robotrock 0.5.0 → 0.7.0

package/dist/chunk-ZHASQUX6.js

@@ -0,0 +1,195 @@
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : /* @__PURE__ */ Symbol.for("Symbol." + name);
+var __typeError = (msg) => {
+  throw TypeError(msg);
+};
+var __using = (stack, value, async) => {
+  if (value != null) {
+    if (typeof value !== "object" && typeof value !== "function") __typeError("Object expected");
+    var dispose, inner;
+    if (async) dispose = value[__knownSymbol("asyncDispose")];
+    if (dispose === void 0) {
+      dispose = value[__knownSymbol("dispose")];
+      if (async) inner = dispose;
+    }
+    if (typeof dispose !== "function") __typeError("Object not disposable");
+    if (inner) dispose = function() {
+      try {
+        inner.call(this);
+      } catch (e) {
+        return Promise.reject(e);
+      }
+    };
+    stack.push([async, dispose, value]);
+  } else if (async) {
+    stack.push([async]);
+  }
+  return value;
+};
+var __callDispose = (stack, error, hasError) => {
+  var E = typeof SuppressedError === "function" ? SuppressedError : function(e, s, m, _) {
+    return _ = Error(m), _.name = "SuppressedError", _.error = e, _.suppressed = s, _;
+  };
+  var fail = (e) => error = hasError ? new E(e, error, "An error was suppressed during disposal") : (hasError = true, e);
+  var next = (it) => {
+    while (it = stack.pop()) {
+      try {
+        var result = it[1] && it[1].call(it[2]);
+        if (it[0]) return Promise.resolve(result).then(next, (e) => (fail(e), next()));
+      } catch (e) {
+        fail(e);
+      }
+    }
+    if (hasError) throw error;
+  };
+  return next();
+};
+
+// src/schemas/index.ts
+import { z } from "zod";
+import {
+  isPublicHttpUrl,
+  PUBLIC_HTTP_URL_ERROR
+} from "@robotrock/core/utils";
+import { validateContextPublicUrls } from "@robotrock/core/schemas";
+var safeUrlSchema = z.string().refine((url) => isPublicHttpUrl(url), {
+  message: PUBLIC_HTTP_URL_ERROR
+});
+var jsonSchema7Schema = z.custom(
+  (val) => typeof val === "object" && val !== null,
+  { message: "Must be a valid JSON Schema object" }
+);
+var uiSchemaSchema = z.custom((val) => typeof val === "object" && val !== null, {
+  message: "Must be a valid UiSchema object"
+});
+var webhookHandlerSchema = z.object({
+  type: z.literal("webhook"),
+  url: safeUrlSchema,
+  headers: z.record(z.string())
+});
+var triggerHandlerSchema = webhookHandlerSchema.extend({
+  type: z.literal("trigger"),
+  tokenId: z.string().min(1)
+});
+var handlerSchema = z.discriminatedUnion("type", [webhookHandlerSchema, triggerHandlerSchema]);
+var taskActionSchema = z.object({
+  id: z.string().min(1),
+  title: z.string().min(1),
+  description: z.string().optional(),
+  schema: jsonSchema7Schema.optional(),
+  ui: uiSchemaSchema.optional(),
+  data: z.record(z.unknown()).optional(),
+  handlers: z.array(handlerSchema).min(1).optional()
+});
+var uiFieldSchemaSchema = z.object({
+  "ui:widget": z.string().optional(),
+  "ui:title": z.string().optional(),
+  "ui:description": z.string().optional(),
+  "ui:options": z.record(z.unknown()).optional(),
+  items: z.lazy(() => z.record(uiFieldSchemaSchema)).optional()
+}).passthrough();
+var contextUiSchema = z.record(uiFieldSchemaSchema).optional();
+var contextDataSchema = z.object({
+  data: z.record(z.unknown()),
+  ui: contextUiSchema
+}).optional();
+var taskContextObjectSchema = z.object({
+  app: z.string().min(1).optional(),
+  type: z.string().min(1),
+  name: z.string().min(1),
+  description: z.string().optional(),
+  validUntil: z.string().optional(),
+  context: contextDataSchema,
+  version: z.literal(2).optional(),
+  actions: z.array(taskActionSchema).min(1, "At least one action is required")
+});
+function refineContextPublicUrls(data, ctx) {
+  const error = validateContextPublicUrls(data.context);
+  if (error) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: error,
+      path: ["context"]
+    });
+  }
+}
+var taskContextSchema = taskContextObjectSchema.superRefine(
+  refineContextPublicUrls
+);
+var assignToSchema = z.object({
+  users: z.array(z.string().email()).optional(),
+  groups: z.array(z.string().min(1)).optional()
+}).refine(
+  (data) => {
+    const groups = data.groups ?? [];
+    if (groups.includes("all") && groups.length > 1) {
+      return false;
+    }
+    return true;
+  },
+  { message: 'Cannot combine "all" with other group slugs' }
+);
+var threadUpdateMessageSchema = z.string().min(1).max(500);
+var threadUpdateStatuses = [
+  "info",
+  "queued",
+  "running",
+  "waiting",
+  "succeeded",
+  "failed",
+  "cancelled"
+];
+var threadUpdateStatusSchema = z.enum(threadUpdateStatuses);
+var DEFAULT_THREAD_UPDATE_STATUS = "info";
+var threadUpdateInputSchema = z.object({
+  message: threadUpdateMessageSchema,
+  status: threadUpdateStatusSchema.optional()
+});
+var taskPriorities = ["low", "normal", "high", "urgent"];
+var taskPrioritySchema = z.enum(taskPriorities);
+var DEFAULT_TASK_PRIORITY = "normal";
+var LOWEST_TASK_PRIORITY = "low";
+var TASK_PRIORITY_RANK = {
+  low: 1,
+  normal: 2,
+  high: 3,
+  urgent: 4
+};
+var createTaskBodySchema = taskContextObjectSchema.extend({
+  assignTo: assignToSchema.optional(),
+  /**
+   * Groups related tasks together. When omitted, the server generates one and
+   * returns it so the caller can reuse it on later tasks in the same thread.
+   */
+  threadId: z.string().min(1).optional(),
+  /**
+   * Optional thread priority. When set, applies to the whole thread and
+   * overwrites any previous priority. Omit on later tasks to leave unchanged.
+   */
+  priority: taskPrioritySchema.optional(),
+  /**
+   * Optional initial status update logged against the task's thread. Shows in
+   * the inbox status bar and the thread update log.
+   */
+  update: threadUpdateInputSchema.optional()
+}).superRefine(refineContextPublicUrls);
+var threadUpdateBodySchema = threadUpdateInputSchema;
+
+export {
+  __using,
+  __callDispose,
+  taskContextSchema,
+  assignToSchema,
+  threadUpdateMessageSchema,
+  threadUpdateStatuses,
+  threadUpdateStatusSchema,
+  DEFAULT_THREAD_UPDATE_STATUS,
+  threadUpdateInputSchema,
+  taskPriorities,
+  taskPrioritySchema,
+  DEFAULT_TASK_PRIORITY,
+  LOWEST_TASK_PRIORITY,
+  TASK_PRIORITY_RANK,
+  createTaskBodySchema,
+  threadUpdateBodySchema
+};
+//# sourceMappingURL=chunk-ZHASQUX6.js.map

package/dist/chunk-ZHASQUX6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/schemas/index.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  isPublicHttpUrl,\n  PUBLIC_HTTP_URL_ERROR,\n} from \"@robotrock/core/utils\";\nimport { validateContextPublicUrls } from \"@robotrock/core/schemas\";\n\nexport interface JSONSchema7 {\n  $id?: string;\n  $ref?: string;\n  $schema?: string;\n  $comment?: string;\n  type?: JSONSchema7TypeName | JSONSchema7TypeName[];\n  enum?: unknown[];\n  const?: unknown;\n  multipleOf?: number;\n  maximum?: number;\n  exclusiveMaximum?: number;\n  minimum?: number;\n  exclusiveMinimum?: number;\n  maxLength?: number;\n  minLength?: number;\n  pattern?: string;\n  format?: string;\n  items?: JSONSchema7 | JSONSchema7[];\n  additionalItems?: JSONSchema7 | boolean;\n  maxItems?: number;\n  minItems?: number;\n  uniqueItems?: boolean;\n  contains?: JSONSchema7;\n  maxProperties?: number;\n  minProperties?: number;\n  required?: string[];\n  properties?: Record<string, JSONSchema7>;\n  patternProperties?: Record<string, JSONSchema7>;\n  additionalProperties?: JSONSchema7 | boolean;\n  dependencies?: Record<string, JSONSchema7 | string[]>;\n  propertyNames?: JSONSchema7;\n  if?: JSONSchema7;\n  then?: JSONSchema7;\n  else?: JSONSchema7;\n  allOf?: JSONSchema7[];\n  anyOf?: JSONSchema7[];\n  oneOf?: JSONSchema7[];\n  not?: JSONSchema7;\n  title?: string;\n  description?: string;\n  default?: unknown;\n  readOnly?: boolean;\n  writeOnly?: boolean;\n  examples?: unknown[];\n}\n\nexport type JSONSchema7TypeName =\n  | \"string\"\n  | \"number\"\n  | \"integer\"\n  | \"boolean\"\n  | \"object\"\n  | \"array\"\n  | \"null\";\n\nexport type ExtendedJSONSchema7 = JSONSchema7 & {\n  enumNames?: string[];\n  [key: string]: unknown;\n};\n\nexport type UiSchema = {\n  \"ui:widget\"?: string;\n  \"ui:title\"?: string;\n  \"ui:description\"?: string;\n  \"ui:placeholder\"?: string;\n  \"ui:options\"?: Record<string, unknown>;\n  [key: string]: unknown;\n};\n\nconst safeUrlSchema = z.string().refine((url) => isPublicHttpUrl(url), {\n  message: PUBLIC_HTTP_URL_ERROR,\n});\n\nconst jsonSchema7Schema = z.custom<ExtendedJSONSchema7>(\n  (val) => typeof val === \"object\" && val !== null,\n  { message: \"Must be a valid JSON Schema object\" }\n);\n\nconst uiSchemaSchema = z.custom<UiSchema>((val) => typeof val === \"object\" && val !== null, {\n  message: \"Must be a valid UiSchema object\",\n});\n\nconst webhookHandlerSchema = z.object({\n  type: z.literal(\"webhook\"),\n  url: safeUrlSchema,\n  headers: z.record(z.string()),\n});\n\nconst triggerHandlerSchema = webhookHandlerSchema.extend({\n  type: z.literal(\"trigger\"),\n  tokenId: z.string().min(1),\n});\n\nconst handlerSchema = z.discriminatedUnion(\"type\", [webhookHandlerSchema, triggerHandlerSchema]);\n\nconst taskActionSchema = z.object({\n  id: z.string().min(1),\n  title: z.string().min(1),\n  description: z.string().optional(),\n  schema: jsonSchema7Schema.optional(),\n  ui: uiSchemaSchema.optional(),\n  data: z.record(z.unknown()).optional(),\n  handlers: z.array(handlerSchema).min(1).optional(),\n});\n\nconst uiFieldSchemaSchema: z.ZodType<Record<string, unknown>> = z\n  .object({\n    \"ui:widget\": z.string().optional(),\n    \"ui:title\": z.string().optional(),\n    \"ui:description\": z.string().optional(),\n    \"ui:options\": z.record(z.unknown()).optional(),\n    items: z.lazy(() => z.record(uiFieldSchemaSchema)).optional(),\n  })\n  .passthrough();\n\nconst contextUiSchema = z.record(uiFieldSchemaSchema).optional();\n\nconst contextDataSchema = z\n  .object({\n    data: z.record(z.unknown()),\n    ui: contextUiSchema,\n  })\n  .optional();\n\nconst taskContextObjectSchema = z.object({\n  app: z.string().min(1).optional(),\n  type: z.string().min(1),\n  name: z.string().min(1),\n  description: z.string().optional(),\n  validUntil: z.string().optional(),\n  context: contextDataSchema,\n  version: z.literal(2).optional(),\n  actions: z.array(taskActionSchema).min(1, \"At least one action is required\"),\n});\n\nfunction refineContextPublicUrls<T extends { context?: z.infer<typeof contextDataSchema> }>(\n  data: T,\n  ctx: z.RefinementCtx\n) {\n  const error = validateContextPublicUrls(data.context);\n  if (error) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: error,\n      path: [\"context\"],\n    });\n  }\n}\n\nexport const taskContextSchema = taskContextObjectSchema.superRefine(\n  refineContextPublicUrls\n);\n\n/**\n * Assignment targets at task create (not stored in task context JSON).\n * Unknown user emails are auto-provisioned as assignee memberships (not full team seats).\n */\nexport const assignToSchema = z\n  .object({\n    users: z.array(z.string().email()).optional(),\n    groups: z.array(z.string().min(1)).optional(),\n  })\n  .refine(\n    (data) => {\n      const groups = data.groups ?? [];\n      if (groups.includes(\"all\") && groups.length > 1) {\n        return false;\n      }\n      return true;\n    },\n    { message: 'Cannot combine \"all\" with other group slugs' }\n  );\n\n/** A short thread-scoped status update message (1-2 sentences). */\nexport const threadUpdateMessageSchema = z.string().min(1).max(500);\n\n/**\n * Lifecycle status carried by a thread update. Drives the icon and color shown\n * in the inbox status bar. Defaults to `info` when omitted.\n */\nexport const threadUpdateStatuses = [\n  \"info\",\n  \"queued\",\n  \"running\",\n  \"waiting\",\n  \"succeeded\",\n  \"failed\",\n  \"cancelled\",\n] as const;\n\nexport const threadUpdateStatusSchema = z.enum(threadUpdateStatuses);\n\n/** The default status applied when an update omits one. */\nexport const DEFAULT_THREAD_UPDATE_STATUS: ThreadUpdateStatus = \"info\";\n\n/** Shared shape for a thread update (standalone and at task creation). */\nexport const threadUpdateInputSchema = z.object({\n  message: threadUpdateMessageSchema,\n  status: threadUpdateStatusSchema.optional(),\n});\n\n/** Thread priority levels for inbox ordering and display. */\nexport const taskPriorities = [\"low\", \"normal\", \"high\", \"urgent\"] as const;\n\nexport const taskPrioritySchema = z.enum(taskPriorities);\n\nexport type TaskPriority = (typeof taskPriorities)[number];\n\nexport const DEFAULT_TASK_PRIORITY: TaskPriority = \"normal\";\n\nexport const LOWEST_TASK_PRIORITY: TaskPriority = \"low\";\n\nexport const TASK_PRIORITY_RANK: Record<TaskPriority, number> = {\n  low: 1,\n  normal: 2,\n  high: 3,\n  urgent: 4,\n};\n\nexport const createTaskBodySchema = taskContextObjectSchema\n  .extend({\n    assignTo: assignToSchema.optional(),\n    /**\n     * Groups related tasks together. When omitted, the server generates one and\n     * returns it so the caller can reuse it on later tasks in the same thread.\n     */\n    threadId: z.string().min(1).optional(),\n    /**\n     * Optional thread priority. When set, applies to the whole thread and\n     * overwrites any previous priority. Omit on later tasks to leave unchanged.\n     */\n    priority: taskPrioritySchema.optional(),\n    /**\n     * Optional initial status update logged against the task's thread. Shows in\n     * the inbox status bar and the thread update log.\n     */\n    update: threadUpdateInputSchema.optional(),\n  })\n  .superRefine(refineContextPublicUrls);\n\n/** POST /v1/threads/:threadId/updates body: a standalone thread update. */\nexport const threadUpdateBodySchema = threadUpdateInputSchema;\n\n/** Where a thread update originated. */\nexport type ThreadUpdateSource = \"api\" | \"task_create\" | \"dashboard\";\n\n/** Lifecycle status carried by a thread update. */\nexport type ThreadUpdateStatus = (typeof threadUpdateStatuses)[number];\n\n/** A logged thread update as returned by the API. */\nexport interface ThreadUpdate {\n  id: string;\n  threadId: string;\n  message: string;\n  status: ThreadUpdateStatus;\n  source: ThreadUpdateSource;\n  createdAt: number;\n}\n\nexport type AssignToInput = z.infer<typeof assignToSchema>;\nexport type CreateTaskBodyInput = z.input<typeof createTaskBodySchema>;\nexport type CreateTaskBody = z.output<typeof createTaskBodySchema>;\nexport type ThreadUpdateBodyInput = z.input<typeof threadUpdateBodySchema>;\nexport type ThreadUpdateBody = z.output<typeof threadUpdateBodySchema>;\nexport type ThreadUpdateInput = z.input<typeof threadUpdateInputSchema>;\nexport type TaskContextInput = z.input<typeof taskContextSchema>;\nexport type TaskContextOutput = z.output<typeof taskContextSchema>;\nexport type TaskContext = TaskContextOutput;\nexport type TaskAction = z.infer<typeof taskActionSchema>;\nexport type WebhookHandler = z.infer<typeof webhookHandlerSchema>;\nexport type TriggerHandler = z.infer<typeof triggerHandlerSchema>;\nexport type Handler = z.infer<typeof handlerSchema>;\n\ntype InferObjectProperties<\n  Props,\n  Req extends PropertyKey,\n> = Props extends Record<string, unknown>\n  ? ({\n      [K in keyof Props as K extends Req ? K : never]-?: InferJsonSchema7<Props[K]>;\n    } & {\n      [K in keyof Props as K extends Req ? never : K]?: InferJsonSchema7<Props[K]>;\n    } extends infer O\n      ? { [K in keyof O]: O[K] }\n      : never)\n  : Record<string, unknown>;\n\ntype RequiredKeys<S> =\n  S extends { readonly required: readonly string[] } ? S[\"required\"][number] : never;\n\nexport type InferJsonSchema7<S> = [S] extends [undefined]\n  ? Record<string, never>\n  : S extends { readonly const: infer C }\n    ? C\n    : S extends {\n          readonly enum: readonly (infer E)[];\n        }\n      ? E\n      : S extends {\n            readonly type: \"object\";\n            readonly properties?: infer Props;\n          }\n        ? InferObjectProperties<Props, RequiredKeys<S>>\n        : S extends {\n              readonly type: \"object\";\n              readonly properties?: undefined;\n            }\n          ? Record<string, unknown>\n          : S extends {\n                readonly type: \"array\";\n                readonly items?: infer Items;\n              }\n            ? Items extends readonly unknown[]\n              ? InferJsonSchema7<Items[number]>[]\n              : Items extends object\n                ? InferJsonSchema7<Items>[]\n                : unknown[]\n            : S extends { readonly type: \"string\" }\n              ? string\n              : S extends { readonly type: \"number\" } | { readonly type: \"integer\" }\n                ? number\n                : S extends { readonly type: \"boolean\" }\n                  ? boolean\n                  : unknown;\n\nexport type TaskStatus = \"pending\" | \"open\" | \"handled\" | \"expired\";\n\nexport interface TaskResponse {\n  success: boolean;\n  task: {\n    taskId: string;\n    threadId: string;\n    status: \"pending\" | \"open\";\n    context: TaskContext;\n    validUntil: string;\n    submittedAt: string;\n  };\n  message: string;\n}\n\nexport interface ThreadUpdateResponse {\n  success: boolean;\n  update: ThreadUpdate;\n  message: string;\n}\n\nexport interface Task {\n  id: string;\n  threadId?: string;\n  createdAt: Date;\n  status: TaskStatus;\n  context: TaskContext;\n  validUntil: number;\n  handledAt?: number;\n  handled?: {\n    action: {\n      id: string;\n      data: unknown;\n    };\n    handledBy?: string;\n    userId?: string;\n    token?: string;\n  };\n}\n\nexport type InferActionData<T extends { schema?: unknown }> = [\n  Exclude<T[\"schema\"], undefined>,\n] extends [\n  never,\n]\n  ? Record<string, never>\n  : Exclude<T[\"schema\"], undefined> extends infer S\n    ? InferJsonSchema7<S>\n    : Record<string, never>;\n\nexport type TupleElementIndices<T extends readonly unknown[]> = T extends readonly [\n  unknown,\n  ...unknown[],\n]\n  ? Exclude<keyof T, keyof unknown[]>\n  : number;\n\nexport interface TaskResult<T = Record<string, unknown>> {\n  actionId: string;\n  data: T;\n  handledBy?: string;\n  handledAt: Date;\n}\n\nexport interface ApprovalResult<T = Record<string, unknown>> extends TaskResult<T> {\n  taskId: string;\n}\n\nexport type DiscriminatedApprovalResult<\n  TActions extends readonly { id: string; schema?: unknown }[],\n> = {\n  [I in TupleElementIndices<TActions>]: TActions[I] extends { id: string; schema?: unknown }\n    ? Omit<ApprovalResult<InferActionData<TActions[I]>>, \"actionId\" | \"data\"> & {\n        actionId: TActions[I][\"id\"];\n        data: InferActionData<TActions[I]>;\n      }\n    : never\n}[TupleElementIndices<TActions>];\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAuE1C,IAAM,gBAAgB,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,gBAAgB,GAAG,GAAG;AAAA,EACrE,SAAS;AACX,CAAC;AAED,IAAM,oBAAoB,EAAE;AAAA,EAC1B,CAAC,QAAQ,OAAO,QAAQ,YAAY,QAAQ;AAAA,EAC5C,EAAE,SAAS,qCAAqC;AAClD;AAEA,IAAM,iBAAiB,EAAE,OAAiB,CAAC,QAAQ,OAAO,QAAQ,YAAY,QAAQ,MAAM;AAAA,EAC1F,SAAS;AACX,CAAC;AAED,IAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,MAAM,EAAE,QAAQ,SAAS;AAAA,EACzB,KAAK;AAAA,EACL,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;AAC9B,CAAC;AAED,IAAM,uBAAuB,qBAAqB,OAAO;AAAA,EACvD,MAAM,EAAE,QAAQ,SAAS;AAAA,EACzB,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAC3B,CAAC;AAED,IAAM,gBAAgB,EAAE,mBAAmB,QAAQ,CAAC,sBAAsB,oBAAoB,CAAC;AAE/F,IAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACpB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACvB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQ,kBAAkB,SAAS;AAAA,EACnC,IAAI,eAAe,SAAS;AAAA,EAC5B,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACrC,UAAU,EAAE,MAAM,aAAa,EAAE,IAAI,CAAC,EAAE,SAAS;AACnD,CAAC;AAED,IAAM,sBAA0D,EAC7D,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC7C,OAAO,EAAE,KAAK,MAAM,EAAE,OAAO,mBAAmB,CAAC,EAAE,SAAS;AAC9D,CAAC,EACA,YAAY;AAEf,IAAM,kBAAkB,EAAE,OAAO,mBAAmB,EAAE,SAAS;AAE/D,IAAM,oBAAoB,EACvB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;AAAA,EAC1B,IAAI;AACN,CAAC,EACA,SAAS;AAEZ,IAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAChC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,SAAS;AAAA,EACT,SAAS,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC/B,SAAS,EAAE,MAAM,gBAAgB,EAAE,IAAI,GAAG,iCAAiC;AAC7E,CAAC;AAED,SAAS,wBACP,MACA,KACA;AACA,QAAM,QAAQ,0BAA0B,KAAK,OAAO;AACpD,MAAI,OAAO;AACT,QAAI,SAAS;AAAA,MACX,MAAM,EAAE,aAAa;AAAA,MACrB,SAAS;AAAA,MACT,MAAM,CAAC,SAAS;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAEO,IAAM,oBAAoB,wBAAwB;AAAA,EACvD;AACF;AAMO,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,SAAS;AAAA,EAC5C,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS;AAC9C,CAAC,EACA;AAAA,EACC,CAAC,SAAS;AACR,UAAM,SAAS,KAAK,UAAU,CAAC;AAC/B,QAAI,OAAO,SAAS,KAAK,KAAK,OAAO,SAAS,GAAG;AAC/C,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EACA,EAAE,SAAS,8CAA8C;AAC3D;AAGK,IAAM,4BAA4B,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAM3D,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,2BAA2B,EAAE,KAAK,oBAAoB;AAG5D,IAAM,+BAAmD;AAGzD,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,SAAS;AAAA,EACT,QAAQ,yBAAyB,SAAS;AAC5C,CAAC;AAGM,IAAM,iBAAiB,CAAC,OAAO,UAAU,QAAQ,QAAQ;AAEzD,IAAM,qBAAqB,EAAE,KAAK,cAAc;AAIhD,IAAM,wBAAsC;AAE5C,IAAM,uBAAqC;AAE3C,IAAM,qBAAmD;AAAA,EAC9D,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AACV;AAEO,IAAM,uBAAuB,wBACjC,OAAO;AAAA,EACN,UAAU,eAAe,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,UAAU,mBAAmB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtC,QAAQ,wBAAwB,SAAS;AAC3C,CAAC,EACA,YAAY,uBAAuB;AAG/B,IAAM,yBAAyB;","names":[]}

package/dist/{client-BOm2Ce2f.d.ts → client-CLcHdjOz.d.ts}

@@ -1,4 +1,4 @@
-import { TaskContextInput, AssignToInput, ThreadUpdateStatus, TaskResponse, DiscriminatedApprovalResult, Task, ThreadUpdate } from './schemas/index.js';
+import { TaskContextInput, AssignToInput, TaskPriority, ThreadUpdateStatus, TaskResponse, DiscriminatedApprovalResult, Task, ThreadUpdate } from './schemas/index.js';
 
 type RobotRockWebhookConfig = {
     url: string;
@@ -59,6 +59,11 @@ type SendToHumanInput<A extends readonly SendToHumanActionInput[] = readonly Sen
      * one (returned as `task.threadId`) and reuse it on later tasks in the thread.
      */
     threadId?: string;
+    /**
+     * Optional thread priority. When set, applies to the whole thread and
+     * overwrites any previous priority. Omit on later tasks to leave unchanged.
+     */
+    priority?: TaskPriority;
     /**
      * Optional initial status update logged against the task's thread. Shows in
      * the inbox status bar and the thread update log.

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { R as RobotRockConfig, b as RobotRock } from './client-BOm2Ce2f.js';
-export { c as RobotRockError, g as RobotRockPollingClientConfig, i as RobotRockPollingOptions, f as RobotRockWebhookClientConfig, h as RobotRockWebhookConfig, S as SendToHumanActionInput, a as SendToHumanInput, k as SendToHumanResult, j as SendToHumanValidUntil, l as SendUpdateInput, d as attachWebhookToActions, e as createClient } from './client-BOm2Ce2f.js';
+import { R as RobotRockConfig, b as RobotRock } from './client-CLcHdjOz.js';
+export { c as RobotRockError, g as RobotRockPollingClientConfig, i as RobotRockPollingOptions, f as RobotRockWebhookClientConfig, h as RobotRockWebhookConfig, S as SendToHumanActionInput, a as SendToHumanInput, k as SendToHumanResult, j as SendToHumanValidUntil, l as SendUpdateInput, d as attachWebhookToActions, e as createClient } from './client-CLcHdjOz.js';
 import { Task, DiscriminatedApprovalResult } from './schemas/index.js';
-export { ApprovalResult, AssignToInput, CreateTaskBody, CreateTaskBodyInput, DEFAULT_THREAD_UPDATE_STATUS, Handler, InferActionData, TaskAction, TaskContext, TaskContextInput, TaskResponse, TaskResult, TaskStatus, ThreadUpdate, ThreadUpdateBody, ThreadUpdateBodyInput, ThreadUpdateInput, ThreadUpdateResponse, ThreadUpdateSource, ThreadUpdateStatus, TriggerHandler, TupleElementIndices, WebhookHandler, assignToSchema, createTaskBodySchema, taskContextSchema, threadUpdateBodySchema, threadUpdateInputSchema, threadUpdateStatusSchema, threadUpdateStatuses } from './schemas/index.js';
+export { ApprovalResult, AssignToInput, CreateTaskBody, CreateTaskBodyInput, DEFAULT_TASK_PRIORITY, DEFAULT_THREAD_UPDATE_STATUS, Handler, InferActionData, LOWEST_TASK_PRIORITY, TASK_PRIORITY_RANK, TaskAction, TaskContext, TaskContextInput, TaskPriority, TaskResponse, TaskResult, TaskStatus, ThreadUpdate, ThreadUpdateBody, ThreadUpdateBodyInput, ThreadUpdateInput, ThreadUpdateResponse, ThreadUpdateSource, ThreadUpdateStatus, TriggerHandler, TupleElementIndices, WebhookHandler, assignToSchema, createTaskBodySchema, taskContextSchema, taskPriorities, taskPrioritySchema, threadUpdateBodySchema, threadUpdateInputSchema, threadUpdateStatusSchema, threadUpdateStatuses } from './schemas/index.js';
 import { z } from 'zod';
 export { R as RobotRockHandlerWebhookPayload } from './handler-webhook-BqEi6Bk-.js';
 

package/dist/{index.mjs → index.js}

@@ -8,35 +8,40 @@ import {
   resolveRobotRockClient,
   resolveRobotRockConfig,
   toDiscriminatedApprovalResult
-} from "./chunk-E7ZWBFZ6.mjs";
+} from "./chunk-ZG2XVK6Y.js";
 import {
+  DEFAULT_TASK_PRIORITY,
   DEFAULT_THREAD_UPDATE_STATUS,
+  LOWEST_TASK_PRIORITY,
+  TASK_PRIORITY_RANK,
   assignToSchema,
   createTaskBodySchema,
-  external_exports,
   taskContextSchema,
+  taskPriorities,
+  taskPrioritySchema,
   threadUpdateBodySchema,
   threadUpdateInputSchema,
   threadUpdateStatusSchema,
   threadUpdateStatuses
-} from "./chunk-VNXWLPRV.mjs";
+} from "./chunk-ZHASQUX6.js";
 
 // src/webhook.ts
 import { createHmac, timingSafeEqual } from "crypto";
+import { z } from "zod";
 var ROBOTROCK_SIGNATURE_HEADER = "x-robotrock-signature";
-var robotRockWebhookPayloadBodySchema = external_exports.object({
-  taskId: external_exports.string().min(1),
-  action: external_exports.object({
-    id: external_exports.string().min(1),
-    title: external_exports.string().min(1),
-    data: external_exports.unknown()
+var robotRockWebhookPayloadBodySchema = z.object({
+  taskId: z.string().min(1),
+  action: z.object({
+    id: z.string().min(1),
+    title: z.string().min(1),
+    data: z.unknown()
   }),
-  handledBy: external_exports.string().min(1).optional(),
-  handledAt: external_exports.string().min(1),
-  handlerType: external_exports.string().min(1)
+  handledBy: z.string().min(1).optional(),
+  handledAt: z.string().min(1),
+  handlerType: z.string().min(1)
 });
 var robotRockWebhookPayloadSchema = robotRockWebhookPayloadBodySchema.extend({
-  headers: external_exports.record(external_exports.string())
+  headers: z.record(z.string())
 });
 var RobotRockWebhookError = class extends Error {
   constructor(message, code, details) {
@@ -126,10 +131,13 @@ function normalizeHeaders(headers) {
   return result;
 }
 export {
+  DEFAULT_TASK_PRIORITY,
   DEFAULT_THREAD_UPDATE_STATUS,
+  LOWEST_TASK_PRIORITY,
   RobotRock,
   RobotRockError,
   RobotRockWebhookError,
+  TASK_PRIORITY_RANK,
   TaskExpiredError,
   TaskTimeoutError,
   assignToSchema,
@@ -139,6 +147,8 @@ export {
   resolveRobotRockClient,
   resolveRobotRockConfig,
   taskContextSchema,
+  taskPriorities,
+  taskPrioritySchema,
   threadUpdateBodySchema,
   threadUpdateInputSchema,
   threadUpdateStatusSchema,
@@ -146,4 +156,4 @@ export {
   toDiscriminatedApprovalResult,
   verifyRobotRockWebhook
 };
-//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.js.map

package/dist/{index.mjs.map → index.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/webhook.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\n\nconst ROBOTROCK_SIGNATURE_HEADER = \"x-robotrock-signature\";\n\nconst robotRockWebhookPayloadBodySchema = z.object({\n  taskId: z.string().min(1),\n  action: z.object({\n    id: z.string().min(1),\n    title: z.string().min(1),\n    data: z.unknown(),\n  }),\n  handledBy: z.string().min(1).optional(),\n  handledAt: z.string().min(1),\n  handlerType: z.string().min(1),\n});\n\nconst robotRockWebhookPayloadSchema = robotRockWebhookPayloadBodySchema.extend({\n  headers: z.record(z.string()),\n});\n\nexport type RobotRockWebhookErrorCode =\n  | \"MISSING_WEBHOOK_SECRET\"\n  | \"MISSING_SIGNATURE\"\n  | \"INVALID_SIGNATURE\"\n  | \"INVALID_JSON\"\n  | \"INVALID_PAYLOAD\";\n\nexport class RobotRockWebhookError extends Error {\n  constructor(\n    message: string,\n    public readonly code: RobotRockWebhookErrorCode,\n    public readonly details?: unknown\n  ) {\n    super(message);\n    this.name = \"RobotRockWebhookError\";\n  }\n}\n\nexport type RobotRockWebhookPayload = z.infer<typeof robotRockWebhookPayloadSchema>;\n\nexport interface VerifyRobotRockWebhookOptions {\n  /**\n   * Override shared secret (defaults to ROBOTROCK_WEBHOOK_SECRET).\n   * Keep undefined in production to enforce the canonical env var.\n   */\n  secret?: string;\n  /**\n   * Resolve the tenant signing secret by public task id (hosted MCP uses Convex).\n   * Used when secret is not passed explicitly.\n   */\n  resolveSecret?: (taskId: string) => Promise<string | undefined>;\n  /** Signature header to read. @default \"x-robotrock-signature\" */\n  signatureHeader?: string;\n}\n\n/**\n * Verify a RobotRock webhook request and return a validated payload.\n * Throws RobotRockWebhookError with machine-readable `code` for audit logging.\n */\nexport async function verifyRobotRockWebhook(\n  request: Request,\n  options: VerifyRobotRockWebhookOptions = {}\n): Promise<RobotRockWebhookPayload> {\n  const signatureHeaderName = options.signatureHeader ?? ROBOTROCK_SIGNATURE_HEADER;\n  const signature = request.headers.get(signatureHeaderName);\n\n  if (!signature) {\n    throw new RobotRockWebhookError(\n      `Missing webhook signature header: ${signatureHeaderName}`,\n      \"MISSING_SIGNATURE\"\n    );\n  }\n\n  const rawBody = await request.text();\n  const secret = await resolveWebhookSigningSecret(rawBody, options);\n\n  if (!secret) {\n    throw new RobotRockWebhookError(\n      \"Missing webhook signing secret for verification\",\n      \"MISSING_WEBHOOK_SECRET\"\n    );\n  }\n\n  assertValidSignature(rawBody, signature, secret);\n\n  let parsedBody: unknown;\n  try {\n    parsedBody = JSON.parse(rawBody);\n  } catch (error) {\n    throw new RobotRockWebhookError(\"Webhook body is not valid JSON\", \"INVALID_JSON\", {\n      cause: error instanceof Error ? error.message : String(error),\n    });\n  }\n\n  const payloadResult = robotRockWebhookPayloadBodySchema.safeParse(parsedBody);\n  if (!payloadResult.success) {\n    throw new RobotRockWebhookError(\n      \"Webhook payload schema validation failed\",\n      \"INVALID_PAYLOAD\",\n      payloadResult.error.flatten()\n    );\n  }\n\n  return {\n    ...payloadResult.data,\n    headers: normalizeHeaders(request.headers),\n  };\n}\n\nasync function resolveWebhookSigningSecret(\n  rawBody: string,\n  options: VerifyRobotRockWebhookOptions\n): Promise<string | undefined> {\n  if (options.secret) {\n    return options.secret;\n  }\n\n  if (options.resolveSecret) {\n    const taskId = peekWebhookTaskId(rawBody);\n    if (taskId) {\n      const resolved = await options.resolveSecret(taskId);\n      if (resolved) {\n        return resolved;\n      }\n    }\n  }\n\n  return process.env.ROBOTROCK_WEBHOOK_SECRET;\n}\n\nfunction peekWebhookTaskId(rawBody: string): string | undefined {\n  try {\n    const parsed: unknown = JSON.parse(rawBody);\n    if (\n      typeof parsed === \"object\" &&\n      parsed !== null &&\n      \"taskId\" in parsed &&\n      typeof (parsed as { taskId: unknown }).taskId === \"string\"\n    ) {\n      return (parsed as { taskId: string }).taskId;\n    }\n  } catch {\n    // fall through\n  }\n  return undefined;\n}\n\nfunction assertValidSignature(rawBody: string, signature: string, secret: string): void {\n  const expected = `sha256=${createHmac(\"sha256\", secret).update(rawBody).digest(\"hex\")}`;\n  const expectedBuffer = Buffer.from(expected);\n  const receivedBuffer = Buffer.from(signature);\n\n  if (\n    expectedBuffer.length !== receivedBuffer.length ||\n    !timingSafeEqual(expectedBuffer, receivedBuffer)\n  ) {\n    throw new RobotRockWebhookError(\"Webhook signature verification failed\", \"INVALID_SIGNATURE\");\n  }\n}\n\nfunction normalizeHeaders(headers: Headers): Record<string, string> {\n  const result: Record<string, string> = {};\n  headers.forEach((value, key) => {\n    result[key] = value;\n  });\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,YAAY,uBAAuB;AAG5C,IAAM,6BAA6B;AAEnC,IAAM,oCAAoC,iBAAE,OAAO;AAAA,EACjD,QAAQ,iBAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,QAAQ,iBAAE,OAAO;AAAA,IACf,IAAI,iBAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACpB,OAAO,iBAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,MAAM,iBAAE,QAAQ;AAAA,EAClB,CAAC;AAAA,EACD,WAAW,iBAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,WAAW,iBAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,aAAa,iBAAE,OAAO,EAAE,IAAI,CAAC;AAC/B,CAAC;AAED,IAAM,gCAAgC,kCAAkC,OAAO;AAAA,EAC7E,SAAS,iBAAE,OAAO,iBAAE,OAAO,CAAC;AAC9B,CAAC;AASM,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC/C,YACE,SACgB,MACA,SAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAuBA,eAAsB,uBACpB,SACA,UAAyC,CAAC,GACR;AAClC,QAAM,sBAAsB,QAAQ,mBAAmB;AACvD,QAAM,YAAY,QAAQ,QAAQ,IAAI,mBAAmB;AAEzD,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,qCAAqC,mBAAmB;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,QAAM,SAAS,MAAM,4BAA4B,SAAS,OAAO;AAEjE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,uBAAqB,SAAS,WAAW,MAAM;AAE/C,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,OAAO;AAAA,EACjC,SAAS,OAAO;AACd,UAAM,IAAI,sBAAsB,kCAAkC,gBAAgB;AAAA,MAChF,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AAEA,QAAM,gBAAgB,kCAAkC,UAAU,UAAU;AAC5E,MAAI,CAAC,cAAc,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,cAAc,MAAM,QAAQ;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG,cAAc;AAAA,IACjB,SAAS,iBAAiB,QAAQ,OAAO;AAAA,EAC3C;AACF;AAEA,eAAe,4BACb,SACA,SAC6B;AAC7B,MAAI,QAAQ,QAAQ;AAClB,WAAO,QAAQ;AAAA,EACjB;AAEA,MAAI,QAAQ,eAAe;AACzB,UAAM,SAAS,kBAAkB,OAAO;AACxC,QAAI,QAAQ;AACV,YAAM,WAAW,MAAM,QAAQ,cAAc,MAAM;AACnD,UAAI,UAAU;AACZ,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO,QAAQ,IAAI;AACrB;AAEA,SAAS,kBAAkB,SAAqC;AAC9D,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,OAAO;AAC1C,QACE,OAAO,WAAW,YAClB,WAAW,QACX,YAAY,UACZ,OAAQ,OAA+B,WAAW,UAClD;AACA,aAAQ,OAA8B;AAAA,IACxC;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,SAAiB,WAAmB,QAAsB;AACtF,QAAM,WAAW,UAAU,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;AACrF,QAAM,iBAAiB,OAAO,KAAK,QAAQ;AAC3C,QAAM,iBAAiB,OAAO,KAAK,SAAS;AAE5C,MACE,eAAe,WAAW,eAAe,UACzC,CAAC,gBAAgB,gBAAgB,cAAc,GAC/C;AACA,UAAM,IAAI,sBAAsB,yCAAyC,mBAAmB;AAAA,EAC9F;AACF;AAEA,SAAS,iBAAiB,SAA0C;AAClE,QAAM,SAAiC,CAAC;AACxC,UAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,WAAO,GAAG,IAAI;AAAA,EAChB,CAAC;AACD,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/webhook.ts"],"sourcesContent":["import { createHmac, timingSafeEqual } from \"node:crypto\";\nimport { z } from \"zod\";\n\nconst ROBOTROCK_SIGNATURE_HEADER = \"x-robotrock-signature\";\n\nconst robotRockWebhookPayloadBodySchema = z.object({\n  taskId: z.string().min(1),\n  action: z.object({\n    id: z.string().min(1),\n    title: z.string().min(1),\n    data: z.unknown(),\n  }),\n  handledBy: z.string().min(1).optional(),\n  handledAt: z.string().min(1),\n  handlerType: z.string().min(1),\n});\n\nconst robotRockWebhookPayloadSchema = robotRockWebhookPayloadBodySchema.extend({\n  headers: z.record(z.string()),\n});\n\nexport type RobotRockWebhookErrorCode =\n  | \"MISSING_WEBHOOK_SECRET\"\n  | \"MISSING_SIGNATURE\"\n  | \"INVALID_SIGNATURE\"\n  | \"INVALID_JSON\"\n  | \"INVALID_PAYLOAD\";\n\nexport class RobotRockWebhookError extends Error {\n  constructor(\n    message: string,\n    public readonly code: RobotRockWebhookErrorCode,\n    public readonly details?: unknown\n  ) {\n    super(message);\n    this.name = \"RobotRockWebhookError\";\n  }\n}\n\nexport type RobotRockWebhookPayload = z.infer<typeof robotRockWebhookPayloadSchema>;\n\nexport interface VerifyRobotRockWebhookOptions {\n  /**\n   * Override shared secret (defaults to ROBOTROCK_WEBHOOK_SECRET).\n   * Keep undefined in production to enforce the canonical env var.\n   */\n  secret?: string;\n  /**\n   * Resolve the tenant signing secret by public task id (hosted MCP uses Convex).\n   * Used when secret is not passed explicitly.\n   */\n  resolveSecret?: (taskId: string) => Promise<string | undefined>;\n  /** Signature header to read. @default \"x-robotrock-signature\" */\n  signatureHeader?: string;\n}\n\n/**\n * Verify a RobotRock webhook request and return a validated payload.\n * Throws RobotRockWebhookError with machine-readable `code` for audit logging.\n */\nexport async function verifyRobotRockWebhook(\n  request: Request,\n  options: VerifyRobotRockWebhookOptions = {}\n): Promise<RobotRockWebhookPayload> {\n  const signatureHeaderName = options.signatureHeader ?? ROBOTROCK_SIGNATURE_HEADER;\n  const signature = request.headers.get(signatureHeaderName);\n\n  if (!signature) {\n    throw new RobotRockWebhookError(\n      `Missing webhook signature header: ${signatureHeaderName}`,\n      \"MISSING_SIGNATURE\"\n    );\n  }\n\n  const rawBody = await request.text();\n  const secret = await resolveWebhookSigningSecret(rawBody, options);\n\n  if (!secret) {\n    throw new RobotRockWebhookError(\n      \"Missing webhook signing secret for verification\",\n      \"MISSING_WEBHOOK_SECRET\"\n    );\n  }\n\n  assertValidSignature(rawBody, signature, secret);\n\n  let parsedBody: unknown;\n  try {\n    parsedBody = JSON.parse(rawBody);\n  } catch (error) {\n    throw new RobotRockWebhookError(\"Webhook body is not valid JSON\", \"INVALID_JSON\", {\n      cause: error instanceof Error ? error.message : String(error),\n    });\n  }\n\n  const payloadResult = robotRockWebhookPayloadBodySchema.safeParse(parsedBody);\n  if (!payloadResult.success) {\n    throw new RobotRockWebhookError(\n      \"Webhook payload schema validation failed\",\n      \"INVALID_PAYLOAD\",\n      payloadResult.error.flatten()\n    );\n  }\n\n  return {\n    ...payloadResult.data,\n    headers: normalizeHeaders(request.headers),\n  };\n}\n\nasync function resolveWebhookSigningSecret(\n  rawBody: string,\n  options: VerifyRobotRockWebhookOptions\n): Promise<string | undefined> {\n  if (options.secret) {\n    return options.secret;\n  }\n\n  if (options.resolveSecret) {\n    const taskId = peekWebhookTaskId(rawBody);\n    if (taskId) {\n      const resolved = await options.resolveSecret(taskId);\n      if (resolved) {\n        return resolved;\n      }\n    }\n  }\n\n  return process.env.ROBOTROCK_WEBHOOK_SECRET;\n}\n\nfunction peekWebhookTaskId(rawBody: string): string | undefined {\n  try {\n    const parsed: unknown = JSON.parse(rawBody);\n    if (\n      typeof parsed === \"object\" &&\n      parsed !== null &&\n      \"taskId\" in parsed &&\n      typeof (parsed as { taskId: unknown }).taskId === \"string\"\n    ) {\n      return (parsed as { taskId: string }).taskId;\n    }\n  } catch {\n    // fall through\n  }\n  return undefined;\n}\n\nfunction assertValidSignature(rawBody: string, signature: string, secret: string): void {\n  const expected = `sha256=${createHmac(\"sha256\", secret).update(rawBody).digest(\"hex\")}`;\n  const expectedBuffer = Buffer.from(expected);\n  const receivedBuffer = Buffer.from(signature);\n\n  if (\n    expectedBuffer.length !== receivedBuffer.length ||\n    !timingSafeEqual(expectedBuffer, receivedBuffer)\n  ) {\n    throw new RobotRockWebhookError(\"Webhook signature verification failed\", \"INVALID_SIGNATURE\");\n  }\n}\n\nfunction normalizeHeaders(headers: Headers): Record<string, string> {\n  const result: Record<string, string> = {};\n  headers.forEach((value, key) => {\n    result[key] = value;\n  });\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,YAAY,uBAAuB;AAC5C,SAAS,SAAS;AAElB,IAAM,6BAA6B;AAEnC,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACjD,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACxB,QAAQ,EAAE,OAAO;AAAA,IACf,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACpB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,IACvB,MAAM,EAAE,QAAQ;AAAA,EAClB,CAAC;AAAA,EACD,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAC/B,CAAC;AAED,IAAM,gCAAgC,kCAAkC,OAAO;AAAA,EAC7E,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC;AAC9B,CAAC;AASM,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAC/C,YACE,SACgB,MACA,SAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AACF;AAuBA,eAAsB,uBACpB,SACA,UAAyC,CAAC,GACR;AAClC,QAAM,sBAAsB,QAAQ,mBAAmB;AACvD,QAAM,YAAY,QAAQ,QAAQ,IAAI,mBAAmB;AAEzD,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,qCAAqC,mBAAmB;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,QAAQ,KAAK;AACnC,QAAM,SAAS,MAAM,4BAA4B,SAAS,OAAO;AAEjE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,uBAAqB,SAAS,WAAW,MAAM;AAE/C,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,OAAO;AAAA,EACjC,SAAS,OAAO;AACd,UAAM,IAAI,sBAAsB,kCAAkC,gBAAgB;AAAA,MAChF,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AAEA,QAAM,gBAAgB,kCAAkC,UAAU,UAAU;AAC5E,MAAI,CAAC,cAAc,SAAS;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,cAAc,MAAM,QAAQ;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,GAAG,cAAc;AAAA,IACjB,SAAS,iBAAiB,QAAQ,OAAO;AAAA,EAC3C;AACF;AAEA,eAAe,4BACb,SACA,SAC6B;AAC7B,MAAI,QAAQ,QAAQ;AAClB,WAAO,QAAQ;AAAA,EACjB;AAEA,MAAI,QAAQ,eAAe;AACzB,UAAM,SAAS,kBAAkB,OAAO;AACxC,QAAI,QAAQ;AACV,YAAM,WAAW,MAAM,QAAQ,cAAc,MAAM;AACnD,UAAI,UAAU;AACZ,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO,QAAQ,IAAI;AACrB;AAEA,SAAS,kBAAkB,SAAqC;AAC9D,MAAI;AACF,UAAM,SAAkB,KAAK,MAAM,OAAO;AAC1C,QACE,OAAO,WAAW,YAClB,WAAW,QACX,YAAY,UACZ,OAAQ,OAA+B,WAAW,UAClD;AACA,aAAQ,OAA8B;AAAA,IACxC;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAEA,SAAS,qBAAqB,SAAiB,WAAmB,QAAsB;AACtF,QAAM,WAAW,UAAU,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;AACrF,QAAM,iBAAiB,OAAO,KAAK,QAAQ;AAC3C,QAAM,iBAAiB,OAAO,KAAK,SAAS;AAE5C,MACE,eAAe,WAAW,eAAe,UACzC,CAAC,gBAAgB,gBAAgB,cAAc,GAC/C;AACA,UAAM,IAAI,sBAAsB,yCAAyC,mBAAmB;AAAA,EAC9F;AACF;AAEA,SAAS,iBAAiB,SAA0C;AAClE,QAAM,SAAiC,CAAC;AACxC,UAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,WAAO,GAAG,IAAI;AAAA,EAChB,CAAC;AACD,SAAO;AACT;","names":[]}