@tier0/sdk-v2 0.1.0 → 0.2.2

package/dist/cjs/uns-v2/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/uns-v2/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,8CAA4B;AAC5B,uCAA4C;AAAnC,0GAAA,cAAc,OAAA;AACvB,mDAAuD;AAA9C,qHAAA,mBAAmB,OAAA","sourcesContent":["export * from './generated.js';\r\nexport * from './client.js';\r\nexport { UnsV2RawNumber } from './codec.js';\r\nexport { createUnsDataClient } from './data-client.js';\r\nexport type { UnsDataClient, UnsDataClientConfig, UnsDataOperationName } from './data-client.js';\r\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/uns-v2/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,8CAA4B;AAC5B,uCAA4C;AAAnC,0GAAA,cAAc,OAAA;AACvB,mDAAuD;AAA9C,qHAAA,mBAAmB,OAAA","sourcesContent":["export * from './generated.js';\nexport * from './client.js';\nexport { UnsV2RawNumber } from './codec.js';\nexport { createUnsDataClient } from './data-client.js';\nexport type { UnsDataClient, UnsDataClientConfig, UnsDataOperationName } from './data-client.js';\n"]}

package/dist/cjs/uns-v2/sse.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Minimal `text/event-stream` parser (WHATWG server-sent events). Unlike
+ * EventSource it also dispatches a named event without data lines, and
+ * reports comment lines, so a keep-alive in either form is visible.
+ */
+export interface ServerSentEvent {
+    /** `message` when the server names no event. */
+    event: string;
+    data: string;
+    /** Last `id:` seen on the stream so far, as EventSource keeps it. */
+    id?: string;
+}
+/** A line longer than this is not an event stream (e.g. a proxy page without newlines). */
+export declare const SSE_MAX_LINE_BYTES: number;
+export declare class ServerSentEventsError extends Error {
+}
+/** Yields each dispatched event and each comment line; `retry:` is ignored. Throws ServerSentEventsError on an oversized line. */
+export declare function parseServerSentEvents(stream: ReadableStream<Uint8Array>): AsyncGenerator<ServerSentEvent | {
+    comment: string;
+}>;

package/dist/cjs/uns-v2/sse.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * Minimal `text/event-stream` parser (WHATWG server-sent events). Unlike
+ * EventSource it also dispatches a named event without data lines, and
+ * reports comment lines, so a keep-alive in either form is visible.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServerSentEventsError = exports.SSE_MAX_LINE_BYTES = void 0;
+exports.parseServerSentEvents = parseServerSentEvents;
+/** A line longer than this is not an event stream (e.g. a proxy page without newlines). */
+exports.SSE_MAX_LINE_BYTES = 1 << 20;
+class ServerSentEventsError extends Error {
+}
+exports.ServerSentEventsError = ServerSentEventsError;
+/** Yields each dispatched event and each comment line; `retry:` is ignored. Throws ServerSentEventsError on an oversized line. */
+async function* parseServerSentEvents(stream) {
+    const reader = stream.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let event = '';
+    let data = [];
+    let id;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            buffer += done ? decoder.decode() : decoder.decode(value, { stream: true });
+            // A trailing "\r" may be the first half of "\r\n": keep it for the next chunk.
+            const lines = buffer.split(/\r\n|\n|\r(?!$)/);
+            buffer = done ? '' : (lines.pop() ?? '');
+            // UTF-16 length bounds the UTF-8 size from below; good enough to stop runaway input.
+            if (buffer.length > exports.SSE_MAX_LINE_BYTES)
+                throw new ServerSentEventsError('Server-sent event line too long.');
+            for (const line of lines) {
+                if (line === '') {
+                    if (data.length > 0 || event)
+                        yield { event: event || 'message', data: data.join('\n'), ...(id === undefined ? {} : { id }) };
+                    event = '';
+                    data = [];
+                    continue;
+                }
+                if (line.startsWith(':')) {
+                    yield { comment: line.slice(1).trimStart() };
+                    continue;
+                }
+                const colon = line.indexOf(':');
+                const field = colon < 0 ? line : line.slice(0, colon);
+                const raw = colon < 0 ? '' : line.slice(colon + 1);
+                const text = raw.startsWith(' ') ? raw.slice(1) : raw;
+                if (field === 'event')
+                    event = text;
+                else if (field === 'data')
+                    data.push(text);
+                else if (field === 'id' && !text.includes('\u0000'))
+                    id = text;
+            }
+            if (done)
+                return;
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+}
+//# sourceMappingURL=sse.js.map

package/dist/cjs/uns-v2/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../../src/uns-v2/sse.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAgBH,sDAyCC;AA/CD,2FAA2F;AAC9E,QAAA,kBAAkB,GAAG,CAAC,IAAI,EAAE,CAAC;AAE1C,MAAa,qBAAsB,SAAQ,KAAK;CAAG;AAAnD,sDAAmD;AAEnD,kIAAkI;AAC3H,KAAK,SAAS,CAAC,CAAC,qBAAqB,CAAC,MAAkC;IAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,IAAI,GAAa,EAAE,CAAC;IACxB,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,+EAA+E;YAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC9C,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,qFAAqF;YACrF,IAAI,MAAM,CAAC,MAAM,GAAG,0BAAkB;gBAAE,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,CAAC,CAAC;YAC5G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBAChB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK;wBAAE,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;oBAC9H,KAAK,GAAG,EAAE,CAAC;oBACX,IAAI,GAAG,EAAE,CAAC;oBACV,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;oBAC7C,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBACtD,IAAI,KAAK,KAAK,OAAO;oBAAE,KAAK,GAAG,IAAI,CAAC;qBAC/B,IAAI,KAAK,KAAK,MAAM;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;qBACtC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,EAAE,GAAG,IAAI,CAAC;YACjE,CAAC;YACD,IAAI,IAAI;gBAAE,OAAO;QACnB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["/**\n * Minimal `text/event-stream` parser (WHATWG server-sent events). Unlike\n * EventSource it also dispatches a named event without data lines, and\n * reports comment lines, so a keep-alive in either form is visible.\n */\n\nexport interface ServerSentEvent {\n  /** `message` when the server names no event. */\n  event: string;\n  data: string;\n  /** Last `id:` seen on the stream so far, as EventSource keeps it. */\n  id?: string;\n}\n\n/** A line longer than this is not an event stream (e.g. a proxy page without newlines). */\nexport const SSE_MAX_LINE_BYTES = 1 << 20;\n\nexport class ServerSentEventsError extends Error {}\n\n/** Yields each dispatched event and each comment line; `retry:` is ignored. Throws ServerSentEventsError on an oversized line. */\nexport async function* parseServerSentEvents(stream: ReadableStream<Uint8Array>): AsyncGenerator<ServerSentEvent | { comment: string }> {\n  const reader = stream.getReader();\n  const decoder = new TextDecoder();\n  let buffer = '';\n  let event = '';\n  let data: string[] = [];\n  let id: string | undefined;\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      buffer += done ? decoder.decode() : decoder.decode(value, { stream: true });\n      // A trailing \"\\r\" may be the first half of \"\\r\\n\": keep it for the next chunk.\n      const lines = buffer.split(/\\r\\n|\\n|\\r(?!$)/);\n      buffer = done ? '' : (lines.pop() ?? '');\n      // UTF-16 length bounds the UTF-8 size from below; good enough to stop runaway input.\n      if (buffer.length > SSE_MAX_LINE_BYTES) throw new ServerSentEventsError('Server-sent event line too long.');\n      for (const line of lines) {\n        if (line === '') {\n          if (data.length > 0 || event) yield { event: event || 'message', data: data.join('\\n'), ...(id === undefined ? {} : { id }) };\n          event = '';\n          data = [];\n          continue;\n        }\n        if (line.startsWith(':')) {\n          yield { comment: line.slice(1).trimStart() };\n          continue;\n        }\n        const colon = line.indexOf(':');\n        const field = colon < 0 ? line : line.slice(0, colon);\n        const raw = colon < 0 ? '' : line.slice(colon + 1);\n        const text = raw.startsWith(' ') ? raw.slice(1) : raw;\n        if (field === 'event') event = text;\n        else if (field === 'data') data.push(text);\n        else if (field === 'id' && !text.includes('\\u0000')) id = text;\n      }\n      if (done) return;\n    }\n  } finally {\n    await reader.cancel().catch(() => undefined);\n    reader.releaseLock();\n  }\n}\n"]}

package/dist/esm/app-identity-contract.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-identity-contract.generated.js","sourceRoot":"","sources":["../../src/app-identity-contract.generated.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,SAAS,EAAE,+BAA+B;IAC1C,QAAQ,EAAE,sBAAsB;IAChC,MAAM,EAAE,uBAAuB;IAC/B,WAAW,EAAE,OAAO;IACpB,QAAQ,EAAE,mBAAmB;IAC7B,UAAU,EAAE,mBAAmB;IAC/B,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,EAAE;IACnB,kBAAkB,EAAE,CAAC;IACrB,UAAU,EAAE,EAAE;IACd,cAAc,EAAE,GAAG;IACnB,SAAS,EAAE,CAAC;IACZ,cAAc,EAAE,mCAAmC;IACnD,cAAc,EAAE,2EAA2E;IAC3F,gBAAgB,EAAE;QAChB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,aAAa;QACb,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,YAAY;QACZ,KAAK;QACL,KAAK;QACL,KAAK;QACL,OAAO;KACR;IACD,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE;QACtB,KAAK;QACL,KAAK;QACL,KAAK;KACN;IACD,iBAAiB,EAAE;QACjB,KAAK;QACL,KAAK;QACL,GAAG;QACH,KAAK;KACN;CACO,CAAC","sourcesContent":["// Generated from SWE gatewayheader/app-request-identity.v1.json; do not edit.\r\n// Source SHA-256: ac5ec2efb882395e63a46c9ec479de16c09943b88fc0bd906dd77c7f9f4bfaa3\r\nexport const APP_REQUEST_IDENTITY_CONTRACT = {\r\n  \"version\": \"tier0.app-request-identity/v1\",\r\n  \"header\": \"X-Tier0-App-Identity\",\r\n  \"type\": \"tier0-app-request+jwt\",\r\n  \"algorithm\": \"EdDSA\",\r\n  \"issuer\": \"tier0-app-gateway\",\r\n  \"audience\": \"tier0-app-runtime\",\r\n  \"maxTokenBytes\": 8192,\r\n  \"maxBodyBytes\": 65536,\r\n  \"maxURIBytes\": 8192,\r\n  \"maxTTLSeconds\": 30,\r\n  \"clockSkewSeconds\": 5,\r\n  \"maxRoles\": 32,\r\n  \"maxRoleBytes\": 128,\r\n  \"maxKeys\": 8,\r\n  \"keyIDPattern\": \"^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$\",\r\n  \"appIDPattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$\",\r\n  \"requiredClaims\": [\r\n    \"ver\",\r\n    \"iss\",\r\n    \"aud\",\r\n    \"sub\",\r\n    \"workspaceID\",\r\n    \"appID\",\r\n    \"method\",\r\n    \"requestURI\",\r\n    \"bodySHA256\",\r\n    \"iat\",\r\n    \"exp\",\r\n    \"jti\",\r\n    \"roles\"\r\n  ],\r\n  \"methodPattern\": \"^[A-Z]{1,16}$\",\r\n  \"requiredHeaderFields\": [\r\n    \"alg\",\r\n    \"typ\",\r\n    \"kid\"\r\n  ],\r\n  \"publicKeyFields\": [\r\n    \"kty\",\r\n    \"crv\",\r\n    \"x\",\r\n    \"kid\"\r\n  ]\r\n} as const;\r\n"]}
+{"version":3,"file":"app-identity-contract.generated.js","sourceRoot":"","sources":["../../src/app-identity-contract.generated.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,mFAAmF;AACnF,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,SAAS,EAAE,+BAA+B;IAC1C,QAAQ,EAAE,sBAAsB;IAChC,MAAM,EAAE,uBAAuB;IAC/B,WAAW,EAAE,OAAO;IACpB,QAAQ,EAAE,mBAAmB;IAC7B,UAAU,EAAE,mBAAmB;IAC/B,eAAe,EAAE,IAAI;IACrB,cAAc,EAAE,KAAK;IACrB,aAAa,EAAE,IAAI;IACnB,eAAe,EAAE,EAAE;IACnB,kBAAkB,EAAE,CAAC;IACrB,UAAU,EAAE,EAAE;IACd,cAAc,EAAE,GAAG;IACnB,SAAS,EAAE,CAAC;IACZ,cAAc,EAAE,mCAAmC;IACnD,cAAc,EAAE,2EAA2E;IAC3F,gBAAgB,EAAE;QAChB,KAAK;QACL,KAAK;QACL,KAAK;QACL,KAAK;QACL,aAAa;QACb,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,YAAY;QACZ,KAAK;QACL,KAAK;QACL,KAAK;QACL,OAAO;KACR;IACD,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE;QACtB,KAAK;QACL,KAAK;QACL,KAAK;KACN;IACD,iBAAiB,EAAE;QACjB,KAAK;QACL,KAAK;QACL,GAAG;QACH,KAAK;KACN;CACO,CAAC","sourcesContent":["// Generated from SWE gatewayheader/app-request-identity.v1.json; do not edit.\n// Source SHA-256: ac5ec2efb882395e63a46c9ec479de16c09943b88fc0bd906dd77c7f9f4bfaa3\nexport const APP_REQUEST_IDENTITY_CONTRACT = {\n  \"version\": \"tier0.app-request-identity/v1\",\n  \"header\": \"X-Tier0-App-Identity\",\n  \"type\": \"tier0-app-request+jwt\",\n  \"algorithm\": \"EdDSA\",\n  \"issuer\": \"tier0-app-gateway\",\n  \"audience\": \"tier0-app-runtime\",\n  \"maxTokenBytes\": 8192,\n  \"maxBodyBytes\": 65536,\n  \"maxURIBytes\": 8192,\n  \"maxTTLSeconds\": 30,\n  \"clockSkewSeconds\": 5,\n  \"maxRoles\": 32,\n  \"maxRoleBytes\": 128,\n  \"maxKeys\": 8,\n  \"keyIDPattern\": \"^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$\",\n  \"appIDPattern\": \"^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$\",\n  \"requiredClaims\": [\n    \"ver\",\n    \"iss\",\n    \"aud\",\n    \"sub\",\n    \"workspaceID\",\n    \"appID\",\n    \"method\",\n    \"requestURI\",\n    \"bodySHA256\",\n    \"iat\",\n    \"exp\",\n    \"jti\",\n    \"roles\"\n  ],\n  \"methodPattern\": \"^[A-Z]{1,16}$\",\n  \"requiredHeaderFields\": [\n    \"alg\",\n    \"typ\",\n    \"kid\"\n  ],\n  \"publicKeyFields\": [\n    \"kty\",\n    \"crv\",\n    \"x\",\n    \"kid\"\n  ]\n} as const;\n"]}

package/dist/esm/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAA6B,MAAM,sBAAsB,CAAC;AACtG,OAAO,EAAE,SAAS,EAAmB,MAAM,qBAAqB,CAAC;AA6CjE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,MAAM,CAAU;IAChB,SAAS,CAAS;IAClB,SAAS,GAAG,KAAK,CAAC;IAE3B,YAAY,OAAe,EAAE,IAAyB;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;CACF;AAED,MAAM,SAAS,GAAqC;IAClD,cAAc,EAAE,CAAC,YAAY,CAAC;IAC9B,WAAW,EAAE,CAAC,YAAY,CAAC;IAC3B,WAAW,EAAE,CAAC,iBAAiB,CAAC;IAChC,YAAY,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IAC1C,mBAAmB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAAC;CACrE,CAAC;AAEF,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AACD,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;AAC3F,CAAC;AAED,8GAA8G;AAC9G,SAAS,SAAS,CAAC,KAAc,EAAE,MAAc;IAC/C,MAAM,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,EAAS,EAAE;QACtC,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,wCAAwC,EAAE;YACzH,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,2BAA2B;SAC5F,CAAC,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QACpD,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACzH,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;QACxE,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACvF,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK;QAC5D,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjD,CAAC,KAAK,CAAC,2BAA2B,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC9D,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzE,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAsB,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;YAClH,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAe,CAAC;YAC1G,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACjC,CAAE,IAAI,CAAC,gBAA6B,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtD,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAE,KAAK,CAAC,mBAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;QACrH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC;QACrC,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QAClH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB;YACpE,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5F,YAAY,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;YACvF,KAAK,EAAE,IAAI,CAAC,KAAwB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAsC;YAC/F,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrC,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC3D,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzE,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACzC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAqB,EAAE,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAkB,EAAE,CAAC;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAwB,EAAE,CAAC;QACnH,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QAC3E,2BAA2B,EAAE,CAAC,GAAG,KAAK,CAAC,2BAA2B,CAAC,EAAE,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACxH,YAAY,EAAE,YAAY;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,kBAAkB;IACZ,SAAS,CAAiB;IAE3C,YAAY,gBAAkC,SAAS,EAAE,SAA+B,EAAE;QACxF,IAAI,CAAC,SAAS,GAAG,IAAI,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,yGAAyG;IACzG,KAAK,CAAC,QAAQ;QACZ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;QACzG,IAAI,QAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzD,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE;gBACtE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,KAAK,CAAC,IAAI,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAClF,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;CACF;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC","sourcesContent":["import { CloudTransport, CloudTransportError, type CloudTransportConfig } from './cloud-transport.js';\r\nimport { getClient, type HttpClient } from './openapi/client.js';\r\n\r\nexport type CapabilityCode = 'namespace.v2' | 'source.v1' | 'stream.v2' | 'control.v1' | 'control.invoke.v1';\r\nexport type CapabilityState = 'disabled' | 'not_supported' | 'unavailable' | 'readiness_unknown' | 'ready';\r\nexport type CapabilityAvailability = 'unavailable' | 'unknown' | 'available';\r\n\r\nexport interface PublicCapability {\r\n  code: CapabilityCode;\r\n  /** Public release and workspace gates; does not establish runtime readiness. */\r\n  releaseEnabled: boolean;\r\n  /** Server-assessed implementation/readiness, never inferred from releaseEnabled. */\r\n  enabled: boolean;\r\n  /** Authorization summary, not a grant for every individual Control code. */\r\n  allowed: boolean;\r\n  state: CapabilityState;\r\n  /** Not device online status or execution/ACK confirmation. */\r\n  availability: CapabilityAvailability;\r\n  contractVersions: string[];\r\n}\r\n\r\nexport interface CapabilityDeprecation {\r\n  contract: string;\r\n  replacement?: string;\r\n  sunsetAt?: string;\r\n}\r\n\r\nexport interface CapabilityDiscoverResponse {\r\n  product: 'cloud';\r\n  /** Trusted server configuration only; absent when unconfigured. */\r\n  productVersion?: string;\r\n  contractVersion: '1.0';\r\n  apiContractVersions: string[];\r\n  interpreterContractVersions: string[];\r\n  /** Public SDK contract labels, not npm package versions. */\r\n  sdkContractVersions: string[];\r\n  capabilities: PublicCapability[];\r\n  deprecations: CapabilityDeprecation[];\r\n}\r\n\r\nexport interface CapabilityErrorInfo {\r\n  status?: number;\r\n  /** Gateway string code (including unknown future codes), or an SDK-local CAPABILITY_* code. */\r\n  errorCode: string;\r\n}\r\n\r\nexport class CapabilityError extends Error {\r\n  readonly status?: number;\r\n  readonly errorCode: string;\r\n  readonly retryable = false;\r\n\r\n  constructor(message: string, info: CapabilityErrorInfo) {\r\n    super(message);\r\n    this.name = 'CapabilityError';\r\n    this.status = info.status;\r\n    this.errorCode = info.errorCode;\r\n  }\r\n}\r\n\r\nconst contracts: Record<CapabilityCode, string[]> = {\r\n  'namespace.v2': ['openapi/v2'],\r\n  'source.v1': ['openapi/v1'],\r\n  'stream.v2': ['tier0-stream/v2'],\r\n  'control.v1': ['openapi/v1', 'control/v1'],\r\n  'control.invoke.v1': ['openapi/v1', 'tier0-stream/v2', 'control/v1'],\r\n};\r\n\r\nfunction record(value: unknown): value is Record<string, unknown> {\r\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\r\n}\r\nfunction text(value: unknown): value is string {\r\n  return typeof value === 'string' && value.length > 0;\r\n}\r\nfunction strings(value: unknown): value is string[] {\r\n  return Array.isArray(value) && value.every(text) && new Set(value).size === value.length;\r\n}\r\n\r\n/** Validate and explicitly project the frozen contract; unknown capabilities/extension fields are ignored. */\r\nfunction discovery(value: unknown, status: number): CapabilityDiscoverResponse {\r\n  const fail = (version = false): never => {\r\n    throw new CapabilityError(version ? 'Unsupported capability contract version.' : 'Invalid capability discovery response.', {\r\n      status, errorCode: version ? 'CAPABILITY_UNSUPPORTED_VERSION' : 'CAPABILITY_PROTOCOL_ERROR',\r\n    });\r\n  };\r\n  if (!record(value)) return fail();\r\n  if (!text(value.product) || !text(value.contractVersion) ||\r\n      !strings(value.apiContractVersions) || !strings(value.interpreterContractVersions) || !strings(value.sdkContractVersions) ||\r\n      !Array.isArray(value.capabilities) || !Array.isArray(value.deprecations) ||\r\n      (value.productVersion !== undefined && !text(value.productVersion))) return fail();\r\n  if (value.product !== 'cloud' || value.contractVersion !== '1.0' ||\r\n      !value.apiContractVersions.includes('openapi/v1') ||\r\n      !value.interpreterContractVersions.includes('tier0-stream/v2') ||\r\n      !value.sdkContractVersions.includes('control/v1')) return fail(true);\r\n\r\n  const capabilities: PublicCapability[] = [];\r\n  const seen = new Set<string>();\r\n  for (const item of value.capabilities) {\r\n    if (!record(item) || !text(item.code)) return fail();\r\n    if (!Object.prototype.hasOwnProperty.call(contracts, item.code)) continue;\r\n    const code = item.code as CapabilityCode;\r\n    if (seen.has(code)) return fail();\r\n    seen.add(code);\r\n    if (typeof item.releaseEnabled !== 'boolean' || typeof item.enabled !== 'boolean' || typeof item.allowed !== 'boolean' ||\r\n        !['disabled', 'not_supported', 'unavailable', 'readiness_unknown', 'ready'].includes(item.state as string) ||\r\n        !['unavailable', 'unknown', 'available'].includes(item.availability as string) || !strings(item.contractVersions)) return fail();\r\n    if (contracts[code].some(version =>\r\n      !(item.contractVersions as string[]).includes(version) ||\r\n      (version.startsWith('openapi/') && !(value.apiContractVersions as string[]).includes(version)))) return fail(true);\r\n    const ready = item.state === 'ready';\r\n    const expectedAvailability = ready ? 'available' : item.state === 'readiness_unknown' ? 'unknown' : 'unavailable';\r\n    if (item.enabled !== ready || item.availability !== expectedAvailability ||\r\n        (ready && (!item.releaseEnabled || !item.allowed)) ||\r\n        (item.state === 'disabled' ? item.releaseEnabled : !item.releaseEnabled)) return fail();\r\n    capabilities.push({\r\n      code, releaseEnabled: item.releaseEnabled, enabled: item.enabled, allowed: item.allowed,\r\n      state: item.state as CapabilityState, availability: item.availability as CapabilityAvailability,\r\n      contractVersions: [...item.contractVersions],\r\n    });\r\n  }\r\n  const deprecations: CapabilityDeprecation[] = [];\r\n  for (const item of value.deprecations) {\r\n    if (!record(item) || !text(item.contract) ||\r\n        (item.replacement !== undefined && !text(item.replacement)) ||\r\n        (item.sunsetAt !== undefined && !text(item.sunsetAt))) return fail();\r\n    deprecations.push({ contract: item.contract,\r\n      ...(item.replacement === undefined ? {} : { replacement: item.replacement as string }),\r\n      ...(item.sunsetAt === undefined ? {} : { sunsetAt: item.sunsetAt as string }),\r\n    });\r\n  }\r\n  return {\r\n    product: 'cloud', ...(value.productVersion === undefined ? {} : { productVersion: value.productVersion as string }),\r\n    contractVersion: '1.0', apiContractVersions: [...value.apiContractVersions],\r\n    interpreterContractVersions: [...value.interpreterContractVersions], sdkContractVersions: [...value.sdkContractVersions],\r\n    capabilities, deprecations,\r\n  };\r\n}\r\n\r\nexport class CapabilitiesClient {\r\n  private readonly transport: CloudTransport;\r\n\r\n  constructor(resolveClient: () => HttpClient = getClient, config: CloudTransportConfig = {}) {\r\n    this.transport = new CloudTransport(resolveClient, config);\r\n  }\r\n\r\n  /** Workspace comes exclusively from the authenticated key. One POST, no automatic retries or caching. */\r\n  async discover(): Promise<CapabilityDiscoverResponse> {\r\n    if (arguments.length !== 0) throw new TypeError('Tier0 SDK: capability discovery accepts no arguments.');\r\n    let response: Awaited<ReturnType<CloudTransport['post']>>;\r\n    try {\r\n      response = await this.transport.post('/openapi/v1/capabilities/discover', {});\r\n    } catch (error) {\r\n      if (!(error instanceof CloudTransportError)) throw error;\r\n      throw new CapabilityError('Capability discovery HTTP exchange failed.', {\r\n        status: error.status, errorCode: `CAPABILITY_${error.kind}`,\r\n      });\r\n    }\r\n    const { value, status, ok } = response;\r\n    if (!ok) {\r\n      if (!record(value) || !text(value.errorCode) || typeof value.message !== 'string') {\r\n        throw new CapabilityError('Invalid capability error response.', { status, errorCode: 'CAPABILITY_PROTOCOL_ERROR' });\r\n      }\r\n      throw new CapabilityError(value.message, { status, errorCode: value.errorCode });\r\n    }\r\n    return discovery(value, status);\r\n  }\r\n}\r\n\r\n/** Uses configureClient()/runtime environment, resolving the host and workspace key on every call. */\r\nexport const capabilities = new CapabilitiesClient();\r\n"]}
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAA6B,MAAM,sBAAsB,CAAC;AACtG,OAAO,EAAE,SAAS,EAAmB,MAAM,qBAAqB,CAAC;AA6CjE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,MAAM,CAAU;IAChB,SAAS,CAAS;IAClB,SAAS,GAAG,KAAK,CAAC;IAE3B,YAAY,OAAe,EAAE,IAAyB;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;CACF;AAED,MAAM,SAAS,GAAqC;IAClD,cAAc,EAAE,CAAC,YAAY,CAAC;IAC9B,WAAW,EAAE,CAAC,YAAY,CAAC;IAC3B,WAAW,EAAE,CAAC,iBAAiB,CAAC;IAChC,YAAY,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IAC1C,mBAAmB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,YAAY,CAAC;CACrE,CAAC;AAEF,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AACD,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;AAC3F,CAAC;AAED,8GAA8G;AAC9G,SAAS,SAAS,CAAC,KAAc,EAAE,MAAc;IAC/C,MAAM,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,EAAS,EAAE;QACtC,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,wCAAwC,EAAE;YACzH,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,2BAA2B;SAC5F,CAAC,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QACpD,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;QACzH,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;QACxE,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACvF,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK;QAC5D,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjD,CAAC,KAAK,CAAC,2BAA2B,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC9D,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzE,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAsB,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;YAClH,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAe,CAAC;YAC1G,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACjC,CAAE,IAAI,CAAC,gBAA6B,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtD,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAE,KAAK,CAAC,mBAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;QACrH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC;QACrC,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QAClH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB;YACpE,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5F,YAAY,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;YACvF,KAAK,EAAE,IAAI,CAAC,KAAwB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAsC;YAC/F,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrC,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC3D,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzE,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACzC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAqB,EAAE,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAkB,EAAE,CAAC;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAwB,EAAE,CAAC;QACnH,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QAC3E,2BAA2B,EAAE,CAAC,GAAG,KAAK,CAAC,2BAA2B,CAAC,EAAE,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACxH,YAAY,EAAE,YAAY;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,kBAAkB;IACZ,SAAS,CAAiB;IAE3C,YAAY,gBAAkC,SAAS,EAAE,SAA+B,EAAE;QACxF,IAAI,CAAC,SAAS,GAAG,IAAI,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,yGAAyG;IACzG,KAAK,CAAC,QAAQ;QACZ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;QACzG,IAAI,QAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzD,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE;gBACtE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,KAAK,CAAC,IAAI,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAClF,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;CACF;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC","sourcesContent":["import { CloudTransport, CloudTransportError, type CloudTransportConfig } from './cloud-transport.js';\nimport { getClient, type HttpClient } from './openapi/client.js';\n\nexport type CapabilityCode = 'namespace.v2' | 'source.v1' | 'stream.v2' | 'control.v1' | 'control.invoke.v1';\nexport type CapabilityState = 'disabled' | 'not_supported' | 'unavailable' | 'readiness_unknown' | 'ready';\nexport type CapabilityAvailability = 'unavailable' | 'unknown' | 'available';\n\nexport interface PublicCapability {\n  code: CapabilityCode;\n  /** Public release and workspace gates; does not establish runtime readiness. */\n  releaseEnabled: boolean;\n  /** Server-assessed implementation/readiness, never inferred from releaseEnabled. */\n  enabled: boolean;\n  /** Authorization summary, not a grant for every individual Control code. */\n  allowed: boolean;\n  state: CapabilityState;\n  /** Not device online status or execution/ACK confirmation. */\n  availability: CapabilityAvailability;\n  contractVersions: string[];\n}\n\nexport interface CapabilityDeprecation {\n  contract: string;\n  replacement?: string;\n  sunsetAt?: string;\n}\n\nexport interface CapabilityDiscoverResponse {\n  product: 'cloud';\n  /** Trusted server configuration only; absent when unconfigured. */\n  productVersion?: string;\n  contractVersion: '1.0';\n  apiContractVersions: string[];\n  interpreterContractVersions: string[];\n  /** Public SDK contract labels, not npm package versions. */\n  sdkContractVersions: string[];\n  capabilities: PublicCapability[];\n  deprecations: CapabilityDeprecation[];\n}\n\nexport interface CapabilityErrorInfo {\n  status?: number;\n  /** Gateway string code (including unknown future codes), or an SDK-local CAPABILITY_* code. */\n  errorCode: string;\n}\n\nexport class CapabilityError extends Error {\n  readonly status?: number;\n  readonly errorCode: string;\n  readonly retryable = false;\n\n  constructor(message: string, info: CapabilityErrorInfo) {\n    super(message);\n    this.name = 'CapabilityError';\n    this.status = info.status;\n    this.errorCode = info.errorCode;\n  }\n}\n\nconst contracts: Record<CapabilityCode, string[]> = {\n  'namespace.v2': ['openapi/v2'],\n  'source.v1': ['openapi/v1'],\n  'stream.v2': ['tier0-stream/v2'],\n  'control.v1': ['openapi/v1', 'control/v1'],\n  'control.invoke.v1': ['openapi/v1', 'tier0-stream/v2', 'control/v1'],\n};\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\nfunction text(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\nfunction strings(value: unknown): value is string[] {\n  return Array.isArray(value) && value.every(text) && new Set(value).size === value.length;\n}\n\n/** Validate and explicitly project the frozen contract; unknown capabilities/extension fields are ignored. */\nfunction discovery(value: unknown, status: number): CapabilityDiscoverResponse {\n  const fail = (version = false): never => {\n    throw new CapabilityError(version ? 'Unsupported capability contract version.' : 'Invalid capability discovery response.', {\n      status, errorCode: version ? 'CAPABILITY_UNSUPPORTED_VERSION' : 'CAPABILITY_PROTOCOL_ERROR',\n    });\n  };\n  if (!record(value)) return fail();\n  if (!text(value.product) || !text(value.contractVersion) ||\n      !strings(value.apiContractVersions) || !strings(value.interpreterContractVersions) || !strings(value.sdkContractVersions) ||\n      !Array.isArray(value.capabilities) || !Array.isArray(value.deprecations) ||\n      (value.productVersion !== undefined && !text(value.productVersion))) return fail();\n  if (value.product !== 'cloud' || value.contractVersion !== '1.0' ||\n      !value.apiContractVersions.includes('openapi/v1') ||\n      !value.interpreterContractVersions.includes('tier0-stream/v2') ||\n      !value.sdkContractVersions.includes('control/v1')) return fail(true);\n\n  const capabilities: PublicCapability[] = [];\n  const seen = new Set<string>();\n  for (const item of value.capabilities) {\n    if (!record(item) || !text(item.code)) return fail();\n    if (!Object.prototype.hasOwnProperty.call(contracts, item.code)) continue;\n    const code = item.code as CapabilityCode;\n    if (seen.has(code)) return fail();\n    seen.add(code);\n    if (typeof item.releaseEnabled !== 'boolean' || typeof item.enabled !== 'boolean' || typeof item.allowed !== 'boolean' ||\n        !['disabled', 'not_supported', 'unavailable', 'readiness_unknown', 'ready'].includes(item.state as string) ||\n        !['unavailable', 'unknown', 'available'].includes(item.availability as string) || !strings(item.contractVersions)) return fail();\n    if (contracts[code].some(version =>\n      !(item.contractVersions as string[]).includes(version) ||\n      (version.startsWith('openapi/') && !(value.apiContractVersions as string[]).includes(version)))) return fail(true);\n    const ready = item.state === 'ready';\n    const expectedAvailability = ready ? 'available' : item.state === 'readiness_unknown' ? 'unknown' : 'unavailable';\n    if (item.enabled !== ready || item.availability !== expectedAvailability ||\n        (ready && (!item.releaseEnabled || !item.allowed)) ||\n        (item.state === 'disabled' ? item.releaseEnabled : !item.releaseEnabled)) return fail();\n    capabilities.push({\n      code, releaseEnabled: item.releaseEnabled, enabled: item.enabled, allowed: item.allowed,\n      state: item.state as CapabilityState, availability: item.availability as CapabilityAvailability,\n      contractVersions: [...item.contractVersions],\n    });\n  }\n  const deprecations: CapabilityDeprecation[] = [];\n  for (const item of value.deprecations) {\n    if (!record(item) || !text(item.contract) ||\n        (item.replacement !== undefined && !text(item.replacement)) ||\n        (item.sunsetAt !== undefined && !text(item.sunsetAt))) return fail();\n    deprecations.push({ contract: item.contract,\n      ...(item.replacement === undefined ? {} : { replacement: item.replacement as string }),\n      ...(item.sunsetAt === undefined ? {} : { sunsetAt: item.sunsetAt as string }),\n    });\n  }\n  return {\n    product: 'cloud', ...(value.productVersion === undefined ? {} : { productVersion: value.productVersion as string }),\n    contractVersion: '1.0', apiContractVersions: [...value.apiContractVersions],\n    interpreterContractVersions: [...value.interpreterContractVersions], sdkContractVersions: [...value.sdkContractVersions],\n    capabilities, deprecations,\n  };\n}\n\nexport class CapabilitiesClient {\n  private readonly transport: CloudTransport;\n\n  constructor(resolveClient: () => HttpClient = getClient, config: CloudTransportConfig = {}) {\n    this.transport = new CloudTransport(resolveClient, config);\n  }\n\n  /** Workspace comes exclusively from the authenticated key. One POST, no automatic retries or caching. */\n  async discover(): Promise<CapabilityDiscoverResponse> {\n    if (arguments.length !== 0) throw new TypeError('Tier0 SDK: capability discovery accepts no arguments.');\n    let response: Awaited<ReturnType<CloudTransport['post']>>;\n    try {\n      response = await this.transport.post('/openapi/v1/capabilities/discover', {});\n    } catch (error) {\n      if (!(error instanceof CloudTransportError)) throw error;\n      throw new CapabilityError('Capability discovery HTTP exchange failed.', {\n        status: error.status, errorCode: `CAPABILITY_${error.kind}`,\n      });\n    }\n    const { value, status, ok } = response;\n    if (!ok) {\n      if (!record(value) || !text(value.errorCode) || typeof value.message !== 'string') {\n        throw new CapabilityError('Invalid capability error response.', { status, errorCode: 'CAPABILITY_PROTOCOL_ERROR' });\n      }\n      throw new CapabilityError(value.message, { status, errorCode: value.errorCode });\n    }\n    return discovery(value, status);\n  }\n}\n\n/** Uses configureClient()/runtime environment, resolving the host and workspace key on every call. */\nexport const capabilities = new CapabilitiesClient();\n"]}

package/dist/esm/cloud-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-server.js","sourceRoot":"","sources":["../../src/cloud-server.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,6BAA6B,IAAI,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAEjG,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC,MAAM,CAAC;AAE3D,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACpB;IAA5B,YAA4B,IAAmE;QAC7F,KAAK,CAAC,IAAI,CAAC,CAAC;QADc,SAAI,GAAJ,IAAI,CAA+D;QAE7F,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AA6BD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;AAC1E,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;AAC9F,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACrD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACrD,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AACzD,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAC5C,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAClD,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AACvF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChE,MAAM,SAAS,GAAG,CAAC,KAA8B,EAAE,IAAuB,EAAE,EAAE,CAC5E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACrG,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,QAAgB,EAAmB,EAAE,CACxE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ;IACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/F,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;IAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,OAAO,EAAE,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,6BAA6B,CAAC,SAAoC;IAChF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;QAAE,MAAM,aAAa,EAAE,CAAC;IAC/J,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,OAAO;gBAAE,MAAM,aAAa,EAAE,CAAC;YAC9F,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,OAAO;YAAE,MAAM,aAAa,EAAE,CAAC;QACvF,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;gBAChF,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBACjF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,aAAa,EAAE,CAAC;YACzG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,aAAa,EAAE,CAAC;IAAC,CAAC;IAElC,OAAO,CAAC,OAAgC,EAAwB,EAAE;QAChE,IAAI,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,aAAa;gBACtG,CAAC,CAAC,OAAO,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,YAAY;gBACxF,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC;gBAC7F,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YAChG,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACxC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;gBACtE,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI;gBACjE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACpF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;gBAC/B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACpG,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC;gBAChE,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ;gBACrG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;gBACpF,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;gBAC5E,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBAClF,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7E,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC;gBACtF,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG;gBAC/F,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,aAAa;gBAChD,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACpE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,QAAQ;gBACvE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;gBAC9F,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,OAAO,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,QAAQ,CAAC,gBAAgB,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,gBAAgB;gBAAE,MAAM,OAAO,EAAE,CAAC;YACnH,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,IAAI,EAAE,cAAuB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK;gBACrE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAa,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG;gBAC7E,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,GAAG;aAC3E,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,OAAO,EAAE,CAAC;QAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// Server-only entry point. Browser HTTP clients remain independent of node:crypto.\r\nimport { createHash, createPublicKey, verify, type KeyObject } from 'node:crypto';\r\nimport { APP_REQUEST_IDENTITY_CONTRACT as contract } from './app-identity-contract.generated.js';\r\n\r\nexport const APP_REQUEST_IDENTITY_HEADER = contract.header;\r\n\r\nexport class AppRequestIdentityError extends Error {\r\n  constructor(public readonly code: 'APP_IDENTITY_INVALID' | 'APP_IDENTITY_CONFIGURATION_INVALID') {\r\n    super(code);\r\n    this.name = 'AppRequestIdentityError';\r\n  }\r\n}\r\n\r\nexport interface VerifiedCloudAppUser {\r\n  readonly kind: 'gateway-user';\r\n  readonly userID: string;\r\n  readonly workspaceID: string;\r\n  readonly appID: string;\r\n  readonly roleKeys: readonly string[];\r\n  readonly requestID: string;\r\n  readonly issuedAt: number;\r\n  readonly expiresAt: number;\r\n  readonly verificationKeyID: string;\r\n}\r\n\r\nexport interface CloudAppIdentityAuthority {\r\n  appID: string;\r\n  workspaceID: string;\r\n  /** Pinned server configuration, never a key or URL taken from the request. */\r\n  publicKeys: unknown;\r\n}\r\n\r\nexport interface CloudAppIdentityRequest {\r\n  assertion: string | undefined;\r\n  method: string;\r\n  requestURI: string;\r\n  /** Exact bytes received from the gateway, before JSON parsing or normalization. */\r\n  body: Uint8Array;\r\n}\r\n\r\nconst invalid = () => new AppRequestIdentityError('APP_IDENTITY_INVALID');\r\nconst invalidConfig = () => new AppRequestIdentityError('APP_IDENTITY_CONFIGURATION_INVALID');\r\nconst appPattern = new RegExp(contract.appIDPattern);\r\nconst kidPattern = new RegExp(contract.keyIDPattern);\r\nconst methodPattern = new RegExp(contract.methodPattern);\r\nconst maxID = BigInt('9223372036854775807');\r\nconst validID = (value: unknown): value is string =>\r\n  typeof value === 'string' && /^[1-9]\\d{0,18}$/.test(value) && BigInt(value) <= maxID;\r\nconst isObject = (value: unknown): value is Record<string, unknown> =>\r\n  !!value && typeof value === 'object' && !Array.isArray(value);\r\nconst exactKeys = (value: Record<string, unknown>, keys: readonly string[]) =>\r\n  Object.keys(value).length === keys.length && Object.keys(value).every((key) => keys.includes(key));\r\nconst validString = (value: unknown, maxBytes: number): value is string =>\r\n  typeof value === 'string' && value.length > 0 && Buffer.byteLength(value) <= maxBytes &&\r\n  Buffer.from(value).toString('utf8') === value && !/[\\u0000-\\u001f\\u007f-\\u009f]/.test(value);\r\nconst decode = (value: string) => {\r\n  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw invalid();\r\n  const bytes = Buffer.from(value, 'base64url');\r\n  if (bytes.toString('base64url') !== value) throw invalid();\r\n  return bytes;\r\n};\r\n\r\n/** Verifies request provenance, not business authorization or delegated UNS permissions. */\r\nexport function createCloudAppRequestVerifier(authority: CloudAppIdentityAuthority) {\r\n  if (!isObject(authority) || typeof authority.appID !== 'string' || !appPattern.test(authority.appID) || !validID(authority.workspaceID)) throw invalidConfig();\r\n  const appID = authority.appID;\r\n  const workspaceID = authority.workspaceID;\r\n  const keys = new Map<string, KeyObject>();\r\n  try {\r\n    let raw = authority.publicKeys;\r\n    if (typeof raw === 'string') {\r\n      if (Buffer.byteLength(raw) > contract.maxTokenBytes * contract.maxKeys) throw invalidConfig();\r\n      raw = JSON.parse(raw);\r\n    }\r\n    if (!isObject(raw) || !exactKeys(raw, ['keys']) || !Array.isArray(raw.keys) ||\r\n        raw.keys.length === 0 || raw.keys.length > contract.maxKeys) throw invalidConfig();\r\n    for (const key of raw.keys) {\r\n      if (!isObject(key) || !exactKeys(key, contract.publicKeyFields) || key.kty !== 'OKP' ||\r\n          key.crv !== 'Ed25519' || typeof key.kid !== 'string' || !kidPattern.test(key.kid) ||\r\n          keys.has(key.kid) || typeof key.x !== 'string' || decode(key.x).length !== 32) throw invalidConfig();\r\n      keys.set(key.kid, createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: key.x }, format: 'jwk' }));\r\n    }\r\n  } catch { throw invalidConfig(); }\r\n\r\n  return (request: CloudAppIdentityRequest): VerifiedCloudAppUser => {\r\n    try {\r\n      if (typeof request.assertion !== 'string' || Buffer.byteLength(request.assertion) > contract.maxTokenBytes ||\r\n          !(request.body instanceof Uint8Array) || request.body.byteLength > contract.maxBodyBytes ||\r\n          !methodPattern.test(request.method) || !validString(request.requestURI, contract.maxURIBytes) ||\r\n          !request.requestURI.startsWith('/') || request.requestURI.startsWith('//')) throw invalid();\r\n      const parts = request.assertion.split('.');\r\n      if (parts.length !== 3) throw invalid();\r\n      const header: unknown = JSON.parse(decode(parts[0]).toString('utf8'));\r\n      if (!isObject(header) || !exactKeys(header, contract.requiredHeaderFields) ||\r\n          header.alg !== contract.algorithm || header.typ !== contract.type ||\r\n          typeof header.kid !== 'string' || !kidPattern.test(header.kid)) throw invalid();\r\n      const key = keys.get(header.kid);\r\n      const signature = decode(parts[2]);\r\n      if (!key || signature.length !== 64 ||\r\n          !verify(null, Buffer.from(parts[0] + '.' + parts[1], 'ascii'), key, signature)) throw invalid();\r\n      const claims: unknown = JSON.parse(decode(parts[1]).toString('utf8'));\r\n      if (!isObject(claims) || !exactKeys(claims, contract.requiredClaims) ||\r\n          claims.ver !== contract.version || claims.iss !== contract.issuer || claims.aud !== contract.audience ||\r\n          !validID(claims.sub) || claims.workspaceID !== workspaceID || claims.appID !== appID ||\r\n          claims.method !== request.method || claims.requestURI !== request.requestURI ||\r\n          typeof claims.bodySHA256 !== 'string' || !/^[a-f0-9]{64}$/.test(claims.bodySHA256) ||\r\n          claims.bodySHA256 !== createHash('sha256').update(request.body).digest('hex') ||\r\n          typeof claims.iat !== 'number' || !Number.isSafeInteger(claims.iat) || claims.iat <= 0 ||\r\n          typeof claims.exp !== 'number' || !Number.isSafeInteger(claims.exp) || claims.exp <= claims.iat ||\r\n          claims.exp - claims.iat > contract.maxTTLSeconds ||\r\n          typeof claims.jti !== 'string' || !/^[a-f0-9]{32}$/.test(claims.jti) ||\r\n          !Array.isArray(claims.roles) || claims.roles.length > contract.maxRoles ||\r\n          claims.roles.some((role) => !validString(role, contract.maxRoleBytes) || role.trim() !== role) ||\r\n          new Set(claims.roles).size !== claims.roles.length) throw invalid();\r\n      const now = Math.floor(Date.now() / 1000);\r\n      if (claims.iat > now + contract.clockSkewSeconds || now >= claims.exp + contract.clockSkewSeconds) throw invalid();\r\n      return Object.freeze({\r\n        kind: 'gateway-user' as const, userID: claims.sub, workspaceID, appID,\r\n        roleKeys: Object.freeze([...claims.roles] as string[]), requestID: claims.jti,\r\n        issuedAt: claims.iat, expiresAt: claims.exp, verificationKeyID: header.kid,\r\n      });\r\n    } catch { throw invalid(); }\r\n  };\r\n}\r\n"]}
+{"version":3,"file":"cloud-server.js","sourceRoot":"","sources":["../../src/cloud-server.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,6BAA6B,IAAI,QAAQ,EAAE,MAAM,sCAAsC,CAAC;AAEjG,MAAM,CAAC,MAAM,2BAA2B,GAAG,QAAQ,CAAC,MAAM,CAAC;AAE3D,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACpB;IAA5B,YAA4B,IAAmE;QAC7F,KAAK,CAAC,IAAI,CAAC,CAAC;QADc,SAAI,GAAJ,IAAI,CAA+D;QAE7F,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AA6BD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;AAC1E,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,IAAI,uBAAuB,CAAC,oCAAoC,CAAC,CAAC;AAC9F,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACrD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACrD,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;AACzD,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAC5C,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAClD,OAAO,KAAK,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AACvF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CACpE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChE,MAAM,SAAS,GAAG,CAAC,KAA8B,EAAE,IAAuB,EAAE,EAAE,CAC5E,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACrG,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,QAAgB,EAAmB,EAAE,CACxE,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,QAAQ;IACrF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/F,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;IAC/B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK;QAAE,MAAM,OAAO,EAAE,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,UAAU,6BAA6B,CAAC,SAAoC;IAChF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;QAAE,MAAM,aAAa,EAAE,CAAC;IAC/J,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,SAAS,CAAC,UAAU,CAAC;QAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,OAAO;gBAAE,MAAM,aAAa,EAAE,CAAC;YAC9F,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,OAAO;YAAE,MAAM,aAAa,EAAE,CAAC;QACvF,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK;gBAChF,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBACjF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,aAAa,EAAE,CAAC;YACzG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,aAAa,EAAE,CAAC;IAAC,CAAC;IAElC,OAAO,CAAC,OAAgC,EAAwB,EAAE;QAChE,IAAI,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,aAAa;gBACtG,CAAC,CAAC,OAAO,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,GAAG,QAAQ,CAAC,YAAY;gBACxF,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,WAAW,CAAC;gBAC7F,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YAChG,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACxC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;gBACtE,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI;gBACjE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACpF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;gBAC/B,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC;gBAAE,MAAM,OAAO,EAAE,CAAC;YACpG,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC;gBAChE,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ;gBACrG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;gBACpF,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;gBAC5E,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBAClF,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7E,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC;gBACtF,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG;gBAC/F,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,aAAa;gBAChD,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACpE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,QAAQ;gBACvE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC;gBAC9F,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,OAAO,EAAE,CAAC;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,QAAQ,CAAC,gBAAgB,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,gBAAgB;gBAAE,MAAM,OAAO,EAAE,CAAC;YACnH,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,IAAI,EAAE,cAAuB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK;gBACrE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAa,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG;gBAC7E,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,GAAG;aAC3E,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,OAAO,EAAE,CAAC;QAAC,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC","sourcesContent":["// Server-only entry point. Browser HTTP clients remain independent of node:crypto.\nimport { createHash, createPublicKey, verify, type KeyObject } from 'node:crypto';\nimport { APP_REQUEST_IDENTITY_CONTRACT as contract } from './app-identity-contract.generated.js';\n\nexport const APP_REQUEST_IDENTITY_HEADER = contract.header;\n\nexport class AppRequestIdentityError extends Error {\n  constructor(public readonly code: 'APP_IDENTITY_INVALID' | 'APP_IDENTITY_CONFIGURATION_INVALID') {\n    super(code);\n    this.name = 'AppRequestIdentityError';\n  }\n}\n\nexport interface VerifiedCloudAppUser {\n  readonly kind: 'gateway-user';\n  readonly userID: string;\n  readonly workspaceID: string;\n  readonly appID: string;\n  readonly roleKeys: readonly string[];\n  readonly requestID: string;\n  readonly issuedAt: number;\n  readonly expiresAt: number;\n  readonly verificationKeyID: string;\n}\n\nexport interface CloudAppIdentityAuthority {\n  appID: string;\n  workspaceID: string;\n  /** Pinned server configuration, never a key or URL taken from the request. */\n  publicKeys: unknown;\n}\n\nexport interface CloudAppIdentityRequest {\n  assertion: string | undefined;\n  method: string;\n  requestURI: string;\n  /** Exact bytes received from the gateway, before JSON parsing or normalization. */\n  body: Uint8Array;\n}\n\nconst invalid = () => new AppRequestIdentityError('APP_IDENTITY_INVALID');\nconst invalidConfig = () => new AppRequestIdentityError('APP_IDENTITY_CONFIGURATION_INVALID');\nconst appPattern = new RegExp(contract.appIDPattern);\nconst kidPattern = new RegExp(contract.keyIDPattern);\nconst methodPattern = new RegExp(contract.methodPattern);\nconst maxID = BigInt('9223372036854775807');\nconst validID = (value: unknown): value is string =>\n  typeof value === 'string' && /^[1-9]\\d{0,18}$/.test(value) && BigInt(value) <= maxID;\nconst isObject = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === 'object' && !Array.isArray(value);\nconst exactKeys = (value: Record<string, unknown>, keys: readonly string[]) =>\n  Object.keys(value).length === keys.length && Object.keys(value).every((key) => keys.includes(key));\nconst validString = (value: unknown, maxBytes: number): value is string =>\n  typeof value === 'string' && value.length > 0 && Buffer.byteLength(value) <= maxBytes &&\n  Buffer.from(value).toString('utf8') === value && !/[\\u0000-\\u001f\\u007f-\\u009f]/.test(value);\nconst decode = (value: string) => {\n  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw invalid();\n  const bytes = Buffer.from(value, 'base64url');\n  if (bytes.toString('base64url') !== value) throw invalid();\n  return bytes;\n};\n\n/** Verifies request provenance, not business authorization or delegated UNS permissions. */\nexport function createCloudAppRequestVerifier(authority: CloudAppIdentityAuthority) {\n  if (!isObject(authority) || typeof authority.appID !== 'string' || !appPattern.test(authority.appID) || !validID(authority.workspaceID)) throw invalidConfig();\n  const appID = authority.appID;\n  const workspaceID = authority.workspaceID;\n  const keys = new Map<string, KeyObject>();\n  try {\n    let raw = authority.publicKeys;\n    if (typeof raw === 'string') {\n      if (Buffer.byteLength(raw) > contract.maxTokenBytes * contract.maxKeys) throw invalidConfig();\n      raw = JSON.parse(raw);\n    }\n    if (!isObject(raw) || !exactKeys(raw, ['keys']) || !Array.isArray(raw.keys) ||\n        raw.keys.length === 0 || raw.keys.length > contract.maxKeys) throw invalidConfig();\n    for (const key of raw.keys) {\n      if (!isObject(key) || !exactKeys(key, contract.publicKeyFields) || key.kty !== 'OKP' ||\n          key.crv !== 'Ed25519' || typeof key.kid !== 'string' || !kidPattern.test(key.kid) ||\n          keys.has(key.kid) || typeof key.x !== 'string' || decode(key.x).length !== 32) throw invalidConfig();\n      keys.set(key.kid, createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: key.x }, format: 'jwk' }));\n    }\n  } catch { throw invalidConfig(); }\n\n  return (request: CloudAppIdentityRequest): VerifiedCloudAppUser => {\n    try {\n      if (typeof request.assertion !== 'string' || Buffer.byteLength(request.assertion) > contract.maxTokenBytes ||\n          !(request.body instanceof Uint8Array) || request.body.byteLength > contract.maxBodyBytes ||\n          !methodPattern.test(request.method) || !validString(request.requestURI, contract.maxURIBytes) ||\n          !request.requestURI.startsWith('/') || request.requestURI.startsWith('//')) throw invalid();\n      const parts = request.assertion.split('.');\n      if (parts.length !== 3) throw invalid();\n      const header: unknown = JSON.parse(decode(parts[0]).toString('utf8'));\n      if (!isObject(header) || !exactKeys(header, contract.requiredHeaderFields) ||\n          header.alg !== contract.algorithm || header.typ !== contract.type ||\n          typeof header.kid !== 'string' || !kidPattern.test(header.kid)) throw invalid();\n      const key = keys.get(header.kid);\n      const signature = decode(parts[2]);\n      if (!key || signature.length !== 64 ||\n          !verify(null, Buffer.from(parts[0] + '.' + parts[1], 'ascii'), key, signature)) throw invalid();\n      const claims: unknown = JSON.parse(decode(parts[1]).toString('utf8'));\n      if (!isObject(claims) || !exactKeys(claims, contract.requiredClaims) ||\n          claims.ver !== contract.version || claims.iss !== contract.issuer || claims.aud !== contract.audience ||\n          !validID(claims.sub) || claims.workspaceID !== workspaceID || claims.appID !== appID ||\n          claims.method !== request.method || claims.requestURI !== request.requestURI ||\n          typeof claims.bodySHA256 !== 'string' || !/^[a-f0-9]{64}$/.test(claims.bodySHA256) ||\n          claims.bodySHA256 !== createHash('sha256').update(request.body).digest('hex') ||\n          typeof claims.iat !== 'number' || !Number.isSafeInteger(claims.iat) || claims.iat <= 0 ||\n          typeof claims.exp !== 'number' || !Number.isSafeInteger(claims.exp) || claims.exp <= claims.iat ||\n          claims.exp - claims.iat > contract.maxTTLSeconds ||\n          typeof claims.jti !== 'string' || !/^[a-f0-9]{32}$/.test(claims.jti) ||\n          !Array.isArray(claims.roles) || claims.roles.length > contract.maxRoles ||\n          claims.roles.some((role) => !validString(role, contract.maxRoleBytes) || role.trim() !== role) ||\n          new Set(claims.roles).size !== claims.roles.length) throw invalid();\n      const now = Math.floor(Date.now() / 1000);\n      if (claims.iat > now + contract.clockSkewSeconds || now >= claims.exp + contract.clockSkewSeconds) throw invalid();\n      return Object.freeze({\n        kind: 'gateway-user' as const, userID: claims.sub, workspaceID, appID,\n        roleKeys: Object.freeze([...claims.roles] as string[]), requestID: claims.jti,\n        issuedAt: claims.iat, expiresAt: claims.exp, verificationKeyID: header.kid,\n      });\n    } catch { throw invalid(); }\n  };\n}\n"]}

package/dist/esm/cloud-transport.d.ts

@@ -32,10 +32,31 @@ export declare class CloudTransport {
     private readonly timeoutMs;
     private readonly unsV2MaxResponseBytes;
     constructor(resolveClient?: () => HttpClient, config?: CloudTransportConfig);
+    /** `retryAfter`: the raw `Retry-After` header, for answers without a UNS error body. */
     postText(path: string, body: string, options?: RequestOptions): Promise<{
         text: string;
         status: number;
         ok: boolean;
+        retryAfter?: string;
+    }>;
+    /**
+     * Opens a server-sent event stream (GET, `Accept: text/event-stream`
+     * exactly, as the gateway requires). The deadline covers the response
+     * headers, and a non-stream body; a response that is not an event stream
+     * is read whole (bounded like any UNS v2 response) and returned as `text`.
+     * An open stream belongs to the caller: `close()` ends it and drops the
+     * link to `signal`, which also ends it.
+     */
+    getEventStream(path: string, options?: {
+        lastEventId?: string;
+        signal?: AbortSignal;
+    }): Promise<{
+        status: number;
+        stream: ReadableStream<Uint8Array>;
+        close(): void;
+    } | {
+        status: number;
+        text: string;
     }>;
     post(path: string, body: unknown): Promise<{
         value: unknown;

package/dist/esm/cloud-transport.js

@@ -41,6 +41,7 @@ export class CloudTransport {
         }
         this.#unsV2AppDataSubject = subject;
     }
+    /** `retryAfter`: the raw `Retry-After` header, for answers without a UNS error body. */
     async postText(path, body, options = {}) {
         options.signal?.throwIfAborted();
         const client = this.resolveClient();
@@ -112,7 +113,8 @@ export class CloudTransport {
                 reader.releaseLock();
                 reader = undefined;
             }
-            return { text: chunks.join(''), status: response.status, ok: response.ok };
+            const retryAfter = response.headers.get('retry-after') ?? undefined;
+            return { text: chunks.join(''), status: response.status, ok: response.ok, ...(retryAfter === undefined ? {} : { retryAfter }) };
         };
         try {
             const deadline = new Promise((_resolve, reject) => {
@@ -135,6 +137,84 @@ export class CloudTransport {
             options.signal?.removeEventListener('abort', onAbort);
         }
     }
+    /**
+     * Opens a server-sent event stream (GET, `Accept: text/event-stream`
+     * exactly, as the gateway requires). The deadline covers the response
+     * headers, and a non-stream body; a response that is not an event stream
+     * is read whole (bounded like any UNS v2 response) and returned as `text`.
+     * An open stream belongs to the caller: `close()` ends it and drops the
+     * link to `signal`, which also ends it.
+     */
+    async getEventStream(path, options = {}) {
+        options.signal?.throwIfAborted();
+        const client = this.resolveClient();
+        const url = `${client.getBaseURL()}${path}`;
+        const key = client.getApiKey();
+        const headers = { Accept: 'text/event-stream' };
+        if (path.startsWith('/openapi/v2/uns/') && this.#unsV2AppDataSubject !== undefined) {
+            headers[UNS_V2_APP_DATA_SUBJECT_HEADER] = this.#unsV2AppDataSubject;
+        }
+        if (options.lastEventId !== undefined)
+            headers['Last-Event-ID'] = options.lastEventId;
+        if (key) {
+            headers.Authorization = `Bearer ${key}`;
+            headers['X-API-Key'] = key;
+        }
+        const controller = new AbortController();
+        const onAbort = () => controller.abort();
+        const close = () => {
+            options.signal?.removeEventListener('abort', onAbort);
+            controller.abort();
+        };
+        options.signal?.addEventListener('abort', onAbort, { once: true });
+        let expired = false;
+        const timer = setTimeout(() => { expired = true; controller.abort(); }, this.timeoutMs);
+        const failure = (kind, status) => new CloudTransportError(expired ? 'TRANSPORT_TIMEOUT' : controller.signal.aborted ? 'TRANSPORT_ABORTED' : kind, status);
+        let response;
+        try {
+            response = await client.getFetch()(url, { method: 'GET', headers, redirect: 'manual', signal: controller.signal });
+        }
+        catch {
+            clearTimeout(timer);
+            close();
+            throw failure('TRANSPORT_ERROR');
+        }
+        const type = response.headers.get('content-type') ?? '';
+        if (response.status === 200 && /^text\/event-stream\b/i.test(type) && response.body) {
+            clearTimeout(timer);
+            return { status: response.status, stream: response.body, close };
+        }
+        try {
+            if (!response.body)
+                return { status: response.status, text: '' };
+            const reader = response.body.getReader();
+            const decoder = new TextDecoder('utf-8', { fatal: true });
+            const chunks = [];
+            let size = 0;
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                size += value.byteLength;
+                if (size > this.unsV2MaxResponseBytes) {
+                    await reader.cancel().catch(() => undefined);
+                    throw new CloudTransportError('PROTOCOL_ERROR', response.status);
+                }
+                chunks.push(decoder.decode(value, { stream: true }));
+            }
+            chunks.push(decoder.decode());
+            return { status: response.status, text: chunks.join('') };
+        }
+        catch (error) {
+            if (error instanceof CloudTransportError)
+                throw error;
+            throw failure('PROTOCOL_ERROR', response.status);
+        }
+        finally {
+            clearTimeout(timer);
+            close();
+        }
+    }
     async post(path, body) {
         const client = this.resolveClient();
         const url = `${client.getBaseURL()}${path}`;

package/dist/esm/cloud-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-transport.js","sourceRoot":"","sources":["../../src/cloud-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAwC,MAAM,qBAAqB,CAAC;AAiBtF,MAAM,CAAC,MAAM,kCAAkC,GAAG,MAAM,CAAC;AACzD,uGAAuG;AACvG,MAAM,CAAC,MAAM,8BAA8B,GAAG,0BAA0B,CAAC;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,IAAI,EAAE,CAAC;AACjD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,IAAI,EAAE,CAAC;AAIlD,4EAA4E;AAC5E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACvB;IAAwB;IAA7C,YAAqB,IAAa,EAAW,MAAe;QAC1D,KAAK,CAAC,IAAI,CAAC,CAAC;QADO,SAAI,GAAJ,IAAI,CAAS;QAAW,WAAM,GAAN,MAAM,CAAS;QAE1D,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,OAAO,cAAc;IAKI;IAJZ,SAAS,CAAS;IAClB,qBAAqB,CAAS;IACtC,oBAAoB,CAAqB;IAElD,YAA6B,gBAAkC,SAAS,EAAE,SAA+B,EAAE;QAA9E,kBAAa,GAAb,aAAa,CAA8B;QACtE,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,IAAI,kCAAkC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,aAAa,EAAE,CAAC;YACzE,MAAM,IAAI,SAAS,CAAC,4EAA4E,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC;QACzB,MAAM,gBAAgB,GAAG,MAAM,CAAC,qBAAqB,IAAI,yBAAyB,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,IAAI,gBAAgB,GAAG,yBAAyB,EAAE,CAAC;YAChH,MAAM,IAAI,SAAS,CAAC,6EAA6E,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,CAAC,qBAAqB,GAAG,gBAAgB,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC;QAC3C,kFAAkF;QAClF,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YACjH,CAAC,kDAAkD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,SAAS,CAAC,6GAA6G,CAAC,CAAC;QACrI,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,UAA0B,EAAE;QACrE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QAC/E,iFAAiF;QACjF,kFAAkF;QAClF,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;YACnC,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC;YAC7C,IAAI,KAAK,kDAAkD;YAC3D,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACtE,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,aAAa,GAAG,UAAU,GAAG,EAAE,CAAC;YACxC,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QAC7B,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,QAA8B,CAAC;QACnC,IAAI,MAA2D,CAAC;QAChE,IAAI,KAAgD,CAAC;QACrD,IAAI,WAAW,GAA2B,GAAG,EAAE,CAAC,SAAS,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,WAAW,CAAC,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9E,CAAC,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5H,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9D,IAAI,cAAc,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACnH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACrD,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrF,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5C,IAAI,IAAI;wBAAE,MAAM;oBAChB,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;oBAClC,IAAI,aAAa,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;wBAC/C,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;wBAC7C,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACnE,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,mBAAmB;oBAAE,MAAM,KAAK,CAAC;gBACtD,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnE,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC7E,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACvD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC7C,MAAM,CAAC,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,0DAA0D;YAC1D,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpJ,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QAC/E,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,aAAa,GAAG,UAAU,GAAG,EAAE,CAAC;YACxC,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QAC7B,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,QAA8B,CAAC;QACnC,IAAI,KAAgD,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACxI,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC7D,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACvD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,0DAA0D;YAC1D,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpG,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF","sourcesContent":["import { getClient, type HttpClient, type RequestOptions } from './openapi/client.js';\n\nexport interface CloudTransportConfig {\n  /** Whole HTTP exchange including the response body, in milliseconds; default 60,000. */\n  transportTimeoutMs?: number;\n  /** UNS v2 response body limit; may only tighten the 20 MiB contract/RPC ceiling. */\n  unsV2MaxResponseBytes?: number;\n  /**\n   * Opaque proof from the trusted App Gateway only: tier0.app-data-subject/v1,\n   * X-Tier0-App-Data-Subject, aud tier0-uns-data. Proof alone is not authentication;\n   * the SDK checks only compact syntax, never parses or trusts claims.\n   * Create a new client per incoming request; never reuse a token across users.\n   * Do not automatically forward the runtime App request assertion: its audience differs.\n   */\n  unsV2AppDataSubject?: string;\n}\n\nexport const DEFAULT_CLOUD_TRANSPORT_TIMEOUT_MS = 60_000;\n/** Header carrying `unsV2AppDataSubject`; the trusted App Gateway sets it on each business request. */\nexport const UNS_V2_APP_DATA_SUBJECT_HEADER = 'X-Tier0-App-Data-Subject';\nexport const UNS_V2_MAX_REQUEST_BYTES = 16 << 20;\nexport const UNS_V2_MAX_RESPONSE_BYTES = 20 << 20;\n\ntype Failure = 'TRANSPORT_ERROR' | 'PROTOCOL_ERROR' | 'TRANSPORT_TIMEOUT' | 'TRANSPORT_ABORTED';\n\n/** Internal redacted failure, translated by each public contract client. */\nexport class CloudTransportError extends Error {\n  constructor(readonly kind: Failure, readonly status?: number) {\n    super(kind);\n    this.name = 'CloudTransportError';\n  }\n}\n\n/** Single fetch, no redirects/retries; one deadline covers both headers and body. */\nexport class CloudTransport {\n  private readonly timeoutMs: number;\n  private readonly unsV2MaxResponseBytes: number;\n  readonly #unsV2AppDataSubject: string | undefined;\n\n  constructor(private readonly resolveClient: () => HttpClient = getClient, config: CloudTransportConfig = {}) {\n    const timeout = config.transportTimeoutMs ?? DEFAULT_CLOUD_TRANSPORT_TIMEOUT_MS;\n    if (!Number.isInteger(timeout) || timeout < 1 || timeout > 2_147_483_647) {\n      throw new TypeError('Tier0 SDK: transportTimeoutMs must be an integer between 1 and 2147483647.');\n    }\n    this.timeoutMs = timeout;\n    const maxResponseBytes = config.unsV2MaxResponseBytes ?? UNS_V2_MAX_RESPONSE_BYTES;\n    if (!Number.isInteger(maxResponseBytes) || maxResponseBytes < 1 || maxResponseBytes > UNS_V2_MAX_RESPONSE_BYTES) {\n      throw new TypeError('Tier0 SDK: unsV2MaxResponseBytes must be an integer between 1 and 20971520.');\n    }\n    this.unsV2MaxResponseBytes = maxResponseBytes;\n    const subject = config.unsV2AppDataSubject;\n    // ASCII-only syntax makes string length equal byte length. Do not trim or decode.\n    if (subject !== undefined && (typeof subject !== 'string' || subject.length > 8192 || /[^A-Za-z0-9_.-]/.test(subject) ||\n        !/^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(subject))) {\n      throw new TypeError('Tier0 SDK: unsV2AppDataSubject must be a compact three-segment base64url token of at most 8192 ASCII bytes.');\n    }\n    this.#unsV2AppDataSubject = subject;\n  }\n\n  async postText(path: string, body: string, options: RequestOptions = {}): Promise<{ text: string; status: number; ok: boolean }> {\n    options.signal?.throwIfAborted();\n    const client = this.resolveClient();\n    const url = `${client.getBaseURL()}${path}`;\n    const key = client.getApiKey();\n    const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n    // Control routes also live under UNS v2, but must never receive data delegation.\n    // Keep this per-client proof out of shared HTTP headers and Control capabilities.\n    if (path.startsWith('/openapi/v2/uns/') &&\n        !path.startsWith('/openapi/v2/uns/controls/') &&\n        path !== '/openapi/v2/uns/streams/runtime/capabilities/get' &&\n        this.#unsV2AppDataSubject !== undefined) {\n      headers[UNS_V2_APP_DATA_SUBJECT_HEADER] = this.#unsV2AppDataSubject;\n    }\n    if (key) {\n      headers.Authorization = `Bearer ${key}`;\n      headers['X-API-Key'] = key;\n    }\n    const controller = new AbortController();\n    let response: Response | undefined;\n    let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    let rejectAbort: (error: Error) => void = () => undefined;\n    const cancelled = new Promise<never>((_, reject) => { rejectAbort = reject; });\n    const onAbort = () => {\n      controller.abort();\n      void reader?.cancel().catch(() => undefined);\n      rejectAbort(new CloudTransportError('TRANSPORT_ABORTED', response?.status));\n    };\n    options.signal?.addEventListener('abort', onAbort, { once: true });\n    const exchange = async () => {\n      try {\n        response = await client.getFetch()(url, { method: 'POST', headers, body, redirect: 'manual', signal: controller.signal });\n      } catch {\n        throw new CloudTransportError('TRANSPORT_ERROR');\n      }\n      const declaredLength = response.headers.get('content-length');\n      if (declaredLength !== null && /^\\d+$/.test(declaredLength) && Number(declaredLength) > this.unsV2MaxResponseBytes) {\n        await response.body?.cancel().catch(() => undefined);\n        throw new CloudTransportError('PROTOCOL_ERROR', response.status);\n      }\n      if (!response.body) throw new CloudTransportError('PROTOCOL_ERROR', response.status);\n      reader = response.body.getReader();\n      const decoder = new TextDecoder('utf-8', { fatal: true });\n      const chunks: string[] = [];\n      let receivedBytes = 0;\n      try {\n        while (true) {\n          const { done, value } = await reader.read();\n          if (done) break;\n          receivedBytes += value.byteLength;\n          if (receivedBytes > this.unsV2MaxResponseBytes) {\n            await reader.cancel().catch(() => undefined);\n            throw new CloudTransportError('PROTOCOL_ERROR', response.status);\n          }\n          chunks.push(decoder.decode(value, { stream: true }));\n        }\n        chunks.push(decoder.decode());\n      } catch (error) {\n        if (error instanceof CloudTransportError) throw error;\n        throw new CloudTransportError('PROTOCOL_ERROR', response.status);\n      } finally {\n        reader.releaseLock();\n        reader = undefined;\n      }\n      return { text: chunks.join(''), status: response.status, ok: response.ok };\n    };\n    try {\n      const deadline = new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(() => {\n          controller.abort();\n          void reader?.cancel().catch(() => undefined);\n          reject(new CloudTransportError('TRANSPORT_TIMEOUT', response?.status));\n        }, this.timeoutMs);\n      });\n      // Also bounds custom transports which ignore AbortSignal.\n      return await Promise.race([exchange(), deadline, cancelled]);\n    } catch (error) {\n      if (controller.signal.aborted) throw new CloudTransportError(options.signal?.aborted ? 'TRANSPORT_ABORTED' : 'TRANSPORT_TIMEOUT', response?.status);\n      throw error;\n    } finally {\n      clearTimeout(timer);\n      options.signal?.removeEventListener('abort', onAbort);\n    }\n  }\n\n  async post(path: string, body: unknown): Promise<{ value: unknown; status: number; ok: boolean }> {\n    const client = this.resolveClient();\n    const url = `${client.getBaseURL()}${path}`;\n    const key = client.getApiKey();\n    const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n    if (key) {\n      headers.Authorization = `Bearer ${key}`;\n      headers['X-API-Key'] = key;\n    }\n    const serialized = JSON.stringify(body);\n    const controller = new AbortController();\n    let response: Response | undefined;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const exchange = async () => {\n      try {\n        response = await client.getFetch()(url, { method: 'POST', headers, body: serialized, redirect: 'manual', signal: controller.signal });\n      } catch {\n        throw new CloudTransportError('TRANSPORT_ERROR');\n      }\n      let value: unknown;\n      try {\n        value = await response.json();\n      } catch {\n        throw new CloudTransportError('PROTOCOL_ERROR', response.status);\n      }\n      return { value, status: response.status, ok: response.ok };\n    };\n    try {\n      const deadline = new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(() => {\n          controller.abort();\n          reject(new CloudTransportError('TRANSPORT_TIMEOUT', response?.status));\n        }, this.timeoutMs);\n      });\n      // Also bounds custom transports which ignore AbortSignal.\n      return await Promise.race([exchange(), deadline]);\n    } catch (error) {\n      if (controller.signal.aborted) throw new CloudTransportError('TRANSPORT_TIMEOUT', response?.status);\n      throw error;\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n"]}
+{"version":3,"file":"cloud-transport.js","sourceRoot":"","sources":["../../src/cloud-transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAwC,MAAM,qBAAqB,CAAC;AAiBtF,MAAM,CAAC,MAAM,kCAAkC,GAAG,MAAM,CAAC;AACzD,uGAAuG;AACvG,MAAM,CAAC,MAAM,8BAA8B,GAAG,0BAA0B,CAAC;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,IAAI,EAAE,CAAC;AACjD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,IAAI,EAAE,CAAC;AAIlD,4EAA4E;AAC5E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACvB;IAAwB;IAA7C,YAAqB,IAAa,EAAW,MAAe;QAC1D,KAAK,CAAC,IAAI,CAAC,CAAC;QADO,SAAI,GAAJ,IAAI,CAAS;QAAW,WAAM,GAAN,MAAM,CAAS;QAE1D,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,OAAO,cAAc;IAKI;IAJZ,SAAS,CAAS;IAClB,qBAAqB,CAAS;IACtC,oBAAoB,CAAqB;IAElD,YAA6B,gBAAkC,SAAS,EAAE,SAA+B,EAAE;QAA9E,kBAAa,GAAb,aAAa,CAA8B;QACtE,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,IAAI,kCAAkC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,aAAa,EAAE,CAAC;YACzE,MAAM,IAAI,SAAS,CAAC,4EAA4E,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC;QACzB,MAAM,gBAAgB,GAAG,MAAM,CAAC,qBAAqB,IAAI,yBAAyB,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,GAAG,CAAC,IAAI,gBAAgB,GAAG,yBAAyB,EAAE,CAAC;YAChH,MAAM,IAAI,SAAS,CAAC,6EAA6E,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,CAAC,qBAAqB,GAAG,gBAAgB,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,mBAAmB,CAAC;QAC3C,kFAAkF;QAClF,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YACjH,CAAC,kDAAkD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,SAAS,CAAC,6GAA6G,CAAC,CAAC;QACrI,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC;IACtC,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,UAA0B,EAAE;QACrE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QAC/E,iFAAiF;QACjF,kFAAkF;QAClF,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;YACnC,CAAC,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC;YAC7C,IAAI,KAAK,kDAAkD;YAC3D,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACtE,CAAC;QACD,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,aAAa,GAAG,UAAU,GAAG,EAAE,CAAC;YACxC,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QAC7B,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,QAA8B,CAAC;QACnC,IAAI,MAA2D,CAAC;QAChE,IAAI,KAAgD,CAAC;QACrD,IAAI,WAAW,GAA2B,GAAG,EAAE,CAAC,SAAS,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,WAAW,CAAC,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9E,CAAC,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5H,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC9D,IAAI,cAAc,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBACnH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACrD,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAAE,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrF,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5C,IAAI,IAAI;wBAAE,MAAM;oBAChB,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;oBAClC,IAAI,aAAa,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;wBAC/C,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;wBAC7C,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACnE,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,mBAAmB;oBAAE,MAAM,KAAK,CAAC;gBACtD,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnE,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,WAAW,EAAE,CAAC;gBACrB,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;YACpE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAClI,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACvD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,KAAK,MAAM,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC7C,MAAM,CAAC,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,0DAA0D;YAC1D,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpJ,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,UAA0D,EAAE;QAE7F,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACxE,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACnF,OAAO,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACtF,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,aAAa,GAAG,UAAU,GAAG,EAAE,CAAC;YACxC,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QAC7B,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,GAAG,EAAE;YACjB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,CAAC;QACF,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,CAAC,IAAa,EAAE,MAAe,EAAE,EAAE,CACjD,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1H,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACrH,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpF,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;gBACzB,IAAI,IAAI,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBACtC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC7C,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACnE,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9B,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB;gBAAE,MAAM,KAAK,CAAC;YACtD,MAAM,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;QAC/E,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,aAAa,GAAG,UAAU,GAAG,EAAE,CAAC;YACxC,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QAC7B,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,QAA8B,CAAC;QACnC,IAAI,KAAgD,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACxI,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QAC7D,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACvD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,UAAU,CAAC,KAAK,EAAE,CAAC;oBACnB,MAAM,CAAC,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,0DAA0D;YAC1D,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpG,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF","sourcesContent":["import { getClient, type HttpClient, type RequestOptions } from './openapi/client.js';\n\nexport interface CloudTransportConfig {\n  /** Whole HTTP exchange including the response body, in milliseconds; default 60,000. */\n  transportTimeoutMs?: number;\n  /** UNS v2 response body limit; may only tighten the 20 MiB contract/RPC ceiling. */\n  unsV2MaxResponseBytes?: number;\n  /**\n   * Opaque proof from the trusted App Gateway only: tier0.app-data-subject/v1,\n   * X-Tier0-App-Data-Subject, aud tier0-uns-data. Proof alone is not authentication;\n   * the SDK checks only compact syntax, never parses or trusts claims.\n   * Create a new client per incoming request; never reuse a token across users.\n   * Do not automatically forward the runtime App request assertion: its audience differs.\n   */\n  unsV2AppDataSubject?: string;\n}\n\nexport const DEFAULT_CLOUD_TRANSPORT_TIMEOUT_MS = 60_000;\n/** Header carrying `unsV2AppDataSubject`; the trusted App Gateway sets it on each business request. */\nexport const UNS_V2_APP_DATA_SUBJECT_HEADER = 'X-Tier0-App-Data-Subject';\nexport const UNS_V2_MAX_REQUEST_BYTES = 16 << 20;\nexport const UNS_V2_MAX_RESPONSE_BYTES = 20 << 20;\n\ntype Failure = 'TRANSPORT_ERROR' | 'PROTOCOL_ERROR' | 'TRANSPORT_TIMEOUT' | 'TRANSPORT_ABORTED';\n\n/** Internal redacted failure, translated by each public contract client. */\nexport class CloudTransportError extends Error {\n  constructor(readonly kind: Failure, readonly status?: number) {\n    super(kind);\n    this.name = 'CloudTransportError';\n  }\n}\n\n/** Single fetch, no redirects/retries; one deadline covers both headers and body. */\nexport class CloudTransport {\n  private readonly timeoutMs: number;\n  private readonly unsV2MaxResponseBytes: number;\n  readonly #unsV2AppDataSubject: string | undefined;\n\n  constructor(private readonly resolveClient: () => HttpClient = getClient, config: CloudTransportConfig = {}) {\n    const timeout = config.transportTimeoutMs ?? DEFAULT_CLOUD_TRANSPORT_TIMEOUT_MS;\n    if (!Number.isInteger(timeout) || timeout < 1 || timeout > 2_147_483_647) {\n      throw new TypeError('Tier0 SDK: transportTimeoutMs must be an integer between 1 and 2147483647.');\n    }\n    this.timeoutMs = timeout;\n    const maxResponseBytes = config.unsV2MaxResponseBytes ?? UNS_V2_MAX_RESPONSE_BYTES;\n    if (!Number.isInteger(maxResponseBytes) || maxResponseBytes < 1 || maxResponseBytes > UNS_V2_MAX_RESPONSE_BYTES) {\n      throw new TypeError('Tier0 SDK: unsV2MaxResponseBytes must be an integer between 1 and 20971520.');\n    }\n    this.unsV2MaxResponseBytes = maxResponseBytes;\n    const subject = config.unsV2AppDataSubject;\n    // ASCII-only syntax makes string length equal byte length. Do not trim or decode.\n    if (subject !== undefined && (typeof subject !== 'string' || subject.length > 8192 || /[^A-Za-z0-9_.-]/.test(subject) ||\n        !/^[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(subject))) {\n      throw new TypeError('Tier0 SDK: unsV2AppDataSubject must be a compact three-segment base64url token of at most 8192 ASCII bytes.');\n    }\n    this.#unsV2AppDataSubject = subject;\n  }\n\n  /** `retryAfter`: the raw `Retry-After` header, for answers without a UNS error body. */\n  async postText(path: string, body: string, options: RequestOptions = {}): Promise<{ text: string; status: number; ok: boolean; retryAfter?: string }> {\n    options.signal?.throwIfAborted();\n    const client = this.resolveClient();\n    const url = `${client.getBaseURL()}${path}`;\n    const key = client.getApiKey();\n    const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n    // Control routes also live under UNS v2, but must never receive data delegation.\n    // Keep this per-client proof out of shared HTTP headers and Control capabilities.\n    if (path.startsWith('/openapi/v2/uns/') &&\n        !path.startsWith('/openapi/v2/uns/controls/') &&\n        path !== '/openapi/v2/uns/streams/runtime/capabilities/get' &&\n        this.#unsV2AppDataSubject !== undefined) {\n      headers[UNS_V2_APP_DATA_SUBJECT_HEADER] = this.#unsV2AppDataSubject;\n    }\n    if (key) {\n      headers.Authorization = `Bearer ${key}`;\n      headers['X-API-Key'] = key;\n    }\n    const controller = new AbortController();\n    let response: Response | undefined;\n    let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    let rejectAbort: (error: Error) => void = () => undefined;\n    const cancelled = new Promise<never>((_, reject) => { rejectAbort = reject; });\n    const onAbort = () => {\n      controller.abort();\n      void reader?.cancel().catch(() => undefined);\n      rejectAbort(new CloudTransportError('TRANSPORT_ABORTED', response?.status));\n    };\n    options.signal?.addEventListener('abort', onAbort, { once: true });\n    const exchange = async () => {\n      try {\n        response = await client.getFetch()(url, { method: 'POST', headers, body, redirect: 'manual', signal: controller.signal });\n      } catch {\n        throw new CloudTransportError('TRANSPORT_ERROR');\n      }\n      const declaredLength = response.headers.get('content-length');\n      if (declaredLength !== null && /^\\d+$/.test(declaredLength) && Number(declaredLength) > this.unsV2MaxResponseBytes) {\n        await response.body?.cancel().catch(() => undefined);\n        throw new CloudTransportError('PROTOCOL_ERROR', response.status);\n      }\n      if (!response.body) throw new CloudTransportError('PROTOCOL_ERROR', response.status);\n      reader = response.body.getReader();\n      const decoder = new TextDecoder('utf-8', { fatal: true });\n      const chunks: string[] = [];\n      let receivedBytes = 0;\n      try {\n        while (true) {\n          const { done, value } = await reader.read();\n          if (done) break;\n          receivedBytes += value.byteLength;\n          if (receivedBytes > this.unsV2MaxResponseBytes) {\n            await reader.cancel().catch(() => undefined);\n            throw new CloudTransportError('PROTOCOL_ERROR', response.status);\n          }\n          chunks.push(decoder.decode(value, { stream: true }));\n        }\n        chunks.push(decoder.decode());\n      } catch (error) {\n        if (error instanceof CloudTransportError) throw error;\n        throw new CloudTransportError('PROTOCOL_ERROR', response.status);\n      } finally {\n        reader.releaseLock();\n        reader = undefined;\n      }\n      const retryAfter = response.headers.get('retry-after') ?? undefined;\n      return { text: chunks.join(''), status: response.status, ok: response.ok, ...(retryAfter === undefined ? {} : { retryAfter }) };\n    };\n    try {\n      const deadline = new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(() => {\n          controller.abort();\n          void reader?.cancel().catch(() => undefined);\n          reject(new CloudTransportError('TRANSPORT_TIMEOUT', response?.status));\n        }, this.timeoutMs);\n      });\n      // Also bounds custom transports which ignore AbortSignal.\n      return await Promise.race([exchange(), deadline, cancelled]);\n    } catch (error) {\n      if (controller.signal.aborted) throw new CloudTransportError(options.signal?.aborted ? 'TRANSPORT_ABORTED' : 'TRANSPORT_TIMEOUT', response?.status);\n      throw error;\n    } finally {\n      clearTimeout(timer);\n      options.signal?.removeEventListener('abort', onAbort);\n    }\n  }\n\n  /**\n   * Opens a server-sent event stream (GET, `Accept: text/event-stream`\n   * exactly, as the gateway requires). The deadline covers the response\n   * headers, and a non-stream body; a response that is not an event stream\n   * is read whole (bounded like any UNS v2 response) and returned as `text`.\n   * An open stream belongs to the caller: `close()` ends it and drops the\n   * link to `signal`, which also ends it.\n   */\n  async getEventStream(path: string, options: { lastEventId?: string; signal?: AbortSignal } = {}):\n    Promise<{ status: number; stream: ReadableStream<Uint8Array>; close(): void } | { status: number; text: string }> {\n    options.signal?.throwIfAborted();\n    const client = this.resolveClient();\n    const url = `${client.getBaseURL()}${path}`;\n    const key = client.getApiKey();\n    const headers: Record<string, string> = { Accept: 'text/event-stream' };\n    if (path.startsWith('/openapi/v2/uns/') && this.#unsV2AppDataSubject !== undefined) {\n      headers[UNS_V2_APP_DATA_SUBJECT_HEADER] = this.#unsV2AppDataSubject;\n    }\n    if (options.lastEventId !== undefined) headers['Last-Event-ID'] = options.lastEventId;\n    if (key) {\n      headers.Authorization = `Bearer ${key}`;\n      headers['X-API-Key'] = key;\n    }\n    const controller = new AbortController();\n    const onAbort = () => controller.abort();\n    const close = () => {\n      options.signal?.removeEventListener('abort', onAbort);\n      controller.abort();\n    };\n    options.signal?.addEventListener('abort', onAbort, { once: true });\n    let expired = false;\n    const timer = setTimeout(() => { expired = true; controller.abort(); }, this.timeoutMs);\n    const failure = (kind: Failure, status?: number) =>\n      new CloudTransportError(expired ? 'TRANSPORT_TIMEOUT' : controller.signal.aborted ? 'TRANSPORT_ABORTED' : kind, status);\n    let response: Response;\n    try {\n      response = await client.getFetch()(url, { method: 'GET', headers, redirect: 'manual', signal: controller.signal });\n    } catch {\n      clearTimeout(timer);\n      close();\n      throw failure('TRANSPORT_ERROR');\n    }\n    const type = response.headers.get('content-type') ?? '';\n    if (response.status === 200 && /^text\\/event-stream\\b/i.test(type) && response.body) {\n      clearTimeout(timer);\n      return { status: response.status, stream: response.body, close };\n    }\n    try {\n      if (!response.body) return { status: response.status, text: '' };\n      const reader = response.body.getReader();\n      const decoder = new TextDecoder('utf-8', { fatal: true });\n      const chunks: string[] = [];\n      let size = 0;\n      while (true) {\n        const { done, value } = await reader.read();\n        if (done) break;\n        size += value.byteLength;\n        if (size > this.unsV2MaxResponseBytes) {\n          await reader.cancel().catch(() => undefined);\n          throw new CloudTransportError('PROTOCOL_ERROR', response.status);\n        }\n        chunks.push(decoder.decode(value, { stream: true }));\n      }\n      chunks.push(decoder.decode());\n      return { status: response.status, text: chunks.join('') };\n    } catch (error) {\n      if (error instanceof CloudTransportError) throw error;\n      throw failure('PROTOCOL_ERROR', response.status);\n    } finally {\n      clearTimeout(timer);\n      close();\n    }\n  }\n\n  async post(path: string, body: unknown): Promise<{ value: unknown; status: number; ok: boolean }> {\n    const client = this.resolveClient();\n    const url = `${client.getBaseURL()}${path}`;\n    const key = client.getApiKey();\n    const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n    if (key) {\n      headers.Authorization = `Bearer ${key}`;\n      headers['X-API-Key'] = key;\n    }\n    const serialized = JSON.stringify(body);\n    const controller = new AbortController();\n    let response: Response | undefined;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n    const exchange = async () => {\n      try {\n        response = await client.getFetch()(url, { method: 'POST', headers, body: serialized, redirect: 'manual', signal: controller.signal });\n      } catch {\n        throw new CloudTransportError('TRANSPORT_ERROR');\n      }\n      let value: unknown;\n      try {\n        value = await response.json();\n      } catch {\n        throw new CloudTransportError('PROTOCOL_ERROR', response.status);\n      }\n      return { value, status: response.status, ok: response.ok };\n    };\n    try {\n      const deadline = new Promise<never>((_resolve, reject) => {\n        timer = setTimeout(() => {\n          controller.abort();\n          reject(new CloudTransportError('TRANSPORT_TIMEOUT', response?.status));\n        }, this.timeoutMs);\n      });\n      // Also bounds custom transports which ignore AbortSignal.\n      return await Promise.race([exchange(), deadline]);\n    } catch (error) {\n      if (controller.signal.aborted) throw new CloudTransportError('TRANSPORT_TIMEOUT', response?.status);\n      throw error;\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n}\n"]}

package/dist/esm/controls.js.map

@@ -1 +1 @@
-{"version":3,"file":"controls.js","sourceRoot":"","sources":["../../src/controls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAsC,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,kCAAkC,EAA6B,MAAM,sBAAsB,CAAC;AAkC1I,MAAM,CAAC,MAAM,oCAAoC,GAAG,kCAAkC,CAAC;AA4BvF,oFAAoF;AACpF,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,MAAM,CAAU;IAChB,SAAS,CAAS;IAClB,KAAK,CAAU;IACf,eAAe,CAAU;IACzB,SAAS,CAAU;IACnB,QAAQ,CAAW;IACnB,SAAS,GAAG,KAAK,CAAC;IAE3B,YAAY,OAAe,EAAE,IAAsB;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChC,CAAC;CACF;AAED,6GAA6G;AAC7G,MAAM,OAAO,yBAA0B,SAAQ,YAAY;IAChD,cAAc,GAAG,IAAI,CAAC;IAE/B,YAAY,IAAsB;QAChC,KAAK,CAAC,qFAAqF,EAAE,IAAI,CAAC,CAAC;QACnG,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,OAAiB;IAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,OAAO,IAAI,GAAG,EAAW;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QACxH,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QAC9G,KAAK,CAAC,IAAI,KAAK,EAAE,IAAI,KAAK,CAAC,eAAe,KAAK,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;QAC5G,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAoB,CAAC;QACtD,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAqB,CAAC;QACtE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO;QACL,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAChE,eAAe,EAAE,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QAC9F,SAAS,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACtE,QAAQ,EAAE,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAC3E,CAAC;AACJ,CAAC;AAYD,MAAM,OAAO,cAAc;IACR,SAAS,CAAiB;IAE3C,YAAY,gBAAkC,SAAS,EAAE,SAAiC,EAAE;QAC1F,IAAI,CAAC,SAAS,GAAG,IAAI,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa,EAAE,OAAgB;QAC9D,IAAI,QAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1E,IAAI,OAAO;gBAAE,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC;gBAChG,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,2BAA2B,CAAC;YAC9F,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC;YACvF,MAAM,IAAI,GAAqB;gBAC7B,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM;gBACzB,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAmB,CAAC,CAAC,CAAC,wBAAwB;aACxE,CAAC;YACF,IAAI,IAAI,CAAC,SAAS,KAAK,wBAAwB,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAiB,CAAC,CAAC,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,QAAQ,CAAC,UAAkC,EAAE;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACzF,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;YAC/G,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAK,KAAK,CAAC,KAAgB,GAAG,CAAC;YACnF,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,YAAY,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,OAAO,KAA2C,CAAC;IACrD,CAAC;IAED,GAAG,CAA4C,QAA0B;QACvE,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO;YACL,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACnB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBAC9C,MAAM,IAAI,YAAY,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;gBACpC,IAAI,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAClC,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;gBACnC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;oBAC/H,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;gBACrE,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;gBAChF,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE;oBAC1D,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;iBAC7D,EAAE,IAAI,CAAC,CAAC;gBACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,eAAe;oBAC5G,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK;oBACzG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;oBACxH,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBACxC,MAAM,IAAI,yBAAyB,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,OAAO,KAAiD,CAAC;YAC3D,CAAC;SACF,CAAC;IACJ,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC","sourcesContent":["import { getClient, type HttpClient, type ClientConfig } from './openapi/client.js';\r\nimport { CloudTransport, CloudTransportError, DEFAULT_CLOUD_TRANSPORT_TIMEOUT_MS, type CloudTransportConfig } from './cloud-transport.js';\r\n\r\n/** Cloud Control contracts are independent of generated OpenAPI / Enterprise flow types. */\r\nexport type ControlJSON = null | boolean | number | string | ControlJSON[] | { [key: string]: ControlJSON };\r\n\r\nexport interface PublicControl {\r\n  code: string;\r\n  name: string;\r\n  description: string;\r\n  contractVersion: string;\r\n  inputSchema: Record<string, ControlJSON>;\r\n  outputSchema: Record<string, ControlJSON>;\r\n  sideEffect: 'read' | 'write';\r\n  idempotency: 'none' | 'optional' | 'required';\r\n  timeoutMs: number;\r\n  status: string;\r\n}\r\n\r\nexport interface ControlDiscoverOptions {\r\n  page?: number;\r\n  size?: number;\r\n  search?: string;\r\n}\r\n\r\nexport interface ControlDiscoverResponse {\r\n  total: number;\r\n  list: PublicControl[];\r\n}\r\n\r\n/** Shared HTTP settings; UNS v2 options never affect Control execution or headers. */\r\nexport interface ControlTransportConfig extends CloudTransportConfig {}\r\n\r\nexport interface CloudClientConfig extends ClientConfig, ControlTransportConfig {}\r\n\r\nexport const DEFAULT_CONTROL_TRANSPORT_TIMEOUT_MS = DEFAULT_CLOUD_TRANSPORT_TIMEOUT_MS;\r\n\r\nexport interface ControlInvokeOptions {\r\n  /** Stable caller-owned key for one business intent, at most 128 UTF-8 bytes. Never generated or retried by the SDK. */\r\n  idempotencyKey?: string;\r\n}\r\n\r\nexport interface ControlInvokeResponse<Result = ControlJSON> {\r\n  code: string;\r\n  contractVersion: string;\r\n  result: Result;\r\n  runID: string;\r\n  status: string;\r\n  /** True only when the server explicitly reports an idempotent replay. */\r\n  replayed: boolean;\r\n}\r\n\r\nexport interface ControlErrorInfo {\r\n  /** HTTP status, absent when no HTTP response was received. */\r\n  status?: number;\r\n  /** Gateway string errorCode, or an SDK-local CONTROL_* transport/protocol code. */\r\n  errorCode: string;\r\n  runID?: string;\r\n  contractVersion?: string;\r\n  runStatus?: string;\r\n  replayed?: boolean;\r\n}\r\n\r\n/** No Control error is automatically retried, including authentication failures. */\r\nexport class ControlError extends Error {\r\n  readonly status?: number;\r\n  readonly errorCode: string;\r\n  readonly runID?: string;\r\n  readonly contractVersion?: string;\r\n  readonly runStatus?: string;\r\n  readonly replayed?: boolean;\r\n  readonly retryable = false;\r\n\r\n  constructor(message: string, info: ControlErrorInfo) {\r\n    super(message);\r\n    this.name = 'ControlError';\r\n    this.status = info.status;\r\n    this.errorCode = info.errorCode;\r\n    this.runID = info.runID;\r\n    this.contractVersion = info.contractVersion;\r\n    this.runStatus = info.runStatus;\r\n    this.replayed = info.replayed;\r\n  }\r\n}\r\n\r\n/** Execution may have happened. Reconcile run information; any deliberate replay must reuse the same key. */\r\nexport class ControlResultUnknownError extends ControlError {\r\n  readonly outcomeUnknown = true;\r\n\r\n  constructor(info: ControlErrorInfo) {\r\n    super('Control result is unknown; execution may have occurred. Do not automatically retry.', info);\r\n    this.name = 'ControlResultUnknownError';\r\n  }\r\n}\r\n\r\nfunction record(value: unknown): value is Record<string, unknown> {\r\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\r\n}\r\n\r\nfunction keys(value: unknown, allowed: string[]): void {\r\n  if (!record(value) || Reflect.ownKeys(value).some(key => typeof key !== 'string' || !allowed.includes(key))) {\r\n    throw new TypeError('Tier0 SDK: unsupported Control option.');\r\n  }\r\n}\r\n\r\nfunction json(value: unknown, seen = new Set<unknown>()): boolean {\r\n  if (value === null || typeof value === 'string' || typeof value === 'boolean') return true;\r\n  if (typeof value === 'number') return Number.isFinite(value);\r\n  if (typeof value !== 'object' || seen.has(value)) return false;\r\n  if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {\r\n    return false;\r\n  }\r\n  seen.add(value);\r\n  const valid = (Array.isArray(value) ? Array.from(value) : Object.values(value)).every(item => json(item, seen));\r\n  seen.delete(value);\r\n  return valid;\r\n}\r\n\r\nfunction definition(value: unknown): value is PublicControl {\r\n  if (!record(value)) return false;\r\n  return ['code', 'name', 'description', 'contractVersion', 'status'].every(key => typeof value[key] === 'string') &&\r\n    value.code !== '' && value.contractVersion !== '' && record(value.inputSchema) && record(value.outputSchema) &&\r\n    ['read', 'write'].includes(value.sideEffect as string) &&\r\n    ['none', 'optional', 'required'].includes(value.idempotency as string) &&\r\n    typeof value.timeoutMs === 'number' && Number.isSafeInteger(value.timeoutMs) && value.timeoutMs > 0;\r\n}\r\n\r\nfunction runInfo(value: unknown): Partial<ControlErrorInfo> {\r\n  if (!record(value)) return {};\r\n  return {\r\n    runID: typeof value.runID === 'string' ? value.runID : undefined,\r\n    contractVersion: typeof value.contractVersion === 'string' ? value.contractVersion : undefined,\r\n    runStatus: typeof value.status === 'string' ? value.status : undefined,\r\n    replayed: typeof value.replayed === 'boolean' ? value.replayed : undefined,\r\n  };\r\n}\r\n\r\nexport interface ControlHandle<Input = ControlJSON, Result = ControlJSON> {\r\n  describe(): Promise<PublicControl>;\r\n  /**\r\n   * One POST only. Input is opaque business JSON, including fields named streamId,\r\n   * entryId, deploymentVersion or timeoutMs. Only the server chooses binding/version/timeout.\r\n   * Generic types are caller assertions; the server validates the contract schemas.\r\n   */\r\n  invoke(input: Input, options?: ControlInvokeOptions): Promise<ControlInvokeResponse<Result>>;\r\n}\r\n\r\nexport class ControlsClient {\r\n  private readonly transport: CloudTransport;\r\n\r\n  constructor(resolveClient: () => HttpClient = getClient, config: ControlTransportConfig = {}) {\r\n    this.transport = new CloudTransport(resolveClient, config);\r\n  }\r\n\r\n  private async post(path: string, body: unknown, invoked: boolean): Promise<{ value: unknown; status: number }> {\r\n    let response: Awaited<ReturnType<CloudTransport['post']>>;\r\n    try {\r\n      response = await this.transport.post(path, body);\r\n    } catch (error) {\r\n      if (!(error instanceof CloudTransportError)) throw error;\r\n      const info = { status: error.status, errorCode: `CONTROL_${error.kind}` };\r\n      if (invoked) throw new ControlResultUnknownError(info);\r\n      const message = error.kind === 'TRANSPORT_TIMEOUT' ? 'Control HTTP transport deadline exceeded.' :\r\n        error.kind === 'PROTOCOL_ERROR' ? 'Invalid Control response.' : 'Control transport failed.';\r\n      throw new ControlError(message, info);\r\n    }\r\n    const { value, status, ok } = response;\r\n    if (!ok) {\r\n      const error = record(value) ? value : {};\r\n      const valid = typeof error.errorCode === 'string' && typeof error.message === 'string';\r\n      const info: ControlErrorInfo = {\r\n        ...runInfo(value), status,\r\n        errorCode: valid ? error.errorCode as string : 'CONTROL_PROTOCOL_ERROR',\r\n      };\r\n      if (info.errorCode === 'CONTROL_RESULT_UNKNOWN' || (invoked && !valid)) {\r\n        throw new ControlResultUnknownError(info);\r\n      }\r\n      throw new ControlError(valid ? error.message as string : 'Invalid Control error response.', info);\r\n    }\r\n    return { value, status };\r\n  }\r\n\r\n  /** Discover visible contracts; defaults and authorization are resolved by the server. */\r\n  async discover(options: ControlDiscoverOptions = {}): Promise<ControlDiscoverResponse> {\r\n    keys(options, ['page', 'size', 'search']);\r\n    if ((options.page !== undefined && (!Number.isSafeInteger(options.page) || options.page < 1)) ||\r\n        (options.size !== undefined && (!Number.isSafeInteger(options.size) || options.size < 1 || options.size > 200)) ||\r\n        (options.search !== undefined && typeof options.search !== 'string')) {\r\n      throw new TypeError('Tier0 SDK: invalid Control discovery options.');\r\n    }\r\n    const { value, status } = await this.post('/openapi/v1/controls/discover', options, false);\r\n    if (!record(value) || !Number.isSafeInteger(value.total) || (value.total as number) < 0 ||\r\n        !Array.isArray(value.list) || !value.list.every(definition)) {\r\n      throw new ControlError('Invalid Control discovery response.', { status, errorCode: 'CONTROL_PROTOCOL_ERROR' });\r\n    }\r\n    return value as unknown as ControlDiscoverResponse;\r\n  }\r\n\r\n  use<Input = ControlJSON, Result = ControlJSON>(selector: { code: string }): ControlHandle<Input, Result> {\r\n    keys(selector, ['code']);\r\n    const code = selector.code;\r\n    if (typeof code !== 'string' || code.length > 128 || !/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/.test(code)) {\r\n      throw new TypeError('Tier0 SDK: invalid Control code.');\r\n    }\r\n    const path = `/openapi/v1/controls/${encodeURIComponent(code)}`;\r\n    return {\r\n      describe: async () => {\r\n        const { value, status } = await this.post(`${path}/describe`, {}, false);\r\n        if (!definition(value) || value.code !== code) {\r\n          throw new ControlError('Invalid Control description.', { status, errorCode: 'CONTROL_PROTOCOL_ERROR' });\r\n        }\r\n        return value;\r\n      },\r\n      invoke: async (input, options = {}) => {\r\n        keys(options, ['idempotencyKey']);\r\n        const key = options.idempotencyKey;\r\n        if (key !== undefined && (typeof key !== 'string' || !key || key.trim() !== key || new TextEncoder().encode(key).length > 128)) {\r\n          throw new TypeError('Tier0 SDK: invalid Control idempotency key.');\r\n        }\r\n        if (!json(input)) throw new TypeError('Tier0 SDK: Control input must be JSON.');\r\n        const { value, status } = await this.post(`${path}/invoke`, {\r\n          input, ...(key === undefined ? {} : { idempotencyKey: key }),\r\n        }, true);\r\n        if (!record(value) || value.code !== code || typeof value.contractVersion !== 'string' || !value.contractVersion ||\r\n            !Object.prototype.hasOwnProperty.call(value, 'result') || typeof value.runID !== 'string' || !value.runID ||\r\n            typeof value.status !== 'string' || !value.status || ['accepted', 'queued', 'pending', 'running'].includes(value.status) ||\r\n            typeof value.replayed !== 'boolean') {\r\n          throw new ControlResultUnknownError({ ...runInfo(value), status, errorCode: 'CONTROL_PROTOCOL_ERROR' });\r\n        }\r\n        return value as unknown as ControlInvokeResponse<Result>;\r\n      },\r\n    };\r\n  }\r\n}\r\n\r\n/** Uses configureClient()/TIER0_API_HOST/TIER0_API_KEY, resolved for every call. */\r\nexport const controls = new ControlsClient();\r\n"]}
+{"version":3,"file":"controls.js","sourceRoot":"","sources":["../../src/controls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAsC,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,kCAAkC,EAA6B,MAAM,sBAAsB,CAAC;AAkC1I,MAAM,CAAC,MAAM,oCAAoC,GAAG,kCAAkC,CAAC;AA4BvF,oFAAoF;AACpF,MAAM,OAAO,YAAa,SAAQ,KAAK;IAC5B,MAAM,CAAU;IAChB,SAAS,CAAS;IAClB,KAAK,CAAU;IACf,eAAe,CAAU;IACzB,SAAS,CAAU;IACnB,QAAQ,CAAW;IACnB,SAAS,GAAG,KAAK,CAAC;IAE3B,YAAY,OAAe,EAAE,IAAsB;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAChC,CAAC;CACF;AAED,6GAA6G;AAC7G,MAAM,OAAO,yBAA0B,SAAQ,YAAY;IAChD,cAAc,GAAG,IAAI,CAAC;IAE/B,YAAY,IAAsB;QAChC,KAAK,CAAC,qFAAqF,EAAE,IAAI,CAAC,CAAC;QACnG,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,OAAiB;IAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5G,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,OAAO,IAAI,GAAG,EAAW;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QACxH,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAChH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QAC9G,KAAK,CAAC,IAAI,KAAK,EAAE,IAAI,KAAK,CAAC,eAAe,KAAK,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;QAC5G,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAoB,CAAC;QACtD,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAqB,CAAC;QACtE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,OAAO;QACL,KAAK,EAAE,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAChE,eAAe,EAAE,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;QAC9F,SAAS,EAAE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACtE,QAAQ,EAAE,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAC3E,CAAC;AACJ,CAAC;AAYD,MAAM,OAAO,cAAc;IACR,SAAS,CAAiB;IAE3C,YAAY,gBAAkC,SAAS,EAAE,SAAiC,EAAE;QAC1F,IAAI,CAAC,SAAS,GAAG,IAAI,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAa,EAAE,OAAgB;QAC9D,IAAI,QAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,mBAAmB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1E,IAAI,OAAO;gBAAE,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC;gBAChG,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,2BAA2B,CAAC;YAC9F,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC;YACvF,MAAM,IAAI,GAAqB;gBAC7B,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM;gBACzB,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAmB,CAAC,CAAC,CAAC,wBAAwB;aACxE,CAAC;YACF,IAAI,IAAI,CAAC,SAAS,KAAK,wBAAwB,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvE,MAAM,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAiB,CAAC,CAAC,CAAC,iCAAiC,EAAE,IAAI,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,QAAQ,CAAC,UAAkC,EAAE;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACzF,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;YAC/G,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,+BAA+B,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAK,KAAK,CAAC,KAAgB,GAAG,CAAC;YACnF,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,YAAY,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,OAAO,KAA2C,CAAC;IACrD,CAAC;IAED,GAAG,CAA4C,QAA0B;QACvE,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,wBAAwB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,OAAO;YACL,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACnB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzE,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;oBAC9C,MAAM,IAAI,YAAY,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,EAAE,EAAE,EAAE;gBACpC,IAAI,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAClC,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC;gBACnC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;oBAC/H,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;gBACrE,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;gBAChF,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE;oBAC1D,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;iBAC7D,EAAE,IAAI,CAAC,CAAC;gBACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,eAAe;oBAC5G,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK;oBACzG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;oBACxH,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;oBACxC,MAAM,IAAI,yBAAyB,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,OAAO,KAAiD,CAAC;YAC3D,CAAC;SACF,CAAC;IACJ,CAAC;CACF;AAED,oFAAoF;AACpF,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC","sourcesContent":["import { getClient, type HttpClient, type ClientConfig } from './openapi/client.js';\nimport { CloudTransport, CloudTransportError, DEFAULT_CLOUD_TRANSPORT_TIMEOUT_MS, type CloudTransportConfig } from './cloud-transport.js';\n\n/** Cloud Control contracts are independent of generated OpenAPI / Enterprise flow types. */\nexport type ControlJSON = null | boolean | number | string | ControlJSON[] | { [key: string]: ControlJSON };\n\nexport interface PublicControl {\n  code: string;\n  name: string;\n  description: string;\n  contractVersion: string;\n  inputSchema: Record<string, ControlJSON>;\n  outputSchema: Record<string, ControlJSON>;\n  sideEffect: 'read' | 'write';\n  idempotency: 'none' | 'optional' | 'required';\n  timeoutMs: number;\n  status: string;\n}\n\nexport interface ControlDiscoverOptions {\n  page?: number;\n  size?: number;\n  search?: string;\n}\n\nexport interface ControlDiscoverResponse {\n  total: number;\n  list: PublicControl[];\n}\n\n/** Shared HTTP settings; UNS v2 options never affect Control execution or headers. */\nexport interface ControlTransportConfig extends CloudTransportConfig {}\n\nexport interface CloudClientConfig extends ClientConfig, ControlTransportConfig {}\n\nexport const DEFAULT_CONTROL_TRANSPORT_TIMEOUT_MS = DEFAULT_CLOUD_TRANSPORT_TIMEOUT_MS;\n\nexport interface ControlInvokeOptions {\n  /** Stable caller-owned key for one business intent, at most 128 UTF-8 bytes. Never generated or retried by the SDK. */\n  idempotencyKey?: string;\n}\n\nexport interface ControlInvokeResponse<Result = ControlJSON> {\n  code: string;\n  contractVersion: string;\n  result: Result;\n  runID: string;\n  status: string;\n  /** True only when the server explicitly reports an idempotent replay. */\n  replayed: boolean;\n}\n\nexport interface ControlErrorInfo {\n  /** HTTP status, absent when no HTTP response was received. */\n  status?: number;\n  /** Gateway string errorCode, or an SDK-local CONTROL_* transport/protocol code. */\n  errorCode: string;\n  runID?: string;\n  contractVersion?: string;\n  runStatus?: string;\n  replayed?: boolean;\n}\n\n/** No Control error is automatically retried, including authentication failures. */\nexport class ControlError extends Error {\n  readonly status?: number;\n  readonly errorCode: string;\n  readonly runID?: string;\n  readonly contractVersion?: string;\n  readonly runStatus?: string;\n  readonly replayed?: boolean;\n  readonly retryable = false;\n\n  constructor(message: string, info: ControlErrorInfo) {\n    super(message);\n    this.name = 'ControlError';\n    this.status = info.status;\n    this.errorCode = info.errorCode;\n    this.runID = info.runID;\n    this.contractVersion = info.contractVersion;\n    this.runStatus = info.runStatus;\n    this.replayed = info.replayed;\n  }\n}\n\n/** Execution may have happened. Reconcile run information; any deliberate replay must reuse the same key. */\nexport class ControlResultUnknownError extends ControlError {\n  readonly outcomeUnknown = true;\n\n  constructor(info: ControlErrorInfo) {\n    super('Control result is unknown; execution may have occurred. Do not automatically retry.', info);\n    this.name = 'ControlResultUnknownError';\n  }\n}\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n\nfunction keys(value: unknown, allowed: string[]): void {\n  if (!record(value) || Reflect.ownKeys(value).some(key => typeof key !== 'string' || !allowed.includes(key))) {\n    throw new TypeError('Tier0 SDK: unsupported Control option.');\n  }\n}\n\nfunction json(value: unknown, seen = new Set<unknown>()): boolean {\n  if (value === null || typeof value === 'string' || typeof value === 'boolean') return true;\n  if (typeof value === 'number') return Number.isFinite(value);\n  if (typeof value !== 'object' || seen.has(value)) return false;\n  if (!Array.isArray(value) && Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {\n    return false;\n  }\n  seen.add(value);\n  const valid = (Array.isArray(value) ? Array.from(value) : Object.values(value)).every(item => json(item, seen));\n  seen.delete(value);\n  return valid;\n}\n\nfunction definition(value: unknown): value is PublicControl {\n  if (!record(value)) return false;\n  return ['code', 'name', 'description', 'contractVersion', 'status'].every(key => typeof value[key] === 'string') &&\n    value.code !== '' && value.contractVersion !== '' && record(value.inputSchema) && record(value.outputSchema) &&\n    ['read', 'write'].includes(value.sideEffect as string) &&\n    ['none', 'optional', 'required'].includes(value.idempotency as string) &&\n    typeof value.timeoutMs === 'number' && Number.isSafeInteger(value.timeoutMs) && value.timeoutMs > 0;\n}\n\nfunction runInfo(value: unknown): Partial<ControlErrorInfo> {\n  if (!record(value)) return {};\n  return {\n    runID: typeof value.runID === 'string' ? value.runID : undefined,\n    contractVersion: typeof value.contractVersion === 'string' ? value.contractVersion : undefined,\n    runStatus: typeof value.status === 'string' ? value.status : undefined,\n    replayed: typeof value.replayed === 'boolean' ? value.replayed : undefined,\n  };\n}\n\nexport interface ControlHandle<Input = ControlJSON, Result = ControlJSON> {\n  describe(): Promise<PublicControl>;\n  /**\n   * One POST only. Input is opaque business JSON, including fields named streamId,\n   * entryId, deploymentVersion or timeoutMs. Only the server chooses binding/version/timeout.\n   * Generic types are caller assertions; the server validates the contract schemas.\n   */\n  invoke(input: Input, options?: ControlInvokeOptions): Promise<ControlInvokeResponse<Result>>;\n}\n\nexport class ControlsClient {\n  private readonly transport: CloudTransport;\n\n  constructor(resolveClient: () => HttpClient = getClient, config: ControlTransportConfig = {}) {\n    this.transport = new CloudTransport(resolveClient, config);\n  }\n\n  private async post(path: string, body: unknown, invoked: boolean): Promise<{ value: unknown; status: number }> {\n    let response: Awaited<ReturnType<CloudTransport['post']>>;\n    try {\n      response = await this.transport.post(path, body);\n    } catch (error) {\n      if (!(error instanceof CloudTransportError)) throw error;\n      const info = { status: error.status, errorCode: `CONTROL_${error.kind}` };\n      if (invoked) throw new ControlResultUnknownError(info);\n      const message = error.kind === 'TRANSPORT_TIMEOUT' ? 'Control HTTP transport deadline exceeded.' :\n        error.kind === 'PROTOCOL_ERROR' ? 'Invalid Control response.' : 'Control transport failed.';\n      throw new ControlError(message, info);\n    }\n    const { value, status, ok } = response;\n    if (!ok) {\n      const error = record(value) ? value : {};\n      const valid = typeof error.errorCode === 'string' && typeof error.message === 'string';\n      const info: ControlErrorInfo = {\n        ...runInfo(value), status,\n        errorCode: valid ? error.errorCode as string : 'CONTROL_PROTOCOL_ERROR',\n      };\n      if (info.errorCode === 'CONTROL_RESULT_UNKNOWN' || (invoked && !valid)) {\n        throw new ControlResultUnknownError(info);\n      }\n      throw new ControlError(valid ? error.message as string : 'Invalid Control error response.', info);\n    }\n    return { value, status };\n  }\n\n  /** Discover visible contracts; defaults and authorization are resolved by the server. */\n  async discover(options: ControlDiscoverOptions = {}): Promise<ControlDiscoverResponse> {\n    keys(options, ['page', 'size', 'search']);\n    if ((options.page !== undefined && (!Number.isSafeInteger(options.page) || options.page < 1)) ||\n        (options.size !== undefined && (!Number.isSafeInteger(options.size) || options.size < 1 || options.size > 200)) ||\n        (options.search !== undefined && typeof options.search !== 'string')) {\n      throw new TypeError('Tier0 SDK: invalid Control discovery options.');\n    }\n    const { value, status } = await this.post('/openapi/v1/controls/discover', options, false);\n    if (!record(value) || !Number.isSafeInteger(value.total) || (value.total as number) < 0 ||\n        !Array.isArray(value.list) || !value.list.every(definition)) {\n      throw new ControlError('Invalid Control discovery response.', { status, errorCode: 'CONTROL_PROTOCOL_ERROR' });\n    }\n    return value as unknown as ControlDiscoverResponse;\n  }\n\n  use<Input = ControlJSON, Result = ControlJSON>(selector: { code: string }): ControlHandle<Input, Result> {\n    keys(selector, ['code']);\n    const code = selector.code;\n    if (typeof code !== 'string' || code.length > 128 || !/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/.test(code)) {\n      throw new TypeError('Tier0 SDK: invalid Control code.');\n    }\n    const path = `/openapi/v1/controls/${encodeURIComponent(code)}`;\n    return {\n      describe: async () => {\n        const { value, status } = await this.post(`${path}/describe`, {}, false);\n        if (!definition(value) || value.code !== code) {\n          throw new ControlError('Invalid Control description.', { status, errorCode: 'CONTROL_PROTOCOL_ERROR' });\n        }\n        return value;\n      },\n      invoke: async (input, options = {}) => {\n        keys(options, ['idempotencyKey']);\n        const key = options.idempotencyKey;\n        if (key !== undefined && (typeof key !== 'string' || !key || key.trim() !== key || new TextEncoder().encode(key).length > 128)) {\n          throw new TypeError('Tier0 SDK: invalid Control idempotency key.');\n        }\n        if (!json(input)) throw new TypeError('Tier0 SDK: Control input must be JSON.');\n        const { value, status } = await this.post(`${path}/invoke`, {\n          input, ...(key === undefined ? {} : { idempotencyKey: key }),\n        }, true);\n        if (!record(value) || value.code !== code || typeof value.contractVersion !== 'string' || !value.contractVersion ||\n            !Object.prototype.hasOwnProperty.call(value, 'result') || typeof value.runID !== 'string' || !value.runID ||\n            typeof value.status !== 'string' || !value.status || ['accepted', 'queued', 'pending', 'running'].includes(value.status) ||\n            typeof value.replayed !== 'boolean') {\n          throw new ControlResultUnknownError({ ...runInfo(value), status, errorCode: 'CONTROL_PROTOCOL_ERROR' });\n        }\n        return value as unknown as ControlInvokeResponse<Result>;\n      },\n    };\n  }\n}\n\n/** Uses configureClient()/TIER0_API_HOST/TIER0_API_KEY, resolved for every call. */\nexport const controls = new ControlsClient();\n"]}