managed-deepagents 0.10.0-dev.15 → 0.10.0-dev.16

package/dist/channels/http/endpoint.d.ts

@@ -1,84 +0,0 @@
-import { z } from "zod";
-import type { ChannelRunResult } from "../run-input.js";
-import type { JsonValue } from "../types.js";
-/**
- * The deployment's env var holding the secret it shares with your services:
- * every event endpoint request is signed with it, as Standard Webhooks does.
- * Several, separated by whitespace or commas, each sign the request, for
- * rotation.
- */
-export declare const SERVICE_SECRET_ENV = "MDA_SERVICE_SECRET";
-/**
- * Where an `onEvent` key's events go when a service of yours decides what
- * they start: its URL, or a `Request` that also carries headers, such as a
- * credential the service checks. See {@link endpointHandler}.
- */
-export type EventEndpoint = string | URL | Request;
-/** The key a Standard Webhooks secret stands for; a malformed one throws. */
-export declare function signingKey(secret: string): Buffer;
-/**
- * The Standard Webhooks headers that sign one request with `keys`: none
- * without a key. Each key signs `<id>.<timestamp>.<body>`.
- */
-export declare function signatureHeaders(keys: readonly Buffer[], id: string, timestamp: number, body: string): Record<string, string>;
-/** A channel's event, by the fields an endpoint is sent. */
-type ChannelEvent = {
-    key: string;
-    deliveryId: string;
-    payload: unknown;
-};
-/**
- * The fields a channel adds to the event it sends an endpoint, beside its key,
- * delivery ID and payload, such as the handles a GitHub event mentions.
- */
-export type EventFields<E> = (event: E) => Record<string, JsonValue>;
-/**
- * The event a channel sends its endpoint: the event key, the provider's
- * delivery ID and its payload, and the channel's own fields `X`. For a union
- * of events, the payload is typed by the key.
- */
-export type EndpointEvent<E extends ChannelEvent = ChannelEvent, X extends keyof E = never> = E extends unknown ? Pick<E, "key" | "deliveryId" | "payload" | X> : never;
-/** The conversation's thread an endpoint request is about. */
-export interface EndpointThread {
-    /** The thread the run starts on, or that waits on an interrupt. */
-    id: string;
-    channel: {
-        name: string;
-    };
-    /** Set when the thread waits on an interrupt: no run starts, whatever the answer. */
-    interrupted?: true;
-}
-/** What a channel POSTs its endpoint: the event, and the thread it belongs to. */
-export interface EndpointRequest<E extends ChannelEvent = ChannelEvent, X extends keyof E = never> {
-    event: EndpointEvent<E, X>;
-    thread: EndpointThread;
-}
-declare const answerSchema: z.ZodObject<{
-    input: z.ZodCustom<JsonValue, JsonValue>;
-    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodCustom<JsonValue, JsonValue>>>;
-    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodCustom<JsonValue, JsonValue>>>;
-    webhook: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-/**
- * What an endpoint answers: the run's input, as a handler returns it (text,
- * or state such as `{ messages }`), with the run options a handler may set,
- * all JSON. An endpoint answers `null` (or HTTP 204) instead to start nothing.
- * The channel checks an answer against the same schema.
- */
-export type EndpointAnswer = z.infer<typeof answerSchema>;
-/** Whether an `onEvent` value is an endpoint rather than a handler function. */
-export declare function isEventEndpoint(value: unknown): value is EventEndpoint;
-/**
- * The handler an endpoint stands for. When the event's thread takes a turn,
- * MDA POSTs `{ event: { key, deliveryId, payload }, thread: { id, channel,
- * interrupted? } }` as JSON to the endpoint's URL, with the channel's own
- * event `fields` beside the payload and a `Request`'s headers,
- * signed when the deployment has `MDA_SERVICE_SECRET`, and starts the
- * run the service answers with: `{ input, context?, metadata?, webhook? }`.
- * `null` or HTTP 204 starts nothing. Any other answer, a
- * redirect, or no answer within 60 seconds fails the handler, as a handler
- * that throws does. The URL is http(s), without credentials in it.
- */
-export declare function endpointHandler<E extends ChannelEvent = ChannelEvent>(endpoint: EventEndpoint, label: string, fields?: EventFields<E>): (event: E, thread: EndpointThread) => Promise<ChannelRunResult | null>;
-export {};
-//# sourceMappingURL=endpoint.d.ts.map

package/dist/channels/http/endpoint.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../../../src/channels/http/endpoint.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAQvD;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC;AAmBnD,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAejD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAaxB;AAED,4DAA4D;AAC5D,KAAK,YAAY,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1E;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAErE;;;;GAIG;AACH,MAAM,MAAM,aAAa,CACvB,CAAC,SAAS,YAAY,GAAG,YAAY,EACrC,CAAC,SAAS,MAAM,CAAC,GAAG,KAAK,IACvB,CAAC,SAAS,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG,YAAY,GAAG,SAAS,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;AAE9E,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B,qFAAqF;IACrF,WAAW,CAAC,EAAE,IAAI,CAAC;CACpB;AAED,kFAAkF;AAClF,MAAM,WAAW,eAAe,CAC9B,CAAC,SAAS,YAAY,GAAG,YAAY,EACrC,CAAC,SAAS,MAAM,CAAC,GAAG,KAAK;IAEzB,KAAK,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,QAAA,MAAM,YAAY;;;;;kBAQhB,CAAC;AAEH;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAE1D,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAMtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,EACnE,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,GACtB,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAgDxE"}

package/dist/channels/http/endpoint.js

@@ -1,206 +0,0 @@
-/**
- * Event endpoints: an `onEvent` value that is a URL or a `Request` rather than
- * a function. MDA asks that service of yours what the event starts, for logic
- * that lives outside the deployment.
- */
-import { createHmac } from "node:crypto";
-import { z } from "zod";
-import { jsonValueSchema } from "../message-schema.js";
-/** How long the service may take to answer. */
-const TIMEOUT_MS = 60_000;
-/** The largest answer read; run input may carry images. */
-const MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
-const ANSWER_SHAPE = "event endpoint answer must be null or { input, context?, metadata?, webhook? }";
-/**
- * The deployment's env var holding the secret it shares with your services:
- * every event endpoint request is signed with it, as Standard Webhooks does.
- * Several, separated by whitespace or commas, each sign the request, for
- * rotation.
- */
-export const SERVICE_SECRET_ENV = "MDA_SERVICE_SECRET";
-/** Standard Webhooks' optional secret prefix. */
-const SECRET_PREFIX = "whsec_";
-/** The key sizes Standard Webhooks allows, in bytes. */
-const MIN_KEY_BYTES = 24;
-const MAX_KEY_BYTES = 64;
-const SECRET_SHAPE = `${SERVICE_SECRET_ENV} must hold Standard Webhooks secrets: padded base64 of 24 to 64 bytes, optionally prefixed with whsec_`;
-let cachedKeys;
-/** The signing keys `MDA_SERVICE_SECRET` holds; none when it's unset. */
-function signingKeys() {
-    const secrets = process.env[SERVICE_SECRET_ENV]?.trim() ?? "";
-    if (cachedKeys?.secrets !== secrets)
-        cachedKeys = {
-            secrets,
-            // Stray separators, as rotation leaves behind, name no secret.
-            keys: secrets
-                .split(/[\s,]+/)
-                .filter(Boolean)
-                .map(signingKey),
-        };
-    return cachedKeys.keys;
-}
-/** The key a Standard Webhooks secret stands for; a malformed one throws. */
-export function signingKey(secret) {
-    const encoded = secret.startsWith(SECRET_PREFIX)
-        ? secret.slice(SECRET_PREFIX.length)
-        : secret;
-    // Buffer.from skips characters that aren't base64 and missing padding; the
-    // round trip refuses both, as Standard Webhooks libraries' decoders do.
-    const key = Buffer.from(encoded, "base64");
-    if (!encoded ||
-        key.toString("base64") !== encoded ||
-        key.byteLength < MIN_KEY_BYTES ||
-        key.byteLength > MAX_KEY_BYTES)
-        throw new TypeError(SECRET_SHAPE);
-    return key;
-}
-/**
- * The Standard Webhooks headers that sign one request with `keys`: none
- * without a key. Each key signs `<id>.<timestamp>.<body>`.
- */
-export function signatureHeaders(keys, id, timestamp, body) {
-    if (!keys.length)
-        return {};
-    const signed = `${id}.${timestamp}.${body}`;
-    return {
-        "webhook-id": id,
-        "webhook-timestamp": String(timestamp),
-        "webhook-signature": keys
-            .map((key) => `v1,${createHmac("sha256", key).update(signed).digest("base64")}`)
-            .join(" "),
-    };
-}
-const answerSchema = z.strictObject({
-    input: jsonValueSchema,
-    /** Run context, as `agent.invoke(input, { context })` takes it. */
-    context: z.record(z.string(), jsonValueSchema).optional(),
-    /** Metadata for the run; see `ChannelRunOptions`. */
-    metadata: z.record(z.string(), jsonValueSchema).optional(),
-    /** A URL the Agent Server POSTs the finished run to; see `ChannelRunOptions`. */
-    webhook: z.string().optional(),
-});
-/** Whether an `onEvent` value is an endpoint rather than a handler function. */
-export function isEventEndpoint(value) {
-    return (typeof value === "string" ||
-        value instanceof URL ||
-        value instanceof Request);
-}
-/**
- * The handler an endpoint stands for. When the event's thread takes a turn,
- * MDA POSTs `{ event: { key, deliveryId, payload }, thread: { id, channel,
- * interrupted? } }` as JSON to the endpoint's URL, with the channel's own
- * event `fields` beside the payload and a `Request`'s headers,
- * signed when the deployment has `MDA_SERVICE_SECRET`, and starts the
- * run the service answers with: `{ input, context?, metadata?, webhook? }`.
- * `null` or HTTP 204 starts nothing. Any other answer, a
- * redirect, or no answer within 60 seconds fails the handler, as a handler
- * that throws does. The URL is http(s), without credentials in it.
- */
-export function endpointHandler(endpoint, label, fields) {
-    const template = endpoint instanceof Request ? endpoint : undefined;
-    const target = endpointUrl(template ? template.url : String(endpoint), label);
-    const baseHeaders = new Headers(template?.headers);
-    baseHeaders.set("content-type", "application/json");
-    baseHeaders.set("accept", "application/json");
-    return async (event, thread) => {
-        const request = {
-            event: {
-                ...fields?.(event),
-                key: event.key,
-                deliveryId: event.deliveryId,
-                payload: event.payload,
-            },
-            thread: {
-                id: thread.id,
-                channel: { name: thread.channel.name },
-                ...(thread.interrupted && { interrupted: true }),
-            },
-        };
-        // The exact bytes sent are the ones signed.
-        const body = JSON.stringify(request);
-        const headers = new Headers(baseHeaders);
-        const signature = signatureHeaders(signingKeys(), `msg_${event.deliveryId}`, Math.floor(Date.now() / 1000), body);
-        for (const [name, value] of Object.entries(signature))
-            headers.set(name, value);
-        const response = await fetch(target, {
-            method: "POST",
-            headers,
-            body,
-            redirect: "manual",
-            signal: AbortSignal.timeout(TIMEOUT_MS),
-        });
-        if (response.status === 204) {
-            await response.body?.cancel();
-            return null;
-        }
-        if (!response.ok) {
-            await response.body?.cancel();
-            throw new Error(`event endpoint answered HTTP ${response.status}`);
-        }
-        return runResult(await boundedJson(response));
-    };
-}
-function endpointUrl(url, label) {
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch {
-        parsed = undefined;
-    }
-    if (!parsed ||
-        (parsed.protocol !== "https:" && parsed.protocol !== "http:") ||
-        parsed.username ||
-        parsed.password)
-        throw new TypeError(`${label} must be an absolute http(s) URL, without credentials in it`);
-    return parsed.href;
-}
-/** The answer as JSON, read only up to `MAX_RESPONSE_BYTES`. */
-async function boundedJson(response) {
-    const declared = Number(response.headers.get("content-length"));
-    if (declared > MAX_RESPONSE_BYTES) {
-        await response.body?.cancel();
-        throw new Error("event endpoint answer is too large");
-    }
-    const reader = response.body?.getReader();
-    const chunks = [];
-    let size = 0;
-    for (;;) {
-        const chunk = await reader?.read();
-        if (!chunk || chunk.done)
-            break;
-        size += chunk.value.byteLength;
-        if (size > MAX_RESPONSE_BYTES) {
-            await reader?.cancel();
-            throw new Error("event endpoint answer is too large");
-        }
-        chunks.push(chunk.value);
-    }
-    const text = new TextDecoder().decode(chunks.length === 1 ? chunks[0] : concat(chunks, size));
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        throw new Error("event endpoint answer is not JSON");
-    }
-}
-function concat(chunks, size) {
-    const joined = new Uint8Array(size);
-    let offset = 0;
-    for (const chunk of chunks) {
-        joined.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    return joined;
-}
-/** The run the answer names; the channel checks the input and options as a handler's. */
-function runResult(body) {
-    const parsed = answerSchema.nullable().safeParse(body);
-    if (!parsed.success)
-        throw new Error(ANSWER_SHAPE);
-    if (parsed.data === null)
-        return null;
-    const { input, ...options } = parsed.data;
-    return (Object.keys(options).length ? [input, options] : input);
-}
-//# sourceMappingURL=endpoint.js.map

package/dist/channels/http/endpoint.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../../src/channels/http/endpoint.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAIvD,+CAA+C;AAC/C,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,2DAA2D;AAC3D,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,YAAY,GAChB,gFAAgF,CAAC;AACnF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AACvD,iDAAiD;AACjD,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,wDAAwD;AACxD,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,YAAY,GAAG,GAAG,kBAAkB,wGAAwG,CAAC;AASnJ,IAAI,UAAoE,CAAC;AAEzE,yEAAyE;AACzE,SAAS,WAAW;IAClB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,UAAU,EAAE,OAAO,KAAK,OAAO;QACjC,UAAU,GAAG;YACX,OAAO;YACP,+DAA+D;YAC/D,IAAI,EAAE,OAAO;iBACV,KAAK,CAAC,QAAQ,CAAC;iBACf,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,UAAU,CAAC;SACnB,CAAC;IACJ,OAAO,UAAU,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC;QAC9C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC;QACpC,CAAC,CAAC,MAAM,CAAC;IACX,2EAA2E;IAC3E,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,IACE,CAAC,OAAO;QACR,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,OAAO;QAClC,GAAG,CAAC,UAAU,GAAG,aAAa;QAC9B,GAAG,CAAC,UAAU,GAAG,aAAa;QAE9B,MAAM,IAAI,SAAS,CAAC,YAAY,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAuB,EACvB,EAAU,EACV,SAAiB,EACjB,IAAY;IAEZ,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;IAC5C,OAAO;QACL,YAAY,EAAE,EAAE;QAChB,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC;QACtC,mBAAmB,EAAE,IAAI;aACtB,GAAG,CACF,CAAC,GAAG,EAAE,EAAE,CACN,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CACpE;aACA,IAAI,CAAC,GAAG,CAAC;KACb,CAAC;AACJ,CAAC;AAuCD,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IAClC,KAAK,EAAE,eAAe;IACtB,mEAAmE;IACnE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE;IACzD,qDAAqD;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE;IAC1D,iFAAiF;IACjF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAUH,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,YAAY,GAAG;QACpB,KAAK,YAAY,OAAO,CACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAuB,EACvB,KAAa,EACb,MAAuB;IAEvB,MAAM,QAAQ,GAAG,QAAQ,YAAY,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,WAAW,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACpD,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC9C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAoB;YAC/B,KAAK,EAAE;gBACL,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC;gBAClB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB;YACD,MAAM,EAAE;gBACN,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;gBACtC,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;aACjD;SACF,CAAC;QACF,4CAA4C;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,gBAAgB,CAChC,WAAW,EAAE,EACb,OAAO,KAAK,CAAC,UAAU,EAAE,EACzB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAC7B,IAAI,CACL,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;YACJ,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW,EAAE,KAAa;IAC7C,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,IACE,CAAC,MAAM;QACP,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QAC7D,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QAEf,MAAM,IAAI,SAAS,CACjB,GAAG,KAAK,6DAA6D,CACtE,CAAC;IACJ,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,WAAW,CAAC,QAAkB;IAC3C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChE,IAAI,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QAClC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI;YAAE,MAAM;QAChC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;QAC/B,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAC9B,MAAM,MAAM,EAAE,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACnC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CACvD,CAAC;IACF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAoB,EAAE,IAAY;IAChD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yFAAyF;AACzF,SAAS,SAAS,CAAC,IAAa;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1C,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CACnC,CAAC;AACxB,CAAC"}

package/dist/channels/http/provider.d.ts

@@ -1,111 +0,0 @@
-import type { JsonObject } from "../manifest.js";
-import type { JsonValue } from "../types.js";
-import type { ChannelRunResult } from "../run-input.js";
-import type { HttpChannel } from "./index.js";
-import type { HttpChannelAdapter, HttpFinishedDelivery } from "./types.js";
-import { type EventEndpoint, type EventFields } from "./endpoint.js";
-/** The channel's name in the project, or its provider before it has one. */
-export declare function channelName(channel: HttpChannel): string;
-/**
- * Check a channel's `onEvent` keys. The types limit them, but a JavaScript
- * caller or a cast gets no error, and a key nothing dispatches never runs.
- */
-export declare function checkEventKeys(provider: string, handlers: object, supported: ReadonlySet<string>): void;
-/**
- * A channel's `onEvent` with each endpoint, a URL or `Request`, replaced by
- * the handler it stands for, so the channel calls handlers alone. `fields` are
- * the channel's own event fields its endpoints are sent. A bad endpoint throws
- * when the channel is declared.
- */
-export declare function resolveEndpoints<T extends object, E = never>(provider: string, onEvent: T | undefined, fields?: EventFields<E>): {
-    [K in keyof T]: Exclude<T[K], EventEndpoint>;
-};
-/**
- * A provider channel's `onFinish`: a delivery of one of its events is done,
- * with the event, its thread, and the run it started and the decisions the
- * thread waits on; see `channels.http`'s `onFinish`.
- */
-export type EventFinished<E, T = EventThread> = (event: E, thread: T, finished: Pick<HttpFinishedDelivery, "run" | "interrupts">) => void | Promise<void>;
-/** The thread a provider channel's hooks hear about. */
-export interface EventThread {
-    id: string;
-    channel: {
-        name: string;
-    };
-}
-/**
- * The HTTP channel's `onFinish` for a provider channel: the channel's own
- * notice first, such as a link to a pending decision, then the user's hook,
- * for the deliveries whose event the channel parsed. A failing notice is
- * logged and doesn't keep the user's hook from running.
- */
-export declare function finishEvents<E>(notice: NonNullable<HttpChannelAdapter["onFinish"]>, onFinish: EventFinished<E> | undefined, parse: (rawEvent: JsonValue | undefined) => E | undefined, name: () => string): HttpChannelAdapter["onFinish"];
-/**
- * A provider channel's `onReceived`: a delivery of one of its events reached
- * its thread, before MDA reads the thread; see `channels.http`'s `onReceived`.
- */
-export type EventReceived<E, T = EventThread> = (event: E, thread: T) => void | Promise<void>;
-/**
- * The HTTP channel's `onReceived` for a provider channel's user hook, for the
- * deliveries whose event the channel parsed.
- */
-export declare function receiveEvents<E>(onReceived: EventReceived<E> | undefined, parse: (rawEvent: JsonValue | undefined) => E | undefined, name: () => string): HttpChannelAdapter["onReceived"];
-/** The events deploy subscribes the provider's webhook to: the handled ones. */
-export declare function handledEventKeys(handlers: object): string[];
-/**
- * The connection `mda deploy` stores for the provider's app, or one of the
- * values stored beside it, such as `webhook-secret`, when `suffix` is given.
- */
-export declare function appConnectionSlug(provider: string, deploymentId: string, suffix?: string): string;
-/**
- * A frozen copy of a parsed event, kept as the delivery's raw event so a
- * handler that changes its argument can't change what MDA keeps.
- */
-export declare function eventSnapshot(event: unknown, provider: string): JsonValue;
-/** App options for deploy, without unset fields. */
-export declare function definedFields(fields: Record<string, JsonValue | undefined>): JsonObject;
-/**
- * Whether `signature`, a hex HMAC-SHA256 the caller checked the format of,
- * signs `rawBody` with `secret`. Compared in constant time.
- */
-export declare function verifyHmacSha256(secret: string, rawBody: Uint8Array, signature: string): boolean;
-/**
- * A value read at most every `ttlMs(value)` milliseconds. Concurrent callers
- * share the read in flight; a failed read is not kept, so the next call reads
- * again.
- */
-export declare class CachedRead<T> {
-    #private;
-    private readonly read;
-    private readonly ttlMs;
-    constructor(read: () => Promise<T>, ttlMs: (value: T) => number);
-    get(): Promise<T>;
-    /** Read again on the next call. */
-    reset(): void;
-}
-/**
- * A value `mda deploy` stored for the deployment, such as a webhook secret:
- * the `env` override when set, otherwise the agent secret Agent Auth keeps at
- * `slug(deploymentId)`. Only a missing connection reads as `undefined`, and is
- * logged as `label`; credential store failures propagate.
- */
-export declare function readDeploymentSecret(env: string, slug: (deploymentId: string) => string, label: string): Promise<string | undefined>;
-/** Forget values read from Agent Auth; for tests. */
-export declare function resetDeploymentSecrets(): void;
-/** What an event's handler did: returned run input, skipped, or threw. */
-export type EventHandlerOutcome = {
-    type: "input";
-    input: ChannelRunResult;
-} | {
-    type: "skipped";
-} | {
-    type: "failed";
-};
-/** What an event handler returns: run input, or nothing to skip. */
-export type EventHandlerResult = ChannelRunResult | null | undefined | void;
-/** Run an event's handler. A throw is logged, not raised. */
-export declare function runEventHandler(provider: string, event: {
-    key: string;
-    deliveryId: string;
-}, call: () => EventHandlerResult | Promise<EventHandlerResult>): Promise<EventHandlerOutcome>;
-//# sourceMappingURL=provider.d.ts.map

package/dist/channels/http/provider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../src/channels/http/provider.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAE3E,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,WAAW,EACjB,MAAM,eAAe,CAAC;AAOvB,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAExD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,GAC7B,IAAI,CAMN;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,GAAG,KAAK,EAC1D,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,GAAG,SAAS,EACtB,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,GACtB;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC;CAAE,CAiBlD;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,IAAI,CAC9C,KAAK,EAAE,CAAC,EACR,MAAM,EAAE,CAAC,EACT,QAAQ,EAAE,IAAI,CAAC,oBAAoB,EAAE,KAAK,GAAG,YAAY,CAAC,KACvD,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,MAAM,EAAE,WAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,EACnD,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,EACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,GAAG,SAAS,KAAK,CAAC,GAAG,SAAS,EACzD,IAAI,EAAE,MAAM,MAAM,GACjB,kBAAkB,CAAC,UAAU,CAAC,CAoBhC;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,IAAI,CAC9C,KAAK,EAAE,CAAC,EACR,MAAM,EAAE,CAAC,KACN,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAC7B,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,EACxC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,GAAG,SAAS,KAAK,CAAC,GAAG,SAAS,EACzD,IAAI,EAAE,MAAM,MAAM,GACjB,kBAAkB,CAAC,YAAY,CAAC,CAUlC;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAK3D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAGR;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAGzE;AAED,oDAAoD;AACpD,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC,GAC5C,UAAU,CAKZ;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,MAAM,GAChB,OAAO,CAIT;AAED;;;;GAIG;AACH,qBAAa,UAAU,CAAC,CAAC;;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFxB,YACmB,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACtB,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,EAC1C;IAEJ,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAkBhB;IAED,mCAAmC;IACnC,KAAK,IAAI,IAAI,CAEZ;CACF;AAQD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,EACtC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoB7B;AAED,qDAAqD;AACrD,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED,0EAA0E;AAC1E,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEvB,oEAAoE;AACpE,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAAC;AAE5E,6DAA6D;AAC7D,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC1C,IAAI,EAAE,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,GAC3D,OAAO,CAAC,mBAAmB,CAAC,CAgB9B"}

package/dist/channels/http/provider.js

@@ -1,209 +0,0 @@
-/**
- * What webhook channels built on `httpChannel`, such as GitHub and Linear,
- * share: their name, the events they subscribe to, the secrets they read from
- * Agent Auth, signature checks, running an event's handler, and the hooks
- * that hand their typed events to the user.
- */
-import { createHmac, timingSafeEqual } from "node:crypto";
-import { isJsonValue } from "../message-schema.js";
-import { immutableCopy } from "../runtime.js";
-import { logger } from "../../runtime/log.js";
-import { endpointHandler, isEventEndpoint, } from "./endpoint.js";
-import { ConnectionNotFoundError, DEPLOYMENT_ID_ENV, connections, } from "../../connections.js";
-/** The channel's name in the project, or its provider before it has one. */
-export function channelName(channel) {
-    return channel.name ?? channel.kind;
-}
-/**
- * Check a channel's `onEvent` keys. The types limit them, but a JavaScript
- * caller or a cast gets no error, and a key nothing dispatches never runs.
- */
-export function checkEventKeys(provider, handlers, supported) {
-    const unknown = Object.keys(handlers).filter((key) => !supported.has(key));
-    if (unknown.length)
-        throw new TypeError(`unsupported ${provider} event key ${unknown.sort().join(", ")}`);
-}
-/**
- * A channel's `onEvent` with each endpoint, a URL or `Request`, replaced by
- * the handler it stands for, so the channel calls handlers alone. `fields` are
- * the channel's own event fields its endpoints are sent. A bad endpoint throws
- * when the channel is declared.
- */
-export function resolveEndpoints(provider, onEvent, fields) {
-    return Object.fromEntries(Object.entries(onEvent ?? {}).map(([key, value]) => [
-        key,
-        isEventEndpoint(value)
-            ? endpointHandler(value, `${provider} onEvent["${key}"]`, fields)
-            : value,
-    ]));
-}
-/**
- * The HTTP channel's `onFinish` for a provider channel: the channel's own
- * notice first, such as a link to a pending decision, then the user's hook,
- * for the deliveries whose event the channel parsed. A failing notice is
- * logged and doesn't keep the user's hook from running.
- */
-export function finishEvents(notice, onFinish, parse, name) {
-    return async (target, delivery) => {
-        try {
-            await notice(target, delivery);
-        }
-        catch (error) {
-            logger.error(`channel finish notice failed (${logger.safeErrorLabel(error)})`);
-        }
-        const event = onFinish && parse(delivery.rawEvent);
-        if (event === undefined)
-            return;
-        await onFinish?.(event, { id: delivery.threadId, channel: { name: name() } }, {
-            ...(delivery.run && { run: delivery.run }),
-            interrupts: delivery.interrupts,
-        });
-    };
-}
-/**
- * The HTTP channel's `onReceived` for a provider channel's user hook, for the
- * deliveries whose event the channel parsed.
- */
-export function receiveEvents(onReceived, parse, name) {
-    if (!onReceived)
-        return undefined;
-    return async (_target, delivery) => {
-        const event = parse(delivery.rawEvent);
-        if (event === undefined)
-            return;
-        await onReceived(event, {
-            id: delivery.threadId,
-            channel: { name: name() },
-        });
-    };
-}
-/** The events deploy subscribes the provider's webhook to: the handled ones. */
-export function handledEventKeys(handlers) {
-    return Object.entries(handlers)
-        .filter(([, handler]) => handler !== undefined)
-        .map(([key]) => key)
-        .sort();
-}
-/**
- * The connection `mda deploy` stores for the provider's app, or one of the
- * values stored beside it, such as `webhook-secret`, when `suffix` is given.
- */
-export function appConnectionSlug(provider, deploymentId, suffix) {
-    const slug = `mda/${provider}-app/${deploymentId}`;
-    return suffix ? `${slug}/${suffix}` : slug;
-}
-/**
- * A frozen copy of a parsed event, kept as the delivery's raw event so a
- * handler that changes its argument can't change what MDA keeps.
- */
-export function eventSnapshot(event, provider) {
-    if (!isJsonValue(event))
-        throw new TypeError(`invalid ${provider} event`);
-    return immutableCopy(event);
-}
-/** App options for deploy, without unset fields. */
-export function definedFields(fields) {
-    const defined = {};
-    for (const [key, value] of Object.entries(fields))
-        if (value !== undefined)
-            defined[key] = value;
-    return defined;
-}
-/**
- * Whether `signature`, a hex HMAC-SHA256 the caller checked the format of,
- * signs `rawBody` with `secret`. Compared in constant time.
- */
-export function verifyHmacSha256(secret, rawBody, signature) {
-    const expected = createHmac("sha256", secret).update(rawBody).digest();
-    const given = Buffer.from(signature, "hex");
-    return given.length === expected.length && timingSafeEqual(expected, given);
-}
-/**
- * A value read at most every `ttlMs(value)` milliseconds. Concurrent callers
- * share the read in flight; a failed read is not kept, so the next call reads
- * again.
- */
-export class CachedRead {
-    read;
-    ttlMs;
-    #entry;
-    constructor(read, ttlMs) {
-        this.read = read;
-        this.ttlMs = ttlMs;
-    }
-    get() {
-        if (this.#entry && this.#entry.expiresAt > Date.now())
-            return this.#entry.value;
-        const entry = {
-            value: this.read().then((value) => {
-                entry.expiresAt = Date.now() + this.ttlMs(value);
-                return value;
-            }, (error) => {
-                if (this.#entry === entry)
-                    this.#entry = undefined;
-                throw error;
-            }),
-            expiresAt: Number.POSITIVE_INFINITY,
-        };
-        this.#entry = entry;
-        return entry.value;
-    }
-    /** Read again on the next call. */
-    reset() {
-        this.#entry = undefined;
-    }
-}
-/** How long a value read from Agent Auth is reused before it is read again. */
-const SECRET_TTL_MS = 5 * 60_000;
-/** How long a missing value is remembered, so unsigned traffic can't hammer Agent Auth. */
-const MISSING_SECRET_TTL_MS = 60_000;
-const deploymentSecrets = new Map();
-/**
- * A value `mda deploy` stored for the deployment, such as a webhook secret:
- * the `env` override when set, otherwise the agent secret Agent Auth keeps at
- * `slug(deploymentId)`. Only a missing connection reads as `undefined`, and is
- * logged as `label`; credential store failures propagate.
- */
-export function readDeploymentSecret(env, slug, label) {
-    const override = process.env[env]?.trim();
-    if (override)
-        return Promise.resolve(override);
-    const deploymentId = process.env[DEPLOYMENT_ID_ENV]?.trim();
-    if (!deploymentId)
-        return Promise.resolve(undefined);
-    const key = slug(deploymentId);
-    let cached = deploymentSecrets.get(key);
-    if (!cached) {
-        cached = new CachedRead(() => connections.resolveDeploymentSecret(key).catch((error) => {
-            if (!(error instanceof ConnectionNotFoundError))
-                throw error;
-            logger.error(`${label} is not stored in Agent Auth`);
-            return undefined;
-        }), (value) => (value === undefined ? MISSING_SECRET_TTL_MS : SECRET_TTL_MS));
-        deploymentSecrets.set(key, cached);
-    }
-    return cached.get();
-}
-/** Forget values read from Agent Auth; for tests. */
-export function resetDeploymentSecrets() {
-    deploymentSecrets.clear();
-}
-/** Run an event's handler. A throw is logged, not raised. */
-export async function runEventHandler(provider, event, call) {
-    const receipt = JSON.stringify({
-        event: logger.logIdentifier(event.key),
-        deliveryId: logger.logIdentifier(event.deliveryId),
-    });
-    try {
-        const input = await call();
-        if (input === undefined || input === null)
-            return { type: "skipped" };
-        logger.info(`${provider} handler returned run input ${receipt}`);
-        return { type: "input", input };
-    }
-    catch (error) {
-        logger.error(`${provider.toLowerCase()} callback failed ${receipt} (${logger.safeErrorLabel(error)})`);
-        return { type: "failed" };
-    }
-}
-//# sourceMappingURL=provider.js.map

package/dist/channels/http/provider.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../src/channels/http/provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAK9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,eAAe,GAGhB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAE9B,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,OAAoB;IAC9C,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,QAAgB,EAChB,SAA8B;IAE9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,MAAM;QAChB,MAAM,IAAI,SAAS,CACjB,eAAe,QAAQ,cAAc,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjE,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,OAAsB,EACtB,MAAuB;IAEvB,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAClD,GAAG;QACH,eAAe,CAAC,KAAK,CAAC;YACpB,CAAC,CAAC,eAAe,CACb,KAAK,EACL,GAAG,QAAQ,aAAa,GAAG,IAAI,EAC/B,MAIE,CACH;YACH,CAAC,CAAC,KAAK;KACV,CAAC,CACiD,CAAC;AACxD,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAmD,EACnD,QAAsC,EACtC,KAAyD,EACzD,IAAkB;IAElB,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CACV,iCAAiC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CACjE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,MAAM,QAAQ,EAAE,CACd,KAAK,EACL,EAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EACpD;YACE,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC1C,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAwC,EACxC,KAAyD,EACzD,IAAkB;IAElB,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,MAAM,UAAU,CAAC,KAAK,EAAE;YACtB,EAAE,EAAE,QAAQ,CAAC,QAAQ;YACrB,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC;SAC9C,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;SACnB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,YAAoB,EACpB,MAAe;IAEf,MAAM,IAAI,GAAG,OAAO,QAAQ,QAAQ,YAAY,EAAE,CAAC;IACnD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,QAAgB;IAC5D,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,WAAW,QAAQ,QAAQ,CAAC,CAAC;IAC1E,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,aAAa,CAC3B,MAA6C;IAE7C,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,OAAmB,EACnB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,UAAU;IAIF,IAAI;IACJ,KAAK;IAJxB,MAAM,CAAuD;IAE7D,YACmB,IAAsB,EACtB,KAA2B;oBAD3B,IAAI;qBACJ,KAAK;IACrB,CAAC;IAEJ,GAAG;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YACnD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,MAAM,KAAK,GAA6C;YACtD,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CACrB,CAAC,KAAK,EAAE,EAAE;gBACR,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjD,OAAO,KAAK,CAAC;YACf,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBACjB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;oBAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;gBACnD,MAAM,KAAK,CAAC;YACd,CAAC,CACF;YACD,SAAS,EAAE,MAAM,CAAC,iBAAiB;SACpC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,mCAAmC;IACnC,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC;AACjC,2FAA2F;AAC3F,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA0C,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,IAAsC,EACtC,KAAa;IAEb,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/B,IAAI,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,IAAI,UAAU,CACrB,GAAG,EAAE,CACH,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAChE,IAAI,CAAC,CAAC,KAAK,YAAY,uBAAuB,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,EACJ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,aAAa,CAAC,CACzE,CAAC;QACF,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC;AACtB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,sBAAsB;IACpC,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC5B,CAAC;AAWD,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,KAA0C,EAC1C,IAA4D;IAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC;QACtC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;KACnD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,+BAA+B,OAAO,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CACV,GAAG,QAAQ,CAAC,WAAW,EAAE,oBAAoB,OAAO,KAAK,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CACzF,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC"}