@zihin/agent-client 0.1.0 → 0.2.0

package/dist/security.d.ts

@@ -1,82 +0,0 @@
-/**
- * Security utilities — portado de n8n-nodes-zihin/src/utils/security.ts (zero-dep).
- * SSRF prevention, payload limits, error sanitization, API-key format, HMAC signing.
- *
- * Núcleo compartilhado: os shells (n8n, Paperclip) reusam estas primitivas via @zihin/agent-client.
- *
- * @module security
- */
-export interface UrlValidationResult {
-    valid: boolean;
-    error?: string;
-    sanitizedUrl?: string;
-}
-export interface UrlValidationOptions {
-    allowCustomDomains?: boolean;
-    allowHttp?: boolean;
-    allowLocalhost?: boolean;
-}
-/**
- * Validates a base URL for SSRF prevention.
- *
- * NOTA (S4): a checagem é por NOME de host, não pelo IP resolvido. Com `allowCustomDomains: true`,
- * um host que resolve para IP privado (DNS rebinding) passa. Em ambiente sensível, mantenha o
- * whitelist (default) ou faça a resolução/checagem de IP na borda de rede.
- *
- * @param url - The URL to validate
- * @param options - Validation options
- * @returns Validation result with sanitized URL or error
- */
-export declare function validateBaseUrl(url: string, options?: UrlValidationOptions): UrlValidationResult;
-export interface PayloadLimits {
-    maxPromptBytes: number;
-    maxMessageCount: number;
-    maxSingleMessageBytes: number;
-    maxTotalPayloadBytes: number;
-}
-declare const DEFAULT_LIMITS: PayloadLimits;
-export interface PayloadValidationResult {
-    valid: boolean;
-    error?: string;
-    truncated?: boolean;
-    details?: {
-        promptBytes?: number;
-        messageCount?: number;
-        largestMessageBytes?: number;
-        totalBytes?: number;
-    };
-}
-/**
- * Validates a single message/prompt size against configured limits.
- */
-export declare function validatePromptSize(prompt: string, limits?: Partial<PayloadLimits>): PayloadValidationResult;
-export interface SanitizedError {
-    message: string;
-    code?: string;
-    retryable: boolean;
-    retryAfter?: number;
-}
-/**
- * Sanitizes API errors to prevent information leakage (keys, request IDs, stack traces).
- */
-export declare function sanitizeApiError(error: unknown): SanitizedError;
-export interface ApiKeyValidationResult {
-    valid: boolean;
-    error?: string;
-    environment?: 'live' | 'test' | 'dev';
-}
-/**
- * Validates API key format (zhn_live_* | zhn_test_* | zhn_dev_*).
- */
-export declare function validateApiKeyFormat(apiKey: string): ApiKeyValidationResult;
-export interface SignedRequestHeaders {
-    'X-Zihin-Signature': string;
-    'X-Zihin-Timestamp': string;
-    'X-Zihin-Nonce': string;
-}
-/**
- * Signs a request payload with HMAC-SHA256 (timestamp + nonce + payload).
- * Requer Node crypto — carregado sob demanda; lança em runtimes sem ele.
- */
-export declare function signRequest(payload: string, secretKey: string, timestamp?: number): SignedRequestHeaders;
-export { DEFAULT_LIMITS };

package/dist/security.js

@@ -1,251 +0,0 @@
-"use strict";
-/**
- * Security utilities — portado de n8n-nodes-zihin/src/utils/security.ts (zero-dep).
- * SSRF prevention, payload limits, error sanitization, API-key format, HMAC signing.
- *
- * Núcleo compartilhado: os shells (n8n, Paperclip) reusam estas primitivas via @zihin/agent-client.
- *
- * @module security
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_LIMITS = void 0;
-exports.validateBaseUrl = validateBaseUrl;
-exports.validatePromptSize = validatePromptSize;
-exports.sanitizeApiError = sanitizeApiError;
-exports.validateApiKeyFormat = validateApiKeyFormat;
-exports.signRequest = signRequest;
-const internal_1 = require("./internal");
-// `node:crypto` é carregado SOB DEMANDA (só em signRequest) para não quebrar o load do módulo
-// em runtimes sem Node crypto (edge/browser), onde o resto do núcleo funciona via Web APIs.
-// ============================================
-// 1. URL Validation (SSRF Prevention)
-// ============================================
-const PRIVATE_IP_PATTERNS = [
-    /^127\./, // 127.0.0.0/8 (localhost)
-    /^10\./, // 10.0.0.0/8 (private)
-    /^172\.(1[6-9]|2[0-9]|3[0-1])\./, // 172.16.0.0/12 (private)
-    /^192\.168\./, // 192.168.0.0/16 (private)
-    /^169\.254\./, // 169.254.0.0/16 (link-local)
-    /^0\./, // 0.0.0.0/8
-    /^::1$/, // IPv6 localhost
-    /^fe80:/i, // IPv6 link-local
-    /^fc00:/i, // IPv6 unique local
-    /^fd00:/i, // IPv6 unique local
-];
-const BLOCKED_HOSTNAMES = [
-    'localhost',
-    'localtest.me',
-    'metadata.google.internal', // GCP metadata
-    '169.254.169.254', // AWS/Azure/GCP metadata
-    'metadata.azure.com',
-];
-const ALLOWED_ZIHIN_DOMAINS = [
-    'llm.zihin.ai',
-    'api.zihin.ai',
-    'staging.llm.zihin.ai',
-    'dev.llm.zihin.ai',
-];
-/**
- * Validates a base URL for SSRF prevention.
- *
- * NOTA (S4): a checagem é por NOME de host, não pelo IP resolvido. Com `allowCustomDomains: true`,
- * um host que resolve para IP privado (DNS rebinding) passa. Em ambiente sensível, mantenha o
- * whitelist (default) ou faça a resolução/checagem de IP na borda de rede.
- *
- * @param url - The URL to validate
- * @param options - Validation options
- * @returns Validation result with sanitized URL or error
- */
-function validateBaseUrl(url, options = {}) {
-    // Empty/default URL is allowed
-    if (!url || url.trim() === '') {
-        return { valid: true, sanitizedUrl: 'https://llm.zihin.ai' };
-    }
-    try {
-        const parsed = new URL(url);
-        const hostname = parsed.hostname;
-        // Check if this is localhost (for development)
-        const isLocalhost = hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1';
-        // Allow localhost when explicitly enabled (development mode)
-        if (isLocalhost && options.allowLocalhost) {
-            const sanitizedUrl = parsed.origin + parsed.pathname.replace(/\/+$/, '');
-            return { valid: true, sanitizedUrl };
-        }
-        // 1. Protocol validation (HTTPS only by default)
-        if (!options.allowHttp && parsed.protocol !== 'https:') {
-            return {
-                valid: false,
-                error: 'Only HTTPS URLs are allowed for security reasons',
-            };
-        }
-        // 2. Block private IP ranges
-        for (const pattern of PRIVATE_IP_PATTERNS) {
-            if (pattern.test(hostname)) {
-                return { valid: false, error: 'Private IP addresses are not allowed' };
-            }
-        }
-        // 3. Block known dangerous hostnames
-        for (const blocked of BLOCKED_HOSTNAMES) {
-            if (blocked.startsWith('*')) {
-                const suffix = blocked.slice(1);
-                if (hostname.endsWith(suffix)) {
-                    return { valid: false, error: 'This hostname is not allowed' };
-                }
-            }
-            else if (hostname === blocked || hostname.endsWith('.' + blocked)) {
-                return { valid: false, error: 'This hostname is not allowed' };
-            }
-        }
-        // 4. Whitelist mode (only Zihin domains) unless custom domains allowed
-        if (!options.allowCustomDomains) {
-            const isAllowed = ALLOWED_ZIHIN_DOMAINS.some((domain) => hostname === domain || hostname.endsWith('.' + domain));
-            if (!isAllowed) {
-                return {
-                    valid: false,
-                    error: `Only Zihin domains are allowed. Use 'allowCustomBaseUrl' for custom endpoints.`,
-                };
-            }
-        }
-        // Remove trailing slash for consistency
-        const sanitizedUrl = parsed.origin + parsed.pathname.replace(/\/+$/, '');
-        return { valid: true, sanitizedUrl };
-    }
-    catch {
-        return { valid: false, error: 'Invalid URL format' };
-    }
-}
-const DEFAULT_LIMITS = {
-    maxPromptBytes: 100 * 1024, // 100KB
-    maxMessageCount: 100,
-    maxSingleMessageBytes: 50 * 1024, // 50KB
-    maxTotalPayloadBytes: 500 * 1024, // 500KB
-};
-exports.DEFAULT_LIMITS = DEFAULT_LIMITS;
-/**
- * Validates a single message/prompt size against configured limits.
- */
-function validatePromptSize(prompt, limits = {}) {
-    const effectiveLimits = { ...DEFAULT_LIMITS, ...limits };
-    const bytes = (0, internal_1.utf8Len)(prompt);
-    if (bytes > effectiveLimits.maxPromptBytes) {
-        return {
-            valid: false,
-            error: `Prompt size (${Math.round(bytes / 1024)}KB) exceeds maximum allowed (${Math.round(effectiveLimits.maxPromptBytes / 1024)}KB)`,
-            details: { promptBytes: bytes },
-        };
-    }
-    return { valid: true, details: { promptBytes: bytes } };
-}
-// ============================================
-// 3. Error Sanitization
-// ============================================
-// Redação SÓ de segredos reais. request_id/trace_id/correlation_id NÃO são redatados:
-// não são secretos e são exatamente o que o suporte/observabilidade precisa para correlacionar.
-const SENSITIVE_PATTERNS = [
-    /zhn_(?:live|test|dev)_[a-zA-Z0-9]+/g, // API keys
-    /Bearer\s+[a-zA-Z0-9._-]+/gi, // Bearer tokens
-    /at\s+[\w./<>]+\s*\(.*:\d+:\d+\)/g, // Stack trace lines
-    /^\s+at\s+.+$/gm, // Stack traces
-    /Error:\s*.*\n\s+at/g, // Error stack beginnings
-];
-const ERROR_CODE_MAP = {
-    RATE_LIMIT_EXCEEDED: 'Rate limit exceeded. Please wait before retrying.',
-    UNAUTHORIZED: 'Authentication failed. Please check your API credentials.',
-    FORBIDDEN: 'This API key lacks permission for this action. Use an admin/editor key (member keys cannot create triggers or read telemetry).',
-    INVALID_MODEL: 'The specified model is not available.',
-    INTERNAL_ERROR: 'An internal error occurred. Please try again later.',
-    TIMEOUT: 'Request timed out. Try increasing the timeout.',
-    INVALID_REQUEST: 'The request was malformed. Please check your input.',
-    INSUFFICIENT_CREDITS: 'Insufficient credits. Please check your account balance.',
-    CONTEXT_LENGTH_EXCEEDED: 'The input exceeds the model context length limit.',
-    AGENT_NOT_FOUND: 'Agent not found or not active for this tenant.',
-};
-/**
- * Sanitizes API errors to prevent information leakage (keys, request IDs, stack traces).
- */
-function sanitizeApiError(error) {
-    let message = 'An unexpected error occurred';
-    let code;
-    let retryable = false;
-    let retryAfter;
-    if (typeof error === 'object' && error !== null) {
-        const err = error;
-        // O BE usa o shape aninhado { error: { code, message } }; suporta também o plano
-        // { error|code: string, message }. (Antes, err.error objeto virava "código" e a msg sumia.)
-        const nested = err.error && typeof err.error === 'object' ? err.error : undefined;
-        const codeRaw = nested?.code ?? (typeof err.error === 'string' ? err.error : err.code);
-        code = typeof codeRaw === 'string' ? codeRaw : undefined;
-        const rawMessage = (nested?.message ?? err.message);
-        if (code && ERROR_CODE_MAP[code]) {
-            message = ERROR_CODE_MAP[code];
-        }
-        else if (typeof rawMessage === 'string' && rawMessage) {
-            message = rawMessage;
-        }
-        if (code === 'RATE_LIMIT_EXCEEDED' || code === 'TIMEOUT') {
-            retryable = true;
-            retryAfter = err.retryAfter || 60;
-        }
-        // S5: limita o tamanho ANTES das regex (bounda custo/ReDoS em mensagens grandes).
-        if (message.length > 2000)
-            message = message.slice(0, 2000);
-        for (const pattern of SENSITIVE_PATTERNS) {
-            message = message.replace(pattern, '[REDACTED]');
-        }
-    }
-    else if (typeof error === 'string') {
-        message = error;
-        if (message.length > 2000)
-            message = message.slice(0, 2000);
-        for (const pattern of SENSITIVE_PATTERNS) {
-            message = message.replace(pattern, '[REDACTED]');
-        }
-    }
-    if (message.length > 500) {
-        message = message.substring(0, 500) + '...';
-    }
-    return { message, code, retryable, retryAfter };
-}
-// ============================================
-// 4. API Key Validation
-// ============================================
-const API_KEY_PATTERN = /^zhn_(live|test|dev)_[a-zA-Z0-9]{20,}$/;
-/**
- * Validates API key format (zhn_live_* | zhn_test_* | zhn_dev_*).
- */
-function validateApiKeyFormat(apiKey) {
-    if (!apiKey || apiKey.trim() === '') {
-        return { valid: false, error: 'API key is required' };
-    }
-    const trimmed = apiKey.trim();
-    if (!API_KEY_PATTERN.test(trimmed)) {
-        return {
-            valid: false,
-            error: 'Invalid API key format. Expected: zhn_live_xxx, zhn_test_xxx or zhn_dev_xxx',
-        };
-    }
-    const environment = trimmed.startsWith('zhn_live_')
-        ? 'live'
-        : trimmed.startsWith('zhn_test_')
-            ? 'test'
-            : 'dev';
-    return { valid: true, environment };
-}
-/**
- * Signs a request payload with HMAC-SHA256 (timestamp + nonce + payload).
- * Requer Node crypto — carregado sob demanda; lança em runtimes sem ele.
- */
-function signRequest(payload, secretKey, timestamp) {
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
-    const { createHmac, randomBytes } = require('node:crypto');
-    const ts = timestamp || Date.now();
-    const nonce = randomBytes(16).toString('hex');
-    const message = `${ts}.${nonce}.${payload}`;
-    const signature = createHmac('sha256', secretKey).update(message).digest('hex');
-    return {
-        'X-Zihin-Signature': `sha256=${signature}`,
-        'X-Zihin-Timestamp': ts.toString(),
-        'X-Zihin-Nonce': nonce,
-    };
-}
-//# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AA8DH,0CAsEC;AAmCD,gDAkBC;AAwCD,4CA8CC;AAiBD,oDAqBC;AAgBD,kCAkBC;AArVD,yCAAqC;AAErC,8FAA8F;AAC9F,4FAA4F;AAE5F,+CAA+C;AAC/C,sCAAsC;AACtC,+CAA+C;AAE/C,MAAM,mBAAmB,GAAG;IAC3B,QAAQ,EAAE,0BAA0B;IACpC,OAAO,EAAE,uBAAuB;IAChC,gCAAgC,EAAE,0BAA0B;IAC5D,aAAa,EAAE,2BAA2B;IAC1C,aAAa,EAAE,8BAA8B;IAC7C,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,iBAAiB;IAC1B,SAAS,EAAE,kBAAkB;IAC7B,SAAS,EAAE,oBAAoB;IAC/B,SAAS,EAAE,oBAAoB;CAC/B,CAAC;AAEF,MAAM,iBAAiB,GAAG;IACzB,WAAW;IACX,cAAc;IACd,0BAA0B,EAAE,eAAe;IAC3C,iBAAiB,EAAE,yBAAyB;IAC5C,oBAAoB;CACpB,CAAC;AAEF,MAAM,qBAAqB,GAAG;IAC7B,cAAc;IACd,cAAc;IACd,sBAAsB;IACtB,kBAAkB;CAClB,CAAC;AAcF;;;;;;;;;;GAUG;AACH,SAAgB,eAAe,CAC9B,GAAW,EACX,UAAgC,EAAE;IAElC,+BAA+B;IAC/B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,sBAAsB,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEjC,+CAA+C;QAC/C,MAAM,WAAW,GAChB,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,CAAC;QAE5E,6DAA6D;QAC7D,IAAI,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACtC,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO;gBACN,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,kDAAkD;aACzD,CAAC;QACH,CAAC;QAED,6BAA6B;QAC7B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;YACxE,CAAC;QACF,CAAC;QAED,qCAAqC;QACrC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAChC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;gBAChE,CAAC;YACF,CAAC;iBAAM,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC;gBACrE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;YAChE,CAAC;QACF,CAAC;QAED,uEAAuE;QACvE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CAClE,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,OAAO;oBACN,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,gFAAgF;iBACvF,CAAC;YACH,CAAC;QACF,CAAC;QAED,wCAAwC;QACxC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEzE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACtD,CAAC;AACF,CAAC;AAaD,MAAM,cAAc,GAAkB;IACrC,cAAc,EAAE,GAAG,GAAG,IAAI,EAAE,QAAQ;IACpC,eAAe,EAAE,GAAG;IACpB,qBAAqB,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO;IACzC,oBAAoB,EAAE,GAAG,GAAG,IAAI,EAAE,QAAQ;CAC1C,CAAC;AAmMO,wCAAc;AArLvB;;GAEG;AACH,SAAgB,kBAAkB,CACjC,MAAc,EACd,SAAiC,EAAE;IAEnC,MAAM,eAAe,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,IAAA,kBAAO,EAAC,MAAM,CAAC,CAAC;IAE9B,IAAI,KAAK,GAAG,eAAe,CAAC,cAAc,EAAE,CAAC;QAC5C,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,gBAAgB,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,gCAAgC,IAAI,CAAC,KAAK,CACxF,eAAe,CAAC,cAAc,GAAG,IAAI,CACrC,KAAK;YACN,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;SAC/B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;AACzD,CAAC;AAED,+CAA+C;AAC/C,wBAAwB;AACxB,+CAA+C;AAE/C,sFAAsF;AACtF,gGAAgG;AAChG,MAAM,kBAAkB,GAAG;IAC1B,qCAAqC,EAAE,WAAW;IAClD,4BAA4B,EAAE,gBAAgB;IAC9C,kCAAkC,EAAE,oBAAoB;IACxD,gBAAgB,EAAE,eAAe;IACjC,qBAAqB,EAAE,yBAAyB;CAChD,CAAC;AAEF,MAAM,cAAc,GAA2B;IAC9C,mBAAmB,EAAE,mDAAmD;IACxE,YAAY,EAAE,2DAA2D;IACzE,SAAS,EACR,gIAAgI;IACjI,aAAa,EAAE,uCAAuC;IACtD,cAAc,EAAE,qDAAqD;IACrE,OAAO,EAAE,gDAAgD;IACzD,eAAe,EAAE,qDAAqD;IACtE,oBAAoB,EAAE,0DAA0D;IAChF,uBAAuB,EAAE,mDAAmD;IAC5E,eAAe,EAAE,gDAAgD;CACjE,CAAC;AASF;;GAEG;AACH,SAAgB,gBAAgB,CAAC,KAAc;IAC9C,IAAI,OAAO,GAAG,8BAA8B,CAAC;IAC7C,IAAI,IAAwB,CAAC;IAC7B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,UAA8B,CAAC;IAEnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,KAAgC,CAAC;QAE7C,iFAAiF;QACjF,4FAA4F;QAC5F,MAAM,MAAM,GACX,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,KAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvF,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,GAAG,CAAC,OAAO,CAAY,CAAC;QAE/D,IAAI,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,EAAE,CAAC;YACzD,OAAO,GAAG,UAAU,CAAC;QACtB,CAAC;QAED,IAAI,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1D,SAAS,GAAG,IAAI,CAAC;YACjB,UAAU,GAAI,GAAG,CAAC,UAAqB,IAAI,EAAE,CAAC;QAC/C,CAAC;QAED,kFAAkF;QAClF,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAC1C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtC,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YAC1C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC1B,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,+CAA+C;AAC/C,wBAAwB;AACxB,+CAA+C;AAE/C,MAAM,eAAe,GAAG,wCAAwC,CAAC;AAQjE;;GAEG;AACH,SAAgB,oBAAoB,CAAC,MAAc;IAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAE9B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,OAAO;YACN,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,6EAA6E;SACpF,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;QAClD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;YAChC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,KAAK,CAAC;IAEV,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AACrC,CAAC;AAYD;;;GAGG;AACH,SAAgB,WAAW,CAC1B,OAAe,EACf,SAAiB,EACjB,SAAkB;IAElB,8DAA8D;IAC9D,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAC;IAC3F,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,EAAE,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;IAE5C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhF,OAAO;QACN,mBAAmB,EAAE,UAAU,SAAS,EAAE;QAC1C,mBAAmB,EAAE,EAAE,CAAC,QAAQ,EAAE;QAClC,eAAe,EAAE,KAAK;KACtB,CAAC;AACH,CAAC"}

package/dist/sse.d.ts

@@ -1,27 +0,0 @@
-/**
- * Parser de Server-Sent Events. Converte o corpo (ReadableStream) num async iterator de
- * eventos `{ event, data }`, com `data` já parseado de JSON quando possível.
- *
- * Robustez:
- *  - limites de tamanho (maxEventBytes / maxTotalBytes) → aborta com `protocol` (anti-DoS de memória).
- *  - parse incremental O(n) (sem replace global no buffer acumulado).
- *  - `reader.cancel()` no finally → fecha a conexão mesmo em `break`/erro (sem socket vazado).
- *
- * @module sse
- */
-export interface SseEvent {
-    event: string;
-    data: unknown;
-    rawData: string;
-}
-export interface ParseSseOptions {
-    /** Signal do chamador, para checagem de abort entre leituras. */
-    signal?: AbortSignal;
-    /** Traduz uma rejeição de read()/abort para o erro correto (timeout/aborted/network). */
-    onAbortError?: () => Error;
-    /** Chamado no finally (libera deadline/recursos). */
-    onEnd?: () => void;
-    maxEventBytes?: number;
-    maxTotalBytes?: number;
-}
-export declare function parseSse(response: Response, opts?: ParseSseOptions): AsyncGenerator<SseEvent>;

package/dist/sse.js

@@ -1,138 +0,0 @@
-"use strict";
-/**
- * Parser de Server-Sent Events. Converte o corpo (ReadableStream) num async iterator de
- * eventos `{ event, data }`, com `data` já parseado de JSON quando possível.
- *
- * Robustez:
- *  - limites de tamanho (maxEventBytes / maxTotalBytes) → aborta com `protocol` (anti-DoS de memória).
- *  - parse incremental O(n) (sem replace global no buffer acumulado).
- *  - `reader.cancel()` no finally → fecha a conexão mesmo em `break`/erro (sem socket vazado).
- *
- * @module sse
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseSse = parseSse;
-const errors_1 = require("./errors");
-const internal_1 = require("./internal");
-const DEFAULT_MAX_EVENT_BYTES = 1 * 1024 * 1024;
-const DEFAULT_MAX_TOTAL_BYTES = 64 * 1024 * 1024;
-async function* parseSse(response, opts = {}) {
-    if (!response.body) {
-        throw new errors_1.ZihinAgentError('protocol', 'SSE response has no body.');
-    }
-    const maxEventBytes = opts.maxEventBytes ?? DEFAULT_MAX_EVENT_BYTES;
-    const maxTotalBytes = opts.maxTotalBytes ?? DEFAULT_MAX_TOTAL_BYTES;
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder('utf-8');
-    let buffer = '';
-    let eventName = '';
-    let dataLines = [];
-    let dataBytes = 0;
-    let totalBytes = 0;
-    const flush = () => {
-        const had = dataLines.length > 0 || eventName !== '';
-        const rawData = dataLines.join('\n');
-        const evt = eventName || 'message';
-        eventName = '';
-        dataLines = [];
-        dataBytes = 0;
-        if (!had || rawData === '')
-            return null;
-        let data = rawData;
-        try {
-            data = JSON.parse(rawData);
-        }
-        catch {
-            /* mantém string crua */
-        }
-        return { event: evt, data, rawData };
-    };
-    try {
-        // eslint-disable-next-line no-constant-condition
-        while (true) {
-            if (opts.signal?.aborted) {
-                throw opts.onAbortError ? opts.onAbortError() : new errors_1.ZihinAgentError('aborted', 'Stream aborted.');
-            }
-            let chunk;
-            try {
-                chunk = await reader.read();
-            }
-            catch (err) {
-                throw opts.onAbortError ? opts.onAbortError() : (0, errors_1.errorFromThrow)(err);
-            }
-            if (chunk.done)
-                break;
-            totalBytes += chunk.value.byteLength;
-            if (totalBytes > maxTotalBytes) {
-                throw new errors_1.ZihinAgentError('protocol', `SSE stream exceeded ${maxTotalBytes} bytes.`);
-            }
-            buffer += decoder.decode(chunk.value, { stream: true });
-            let nl;
-            while ((nl = buffer.indexOf('\n')) !== -1) {
-                let line = buffer.slice(0, nl);
-                buffer = buffer.slice(nl + 1);
-                if (line.endsWith('\r'))
-                    line = line.slice(0, -1); // \r\n sem replace global (P3)
-                if (line === '') {
-                    const e = flush();
-                    if (e)
-                        yield e;
-                    continue;
-                }
-                if (line.startsWith(':'))
-                    continue; // comentário/keep-alive
-                const colon = line.indexOf(':');
-                const field = colon === -1 ? line : line.slice(0, colon);
-                let val = colon === -1 ? '' : line.slice(colon + 1);
-                if (val.startsWith(' '))
-                    val = val.slice(1);
-                if (field === 'event') {
-                    eventName = val;
-                }
-                else if (field === 'data') {
-                    dataBytes += (0, internal_1.utf8Len)(val) + 1;
-                    if (dataBytes > maxEventBytes) {
-                        throw new errors_1.ZihinAgentError('protocol', `SSE event exceeded ${maxEventBytes} bytes.`);
-                    }
-                    dataLines.push(val);
-                }
-                // `id`/`retry` ignorados (sem reconexão automática aqui).
-            }
-            // Linha sem `\n` ainda em buffer não pode crescer sem teto (S2).
-            if ((0, internal_1.utf8Len)(buffer) > maxEventBytes) {
-                throw new errors_1.ZihinAgentError('protocol', `SSE line exceeded ${maxEventBytes} bytes.`);
-            }
-        }
-        // Flush final do decoder (caractere multibyte partido no fim do stream) e processa
-        // uma última linha `data:`/`event:` que tenha chegado sem o `\n` terminal.
-        buffer += decoder.decode();
-        if (buffer.length > 0) {
-            let line = buffer.endsWith('\r') ? buffer.slice(0, -1) : buffer;
-            if (line && !line.startsWith(':')) {
-                const colon = line.indexOf(':');
-                const field = colon === -1 ? line : line.slice(0, colon);
-                let val = colon === -1 ? '' : line.slice(colon + 1);
-                if (val.startsWith(' '))
-                    val = val.slice(1);
-                if (field === 'data')
-                    dataLines.push(val);
-                else if (field === 'event')
-                    eventName = val;
-            }
-        }
-        const tail = flush();
-        if (tail)
-            yield tail;
-    }
-    finally {
-        // Fecha a conexão também em break/throw (P2: sem socket vazado). cancel() libera o lock.
-        try {
-            await reader.cancel();
-        }
-        catch {
-            /* ignore */
-        }
-        opts.onEnd?.();
-    }
-}
-//# sourceMappingURL=sse.js.map

package/dist/sse.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sse.js","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AAyBH,4BAsHC;AA7ID,qCAA2D;AAC3D,yCAAqC;AAmBrC,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAChD,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,KAAK,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAkB,EAAE,OAAwB,EAAE;IAC7E,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,wBAAe,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,uBAAuB,CAAC;IAEpE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,MAAM,KAAK,GAAG,GAAoB,EAAE;QACnC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,KAAK,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,SAAS,IAAI,SAAS,CAAC;QACnC,SAAS,GAAG,EAAE,CAAC;QACf,SAAS,GAAG,EAAE,CAAC;QACf,SAAS,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,GAAG,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,IAAI,GAAY,OAAO,CAAC;QAC5B,IAAI,CAAC;YACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACR,wBAAwB;QACzB,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACtC,CAAC,CAAC;IAEF,IAAI,CAAC;QACJ,iDAAiD;QACjD,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,wBAAe,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;YACnG,CAAC;YAED,IAAI,KAA8C,CAAC;YACnD,IAAI,CAAC;gBACJ,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAA,uBAAc,EAAC,GAAG,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,KAAK,CAAC,IAAI;gBAAE,MAAM;YAEtB,UAAU,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YACrC,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;gBAChC,MAAM,IAAI,wBAAe,CAAC,UAAU,EAAE,uBAAuB,aAAa,SAAS,CAAC,CAAC;YACtF,CAAC;YAED,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAExD,IAAI,EAAU,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC3C,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC/B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B;gBAElF,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBACjB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;oBAClB,IAAI,CAAC;wBAAE,MAAM,CAAC,CAAC;oBACf,SAAS;gBACV,CAAC;gBACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS,CAAC,wBAAwB;gBAE5D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACzD,IAAI,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACpD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAE5C,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;oBACvB,SAAS,GAAG,GAAG,CAAC;gBACjB,CAAC;qBAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;oBAC7B,SAAS,IAAI,IAAA,kBAAO,EAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,SAAS,GAAG,aAAa,EAAE,CAAC;wBAC/B,MAAM,IAAI,wBAAe,CAAC,UAAU,EAAE,sBAAsB,aAAa,SAAS,CAAC,CAAC;oBACrF,CAAC;oBACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;gBACD,0DAA0D;YAC3D,CAAC;YAED,iEAAiE;YACjE,IAAI,IAAA,kBAAO,EAAC,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;gBACrC,MAAM,IAAI,wBAAe,CAAC,UAAU,EAAE,qBAAqB,aAAa,SAAS,CAAC,CAAC;YACpF,CAAC;QACF,CAAC;QAED,mFAAmF;QACnF,2EAA2E;QAC3E,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAChE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAChC,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBACzD,IAAI,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACpD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC5C,IAAI,KAAK,KAAK,MAAM;oBAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;qBACrC,IAAI,KAAK,KAAK,OAAO;oBAAE,SAAS,GAAG,GAAG,CAAC;YAC7C,CAAC;QACF,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;QACrB,IAAI,IAAI;YAAE,MAAM,IAAI,CAAC;IACtB,CAAC;YAAS,CAAC;QACV,yFAAyF;QACzF,IAAI,CAAC;YACJ,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACR,YAAY;QACb,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,CAAC;AACF,CAAC"}

package/dist/triggers.d.ts

@@ -1,43 +0,0 @@
-/**
- * Caminho B — invocação assíncrona/desacoplada via sistema de triggers.
- *  - createTrigger: provisiona (1x) um webhook ligado a um agente (POST /api/triggers).
- *  - dispatchAgent: dispara o trigger (POST /api/triggers/webhook/:id) → 202 (async) | JSON (sync).
- *  - getExecution: consulta o resultado (GET /api/triggers/:id/executions/:execId).
- *
- * Requer key role admin/editor (triggers:create / telemetry:read). Keys `member` → 403.
- *
- * @module triggers
- */
-import { type ResolvedConfig } from './http';
-import type { CreateTriggerParams, DeleteTriggerParams, DispatchAgentParams, DispatchResult, ExecutionStatus, FindOrCreateResult, GetExecutionParams, GetTriggerParams, ListTriggersParams, TriggerInfo, TriggerRef } from './types';
-/**
- * Provisiona um trigger de webhook ligado a um agente. Faça isto uma vez; depois dispare
- * quantas vezes quiser com `dispatchAgent`.
- */
-export declare function createTrigger(cfg: ResolvedConfig, params: CreateTriggerParams): Promise<TriggerRef>;
-/**
- * Dispara um trigger. Em modo async retorna `{ accepted, executionId }` (202);
- * em modo sync retorna também `{ agentResponse, usage }` (200).
- */
-export declare function dispatchAgent(cfg: ResolvedConfig, params: DispatchAgentParams): Promise<DispatchResult>;
-/** Lista os triggers do tenant (opcionalmente filtrando por agente/tipo/habilitados). */
-export declare function listTriggers(cfg: ResolvedConfig, params?: ListTriggersParams): Promise<TriggerInfo[]>;
-/** Obtém um trigger pelo id (inclui webhookUrl para webhooks). */
-export declare function getTrigger(cfg: ResolvedConfig, params: GetTriggerParams): Promise<TriggerInfo>;
-/** Remove um trigger. Requer key role admin/owner (editor NÃO pode deletar → 403). */
-export declare function deleteTrigger(cfg: ResolvedConfig, params: DeleteTriggerParams): Promise<{
-    deleted: boolean;
-}>;
-/**
- * Reaproveita um trigger existente do mesmo agente+nome, ou cria um novo. Evita o footgun de
- * duplicação (o BE não tem unicidade de nome). Retorna `created: false` se reusou.
- *
- * Nota: se um trigger com o mesmo nome já existe mas com config diferente (ex.: outra callbackUrl),
- * ele é REAPROVEITADO como está — atualize explicitamente com o BE se precisar reconciliar.
- */
-export declare function findOrCreateTrigger(cfg: ResolvedConfig, params: CreateTriggerParams): Promise<FindOrCreateResult>;
-/**
- * Consulta o status/resultado de uma execução disparada por trigger.
- * Útil para polling no modo async (alternativa ao callback).
- */
-export declare function getExecution(cfg: ResolvedConfig, params: GetExecutionParams): Promise<ExecutionStatus>;