@agent-native/core 0.131.9 → 0.132.1

package/dist/application-state/handlers.d.ts

@@ -1,4 +1,19 @@
 export declare const getState: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<Record<string, unknown>>>;
+/** Upper bound on one batched read, so a crafted URL can't fan out unbounded. */
+export declare const MAX_APP_STATE_BATCH_KEYS = 100;
+/**
+ * `GET /_agent-native/application-state?keys=a,b,c` — read many keys for the
+ * caller's session in one round trip.
+ *
+ * `values` carries only the keys that have a stored row; every other requested
+ * key is listed in `missing`. A key whose stored value is `null` therefore
+ * appears in `values` with a `null` value and NOT in `missing`, which is what
+ * keeps "no row" distinguishable from "row holding an empty value".
+ */
+export declare const getStateMany: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    values: Record<string, unknown>;
+    missing: string[];
+}>>;
 export declare const putState: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<any>>;
 export declare const deleteState: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     ok: boolean;

package/dist/application-state/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/application-state/handlers.ts"],"names":[],"mappings":"AAwCA,eAAO,MAAM,QAAQ,wGAKnB,CAAC;AAEH,eAAO,MAAM,QAAQ,oFAOnB,CAAC;AAEH,eAAO,MAAM,WAAW;;GAMtB,CAAC;AAQH,8BAA8B;AAC9B,eAAO,MAAM,iBAAiB,0GAI5B,CAAC;AAEH,iCAAiC;AACjC,eAAO,MAAM,eAAe,wGAK1B,CAAC;AAEH,uCAAuC;AACvC,eAAO,MAAM,eAAe,oFAe1B,CAAC;AAEH,oCAAoC;AACpC,eAAO,MAAM,kBAAkB;;GAM7B,CAAC;AAEH,gCAAgC;AAChC,eAAO,MAAM,sBAAsB;;GAOlC,CAAC"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/application-state/handlers.ts"],"names":[],"mappings":"AA0CA,eAAO,MAAM,QAAQ,wGAKnB,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY;;;GA6BvB,CAAC;AAEH,eAAO,MAAM,QAAQ,oFAOnB,CAAC;AAEH,eAAO,MAAM,WAAW;;GAMtB,CAAC;AAQH,8BAA8B;AAC9B,eAAO,MAAM,iBAAiB,0GAI5B,CAAC;AAEH,iCAAiC;AACjC,eAAO,MAAM,eAAe,wGAK1B,CAAC;AAEH,uCAAuC;AACvC,eAAO,MAAM,eAAe,oFAe1B,CAAC;AAEH,oCAAoC;AACpC,eAAO,MAAM,kBAAkB;;GAM7B,CAAC;AAEH,gCAAgC;AAChC,eAAO,MAAM,sBAAsB;;GAOlC,CAAC"}

package/dist/application-state/handlers.js

@@ -1,7 +1,7 @@
-import { createError, defineEventHandler, getRouterParam, getHeader, setResponseStatus, } from "h3";
+import { createError, defineEventHandler, getRouterParam, getHeader, getQuery, setResponseStatus, } from "h3";
 import { getSession } from "../server/auth.js";
 import { readBody } from "../server/h3-helpers.js";
-import { appStateGet, appStatePut, appStateDelete, appStateList, appStateDeleteByPrefix, } from "./store.js";
+import { appStateGet, appStateGetManyEntries, appStatePut, appStateDelete, appStateList, appStateDeleteByPrefix, } from "./store.js";
 /**
  * Resolve the session ID for app state scoping. Returns the authenticated
  * user's email; throws 401 when the request has no session.
@@ -26,6 +26,46 @@ export const getState = defineEventHandler(async (event) => {
     const value = await appStateGet(sessionId, key);
     return value ?? null;
 });
+/** Upper bound on one batched read, so a crafted URL can't fan out unbounded. */
+export const MAX_APP_STATE_BATCH_KEYS = 100;
+/**
+ * `GET /_agent-native/application-state?keys=a,b,c` — read many keys for the
+ * caller's session in one round trip.
+ *
+ * `values` carries only the keys that have a stored row; every other requested
+ * key is listed in `missing`. A key whose stored value is `null` therefore
+ * appears in `values` with a `null` value and NOT in `missing`, which is what
+ * keeps "no row" distinguishable from "row holding an empty value".
+ */
+export const getStateMany = defineEventHandler(async (event) => {
+    const sessionId = await getSessionId(event);
+    const raw = getQuery(event).keys;
+    const requested = (Array.isArray(raw) ? raw : [raw])
+        .flatMap((entry) => String(entry ?? "").split(","))
+        .map((key) => safeKey(key.trim()))
+        .filter((key) => key.length > 0);
+    const keys = [...new Set(requested)];
+    if (keys.length === 0) {
+        throw createError({
+            statusCode: 400,
+            statusMessage: "Query parameter `keys` is required",
+        });
+    }
+    if (keys.length > MAX_APP_STATE_BATCH_KEYS) {
+        throw createError({
+            statusCode: 400,
+            statusMessage: `At most ${MAX_APP_STATE_BATCH_KEYS} keys may be read at once`,
+        });
+    }
+    const entries = await appStateGetManyEntries(sessionId, keys);
+    const values = {};
+    for (const entry of entries)
+        values[entry.key] = entry.value;
+    return {
+        values,
+        missing: keys.filter((key) => !(key in values)),
+    };
+});
 export const putState = defineEventHandler(async (event) => {
     const sessionId = await getSessionId(event);
     const key = safeKey(String(getRouterParam(event, "key")));

package/dist/application-state/handlers.js.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/application-state/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,WAAW,EACX,WAAW,EACX,cAAc,EACd,YAAY,EACZ,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,KAAc;IACxC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACpB,MAAM,WAAW,CAAC;YAChB,UAAU,EAAE,GAAG;YACf,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,iCAAiC;AAEjC,MAAM,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IAClE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IAClE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,WAAW,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IACrE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,uCAAuC;AAEvC,SAAS,eAAe,CAAC,EAAU;IACjC,OAAO,WAAW,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,8BAA8B;AAC9B,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IAC3E,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,iCAAiC;AACjC,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IACzE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAW,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,uCAAuC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IACzE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAW,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC;IAC9B,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,oCAAoC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IAC5E,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAW,CAAC;IACjD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,cAAc,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,gCAAgC;AAChC,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CACtD,KAAK,EAAE,KAAc,EAAE,EAAE;IACvB,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CACF,CAAC","sourcesContent":["import {\n  createError,\n  defineEventHandler,\n  getRouterParam,\n  getHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport { getSession } from \"../server/auth.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  appStateGet,\n  appStatePut,\n  appStateDelete,\n  appStateList,\n  appStateDeleteByPrefix,\n} from \"./store.js\";\n\n/**\n * Resolve the session ID for app state scoping. Returns the authenticated\n * user's email; throws 401 when the request has no session.\n */\nasync function getSessionId(event: H3Event): Promise<string> {\n  const session = await getSession(event);\n  if (!session?.email) {\n    throw createError({\n      statusCode: 401,\n      statusMessage: \"Unauthenticated\",\n    });\n  }\n  return session.email;\n}\n\nfunction safeKey(key: string): string {\n  return key.replace(/[^a-zA-Z0-9_:-]/g, \"\");\n}\n\n// --- Generic state handlers ---\n\nexport const getState = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const key = safeKey(String(getRouterParam(event, \"key\")));\n  const value = await appStateGet(sessionId, key);\n  return value ?? null;\n});\n\nexport const putState = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const key = safeKey(String(getRouterParam(event, \"key\")));\n  const body = await readBody(event);\n  const requestSource = getHeader(event, \"x-request-source\") || undefined;\n  await appStatePut(sessionId, key, body, { requestSource });\n  return body;\n});\n\nexport const deleteState = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const key = safeKey(String(getRouterParam(event, \"key\")));\n  const requestSource = getHeader(event, \"x-request-source\") || undefined;\n  await appStateDelete(sessionId, key, { requestSource });\n  return { ok: true };\n});\n\n// --- Multi-draft compose handlers ---\n\nfunction composeDraftKey(id: string): string {\n  return `compose-${safeKey(id)}`;\n}\n\n/** List all compose drafts */\nexport const listComposeDrafts = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const items = await appStateList(sessionId, \"compose-\");\n  return items.map((item) => item.value);\n});\n\n/** Get a single compose draft */\nexport const getComposeDraft = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const id = getRouterParam(event, \"id\") as string;\n  const value = await appStateGet(sessionId, composeDraftKey(id));\n  return value ?? null;\n});\n\n/** Create or update a compose draft */\nexport const putComposeDraft = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const id = getRouterParam(event, \"id\") as string;\n  const body = await readBody(event);\n  const { subject, body: bodyText } = body;\n\n  if (typeof subject !== \"string\" || typeof bodyText !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"subject and body are required strings\" };\n  }\n\n  const state = { ...body, id };\n  const requestSource = getHeader(event, \"x-request-source\") || undefined;\n  await appStatePut(sessionId, composeDraftKey(id), state, { requestSource });\n  return state;\n});\n\n/** Delete a single compose draft */\nexport const deleteComposeDraft = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const id = getRouterParam(event, \"id\") as string;\n  const requestSource = getHeader(event, \"x-request-source\") || undefined;\n  await appStateDelete(sessionId, composeDraftKey(id), { requestSource });\n  return { ok: true };\n});\n\n/** Delete all compose drafts */\nexport const deleteAllComposeDrafts = defineEventHandler(\n  async (event: H3Event) => {\n    const sessionId = await getSessionId(event);\n    const requestSource = getHeader(event, \"x-request-source\") || undefined;\n    await appStateDeleteByPrefix(sessionId, \"compose-\", { requestSource });\n    return { ok: true };\n  },\n);\n"]}
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/application-state/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,cAAc,EACd,SAAS,EACT,QAAQ,EACR,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,YAAY,EACZ,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,KAAc;IACxC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACpB,MAAM,WAAW,CAAC;YAChB,UAAU,EAAE,GAAG;YACf,aAAa,EAAE,iBAAiB;SACjC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,iCAAiC;AAEjC,MAAM,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IAClE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IACtE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;IACjC,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;SACjD,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SAClD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;SACjC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAErC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,WAAW,CAAC;YAChB,UAAU,EAAE,GAAG;YACf,aAAa,EAAE,oCAAoC;SACpD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC;YAChB,UAAU,EAAE,GAAG;YACf,aAAa,EAAE,WAAW,wBAAwB,2BAA2B;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9D,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,OAAO;QAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAC7D,OAAO;QACL,MAAM;QACN,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;KAChD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IAClE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,WAAW,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IACrE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,uCAAuC;AAEvC,SAAS,eAAe,CAAC,EAAU;IACjC,OAAO,WAAW,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,8BAA8B;AAC9B,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IAC3E,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,iCAAiC;AACjC,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IACzE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAW,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,OAAO,KAAK,IAAI,IAAI,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,uCAAuC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IACzE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAW,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAEzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC;IAC9B,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,WAAW,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,oCAAoC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;IAC5E,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAW,CAAC;IACjD,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,cAAc,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,gCAAgC;AAChC,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CACtD,KAAK,EAAE,KAAc,EAAE,EAAE;IACvB,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC;IACxE,MAAM,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;IACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC,CACF,CAAC","sourcesContent":["import {\n  createError,\n  defineEventHandler,\n  getRouterParam,\n  getHeader,\n  getQuery,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport { getSession } from \"../server/auth.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  appStateGet,\n  appStateGetManyEntries,\n  appStatePut,\n  appStateDelete,\n  appStateList,\n  appStateDeleteByPrefix,\n} from \"./store.js\";\n\n/**\n * Resolve the session ID for app state scoping. Returns the authenticated\n * user's email; throws 401 when the request has no session.\n */\nasync function getSessionId(event: H3Event): Promise<string> {\n  const session = await getSession(event);\n  if (!session?.email) {\n    throw createError({\n      statusCode: 401,\n      statusMessage: \"Unauthenticated\",\n    });\n  }\n  return session.email;\n}\n\nfunction safeKey(key: string): string {\n  return key.replace(/[^a-zA-Z0-9_:-]/g, \"\");\n}\n\n// --- Generic state handlers ---\n\nexport const getState = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const key = safeKey(String(getRouterParam(event, \"key\")));\n  const value = await appStateGet(sessionId, key);\n  return value ?? null;\n});\n\n/** Upper bound on one batched read, so a crafted URL can't fan out unbounded. */\nexport const MAX_APP_STATE_BATCH_KEYS = 100;\n\n/**\n * `GET /_agent-native/application-state?keys=a,b,c` — read many keys for the\n * caller's session in one round trip.\n *\n * `values` carries only the keys that have a stored row; every other requested\n * key is listed in `missing`. A key whose stored value is `null` therefore\n * appears in `values` with a `null` value and NOT in `missing`, which is what\n * keeps \"no row\" distinguishable from \"row holding an empty value\".\n */\nexport const getStateMany = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const raw = getQuery(event).keys;\n  const requested = (Array.isArray(raw) ? raw : [raw])\n    .flatMap((entry) => String(entry ?? \"\").split(\",\"))\n    .map((key) => safeKey(key.trim()))\n    .filter((key) => key.length > 0);\n  const keys = [...new Set(requested)];\n\n  if (keys.length === 0) {\n    throw createError({\n      statusCode: 400,\n      statusMessage: \"Query parameter `keys` is required\",\n    });\n  }\n  if (keys.length > MAX_APP_STATE_BATCH_KEYS) {\n    throw createError({\n      statusCode: 400,\n      statusMessage: `At most ${MAX_APP_STATE_BATCH_KEYS} keys may be read at once`,\n    });\n  }\n\n  const entries = await appStateGetManyEntries(sessionId, keys);\n  const values: Record<string, unknown> = {};\n  for (const entry of entries) values[entry.key] = entry.value;\n  return {\n    values,\n    missing: keys.filter((key) => !(key in values)),\n  };\n});\n\nexport const putState = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const key = safeKey(String(getRouterParam(event, \"key\")));\n  const body = await readBody(event);\n  const requestSource = getHeader(event, \"x-request-source\") || undefined;\n  await appStatePut(sessionId, key, body, { requestSource });\n  return body;\n});\n\nexport const deleteState = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const key = safeKey(String(getRouterParam(event, \"key\")));\n  const requestSource = getHeader(event, \"x-request-source\") || undefined;\n  await appStateDelete(sessionId, key, { requestSource });\n  return { ok: true };\n});\n\n// --- Multi-draft compose handlers ---\n\nfunction composeDraftKey(id: string): string {\n  return `compose-${safeKey(id)}`;\n}\n\n/** List all compose drafts */\nexport const listComposeDrafts = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const items = await appStateList(sessionId, \"compose-\");\n  return items.map((item) => item.value);\n});\n\n/** Get a single compose draft */\nexport const getComposeDraft = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const id = getRouterParam(event, \"id\") as string;\n  const value = await appStateGet(sessionId, composeDraftKey(id));\n  return value ?? null;\n});\n\n/** Create or update a compose draft */\nexport const putComposeDraft = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const id = getRouterParam(event, \"id\") as string;\n  const body = await readBody(event);\n  const { subject, body: bodyText } = body;\n\n  if (typeof subject !== \"string\" || typeof bodyText !== \"string\") {\n    setResponseStatus(event, 400);\n    return { error: \"subject and body are required strings\" };\n  }\n\n  const state = { ...body, id };\n  const requestSource = getHeader(event, \"x-request-source\") || undefined;\n  await appStatePut(sessionId, composeDraftKey(id), state, { requestSource });\n  return state;\n});\n\n/** Delete a single compose draft */\nexport const deleteComposeDraft = defineEventHandler(async (event: H3Event) => {\n  const sessionId = await getSessionId(event);\n  const id = getRouterParam(event, \"id\") as string;\n  const requestSource = getHeader(event, \"x-request-source\") || undefined;\n  await appStateDelete(sessionId, composeDraftKey(id), { requestSource });\n  return { ok: true };\n});\n\n/** Delete all compose drafts */\nexport const deleteAllComposeDrafts = defineEventHandler(\n  async (event: H3Event) => {\n    const sessionId = await getSessionId(event);\n    const requestSource = getHeader(event, \"x-request-source\") || undefined;\n    await appStateDeleteByPrefix(sessionId, \"compose-\", { requestSource });\n    return { ok: true };\n  },\n);\n"]}

package/dist/application-state/index.d.ts

@@ -1,5 +1,5 @@
-export { appStateGet, appStateGetMany, appStatePut, appStateDelete, appStateCompareAndSet, appStateCompareAndSetMany, appStateList, appStateDeleteByPrefix, type AppStateCompareAndSetOperation, } from "./store.js";
+export { appStateGet, appStateGetMany, appStateGetManyEntries, appStatePut, appStateDelete, appStateCompareAndSet, appStateCompareAndSetMany, appStateList, appStateDeleteByPrefix, type AppStateCompareAndSetOperation, } from "./store.js";
 export { getAppStateEmitter, emitAppStateChange, emitAppStateDelete, type AppStateEvent, } from "./emitter.js";
-export { getState, putState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, } from "./handlers.js";
+export { getState, getStateMany, MAX_APP_STATE_BATCH_KEYS, putState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, } from "./handlers.js";
 export { readAppState, writeAppState, deleteAppState, compareAndSetAppState, compareAndSetManyAppState, listAppState, deleteAppStateByPrefix, readAppStateForCurrentTab, writeAppStateForCurrentTab, appStateKeyForBrowserTab, getCurrentRequestBrowserTabId, } from "./script-helpers.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/application-state/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/application-state/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,eAAe,EACf,WAAW,EACX,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,YAAY,EACZ,sBAAsB,EACtB,KAAK,8BAA8B,GACpC,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,YAAY,EACZ,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/application-state/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,YAAY,EACZ,sBAAsB,EACtB,KAAK,8BAA8B,GACpC,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,wBAAwB,EACxB,QAAQ,EACR,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,YAAY,EACZ,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC"}

package/dist/application-state/index.js

@@ -1,9 +1,9 @@
 // Store
-export { appStateGet, appStateGetMany, appStatePut, appStateDelete, appStateCompareAndSet, appStateCompareAndSetMany, appStateList, appStateDeleteByPrefix, } from "./store.js";
+export { appStateGet, appStateGetMany, appStateGetManyEntries, appStatePut, appStateDelete, appStateCompareAndSet, appStateCompareAndSetMany, appStateList, appStateDeleteByPrefix, } from "./store.js";
 // Emitter (for SSE wiring)
 export { getAppStateEmitter, emitAppStateChange, emitAppStateDelete, } from "./emitter.js";
 // H3 route handlers (for templates)
-export { getState, putState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, } from "./handlers.js";
+export { getState, getStateMany, MAX_APP_STATE_BATCH_KEYS, putState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, } from "./handlers.js";
 // Script helpers
 export { readAppState, writeAppState, deleteAppState, compareAndSetAppState, compareAndSetManyAppState, listAppState, deleteAppStateByPrefix, readAppStateForCurrentTab, writeAppStateForCurrentTab, appStateKeyForBrowserTab, getCurrentRequestBrowserTabId, } from "./script-helpers.js";
 //# sourceMappingURL=index.js.map

package/dist/application-state/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/application-state/index.ts"],"names":[],"mappings":"AAAA,QAAQ;AACR,OAAO,EACL,WAAW,EACX,eAAe,EACf,WAAW,EACX,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,YAAY,EACZ,sBAAsB,GAEvB,MAAM,YAAY,CAAC;AAEpB,2BAA2B;AAC3B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AAEtB,oCAAoC;AACpC,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,iBAAiB;AACjB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,YAAY,EACZ,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC","sourcesContent":["// Store\nexport {\n  appStateGet,\n  appStateGetMany,\n  appStatePut,\n  appStateDelete,\n  appStateCompareAndSet,\n  appStateCompareAndSetMany,\n  appStateList,\n  appStateDeleteByPrefix,\n  type AppStateCompareAndSetOperation,\n} from \"./store.js\";\n\n// Emitter (for SSE wiring)\nexport {\n  getAppStateEmitter,\n  emitAppStateChange,\n  emitAppStateDelete,\n  type AppStateEvent,\n} from \"./emitter.js\";\n\n// H3 route handlers (for templates)\nexport {\n  getState,\n  putState,\n  deleteState,\n  listComposeDrafts,\n  getComposeDraft,\n  putComposeDraft,\n  deleteComposeDraft,\n  deleteAllComposeDrafts,\n} from \"./handlers.js\";\n\n// Script helpers\nexport {\n  readAppState,\n  writeAppState,\n  deleteAppState,\n  compareAndSetAppState,\n  compareAndSetManyAppState,\n  listAppState,\n  deleteAppStateByPrefix,\n  readAppStateForCurrentTab,\n  writeAppStateForCurrentTab,\n  appStateKeyForBrowserTab,\n  getCurrentRequestBrowserTabId,\n} from \"./script-helpers.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/application-state/index.ts"],"names":[],"mappings":"AAAA,QAAQ;AACR,OAAO,EACL,WAAW,EACX,eAAe,EACf,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,YAAY,EACZ,sBAAsB,GAEvB,MAAM,YAAY,CAAC;AAEpB,2BAA2B;AAC3B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,cAAc,CAAC;AAEtB,oCAAoC;AACpC,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,wBAAwB,EACxB,QAAQ,EACR,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,iBAAiB;AACjB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,yBAAyB,EACzB,YAAY,EACZ,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC","sourcesContent":["// Store\nexport {\n  appStateGet,\n  appStateGetMany,\n  appStateGetManyEntries,\n  appStatePut,\n  appStateDelete,\n  appStateCompareAndSet,\n  appStateCompareAndSetMany,\n  appStateList,\n  appStateDeleteByPrefix,\n  type AppStateCompareAndSetOperation,\n} from \"./store.js\";\n\n// Emitter (for SSE wiring)\nexport {\n  getAppStateEmitter,\n  emitAppStateChange,\n  emitAppStateDelete,\n  type AppStateEvent,\n} from \"./emitter.js\";\n\n// H3 route handlers (for templates)\nexport {\n  getState,\n  getStateMany,\n  MAX_APP_STATE_BATCH_KEYS,\n  putState,\n  deleteState,\n  listComposeDrafts,\n  getComposeDraft,\n  putComposeDraft,\n  deleteComposeDraft,\n  deleteAllComposeDrafts,\n} from \"./handlers.js\";\n\n// Script helpers\nexport {\n  readAppState,\n  writeAppState,\n  deleteAppState,\n  compareAndSetAppState,\n  compareAndSetManyAppState,\n  listAppState,\n  deleteAppStateByPrefix,\n  readAppStateForCurrentTab,\n  writeAppStateForCurrentTab,\n  appStateKeyForBrowserTab,\n  getCurrentRequestBrowserTabId,\n} from \"./script-helpers.js\";\n"]}

package/dist/application-state/store.d.ts

@@ -1,5 +1,16 @@
 import type { StoreWriteOptions } from "../settings/store.js";
 export declare function appStateGet(sessionId: string, key: string): Promise<Record<string, unknown> | null>;
+/**
+ * Read several application-state keys for one session in a single SQL query,
+ * returning ONLY the rows that exist. A key absent from the result has no row;
+ * a key present with a `null` value has a row that stores `null`. Callers that
+ * must not conflate the two (the batched HTTP read) depend on that difference,
+ * so this deliberately does not pad missing keys.
+ */
+export declare function appStateGetManyEntries(sessionId: string, keys: readonly string[]): Promise<Array<{
+    key: string;
+    value: Record<string, unknown> | null;
+}>>;
 /**
  * Read several application-state keys for one session in a single SQL query.
  * Missing keys are returned as `null` so callers can preserve the requested

package/dist/application-state/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/application-state/store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAyF9D,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CASzC;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAiBzD;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAC7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACzC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,MAAM,WAAW,8BAA8B;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AA0GD,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,SAAS,8BAA8B,EAAE,EACrD,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC,CA+FlB;AAED,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC,CAWjE;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAsBjB"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/application-state/store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAyF9D,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CASzC;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CAAE,CAAC,CAAC,CAcxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAQzD;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAC7C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACzC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,MAAM,WAAW,8BAA8B;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AA0GD,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,SAAS,8BAA8B,EAAE,EACrD,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC,CA+FlB;AAED,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC,CAWjE;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,MAAM,CAAC,CAsBjB"}

package/dist/application-state/store.js

@@ -90,17 +90,16 @@ export async function appStateGet(sessionId, key) {
     return JSON.parse(rows[0].value);
 }
 /**
- * Read several application-state keys for one session in a single SQL query.
- * Missing keys are returned as `null` so callers can preserve the requested
- * shape without issuing one fallback query per key.
+ * Read several application-state keys for one session in a single SQL query,
+ * returning ONLY the rows that exist. A key absent from the result has no row;
+ * a key present with a `null` value has a row that stores `null`. Callers that
+ * must not conflate the two (the batched HTTP read) depend on that difference,
+ * so this deliberately does not pad missing keys.
  */
-export async function appStateGetMany(sessionId, keys) {
+export async function appStateGetManyEntries(sessionId, keys) {
     const uniqueKeys = [...new Set(keys)];
-    const values = {};
-    for (const key of uniqueKeys)
-        values[key] = null;
     if (uniqueKeys.length === 0)
-        return values;
+        return [];
     await ensureTable();
     const client = getDbExec();
     const placeholders = uniqueKeys.map(() => "?").join(", ");
@@ -108,8 +107,22 @@ export async function appStateGetMany(sessionId, keys) {
         sql: `SELECT key, value FROM application_state WHERE session_id = ? AND key IN (${placeholders})`,
         args: [sessionId, ...uniqueKeys],
     });
-    for (const row of rows) {
-        values[row.key] = JSON.parse(row.value);
+    return rows.map((row) => ({
+        key: row.key,
+        value: JSON.parse(row.value),
+    }));
+}
+/**
+ * Read several application-state keys for one session in a single SQL query.
+ * Missing keys are returned as `null` so callers can preserve the requested
+ * shape without issuing one fallback query per key.
+ */
+export async function appStateGetMany(sessionId, keys) {
+    const values = {};
+    for (const key of new Set(keys))
+        values[key] = null;
+    for (const entry of await appStateGetManyEntries(sessionId, keys)) {
+        values[entry.key] = entry.value;
     }
     return values;
 }

package/dist/application-state/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/application-state/store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,eAAe,EACf,UAAU,EACV,OAAO,GAER,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEtE,IAAI,YAAuC,CAAC;AAC5C,MAAM,gCAAgC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AACrE,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG;;;;;uBAKD,OAAO,EAAE;;;OAGzB,CAAC;YAEF,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,mEAAmE;gBACnE,kEAAkE;gBAClE,6DAA6D;gBAC7D,kEAAkE;gBAClE,uEAAuE;gBACvE,oEAAoE;gBACpE,uEAAuE;gBACvE,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,8CAA8C;gBAC9C,MAAM,iBAAiB,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;gBACxD,0EAA0E;gBAC1E,0EAA0E;gBAC1E,mEAAmE;gBACnE,MAAM,uBAAuB,CAAC,mBAAmB,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;gBACnE,uEAAuE;gBACvE,gEAAgE;gBAChE,MAAM,iBAAiB,CACrB,0BAA0B,EAC1B,uFAAuF,CACxF,CAAC;gBACF,MAAM,iBAAiB,CACrB,2BAA2B,EAC3B,6FAA6F,CAC9F,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,MAAM,uBAAuB,CAAC,mBAAmB,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YACnE,sCAAsC;YACtC,wEAAwE;YACxE,yEAAyE;YACzE,qEAAqE;YACrE,qEAAqE;YACrE,oDAAoD;YACpD,KAAK,MAAM,GAAG,IAAI;gBAChB,uFAAuF;gBACvF,6FAA6F;aAC9F,EAAE,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,GAAW;IAEX,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sEAAsE;QAC3E,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC;KACvB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,IAAuB;IAEvB,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAmD,EAAE,CAAC;IAClE,KAAK,MAAM,GAAG,IAAI,UAAU;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAE3C,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,6EAA6E,YAAY,GAAG;QACjG,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC;KACjC,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,GAAW,EACX,KAA8B,EAC9B,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,IACE,CAAC,eAAe,EAAE;QAClB,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,gCAAgC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4BAA4B,GAAG,4HAA4H,CAC5J,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,UAAU,EAAE;YACf,CAAC,CAAC,yLAAyL;YAC3L,CAAC,CAAC,mGAAmG;QACvG,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,GAAW,EACX,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,gEAAgE;QACrE,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC;KACvB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO;QAAE,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACxE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,GAAW,EACX,aAA6C,EAC7C,SAAyC,EACzC,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAChD,MAAM,EACN,SAAS,EACT,GAAG,EACH,aAAa,EACb,SAAS,CACV,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,MAAM,sBAAsB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEhE,KAAK,UAAU,4BAA4B,CACzC,MAAc,EACd,SAAiB,EACjB,GAAW,EACX,aAA6C,EAC7C,SAAyC;IAEzC,MAAM,SAAS,GAAG,mCAAmC,CACnD,SAAS,EACT,GAAG,EACH,aAAa,EACb,SAAS,CACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,mCAAmC,CAC1C,SAAiB,EACjB,GAAW,EACX,aAA6C,EAC7C,SAAyC;IAEzC,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpD,OAAO;YACL,GAAG,EAAE,UAAU,EAAE;gBACf,CAAC,CAAC,mNAAmN;gBACrN,CAAC,CAAC,oLAAoL;YACxL,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC;SACjC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO;QACL,GAAG,EAAE,uGAAuG;QAC5G,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,SAAiB,EACjB,QAAgB,EAChB,SAAyC;IAEzC,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC;IACzC,MAAM,SAAS,GACb,QAAQ,KAAK,IAAI;QACf,CAAC,CAAC,+EAA+E;QACjF,CAAC,CAAC,yFAAyF,CAAC;IAChG,OAAO;QACL,GAAG,EAAE,sGAAsG,SAAS,GAAG;QACvH,IAAI,EACF,QAAQ,KAAK,IAAI;YACf,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC;YAC7D,CAAC,CAAC;gBACE,SAAS;gBACT,QAAQ;gBACR,IAAI,CAAC,GAAG,EAAE;gBACV,SAAS;gBACT,SAAS,CAAC,GAAG;gBACb,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;aACzB;KACR,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,sFAAsF,CAAC,IAAI,CAChG,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,GAAW,EACX,KAA8B;IAE9B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,IACE,CAAC,eAAe,EAAE;QAClB,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,gCAAgC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4BAA4B,GAAG,4HAA4H,CAC5J,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,UAAqD,EACrD,OAA2B;IAE3B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5C,IAAI,SAAS;YAAE,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAC3B,CAAC;IAEF,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,8BAA8B,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,WAAW,GAAG;YAClB,GAAG,EAAE,2FAA2F;YAChG,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACxC,CAAC;QACF,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAC1D,CAAC;QACF,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACpD,mCAAmC,CACjC,SAAS,EACT,SAAS,CAAC,GAAG,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,SAAS,CACpB,CACF,CAAC;QACF,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;gBACjC,WAAW;gBACX,GAAG,MAAM;gBACT,GAAG,SAAS;gBACZ;oBACE,GAAG,EAAE,gEAAgE;oBACrE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,yBAAyB,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CACnC,CAAC,GAAG,MAAM,CAAC,MAAM,EACjB,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CACrC,CAAC;QACF,IACE,eAAe,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;YAC3C,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACpC,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;oBAC1C,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAChD,EAAE,EACF,SAAS,EACT,SAAS,CAAC,GAAG,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,SAAS,CACpB,CAAC;oBACF,IAAI,CAAC,OAAO;wBAAE,MAAM,sBAAsB,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,KAAK,sBAAsB;gBAAE,OAAO,KAAK,CAAC;YACnD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,SAAiB;IAEjB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,yFAAyF;QAC9F,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;KAC/C,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,GAAG,EAAE,GAAG,CAAC,GAAa;QACtB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAe,CAAC;KACvC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,SAAiB,EACjB,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,uCAAuC;IACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,kFAAkF;QACvF,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;KAC/C,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,8EAA8E;QACnF,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;KAC/C,CAAC,CAAC;IAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,kBAAkB,CAAC,GAAG,CAAC,GAAa,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,MAAM,CAAC,YAAY,CAAC;AAC7B,CAAC","sourcesContent":["import {\n  getDbExec,\n  getDialect,\n  isLocalDatabase,\n  isPostgres,\n  intType,\n  type DbExec,\n} from \"../db/client.js\";\nimport { ensureIndexExists, ensureTableExists } from \"../db/ddl-guard.js\";\nimport { widenIntColumnsToBigInt } from \"../db/widen-columns.js\";\nimport type { StoreWriteOptions } from \"../settings/store.js\";\nimport { emitAppStateChange, emitAppStateDelete } from \"./emitter.js\";\n\nlet _initPromise: Promise<void> | undefined;\nconst MAX_HOSTED_APP_STATE_VALUE_BYTES = 1024 * 1024;\n\n// Escapes LIKE wildcards (`%`, `_`) and the escape char itself so a caller's\n// literal prefix is matched verbatim. Used with `ESCAPE '!'` in prefix queries\n// below; without this, a prefix such as `user_settings` would treat `_` as a\n// single-char wildcard and over-match (e.g. delete `userXsettings`).\nfunction escapeLike(s: string): string {\n  return s.replace(/[!%_]/g, (match) => `!${match}`);\n}\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const createSql = `\n        CREATE TABLE IF NOT EXISTS application_state (\n          session_id TEXT NOT NULL,\n          key TEXT NOT NULL,\n          value TEXT NOT NULL,\n          updated_at ${intType()} NOT NULL,\n          PRIMARY KEY (session_id, key)\n        )\n      `;\n\n      if (isPostgres()) {\n        // Hot path: the `application_state` table and its poll indexes are\n        // virtually always already present in production. Issuing `CREATE\n        // TABLE`/ `CREATE INDEX` still takes a lock that, in a fresh\n        // background-worker process behind a concurrent connection on the\n        // shared Neon DB, can block ~indefinitely (ACCESS EXCLUSIVE for CREATE\n        // TABLE; a write-blocking SHARE lock for CREATE INDEX). The ensure*\n        // wrappers probe `information_schema`/`pg_indexes` first (plain reads,\n        // no lock) and run DDL ONLY for what is actually missing, bounded by a\n        // transaction-scoped `lock_timeout`. If a swallowed lock-timeout leaves\n        // the schema still missing they RE-PROBE and THROW rather than letting\n        // init memoize success against absent schema.\n        await ensureTableExists(\"application_state\", createSql);\n        // Older deployments created `updated_at` as 32-bit `INTEGER`; on Postgres\n        // the `Date.now()` written by appStatePut() on every turn overflows int4.\n        // Widen it in place (no-op once done / on fresh BIGINT databases).\n        await widenIntColumnsToBigInt(\"application_state\", [\"updated_at\"]);\n        // Indexes for the two hot poll paths. Probe pg_indexes first (no lock)\n        // and skip the SHARE-locking CREATE INDEX when already present.\n        await ensureIndexExists(\n          \"app_state_updated_at_idx\",\n          `CREATE INDEX IF NOT EXISTS app_state_updated_at_idx ON application_state (updated_at)`,\n        );\n        await ensureIndexExists(\n          \"app_state_key_updated_idx\",\n          `CREATE INDEX IF NOT EXISTS app_state_key_updated_idx ON application_state (key, updated_at)`,\n        );\n        return;\n      }\n\n      // SQLite (local dev): no lock problem — keep the original behaviour.\n      await client.execute(createSql);\n      // Older deployments created `updated_at` as 32-bit `INTEGER`; on Postgres\n      // the `Date.now()` written by appStatePut() on every turn overflows int4.\n      // Widen it in place (no-op once done / on fresh BIGINT databases).\n      await widenIntColumnsToBigInt(\"application_state\", [\"updated_at\"]);\n      // Indexes for the two hot poll paths:\n      //  - `SELECT … WHERE updated_at > ?` (watermark scan, every poll cycle)\n      //  - `SELECT … WHERE key = ? … ORDER BY updated_at ASC` (marker lookups)\n      // Both are dialect-agnostic (no DESC/partial/PG-only syntax) so they\n      // apply identically on SQLite and Postgres. IF NOT EXISTS makes them\n      // idempotent across restarts on existing databases.\n      for (const ddl of [\n        `CREATE INDEX IF NOT EXISTS app_state_updated_at_idx ON application_state (updated_at)`,\n        `CREATE INDEX IF NOT EXISTS app_state_key_updated_idx ON application_state (key, updated_at)`,\n      ]) {\n        try {\n          await client.execute(ddl);\n        } catch {\n          // Index already exists or the dialect rejected a duplicate.\n        }\n      }\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nexport async function appStateGet(\n  sessionId: string,\n  key: string,\n): Promise<Record<string, unknown> | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT value FROM application_state WHERE session_id = ? AND key = ?`,\n    args: [sessionId, key],\n  });\n  if (rows.length === 0) return null;\n  return JSON.parse(rows[0].value as string);\n}\n\n/**\n * Read several application-state keys for one session in a single SQL query.\n * Missing keys are returned as `null` so callers can preserve the requested\n * shape without issuing one fallback query per key.\n */\nexport async function appStateGetMany(\n  sessionId: string,\n  keys: readonly string[],\n): Promise<Record<string, Record<string, unknown> | null>> {\n  const uniqueKeys = [...new Set(keys)];\n  const values: Record<string, Record<string, unknown> | null> = {};\n  for (const key of uniqueKeys) values[key] = null;\n  if (uniqueKeys.length === 0) return values;\n\n  await ensureTable();\n  const client = getDbExec();\n  const placeholders = uniqueKeys.map(() => \"?\").join(\", \");\n  const { rows } = await client.execute({\n    sql: `SELECT key, value FROM application_state WHERE session_id = ? AND key IN (${placeholders})`,\n    args: [sessionId, ...uniqueKeys],\n  });\n  for (const row of rows) {\n    values[row.key as string] = JSON.parse(row.value as string);\n  }\n  return values;\n}\n\nexport async function appStatePut(\n  sessionId: string,\n  key: string,\n  value: Record<string, unknown>,\n  options?: StoreWriteOptions,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const serialized = JSON.stringify(value);\n  if (\n    !isLocalDatabase() &&\n    Buffer.byteLength(serialized, \"utf8\") > MAX_HOSTED_APP_STATE_VALUE_BYTES\n  ) {\n    throw new Error(\n      `application_state value \"${key}\" is too large for hosted SQL storage. Store large files, base64, or blobs in file storage and write only a URL or handle.`,\n    );\n  }\n  await client.execute({\n    sql: isPostgres()\n      ? `INSERT INTO application_state (session_id, key, value, updated_at) VALUES (?, ?, ?, ?) ON CONFLICT (session_id, key) DO UPDATE SET value=EXCLUDED.value, updated_at=EXCLUDED.updated_at`\n      : `INSERT OR REPLACE INTO application_state (session_id, key, value, updated_at) VALUES (?, ?, ?, ?)`,\n    args: [sessionId, key, serialized, Date.now()],\n  });\n  emitAppStateChange(key, options?.requestSource, sessionId);\n}\n\nexport async function appStateDelete(\n  sessionId: string,\n  key: string,\n  options?: StoreWriteOptions,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const result = await client.execute({\n    sql: `DELETE FROM application_state WHERE session_id = ? AND key = ?`,\n    args: [sessionId, key],\n  });\n  const deleted = result.rowsAffected > 0;\n  if (deleted) emitAppStateDelete(key, options?.requestSource, sessionId);\n  return deleted;\n}\n\nexport async function appStateCompareAndSet(\n  sessionId: string,\n  key: string,\n  expectedValue: Record<string, unknown> | null,\n  nextValue: Record<string, unknown> | null,\n  options?: StoreWriteOptions,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const changed = await executeAppStateCompareAndSet(\n    client,\n    sessionId,\n    key,\n    expectedValue,\n    nextValue,\n  );\n  if (changed) {\n    if (nextValue === null) {\n      emitAppStateDelete(key, options?.requestSource, sessionId);\n    } else {\n      emitAppStateChange(key, options?.requestSource, sessionId);\n    }\n  }\n  return changed;\n}\n\nexport interface AppStateCompareAndSetOperation {\n  key: string;\n  expectedValue: Record<string, unknown> | null;\n  nextValue: Record<string, unknown> | null;\n}\n\nconst APP_STATE_CAS_MISMATCH = Symbol(\"app-state-cas-mismatch\");\n\nasync function executeAppStateCompareAndSet(\n  client: DbExec,\n  sessionId: string,\n  key: string,\n  expectedValue: Record<string, unknown> | null,\n  nextValue: Record<string, unknown> | null,\n): Promise<boolean> {\n  const statement = buildAppStateCompareAndSetStatement(\n    sessionId,\n    key,\n    expectedValue,\n    nextValue,\n  );\n  const result = await client.execute(statement);\n  return result.rowsAffected > 0;\n}\n\nfunction buildAppStateCompareAndSetStatement(\n  sessionId: string,\n  key: string,\n  expectedValue: Record<string, unknown> | null,\n  nextValue: Record<string, unknown> | null,\n): { sql: string; args: unknown[] } {\n  if (expectedValue === null) {\n    if (nextValue === null) {\n      throw new Error(\n        \"Application state CAS cannot replace absence with absence.\",\n      );\n    }\n    const next = serializeAppStateValue(key, nextValue);\n    return {\n      sql: isPostgres()\n        ? `INSERT INTO application_state (session_id, key, value, updated_at) SELECT ?, ?, ?, ? WHERE NOT EXISTS (SELECT 1 FROM application_state WHERE session_id = ? AND key = ?) ON CONFLICT (session_id, key) DO NOTHING`\n        : `INSERT OR IGNORE INTO application_state (session_id, key, value, updated_at) SELECT ?, ?, ?, ? WHERE NOT EXISTS (SELECT 1 FROM application_state WHERE session_id = ? AND key = ?)`,\n      args: [sessionId, key, next, Date.now(), sessionId, key],\n    };\n  }\n\n  const expected = JSON.stringify(expectedValue);\n  if (nextValue === null) {\n    return {\n      sql: `DELETE FROM application_state WHERE session_id = ? AND key = ? AND value = ?`,\n      args: [sessionId, key, expected],\n    };\n  }\n\n  const next = serializeAppStateValue(key, nextValue);\n  return {\n    sql: `UPDATE application_state SET value = ?, updated_at = ? WHERE session_id = ? AND key = ? AND value = ?`,\n    args: [next, Date.now(), sessionId, key, expected],\n  };\n}\n\nfunction buildD1CompareAndSetGuard(\n  sessionId: string,\n  guardKey: string,\n  operation: AppStateCompareAndSetOperation,\n): { sql: string; args: unknown[] } {\n  const expected = operation.expectedValue;\n  const condition =\n    expected === null\n      ? \"NOT EXISTS (SELECT 1 FROM application_state WHERE session_id = ? AND key = ?)\"\n      : \"EXISTS (SELECT 1 FROM application_state WHERE session_id = ? AND key = ? AND value = ?)\";\n  return {\n    sql: `INSERT INTO application_state (session_id, key, value, updated_at) SELECT ?, ?, '{}', ? WHERE NOT (${condition})`,\n    args:\n      expected === null\n        ? [sessionId, guardKey, Date.now(), sessionId, operation.key]\n        : [\n            sessionId,\n            guardKey,\n            Date.now(),\n            sessionId,\n            operation.key,\n            JSON.stringify(expected),\n          ],\n  };\n}\n\nfunction isD1CompareAndSetMismatch(error: unknown): boolean {\n  const message = error instanceof Error ? error.message : String(error);\n  return /unique constraint failed:\\s*application_state\\.session_id,\\s*application_state\\.key/i.test(\n    message,\n  );\n}\n\nfunction serializeAppStateValue(\n  key: string,\n  value: Record<string, unknown>,\n): string {\n  const serialized = JSON.stringify(value);\n  if (\n    !isLocalDatabase() &&\n    Buffer.byteLength(serialized, \"utf8\") > MAX_HOSTED_APP_STATE_VALUE_BYTES\n  ) {\n    throw new Error(\n      `application_state value \"${key}\" is too large for hosted SQL storage. Store large files, base64, or blobs in file storage and write only a URL or handle.`,\n    );\n  }\n  return serialized;\n}\n\nexport async function appStateCompareAndSetMany(\n  sessionId: string,\n  operations: readonly AppStateCompareAndSetOperation[],\n  options?: StoreWriteOptions,\n): Promise<boolean> {\n  if (operations.length === 0) return true;\n  const keys = new Set(operations.map(({ key }) => key));\n  if (keys.size !== operations.length) {\n    throw new Error(\"Application state multi-key CAS requires unique keys.\");\n  }\n  for (const { key, nextValue } of operations) {\n    if (nextValue) serializeAppStateValue(key, nextValue);\n  }\n  const orderedOperations = [...operations].sort((a, b) =>\n    a.key.localeCompare(b.key),\n  );\n\n  await ensureTable();\n  const client = getDbExec();\n  if (getDialect() === \"d1\") {\n    if (!client.atomicBatch) {\n      throw new Error(\n        \"D1 application-state CAS requires atomic batch support.\",\n      );\n    }\n    const guardKey = `__agent_native_cas_guard__:${Date.now()}:${Math.random().toString(36).slice(2)}`;\n    const guardInsert = {\n      sql: `INSERT INTO application_state (session_id, key, value, updated_at) VALUES (?, ?, '{}', ?)`,\n      args: [sessionId, guardKey, Date.now()],\n    };\n    const guards = orderedOperations.map((operation) =>\n      buildD1CompareAndSetGuard(sessionId, guardKey, operation),\n    );\n    const mutations = orderedOperations.map((operation) =>\n      buildAppStateCompareAndSetStatement(\n        sessionId,\n        operation.key,\n        operation.expectedValue,\n        operation.nextValue,\n      ),\n    );\n    let results;\n    try {\n      results = await client.atomicBatch([\n        guardInsert,\n        ...guards,\n        ...mutations,\n        {\n          sql: `DELETE FROM application_state WHERE session_id = ? AND key = ?`,\n          args: [sessionId, guardKey],\n        },\n      ]);\n    } catch (error) {\n      if (isD1CompareAndSetMismatch(error)) return false;\n      throw error;\n    }\n    const mutationResults = results.slice(\n      1 + guards.length,\n      1 + guards.length + mutations.length,\n    );\n    if (\n      mutationResults.length !== mutations.length ||\n      mutationResults.some((result) => result.rowsAffected !== 1)\n    ) {\n      throw new Error(\n        \"D1 application-state CAS completed without applying every mutation.\",\n      );\n    }\n  } else {\n    if (!client.transaction) {\n      throw new Error(\"Application state multi-key CAS requires transactions.\");\n    }\n    try {\n      await client.transaction(async (tx) => {\n        for (const operation of orderedOperations) {\n          const changed = await executeAppStateCompareAndSet(\n            tx,\n            sessionId,\n            operation.key,\n            operation.expectedValue,\n            operation.nextValue,\n          );\n          if (!changed) throw APP_STATE_CAS_MISMATCH;\n        }\n      });\n    } catch (error) {\n      if (error === APP_STATE_CAS_MISMATCH) return false;\n      throw error;\n    }\n  }\n\n  for (const { key, nextValue } of operations) {\n    if (nextValue === null) {\n      emitAppStateDelete(key, options?.requestSource, sessionId);\n    } else {\n      emitAppStateChange(key, options?.requestSource, sessionId);\n    }\n  }\n  return true;\n}\n\nexport async function appStateList(\n  sessionId: string,\n  keyPrefix: string,\n): Promise<Array<{ key: string; value: Record<string, unknown> }>> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT key, value FROM application_state WHERE session_id = ? AND key LIKE ? ESCAPE '!'`,\n    args: [sessionId, escapeLike(keyPrefix) + \"%\"],\n  });\n  return rows.map((row) => ({\n    key: row.key as string,\n    value: JSON.parse(row.value as string),\n  }));\n}\n\nexport async function appStateDeleteByPrefix(\n  sessionId: string,\n  keyPrefix: string,\n  options?: StoreWriteOptions,\n): Promise<number> {\n  await ensureTable();\n  const client = getDbExec();\n\n  // Get keys first so we can emit events\n  const { rows } = await client.execute({\n    sql: `SELECT key FROM application_state WHERE session_id = ? AND key LIKE ? ESCAPE '!'`,\n    args: [sessionId, escapeLike(keyPrefix) + \"%\"],\n  });\n\n  if (rows.length === 0) return 0;\n\n  const result = await client.execute({\n    sql: `DELETE FROM application_state WHERE session_id = ? AND key LIKE ? ESCAPE '!'`,\n    args: [sessionId, escapeLike(keyPrefix) + \"%\"],\n  });\n\n  for (const row of rows) {\n    emitAppStateDelete(row.key as string, options?.requestSource, sessionId);\n  }\n\n  return result.rowsAffected;\n}\n"]}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/application-state/store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,eAAe,EACf,UAAU,EACV,OAAO,GAER,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEtE,IAAI,YAAuC,CAAC;AAC5C,MAAM,gCAAgC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,qEAAqE;AACrE,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG;;;;;uBAKD,OAAO,EAAE;;;OAGzB,CAAC;YAEF,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,mEAAmE;gBACnE,kEAAkE;gBAClE,6DAA6D;gBAC7D,kEAAkE;gBAClE,uEAAuE;gBACvE,oEAAoE;gBACpE,uEAAuE;gBACvE,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,8CAA8C;gBAC9C,MAAM,iBAAiB,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;gBACxD,0EAA0E;gBAC1E,0EAA0E;gBAC1E,mEAAmE;gBACnE,MAAM,uBAAuB,CAAC,mBAAmB,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;gBACnE,uEAAuE;gBACvE,gEAAgE;gBAChE,MAAM,iBAAiB,CACrB,0BAA0B,EAC1B,uFAAuF,CACxF,CAAC;gBACF,MAAM,iBAAiB,CACrB,2BAA2B,EAC3B,6FAA6F,CAC9F,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,MAAM,uBAAuB,CAAC,mBAAmB,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YACnE,sCAAsC;YACtC,wEAAwE;YACxE,yEAAyE;YACzE,qEAAqE;YACrE,qEAAqE;YACrE,oDAAoD;YACpD,KAAK,MAAM,GAAG,IAAI;gBAChB,uFAAuF;gBACvF,6FAA6F;aAC9F,EAAE,CAAC;gBACF,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,GAAW;IAEX,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sEAAsE;QAC3E,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC;KACvB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,IAAuB;IAEvB,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,6EAA6E,YAAY,GAAG;QACjG,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,UAAU,CAAC;KACjC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,GAAG,EAAE,GAAG,CAAC,GAAa;QACtB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAe,CAAC;KACvC,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,SAAiB,EACjB,IAAuB;IAEvB,MAAM,MAAM,GAAmD,EAAE,CAAC;IAClE,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IAEpD,KAAK,MAAM,KAAK,IAAI,MAAM,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,GAAW,EACX,KAA8B,EAC9B,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,IACE,CAAC,eAAe,EAAE;QAClB,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,gCAAgC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4BAA4B,GAAG,4HAA4H,CAC5J,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,UAAU,EAAE;YACf,CAAC,CAAC,yLAAyL;YAC3L,CAAC,CAAC,mGAAmG;QACvG,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,GAAW,EACX,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,gEAAgE;QACrE,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC;KACvB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO;QAAE,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACxE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,GAAW,EACX,aAA6C,EAC7C,SAAyC,EACzC,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAChD,MAAM,EACN,SAAS,EACT,GAAG,EACH,aAAa,EACb,SAAS,CACV,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,MAAM,sBAAsB,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEhE,KAAK,UAAU,4BAA4B,CACzC,MAAc,EACd,SAAiB,EACjB,GAAW,EACX,aAA6C,EAC7C,SAAyC;IAEzC,MAAM,SAAS,GAAG,mCAAmC,CACnD,SAAS,EACT,GAAG,EACH,aAAa,EACb,SAAS,CACV,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,mCAAmC,CAC1C,SAAiB,EACjB,GAAW,EACX,aAA6C,EAC7C,SAAyC;IAEzC,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpD,OAAO;YACL,GAAG,EAAE,UAAU,EAAE;gBACf,CAAC,CAAC,mNAAmN;gBACrN,CAAC,CAAC,oLAAoL;YACxL,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC;SACzD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,GAAG,EAAE,8EAA8E;YACnF,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC;SACjC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO;QACL,GAAG,EAAE,uGAAuG;QAC5G,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,SAAiB,EACjB,QAAgB,EAChB,SAAyC;IAEzC,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC;IACzC,MAAM,SAAS,GACb,QAAQ,KAAK,IAAI;QACf,CAAC,CAAC,+EAA+E;QACjF,CAAC,CAAC,yFAAyF,CAAC;IAChG,OAAO;QACL,GAAG,EAAE,sGAAsG,SAAS,GAAG;QACvH,IAAI,EACF,QAAQ,KAAK,IAAI;YACf,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC;YAC7D,CAAC,CAAC;gBACE,SAAS;gBACT,QAAQ;gBACR,IAAI,CAAC,GAAG,EAAE;gBACV,SAAS;gBACT,SAAS,CAAC,GAAG;gBACb,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;aACzB;KACR,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,sFAAsF,CAAC,IAAI,CAChG,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,GAAW,EACX,KAA8B;IAE9B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,IACE,CAAC,eAAe,EAAE;QAClB,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,gCAAgC,EACxE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4BAA4B,GAAG,4HAA4H,CAC5J,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,SAAiB,EACjB,UAAqD,EACrD,OAA2B;IAE3B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5C,IAAI,SAAS;YAAE,sBAAsB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtD,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAC3B,CAAC;IAEF,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,yDAAyD,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,8BAA8B,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,MAAM,WAAW,GAAG;YAClB,GAAG,EAAE,2FAA2F;YAChG,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACxC,CAAC;QACF,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACjD,yBAAyB,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAC1D,CAAC;QACF,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACpD,mCAAmC,CACjC,SAAS,EACT,SAAS,CAAC,GAAG,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,SAAS,CACpB,CACF,CAAC;QACF,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;gBACjC,WAAW;gBACX,GAAG,MAAM;gBACT,GAAG,SAAS;gBACZ;oBACE,GAAG,EAAE,gEAAgE;oBACrE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,yBAAyB,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CACnC,CAAC,GAAG,MAAM,CAAC,MAAM,EACjB,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CACrC,CAAC;QACF,IACE,eAAe,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;YAC3C,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,EAC3D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACpC,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;oBAC1C,MAAM,OAAO,GAAG,MAAM,4BAA4B,CAChD,EAAE,EACF,SAAS,EACT,SAAS,CAAC,GAAG,EACb,SAAS,CAAC,aAAa,EACvB,SAAS,CAAC,SAAS,CACpB,CAAC;oBACF,IAAI,CAAC,OAAO;wBAAE,MAAM,sBAAsB,CAAC;gBAC7C,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,KAAK,sBAAsB;gBAAE,OAAO,KAAK,CAAC;YACnD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,SAAiB;IAEjB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,yFAAyF;QAC9F,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;KAC/C,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxB,GAAG,EAAE,GAAG,CAAC,GAAa;QACtB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAe,CAAC;KACvC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,SAAiB,EACjB,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,uCAAuC;IACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,kFAAkF;QACvF,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;KAC/C,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEhC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,8EAA8E;QACnF,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;KAC/C,CAAC,CAAC;IAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,kBAAkB,CAAC,GAAG,CAAC,GAAa,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,MAAM,CAAC,YAAY,CAAC;AAC7B,CAAC","sourcesContent":["import {\n  getDbExec,\n  getDialect,\n  isLocalDatabase,\n  isPostgres,\n  intType,\n  type DbExec,\n} from \"../db/client.js\";\nimport { ensureIndexExists, ensureTableExists } from \"../db/ddl-guard.js\";\nimport { widenIntColumnsToBigInt } from \"../db/widen-columns.js\";\nimport type { StoreWriteOptions } from \"../settings/store.js\";\nimport { emitAppStateChange, emitAppStateDelete } from \"./emitter.js\";\n\nlet _initPromise: Promise<void> | undefined;\nconst MAX_HOSTED_APP_STATE_VALUE_BYTES = 1024 * 1024;\n\n// Escapes LIKE wildcards (`%`, `_`) and the escape char itself so a caller's\n// literal prefix is matched verbatim. Used with `ESCAPE '!'` in prefix queries\n// below; without this, a prefix such as `user_settings` would treat `_` as a\n// single-char wildcard and over-match (e.g. delete `userXsettings`).\nfunction escapeLike(s: string): string {\n  return s.replace(/[!%_]/g, (match) => `!${match}`);\n}\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const createSql = `\n        CREATE TABLE IF NOT EXISTS application_state (\n          session_id TEXT NOT NULL,\n          key TEXT NOT NULL,\n          value TEXT NOT NULL,\n          updated_at ${intType()} NOT NULL,\n          PRIMARY KEY (session_id, key)\n        )\n      `;\n\n      if (isPostgres()) {\n        // Hot path: the `application_state` table and its poll indexes are\n        // virtually always already present in production. Issuing `CREATE\n        // TABLE`/ `CREATE INDEX` still takes a lock that, in a fresh\n        // background-worker process behind a concurrent connection on the\n        // shared Neon DB, can block ~indefinitely (ACCESS EXCLUSIVE for CREATE\n        // TABLE; a write-blocking SHARE lock for CREATE INDEX). The ensure*\n        // wrappers probe `information_schema`/`pg_indexes` first (plain reads,\n        // no lock) and run DDL ONLY for what is actually missing, bounded by a\n        // transaction-scoped `lock_timeout`. If a swallowed lock-timeout leaves\n        // the schema still missing they RE-PROBE and THROW rather than letting\n        // init memoize success against absent schema.\n        await ensureTableExists(\"application_state\", createSql);\n        // Older deployments created `updated_at` as 32-bit `INTEGER`; on Postgres\n        // the `Date.now()` written by appStatePut() on every turn overflows int4.\n        // Widen it in place (no-op once done / on fresh BIGINT databases).\n        await widenIntColumnsToBigInt(\"application_state\", [\"updated_at\"]);\n        // Indexes for the two hot poll paths. Probe pg_indexes first (no lock)\n        // and skip the SHARE-locking CREATE INDEX when already present.\n        await ensureIndexExists(\n          \"app_state_updated_at_idx\",\n          `CREATE INDEX IF NOT EXISTS app_state_updated_at_idx ON application_state (updated_at)`,\n        );\n        await ensureIndexExists(\n          \"app_state_key_updated_idx\",\n          `CREATE INDEX IF NOT EXISTS app_state_key_updated_idx ON application_state (key, updated_at)`,\n        );\n        return;\n      }\n\n      // SQLite (local dev): no lock problem — keep the original behaviour.\n      await client.execute(createSql);\n      // Older deployments created `updated_at` as 32-bit `INTEGER`; on Postgres\n      // the `Date.now()` written by appStatePut() on every turn overflows int4.\n      // Widen it in place (no-op once done / on fresh BIGINT databases).\n      await widenIntColumnsToBigInt(\"application_state\", [\"updated_at\"]);\n      // Indexes for the two hot poll paths:\n      //  - `SELECT … WHERE updated_at > ?` (watermark scan, every poll cycle)\n      //  - `SELECT … WHERE key = ? … ORDER BY updated_at ASC` (marker lookups)\n      // Both are dialect-agnostic (no DESC/partial/PG-only syntax) so they\n      // apply identically on SQLite and Postgres. IF NOT EXISTS makes them\n      // idempotent across restarts on existing databases.\n      for (const ddl of [\n        `CREATE INDEX IF NOT EXISTS app_state_updated_at_idx ON application_state (updated_at)`,\n        `CREATE INDEX IF NOT EXISTS app_state_key_updated_idx ON application_state (key, updated_at)`,\n      ]) {\n        try {\n          await client.execute(ddl);\n        } catch {\n          // Index already exists or the dialect rejected a duplicate.\n        }\n      }\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nexport async function appStateGet(\n  sessionId: string,\n  key: string,\n): Promise<Record<string, unknown> | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT value FROM application_state WHERE session_id = ? AND key = ?`,\n    args: [sessionId, key],\n  });\n  if (rows.length === 0) return null;\n  return JSON.parse(rows[0].value as string);\n}\n\n/**\n * Read several application-state keys for one session in a single SQL query,\n * returning ONLY the rows that exist. A key absent from the result has no row;\n * a key present with a `null` value has a row that stores `null`. Callers that\n * must not conflate the two (the batched HTTP read) depend on that difference,\n * so this deliberately does not pad missing keys.\n */\nexport async function appStateGetManyEntries(\n  sessionId: string,\n  keys: readonly string[],\n): Promise<Array<{ key: string; value: Record<string, unknown> | null }>> {\n  const uniqueKeys = [...new Set(keys)];\n  if (uniqueKeys.length === 0) return [];\n  await ensureTable();\n  const client = getDbExec();\n  const placeholders = uniqueKeys.map(() => \"?\").join(\", \");\n  const { rows } = await client.execute({\n    sql: `SELECT key, value FROM application_state WHERE session_id = ? AND key IN (${placeholders})`,\n    args: [sessionId, ...uniqueKeys],\n  });\n  return rows.map((row) => ({\n    key: row.key as string,\n    value: JSON.parse(row.value as string),\n  }));\n}\n\n/**\n * Read several application-state keys for one session in a single SQL query.\n * Missing keys are returned as `null` so callers can preserve the requested\n * shape without issuing one fallback query per key.\n */\nexport async function appStateGetMany(\n  sessionId: string,\n  keys: readonly string[],\n): Promise<Record<string, Record<string, unknown> | null>> {\n  const values: Record<string, Record<string, unknown> | null> = {};\n  for (const key of new Set(keys)) values[key] = null;\n\n  for (const entry of await appStateGetManyEntries(sessionId, keys)) {\n    values[entry.key] = entry.value;\n  }\n  return values;\n}\n\nexport async function appStatePut(\n  sessionId: string,\n  key: string,\n  value: Record<string, unknown>,\n  options?: StoreWriteOptions,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const serialized = JSON.stringify(value);\n  if (\n    !isLocalDatabase() &&\n    Buffer.byteLength(serialized, \"utf8\") > MAX_HOSTED_APP_STATE_VALUE_BYTES\n  ) {\n    throw new Error(\n      `application_state value \"${key}\" is too large for hosted SQL storage. Store large files, base64, or blobs in file storage and write only a URL or handle.`,\n    );\n  }\n  await client.execute({\n    sql: isPostgres()\n      ? `INSERT INTO application_state (session_id, key, value, updated_at) VALUES (?, ?, ?, ?) ON CONFLICT (session_id, key) DO UPDATE SET value=EXCLUDED.value, updated_at=EXCLUDED.updated_at`\n      : `INSERT OR REPLACE INTO application_state (session_id, key, value, updated_at) VALUES (?, ?, ?, ?)`,\n    args: [sessionId, key, serialized, Date.now()],\n  });\n  emitAppStateChange(key, options?.requestSource, sessionId);\n}\n\nexport async function appStateDelete(\n  sessionId: string,\n  key: string,\n  options?: StoreWriteOptions,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const result = await client.execute({\n    sql: `DELETE FROM application_state WHERE session_id = ? AND key = ?`,\n    args: [sessionId, key],\n  });\n  const deleted = result.rowsAffected > 0;\n  if (deleted) emitAppStateDelete(key, options?.requestSource, sessionId);\n  return deleted;\n}\n\nexport async function appStateCompareAndSet(\n  sessionId: string,\n  key: string,\n  expectedValue: Record<string, unknown> | null,\n  nextValue: Record<string, unknown> | null,\n  options?: StoreWriteOptions,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const changed = await executeAppStateCompareAndSet(\n    client,\n    sessionId,\n    key,\n    expectedValue,\n    nextValue,\n  );\n  if (changed) {\n    if (nextValue === null) {\n      emitAppStateDelete(key, options?.requestSource, sessionId);\n    } else {\n      emitAppStateChange(key, options?.requestSource, sessionId);\n    }\n  }\n  return changed;\n}\n\nexport interface AppStateCompareAndSetOperation {\n  key: string;\n  expectedValue: Record<string, unknown> | null;\n  nextValue: Record<string, unknown> | null;\n}\n\nconst APP_STATE_CAS_MISMATCH = Symbol(\"app-state-cas-mismatch\");\n\nasync function executeAppStateCompareAndSet(\n  client: DbExec,\n  sessionId: string,\n  key: string,\n  expectedValue: Record<string, unknown> | null,\n  nextValue: Record<string, unknown> | null,\n): Promise<boolean> {\n  const statement = buildAppStateCompareAndSetStatement(\n    sessionId,\n    key,\n    expectedValue,\n    nextValue,\n  );\n  const result = await client.execute(statement);\n  return result.rowsAffected > 0;\n}\n\nfunction buildAppStateCompareAndSetStatement(\n  sessionId: string,\n  key: string,\n  expectedValue: Record<string, unknown> | null,\n  nextValue: Record<string, unknown> | null,\n): { sql: string; args: unknown[] } {\n  if (expectedValue === null) {\n    if (nextValue === null) {\n      throw new Error(\n        \"Application state CAS cannot replace absence with absence.\",\n      );\n    }\n    const next = serializeAppStateValue(key, nextValue);\n    return {\n      sql: isPostgres()\n        ? `INSERT INTO application_state (session_id, key, value, updated_at) SELECT ?, ?, ?, ? WHERE NOT EXISTS (SELECT 1 FROM application_state WHERE session_id = ? AND key = ?) ON CONFLICT (session_id, key) DO NOTHING`\n        : `INSERT OR IGNORE INTO application_state (session_id, key, value, updated_at) SELECT ?, ?, ?, ? WHERE NOT EXISTS (SELECT 1 FROM application_state WHERE session_id = ? AND key = ?)`,\n      args: [sessionId, key, next, Date.now(), sessionId, key],\n    };\n  }\n\n  const expected = JSON.stringify(expectedValue);\n  if (nextValue === null) {\n    return {\n      sql: `DELETE FROM application_state WHERE session_id = ? AND key = ? AND value = ?`,\n      args: [sessionId, key, expected],\n    };\n  }\n\n  const next = serializeAppStateValue(key, nextValue);\n  return {\n    sql: `UPDATE application_state SET value = ?, updated_at = ? WHERE session_id = ? AND key = ? AND value = ?`,\n    args: [next, Date.now(), sessionId, key, expected],\n  };\n}\n\nfunction buildD1CompareAndSetGuard(\n  sessionId: string,\n  guardKey: string,\n  operation: AppStateCompareAndSetOperation,\n): { sql: string; args: unknown[] } {\n  const expected = operation.expectedValue;\n  const condition =\n    expected === null\n      ? \"NOT EXISTS (SELECT 1 FROM application_state WHERE session_id = ? AND key = ?)\"\n      : \"EXISTS (SELECT 1 FROM application_state WHERE session_id = ? AND key = ? AND value = ?)\";\n  return {\n    sql: `INSERT INTO application_state (session_id, key, value, updated_at) SELECT ?, ?, '{}', ? WHERE NOT (${condition})`,\n    args:\n      expected === null\n        ? [sessionId, guardKey, Date.now(), sessionId, operation.key]\n        : [\n            sessionId,\n            guardKey,\n            Date.now(),\n            sessionId,\n            operation.key,\n            JSON.stringify(expected),\n          ],\n  };\n}\n\nfunction isD1CompareAndSetMismatch(error: unknown): boolean {\n  const message = error instanceof Error ? error.message : String(error);\n  return /unique constraint failed:\\s*application_state\\.session_id,\\s*application_state\\.key/i.test(\n    message,\n  );\n}\n\nfunction serializeAppStateValue(\n  key: string,\n  value: Record<string, unknown>,\n): string {\n  const serialized = JSON.stringify(value);\n  if (\n    !isLocalDatabase() &&\n    Buffer.byteLength(serialized, \"utf8\") > MAX_HOSTED_APP_STATE_VALUE_BYTES\n  ) {\n    throw new Error(\n      `application_state value \"${key}\" is too large for hosted SQL storage. Store large files, base64, or blobs in file storage and write only a URL or handle.`,\n    );\n  }\n  return serialized;\n}\n\nexport async function appStateCompareAndSetMany(\n  sessionId: string,\n  operations: readonly AppStateCompareAndSetOperation[],\n  options?: StoreWriteOptions,\n): Promise<boolean> {\n  if (operations.length === 0) return true;\n  const keys = new Set(operations.map(({ key }) => key));\n  if (keys.size !== operations.length) {\n    throw new Error(\"Application state multi-key CAS requires unique keys.\");\n  }\n  for (const { key, nextValue } of operations) {\n    if (nextValue) serializeAppStateValue(key, nextValue);\n  }\n  const orderedOperations = [...operations].sort((a, b) =>\n    a.key.localeCompare(b.key),\n  );\n\n  await ensureTable();\n  const client = getDbExec();\n  if (getDialect() === \"d1\") {\n    if (!client.atomicBatch) {\n      throw new Error(\n        \"D1 application-state CAS requires atomic batch support.\",\n      );\n    }\n    const guardKey = `__agent_native_cas_guard__:${Date.now()}:${Math.random().toString(36).slice(2)}`;\n    const guardInsert = {\n      sql: `INSERT INTO application_state (session_id, key, value, updated_at) VALUES (?, ?, '{}', ?)`,\n      args: [sessionId, guardKey, Date.now()],\n    };\n    const guards = orderedOperations.map((operation) =>\n      buildD1CompareAndSetGuard(sessionId, guardKey, operation),\n    );\n    const mutations = orderedOperations.map((operation) =>\n      buildAppStateCompareAndSetStatement(\n        sessionId,\n        operation.key,\n        operation.expectedValue,\n        operation.nextValue,\n      ),\n    );\n    let results;\n    try {\n      results = await client.atomicBatch([\n        guardInsert,\n        ...guards,\n        ...mutations,\n        {\n          sql: `DELETE FROM application_state WHERE session_id = ? AND key = ?`,\n          args: [sessionId, guardKey],\n        },\n      ]);\n    } catch (error) {\n      if (isD1CompareAndSetMismatch(error)) return false;\n      throw error;\n    }\n    const mutationResults = results.slice(\n      1 + guards.length,\n      1 + guards.length + mutations.length,\n    );\n    if (\n      mutationResults.length !== mutations.length ||\n      mutationResults.some((result) => result.rowsAffected !== 1)\n    ) {\n      throw new Error(\n        \"D1 application-state CAS completed without applying every mutation.\",\n      );\n    }\n  } else {\n    if (!client.transaction) {\n      throw new Error(\"Application state multi-key CAS requires transactions.\");\n    }\n    try {\n      await client.transaction(async (tx) => {\n        for (const operation of orderedOperations) {\n          const changed = await executeAppStateCompareAndSet(\n            tx,\n            sessionId,\n            operation.key,\n            operation.expectedValue,\n            operation.nextValue,\n          );\n          if (!changed) throw APP_STATE_CAS_MISMATCH;\n        }\n      });\n    } catch (error) {\n      if (error === APP_STATE_CAS_MISMATCH) return false;\n      throw error;\n    }\n  }\n\n  for (const { key, nextValue } of operations) {\n    if (nextValue === null) {\n      emitAppStateDelete(key, options?.requestSource, sessionId);\n    } else {\n      emitAppStateChange(key, options?.requestSource, sessionId);\n    }\n  }\n  return true;\n}\n\nexport async function appStateList(\n  sessionId: string,\n  keyPrefix: string,\n): Promise<Array<{ key: string; value: Record<string, unknown> }>> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT key, value FROM application_state WHERE session_id = ? AND key LIKE ? ESCAPE '!'`,\n    args: [sessionId, escapeLike(keyPrefix) + \"%\"],\n  });\n  return rows.map((row) => ({\n    key: row.key as string,\n    value: JSON.parse(row.value as string),\n  }));\n}\n\nexport async function appStateDeleteByPrefix(\n  sessionId: string,\n  keyPrefix: string,\n  options?: StoreWriteOptions,\n): Promise<number> {\n  await ensureTable();\n  const client = getDbExec();\n\n  // Get keys first so we can emit events\n  const { rows } = await client.execute({\n    sql: `SELECT key FROM application_state WHERE session_id = ? AND key LIKE ? ESCAPE '!'`,\n    args: [sessionId, escapeLike(keyPrefix) + \"%\"],\n  });\n\n  if (rows.length === 0) return 0;\n\n  const result = await client.execute({\n    sql: `DELETE FROM application_state WHERE session_id = ? AND key LIKE ? ESCAPE '!'`,\n    args: [sessionId, escapeLike(keyPrefix) + \"%\"],\n  });\n\n  for (const row of rows) {\n    emitAppStateDelete(row.key as string, options?.requestSource, sessionId);\n  }\n\n  return result.rowsAffected;\n}\n"]}

package/dist/audit/redact.d.ts

@@ -12,16 +12,39 @@
  */
 /** Heuristic: does a bare string value look like a secret? */
 declare function looksSecret(value: string): boolean;
-declare function redact(value: unknown, depth: number): unknown;
+declare function redactEmbeddedSecrets(value: string): string;
+declare function redact(value: unknown, depth: number, maxString: number): unknown;
+export interface RedactLimits {
+    /**
+     * Hard cap on the serialized output, INCLUDING the truncation envelope.
+     * Surfaces with their own wire budget (the A2A activity snapshot) pass a
+     * tighter cap than the audit-log default.
+     */
+    maxJson?: number;
+    /** Cap on any single string value before it gets a truncation marker. */
+    maxString?: number;
+}
 /**
  * Redact and serialize call arguments to a capped JSON string, or `null` when
  * there is nothing to record. Never throws.
  */
-export declare function redactArgsToJson(args: unknown): string | null;
+export declare function redactArgsToJson(args: unknown, limits?: RedactLimits): string | null;
+/**
+ * Same bounds as `redactArgsToJson`, returned as a structural value for
+ * surfaces whose consumers expect an object (transcript `metadata.input`).
+ */
+export declare function redactArgsToValue(args: unknown, limits?: RedactLimits): unknown;
+/**
+ * Bounded, redacted plain-text summary of a tool result. Oversized text keeps
+ * its head and gains an explicit `…(N more chars)` marker, so a reader can
+ * always tell a short result from a clipped one.
+ */
+export declare function redactTextToSummary(text: string, maxChars?: number): string | null;
 /** Exposed for tests. */
 export declare const __test: {
     looksSecret: typeof looksSecret;
     redact: typeof redact;
+    redactEmbeddedSecrets: typeof redactEmbeddedSecrets;
     SENSITIVE_KEY: RegExp;
 };
 export {};

package/dist/audit/redact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/audit/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,8DAA8D;AAC9D,iBAAS,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAkB3C;AAUD,iBAAS,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CA0BtD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAqB7D;AAED,yBAAyB;AACzB,eAAO,MAAM,MAAM;;;;CAAyC,CAAC"}
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/audit/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAiBH,8DAA8D;AAC9D,iBAAS,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAkB3C;AAUD,iBAAS,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOpD;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CA8BzE;AAED,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,OAAO,EACb,MAAM,CAAC,EAAE,YAAY,GACpB,MAAM,GAAG,IAAI,CA+Bf;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,OAAO,EACb,MAAM,CAAC,EAAE,YAAY,GACpB,OAAO,CAQT;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,SAAa,GACpB,MAAM,GAAG,IAAI,CAYf;AAED,yBAAyB;AACzB,eAAO,MAAM,MAAM;;;;;CAKlB,CAAC"}

package/dist/audit/redact.js

@@ -10,13 +10,18 @@
  * This mirrors the framework's standing rule that credential-looking literals
  * never land in source, logs, or fixtures.
  */
-const SENSITIVE_KEY = /(pass(word|phrase)?|secret|token|api[_-]?key|apikey|authorization|bearer|credential|cookie|session[_-]?(id|token)|private[_-]?key|client[_-]?secret|signing[_-]?secret|access[_-]?key|refresh[_-]?token|webhook[_-]?(url|secret))/i;
+const SENSITIVE_KEY = /(?:pass(?:word|phrase)?|secret|token|api[_-]?key|apikey|authorization|bearer|credential|cookie|session[_-]?(?:id|token)|private[_-]?key|client[_-]?secret|signing[_-]?secret|access[_-]?key|refresh[_-]?token|webhook[_-]?(?:url|secret))/i;
 const REDACTED = "[redacted]";
 const MAX_STRING = 2000;
 const MAX_DEPTH = 6;
 const MAX_KEYS = 100;
 const MAX_ARRAY = 100;
 const MAX_JSON = 8000;
+/**
+ * Head room reserved for the `…(N more chars)` marker so a truncated summary
+ * still fits its caller's cap. Callers below this cannot carry a marker at all.
+ */
+const MARKER_SLACK = 32;
 /** Heuristic: does a bare string value look like a secret? */
 function looksSecret(value) {
     if (/^bearer\s+\S/i.test(value))
@@ -35,25 +40,32 @@ function looksSecret(value) {
     }
     return false;
 }
-function redactString(value) {
+function redactString(value, maxString) {
     if (looksSecret(value))
         return REDACTED;
-    if (value.length > MAX_STRING) {
-        return `${value.slice(0, MAX_STRING)}…(${value.length - MAX_STRING} more chars)`;
+    if (value.length > maxString) {
+        return `${value.slice(0, maxString)}…(${value.length - maxString} more chars)`;
     }
     return value;
 }
-function redact(value, depth) {
+function redactEmbeddedSecrets(value) {
+    const bearer = value.replace(/\b(bearer\s+)([^\s"',}]+)/gi, `$1${REDACTED}`);
+    const credentialField = new RegExp(`(["']?\\b${SENSITIVE_KEY.source}\\b["']?\\s*[:=]\\s*)(["']?)(?!bearer\\b)([^"'\\s,}]+)\\2`, "gi");
+    return bearer.replace(credentialField, `$1$2${REDACTED}$2`);
+}
+function redact(value, depth, maxString) {
     if (value == null)
         return value;
     if (typeof value === "string")
-        return redactString(value);
+        return redactString(value, maxString);
     if (typeof value === "number" || typeof value === "boolean")
         return value;
     if (depth >= MAX_DEPTH)
         return "[…]";
     if (Array.isArray(value)) {
-        const out = value.slice(0, MAX_ARRAY).map((v) => redact(v, depth + 1));
+        const out = value
+            .slice(0, MAX_ARRAY)
+            .map((v) => redact(v, depth + 1, maxString));
         if (value.length > MAX_ARRAY)
             out.push(`…(${value.length - MAX_ARRAY} more)`);
         return out;
@@ -67,7 +79,9 @@ function redact(value, depth) {
                 break;
             }
             n += 1;
-            out[k] = SENSITIVE_KEY.test(k) ? REDACTED : redact(v, depth + 1);
+            out[k] = SENSITIVE_KEY.test(k)
+                ? REDACTED
+                : redact(v, depth + 1, maxString);
         }
         return out;
     }
@@ -78,32 +92,82 @@ function redact(value, depth) {
  * Redact and serialize call arguments to a capped JSON string, or `null` when
  * there is nothing to record. Never throws.
  */
-export function redactArgsToJson(args) {
+export function redactArgsToJson(args, limits) {
+    const maxJson = Math.max(MARKER_SLACK * 4, limits?.maxJson ?? MAX_JSON);
+    const maxString = limits?.maxString ?? MAX_STRING;
     try {
         if (args == null)
             return null;
-        const redacted = redact(args, 0);
+        const redacted = redact(args, 0, maxString);
         if (redacted === undefined)
             return null;
         const json = JSON.stringify(redacted);
         if (json == null)
             return null;
-        if (json.length > MAX_JSON) {
-            // Slicing the serialized JSON would yield an unparseable string. Wrap a
-            // preview in a valid envelope so `get-audit-event` can always JSON.parse
-            // the stored `input`.
-            return JSON.stringify({
-                _auditTruncated: true,
-                originalBytes: json.length,
-                preview: json.slice(0, MAX_JSON),
-            });
+        if (json.length <= maxJson)
+            return json;
+        // Slicing the serialized JSON would yield an unparseable string. Wrap a
+        // preview in a valid envelope so `get-audit-event` can always JSON.parse
+        // the stored `input`. JSON escaping makes the envelope overhead
+        // content-dependent, so shrink the preview until the whole thing measures
+        // under the cap rather than guessing at the overhead.
+        const envelope = (preview) => JSON.stringify({
+            _auditTruncated: true,
+            originalBytes: json.length,
+            preview,
+        });
+        let take = maxJson;
+        let out = envelope(json.slice(0, take));
+        while (out.length > maxJson && take > 0) {
+            take = Math.max(0, take - Math.max(1, out.length - maxJson));
+            out = envelope(json.slice(0, take));
         }
-        return json;
+        return out;
     }
     catch {
         return null;
     }
 }
+/**
+ * Same bounds as `redactArgsToJson`, returned as a structural value for
+ * surfaces whose consumers expect an object (transcript `metadata.input`).
+ */
+export function redactArgsToValue(args, limits) {
+    const json = redactArgsToJson(args, limits);
+    if (json == null)
+        return null;
+    try {
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Bounded, redacted plain-text summary of a tool result. Oversized text keeps
+ * its head and gains an explicit `…(N more chars)` marker, so a reader can
+ * always tell a short result from a clipped one.
+ */
+export function redactTextToSummary(text, maxChars = MAX_STRING) {
+    if (!text)
+        return null;
+    // Only ever walk a bounded head: a multi-megabyte tool result must not be
+    // scanned in full just to produce a preview of it.
+    const head = text.slice(0, maxChars + MARKER_SLACK);
+    const redactedHead = redactEmbeddedSecrets(head);
+    if (looksSecret(redactedHead.trim()))
+        return REDACTED;
+    if (text.length <= maxChars && redactedHead.length <= maxChars) {
+        return redactedHead;
+    }
+    const keep = Math.max(0, maxChars - MARKER_SLACK);
+    return `${redactedHead.slice(0, keep)}…(${text.length - keep} more chars)`;
+}
 /** Exposed for tests. */
-export const __test = { looksSecret, redact, SENSITIVE_KEY };
+export const __test = {
+    looksSecret,
+    redact,
+    redactEmbeddedSecrets,
+    SENSITIVE_KEY,
+};
 //# sourceMappingURL=redact.js.map