@agent-native/core 0.101.2 → 0.101.4

package/dist/client/use-run-stuck-detection.js

@@ -28,6 +28,89 @@ export function useRunStuckDetection({ threadId, enabled = true, stuckThresholdM
         const base = apiUrl ?? agentNativePath("/_agent-native/agent-chat");
         let cancelled = false;
         let timer = null;
+        let snapshotTransitionTimer = null;
+        let snapshotVersion = 0;
+        const effectiveThresholdFor = (dispatchMode, heartbeatSinceMs) => {
+            const liveBackgroundWorker = dispatchMode === "background-processing" &&
+                heartbeatSinceMs != null &&
+                heartbeatSinceMs >= 0 &&
+                heartbeatSinceMs < FRESH_BACKGROUND_HEARTBEAT_MS;
+            const serverContinued = dispatchMode === "foreground-self-chain" ||
+                dispatchMode?.startsWith("background") === true;
+            return liveBackgroundWorker
+                ? Math.min(backgroundStuckThresholdMs, liveBackgroundStuckThresholdMs)
+                : serverContinued
+                    ? backgroundStuckThresholdMs
+                    : stuckThresholdMs;
+        };
+        const scheduleSnapshotTransition = (snapshot, observedAtMs, version) => {
+            if (snapshotTransitionTimer)
+                clearTimeout(snapshotTransitionTimer);
+            snapshotTransitionTimer = null;
+            if (cancelled ||
+                version !== snapshotVersion ||
+                !snapshot.active ||
+                snapshot.status !== "running" ||
+                snapshot.runId == null) {
+                return;
+            }
+            const currentElapsedMs = Math.max(0, Date.now() - observedAtMs);
+            const currentHeartbeatSinceMs = snapshot.heartbeatSinceMs == null
+                ? null
+                : snapshot.heartbeatSinceMs + currentElapsedMs;
+            const currentStuckSinceMs = snapshot.stuckSinceMs == null
+                ? null
+                : snapshot.stuckSinceMs + currentElapsedMs;
+            const effectiveThresholdMs = effectiveThresholdFor(snapshot.dispatchMode, currentHeartbeatSinceMs);
+            const currentlyStuck = Boolean(currentStuckSinceMs != null &&
+                currentStuckSinceMs > effectiveThresholdMs);
+            const transitionDelaysMs = [];
+            if (currentHeartbeatSinceMs != null &&
+                currentHeartbeatSinceMs >= 0 &&
+                currentHeartbeatSinceMs < FRESH_BACKGROUND_HEARTBEAT_MS) {
+                transitionDelaysMs.push(FRESH_BACKGROUND_HEARTBEAT_MS - currentHeartbeatSinceMs + 1);
+            }
+            if (currentStuckSinceMs != null && !currentlyStuck) {
+                transitionDelaysMs.push(Math.max(1, effectiveThresholdMs - currentStuckSinceMs + 1));
+            }
+            if (transitionDelaysMs.length === 0)
+                return;
+            // Both ages originate from the server clock. Advance those snapshots by
+            // only a local elapsed duration, which remains safe when client/server
+            // wall clocks differ. Wake at the earlier semantic boundary, then
+            // reschedule if the other boundary is still ahead.
+            const delayMs = Math.max(1, Math.min(...transitionDelaysMs));
+            snapshotTransitionTimer = setTimeout(() => {
+                snapshotTransitionTimer = null;
+                if (cancelled || version !== snapshotVersion)
+                    return;
+                const elapsedSinceObservationMs = Math.max(0, Date.now() - observedAtMs);
+                const nextHeartbeatSinceMs = snapshot.heartbeatSinceMs == null
+                    ? null
+                    : snapshot.heartbeatSinceMs + elapsedSinceObservationMs;
+                const nextStuckSinceMs = snapshot.stuckSinceMs == null
+                    ? null
+                    : snapshot.stuckSinceMs + elapsedSinceObservationMs;
+                const nextEffectiveThresholdMs = effectiveThresholdFor(snapshot.dispatchMode, nextHeartbeatSinceMs);
+                const nextIsStuck = Boolean(nextStuckSinceMs != null &&
+                    nextStuckSinceMs > nextEffectiveThresholdMs);
+                setState((current) => {
+                    if (version !== snapshotVersion ||
+                        current.runId !== snapshot.runId ||
+                        current.lastProgressAt !== snapshot.lastProgressAt ||
+                        current.heartbeatAt !== snapshot.heartbeatAt) {
+                        return current;
+                    }
+                    return {
+                        ...current,
+                        isStuck: nextIsStuck,
+                        stuckSinceMs: nextStuckSinceMs,
+                        heartbeatSinceMs: nextHeartbeatSinceMs,
+                    };
+                });
+                scheduleSnapshotTransition(snapshot, observedAtMs, version);
+            }, delayMs);
+        };
         const poll = async () => {
             if (cancelled)
                 return;
@@ -49,30 +132,29 @@ export function useRunStuckDetection({ threadId, enabled = true, stuckThresholdM
                     const heartbeatAt = data.heartbeatAt ?? null;
                     const heartbeatSinceMs = heartbeatAt != null ? nowMs - heartbeatAt : null;
                     const dispatchMode = typeof data.dispatchMode === "string" ? data.dispatchMode : null;
-                    // Server-continued runs get the wider threshold: the server's own
-                    // recovery (150s no-progress backstop + chained continuations) must
-                    // get its chance before the user sees a "stuck" affordance.
-                    const serverContinued = dispatchMode === "foreground-self-chain" ||
-                        dispatchMode?.startsWith("background") === true;
                     // A claimed durable worker with a fresh heartbeat can legitimately
-                    // be waiting on a bounded long-running tool/sub-agent call. Showing
-                    // Retry at the generic 3-minute continuation threshold aborts healthy
-                    // work and starts the same call again. Let the worker's own 12-minute
-                    // watchdog act first; a dead/stale heartbeat still gets the earlier
-                    // background fallback below.
-                    const liveBackgroundWorker = dispatchMode === "background-processing" &&
-                        heartbeatSinceMs != null &&
-                        heartbeatSinceMs >= 0 &&
-                        heartbeatSinceMs < FRESH_BACKGROUND_HEARTBEAT_MS;
-                    const effectiveThresholdMs = liveBackgroundWorker
-                        ? liveBackgroundStuckThresholdMs
-                        : serverContinued
-                            ? backgroundStuckThresholdMs
-                            : stuckThresholdMs;
+                    // be waiting on a bounded long-running tool/sub-agent call. Still
+                    // surface informational status at the normal background threshold;
+                    // RunStuckBanner uses the fresh heartbeat to withhold Retry while
+                    // keeping an explicit Cancel available. The legacy live-worker
+                    // threshold may make that notice earlier, but never later.
+                    const effectiveThresholdMs = effectiveThresholdFor(dispatchMode, heartbeatSinceMs);
                     const isStuck = Boolean(data.active &&
                         data.status === "running" &&
                         stuckSinceMs != null &&
                         stuckSinceMs > effectiveThresholdMs);
+                    const observedAtMs = Date.now();
+                    const version = ++snapshotVersion;
+                    scheduleSnapshotTransition({
+                        active: data.active,
+                        runId: data.runId ?? null,
+                        status: data.status ?? null,
+                        lastProgressAt,
+                        stuckSinceMs,
+                        heartbeatAt,
+                        heartbeatSinceMs,
+                        dispatchMode,
+                    }, observedAtMs, version);
                     setState({
                         isStuck,
                         runId: data.runId ?? null,
@@ -107,8 +189,11 @@ export function useRunStuckDetection({ threadId, enabled = true, stuckThresholdM
         timer = setTimeout(poll, 2_000);
         return () => {
             cancelled = true;
+            snapshotVersion += 1;
             if (timer)
                 clearTimeout(timer);
+            if (snapshotTransitionTimer)
+                clearTimeout(snapshotTransitionTimer);
         };
     }, [
         threadId,

package/dist/client/use-run-stuck-detection.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-run-stuck-detection.js","sourceRoot":"","sources":["../../src/client/use-run-stuck-detection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AA2EhD,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,CAAC,MAAM,qCAAqC,GAAG,OAAO,CAAC;AAC7D,MAAM,CAAC,MAAM,0CAA0C,GAAG,EAAE,GAAG,MAAM,CAAC;AACtE,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAe7C,MAAM,WAAW,GAAkB;IACjC,OAAO,EAAE,KAAK;IACd,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,YAAY,EAAE,IAAI;IAClB,eAAe,EAAE,IAAI;CACtB,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,EACnC,QAAQ,EACR,OAAO,GAAG,IAAI,EACd,gBAAgB,GAAG,0BAA0B,EAC7C,0BAA0B,GAAG,qCAAqC,EAClE,8BAA8B,GAAG,0CAA0C,EAC3E,cAAc,GAAG,wBAAwB,EACzC,MAAM,GACsB;IAC5B,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,WAAW,CAAC,CAAC;IAE/D,SAAS,CAAC,GAAG,EAAE;QACb,qEAAqE;QACrE,kEAAkE;QAClE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtB,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;YAAE,OAAO;QAElC,MAAM,IAAI,GAAG,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACpE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,KAAK,GAAyC,IAAI,CAAC;QAEvD,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,IAAI,SAAS;gBAAE,OAAO;YACtB,IAAI,SAAS,GAAG,cAAc,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,yBAAyB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAC9D,EAAE,WAAW,EAAE,aAAa,EAAE,CAC/B,CAAC;gBACF,IAAI,SAAS;oBAAE,OAAO;gBACtB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;oBACrD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;oBACnD,uEAAuE;oBACvE,uEAAuE;oBACvE,sEAAsE;oBACtE,sEAAsE;oBACtE,gEAAgE;oBAChE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC3C,MAAM,YAAY,GAChB,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;oBACzD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;oBAC7C,MAAM,gBAAgB,GACpB,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;oBACnD,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;oBACnE,kEAAkE;oBAClE,oEAAoE;oBACpE,4DAA4D;oBAC5D,MAAM,eAAe,GACnB,YAAY,KAAK,uBAAuB;wBACxC,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;oBAClD,mEAAmE;oBACnE,oEAAoE;oBACpE,sEAAsE;oBACtE,sEAAsE;oBACtE,oEAAoE;oBACpE,6BAA6B;oBAC7B,MAAM,oBAAoB,GACxB,YAAY,KAAK,uBAAuB;wBACxC,gBAAgB,IAAI,IAAI;wBACxB,gBAAgB,IAAI,CAAC;wBACrB,gBAAgB,GAAG,6BAA6B,CAAC;oBACnD,MAAM,oBAAoB,GAAG,oBAAoB;wBAC/C,CAAC,CAAC,8BAA8B;wBAChC,CAAC,CAAC,eAAe;4BACf,CAAC,CAAC,0BAA0B;4BAC5B,CAAC,CAAC,gBAAgB,CAAC;oBACvB,MAAM,OAAO,GAAG,OAAO,CACrB,IAAI,CAAC,MAAM;wBACX,IAAI,CAAC,MAAM,KAAK,SAAS;wBACzB,YAAY,IAAI,IAAI;wBACpB,YAAY,GAAG,oBAAoB,CACpC,CAAC;oBACF,QAAQ,CAAC;wBACP,OAAO;wBACP,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;wBACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;wBAC3B,cAAc;wBACd,YAAY;wBACZ,WAAW;wBACX,gBAAgB;wBAChB,YAAY;wBACZ,eAAe,EACb,OAAO,IAAI,CAAC,eAAe,KAAK,SAAS;4BACvC,CAAC,CAAC,IAAI,CAAC,eAAe;4BACtB,CAAC,CAAC,IAAI;qBACX,CAAC,CAAC;oBACH,gEAAgE;oBAChE,+DAA+D;oBAC/D,mEAAmE;oBACnE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBAC9C,SAAS,GAAG,wBAAwB,CAAC;oBACvC,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACtC,CAAC;QACH,CAAC,CAAC;QAEF,oEAAoE;QACpE,mEAAmE;QACnE,uBAAuB;QACvB,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEhC,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC,CAAC;IACJ,CAAC,EAAE;QACD,QAAQ;QACR,OAAO;QACP,gBAAgB;QAChB,0BAA0B;QAC1B,8BAA8B;QAC9B,cAAc;QACd,MAAM;KACP,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAAe;IACzC,OAAO,WAAW,CAChB,KAAK,EAAE,KAAa,EAAE,MAAM,GAAW,MAAM,EAA0B,EAAE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,SAAS,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EACjD;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,WAAW,EAAE,aAAa;gBAC1B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;aACjC,CACF,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,EACD,CAAC,MAAM,CAAC,CACT,CAAC;AACJ,CAAC","sourcesContent":["import { useEffect, useState, useCallback } from \"react\";\n\nimport { agentNativePath } from \"./api-path.js\";\n\n/**\n * Per-thread chat run health, derived from the durable `last_progress_at`\n * timestamp on the server. Drives the user-visible \"this chat looks stuck\"\n * affordance — distinct from the silent reconnect logic in\n * `agent-chat-adapter.ts`, which keeps trying in the background. When\n * automatic recovery isn't making progress (for whatever reason), this\n * hook surfaces a Retry / Cancel button to the user instead of leaving\n * them staring at a frozen spinner.\n */\nexport interface RunStuckState {\n  /** True when an active run hasn't emitted an event for `stuckThresholdMs`. */\n  isStuck: boolean;\n  /** ID of the active run, or null when nothing is in flight. */\n  runId: string | null;\n  /** Server-side run status (\"running\" / \"completed\" / \"errored\" / etc.). */\n  status: string | null;\n  /** Server timestamp (ms) of the last emitted event, or null if none yet. */\n  lastProgressAt: number | null;\n  /** Milliseconds since `lastProgressAt`, or null. */\n  stuckSinceMs: number | null;\n  /** Server timestamp (ms) of the last process-alive heartbeat. */\n  heartbeatAt: number | null;\n  /** Milliseconds since `heartbeatAt`, computed against the server clock. */\n  heartbeatSinceMs: number | null;\n  /** How the run was dispatched/continued, e.g. foreground-self-chain or background-processing. */\n  dispatchMode: string | null;\n  /**\n   * Server-authoritative: true when the run holds an open tool call or A2A\n   * `agent_call` delegation (`in_flight_since` marker set). Preferred over the\n   * client-side proxy for deciding whether Retry (which aborts the run) is\n   * safe to offer. Null when the server bundle predates this field.\n   */\n  hasInFlightWork: boolean | null;\n}\n\nexport interface UseRunStuckDetectionOptions {\n  /** The thread to monitor. Pass null/undefined to disable polling. */\n  threadId: string | null | undefined;\n  /**\n   * Set false to skip scheduling the poll loop entirely — used to gate\n   * polling to only the active chat tab when multiple tabs are mounted\n   * (inactive tabs are kept alive via display:none, not unmounted).\n   * Defaults to true.\n   */\n  enabled?: boolean;\n  /**\n   * Threshold above which an in-flight FOREGROUND run is considered stuck.\n   * The default sits comfortably above the adapter's 75s no-progress\n   * reconnect — by then automatic recovery has already had its chance.\n   */\n  stuckThresholdMs?: number;\n  /**\n   * Threshold for BACKGROUND-dispatched runs (dispatchMode starts with\n   * \"background\"). The server owns recovery for these — its run-manager\n   * no-progress backstop (150s) and unclaimed-run sweep act first — so the\n   * user-facing \"stuck\" affordance is a late fallback, not a race against\n   * them. Selected inside the hook because the dispatch mode is only known\n   * from the same poll response that computes the elapsed time.\n   */\n  backgroundStuckThresholdMs?: number;\n  /**\n   * Threshold for a claimed durable background worker that is still sending\n   * fresh process heartbeats. These workers can legitimately spend up to the\n   * 12-minute tool/no-progress window on large Design, Plan, or Assets work.\n   * Default 13 minutes, matching the durable chunk handoff boundary.\n   */\n  liveBackgroundStuckThresholdMs?: number;\n  /** Poll interval. Default 5_000ms. */\n  pollIntervalMs?: number;\n  /** API base path. Default `/_agent-native/agent-chat`. */\n  apiUrl?: string;\n}\n\nconst DEFAULT_STUCK_THRESHOLD_MS = 90_000;\nexport const DEFAULT_BACKGROUND_STUCK_THRESHOLD_MS = 180_000;\nexport const DEFAULT_LIVE_BACKGROUND_STUCK_THRESHOLD_MS = 13 * 60_000;\nconst DEFAULT_POLL_INTERVAL_MS = 5_000;\nconst IDLE_BACKOFF_INTERVAL_MS = 15_000;\nconst FRESH_BACKGROUND_HEARTBEAT_MS = 30_000;\n\ninterface ActiveRunResponse {\n  active: boolean;\n  runId?: string;\n  status?: string;\n  heartbeatAt: number | null;\n  lastProgressAt?: number | null;\n  dispatchMode?: string | null;\n  /** Server clock at response time, used to compute elapsed server-relative. */\n  serverNow?: number;\n  /** True when the run holds an open tool/A2A call (in_flight_since marker). */\n  hasInFlightWork?: boolean;\n}\n\nconst EMPTY_STATE: RunStuckState = {\n  isStuck: false,\n  runId: null,\n  status: null,\n  lastProgressAt: null,\n  stuckSinceMs: null,\n  heartbeatAt: null,\n  heartbeatSinceMs: null,\n  dispatchMode: null,\n  hasInFlightWork: null,\n};\n\nexport function useRunStuckDetection({\n  threadId,\n  enabled = true,\n  stuckThresholdMs = DEFAULT_STUCK_THRESHOLD_MS,\n  backgroundStuckThresholdMs = DEFAULT_BACKGROUND_STUCK_THRESHOLD_MS,\n  liveBackgroundStuckThresholdMs = DEFAULT_LIVE_BACKGROUND_STUCK_THRESHOLD_MS,\n  pollIntervalMs = DEFAULT_POLL_INTERVAL_MS,\n  apiUrl,\n}: UseRunStuckDetectionOptions): RunStuckState {\n  const [state, setState] = useState<RunStuckState>(EMPTY_STATE);\n\n  useEffect(() => {\n    // Reset on every thread change so the previous thread's stuck banner\n    // doesn't bleed onto the new one before the first poll completes.\n    setState(EMPTY_STATE);\n    if (!threadId || !enabled) return;\n\n    const base = apiUrl ?? agentNativePath(\"/_agent-native/agent-chat\");\n    let cancelled = false;\n    let timer: ReturnType<typeof setTimeout> | null = null;\n\n    const poll = async () => {\n      if (cancelled) return;\n      let nextDelay = pollIntervalMs;\n      try {\n        const res = await fetch(\n          `${base}/runs/active?threadId=${encodeURIComponent(threadId)}`,\n          { credentials: \"same-origin\" },\n        );\n        if (cancelled) return;\n        if (res.ok) {\n          const data = (await res.json()) as ActiveRunResponse;\n          const lastProgressAt = data.lastProgressAt ?? null;\n          // Measure elapsed against the SERVER clock (serverNow) rather than the\n          // client's Date.now(). lastProgressAt is a server timestamp, so client\n          // clock skew of more than stuckThresholdMs would otherwise mark every\n          // run stuck (clock ahead) or never stuck (clock behind). Fall back to\n          // the client clock for older bundles that don't send serverNow.\n          const nowMs = data.serverNow ?? Date.now();\n          const stuckSinceMs =\n            lastProgressAt != null ? nowMs - lastProgressAt : null;\n          const heartbeatAt = data.heartbeatAt ?? null;\n          const heartbeatSinceMs =\n            heartbeatAt != null ? nowMs - heartbeatAt : null;\n          const dispatchMode =\n            typeof data.dispatchMode === \"string\" ? data.dispatchMode : null;\n          // Server-continued runs get the wider threshold: the server's own\n          // recovery (150s no-progress backstop + chained continuations) must\n          // get its chance before the user sees a \"stuck\" affordance.\n          const serverContinued =\n            dispatchMode === \"foreground-self-chain\" ||\n            dispatchMode?.startsWith(\"background\") === true;\n          // A claimed durable worker with a fresh heartbeat can legitimately\n          // be waiting on a bounded long-running tool/sub-agent call. Showing\n          // Retry at the generic 3-minute continuation threshold aborts healthy\n          // work and starts the same call again. Let the worker's own 12-minute\n          // watchdog act first; a dead/stale heartbeat still gets the earlier\n          // background fallback below.\n          const liveBackgroundWorker =\n            dispatchMode === \"background-processing\" &&\n            heartbeatSinceMs != null &&\n            heartbeatSinceMs >= 0 &&\n            heartbeatSinceMs < FRESH_BACKGROUND_HEARTBEAT_MS;\n          const effectiveThresholdMs = liveBackgroundWorker\n            ? liveBackgroundStuckThresholdMs\n            : serverContinued\n              ? backgroundStuckThresholdMs\n              : stuckThresholdMs;\n          const isStuck = Boolean(\n            data.active &&\n            data.status === \"running\" &&\n            stuckSinceMs != null &&\n            stuckSinceMs > effectiveThresholdMs,\n          );\n          setState({\n            isStuck,\n            runId: data.runId ?? null,\n            status: data.status ?? null,\n            lastProgressAt,\n            stuckSinceMs,\n            heartbeatAt,\n            heartbeatSinceMs,\n            dispatchMode,\n            hasInFlightWork:\n              typeof data.hasInFlightWork === \"boolean\"\n                ? data.hasInFlightWork\n                : null,\n          });\n          // Back off polling when nothing is in flight — there's no point\n          // hammering the endpoint while the chat is idle. We still poll\n          // occasionally so a fresh run started in another tab is picked up.\n          if (!data.active || data.status !== \"running\") {\n            nextDelay = IDLE_BACKOFF_INTERVAL_MS;\n          }\n        }\n      } catch {\n        // Network blip — leave previous state. Next tick will retry.\n      }\n      if (!cancelled) {\n        timer = setTimeout(poll, nextDelay);\n      }\n    };\n\n    // Stagger the first poll so a freshly-started run isn't immediately\n    // classified as stuck before the server has had a chance to record\n    // any progress events.\n    timer = setTimeout(poll, 2_000);\n\n    return () => {\n      cancelled = true;\n      if (timer) clearTimeout(timer);\n    };\n  }, [\n    threadId,\n    enabled,\n    stuckThresholdMs,\n    backgroundStuckThresholdMs,\n    liveBackgroundStuckThresholdMs,\n    pollIntervalMs,\n    apiUrl,\n  ]);\n\n  return state;\n}\n\n/**\n * POST `/runs/:id/abort` so the server flips the run to \"aborted\" and the\n * adapter's reconnect loop exits cleanly. Returns the run id that was\n * aborted (or null on failure) so callers can correlate observability\n * events. Best-effort — failures are swallowed, since the user's intent\n * is already captured locally.\n */\nexport function useAbortRun(apiUrl?: string) {\n  return useCallback(\n    async (runId: string, reason: string = \"user\"): Promise<string | null> => {\n      const base = apiUrl ?? agentNativePath(\"/_agent-native/agent-chat\");\n      try {\n        const res = await fetch(\n          `${base}/runs/${encodeURIComponent(runId)}/abort`,\n          {\n            method: \"POST\",\n            headers: { \"Content-Type\": \"application/json\" },\n            credentials: \"same-origin\",\n            body: JSON.stringify({ reason }),\n          },\n        );\n        if (!res.ok) return null;\n        return runId;\n      } catch {\n        return null;\n      }\n    },\n    [apiUrl],\n  );\n}\n"]}
+{"version":3,"file":"use-run-stuck-detection.js","sourceRoot":"","sources":["../../src/client/use-run-stuck-detection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AA2EhD,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,CAAC,MAAM,qCAAqC,GAAG,OAAO,CAAC;AAC7D,MAAM,CAAC,MAAM,0CAA0C,GAAG,EAAE,GAAG,MAAM,CAAC;AACtE,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAe7C,MAAM,WAAW,GAAkB;IACjC,OAAO,EAAE,KAAK;IACd,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,IAAI;IACZ,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,WAAW,EAAE,IAAI;IACjB,gBAAgB,EAAE,IAAI;IACtB,YAAY,EAAE,IAAI;IAClB,eAAe,EAAE,IAAI;CACtB,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,EACnC,QAAQ,EACR,OAAO,GAAG,IAAI,EACd,gBAAgB,GAAG,0BAA0B,EAC7C,0BAA0B,GAAG,qCAAqC,EAClE,8BAA8B,GAAG,0CAA0C,EAC3E,cAAc,GAAG,wBAAwB,EACzC,MAAM,GACsB;IAC5B,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,WAAW,CAAC,CAAC;IAE/D,SAAS,CAAC,GAAG,EAAE;QACb,qEAAqE;QACrE,kEAAkE;QAClE,QAAQ,CAAC,WAAW,CAAC,CAAC;QACtB,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;YAAE,OAAO;QAElC,MAAM,IAAI,GAAG,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACpE,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,KAAK,GAAyC,IAAI,CAAC;QACvD,IAAI,uBAAuB,GAAyC,IAAI,CAAC;QACzE,IAAI,eAAe,GAAG,CAAC,CAAC;QAaxB,MAAM,qBAAqB,GAAG,CAC5B,YAA2B,EAC3B,gBAA+B,EAC/B,EAAE;YACF,MAAM,oBAAoB,GACxB,YAAY,KAAK,uBAAuB;gBACxC,gBAAgB,IAAI,IAAI;gBACxB,gBAAgB,IAAI,CAAC;gBACrB,gBAAgB,GAAG,6BAA6B,CAAC;YACnD,MAAM,eAAe,GACnB,YAAY,KAAK,uBAAuB;gBACxC,YAAY,EAAE,UAAU,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC;YAClD,OAAO,oBAAoB;gBACzB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,8BAA8B,CAAC;gBACtE,CAAC,CAAC,eAAe;oBACf,CAAC,CAAC,0BAA0B;oBAC5B,CAAC,CAAC,gBAAgB,CAAC;QACzB,CAAC,CAAC;QAEF,MAAM,0BAA0B,GAAG,CACjC,QAA2B,EAC3B,YAAoB,EACpB,OAAe,EACf,EAAE;YACF,IAAI,uBAAuB;gBAAE,YAAY,CAAC,uBAAuB,CAAC,CAAC;YACnE,uBAAuB,GAAG,IAAI,CAAC;YAC/B,IACE,SAAS;gBACT,OAAO,KAAK,eAAe;gBAC3B,CAAC,QAAQ,CAAC,MAAM;gBAChB,QAAQ,CAAC,MAAM,KAAK,SAAS;gBAC7B,QAAQ,CAAC,KAAK,IAAI,IAAI,EACtB,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;YAChE,MAAM,uBAAuB,GAC3B,QAAQ,CAAC,gBAAgB,IAAI,IAAI;gBAC/B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,QAAQ,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;YACnD,MAAM,mBAAmB,GACvB,QAAQ,CAAC,YAAY,IAAI,IAAI;gBAC3B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,QAAQ,CAAC,YAAY,GAAG,gBAAgB,CAAC;YAC/C,MAAM,oBAAoB,GAAG,qBAAqB,CAChD,QAAQ,CAAC,YAAY,EACrB,uBAAuB,CACxB,CAAC;YACF,MAAM,cAAc,GAAG,OAAO,CAC5B,mBAAmB,IAAI,IAAI;gBAC3B,mBAAmB,GAAG,oBAAoB,CAC3C,CAAC;YACF,MAAM,kBAAkB,GAAa,EAAE,CAAC;YACxC,IACE,uBAAuB,IAAI,IAAI;gBAC/B,uBAAuB,IAAI,CAAC;gBAC5B,uBAAuB,GAAG,6BAA6B,EACvD,CAAC;gBACD,kBAAkB,CAAC,IAAI,CACrB,6BAA6B,GAAG,uBAAuB,GAAG,CAAC,CAC5D,CAAC;YACJ,CAAC;YACD,IAAI,mBAAmB,IAAI,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACnD,kBAAkB,CAAC,IAAI,CACrB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,GAAG,mBAAmB,GAAG,CAAC,CAAC,CAC5D,CAAC;YACJ,CAAC;YACD,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAE5C,wEAAwE;YACxE,uEAAuE;YACvE,kEAAkE;YAClE,mDAAmD;YACnD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC;YAC7D,uBAAuB,GAAG,UAAU,CAAC,GAAG,EAAE;gBACxC,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,IAAI,SAAS,IAAI,OAAO,KAAK,eAAe;oBAAE,OAAO;gBACrD,MAAM,yBAAyB,GAAG,IAAI,CAAC,GAAG,CACxC,CAAC,EACD,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAC1B,CAAC;gBACF,MAAM,oBAAoB,GACxB,QAAQ,CAAC,gBAAgB,IAAI,IAAI;oBAC/B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,QAAQ,CAAC,gBAAgB,GAAG,yBAAyB,CAAC;gBAC5D,MAAM,gBAAgB,GACpB,QAAQ,CAAC,YAAY,IAAI,IAAI;oBAC3B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,QAAQ,CAAC,YAAY,GAAG,yBAAyB,CAAC;gBACxD,MAAM,wBAAwB,GAAG,qBAAqB,CACpD,QAAQ,CAAC,YAAY,EACrB,oBAAoB,CACrB,CAAC;gBACF,MAAM,WAAW,GAAG,OAAO,CACzB,gBAAgB,IAAI,IAAI;oBACxB,gBAAgB,GAAG,wBAAwB,CAC5C,CAAC;gBACF,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;oBACnB,IACE,OAAO,KAAK,eAAe;wBAC3B,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;wBAChC,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;wBAClD,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAC5C,CAAC;wBACD,OAAO,OAAO,CAAC;oBACjB,CAAC;oBACD,OAAO;wBACL,GAAG,OAAO;wBACV,OAAO,EAAE,WAAW;wBACpB,YAAY,EAAE,gBAAgB;wBAC9B,gBAAgB,EAAE,oBAAoB;qBACvC,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,0BAA0B,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAC9D,CAAC,EAAE,OAAO,CAAC,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,IAAI,SAAS;gBAAE,OAAO;YACtB,IAAI,SAAS,GAAG,cAAc,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,yBAAyB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAC9D,EAAE,WAAW,EAAE,aAAa,EAAE,CAC/B,CAAC;gBACF,IAAI,SAAS;oBAAE,OAAO;gBACtB,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;oBACX,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;oBACrD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;oBACnD,uEAAuE;oBACvE,uEAAuE;oBACvE,sEAAsE;oBACtE,sEAAsE;oBACtE,gEAAgE;oBAChE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;oBAC3C,MAAM,YAAY,GAChB,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC;oBACzD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;oBAC7C,MAAM,gBAAgB,GACpB,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;oBACnD,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;oBACnE,mEAAmE;oBACnE,kEAAkE;oBAClE,mEAAmE;oBACnE,kEAAkE;oBAClE,+DAA+D;oBAC/D,2DAA2D;oBAC3D,MAAM,oBAAoB,GAAG,qBAAqB,CAChD,YAAY,EACZ,gBAAgB,CACjB,CAAC;oBACF,MAAM,OAAO,GAAG,OAAO,CACrB,IAAI,CAAC,MAAM;wBACX,IAAI,CAAC,MAAM,KAAK,SAAS;wBACzB,YAAY,IAAI,IAAI;wBACpB,YAAY,GAAG,oBAAoB,CACpC,CAAC;oBACF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;oBAChC,MAAM,OAAO,GAAG,EAAE,eAAe,CAAC;oBAClC,0BAA0B,CACxB;wBACE,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;wBACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;wBAC3B,cAAc;wBACd,YAAY;wBACZ,WAAW;wBACX,gBAAgB;wBAChB,YAAY;qBACb,EACD,YAAY,EACZ,OAAO,CACR,CAAC;oBACF,QAAQ,CAAC;wBACP,OAAO;wBACP,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;wBACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;wBAC3B,cAAc;wBACd,YAAY;wBACZ,WAAW;wBACX,gBAAgB;wBAChB,YAAY;wBACZ,eAAe,EACb,OAAO,IAAI,CAAC,eAAe,KAAK,SAAS;4BACvC,CAAC,CAAC,IAAI,CAAC,eAAe;4BACtB,CAAC,CAAC,IAAI;qBACX,CAAC,CAAC;oBACH,gEAAgE;oBAChE,+DAA+D;oBAC/D,mEAAmE;oBACnE,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;wBAC9C,SAAS,GAAG,wBAAwB,CAAC;oBACvC,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACtC,CAAC;QACH,CAAC,CAAC;QAEF,oEAAoE;QACpE,mEAAmE;QACnE,uBAAuB;QACvB,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAEhC,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;YACjB,eAAe,IAAI,CAAC,CAAC;YACrB,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,uBAAuB;gBAAE,YAAY,CAAC,uBAAuB,CAAC,CAAC;QACrE,CAAC,CAAC;IACJ,CAAC,EAAE;QACD,QAAQ;QACR,OAAO;QACP,gBAAgB;QAChB,0BAA0B;QAC1B,8BAA8B;QAC9B,cAAc;QACd,MAAM;KACP,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAAe;IACzC,OAAO,WAAW,CAChB,KAAK,EAAE,KAAa,EAAE,MAAM,GAAW,MAAM,EAA0B,EAAE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,GAAG,IAAI,SAAS,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EACjD;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,WAAW,EAAE,aAAa;gBAC1B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;aACjC,CACF,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,EACD,CAAC,MAAM,CAAC,CACT,CAAC;AACJ,CAAC","sourcesContent":["import { useEffect, useState, useCallback } from \"react\";\n\nimport { agentNativePath } from \"./api-path.js\";\n\n/**\n * Per-thread chat run health, derived from the durable `last_progress_at`\n * timestamp on the server. Drives the user-visible \"this chat looks stuck\"\n * affordance — distinct from the silent reconnect logic in\n * `agent-chat-adapter.ts`, which keeps trying in the background. When\n * automatic recovery isn't making progress (for whatever reason), this\n * hook surfaces a Retry / Cancel button to the user instead of leaving\n * them staring at a frozen spinner.\n */\nexport interface RunStuckState {\n  /** True when an active run hasn't emitted an event for `stuckThresholdMs`. */\n  isStuck: boolean;\n  /** ID of the active run, or null when nothing is in flight. */\n  runId: string | null;\n  /** Server-side run status (\"running\" / \"completed\" / \"errored\" / etc.). */\n  status: string | null;\n  /** Server timestamp (ms) of the last emitted event, or null if none yet. */\n  lastProgressAt: number | null;\n  /** Milliseconds since `lastProgressAt`, or null. */\n  stuckSinceMs: number | null;\n  /** Server timestamp (ms) of the last process-alive heartbeat. */\n  heartbeatAt: number | null;\n  /** Milliseconds since `heartbeatAt`, computed against the server clock. */\n  heartbeatSinceMs: number | null;\n  /** How the run was dispatched/continued, e.g. foreground-self-chain or background-processing. */\n  dispatchMode: string | null;\n  /**\n   * Server-authoritative: true when the run holds an open tool call or A2A\n   * `agent_call` delegation (`in_flight_since` marker set). Preferred over the\n   * client-side proxy for deciding whether Retry (which aborts the run) is\n   * safe to offer. Null when the server bundle predates this field.\n   */\n  hasInFlightWork: boolean | null;\n}\n\nexport interface UseRunStuckDetectionOptions {\n  /** The thread to monitor. Pass null/undefined to disable polling. */\n  threadId: string | null | undefined;\n  /**\n   * Set false to skip scheduling the poll loop entirely — used to gate\n   * polling to only the active chat tab when multiple tabs are mounted\n   * (inactive tabs are kept alive via display:none, not unmounted).\n   * Defaults to true.\n   */\n  enabled?: boolean;\n  /**\n   * Threshold above which an in-flight FOREGROUND run is considered stuck.\n   * The default sits comfortably above the adapter's 75s no-progress\n   * reconnect — by then automatic recovery has already had its chance.\n   */\n  stuckThresholdMs?: number;\n  /**\n   * Threshold for BACKGROUND-dispatched runs (dispatchMode starts with\n   * \"background\"). The server owns recovery for these — its run-manager\n   * no-progress backstop (150s) and unclaimed-run sweep act first — so the\n   * user-facing \"stuck\" affordance is a late fallback, not a race against\n   * them. Selected inside the hook because the dispatch mode is only known\n   * from the same poll response that computes the elapsed time.\n   */\n  backgroundStuckThresholdMs?: number;\n  /**\n   * Legacy upper bound for a claimed durable background worker that is still\n   * sending fresh process heartbeats. Informational quiet-run UI is never\n   * delayed past `backgroundStuckThresholdMs`; this option can only request an\n   * earlier notice for live workers. Default 13 minutes.\n   */\n  liveBackgroundStuckThresholdMs?: number;\n  /** Poll interval. Default 5_000ms. */\n  pollIntervalMs?: number;\n  /** API base path. Default `/_agent-native/agent-chat`. */\n  apiUrl?: string;\n}\n\nconst DEFAULT_STUCK_THRESHOLD_MS = 90_000;\nexport const DEFAULT_BACKGROUND_STUCK_THRESHOLD_MS = 180_000;\nexport const DEFAULT_LIVE_BACKGROUND_STUCK_THRESHOLD_MS = 13 * 60_000;\nconst DEFAULT_POLL_INTERVAL_MS = 5_000;\nconst IDLE_BACKOFF_INTERVAL_MS = 15_000;\nconst FRESH_BACKGROUND_HEARTBEAT_MS = 30_000;\n\ninterface ActiveRunResponse {\n  active: boolean;\n  runId?: string;\n  status?: string;\n  heartbeatAt: number | null;\n  lastProgressAt?: number | null;\n  dispatchMode?: string | null;\n  /** Server clock at response time, used to compute elapsed server-relative. */\n  serverNow?: number;\n  /** True when the run holds an open tool/A2A call (in_flight_since marker). */\n  hasInFlightWork?: boolean;\n}\n\nconst EMPTY_STATE: RunStuckState = {\n  isStuck: false,\n  runId: null,\n  status: null,\n  lastProgressAt: null,\n  stuckSinceMs: null,\n  heartbeatAt: null,\n  heartbeatSinceMs: null,\n  dispatchMode: null,\n  hasInFlightWork: null,\n};\n\nexport function useRunStuckDetection({\n  threadId,\n  enabled = true,\n  stuckThresholdMs = DEFAULT_STUCK_THRESHOLD_MS,\n  backgroundStuckThresholdMs = DEFAULT_BACKGROUND_STUCK_THRESHOLD_MS,\n  liveBackgroundStuckThresholdMs = DEFAULT_LIVE_BACKGROUND_STUCK_THRESHOLD_MS,\n  pollIntervalMs = DEFAULT_POLL_INTERVAL_MS,\n  apiUrl,\n}: UseRunStuckDetectionOptions): RunStuckState {\n  const [state, setState] = useState<RunStuckState>(EMPTY_STATE);\n\n  useEffect(() => {\n    // Reset on every thread change so the previous thread's stuck banner\n    // doesn't bleed onto the new one before the first poll completes.\n    setState(EMPTY_STATE);\n    if (!threadId || !enabled) return;\n\n    const base = apiUrl ?? agentNativePath(\"/_agent-native/agent-chat\");\n    let cancelled = false;\n    let timer: ReturnType<typeof setTimeout> | null = null;\n    let snapshotTransitionTimer: ReturnType<typeof setTimeout> | null = null;\n    let snapshotVersion = 0;\n\n    type RunHealthSnapshot = {\n      active: boolean;\n      runId: string | null;\n      status: string | null;\n      lastProgressAt: number | null;\n      stuckSinceMs: number | null;\n      heartbeatAt: number | null;\n      heartbeatSinceMs: number | null;\n      dispatchMode: string | null;\n    };\n\n    const effectiveThresholdFor = (\n      dispatchMode: string | null,\n      heartbeatSinceMs: number | null,\n    ) => {\n      const liveBackgroundWorker =\n        dispatchMode === \"background-processing\" &&\n        heartbeatSinceMs != null &&\n        heartbeatSinceMs >= 0 &&\n        heartbeatSinceMs < FRESH_BACKGROUND_HEARTBEAT_MS;\n      const serverContinued =\n        dispatchMode === \"foreground-self-chain\" ||\n        dispatchMode?.startsWith(\"background\") === true;\n      return liveBackgroundWorker\n        ? Math.min(backgroundStuckThresholdMs, liveBackgroundStuckThresholdMs)\n        : serverContinued\n          ? backgroundStuckThresholdMs\n          : stuckThresholdMs;\n    };\n\n    const scheduleSnapshotTransition = (\n      snapshot: RunHealthSnapshot,\n      observedAtMs: number,\n      version: number,\n    ) => {\n      if (snapshotTransitionTimer) clearTimeout(snapshotTransitionTimer);\n      snapshotTransitionTimer = null;\n      if (\n        cancelled ||\n        version !== snapshotVersion ||\n        !snapshot.active ||\n        snapshot.status !== \"running\" ||\n        snapshot.runId == null\n      ) {\n        return;\n      }\n\n      const currentElapsedMs = Math.max(0, Date.now() - observedAtMs);\n      const currentHeartbeatSinceMs =\n        snapshot.heartbeatSinceMs == null\n          ? null\n          : snapshot.heartbeatSinceMs + currentElapsedMs;\n      const currentStuckSinceMs =\n        snapshot.stuckSinceMs == null\n          ? null\n          : snapshot.stuckSinceMs + currentElapsedMs;\n      const effectiveThresholdMs = effectiveThresholdFor(\n        snapshot.dispatchMode,\n        currentHeartbeatSinceMs,\n      );\n      const currentlyStuck = Boolean(\n        currentStuckSinceMs != null &&\n        currentStuckSinceMs > effectiveThresholdMs,\n      );\n      const transitionDelaysMs: number[] = [];\n      if (\n        currentHeartbeatSinceMs != null &&\n        currentHeartbeatSinceMs >= 0 &&\n        currentHeartbeatSinceMs < FRESH_BACKGROUND_HEARTBEAT_MS\n      ) {\n        transitionDelaysMs.push(\n          FRESH_BACKGROUND_HEARTBEAT_MS - currentHeartbeatSinceMs + 1,\n        );\n      }\n      if (currentStuckSinceMs != null && !currentlyStuck) {\n        transitionDelaysMs.push(\n          Math.max(1, effectiveThresholdMs - currentStuckSinceMs + 1),\n        );\n      }\n      if (transitionDelaysMs.length === 0) return;\n\n      // Both ages originate from the server clock. Advance those snapshots by\n      // only a local elapsed duration, which remains safe when client/server\n      // wall clocks differ. Wake at the earlier semantic boundary, then\n      // reschedule if the other boundary is still ahead.\n      const delayMs = Math.max(1, Math.min(...transitionDelaysMs));\n      snapshotTransitionTimer = setTimeout(() => {\n        snapshotTransitionTimer = null;\n        if (cancelled || version !== snapshotVersion) return;\n        const elapsedSinceObservationMs = Math.max(\n          0,\n          Date.now() - observedAtMs,\n        );\n        const nextHeartbeatSinceMs =\n          snapshot.heartbeatSinceMs == null\n            ? null\n            : snapshot.heartbeatSinceMs + elapsedSinceObservationMs;\n        const nextStuckSinceMs =\n          snapshot.stuckSinceMs == null\n            ? null\n            : snapshot.stuckSinceMs + elapsedSinceObservationMs;\n        const nextEffectiveThresholdMs = effectiveThresholdFor(\n          snapshot.dispatchMode,\n          nextHeartbeatSinceMs,\n        );\n        const nextIsStuck = Boolean(\n          nextStuckSinceMs != null &&\n          nextStuckSinceMs > nextEffectiveThresholdMs,\n        );\n        setState((current) => {\n          if (\n            version !== snapshotVersion ||\n            current.runId !== snapshot.runId ||\n            current.lastProgressAt !== snapshot.lastProgressAt ||\n            current.heartbeatAt !== snapshot.heartbeatAt\n          ) {\n            return current;\n          }\n          return {\n            ...current,\n            isStuck: nextIsStuck,\n            stuckSinceMs: nextStuckSinceMs,\n            heartbeatSinceMs: nextHeartbeatSinceMs,\n          };\n        });\n        scheduleSnapshotTransition(snapshot, observedAtMs, version);\n      }, delayMs);\n    };\n\n    const poll = async () => {\n      if (cancelled) return;\n      let nextDelay = pollIntervalMs;\n      try {\n        const res = await fetch(\n          `${base}/runs/active?threadId=${encodeURIComponent(threadId)}`,\n          { credentials: \"same-origin\" },\n        );\n        if (cancelled) return;\n        if (res.ok) {\n          const data = (await res.json()) as ActiveRunResponse;\n          const lastProgressAt = data.lastProgressAt ?? null;\n          // Measure elapsed against the SERVER clock (serverNow) rather than the\n          // client's Date.now(). lastProgressAt is a server timestamp, so client\n          // clock skew of more than stuckThresholdMs would otherwise mark every\n          // run stuck (clock ahead) or never stuck (clock behind). Fall back to\n          // the client clock for older bundles that don't send serverNow.\n          const nowMs = data.serverNow ?? Date.now();\n          const stuckSinceMs =\n            lastProgressAt != null ? nowMs - lastProgressAt : null;\n          const heartbeatAt = data.heartbeatAt ?? null;\n          const heartbeatSinceMs =\n            heartbeatAt != null ? nowMs - heartbeatAt : null;\n          const dispatchMode =\n            typeof data.dispatchMode === \"string\" ? data.dispatchMode : null;\n          // A claimed durable worker with a fresh heartbeat can legitimately\n          // be waiting on a bounded long-running tool/sub-agent call. Still\n          // surface informational status at the normal background threshold;\n          // RunStuckBanner uses the fresh heartbeat to withhold Retry while\n          // keeping an explicit Cancel available. The legacy live-worker\n          // threshold may make that notice earlier, but never later.\n          const effectiveThresholdMs = effectiveThresholdFor(\n            dispatchMode,\n            heartbeatSinceMs,\n          );\n          const isStuck = Boolean(\n            data.active &&\n            data.status === \"running\" &&\n            stuckSinceMs != null &&\n            stuckSinceMs > effectiveThresholdMs,\n          );\n          const observedAtMs = Date.now();\n          const version = ++snapshotVersion;\n          scheduleSnapshotTransition(\n            {\n              active: data.active,\n              runId: data.runId ?? null,\n              status: data.status ?? null,\n              lastProgressAt,\n              stuckSinceMs,\n              heartbeatAt,\n              heartbeatSinceMs,\n              dispatchMode,\n            },\n            observedAtMs,\n            version,\n          );\n          setState({\n            isStuck,\n            runId: data.runId ?? null,\n            status: data.status ?? null,\n            lastProgressAt,\n            stuckSinceMs,\n            heartbeatAt,\n            heartbeatSinceMs,\n            dispatchMode,\n            hasInFlightWork:\n              typeof data.hasInFlightWork === \"boolean\"\n                ? data.hasInFlightWork\n                : null,\n          });\n          // Back off polling when nothing is in flight — there's no point\n          // hammering the endpoint while the chat is idle. We still poll\n          // occasionally so a fresh run started in another tab is picked up.\n          if (!data.active || data.status !== \"running\") {\n            nextDelay = IDLE_BACKOFF_INTERVAL_MS;\n          }\n        }\n      } catch {\n        // Network blip — leave previous state. Next tick will retry.\n      }\n      if (!cancelled) {\n        timer = setTimeout(poll, nextDelay);\n      }\n    };\n\n    // Stagger the first poll so a freshly-started run isn't immediately\n    // classified as stuck before the server has had a chance to record\n    // any progress events.\n    timer = setTimeout(poll, 2_000);\n\n    return () => {\n      cancelled = true;\n      snapshotVersion += 1;\n      if (timer) clearTimeout(timer);\n      if (snapshotTransitionTimer) clearTimeout(snapshotTransitionTimer);\n    };\n  }, [\n    threadId,\n    enabled,\n    stuckThresholdMs,\n    backgroundStuckThresholdMs,\n    liveBackgroundStuckThresholdMs,\n    pollIntervalMs,\n    apiUrl,\n  ]);\n\n  return state;\n}\n\n/**\n * POST `/runs/:id/abort` so the server flips the run to \"aborted\" and the\n * adapter's reconnect loop exits cleanly. Returns the run id that was\n * aborted (or null on failure) so callers can correlate observability\n * events. Best-effort — failures are swallowed, since the user's intent\n * is already captured locally.\n */\nexport function useAbortRun(apiUrl?: string) {\n  return useCallback(\n    async (runId: string, reason: string = \"user\"): Promise<string | null> => {\n      const base = apiUrl ?? agentNativePath(\"/_agent-native/agent-chat\");\n      try {\n        const res = await fetch(\n          `${base}/runs/${encodeURIComponent(runId)}/abort`,\n          {\n            method: \"POST\",\n            headers: { \"Content-Type\": \"application/json\" },\n            credentials: \"same-origin\",\n            body: JSON.stringify({ reason }),\n          },\n        );\n        if (!res.ok) return null;\n        return runId;\n      } catch {\n        return null;\n      }\n    },\n    [apiUrl],\n  );\n}\n"]}

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,10 +77,10 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;
 //# sourceMappingURL=awareness.d.ts.map

package/dist/collab/awareness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"awareness.d.ts","sourceRoot":"","sources":["../../src/collab/awareness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAOD,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD,wBAAgB,mBAAmB,IAAI,YAAY,CAElD;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,cAAc,GAAG,SAAS,GAChC,IAAI,CAON;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAClD,KAAK,CAAC,EAAE,cAAc,GACrB,IAAI,CAgBN;AAoBD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAAmB,GAC7B,IAAI,CAON;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE1E;AAiBD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAO1E;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,IAAI,CAOnE;AAkCD;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;;kBAwDa,MAAM;eAAS,MAAM;;GAoB1D,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;kBAYM,MAAM;kBAAY,MAAM;;GAMvD,CAAC"}
+{"version":3,"file":"awareness.d.ts","sourceRoot":"","sources":["../../src/collab/awareness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAOD,eAAO,MAAM,sBAAsB,EAAG,kBAA2B,CAAC;AAElE,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,WAAW,CAAC;IACpB,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD,wBAAgB,mBAAmB,IAAI,YAAY,CAElD;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,cAAc,GAAG,SAAS,GAChC,IAAI,CAON;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,EAClD,KAAK,CAAC,EAAE,cAAc,GACrB,IAAI,CAgBN;AAoBD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,MAAmB,GAC7B,IAAI,CAON;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE1E;AAiBD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAO1E;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,IAAI,CAOnE;AAkCD;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa;;;;;kBAwDa,MAAM;eAAS,MAAM;;;GAoB1D,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;kBAYM,MAAM;kBAAY,MAAM;;;GAMvD,CAAC"}

package/dist/credentials/index.d.ts

@@ -14,16 +14,21 @@ export declare function resolveCredentialForScope(key: string, ctx: CredentialCo
     scope: CredentialStorageScope;
 }): Promise<string | undefined>;
 /**
- * Resolve a credential, scoped to the caller's user (and falling back to
- * the active org's shared credential, if any).
+ * Resolve a credential across the encrypted app_secrets store and the legacy
+ * settings-backed credential store. User overrides win, followed by the
+ * active org/workspace shared value.
  *
  * SECURITY: NEVER reads from process.env. Env vars are global to the
- * deployment and would leak across users in a multi-tenant app. The only
- * sources are per-user / per-org rows in the SQL `settings` table.
+ * deployment and would leak across users in a multi-tenant app.
  *
- * Storage keys (priority order):
- *   1. u:<email>:credential:<KEY>   — per-user override
- *   2. o:<orgId>:credential:<KEY>   — per-org shared credential (if orgId given)
+ * Read order:
+ *   1. user-scoped app_secrets
+ *   2. user-scoped legacy settings credential
+ *   3. org-scoped app_secrets
+ *   4. legacy workspace-scoped app_secrets for the org
+ *   5. org-scoped legacy settings credential
+ *
+ * Without an active org, step 3 is replaced by the solo workspace scope.
  */
 export declare function resolveCredential(key: string, ctx: CredentialContext): Promise<string | undefined>;
 /**

package/dist/credentials/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,KAAK,CAAC;AA6BpD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,GACzD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAc7B;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAcf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,KAAK,CAAC;AA2CpD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,GACzD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA2B7B;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/credentials/index.js

@@ -1,4 +1,5 @@
 import { encryptSecretValue, decryptSecretValue, isEncryptedSecretValue, } from "../secrets/crypto.js";
+import { readAppSecret } from "../secrets/storage.js";
 import { getSetting, putSetting, deleteSetting } from "../settings/store.js";
 const SETTING_PREFIX = "credential:";
 function userCredentialSettingKey(email, key) {
@@ -26,6 +27,16 @@ async function readCredentialSetting(settingKey) {
         return undefined;
     }
 }
+async function readScopedAppSecret(key, scope, scopeId) {
+    try {
+        return (await readAppSecret({ key, scope, scopeId }))?.value;
+    }
+    catch {
+        // Older databases may not have app_secrets yet. Keep the legacy
+        // credential store available while the table bootstraps.
+        return undefined;
+    }
+}
 /**
  * Resolve a credential from one explicit legacy SQL credential scope.
  *
@@ -44,20 +55,28 @@ export async function resolveCredentialForScope(key, ctx) {
     return readCredentialSetting(userCredentialSettingKey(ctx.userEmail, key));
 }
 /**
- * Resolve a credential, scoped to the caller's user (and falling back to
- * the active org's shared credential, if any).
+ * Resolve a credential across the encrypted app_secrets store and the legacy
+ * settings-backed credential store. User overrides win, followed by the
+ * active org/workspace shared value.
  *
  * SECURITY: NEVER reads from process.env. Env vars are global to the
- * deployment and would leak across users in a multi-tenant app. The only
- * sources are per-user / per-org rows in the SQL `settings` table.
+ * deployment and would leak across users in a multi-tenant app.
+ *
+ * Read order:
+ *   1. user-scoped app_secrets
+ *   2. user-scoped legacy settings credential
+ *   3. org-scoped app_secrets
+ *   4. legacy workspace-scoped app_secrets for the org
+ *   5. org-scoped legacy settings credential
  *
- * Storage keys (priority order):
- *   1. u:<email>:credential:<KEY>   — per-user override
- *   2. o:<orgId>:credential:<KEY>   — per-org shared credential (if orgId given)
+ * Without an active org, step 3 is replaced by the solo workspace scope.
  */
 export async function resolveCredential(key, ctx) {
     if (!ctx?.userEmail)
         return undefined;
+    const userSecret = await readScopedAppSecret(key, "user", ctx.userEmail);
+    if (userSecret)
+        return userSecret;
     const userSetting = await resolveCredentialForScope(key, {
         ...ctx,
         scope: "user",
@@ -65,9 +84,15 @@ export async function resolveCredential(key, ctx) {
     if (userSetting)
         return userSetting;
     if (ctx.orgId) {
+        const orgSecret = await readScopedAppSecret(key, "org", ctx.orgId);
+        if (orgSecret)
+            return orgSecret;
+        const workspaceSecret = await readScopedAppSecret(key, "workspace", ctx.orgId);
+        if (workspaceSecret)
+            return workspaceSecret;
         return resolveCredentialForScope(key, { ...ctx, scope: "org" });
     }
-    return undefined;
+    return readScopedAppSecret(key, "workspace", `solo:${ctx.userEmail}`);
 }
 /**
  * Check if a credential is available for the given context.

package/dist/credentials/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE7E,MAAM,cAAc,GAAG,aAAa,CAAC;AASrC,SAAS,wBAAwB,CAAC,KAAa,EAAE,GAAW;IAC1D,OAAO,KAAK,KAAK,CAAC,WAAW,EAAE,IAAI,cAAc,GAAG,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa,EAAE,GAAW;IACzD,OAAO,KAAK,KAAK,IAAI,cAAc,GAAG,GAAG,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAW,EACX,GAA0D;IAE1D,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,qBAAqB,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,qBAAqB,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,GAAsB;IAEtB,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,SAAS,CAAC;IAEtC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE;QACvD,GAAG,GAAG;QACN,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,yBAAyB,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,GAAsB;IAEtB,OAAO,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,KAAa,EACb,GAAmD;IAEnD,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,yBAAyB;IACzB,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,UAAU,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;YACxD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,UAAU,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;QAC7D,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,GAAmD;IAEnD,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,aAAa,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,MAAM,aAAa,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["import {\n  encryptSecretValue,\n  decryptSecretValue,\n  isEncryptedSecretValue,\n} from \"../secrets/crypto.js\";\nimport { getSetting, putSetting, deleteSetting } from \"../settings/store.js\";\n\nconst SETTING_PREFIX = \"credential:\";\n\nexport interface CredentialContext {\n  userEmail: string;\n  orgId?: string | null;\n}\n\nexport type CredentialStorageScope = \"user\" | \"org\";\n\nfunction userCredentialSettingKey(email: string, key: string): string {\n  return `u:${email.toLowerCase()}:${SETTING_PREFIX}${key}`;\n}\n\nfunction orgCredentialSettingKey(orgId: string, key: string): string {\n  return `o:${orgId}:${SETTING_PREFIX}${key}`;\n}\n\nasync function readCredentialSetting(\n  settingKey: string,\n): Promise<string | undefined> {\n  const setting = await getSetting(settingKey);\n  if (!setting || typeof setting.value !== \"string\") return undefined;\n  const stored = setting.value;\n  // Values written by saveCredential are AES-256-GCM encrypted at rest.\n  // Rows that predate encryption are plaintext — read them transparently\n  // (the migrate-encrypt-credentials script re-encrypts them in place).\n  if (!isEncryptedSecretValue(stored)) return stored;\n  try {\n    return decryptSecretValue(stored);\n  } catch {\n    // Key rotated, corrupt, or tampered row — treat as not set rather than\n    // surfacing ciphertext or throwing into every credential lookup.\n    return undefined;\n  }\n}\n\n/**\n * Resolve a credential from one explicit legacy SQL credential scope.\n *\n * Prefer `resolveCredential()` for normal app-local credential lookup. This\n * helper exists for workspace connection refs, where a ref can explicitly say\n * \"use the org-scoped key\" and must not accidentally read a user override.\n */\nexport async function resolveCredentialForScope(\n  key: string,\n  ctx: CredentialContext & { scope: CredentialStorageScope },\n): Promise<string | undefined> {\n  if (!ctx?.userEmail) return undefined;\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) return undefined;\n    return readCredentialSetting(orgCredentialSettingKey(ctx.orgId, key));\n  }\n  return readCredentialSetting(userCredentialSettingKey(ctx.userEmail, key));\n}\n\n/**\n * Resolve a credential, scoped to the caller's user (and falling back to\n * the active org's shared credential, if any).\n *\n * SECURITY: NEVER reads from process.env. Env vars are global to the\n * deployment and would leak across users in a multi-tenant app. The only\n * sources are per-user / per-org rows in the SQL `settings` table.\n *\n * Storage keys (priority order):\n *   1. u:<email>:credential:<KEY>   — per-user override\n *   2. o:<orgId>:credential:<KEY>   — per-org shared credential (if orgId given)\n */\nexport async function resolveCredential(\n  key: string,\n  ctx: CredentialContext,\n): Promise<string | undefined> {\n  if (!ctx?.userEmail) return undefined;\n\n  const userSetting = await resolveCredentialForScope(key, {\n    ...ctx,\n    scope: \"user\",\n  });\n  if (userSetting) return userSetting;\n\n  if (ctx.orgId) {\n    return resolveCredentialForScope(key, { ...ctx, scope: \"org\" });\n  }\n\n  return undefined;\n}\n\n/**\n * Check if a credential is available for the given context.\n */\nexport async function hasCredential(\n  key: string,\n  ctx: CredentialContext,\n): Promise<boolean> {\n  return (await resolveCredential(key, ctx)) !== undefined;\n}\n\n/**\n * Save a credential. By default writes to the per-user store; pass\n * `scope: \"org\"` to write to the active org's shared credentials.\n */\nexport async function saveCredential(\n  key: string,\n  value: string,\n  ctx: CredentialContext & { scope?: \"user\" | \"org\" },\n): Promise<void> {\n  if (!ctx?.userEmail) {\n    throw new Error(\"saveCredential requires CredentialContext with userEmail\");\n  }\n  // Encrypt at rest (AES-256-GCM) so a leaked DB backup / pg_dump / read\n  // replica doesn't expose plaintext keys. resolveCredential decrypts\n  // transparently on read.\n  const encrypted = encryptSecretValue(value);\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) {\n      throw new Error(\"saveCredential scope='org' requires orgId\");\n    }\n    await putSetting(orgCredentialSettingKey(ctx.orgId, key), {\n      value: encrypted,\n    });\n    return;\n  }\n  await putSetting(userCredentialSettingKey(ctx.userEmail, key), {\n    value: encrypted,\n  });\n}\n\n/**\n * Delete a credential from the per-user (default) or per-org store.\n */\nexport async function deleteCredential(\n  key: string,\n  ctx: CredentialContext & { scope?: \"user\" | \"org\" },\n): Promise<void> {\n  if (!ctx?.userEmail) {\n    throw new Error(\n      \"deleteCredential requires CredentialContext with userEmail\",\n    );\n  }\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) {\n      throw new Error(\"deleteCredential scope='org' requires orgId\");\n    }\n    await deleteSetting(orgCredentialSettingKey(ctx.orgId, key));\n    return;\n  }\n  await deleteSetting(userCredentialSettingKey(ctx.userEmail, key));\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAkB,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE7E,MAAM,cAAc,GAAG,aAAa,CAAC;AASrC,SAAS,wBAAwB,CAAC,KAAa,EAAE,GAAW;IAC1D,OAAO,KAAK,KAAK,CAAC,WAAW,EAAE,IAAI,cAAc,GAAG,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa,EAAE,GAAW;IACzD,OAAO,KAAK,KAAK,IAAI,cAAc,GAAG,GAAG,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAW,EACX,KAAyB,EACzB,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,yDAAyD;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAW,EACX,GAA0D;IAE1D,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,qBAAqB,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,qBAAqB,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,GAAsB;IAEtB,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,SAAS,CAAC;IAEtC,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE;QACvD,GAAG,GAAG;QACN,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAEhC,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAC/C,GAAG,EACH,WAAW,EACX,GAAG,CAAC,KAAK,CACV,CAAC;QACF,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;QAE5C,OAAO,yBAAyB,CAAC,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,mBAAmB,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,GAAsB;IAEtB,OAAO,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,KAAa,EACb,GAAmD;IAEnD,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,yBAAyB;IACzB,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,UAAU,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;YACxD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,UAAU,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;QAC7D,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,GAAmD;IAEnD,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,aAAa,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,MAAM,aAAa,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["import {\n  encryptSecretValue,\n  decryptSecretValue,\n  isEncryptedSecretValue,\n} from \"../secrets/crypto.js\";\nimport { readAppSecret, type SecretRef } from \"../secrets/storage.js\";\nimport { getSetting, putSetting, deleteSetting } from \"../settings/store.js\";\n\nconst SETTING_PREFIX = \"credential:\";\n\nexport interface CredentialContext {\n  userEmail: string;\n  orgId?: string | null;\n}\n\nexport type CredentialStorageScope = \"user\" | \"org\";\n\nfunction userCredentialSettingKey(email: string, key: string): string {\n  return `u:${email.toLowerCase()}:${SETTING_PREFIX}${key}`;\n}\n\nfunction orgCredentialSettingKey(orgId: string, key: string): string {\n  return `o:${orgId}:${SETTING_PREFIX}${key}`;\n}\n\nasync function readCredentialSetting(\n  settingKey: string,\n): Promise<string | undefined> {\n  const setting = await getSetting(settingKey);\n  if (!setting || typeof setting.value !== \"string\") return undefined;\n  const stored = setting.value;\n  // Values written by saveCredential are AES-256-GCM encrypted at rest.\n  // Rows that predate encryption are plaintext — read them transparently\n  // (the migrate-encrypt-credentials script re-encrypts them in place).\n  if (!isEncryptedSecretValue(stored)) return stored;\n  try {\n    return decryptSecretValue(stored);\n  } catch {\n    // Key rotated, corrupt, or tampered row — treat as not set rather than\n    // surfacing ciphertext or throwing into every credential lookup.\n    return undefined;\n  }\n}\n\nasync function readScopedAppSecret(\n  key: string,\n  scope: SecretRef[\"scope\"],\n  scopeId: string,\n): Promise<string | undefined> {\n  try {\n    return (await readAppSecret({ key, scope, scopeId }))?.value;\n  } catch {\n    // Older databases may not have app_secrets yet. Keep the legacy\n    // credential store available while the table bootstraps.\n    return undefined;\n  }\n}\n\n/**\n * Resolve a credential from one explicit legacy SQL credential scope.\n *\n * Prefer `resolveCredential()` for normal app-local credential lookup. This\n * helper exists for workspace connection refs, where a ref can explicitly say\n * \"use the org-scoped key\" and must not accidentally read a user override.\n */\nexport async function resolveCredentialForScope(\n  key: string,\n  ctx: CredentialContext & { scope: CredentialStorageScope },\n): Promise<string | undefined> {\n  if (!ctx?.userEmail) return undefined;\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) return undefined;\n    return readCredentialSetting(orgCredentialSettingKey(ctx.orgId, key));\n  }\n  return readCredentialSetting(userCredentialSettingKey(ctx.userEmail, key));\n}\n\n/**\n * Resolve a credential across the encrypted app_secrets store and the legacy\n * settings-backed credential store. User overrides win, followed by the\n * active org/workspace shared value.\n *\n * SECURITY: NEVER reads from process.env. Env vars are global to the\n * deployment and would leak across users in a multi-tenant app.\n *\n * Read order:\n *   1. user-scoped app_secrets\n *   2. user-scoped legacy settings credential\n *   3. org-scoped app_secrets\n *   4. legacy workspace-scoped app_secrets for the org\n *   5. org-scoped legacy settings credential\n *\n * Without an active org, step 3 is replaced by the solo workspace scope.\n */\nexport async function resolveCredential(\n  key: string,\n  ctx: CredentialContext,\n): Promise<string | undefined> {\n  if (!ctx?.userEmail) return undefined;\n\n  const userSecret = await readScopedAppSecret(key, \"user\", ctx.userEmail);\n  if (userSecret) return userSecret;\n\n  const userSetting = await resolveCredentialForScope(key, {\n    ...ctx,\n    scope: \"user\",\n  });\n  if (userSetting) return userSetting;\n\n  if (ctx.orgId) {\n    const orgSecret = await readScopedAppSecret(key, \"org\", ctx.orgId);\n    if (orgSecret) return orgSecret;\n\n    const workspaceSecret = await readScopedAppSecret(\n      key,\n      \"workspace\",\n      ctx.orgId,\n    );\n    if (workspaceSecret) return workspaceSecret;\n\n    return resolveCredentialForScope(key, { ...ctx, scope: \"org\" });\n  }\n\n  return readScopedAppSecret(key, \"workspace\", `solo:${ctx.userEmail}`);\n}\n\n/**\n * Check if a credential is available for the given context.\n */\nexport async function hasCredential(\n  key: string,\n  ctx: CredentialContext,\n): Promise<boolean> {\n  return (await resolveCredential(key, ctx)) !== undefined;\n}\n\n/**\n * Save a credential. By default writes to the per-user store; pass\n * `scope: \"org\"` to write to the active org's shared credentials.\n */\nexport async function saveCredential(\n  key: string,\n  value: string,\n  ctx: CredentialContext & { scope?: \"user\" | \"org\" },\n): Promise<void> {\n  if (!ctx?.userEmail) {\n    throw new Error(\"saveCredential requires CredentialContext with userEmail\");\n  }\n  // Encrypt at rest (AES-256-GCM) so a leaked DB backup / pg_dump / read\n  // replica doesn't expose plaintext keys. resolveCredential decrypts\n  // transparently on read.\n  const encrypted = encryptSecretValue(value);\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) {\n      throw new Error(\"saveCredential scope='org' requires orgId\");\n    }\n    await putSetting(orgCredentialSettingKey(ctx.orgId, key), {\n      value: encrypted,\n    });\n    return;\n  }\n  await putSetting(userCredentialSettingKey(ctx.userEmail, key), {\n    value: encrypted,\n  });\n}\n\n/**\n * Delete a credential from the per-user (default) or per-org store.\n */\nexport async function deleteCredential(\n  key: string,\n  ctx: CredentialContext & { scope?: \"user\" | \"org\" },\n): Promise<void> {\n  if (!ctx?.userEmail) {\n    throw new Error(\n      \"deleteCredential requires CredentialContext with userEmail\",\n    );\n  }\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) {\n      throw new Error(\"deleteCredential scope='org' requires orgId\");\n    }\n    await deleteSetting(orgCredentialSettingKey(ctx.orgId, key));\n    return;\n  }\n  await deleteSetting(userCredentialSettingKey(ctx.userEmail, key));\n}\n"]}

package/dist/deploy/build.d.ts

@@ -151,12 +151,13 @@ export declare function isDurableBackgroundDeployEnabled(): boolean;
  */
 export declare function emitSingleTemplateNetlifyBackgroundFunction(projectCwd: string): void;
 /**
- * Nitro can preserve Vite's `yjs` external in a split server chunk even when
- * its own server build has emitted `_libs/yjs.mjs`. Netlify does not install
- * that bare package at runtime, so make every emitted server chunk use the
- * bundled copy before its function is packaged.
+ * Nitro receives the React Router SSR build as prebuilt chunks, so its normal
+ * dependency resolver cannot reliably fold the preserved bare `yjs` imports
+ * into the same module instance used by core's server collaboration code.
+ * Keep Yjs external through Nitro, bundle its complete public ESM surface once,
+ * then point every emitted server chunk at that one portable runtime module.
  */
-export declare function rewriteBareYjsImportsForServerlessOutput(serverDir: string): string[];
+export declare function bundleYjsRuntimeForServerlessOutput(serverDir: string, projectCwd: string): string[];
 export declare function assertSingleTemplateNetlifyBuildOutput(projectCwd: string): void;
 /**
  * Strip the harmful single-template catch-all rewrite that points at
@@ -204,17 +205,17 @@ export interface NitroBuildPipelineOptions {
  */
 export declare function runNitroBuildPipeline(opts: NitroBuildPipelineOptions): Promise<void>;
 /**
- * Dependencies that must be bundled into every Nitro server output instead of
- * being left as runtime package imports.
- *
- * `yjs` is a direct core dependency, but it is deliberately externalized from
- * the intermediate Vite SSR graph so that Vite and Nitro do not create two
- * incompatible Yjs constructors. On file-traced serverless presets, leaving it
- * external at Nitro's final build can emit `import "yjs"` into a function
- * chunk without placing the package in that function's `node_modules`. Bundle
- * it in Nitro's final output so every template receives the one portable copy.
+ * Dependencies Nitro itself must bundle outside the controlled serverless
+ * output pass. Netlify, Vercel, and Lambda keep Yjs external through Nitro;
+ * `bundleYjsRuntimeForServerlessOutput` then creates their one portable copy.
  */
 export declare const NITRO_SERVER_RUNTIME_BUNDLED_DEPS: readonly ["yjs"];
+/**
+ * Locate the core-owned ESM entry used by the controlled serverless bundling
+ * pass. Resolving from this module keeps the build independent of whether a
+ * template exposes core's transitive Yjs dependency at its own package root.
+ */
+export declare function resolveNitroBundledYjsEntry(): string;
 /**
  * Edge runtimes have no node_modules, while Node/serverless outputs only need
  * the small set above bundled to keep their package manifests traceable.

package/dist/deploy/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/deploy/build.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;GAYG;AAuCH,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAI7B,eAAO,MAAM,6BAA6B,UAiBzC,CAAC;AAEF,eAAO,MAAM,mCAAmC,UAiB/C,CAAC;AACF,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAiFjE,CAAC;AA6BF,eAAO,MAAM,2CAA2C,EAAE,MAAM,CAC9D,MAAM,EACN,MAAM,CAmSP,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,UAAU,wBAAwB;IAChC,KAAK,EAAE,6BAA6B,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACtD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,UAAU,6BAA6B;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,UAAU,6BAA6B;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAwBD,wBAAgB,wCAAwC,CACtD,WAAW,EAAE,MAAM,EAAE,GACpB,MAAM,CAaR;AAgBD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAgBvE,wBAAgB,yCAAyC,CACvD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,EACjB,WAAW,SAAK,GACf,IAAI,CAQN;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EAAE,EACzB,WAAW,EAAE,MAAM,EAAE,EACrB,kBAAkB,GAAE,MAAM,EAAO,EACjC,OAAO,GAAE,gBAAgB,EAAO,EAChC,aAAa,GAAE,oBAAoB,GAAG,IAAW,EACjD,mBAAmB,GAAE,MAAM,EAAO,EAClC,gBAAgB,SAAmC,EACnD,OAAO,GAAE,0BAA+B,GACvC,MAAM,CA4pBR;AA4FD,wBAAgB,8CAA8C,CAC5D,QAAQ,EAAE,wBAAwB,EAClC,QAAQ,SAAmC,GAC1C,MAAM,CAiCR;AA6dD,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AA+GD,wBAAgB,OAAO,CACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,iBAAiB,cAAoB,QAoCtC;AAiCD,KAAK,0BAA0B,GAAG,OAAO,GAAG,KAAK,CAAC;AAQlD,wBAAgB,qCAAqC,CACnD,YAAY,GAAE,MAAM,CAAC,QAA2B,EAChD,QAAQ,GAAE,MAAM,CAAC,YAA2B,EAC5C,UAAU,GAAE,0BAA0B,GAAG,IAAgD,GACxF,OAAO,CAOT;AAqED,wBAAgB,gCAAgC,CAC9C,gBAAgB,EAAE,MAAM,EAAE,GACzB,MAAM,GAAG,IAAI,CA8Bf;AAED,wBAAgB,0BAA0B,CACxC,gBAAgB,EAAE,MAAM,EAAE,GACzB,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCpD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gCAAgC,IAAI,OAAO,CAK1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAgB,2CAA2C,CACzD,UAAU,EAAE,MAAM,GACjB,IAAI,CAkJN;AAuCD;;;;;GAKG;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,MAAM,GAChB,MAAM,EAAE,CA+CV;AAED,wBAAgB,sCAAsC,CACpD,UAAU,EAAE,MAAM,GACjB,IAAI,CA6JN;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAsC5E;AAuED;;;;;;GAMG;AACH,wBAAgB,yCAAyC,CACvD,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,IAAI,CAqDN;AA6ID;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,gBAAgB,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,GAAG,CAAC;IACX,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAkBD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iCAAiC,YAAI,KAAK,CAAU,CAAC;AAElE;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,GACnB,IAAI,GAAG,SAAS,MAAM,EAAE,CAK1B"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/deploy/build.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;GAYG;AAuCH,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAI7B,eAAO,MAAM,6BAA6B,UAiBzC,CAAC;AAEF,eAAO,MAAM,mCAAmC,UAiB/C,CAAC;AACF,eAAO,MAAM,8BAA8B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAiFjE,CAAC;AA6BF,eAAO,MAAM,2CAA2C,EAAE,MAAM,CAC9D,MAAM,EACN,MAAM,CAmSP,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,UAAU,wBAAwB;IAChC,KAAK,EAAE,6BAA6B,CAAC;IACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACtD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,UAAU,6BAA6B;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,UAAU,6BAA6B;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAwBD,wBAAgB,wCAAwC,CACtD,WAAW,EAAE,MAAM,EAAE,GACpB,MAAM,CAaR;AAgBD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAgBvE,wBAAgB,yCAAyC,CACvD,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,MAAM,EACjB,WAAW,SAAK,GACf,IAAI,CAQN;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,eAAe,EAAE,EACzB,WAAW,EAAE,MAAM,EAAE,EACrB,kBAAkB,GAAE,MAAM,EAAO,EACjC,OAAO,GAAE,gBAAgB,EAAO,EAChC,aAAa,GAAE,oBAAoB,GAAG,IAAW,EACjD,mBAAmB,GAAE,MAAM,EAAO,EAClC,gBAAgB,SAAmC,EACnD,OAAO,GAAE,0BAA+B,GACvC,MAAM,CA4pBR;AA4FD,wBAAgB,8CAA8C,CAC5D,QAAQ,EAAE,wBAAwB,EAClC,QAAQ,SAAmC,GAC1C,MAAM,CAiCR;AA6dD,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AA+GD,wBAAgB,OAAO,CACrB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,iBAAiB,cAAoB,QAoCtC;AAiCD,KAAK,0BAA0B,GAAG,OAAO,GAAG,KAAK,CAAC;AAQlD,wBAAgB,qCAAqC,CACnD,YAAY,GAAE,MAAM,CAAC,QAA2B,EAChD,QAAQ,GAAE,MAAM,CAAC,YAA2B,EAC5C,UAAU,GAAE,0BAA0B,GAAG,IAAgD,GACxF,OAAO,CAOT;AAqED,wBAAgB,gCAAgC,CAC9C,gBAAgB,EAAE,MAAM,EAAE,GACzB,MAAM,GAAG,IAAI,CA8Bf;AAED,wBAAgB,0BAA0B,CACxC,gBAAgB,EAAE,MAAM,EAAE,GACzB,KAAK,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCpD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gCAAgC,IAAI,OAAO,CAK1D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,wBAAgB,2CAA2C,CACzD,UAAU,EAAE,MAAM,GACjB,IAAI,CAkJN;AAuCD;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GACjB,MAAM,EAAE,CAyDV;AAED,wBAAgB,sCAAsC,CACpD,UAAU,EAAE,MAAM,GACjB,IAAI,CAiLN;AAED;;;;;GAKG;AACH,wBAAgB,mCAAmC,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAsC5E;AAuED;;;;;;GAMG;AACH,wBAAgB,yCAAyC,CACvD,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,IAAI,CAqDN;AA6ID;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,gBAAgB,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,GAAG,CAAC;IACX,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,IAAI,CAAC,CA+Bf;AAkBD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,YAAI,KAAK,CAAU,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,CAQpD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,GACnB,IAAI,GAAG,SAAS,MAAM,EAAE,CAS1B"}