n  return { verifier, challenge: base64url(new Uint8Array(digest)) }\n}\n\nfunction oauthError(body: unknown, fallback: string): string {\n  if (!isRecord(body)) return fallback\n  if (isNonemptyString(body.error_description)) return body.error_description\n  if (isNonemptyString(body.error)) return body.error\n  return fallback\n}\n\nfunction parseTokens(body: unknown, status: number): OidcTokens {\n  if (!isRecord(body) || !isNonemptyString(body.access_token)) {\n    // A malformed success response may still hold a secret; never echo it.\n    throw new PlatformAuthError('Platform token response is malformed', status, {\n      code: 'INVALID_TOKEN_RESPONSE',\n    })\n  }\n  return {\n    accessToken: body.access_token,\n    tokenType: isNonemptyString(body.token_type) ? body.token_type : 'Bearer',\n    ...(typeof body.expires_in === 'number' ? { expiresIn: body.expires_in } : {}),\n    ...(isNonemptyString(body.refresh_token) ? { refreshToken: body.refresh_token } : {}),\n    ...(isNonemptyString(body.id_token) ? { idToken: body.id_token } : {}),\n    ...(isNonemptyString(body.scope) ? { scope: body.scope } : {}),\n  }\n}\n\n/** Standard OIDC authorization-code + PKCE client for \"Sign in with Tangle\". */\nexport class PlatformOidcClient {\n  private readonly baseUrl: string\n  private readonly clientId: string\n  private readonly clientSecret: string | undefined\n  private readonly redirectUri: string\n  private readonly scope: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: PlatformOidcClientOptions) {\n    if (!options.baseUrl) throw new Error('PlatformOidcClient: baseUrl is required')\n    if (!options.clientId) throw new Error('PlatformOidcClient: clientId is required')\n    if (!options.redirectUri) throw new Error('PlatformOidcClient: redirectUri is required')\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, '')\n    this.clientId = options.clientId\n    this.clientSecret = options.clientSecret || undefined\n    this.redirectUri = options.redirectUri\n    this.scope = options.scope ?? DEFAULT_SCOPE\n    // Arrow wrapper: an unbound global fetch throws \"Illegal invocation\" on Workers.\n    this.fetchImpl =\n      options.fetchImpl ??\n      ((url: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => fetch(url, init))\n  }\n\n  /** Build the `/api/auth/oauth2/authorize` URL for a browser redirect. */\n  authorizeUrl(options: OidcAuthorizeUrlOptions): string {\n    if (!options.state)\n      throw new Error('PlatformOidcClient.authorizeUrl: state is required for CSRF')\n    if (!options.codeChallenge) {\n      throw new Error('PlatformOidcClient.authorizeUrl: codeChallenge is required for PKCE')\n    }\n    const url = new URL('/api/auth/oauth2/authorize', this.baseUrl)\n    url.searchParams.set('client_id', this.clientId)\n    url.searchParams.set('redirect_uri', this.redirectUri)\n    url.searchParams.set('response_type', 'code')\n    url.searchParams.set('scope', this.scope)\n    url.searchParams.set('state', options.state)\n    url.searchParams.set('code_challenge', options.codeChallenge)\n    url.searchParams.set('code_challenge_method', 'S256')\n    if (options.nonce) url.searchParams.set('nonce', options.nonce)\n    if (options.prompt) url.searchParams.set('prompt', options.prompt)\n    if (options.loginHint) url.searchParams.set('login_hint', options.loginHint)\n    return url.toString()\n  }\n\n  /** Exchange the callback code, then resolve the verified identity from userinfo. */\n  async exchange(code: string, codeVerifier: string): Promise<OidcExchangeResult> {\n    if (!code) throw new Error('PlatformOidcClient.exchange: code is required')\n    if (!codeVerifier)\n      throw new Error('PlatformOidcClient.exchange: codeVerifier is required for PKCE')\n    const tokens = await this.token({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: this.redirectUri,\n      code_verifier: codeVerifier,\n    })\n    return { tokens, user: await this.userinfo(tokens.accessToken) }\n  }\n\n  /** Redeem a refresh token. Store the returned refresh token; the provider rotates it. */\n  async refresh(refreshToken: string): Promise<OidcTokens> {\n    if (!refreshToken) throw new Error('PlatformOidcClient.refresh: refreshToken is required')\n    return this.token({ grant_type: 'refresh_token', refresh_token: refreshToken })\n  }\n\n  /** Read the verified identity behind an access token. */\n  async userinfo(accessToken: string): Promise<OidcUser> {\n    const res = await this.fetchImpl(`${this.baseUrl}/api/auth/oauth2/userinfo`, {\n      headers: { authorization: `Bearer ${accessToken}` },\n    })\n    const body: unknown = await res.json().catch(() => null)\n    if (!res.ok) {\n      throw new PlatformAuthError(\n        oauthError(body, `Platform userinfo failed (${res.status})`),\n        res.status,\n        body,\n      )\n    }\n    if (\n      !isRecord(body) ||\n      !isNonemptyString(body.sub) ||\n      !isNonemptyString(body.email) ||\n      body.email_verified !== true\n    ) {\n      throw new PlatformAuthError('Platform userinfo has no verified identity', res.status, {\n        code: 'INVALID_USERINFO_RESPONSE',\n      })\n    }\n    return {\n      id: body.sub,\n      email: body.email,\n      emailVerified: true,\n      ...(isNonemptyString(body.name) ? { name: body.name } : {}),\n    }\n  }\n\n  /** Revoke an access or refresh token (RFC 7009). Disconnect revokes the refresh token. */\n  async revoke(token: string, tokenTypeHint?: 'access_token' | 'refresh_token'): Promise<void> {\n    if (!token) throw new Error('PlatformOidcClient.revoke: token is required')\n    const res = await this.post('/api/auth/oauth2/revoke', {\n      token,\n      ...(tokenTypeHint ? { token_type_hint: tokenTypeHint } : {}),\n    })\n    if (!res.ok) {\n      const body: unknown = await res.json().catch(() => null)\n      throw new PlatformAuthError(\n        oauthError(body, `Platform revoke failed (${res.status})`),\n        res.status,\n        body,\n      )\n    }\n  }\n\n  private async token(params: Record<string, string>): Promise<OidcTokens> {\n    const res = await this.post('/api/auth/oauth2/token', params)\n    const body: unknown = await res.json().catch(() => null)\n    if (!res.ok) {\n      throw new PlatformAuthError(\n        oauthError(body, `Platform token request failed (${res.status})`),\n        res.status,\n        body,\n      )\n    }\n    return parseTokens(body, res.status)\n  }\n\n  private post(path: string, params: Record<string, string>): Promise<Response> {\n    const body = new URLSearchParams(params)\n    const headers: Record<string, string> = { 'content-type': 'application/x-www-form-urlencoded' }\n    if (this.clientSecret) {\n      headers.authorization = `Basic ${btoa(`${this.clientId}:${this.clientSecret}`)}`\n    } else {\n      body.set('client_id', this.clientId)\n    }\n    return this.fetchImpl(`${this.baseUrl}${path}`, { method: 'POST', headers, body })\n  }\n}\n"],"mappings":";;AAoDA,IAAa,oBAAb,cAAuC,MAAM;CAGzB;CACA;CAHlB,YACE,SACA,QACA,MACA;EACA,MAAM,OAAO;EAHG,KAAA,SAAA;EACA,KAAA,OAAA;EAGhB,KAAK,OAAO;CACd;AACF;AAEA,SAASA,WAAS,OAAkD;CAClE,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAASC,mBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS;AAC5D;;AAGA,SAAS,oBAAoB,MAAe,QAAoC;CAC9E,MAAM,gBAAuB;EAE3B,MAAM,IAAI,kBACR,6DACA,QACA,EAAE,MAAM,4BAA4B,CACtC;CACF;CACA,IACE,CAACD,WAAS,IAAI,KACd,CAACC,mBAAiB,KAAK,MAAM,KAC7B,KAAK,kBAAkB,QACvB,CAACD,WAAS,KAAK,IAAI,GAEnB,OAAO,QAAQ;CACjB,MAAM,OAAO,KAAK;CAClB,IAAI,CAACC,mBAAiB,KAAK,EAAE,KAAK,CAACA,mBAAiB,KAAK,KAAK,GAAG,OAAO,QAAQ;CAChF,MAAM,QAAQ,KAAK,MAAM,KAAK;CAC9B,IACE,MAAM,SAAS,OACf,CAAC,6BAA6B,KAAK,KAAK,KACxC,sEAAsE,KAAK,KAAK,GAEhF,OAAO,QAAQ;CACjB,IAAI,KAAK,SAAS,KAAA,KAAa,KAAK,SAAS,QAAQ,OAAO,KAAK,SAAS,UACxE,OAAO,QAAQ;CACjB,IAAI,OAAmC;CACvC,IAAI,KAAK,iBAAiB,KAAA,GAAW;EACnC,IAAI,CAACD,WAAS,KAAK,YAAY,KAAK,CAACC,mBAAiB,KAAK,aAAa,IAAI,GAAG,OAAO,QAAQ;EAC9F,OAAO,EAAE,MAAM,KAAK,aAAa,KAAK;CACxC;CACA,OAAO;EACL,QAAQ,KAAK;EACb,eAAe;EACf,MAAM;GAAE,IAAI,KAAK;GAAI;GAAO,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;EAAG;EACpF;CACF;AACF;;AAGA,IAAa,qBAAb,MAAgC;CAC9B;CACA;CACA;CAEA,YAAY,SAAoC;EAC9C,IAAI,CAAC,QAAQ,SAAS,MAAM,IAAI,MAAM,yCAAyC;EAC/E,IAAI,CAAC,QAAQ,OAAO,MAAM,IAAI,MAAM,uCAAuC;EAC3E,KAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;EACjD,KAAK,QAAQ,QAAQ;EACrB,KAAK,YACH,QAAQ,eACN,KAAkC,SAAuC,MAAM,KAAK,IAAI;CAC9F;;;;;;CAOA,aAAa,SAAsC;EACjD,IAAI,CAAC,QAAQ,OACX,MAAM,IAAI,MAAM,6DAA6D;EAE/E,MAAM,MAAM,IAAI,IAAI,yBAAyB,KAAK,OAAO;EACzD,IAAI,aAAa,IAAI,OAAO,KAAK,KAAK;EACtC,IAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;EAC3C,IAAI,QAAQ,aAAa,IAAI,aAAa,IAAI,YAAY,QAAQ,WAAW;EAC7E,IAAI,QAAQ,QAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;EACjE,IAAI,QAAQ,OAAO,IAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;EAC9D,OAAO,IAAI,SAAS;CACtB;;;;;;CAOA,MAAM,SAAS,MAA2C;EACxD,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,+CAA+C;EAC1E,MAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,uBAAuB;GACtE,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM,KAAK,UAAU;IAAE;IAAM,KAAK,KAAK;GAAM,CAAC;EAChD,CAAC;EACD,MAAM,OAAO,MAAM,IAAI,KAAK,CAAC,CAAC,YAAY,IAAI;EAC9C,IAAI,CAAC,IAAI,IAKP,MAAM,IAAI,kBAHR,QAAQ,OAAO,SAAS,YAAY,WAAW,QAAQ,OAAO,KAAK,UAAU,WACzE,KAAK,QACL,6BAA6B,IAAI,OAAO,IACT,IAAI,QAAQ,IAAI;EAEvD,OAAO,oBAAoB,MAAM,IAAI,MAAM;CAC7C;AACF;;;;ACpCA,IAAa,mBAAb,cAAsC,MAAM;CAGxB;CACA;CACA;CAJlB,YACE,SACA,QACA,MACA,MACA;EACA,MAAM,OAAO;EAJG,KAAA,SAAA;EACA,KAAA,OAAA;EACA,KAAA,OAAA;EAGhB,KAAK,OAAO;CACd;AACF;;AASA,IAAa,oBAAb,MAA+B;CAC7B;CACA;CACA;CAEA,YAAY,SAAmC;EAC7C,IAAI,CAAC,QAAQ,SAAS,MAAM,IAAI,MAAM,wCAAwC;EAC9E,IAAI,CAAC,QAAQ,QAAQ,MAAM,IAAI,MAAM,uCAAuC;EAC5E,KAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;EACjD,KAAK,SAAS,QAAQ;EACtB,KAAK,YACH,QAAQ,eACN,KAAkC,SAAuC,MAAM,KAAK,IAAI;CAC9F;;CAGA,UAAkC;EAChC,OAAO,KAAK,QAAQ,OAAO,mBAAmB;CAChD;;CAGA,MAAM,kBAAiD;EAKrD,QAAO,MAJY,KAAK,QACtB,OACA,qBACF,EAAA,CACY;CACd;;CAGA,iBAAiB,cAAmE;EAClF,OAAO,KAAK,QAAQ,UAAU,uBAAuB,mBAAmB,YAAY,GAAG;CACzF;;;;;;;CAQA,MAAM,UAAU,OAAiD;EAC/D,MAAM,OAA6C,EAAE,WAAW,MAAM,UAAU;EAChF,IAAI,MAAM,QAAQ,KAAA,GAAW,KAAK,MAAM,MAAM;EAC9C,MAAM,OAAO,MAAM,KAAK,QAMrB,QAAQ,uBAAuB,mBAAmB,MAAM,UAAU,EAAE,SAAS,IAAI;EACpF,MAAM,mBAAmB,KAAK,oBAAoB,KAAK;EACvD,IAAI,CAAC,kBACH,MAAM,IAAI,iBACR,4DACA,KACA,8BACA,IACF;EAEF,OAAO;GAAE;GAAkB,OAAO,KAAK;GAAO,WAAW,KAAK;GAAW,QAAQ,KAAK;EAAO;CAC/F;;;;;;CAOA,MAAM,mBAA2C;EAE/C,QAAO,MADmB,KAAK,gBAAgB,EAAA,CAC5B,KAAK,OAAO;GAC7B,cAAc,EAAE;GAChB,YAAY,EAAE;GACd,QAAQ,EAAE;GACV,WAAW,EAAE;EACf,EAAE;CACJ;;;;;CAMA,sBAAsB,cAAuD;EAC3E,OAAO,KAAK,QAAQ,QAAQ,uBAAuB,mBAAmB,YAAY,EAAE,QAAQ;CAC9F;;;;;;CAOA,MAAM,kBAAkD;EACtD,MAAM,cAAc,MAAM,KAAK,gBAAgB;EAC/C,MAAM,QAAQ,WAAW,YAAY,KAAK,MAAM,KAAK,sBAAsB,EAAE,EAAE,CAAC,CAAC;EACjF,OAAO,EAAE,WAAW,YAAY,OAAO;CACzC;;CAGA,SAAqC;EACnC,OAAO,KAAK,QAAQ,OAAO,gBAAgB;CAC7C;;;;;;CAOA,UAAU,OAAiD;EACzD,OAAO,KAAK,QAAQ,QAAQ,kBAAkB,KAAK;CACrD;;CAGA,MAAM,KAAK,OAAoC;EAE7C,QAAO,MADY,KAAK,QAA6B,QAAQ,gBAAgB,KAAK,EAAA,CACtE;CACd;CAEA,MAAc,QACZ,QACA,MACA,MACY;EACZ,MAAM,UAAkC;GACtC,eAAe,UAAU,KAAK;GAC9B,QAAQ;EACV;EACA,IAAI,SAAS,KAAA,GAAW,QAAQ,kBAAkB;EAElD,MAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GACzD;GACA;GACA,MAAM,SAAS,KAAA,IAAY,KAAK,UAAU,IAAI,IAAI,KAAA;EACpD,CAAC;EACD,MAAM,OAAO,MAAM,IAAI,KAAK;EAC5B,IAAI,SAAqC;EACzC,IAAI,MACF,IAAI;GACF,SAAS,KAAK,MAAM,IAAI;EAC1B,QAAQ,CAER;EAEF,IAAI,CAAC,IAAI,MAAO,UAAU,OAAO,YAAY,OAAQ;GACnD,MAAM,OAAO,QAAQ,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,OAAO,KAAA;GAIrF,MAAM,IAAI,iBAFP,QAAQ,SAAS,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,YAClE,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ,uBAAuB,IAAI,OAAO,KACpD,IAAI,QAAQ,MAAM,UAAU,IAAI;EACtE;EACA,IAAI,CAAC,QACH,MAAM,IAAI,iBACR,2CAA2C,IAAI,OAAO,IACtD,IAAI,QACJ,KAAA,GACA,IACF;EAEF,IAAI,OAAO,SAAS,KAAA,GAClB,MAAM,IAAI,iBACR,wCACA,IAAI,QACJ,KAAA,GACA,MACF;EAEF,OAAO,OAAO;CAChB;AACF;;;;;;;;;;;;;;;;;ACxPA,MAAM,gBAAgB;AAEtB,SAAS,SAAS,OAAkD;CAClE,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,iBAAiB,OAAiC;CACzD,OAAO,OAAO,UAAU,YAAY,MAAM,KAAK,CAAC,CAAC,SAAS;AAC5D;AAEA,SAAS,UAAU,OAA2B;CAC5C,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO,UAAU,OAAO,aAAa,IAAI;CAC5D,OAAO,KAAK,MAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC/E;;AAGA,eAAsB,iBAAmE;CACvF,MAAM,WAAW,UAAU,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;CACrE,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,CAAC;CACvF,OAAO;EAAE;EAAU,WAAW,UAAU,IAAI,WAAW,MAAM,CAAC;CAAE;AAClE;AAEA,SAAS,WAAW,MAAe,UAA0B;CAC3D,IAAI,CAAC,SAAS,IAAI,GAAG,OAAO;CAC5B,IAAI,iBAAiB,KAAK,iBAAiB,GAAG,OAAO,KAAK;CAC1D,IAAI,iBAAiB,KAAK,KAAK,GAAG,OAAO,KAAK;CAC9C,OAAO;AACT;AAEA,SAAS,YAAY,MAAe,QAA4B;CAC9D,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,iBAAiB,KAAK,YAAY,GAExD,MAAM,IAAI,kBAAkB,wCAAwC,QAAQ,EAC1E,MAAM,yBACR,CAAC;CAEH,OAAO;EACL,aAAa,KAAK;EAClB,WAAW,iBAAiB,KAAK,UAAU,IAAI,KAAK,aAAa;EACjE,GAAI,OAAO,KAAK,eAAe,WAAW,EAAE,WAAW,KAAK,WAAW,IAAI,CAAC;EAC5E,GAAI,iBAAiB,KAAK,aAAa,IAAI,EAAE,cAAc,KAAK,cAAc,IAAI,CAAC;EACnF,GAAI,iBAAiB,KAAK,QAAQ,IAAI,EAAE,SAAS,KAAK,SAAS,IAAI,CAAC;EACpE,GAAI,iBAAiB,KAAK,KAAK,IAAI,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;CAC9D;AACF;;AAGA,IAAa,qBAAb,MAAgC;CAC9B;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAAoC;EAC9C,IAAI,CAAC,QAAQ,SAAS,MAAM,IAAI,MAAM,yCAAyC;EAC/E,IAAI,CAAC,QAAQ,UAAU,MAAM,IAAI,MAAM,0CAA0C;EACjF,IAAI,CAAC,QAAQ,aAAa,MAAM,IAAI,MAAM,6CAA6C;EACvF,KAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;EACjD,KAAK,WAAW,QAAQ;EACxB,KAAK,eAAe,QAAQ,gBAAgB,KAAA;EAC5C,KAAK,cAAc,QAAQ;EAC3B,KAAK,QAAQ,QAAQ,SAAS;EAE9B,KAAK,YACH,QAAQ,eACN,KAAkC,SAAuC,MAAM,KAAK,IAAI;CAC9F;;CAGA,aAAa,SAA0C;EACrD,IAAI,CAAC,QAAQ,OACX,MAAM,IAAI,MAAM,6DAA6D;EAC/E,IAAI,CAAC,QAAQ,eACX,MAAM,IAAI,MAAM,qEAAqE;EAEvF,MAAM,MAAM,IAAI,IAAI,8BAA8B,KAAK,OAAO;EAC9D,IAAI,aAAa,IAAI,aAAa,KAAK,QAAQ;EAC/C,IAAI,aAAa,IAAI,gBAAgB,KAAK,WAAW;EACrD,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,SAAS,KAAK,KAAK;EACxC,IAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;EAC3C,IAAI,aAAa,IAAI,kBAAkB,QAAQ,aAAa;EAC5D,IAAI,aAAa,IAAI,yBAAyB,MAAM;EACpD,IAAI,QAAQ,OAAO,IAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;EAC9D,IAAI,QAAQ,QAAQ,IAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;EACjE,IAAI,QAAQ,WAAW,IAAI,aAAa,IAAI,cAAc,QAAQ,SAAS;EAC3E,OAAO,IAAI,SAAS;CACtB;;CAGA,MAAM,SAAS,MAAc,cAAmD;EAC9E,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,+CAA+C;EAC1E,IAAI,CAAC,cACH,MAAM,IAAI,MAAM,gEAAgE;EAClF,MAAM,SAAS,MAAM,KAAK,MAAM;GAC9B,YAAY;GACZ;GACA,cAAc,KAAK;GACnB,eAAe;EACjB,CAAC;EACD,OAAO;GAAE;GAAQ,MAAM,MAAM,KAAK,SAAS,OAAO,WAAW;EAAE;CACjE;;CAGA,MAAM,QAAQ,cAA2C;EACvD,IAAI,CAAC,cAAc,MAAM,IAAI,MAAM,sDAAsD;EACzF,OAAO,KAAK,MAAM;GAAE,YAAY;GAAiB,eAAe;EAAa,CAAC;CAChF;;CAGA,MAAM,SAAS,aAAwC;EACrD,MAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,4BAA4B,EAC3E,SAAS,EAAE,eAAe,UAAU,cAAc,EACpD,CAAC;EACD,MAAM,OAAgB,MAAM,IAAI,KAAK,CAAC,CAAC,YAAY,IAAI;EACvD,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,kBACR,WAAW,MAAM,6BAA6B,IAAI,OAAO,EAAE,GAC3D,IAAI,QACJ,IACF;EAEF,IACE,CAAC,SAAS,IAAI,KACd,CAAC,iBAAiB,KAAK,GAAG,KAC1B,CAAC,iBAAiB,KAAK,KAAK,KAC5B,KAAK,mBAAmB,MAExB,MAAM,IAAI,kBAAkB,8CAA8C,IAAI,QAAQ,EACpF,MAAM,4BACR,CAAC;EAEH,OAAO;GACL,IAAI,KAAK;GACT,OAAO,KAAK;GACZ,eAAe;GACf,GAAI,iBAAiB,KAAK,IAAI,IAAI,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;EAC3D;CACF;;CAGA,MAAM,OAAO,OAAe,eAAiE;EAC3F,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,8CAA8C;EAC1E,MAAM,MAAM,MAAM,KAAK,KAAK,2BAA2B;GACrD;GACA,GAAI,gBAAgB,EAAE,iBAAiB,cAAc,IAAI,CAAC;EAC5D,CAAC;EACD,IAAI,CAAC,IAAI,IAAI;GACX,MAAM,OAAgB,MAAM,IAAI,KAAK,CAAC,CAAC,YAAY,IAAI;GACvD,MAAM,IAAI,kBACR,WAAW,MAAM,2BAA2B,IAAI,OAAO,EAAE,GACzD,IAAI,QACJ,IACF;EACF;CACF;CAEA,MAAc,MAAM,QAAqD;EACvE,MAAM,MAAM,MAAM,KAAK,KAAK,0BAA0B,MAAM;EAC5D,MAAM,OAAgB,MAAM,IAAI,KAAK,CAAC,CAAC,YAAY,IAAI;EACvD,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,kBACR,WAAW,MAAM,kCAAkC,IAAI,OAAO,EAAE,GAChE,IAAI,QACJ,IACF;EAEF,OAAO,YAAY,MAAM,IAAI,MAAM;CACrC;CAEA,KAAa,MAAc,QAAmD;EAC5E,MAAM,OAAO,IAAI,gBAAgB,MAAM;EACvC,MAAM,UAAkC,EAAE,gBAAgB,oCAAoC;EAC9F,IAAI,KAAK,cACP,QAAQ,gBAAgB,SAAS,KAAK,GAAG,KAAK,SAAS,GAAG,KAAK,cAAc;OAE7E,KAAK,IAAI,aAAa,KAAK,QAAQ;EAErC,OAAO,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GAAE,QAAQ;GAAQ;GAAS;EAAK,CAAC;CACnF;AACF"}

package/dist/profiles.d.ts

@@ -1,5 +1,5 @@
-import { Oa as Validator } from "./types-r7Fzum3M.js";
-import { _ as CoderTask, a as UiFindingSeverity, c as KnowledgeUpdate, d as ResearchSource, f as ResearchTask, g as researcherProfile, h as multiHarnessResearcherFanout, i as UiFindingScreenshot, l as MultiHarnessResearcherFanoutOptions, m as createResearcherValidator, n as UI_LENSES, o as UiLens, p as ResearcherProfileOptions, r as UiFinding, s as KnowledgeItem, t as UI_FINDING_SEVERITIES, u as ResearchOutput, v as coderTaskToPrompt } from "./substrate-DPIUXsZ5.js";
+import { Ca as Validator } from "./types-D56jQad-.js";
+import { _ as CoderTask, a as UiFindingSeverity, c as KnowledgeUpdate, d as ResearchSource, f as ResearchTask, g as researcherProfile, h as multiHarnessResearcherFanout, i as UiFindingScreenshot, l as MultiHarnessResearcherFanoutOptions, m as createResearcherValidator, n as UI_LENSES, o as UiLens, p as ResearcherProfileOptions, r as UiFinding, s as KnowledgeItem, t as UI_FINDING_SEVERITIES, u as ResearchOutput, v as coderTaskToPrompt } from "./substrate-CHQ5GYnU.js";
 import { SandboxEvent } from "@tangle-network/sandbox";
 //#region src/audit/issue-writer.d.ts
 /** @experimental */

package/dist/{provision-supervisor-Ds43T8XY.js → provision-supervisor-BvnihiyB.js}

@@ -1,7 +1,7 @@
-import { $i as detachedSnapshot, Fi as finalizeRuntimeOwnedPendingExecutor, Ia as armDeadlineTimer, Mi as attestRuntimeOwnedPendingExecutor, Na as abortError, Sa as sleep, Xi as executableAgentProfileSnapshot, _r as environmentGone, br as linkAbort, bt as startRetainedInteractiveRun, dt as interactiveAdmissionSeamKey, fn as taskToPrompt, gn as createInbox, gr as destroyInteractiveEnvironment, hr as retainedCreateMaterial, ht as readWorkerInteractiveBinding, kr as contentAddress, n as createRootHandle, nr as sandboxClientAsProvider, r as createSupervisor, yr as abortError$1, zi as newExecutionAttemptId } from "./supervisor-C50SI_Ww.js";
+import { $i as detachedSnapshot, Fi as finalizeRuntimeOwnedPendingExecutor, Ia as armDeadlineTimer, Mi as attestRuntimeOwnedPendingExecutor, Na as abortError, Sa as sleep, Sr as linkAbort, St as startRetainedInteractiveRun, Xi as executableAgentProfileSnapshot, _r as retainedCreateMaterial, _t as readWorkerInteractiveBinding, ir as sandboxClientAsProvider, jr as contentAddress, mn as taskToPrompt, n as createRootHandle, pt as interactiveAdmissionSeamKey, r as createSupervisor, vn as createInbox, vr as destroyInteractiveEnvironment, xr as abortError$1, yr as environmentGone, zi as newExecutionAttemptId } from "./supervisor-DtlPj9me.js";
 import { a as concreteProfileModel } from "./model-policy-BbSCSak0.js";
 import { a as writeAtomicDurableFile } from "./durable-file-DWQA4ooo.js";
-import { A as createCoordinationTools, n as createSteerAcknowledger, t as createCancelAcknowledger, v as createFileRunContext } from "./coordination-driver-B2GTcMvx.js";
+import { A as createCoordinationTools, n as createSteerAcknowledger, t as createCancelAcknowledger, v as createFileRunContext } from "./coordination-driver-BBL_OgRw.js";
 import { h as supervisorRunDir } from "./run-layout-vwd4SwX_.js";
 import { agentInteractiveSessionControlClaimRequestDigest, agentInteractiveSessionPromptRequestDigest, agentInteractiveSessionStopRequestDigest, agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest } from "@tangle-network/agent-interface";
 import { randomUUID } from "node:crypto";
@@ -1026,4 +1026,4 @@ function writeState(path, state) {
 //#endregion
 export { workerFromInteractiveProvider as n, claimRetainedInteractiveControl as r, provisionSupervisor as t };
 
-//# sourceMappingURL=provision-supervisor-Ds43T8XY.js.map
+//# sourceMappingURL=provision-supervisor-BvnihiyB.js.map