@tangle-network/sandbox 0.2.1 → 0.3.0

package/dist/auth/index.js

@@ -1,271 +1 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
-//#region src/auth/tokens.ts
-/**
-* JWT Token Utilities
-*
-* Token generation and verification using HMAC-SHA256. Server-only
-* (uses Node.js `crypto`).
-*/
-/**
-* Base64URL encode (RFC 7515).
-*/
-function base64UrlEncode(data) {
-	return (typeof data === "string" ? Buffer.from(data) : data).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-/**
-* Base64URL decode (RFC 7515) to raw bytes. Returns `null` if the
-* input contains characters outside the base64url alphabet.
-*/
-function decodeBase64UrlToBuffer(input) {
-	if (!/^[A-Za-z0-9_-]*$/.test(input)) return null;
-	const padded = input + "=".repeat((4 - input.length % 4) % 4);
-	return Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64");
-}
-/**
-* Create HMAC-SHA256 signature.
-*/
-function createSignature(data, secret) {
-	return base64UrlEncode(createHmac("sha256", secret).update(data).digest());
-}
-/**
-* JWT header (always the same for our use case).
-*/
-const JWT_HEADER = base64UrlEncode(JSON.stringify({
-	alg: "HS256",
-	typ: "JWT"
-}));
-function issueToken(signingSecret, payload, ttlMinutes) {
-	const now = Math.floor(Date.now() / 1e3);
-	const fullPayload = {
-		...payload,
-		iat: now,
-		exp: now + ttlMinutes * 60
-	};
-	const data = `${JWT_HEADER}.${base64UrlEncode(JSON.stringify(fullPayload))}`;
-	return `${data}.${createSignature(data, signingSecret)}`;
-}
-/**
-* Issue a read token (JWT) for WebSocket authentication.
-*
-* @param signingSecret - The product's signing secret
-* @param payload - Token payload (without iat/exp/typ, those are added)
-* @param ttlMinutes - Token TTL in minutes
-*/
-function issueReadToken(signingSecret, payload, ttlMinutes) {
-	return issueToken(signingSecret, {
-		...payload,
-		typ: "read"
-	}, ttlMinutes);
-}
-/**
-* Issue a session-scoped token (JWT) for WebSocket authentication.
-* Grants access to a single session's events.
-*/
-function issueSessionScopedToken(signingSecret, payload, ttlMinutes) {
-	return issueReadToken(signingSecret, payload, ttlMinutes);
-}
-/**
-* Issue a project-scoped token (JWT) for WebSocket authentication.
-* Grants access to all sessions within a single project.
-*/
-function issueProjectScopedToken(signingSecret, payload, ttlMinutes) {
-	return issueReadToken(signingSecret, payload, ttlMinutes);
-}
-/**
-* Issue a batch-scoped token (JWT) for WebSocket authentication.
-* Grants access to multiple projects (organization-level access).
-*/
-function issueBatchScopedToken(signingSecret, payload, ttlMinutes) {
-	return issueReadToken(signingSecret, payload, ttlMinutes);
-}
-/**
-* Issue a collaboration-scoped token (JWT) for collaborative document access.
-* Grants read or write access to a single document in one project.
-*/
-function issueCollaborationToken(signingSecret, payload, ttlMinutes) {
-	return issueToken(signingSecret, {
-		sub: payload.userId,
-		sid: payload.sessionId,
-		pid: payload.productId,
-		cid: payload.sandboxId,
-		typ: "collaboration",
-		projectId: payload.projectId,
-		documentId: payload.documentId,
-		access: payload.access
-	}, ttlMinutes);
-}
-/**
-* Decode a JWT **without verifying its signature**.
-*
-* The deliberately scary name is the API contract: an HMAC-signed token
-* whose signature has not been verified is a self-asserted blob of JSON,
-* not an authenticated claim. Treating its fields as authoritative
-* (e.g. `if (unsafeDecodeToken(t).sub === userId) grantAccess()`) is a
-* straightforward authorization bypass — an attacker can mint any
-* payload they like.
-*
-* Use this only when the signature has already been validated upstream
-* (e.g. by an API gateway that strips the token after verification),
-* for client-side `exp` peeking to decide whether to refresh, or for
-* routing/logging keyed off non-security-sensitive claims.
-*
-* For any access-control decision, use {@link verifyToken} instead.
-*
-* Returns `null` if the token is malformed.
-*/
-function unsafeDecodeToken(token) {
-	try {
-		const parts = token.split(".");
-		if (parts.length !== 3) return null;
-		const padded = parts[1] + "=".repeat((4 - parts[1].length % 4) % 4);
-		const decoded = Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString();
-		return JSON.parse(decoded);
-	} catch {
-		return null;
-	}
-}
-/**
-* Verify a JWT's HMAC-SHA256 signature against `signingSecret` and
-* check that it has not expired. Returns the decoded payload on
-* success, or `null` on any failure (malformed token, bad signature,
-* expired, or unexpected algorithm).
-*
-* Signature comparison is constant-time. Callers must use this — not
-* {@link unsafeDecodeToken} — for any authorization decision.
-*
-* @param token - The JWT to verify
-* @param signingSecret - The same secret used to issue the token
-* @param options.clockSkewSeconds - Tolerance for `exp` checks; default `0`
-*/
-function verifyToken(token, signingSecret, options = {}) {
-	try {
-		const parts = token.split(".");
-		if (parts.length !== 3) return null;
-		const [headerB64, payloadB64, signatureB64] = parts;
-		if (!headerB64 || !payloadB64 || !signatureB64) return null;
-		let header;
-		try {
-			const headerPadded = headerB64 + "=".repeat((4 - headerB64.length % 4) % 4);
-			const headerJson = Buffer.from(headerPadded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString();
-			header = JSON.parse(headerJson);
-		} catch {
-			return null;
-		}
-		if (header.alg !== "HS256") return null;
-		const expectedSig = createSignature(`${headerB64}.${payloadB64}`, signingSecret);
-		const providedRaw = decodeBase64UrlToBuffer(signatureB64);
-		const expectedRaw = decodeBase64UrlToBuffer(expectedSig);
-		if (!providedRaw || !expectedRaw) return null;
-		if (providedRaw.length !== expectedRaw.length) return null;
-		if (!timingSafeEqual(providedRaw, expectedRaw)) return null;
-		const payload = unsafeDecodeToken(token);
-		if (!payload) return null;
-		const now = Math.floor(Date.now() / 1e3);
-		const skew = Math.max(0, options.clockSkewSeconds ?? 0);
-		if (typeof payload.exp !== "number" || payload.exp + skew < now) return null;
-		return payload;
-	} catch {
-		return null;
-	}
-}
-/**
-* Get time until token expires (in seconds).
-* Returns negative if expired.
-*/
-function getTokenTTL(payload) {
-	const now = Math.floor(Date.now() / 1e3);
-	return payload.exp - now;
-}
-/**
-* Check if token is expiring soon (within buffer seconds).
-*/
-function isTokenExpiringSoon(payload, bufferSeconds = 60) {
-	return getTokenTTL(payload) <= bufferSeconds;
-}
-//#endregion
-//#region src/auth/index.ts
-/**
-* Authentication Utilities
-*
-* Token issuance for application backends. Server-only (uses Node.js crypto).
-*
-* @example
-* ```typescript
-* import { ProductTokenIssuer } from "@tangle-network/sandbox/auth";
-*
-* const issuer = new ProductTokenIssuer({
-*   productId: "my-product",
-*   signingSecret: process.env.SANDBOX_SIGNING_SECRET!,
-* });
-*
-* const { token, expiresAt } = issuer.issue({
-*   userId: "user_123",
-*   sessionId: "sess_abc",
-*   tier: "pro",
-* });
-* ```
-*
-* @packageDocumentation
-*/
-/**
-* Token issuer for application backend services.
-*
-* Use this in your backend to issue read tokens for WebSocket connections.
-*/
-var ProductTokenIssuer = class {
-	productId;
-	signingSecret;
-	ttlMinutes;
-	constructor(config) {
-		this.productId = config.productId;
-		this.signingSecret = config.signingSecret;
-		this.ttlMinutes = {
-			free: config.ttlMinutes?.free ?? 15,
-			pro: config.ttlMinutes?.pro ?? 240,
-			enterprise: config.ttlMinutes?.enterprise ?? 480
-		};
-	}
-	/**
-	* Issue a read token for a user session.
-	*/
-	issue(params) {
-		const tier = params.tier ?? "free";
-		const ttl = this.ttlMinutes[tier] ?? this.ttlMinutes.free;
-		return {
-			token: issueReadToken(this.signingSecret, {
-				sub: params.userId,
-				sid: params.sessionId,
-				pid: this.productId,
-				cid: params.sandboxId
-			}, ttl),
-			expiresAt: Math.floor(Date.now() / 1e3) + ttl * 60
-		};
-	}
-	/**
-	* Issue a collaboration token for a single document.
-	*/
-	issueCollaboration(params) {
-		const tier = params.tier ?? "free";
-		const ttl = this.ttlMinutes[tier] ?? this.ttlMinutes.free;
-		return {
-			token: issueCollaborationToken(this.signingSecret, {
-				userId: params.userId,
-				sessionId: params.sessionId,
-				productId: this.productId,
-				projectId: params.projectId,
-				documentId: params.documentId,
-				access: params.access,
-				sandboxId: params.sandboxId
-			}, ttl),
-			expiresAt: Math.floor(Date.now() / 1e3) + ttl * 60
-		};
-	}
-	/**
-	* Get the TTL in minutes for a tier.
-	*/
-	getTtlMinutes(tier = "free") {
-		return this.ttlMinutes[tier] ?? this.ttlMinutes.free;
-	}
-};
-//#endregion
-export { ProductTokenIssuer, getTokenTTL, isTokenExpiringSoon, issueBatchScopedToken, issueCollaborationToken, issueProjectScopedToken, issueReadToken, issueSessionScopedToken, unsafeDecodeToken, verifyToken };
+const a0_0x3ba994=a0_0x413e;(function(_0x2d31d8,_0x8f3da2){const _0x486e9d=a0_0x413e,_0x4289cd=_0x2d31d8();while(!![]){try{const _0x4c6c68=-parseInt(_0x486e9d(0x20b))/0x1+-parseInt(_0x486e9d(0x216))/0x2+-parseInt(_0x486e9d(0x21d))/0x3*(parseInt(_0x486e9d(0x21f))/0x4)+-parseInt(_0x486e9d(0x1f8))/0x5*(parseInt(_0x486e9d(0x210))/0x6)+-parseInt(_0x486e9d(0x220))/0x7*(-parseInt(_0x486e9d(0x22a))/0x8)+parseInt(_0x486e9d(0x20f))/0x9+parseInt(_0x486e9d(0x1fd))/0xa;if(_0x4c6c68===_0x8f3da2)break;else _0x4289cd['push'](_0x4289cd['shift']());}catch(_0x4b1e60){_0x4289cd['push'](_0x4289cd['shift']());}}}(a0_0xc6f7,0x61fec));import{createHmac,timingSafeEqual}from'\x6e\x6f\x64\x65\x3a\x63\x72\x79\x70\x74\x6f';function base64UrlEncode(_0x5386e7){const _0x5e55e4=a0_0x413e,_0x3df189={'\x7a\x69\x4a\x67\x55':'\x73\x74\x72\x69\x6e\x67','\x43\x43\x44\x59\x59':'\x62\x61\x73\x65\x36\x34'};return(typeof _0x5386e7===_0x3df189[_0x5e55e4(0x1f1)]?Buffer['\x66\x72\x6f\x6d'](_0x5386e7):_0x5386e7)['\x74\x6f\x53\x74\x72\x69\x6e\x67'](_0x3df189[_0x5e55e4(0x1fc)])[_0x5e55e4(0x213)](/\+/g,'\x2d')[_0x5e55e4(0x213)](/\//g,'\x5f')[_0x5e55e4(0x213)](/=+$/,'');}function decodeBase64UrlToBuffer(_0x27e4c6){const _0x5de3fc=a0_0x413e,_0x34990a={'\x67\x43\x61\x68\x61':function(_0x33955e,_0x3852a1){return _0x33955e+_0x3852a1;},'\x52\x54\x51\x77\x4a':function(_0x245545,_0x554c8a){return _0x245545%_0x554c8a;},'\x4e\x4b\x51\x6f\x47':'\x62\x61\x73\x65\x36\x34'};if(!/^[A-Za-z0-9_-]*$/['\x74\x65\x73\x74'](_0x27e4c6))return null;const _0x282ad2=_0x34990a[_0x5de3fc(0x1f7)](_0x27e4c6,'\x3d'[_0x5de3fc(0x1fe)](_0x34990a[_0x5de3fc(0x1f0)](0x4-_0x27e4c6[_0x5de3fc(0x214)]%0x4,0x4)));return Buffer[_0x5de3fc(0x22c)](_0x282ad2[_0x5de3fc(0x213)](/-/g,'\x2b')[_0x5de3fc(0x213)](/_/g,'\x2f'),_0x34990a[_0x5de3fc(0x201)]);}function createSignature(_0x50fa29,_0x150c48){const _0x56d9c0=a0_0x413e,_0x33aa41={'\x76\x46\x53\x65\x55':'\x73\x68\x61\x32\x35\x36'};return base64UrlEncode(createHmac(_0x33aa41['\x76\x46\x53\x65\x55'],_0x150c48)[_0x56d9c0(0x1f9)](_0x50fa29)[_0x56d9c0(0x1f5)]());}const JWT_HEADER=base64UrlEncode(JSON[a0_0x3ba994(0x209)]({'\x61\x6c\x67':a0_0x3ba994(0x1fb),'\x74\x79\x70':a0_0x3ba994(0x221)}));function issueToken(_0x502640,_0x268515,_0x4dab4e){const _0x5e36ee=a0_0x3ba994,_0x580a8f={'\x48\x6a\x41\x6a\x55':function(_0x4dbb64,_0x45fa15){return _0x4dbb64+_0x45fa15;},'\x6e\x55\x55\x62\x47':function(_0x4591fb,_0x599446){return _0x4591fb(_0x599446);}},_0x5cc8b9=Math[_0x5e36ee(0x224)](Date[_0x5e36ee(0x222)]()/0x3e8),_0x4e1c72={..._0x268515,'\x69\x61\x74':_0x5cc8b9,'\x65\x78\x70':_0x580a8f[_0x5e36ee(0x20d)](_0x5cc8b9,_0x4dab4e*0x3c)},_0x109a08=JWT_HEADER+'\x2e'+_0x580a8f[_0x5e36ee(0x223)](base64UrlEncode,JSON[_0x5e36ee(0x209)](_0x4e1c72));return _0x109a08+'\x2e'+createSignature(_0x109a08,_0x502640);}function issueReadToken(_0x7645ea,_0x29b7bb,_0x1ca4e8){return issueToken(_0x7645ea,{..._0x29b7bb,'\x74\x79\x70':'\x72\x65\x61\x64'},_0x1ca4e8);}function a0_0x413e(_0x113e8a,_0x234532){_0x113e8a=_0x113e8a-0x1f0;const _0xc6f7a2=a0_0xc6f7();let _0x413e1d=_0xc6f7a2[_0x113e8a];if(a0_0x413e['\x4c\x4e\x55\x64\x75\x76']===undefined){var _0x21ffd2=function(_0x5d8ec2){const _0x59afad='\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x2b\x2f\x3d';let _0x1bdc10='',_0x17cc37='';for(let _0x138e1c=0x0,_0x187ba8,_0xf55bcc,_0x1639db=0x0;_0xf55bcc=_0x5d8ec2['\x63\x68\x61\x72\x41\x74'](_0x1639db++);~_0xf55bcc&&(_0x187ba8=_0x138e1c%0x4?_0x187ba8*0x40+_0xf55bcc:_0xf55bcc,_0x138e1c++%0x4)?_0x1bdc10+=String['\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65'](0xff&_0x187ba8>>(-0x2*_0x138e1c&0x6)):0x0){_0xf55bcc=_0x59afad['\x69\x6e\x64\x65\x78\x4f\x66'](_0xf55bcc);}for(let _0xe33635=0x0,_0x41cfb1=_0x1bdc10['\x6c\x65\x6e\x67\x74\x68'];_0xe33635<_0x41cfb1;_0xe33635++){_0x17cc37+='\x25'+('\x30\x30'+_0x1bdc10['\x63\x68\x61\x72\x43\x6f\x64\x65\x41\x74'](_0xe33635)['\x74\x6f\x53\x74\x72\x69\x6e\x67'](0x10))['\x73\x6c\x69\x63\x65'](-0x2);}return decodeURIComponent(_0x17cc37);};a0_0x413e['\x6c\x77\x68\x49\x59\x56']=_0x21ffd2,a0_0x413e['\x61\x43\x45\x4f\x4f\x46']={},a0_0x413e['\x4c\x4e\x55\x64\x75\x76']=!![];}const _0x3a1dc2=_0xc6f7a2[0x0],_0x396031=_0x113e8a+_0x3a1dc2,_0x2b6941=a0_0x413e['\x61\x43\x45\x4f\x4f\x46'][_0x396031];return!_0x2b6941?(_0x413e1d=a0_0x413e['\x6c\x77\x68\x49\x59\x56'](_0x413e1d),a0_0x413e['\x61\x43\x45\x4f\x4f\x46'][_0x396031]=_0x413e1d):_0x413e1d=_0x2b6941,_0x413e1d;}function issueSessionScopedToken(_0x5afe69,_0x345e59,_0x286fee){const _0x201922=a0_0x3ba994,_0x5b5f95={'\x6a\x57\x48\x45\x47':function(_0x47a0f9,_0x17c73e,_0xc392d8,_0x398ce6){return _0x47a0f9(_0x17c73e,_0xc392d8,_0x398ce6);}};return _0x5b5f95[_0x201922(0x227)](issueReadToken,_0x5afe69,_0x345e59,_0x286fee);}function issueProjectScopedToken(_0x4f7deb,_0xd599c4,_0x370d28){return issueReadToken(_0x4f7deb,_0xd599c4,_0x370d28);}function issueBatchScopedToken(_0x128abe,_0x45b626,_0x34760c){return issueReadToken(_0x128abe,_0x45b626,_0x34760c);}function issueCollaborationToken(_0x44b25f,_0x1f163b,_0x6e666e){const _0xc4564c=a0_0x3ba994;return issueToken(_0x44b25f,{'\x73\x75\x62':_0x1f163b[_0xc4564c(0x20a)],'\x73\x69\x64':_0x1f163b['\x73\x65\x73\x73\x69\x6f\x6e\x49\x64'],'\x70\x69\x64':_0x1f163b[_0xc4564c(0x22b)],'\x63\x69\x64':_0x1f163b[_0xc4564c(0x226)],'\x74\x79\x70':_0xc4564c(0x1f3),'\x70\x72\x6f\x6a\x65\x63\x74\x49\x64':_0x1f163b[_0xc4564c(0x1f4)],'\x64\x6f\x63\x75\x6d\x65\x6e\x74\x49\x64':_0x1f163b['\x64\x6f\x63\x75\x6d\x65\x6e\x74\x49\x64'],'\x61\x63\x63\x65\x73\x73':_0x1f163b['\x61\x63\x63\x65\x73\x73']},_0x6e666e);}function unsafeDecodeToken(_0xffcb8f){const _0x22d649=a0_0x3ba994,_0x4e6d60={'\x58\x41\x66\x42\x4f':function(_0xb30591,_0x4090ca){return _0xb30591+_0x4090ca;},'\x64\x6a\x64\x57\x68':'\x62\x61\x73\x65\x36\x34'};try{const _0xc9a5ec=_0xffcb8f[_0x22d649(0x22e)]('\x2e');if(_0xc9a5ec[_0x22d649(0x214)]!==0x3)return null;const _0x17d23c=_0x4e6d60[_0x22d649(0x217)](_0xc9a5ec[0x1],'\x3d'[_0x22d649(0x1fe)]((0x4-_0xc9a5ec[0x1][_0x22d649(0x214)]%0x4)%0x4)),_0x4a8e2a=Buffer[_0x22d649(0x22c)](_0x17d23c['\x72\x65\x70\x6c\x61\x63\x65'](/-/g,'\x2b')[_0x22d649(0x213)](/_/g,'\x2f'),_0x4e6d60[_0x22d649(0x202)])['\x74\x6f\x53\x74\x72\x69\x6e\x67']();return JSON[_0x22d649(0x206)](_0x4a8e2a);}catch{return null;}}function verifyToken(_0x216c3d,_0x1873cf,_0x14a5ce={}){const _0x17c0dd=a0_0x3ba994,_0x1cf145={'\x7a\x44\x67\x52\x58':function(_0x529703,_0x1fe9a7){return _0x529703!==_0x1fe9a7;},'\x77\x52\x57\x4e\x73':function(_0x22e969,_0x24de8f){return _0x22e969(_0x24de8f);},'\x4a\x43\x43\x4b\x43':function(_0x3d0f6d,_0x350e1a){return _0x3d0f6d/_0x350e1a;},'\x62\x57\x42\x69\x70':function(_0x2a8ab4,_0x5adba4){return _0x2a8ab4!==_0x5adba4;},'\x7a\x4c\x41\x74\x56':function(_0x162d2c,_0x4df47b){return _0x162d2c<_0x4df47b;}};try{const _0x4fd8a8=_0x216c3d['\x73\x70\x6c\x69\x74']('\x2e');if(_0x4fd8a8['\x6c\x65\x6e\x67\x74\x68']!==0x3)return null;const [_0x557ed2,_0x1deaf6,_0x3b2838]=_0x4fd8a8;if(!_0x557ed2||!_0x1deaf6||!_0x3b2838)return null;let _0x56a71f;try{const _0x4c83cd=_0x557ed2+'\x3d'[_0x17c0dd(0x1fe)]((0x4-_0x557ed2[_0x17c0dd(0x214)]%0x4)%0x4),_0x3160b6=Buffer[_0x17c0dd(0x22c)](_0x4c83cd[_0x17c0dd(0x213)](/-/g,'\x2b')[_0x17c0dd(0x213)](/_/g,'\x2f'),_0x17c0dd(0x1f2))[_0x17c0dd(0x21b)]();_0x56a71f=JSON[_0x17c0dd(0x206)](_0x3160b6);}catch{return null;}if(_0x56a71f[_0x17c0dd(0x207)]!==_0x17c0dd(0x1fb))return null;const _0x157580=createSignature(_0x557ed2+'\x2e'+_0x1deaf6,_0x1873cf),_0x5e6f32=decodeBase64UrlToBuffer(_0x3b2838),_0x38c682=decodeBase64UrlToBuffer(_0x157580);if(!_0x5e6f32||!_0x38c682)return null;if(_0x1cf145[_0x17c0dd(0x20c)](_0x5e6f32[_0x17c0dd(0x214)],_0x38c682[_0x17c0dd(0x214)]))return null;if(!timingSafeEqual(_0x5e6f32,_0x38c682))return null;const _0x19bd63=_0x1cf145[_0x17c0dd(0x20e)](unsafeDecodeToken,_0x216c3d);if(!_0x19bd63)return null;const _0x434519=Math[_0x17c0dd(0x224)](_0x1cf145['\x4a\x43\x43\x4b\x43'](Date['\x6e\x6f\x77'](),0x3e8)),_0x62fb90=Math[_0x17c0dd(0x229)](0x0,_0x14a5ce[_0x17c0dd(0x225)]??0x0);if(_0x1cf145['\x62\x57\x42\x69\x70'](typeof _0x19bd63[_0x17c0dd(0x218)],'\x6e\x75\x6d\x62\x65\x72')||_0x1cf145[_0x17c0dd(0x22d)](_0x19bd63['\x65\x78\x70']+_0x62fb90,_0x434519))return null;return _0x19bd63;}catch{return null;}}function getTokenTTL(_0x336a7a){const _0x42f189=a0_0x3ba994,_0x22fa52={'\x6a\x6e\x4a\x48\x48':function(_0x3378a3,_0x40c5b1){return _0x3378a3/_0x40c5b1;},'\x53\x5a\x75\x6f\x49':function(_0x33186a,_0x8b12e6){return _0x33186a-_0x8b12e6;}},_0x332ed3=Math[_0x42f189(0x224)](_0x22fa52[_0x42f189(0x203)](Date[_0x42f189(0x222)](),0x3e8));return _0x22fa52[_0x42f189(0x1fa)](_0x336a7a['\x65\x78\x70'],_0x332ed3);}function isTokenExpiringSoon(_0x213570,_0x2f4974=0x3c){const _0x8a22cd={'\x58\x58\x56\x48\x53':function(_0x37514f,_0x49695c){return _0x37514f(_0x49695c);}};return _0x8a22cd['\x58\x58\x56\x48\x53'](getTokenTTL,_0x213570)<=_0x2f4974;}var ProductTokenIssuer=class{[a0_0x3ba994(0x22b)];[a0_0x3ba994(0x204)];[a0_0x3ba994(0x21e)];constructor(_0x69c29f){const _0x23d566=a0_0x3ba994;this['\x70\x72\x6f\x64\x75\x63\x74\x49\x64']=_0x69c29f[_0x23d566(0x22b)],this[_0x23d566(0x204)]=_0x69c29f['\x73\x69\x67\x6e\x69\x6e\x67\x53\x65\x63\x72\x65\x74'],this['\x74\x74\x6c\x4d\x69\x6e\x75\x74\x65\x73']={'\x66\x72\x65\x65':_0x69c29f['\x74\x74\x6c\x4d\x69\x6e\x75\x74\x65\x73']?.['\x66\x72\x65\x65']??0xf,'\x70\x72\x6f':_0x69c29f[_0x23d566(0x21e)]?.[_0x23d566(0x215)]??0xf0,'\x65\x6e\x74\x65\x72\x70\x72\x69\x73\x65':_0x69c29f[_0x23d566(0x21e)]?.[_0x23d566(0x1f6)]??0x1e0};}[a0_0x3ba994(0x21c)](_0x1602fb){const _0x17b313=a0_0x3ba994,_0x14c987={'\x77\x51\x48\x4b\x52':'\x66\x72\x65\x65','\x6b\x4c\x5a\x68\x56':function(_0x32e332,_0x2bb638,_0x172418,_0xb754d1){return _0x32e332(_0x2bb638,_0x172418,_0xb754d1);}},_0x497989=_0x1602fb[_0x17b313(0x1ff)]??_0x14c987[_0x17b313(0x22f)],_0x2e10aa=this[_0x17b313(0x21e)][_0x497989]??this[_0x17b313(0x21e)][_0x17b313(0x219)];return{'\x74\x6f\x6b\x65\x6e':_0x14c987[_0x17b313(0x200)](issueReadToken,this['\x73\x69\x67\x6e\x69\x6e\x67\x53\x65\x63\x72\x65\x74'],{'\x73\x75\x62':_0x1602fb[_0x17b313(0x20a)],'\x73\x69\x64':_0x1602fb['\x73\x65\x73\x73\x69\x6f\x6e\x49\x64'],'\x70\x69\x64':this[_0x17b313(0x22b)],'\x63\x69\x64':_0x1602fb[_0x17b313(0x226)]},_0x2e10aa),'\x65\x78\x70\x69\x72\x65\x73\x41\x74':Math[_0x17b313(0x224)](Date['\x6e\x6f\x77']()/0x3e8)+_0x2e10aa*0x3c};}[a0_0x3ba994(0x228)](_0xa3af8b){const _0x29d586=a0_0x3ba994,_0x199166={'\x6f\x42\x48\x42\x6e':function(_0xc8e6e1,_0x629ede){return _0xc8e6e1+_0x629ede;},'\x69\x4a\x6c\x78\x50':function(_0x469808,_0x4c48fd){return _0x469808*_0x4c48fd;}},_0x289cb4=_0xa3af8b[_0x29d586(0x1ff)]??_0x29d586(0x219),_0xf52d48=this[_0x29d586(0x21e)][_0x289cb4]??this[_0x29d586(0x21e)][_0x29d586(0x219)];return{'\x74\x6f\x6b\x65\x6e':issueCollaborationToken(this[_0x29d586(0x204)],{'\x75\x73\x65\x72\x49\x64':_0xa3af8b[_0x29d586(0x20a)],'\x73\x65\x73\x73\x69\x6f\x6e\x49\x64':_0xa3af8b['\x73\x65\x73\x73\x69\x6f\x6e\x49\x64'],'\x70\x72\x6f\x64\x75\x63\x74\x49\x64':this[_0x29d586(0x22b)],'\x70\x72\x6f\x6a\x65\x63\x74\x49\x64':_0xa3af8b[_0x29d586(0x1f4)],'\x64\x6f\x63\x75\x6d\x65\x6e\x74\x49\x64':_0xa3af8b[_0x29d586(0x211)],'\x61\x63\x63\x65\x73\x73':_0xa3af8b[_0x29d586(0x212)],'\x73\x61\x6e\x64\x62\x6f\x78\x49\x64':_0xa3af8b['\x73\x61\x6e\x64\x62\x6f\x78\x49\x64']},_0xf52d48),'\x65\x78\x70\x69\x72\x65\x73\x41\x74':_0x199166[_0x29d586(0x205)](Math['\x66\x6c\x6f\x6f\x72'](Date[_0x29d586(0x222)]()/0x3e8),_0x199166[_0x29d586(0x208)](_0xf52d48,0x3c))};}[a0_0x3ba994(0x21a)](_0x1f19cd='\x66\x72\x65\x65'){const _0x25b148=a0_0x3ba994;return this[_0x25b148(0x21e)][_0x1f19cd]??this[_0x25b148(0x21e)][_0x25b148(0x219)];}};function a0_0xc6f7(){const _0x4e58a9=['\x41\x30\x58\x41\x41\x66\x79','\x74\x4b\x54\x72\x42\x30\x43','\x7a\x67\x50\x4b\x76\x32\x47','\x41\x4d\x35\x6b\x73\x65\x47','\x43\x32\x4c\x4e\x42\x4d\x4c\x55\x7a\x31\x6e\x4c\x79\x33\x6a\x4c\x44\x61','\x42\x30\x6a\x69\x71\x4d\x34','\x43\x67\x66\x59\x43\x32\x75','\x79\x77\x58\x4e','\x41\x75\x50\x53\x45\x66\x61','\x43\x33\x72\x59\x41\x77\x35\x4e\x41\x77\x7a\x35','\x44\x78\x6e\x4c\x43\x4b\x4c\x4b','\x6e\x5a\x61\x59\x6d\x64\x6d\x5a\x76\x67\x54\x4e\x71\x4d\x72\x55','\x45\x4b\x72\x4e\x75\x4c\x47','\x73\x67\x50\x62\x41\x4c\x75','\x44\x31\x6a\x78\x74\x4e\x6d','\x6d\x4a\x71\x57\x6e\x5a\x43\x59\x6e\x77\x50\x77\x76\x75\x58\x6a\x77\x71','\x6d\x74\x4b\x34\x77\x76\x62\x54\x42\x4b\x58\x57','\x7a\x67\x39\x4a\x44\x77\x31\x4c\x42\x4e\x72\x6a\x7a\x61','\x79\x77\x6e\x4a\x7a\x78\x6e\x5a','\x43\x4d\x76\x57\x42\x67\x66\x4a\x7a\x71','\x42\x67\x76\x55\x7a\x33\x72\x4f','\x43\x68\x6a\x56','\x6e\x5a\x47\x5a\x6e\x64\x79\x34\x41\x78\x66\x7a\x45\x75\x7a\x6a','\x77\x65\x66\x4d\x71\x4b\x38','\x7a\x78\x48\x57','\x7a\x4e\x6a\x4c\x7a\x71','\x7a\x32\x76\x30\x76\x68\x72\x53\x74\x77\x4c\x55\x44\x78\x72\x4c\x43\x57','\x44\x67\x39\x74\x44\x68\x6a\x50\x42\x4d\x43','\x41\x78\x6e\x5a\x44\x77\x75','\x6e\x74\x4b\x33\x6f\x78\x66\x4c\x72\x67\x50\x73\x43\x61','\x44\x68\x72\x53\x74\x77\x4c\x55\x44\x78\x72\x4c\x43\x57','\x6f\x74\x75\x32\x76\x32\x58\x71\x7a\x32\x35\x32','\x6e\x30\x58\x72\x42\x32\x54\x66\x44\x47','\x73\x4c\x44\x75','\x42\x4d\x39\x33','\x42\x4c\x76\x76\x79\x4b\x43','\x7a\x4d\x58\x56\x42\x33\x69','\x79\x32\x58\x56\x79\x32\x54\x74\x41\x32\x76\x33\x75\x32\x76\x4a\x42\x32\x35\x4b\x43\x57','\x43\x32\x66\x55\x7a\x67\x6a\x56\x45\x65\x4c\x4b','\x41\x4c\x44\x69\x72\x75\x43','\x41\x78\x6e\x5a\x44\x77\x76\x64\x42\x32\x58\x53\x79\x77\x6a\x56\x43\x4d\x66\x30\x41\x77\x39\x55','\x42\x77\x66\x34','\x6d\x5a\x71\x30\x6d\x64\x75\x57\x6e\x67\x66\x64\x42\x66\x6a\x64\x75\x71','\x43\x68\x6a\x56\x7a\x68\x76\x4a\x44\x65\x4c\x4b','\x7a\x4e\x6a\x56\x42\x71','\x45\x4b\x58\x62\x44\x66\x79','\x43\x33\x62\x53\x41\x78\x71','\x44\x31\x66\x69\x73\x31\x69','\x75\x4c\x72\x72\x44\x30\x4f','\x45\x4d\x4c\x6b\x7a\x31\x75','\x79\x4d\x66\x5a\x7a\x74\x79\x30','\x79\x32\x39\x53\x42\x67\x66\x49\x42\x33\x6a\x48\x44\x67\x4c\x56\x42\x47','\x43\x68\x6a\x56\x41\x4d\x76\x4a\x44\x65\x4c\x4b','\x7a\x67\x4c\x4e\x7a\x78\x6e\x30','\x7a\x77\x35\x30\x7a\x78\x6a\x57\x43\x4d\x4c\x5a\x7a\x71','\x7a\x30\x6e\x48\x41\x67\x65','\x6d\x4a\x71\x58\x6e\x64\x76\x73\x42\x75\x50\x53\x43\x66\x61','\x44\x78\x62\x4b\x79\x78\x72\x4c','\x75\x31\x50\x31\x42\x30\x4b','\x73\x66\x6d\x59\x6e\x74\x79','\x71\x30\x6e\x65\x77\x76\x4b','\x6d\x74\x71\x5a\x6d\x5a\x69\x31\x6d\x74\x62\x59\x77\x67\x39\x62\x71\x31\x47','\x43\x4d\x76\x57\x7a\x77\x66\x30','\x44\x67\x4c\x4c\x43\x47'];a0_0xc6f7=function(){return _0x4e58a9;};return a0_0xc6f7();}export{ProductTokenIssuer,getTokenTTL,isTokenExpiringSoon,issueBatchScopedToken,issueCollaborationToken,issueProjectScopedToken,issueReadToken,issueSessionScopedToken,unsafeDecodeToken,verifyToken};

package/dist/{errors-BI75IXOM.d.ts → client-BuPZLOxS.d.ts}

@@ -1,4 +1,4 @@
-import { $ as FleetExecDispatchOptions, A as CreateIntelligenceReportOptions, An as SandboxFleetWorkspaceReconcileResult, Bt as PromptResult, C as BatchResult, Cn as SandboxFleetToken, Dn as SandboxFleetTraceOptions, G as ExecOptions, Gt as PublicTemplateInfo, Jn as SecretsManager, Jt as PublishPublicTemplateVersionOptions, K as ExecResult, Kt as PublicTemplateVersionInfo, M as CreateSandboxFleetTokenOptions, Mn as SandboxFleetWorkspaceSnapshotResult, N as CreateSandboxFleetWithCoordinatorOptions, Nn as SandboxInfo, On as SandboxFleetUsage, P as CreateSandboxOptions, Q as FleetDispatchStreamOptions, Qt as ReconcileSandboxFleetsResult, Rt as PromptInputPart, S as BatchOptions, X as FleetDispatchResultBuffer, Xt as ReapExpiredSandboxFleetsResult, Y as FleetDispatchCancelResult, Yt as ReapExpiredSandboxFleetsOptions, Z as FleetDispatchResultBufferOptions, Zt as ReconcileSandboxFleetsOptions, _n as SandboxFleetMachineRecord, _r as UsageInfo, a as TraceExportSink, bt as ListSandboxFleetOptions, cn as SandboxFleetCostEstimate, dn as SandboxFleetDriverCapability, et as FleetExecDispatchResult, fr as TokenRefreshHandler, gt as IntelligenceReportCompareTo, ht as IntelligenceReportBudget, i as TraceExportResult, in as SandboxEnvironment, ir as SubscriptionInfo, j as CreateSandboxFleetOptions, jn as SandboxFleetWorkspaceRestoreResult, m as AttachSandboxFleetMachineOptions, mt as IntelligenceReport, n as SandboxInstance, nn as SandboxClientConfig, nr as SshKeysManager, nt as FleetPromptDispatchOptions, on as SandboxFleetArtifact, pn as SandboxFleetInfo, qt as PublishPublicTemplateOptions, rt as FleetPromptDispatchResult, sn as SandboxFleetArtifactSpec, t as HttpClient, tt as FleetMachineId, un as SandboxFleetDispatchResponse, vt as IntelligenceReportWindow, w as BatchTask, wn as SandboxFleetTraceBundle, x as BatchEvent, xn as SandboxFleetOperationsSummary, xt as ListSandboxOptions, yn as SandboxFleetManifest, zt as PromptOptions } from "./sandbox-aBpWqler.js";
+import { A as BatchTask, Ar as UsageInfo, Bn as SandboxFleetUsage, Cn as SandboxFleetDriverCapability, D as BatchEvent, Dt as IntelligenceReportCompareTo, Et as IntelligenceReportBudget, Fn as SandboxFleetToken, G as CreateSandboxOptions, Gn as SandboxInfo, H as CreateSandboxFleetOptions, Hn as SandboxFleetWorkspaceReconcileResult, In as SandboxFleetTraceBundle, Mt as ListSandboxFleetOptions, Nn as SandboxFleetOperationsSummary, Nt as ListSandboxOptions, O as BatchOptions, Qt as PromptResult, Sn as SandboxFleetDispatchResponse, Tn as SandboxFleetInfo, Tr as TokenRefreshHandler, Tt as IntelligenceReport, U as CreateSandboxFleetTokenOptions, Un as SandboxFleetWorkspaceRestoreResult, V as CreateIntelligenceReportOptions, W as CreateSandboxFleetWithCoordinatorOptions, Wn as SandboxFleetWorkspaceSnapshotResult, Xt as PromptInputPart, Zt as PromptOptions, _r as SubscriptionInfo, a as TraceExportSink, an as PublishPublicTemplateOptions, b as AttachSandboxFleetMachineOptions, bn as SandboxFleetCostEstimate, cn as ReapExpiredSandboxFleetsResult, ct as FleetDispatchResultBufferOptions, dt as FleetExecDispatchResult, ft as FleetMachineId, gn as SandboxEnvironment, hr as SshKeysManager, i as TraceExportResult, in as PublicTemplateVersionInfo, jn as SandboxFleetManifest, k as BatchResult, kn as SandboxFleetMachineRecord, kt as IntelligenceReportWindow, ln as ReconcileSandboxFleetsOptions, lt as FleetDispatchStreamOptions, mn as SandboxClientConfig, mt as FleetPromptDispatchResult, n as SandboxInstance, nt as ExecOptions, on as PublishPublicTemplateVersionOptions, or as SecretsManager, ot as FleetDispatchCancelResult, pt as FleetPromptDispatchOptions, rn as PublicTemplateInfo, rt as ExecResult, sn as ReapExpiredSandboxFleetsOptions, st as FleetDispatchResultBuffer, t as HttpClient, un as ReconcileSandboxFleetsResult, ut as FleetExecDispatchOptions, vn as SandboxFleetArtifact, yn as SandboxFleetArtifactSpec, zn as SandboxFleetTraceOptions } from "./sandbox-CpK8etqP.js";
 
 //#region src/lib/sse-parser.d.ts
 /**
@@ -1047,131 +1047,4 @@ declare class TeamsClient {
  * Alias for SandboxClient for cleaner imports.
  */
 //#endregion
-//#region src/errors.d.ts
-/**
- * Sandbox SDK Errors
- *
- * Error classes for the Sandbox client SDK.
- */
-/**
- * Base error class for all Sandbox SDK errors.
- */
-declare class SandboxError extends Error {
-  /** HTTP status code if applicable */
-  readonly status?: number;
-  /** Error code for programmatic handling */
-  readonly code: string;
-  /** Best-effort origin of the failing request */
-  readonly origin?: SandboxErrorOrigin;
-  /** Request path or endpoint when known */
-  readonly endpoint?: string;
-  /** Retry-after duration in ms when surfaced by the upstream */
-  readonly retryAfterMs?: number;
-  /** Sidecar version when the runtime emitted it */
-  readonly sidecarVersion?: string;
-  /** Sidecar image/tag/sha when the runtime emitted it */
-  readonly containerImage?: string;
-  constructor(message: string, code: string, status?: number, metadata?: SandboxErrorMetadata);
-}
-type SandboxErrorOrigin = "sidecar" | "sandbox-api" | "control-plane" | "runtime" | "unknown";
-interface SandboxErrorMetadata {
-  origin?: SandboxErrorOrigin;
-  endpoint?: string;
-  retryAfterMs?: number;
-  sidecarVersion?: string;
-  containerImage?: string;
-}
-type SandboxErrorJson = string | number | boolean | null | {
-  [key: string]: SandboxErrorJson;
-} | SandboxErrorJson[];
-type SandboxFailureDetail = {
-  [key: string]: SandboxErrorJson;
-};
-/**
- * Authentication failed or API key is invalid.
- */
-declare class AuthError extends SandboxError {
-  constructor(message?: string, metadata?: SandboxErrorMetadata);
-}
-/**
- * The requested resource was not found.
- */
-declare class NotFoundError extends SandboxError {
-  /** The resource type that was not found */
-  readonly resourceType: string;
-  /** The resource ID that was not found */
-  readonly resourceId: string;
-  constructor(resourceType: string, resourceId: string, metadata?: SandboxErrorMetadata);
-}
-/**
- * Account quota or rate limit exceeded.
- */
-declare class QuotaError extends SandboxError {
-  /** The type of quota that was exceeded */
-  readonly quotaType: string;
-  /** Current usage */
-  readonly current?: number;
-  /** Maximum allowed */
-  readonly limit?: number;
-  /** Suggested retry-after duration in ms */
-  readonly retryAfterMs?: number;
-  constructor(quotaType: string, message?: string, current?: number, limit?: number, metadata?: SandboxErrorMetadata, status?: number);
-}
-/**
- * The requested capability is unavailable for the account, driver, or sandbox.
- */
-declare class CapabilityError extends SandboxError {
-  /** Capability or feature that was rejected when known */
-  readonly capability?: string;
-  constructor(message: string, code?: string, status?: number, metadata?: SandboxErrorMetadata, capability?: string);
-}
-/**
- * A multi-resource operation failed for one or more branches.
- */
-declare class PartialFailureError extends SandboxError {
-  /** Per-resource failures returned by the API when available */
-  readonly failures?: SandboxFailureDetail[];
-  constructor(message: string, code?: string, status?: number, metadata?: SandboxErrorMetadata, failures?: SandboxFailureDetail[]);
-}
-/**
- * The request was invalid or malformed.
- */
-declare class ValidationError extends SandboxError {
-  /** Field-level validation errors */
-  readonly fields?: Record<string, string>;
-  constructor(message: string, fields?: Record<string, string>, metadata?: SandboxErrorMetadata);
-}
-/**
- * The sandbox is not in a valid state for the requested operation.
- */
-declare class StateError extends SandboxError {
-  /** Current state of the sandbox */
-  readonly currentState: string;
-  /** Required state for the operation */
-  readonly requiredState?: string;
-  constructor(message: string, currentState: string, requiredState?: string, metadata?: SandboxErrorMetadata);
-}
-/**
- * The request timed out.
- */
-declare class TimeoutError extends SandboxError {
-  /** Timeout duration in milliseconds */
-  readonly timeoutMs: number;
-  constructor(timeoutMs: number, message?: string, metadata?: SandboxErrorMetadata);
-}
-/**
- * A network or connection error occurred.
- */
-declare class NetworkError extends SandboxError {
-  /** The underlying error */
-  readonly cause?: Error;
-  constructor(message: string, causeOrMetadata?: Error | SandboxErrorMetadata, metadata?: SandboxErrorMetadata);
-}
-/**
- * The server returned an unexpected error.
- */
-declare class ServerError extends SandboxError {
-  constructor(message: string, status?: number, metadata?: SandboxErrorMetadata);
-}
-//#endregion
-export { IntegrationAction as A, TriggerRun as B, CreateAutomationInput as C, EndpointInfo as D, DeliveryAttempt as E, IntegrationScope as F, ParsedSSEEvent as G, SandboxFleet as H, IntegrationVerificationKind as I, parseSSEStream as K, IntegrationsManager as L, IntegrationDeliveryStatus as M, IntegrationPrincipalType as N, EndpointWithSecret as O, IntegrationProvider as P, RecipeManifest as R, ConnectionInfo as S, CreateTriggerInput as T, SandboxFleetClient as U, TriggerWithSecret as V, ParseSSEStreamOptions as W, SandboxClient as _, PartialFailureError as a, TeamMember as b, SandboxErrorJson as c, StateError as d, TimeoutError as f, InviteTeamMemberOptions as g, IntelligenceClient as h, NotFoundError as i, IntegrationActionKind as j, InstallRecipeInput as k, SandboxFailureDetail as l, CreateTeamOptions as m, CapabilityError as n, QuotaError as o, ValidationError as p, NetworkError as r, SandboxError as s, AuthError as t, ServerError as u, Team as v, CreateEndpointInput as w, AutomationInfo as x, TeamInvitation as y, TriggerInfo as z };
+export { SandboxFleetClient as A, IntegrationVerificationKind as C, TriggerRun as D, TriggerInfo as E, ParsedSSEEvent as M, parseSSEStream as N, TriggerWithSecret as O, IntegrationScope as S, RecipeManifest as T, IntegrationAction as _, Team as a, IntegrationPrincipalType as b, AutomationInfo as c, CreateEndpointInput as d, CreateTriggerInput as f, InstallRecipeInput as g, EndpointWithSecret as h, SandboxClient as i, ParseSSEStreamOptions as j, SandboxFleet as k, ConnectionInfo as l, EndpointInfo as m, IntelligenceClient as n, TeamInvitation as o, DeliveryAttempt as p, InviteTeamMemberOptions as r, TeamMember as s, CreateTeamOptions as t, CreateAutomationInput as u, IntegrationActionKind as v, IntegrationsManager as w, IntegrationProvider as x, IntegrationDeliveryStatus as y };