@agent-native/core 0.132.2 → 0.133.1

package/dist/client/error-format.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-format.js","sourceRoot":"","sources":["../../src/client/error-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,gIAAgI,CAAC;AAEnI,8EAA8E;AAC9E,6EAA6E;AAC7E,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,UAAmB,EACnB,SAAkB;IAElB,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/D,IACE,SAAS,KAAK,qBAAqB;QACnC,wCAAwC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EACjE,CAAC;QACD,OAAO,UAAU,UAAU,CAAC,OAAO,qCAAqC,0BAA0B,GAAG,CAAC;IACxG,CAAC;IACD,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;QAC1C,OAAO,UAAU,UAAU,CAAC,OAAO,wBAAwB,oBAAoB,GAAG,CAAC;IACrF,CAAC;IACD,IACE,SAAS,KAAK,yBAAyB;QACvC,SAAS,KAAK,gBAAgB,EAC9B,CAAC;QACD,OAAO,UAAU,UAAU,CAAC,OAAO,wBAAwB,oBAAoB,GAAG,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,UAAU,UAAU,CAAC,OAAO,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,UAAU,UAAU,CAAC,OAAO,+BAA+B,UAAU,GAAG,CAAC;AAClF,CAAC;AAOD,SAAS,kBAAkB,CAAC,SAAkB;IAC5C,OAAO,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;SAC3B,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,SAAkB;IAC3D,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,CACL,IAAI,KAAK,uBAAuB;QAChC,IAAI,KAAK,UAAU;QACnB,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,qBAAqB;QAC9B,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC;QAClD,iFAAiF,CAAC,IAAI,CACpF,IAAI,CACL;QACD,8DAA8D,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAAY,EACZ,SAAkB;IAElB,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CACL,IAAI,KAAK,sBAAsB;QAC/B,IAAI,KAAK,UAAU;QACnB,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC;QAClD,+EAA+E,CAAC,IAAI,CAClF,IAAI,CACL;QACD,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACpC,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,SAAkB;IACzD,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,CACL,IAAI,KAAK,wBAAwB;QACjC,IAAI,KAAK,kBAAkB;QAC3B,IAAI,KAAK,eAAe;QACxB,8DAA8D,CAAC,IAAI,CACjE,IAAI,CAAC,IAAI,EAAE,CACZ,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,SAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEtD,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAE3C,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAC1C,OAAO;YACL,OAAO,EACL,0FAA0F;YAC5F,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClC,OAAO;YACL,OAAO,EACL,2FAA2F;YAC7F,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,OAAO,EACL,qFAAqF;YACvF,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,6BAA6B,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EACL,sGAAsG;YACxG,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,oBAAoB,GACxB,kBAAkB,CAAC,SAAS,CAAC,KAAK,wBAAwB;YAC1D,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;YACL,OAAO,EAAE,oBAAoB;gBAC3B,CAAC,CAAC,2EAA2E;gBAC7E,CAAC,CAAC,wEAAwE;YAC5E,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,2EAA2E;QAC3E,uEAAuE;QACvE,kDAAkD;QAClD,wEAAwE;QACxE,mEAAmE;QACnE,0CAA0C;QAC1C,OAAO;YACL,OAAO,EACL,gJAAgJ;YAClJ,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EACL,yGAAyG;YAC3G,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO;YACL,OAAO,EACL,0IAA0I;YAC5I,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EACL,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,2CAA2C;YACnE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,6BAA6B,EAAE,GAAG,CAAC;SAC3C,OAAO,CAAC,2BAA2B,EAAE,GAAG,CAAC;SACzC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,8BAA8B,EAAE,IAAI,CAAC;SAC7C,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["/**\n * Append a Builder CTA markdown link to gateway errors that users can fix\n * outside the app. Used by both\n * chat SSE consumers (`sse-event-processor.ts` and `useProductionAgent.ts`)\n * to keep the copy in lockstep.\n *\n * `upgradeUrl` comes from the gateway response body and ends up interpolated\n * into markdown, so we validate it's a plain https URL with no characters\n * that would escape the `[...](url)` link target. Only `)` and whitespace\n * terminate the link target — `(`, `<`, `>` are fine inside it — so the\n * regex stays narrow; the gateway may emit URLs containing `(`\n * (e.g. `?ref=Acme%20(staging)`) and we don't want to reject them.\n */\nexport const BUILDER_SPACE_SETTINGS_URL =\n  \"https://builder.io/account/space?utm_source=agent-native&utm_medium=product&utm_campaign=onboarding&utm_content=space_settings\";\n\n// Pseudo-href used to mark an in-app \"Start new chat\" CTA inside the markdown\n// error message. The chat renderer intercepts this href and renders a button\n// that dispatches the `agent-native:new-chat` CustomEvent instead of navigating.\nexport const NEW_CHAT_ACTION_HREF = \"agent-native:new-chat\";\n\nfunction isSafeUpgradeUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"https:\") return false;\n    return !/[\\s)]/.test(url);\n  } catch {\n    return false;\n  }\n}\n\nexport function formatChatErrorText(\n  errorMessage: string,\n  upgradeUrl?: string,\n  errorCode?: string,\n): string {\n  const normalized = normalizeChatError(errorMessage, errorCode);\n  if (\n    errorCode === \"gateway_not_enabled\" ||\n    /space has not enabled the LLM gateway/i.test(normalized.message)\n  ) {\n    return `Error: ${normalized.message}\\n\\n[Open Builder space settings](${BUILDER_SPACE_SETTINGS_URL})`;\n  }\n  if (errorCode === \"builder_gateway_error\") {\n    return `Error: ${normalized.message}\\n\\n[Start new chat](${NEW_CHAT_ACTION_HREF})`;\n  }\n  if (\n    errorCode === \"context_length_exceeded\" ||\n    errorCode === \"input_too_long\"\n  ) {\n    return `Error: ${normalized.message}\\n\\n[Start new chat](${NEW_CHAT_ACTION_HREF})`;\n  }\n  if (!upgradeUrl || !isSafeUpgradeUrl(upgradeUrl)) {\n    return `Error: ${normalized.message}`;\n  }\n  return `Error: ${normalized.message}\\n\\n[Upgrade at builder.io](${upgradeUrl})`;\n}\n\nexport interface NormalizedChatError {\n  message: string;\n  details?: string;\n}\n\nfunction normalizeErrorCode(errorCode?: string): string {\n  return String(errorCode ?? \"\")\n    .trim()\n    .toLowerCase();\n}\n\nfunction isProviderRateLimit(text: string, errorCode?: string): boolean {\n  const code = normalizeErrorCode(errorCode);\n  return (\n    code === \"provider_rate_limited\" ||\n    code === \"http_429\" ||\n    code === \"rate_limited\" ||\n    code === \"rate_limit_exceeded\" ||\n    /^429 status code(?:\\s*\\(no body\\))?$/i.test(text) ||\n    /\\b(?:http\\s*)?429\\b.*\\b(?:status|too many requests|rate[-_\\s]?limit|no body)\\b/i.test(\n      text,\n    ) ||\n    /\\b(?:too many requests|rate[-_\\s]?limit(?:ed| exceeded)?)\\b/i.test(text)\n  );\n}\n\nfunction isProviderAuthenticationError(\n  text: string,\n  errorCode?: string,\n): boolean {\n  const code = normalizeErrorCode(errorCode);\n  const lower = text.toLowerCase();\n  return (\n    code === \"authentication_error\" ||\n    code === \"http_401\" ||\n    /^401 status code(?:\\s*\\(no body\\))?$/i.test(text) ||\n    /\\b(?:http\\s*)?401\\b.*\\b(?:status|unauthorized|authentication|auth|no body)\\b/i.test(\n      text,\n    ) ||\n    lower.includes(\"invalid x-api-key\") ||\n    lower.includes(\"invalid api key\") ||\n    lower.includes(\"incorrect api key\") ||\n    lower.includes(\"api key is invalid\") ||\n    (lower.includes(\"authentication_error\") && lower.includes(\"api\"))\n  );\n}\n\nfunction isConnectionError(text: string, errorCode?: string): boolean {\n  const code = normalizeErrorCode(errorCode);\n  return (\n    code === \"provider_network_error\" ||\n    code === \"connection_error\" ||\n    code === \"network_error\" ||\n    /^(?:provider_network_error|connection_error|network_error)$/i.test(\n      text.trim(),\n    )\n  );\n}\n\nexport function normalizeChatError(\n  errorMessage: string,\n  errorCode?: string,\n): NormalizedChatError {\n  const raw = String(errorMessage || \"Unknown error\");\n  const looksHtml = /<html[\\s>]|<body[\\s>]|<head[\\s>]/i.test(raw);\n  const text = looksHtml ? htmlToText(raw) : raw.trim();\n\n  const code = normalizeErrorCode(errorCode);\n\n  if (code === \"builder_model_unauthorized\") {\n    return {\n      message:\n        \"The provider behind this model rejected the request. Pick a different model, then retry.\",\n      details: text,\n    };\n  }\n\n  if (code === \"builder_auth_error\") {\n    return {\n      message:\n        \"Builder rejected the connected credentials. Reconnect Builder.io in Settings, then retry.\",\n      details: text,\n    };\n  }\n\n  if (isProviderRateLimit(text, errorCode)) {\n    return {\n      message:\n        \"The model provider is rate-limiting this chat right now. Wait a moment, then retry.\",\n      details: text,\n    };\n  }\n\n  if (isProviderAuthenticationError(text, errorCode)) {\n    return {\n      message:\n        \"The model provider rejected the saved API key. Update the key in API Keys & Connections, then retry.\",\n      details: text,\n    };\n  }\n\n  if (isConnectionError(text, errorCode)) {\n    const providerNetworkError =\n      normalizeErrorCode(errorCode) === \"provider_network_error\" ||\n      /provider_network_error/i.test(text);\n    return {\n      message: providerNetworkError\n        ? \"The model provider could not be reached. Check your connection and retry.\"\n        : \"The agent connection was interrupted. Check your connection and retry.\",\n      details: text,\n    };\n  }\n\n  if (/^Gateway error \\(no detail; raw event:/i.test(text)) {\n    // The previous copy promised auto-recovery and suggested switching models,\n    // but neither helps for this code: the server already retried once and\n    // the client deliberately skips auto-continuation\n    // (see `builder_gateway_error` in sse-event-processor.ts). The error is\n    // almost always upstream, so retrying the same conversation with a\n    // different model lands on the same wall.\n    return {\n      message:\n        \"The model gateway returned no error details and the chat couldn't recover. Wait a moment and retry, or start a new chat if it keeps happening.\",\n      details: text,\n    };\n  }\n\n  if (/inactivity timeout/i.test(text)) {\n    return {\n      message:\n        \"The agent connection timed out before it could finish. You can continue from the partial work or retry.\",\n      details: text,\n    };\n  }\n\n  if (/Invalid request body:\\s*tools\\.\\d+\\.input_schema\\.type/i.test(text)) {\n    return {\n      message:\n        \"A tool schema was invalid, so the model rejected the request before it started. The invalid tool can be skipped and the request retried.\",\n      details: text,\n    };\n  }\n\n  if (looksHtml) {\n    return {\n      message:\n        text.slice(0, 240) || \"The provider returned an HTML error page.\",\n      details: text,\n    };\n  }\n\n  return { message: text };\n}\n\nfunction htmlToText(html: string): string {\n  return html\n    .replace(/<script[\\s\\S]*?<\\/script>/gi, \" \")\n    .replace(/<style[\\s\\S]*?<\\/style>/gi, \" \")\n    .replace(/<br\\s*\\/?>/gi, \"\\n\")\n    .replace(/<\\/(p|div|h1|h2|h3|li|tr)>/gi, \"\\n\")\n    .replace(/<[^>]+>/g, \" \")\n    .replace(/&nbsp;/gi, \" \")\n    .replace(/&lt;/gi, \"<\")\n    .replace(/&gt;/gi, \">\")\n    .replace(/&amp;/gi, \"&\")\n    .replace(/&quot;/gi, '\"')\n    .replace(/&#39;/gi, \"'\")\n    .replace(/[ \\t]+/g, \" \")\n    .replace(/\\n\\s+/g, \"\\n\")\n    .replace(/\\n{3,}/g, \"\\n\\n\")\n    .trim();\n}\n"]}
+{"version":3,"file":"error-format.js","sourceRoot":"","sources":["../../src/client/error-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,gIAAgI,CAAC;AAEnI,8EAA8E;AAC9E,6EAA6E;AAC7E,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,UAAmB,EACnB,SAAkB;IAElB,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC/D,IACE,SAAS,KAAK,qBAAqB;QACnC,wCAAwC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EACjE,CAAC;QACD,OAAO,UAAU,UAAU,CAAC,OAAO,qCAAqC,0BAA0B,GAAG,CAAC;IACxG,CAAC;IACD,IAAI,SAAS,KAAK,uBAAuB,EAAE,CAAC;QAC1C,OAAO,UAAU,UAAU,CAAC,OAAO,wBAAwB,oBAAoB,GAAG,CAAC;IACrF,CAAC;IACD,IACE,SAAS,KAAK,yBAAyB;QACvC,SAAS,KAAK,gBAAgB,EAC9B,CAAC;QACD,OAAO,UAAU,UAAU,CAAC,OAAO,wBAAwB,oBAAoB,GAAG,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,UAAU,UAAU,CAAC,OAAO,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,UAAU,UAAU,CAAC,OAAO,+BAA+B,UAAU,GAAG,CAAC;AAClF,CAAC;AAOD,SAAS,kBAAkB,CAAC,SAAkB;IAC5C,OAAO,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;SAC3B,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,SAAkB;IAC3D,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,CACL,IAAI,KAAK,uBAAuB;QAChC,IAAI,KAAK,UAAU;QACnB,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,qBAAqB;QAC9B,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC;QAClD,iFAAiF,CAAC,IAAI,CACpF,IAAI,CACL;QACD,8DAA8D,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAAY,EACZ,SAAkB;IAElB,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CACL,IAAI,KAAK,sBAAsB;QAC/B,IAAI,KAAK,UAAU;QACnB,uCAAuC,CAAC,IAAI,CAAC,IAAI,CAAC;QAClD,+EAA+E,CAAC,IAAI,CAClF,IAAI,CACL;QACD,KAAK,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QAC/C,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACpC,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,SAAkB;IACzD,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,CACL,IAAI,KAAK,wBAAwB;QACjC,IAAI,KAAK,kBAAkB;QAC3B,IAAI,KAAK,eAAe;QACxB,8DAA8D,CAAC,IAAI,CACjE,IAAI,CAAC,IAAI,EAAE,CACZ,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,SAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,IAAI,eAAe,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAEtD,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAE3C,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAC1C,OAAO;YACL,OAAO,EACL,0FAA0F;YAC5F,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAClC,OAAO;YACL,OAAO,EACL,2FAA2F;YAC7F,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,mDAAmD;IACnD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EACL,8FAA8F;YAChG,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,mBAAmB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,OAAO,EACL,qFAAqF;YACvF,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,6BAA6B,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACnD,OAAO;YACL,OAAO,EACL,sGAAsG;YACxG,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACvC,MAAM,oBAAoB,GACxB,kBAAkB,CAAC,SAAS,CAAC,KAAK,wBAAwB;YAC1D,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;YACL,OAAO,EAAE,oBAAoB;gBAC3B,CAAC,CAAC,2EAA2E;gBAC7E,CAAC,CAAC,wEAAwE;YAC5E,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,2EAA2E;QAC3E,uEAAuE;QACvE,kDAAkD;QAClD,wEAAwE;QACxE,mEAAmE;QACnE,0CAA0C;QAC1C,OAAO;YACL,OAAO,EACL,gJAAgJ;YAClJ,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EACL,yGAAyG;YAC3G,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,yDAAyD,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO;YACL,OAAO,EACL,0IAA0I;YAC5I,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EACL,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,2CAA2C;YACnE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,6BAA6B,EAAE,GAAG,CAAC;SAC3C,OAAO,CAAC,2BAA2B,EAAE,GAAG,CAAC;SACzC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,8BAA8B,EAAE,IAAI,CAAC;SAC7C,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;AACZ,CAAC","sourcesContent":["/**\n * Append a Builder CTA markdown link to gateway errors that users can fix\n * outside the app. Used by both\n * chat SSE consumers (`sse-event-processor.ts` and `useProductionAgent.ts`)\n * to keep the copy in lockstep.\n *\n * `upgradeUrl` comes from the gateway response body and ends up interpolated\n * into markdown, so we validate it's a plain https URL with no characters\n * that would escape the `[...](url)` link target. Only `)` and whitespace\n * terminate the link target — `(`, `<`, `>` are fine inside it — so the\n * regex stays narrow; the gateway may emit URLs containing `(`\n * (e.g. `?ref=Acme%20(staging)`) and we don't want to reject them.\n */\nexport const BUILDER_SPACE_SETTINGS_URL =\n  \"https://builder.io/account/space?utm_source=agent-native&utm_medium=product&utm_campaign=onboarding&utm_content=space_settings\";\n\n// Pseudo-href used to mark an in-app \"Start new chat\" CTA inside the markdown\n// error message. The chat renderer intercepts this href and renders a button\n// that dispatches the `agent-native:new-chat` CustomEvent instead of navigating.\nexport const NEW_CHAT_ACTION_HREF = \"agent-native:new-chat\";\n\nfunction isSafeUpgradeUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"https:\") return false;\n    return !/[\\s)]/.test(url);\n  } catch {\n    return false;\n  }\n}\n\nexport function formatChatErrorText(\n  errorMessage: string,\n  upgradeUrl?: string,\n  errorCode?: string,\n): string {\n  const normalized = normalizeChatError(errorMessage, errorCode);\n  if (\n    errorCode === \"gateway_not_enabled\" ||\n    /space has not enabled the LLM gateway/i.test(normalized.message)\n  ) {\n    return `Error: ${normalized.message}\\n\\n[Open Builder space settings](${BUILDER_SPACE_SETTINGS_URL})`;\n  }\n  if (errorCode === \"builder_gateway_error\") {\n    return `Error: ${normalized.message}\\n\\n[Start new chat](${NEW_CHAT_ACTION_HREF})`;\n  }\n  if (\n    errorCode === \"context_length_exceeded\" ||\n    errorCode === \"input_too_long\"\n  ) {\n    return `Error: ${normalized.message}\\n\\n[Start new chat](${NEW_CHAT_ACTION_HREF})`;\n  }\n  if (!upgradeUrl || !isSafeUpgradeUrl(upgradeUrl)) {\n    return `Error: ${normalized.message}`;\n  }\n  return `Error: ${normalized.message}\\n\\n[Upgrade at builder.io](${upgradeUrl})`;\n}\n\nexport interface NormalizedChatError {\n  message: string;\n  details?: string;\n}\n\nfunction normalizeErrorCode(errorCode?: string): string {\n  return String(errorCode ?? \"\")\n    .trim()\n    .toLowerCase();\n}\n\nfunction isProviderRateLimit(text: string, errorCode?: string): boolean {\n  const code = normalizeErrorCode(errorCode);\n  return (\n    code === \"provider_rate_limited\" ||\n    code === \"http_429\" ||\n    code === \"rate_limited\" ||\n    code === \"rate_limit_exceeded\" ||\n    /^429 status code(?:\\s*\\(no body\\))?$/i.test(text) ||\n    /\\b(?:http\\s*)?429\\b.*\\b(?:status|too many requests|rate[-_\\s]?limit|no body)\\b/i.test(\n      text,\n    ) ||\n    /\\b(?:too many requests|rate[-_\\s]?limit(?:ed| exceeded)?)\\b/i.test(text)\n  );\n}\n\nfunction isProviderAuthenticationError(\n  text: string,\n  errorCode?: string,\n): boolean {\n  const code = normalizeErrorCode(errorCode);\n  const lower = text.toLowerCase();\n  return (\n    code === \"authentication_error\" ||\n    code === \"http_401\" ||\n    /^401 status code(?:\\s*\\(no body\\))?$/i.test(text) ||\n    /\\b(?:http\\s*)?401\\b.*\\b(?:status|unauthorized|authentication|auth|no body)\\b/i.test(\n      text,\n    ) ||\n    lower.includes(\"missing authentication header\") ||\n    lower.includes(\"invalid x-api-key\") ||\n    lower.includes(\"invalid api key\") ||\n    lower.includes(\"incorrect api key\") ||\n    lower.includes(\"api key is invalid\") ||\n    (lower.includes(\"authentication_error\") && lower.includes(\"api\"))\n  );\n}\n\nfunction isConnectionError(text: string, errorCode?: string): boolean {\n  const code = normalizeErrorCode(errorCode);\n  return (\n    code === \"provider_network_error\" ||\n    code === \"connection_error\" ||\n    code === \"network_error\" ||\n    /^(?:provider_network_error|connection_error|network_error)$/i.test(\n      text.trim(),\n    )\n  );\n}\n\nexport function normalizeChatError(\n  errorMessage: string,\n  errorCode?: string,\n): NormalizedChatError {\n  const raw = String(errorMessage || \"Unknown error\");\n  const looksHtml = /<html[\\s>]|<body[\\s>]|<head[\\s>]/i.test(raw);\n  const text = looksHtml ? htmlToText(raw) : raw.trim();\n\n  const code = normalizeErrorCode(errorCode);\n\n  if (code === \"builder_model_unauthorized\") {\n    return {\n      message:\n        \"The provider behind this model rejected the request. Pick a different model, then retry.\",\n      details: text,\n    };\n  }\n\n  if (code === \"builder_auth_error\") {\n    return {\n      message:\n        \"Builder rejected the connected credentials. Reconnect Builder.io in Settings, then retry.\",\n      details: text,\n    };\n  }\n\n  // A model/parameter combination this provider will never accept. Retrying is\n  // pointless and the raw sentence names an API surface the reader has no way\n  // to act on, so say what they can actually change.\n  if (code === \"provider_config_error\") {\n    return {\n      message:\n        \"This model can't use tools with the current settings. Switch models in Settings, then retry.\",\n      details: text,\n    };\n  }\n\n  if (isProviderRateLimit(text, errorCode)) {\n    return {\n      message:\n        \"The model provider is rate-limiting this chat right now. Wait a moment, then retry.\",\n      details: text,\n    };\n  }\n\n  if (isProviderAuthenticationError(text, errorCode)) {\n    return {\n      message:\n        \"The model provider rejected the saved API key. Update the key in API Keys & Connections, then retry.\",\n      details: text,\n    };\n  }\n\n  if (isConnectionError(text, errorCode)) {\n    const providerNetworkError =\n      normalizeErrorCode(errorCode) === \"provider_network_error\" ||\n      /provider_network_error/i.test(text);\n    return {\n      message: providerNetworkError\n        ? \"The model provider could not be reached. Check your connection and retry.\"\n        : \"The agent connection was interrupted. Check your connection and retry.\",\n      details: text,\n    };\n  }\n\n  if (/^Gateway error \\(no detail; raw event:/i.test(text)) {\n    // The previous copy promised auto-recovery and suggested switching models,\n    // but neither helps for this code: the server already retried once and\n    // the client deliberately skips auto-continuation\n    // (see `builder_gateway_error` in sse-event-processor.ts). The error is\n    // almost always upstream, so retrying the same conversation with a\n    // different model lands on the same wall.\n    return {\n      message:\n        \"The model gateway returned no error details and the chat couldn't recover. Wait a moment and retry, or start a new chat if it keeps happening.\",\n      details: text,\n    };\n  }\n\n  if (/inactivity timeout/i.test(text)) {\n    return {\n      message:\n        \"The agent connection timed out before it could finish. You can continue from the partial work or retry.\",\n      details: text,\n    };\n  }\n\n  if (/Invalid request body:\\s*tools\\.\\d+\\.input_schema\\.type/i.test(text)) {\n    return {\n      message:\n        \"A tool schema was invalid, so the model rejected the request before it started. The invalid tool can be skipped and the request retried.\",\n      details: text,\n    };\n  }\n\n  if (looksHtml) {\n    return {\n      message:\n        text.slice(0, 240) || \"The provider returned an HTML error page.\",\n      details: text,\n    };\n  }\n\n  return { message: text };\n}\n\nfunction htmlToText(html: string): string {\n  return html\n    .replace(/<script[\\s\\S]*?<\\/script>/gi, \" \")\n    .replace(/<style[\\s\\S]*?<\\/style>/gi, \" \")\n    .replace(/<br\\s*\\/?>/gi, \"\\n\")\n    .replace(/<\\/(p|div|h1|h2|h3|li|tr)>/gi, \"\\n\")\n    .replace(/<[^>]+>/g, \" \")\n    .replace(/&nbsp;/gi, \" \")\n    .replace(/&lt;/gi, \"<\")\n    .replace(/&gt;/gi, \">\")\n    .replace(/&amp;/gi, \"&\")\n    .replace(/&quot;/gi, '\"')\n    .replace(/&#39;/gi, \"'\")\n    .replace(/[ \\t]+/g, \" \")\n    .replace(/\\n\\s+/g, \"\\n\")\n    .replace(/\\n{3,}/g, \"\\n\\n\")\n    .trim();\n}\n"]}

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/credentials/index.d.ts

@@ -29,7 +29,12 @@ export declare function resolveCredentialForScope(key: string, ctx: CredentialCo
  *   5. org-scoped legacy settings credential
  *   6. solo workspace-scoped app_secrets (`solo:<email>`)
  *
- * Steps 3-5 are skipped without an active org.
+ * Steps 3-5 use `ctx.orgId` when given, else the org resolved from
+ * `ctx.userEmail` (see `resolveEffectiveOrgId`), and are skipped only when the
+ * caller truly has no org. A membership lookup that could not be read throws
+ * `CredentialStoreUnavailableError` instead of silently reporting the
+ * credential as unset — "the store didn't answer" and "nothing is saved" are
+ * different outcomes callers must not conflate.
  */
 export declare function resolveCredential(key: string, ctx: CredentialContext): Promise<string | undefined>;
 /**
@@ -54,7 +59,9 @@ export declare function resolveCredential(key: string, ctx: CredentialContext):
  * org the caller already belongs to), and never return the owning account, how
  * many rows matched, or any part of the value. Without an active org there is
  * no boundary to bound the probe to, so it declines to answer rather than
- * revealing that some other tenant holds a key of the same name.
+ * revealing that some other tenant holds a key of the same name — this
+ * includes callers whose `ctx.orgId` is unset AND whose org could not be
+ * resolved from `ctx.userEmail` (see `resolveEffectiveOrgId`).
  *
  * Returns null when nothing safe and useful can be said.
  */

package/dist/credentials/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,KAAK,CAAC;AA2CpD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,GACzD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2BxB;AAwDD;;GAEG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAcf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,KAAK,CAAC;AA2CpD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,GACzD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO7B;AA6BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA8BxB;AAwDD;;GAEG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/credentials/index.js

@@ -1,6 +1,7 @@
 import { getDbExec } from "../db/client.js";
 import { encryptSecretValue, decryptSecretValue, isEncryptedSecretValue, } from "../secrets/crypto.js";
 import { readAppSecret } from "../secrets/storage.js";
+import { assertCredentialStoreReadable } from "../server/credential-provider.js";
 import { getSetting, putSetting, deleteSetting } from "../settings/store.js";
 const SETTING_PREFIX = "credential:";
 function userCredentialSettingKey(email, key) {
@@ -55,6 +56,32 @@ export async function resolveCredentialForScope(key, ctx) {
     }
     return readCredentialSetting(userCredentialSettingKey(ctx.userEmail, key));
 }
+/**
+ * `ctx.orgId` when the caller supplied one, otherwise the org resolved from
+ * `ctx.userEmail`'s membership. Interactive requests always supply `orgId`
+ * (session/`getOrgContext` backfill it); CLI runs, cron jobs, and any other
+ * caller built straight from `getCredentialContext()` outside a request event
+ * do not, and previously fell through as "no active org" — invisibly skipping
+ * every org-scoped credential a signed-in session could see. Mirrors the
+ * fallback already proven in `resolveSecretDetailed`
+ * (server/credential-provider.ts).
+ */
+async function resolveEffectiveOrgId(ctx) {
+    if (ctx.orgId)
+        return { orgId: ctx.orgId, lookupFailed: false };
+    try {
+        const { resolveOrgIdForEmail } = await import("../org/context.js");
+        return {
+            orgId: await resolveOrgIdForEmail(ctx.userEmail),
+            lookupFailed: false,
+        };
+    }
+    catch (cause) {
+        // Membership was unreadable, not merely absent — must not collapse to
+        // "caller has no org", which would silently hide every org-scoped row.
+        return { orgId: null, lookupFailed: true, cause };
+    }
+}
 /**
  * Resolve a credential across the encrypted app_secrets store and the legacy
  * settings-backed credential store. User overrides win, followed by the
@@ -71,7 +98,12 @@ export async function resolveCredentialForScope(key, ctx) {
  *   5. org-scoped legacy settings credential
  *   6. solo workspace-scoped app_secrets (`solo:<email>`)
  *
- * Steps 3-5 are skipped without an active org.
+ * Steps 3-5 use `ctx.orgId` when given, else the org resolved from
+ * `ctx.userEmail` (see `resolveEffectiveOrgId`), and are skipped only when the
+ * caller truly has no org. A membership lookup that could not be read throws
+ * `CredentialStoreUnavailableError` instead of silently reporting the
+ * credential as unset — "the store didn't answer" and "nothing is saved" are
+ * different outcomes callers must not conflate.
  */
 export async function resolveCredential(key, ctx) {
     if (!ctx?.userEmail)
@@ -85,15 +117,19 @@ export async function resolveCredential(key, ctx) {
     });
     if (userSetting)
         return userSetting;
-    if (ctx.orgId) {
-        const orgSecret = await readScopedAppSecret(key, "org", ctx.orgId);
+    const orgLookup = await resolveEffectiveOrgId(ctx);
+    assertCredentialStoreReadable(orgLookup);
+    const { orgId } = orgLookup;
+    if (orgId) {
+        const orgSecret = await readScopedAppSecret(key, "org", orgId);
         if (orgSecret)
             return orgSecret;
-        const workspaceSecret = await readScopedAppSecret(key, "workspace", ctx.orgId);
+        const workspaceSecret = await readScopedAppSecret(key, "workspace", orgId);
         if (workspaceSecret)
             return workspaceSecret;
         const orgSetting = await resolveCredentialForScope(key, {
             ...ctx,
+            orgId,
             scope: "org",
         });
         if (orgSetting)
@@ -127,22 +163,28 @@ export async function resolveCredential(key, ctx) {
  * org the caller already belongs to), and never return the owning account, how
  * many rows matched, or any part of the value. Without an active org there is
  * no boundary to bound the probe to, so it declines to answer rather than
- * revealing that some other tenant holds a key of the same name.
+ * revealing that some other tenant holds a key of the same name — this
+ * includes callers whose `ctx.orgId` is unset AND whose org could not be
+ * resolved from `ctx.userEmail` (see `resolveEffectiveOrgId`).
  *
  * Returns null when nothing safe and useful can be said.
  */
 export async function describeCredentialScopeGap(keys, ctx) {
-    if (!ctx?.userEmail || !ctx.orgId)
+    if (!ctx?.userEmail)
+        return null;
+    const orgLookup = await resolveEffectiveOrgId(ctx);
+    if (orgLookup.lookupFailed || !orgLookup.orgId)
         return null;
+    const scopedCtx = { ...ctx, orgId: orgLookup.orgId };
     for (const key of keys) {
-        if (await hasForeignPersonalCredentialInOrg(key, ctx)) {
+        if (await hasForeignPersonalCredentialInOrg(key, scopedCtx)) {
             return (`A "${key}" key is saved in this workspace with Personal scope. ` +
                 `Personal keys are readable only by their own owner's signed-in sessions, ` +
                 `and this run resolves credentials as the owner identity behind the ` +
                 `integration, job, or automation — so it needs "${key}" saved with ` +
                 `Workspace or Organization scope instead.`);
         }
-        const holder = await findMemberOrgHoldingCredential(key, ctx);
+        const holder = await findMemberOrgHoldingCredential(key, scopedCtx);
         if (holder) {
             return (`A "${key}" key is saved in the ${holder} organization, but this ` +
                 `request resolved to a different organization you also belong to. ` +

package/dist/credentials/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAkB,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE7E,MAAM,cAAc,GAAG,aAAa,CAAC;AASrC,SAAS,wBAAwB,CAAC,KAAa,EAAE,GAAW;IAC1D,OAAO,KAAK,KAAK,CAAC,WAAW,EAAE,IAAI,cAAc,GAAG,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa,EAAE,GAAW;IACzD,OAAO,KAAK,KAAK,IAAI,cAAc,GAAG,GAAG,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAW,EACX,KAAyB,EACzB,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,yDAAyD;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAW,EACX,GAA0D;IAE1D,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,qBAAqB,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,qBAAqB,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,GAAsB;IAEtB,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,SAAS,CAAC;IAEtC,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE;QACvD,GAAG,GAAG;QACN,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAEhC,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAC/C,GAAG,EACH,WAAW,EACX,GAAG,CAAC,KAAK,CACV,CAAC;QACF,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;QAE5C,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE;YACtD,GAAG,GAAG;YACN,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QACH,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACpC,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,OAAO,mBAAmB,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAuB,EACvB,GAAsB;IAEtB,IAAI,CAAC,GAAG,EAAE,SAAS,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAE/C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,MAAM,iCAAiC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACtD,OAAO,CACL,MAAM,GAAG,wDAAwD;gBACjE,2EAA2E;gBAC3E,qEAAqE;gBACrE,kDAAkD,GAAG,eAAe;gBACpE,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CACL,MAAM,GAAG,yBAAyB,MAAM,0BAA0B;gBAClE,mEAAmE;gBACnE,qEAAqE;gBACrE,uEAAuE;gBACvE,kDAAkD,MAAM,YAAY;gBACpE,IAAI,GAAG,6CAA6C,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,GAAW,EACX,GAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE;;;;qBAIU;YACf,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,KAAM,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,8BAA8B,CAC3C,GAAW,EACX,GAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE;;;;;;;;qBAQU;YACf,IAAI,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,KAAM,CAAC;SACrD,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,GAAI,IAAI,CAAC,CAAC,CAA4B,CAAC,QAAQ,CAAC;QAC1D,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE;YAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG;YACpB,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,GAAsB;IAEtB,OAAO,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,KAAa,EACb,GAAmD;IAEnD,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,yBAAyB;IACzB,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,UAAU,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;YACxD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,UAAU,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;QAC7D,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,GAAmD;IAEnD,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,aAAa,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,MAAM,aAAa,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport {\n  encryptSecretValue,\n  decryptSecretValue,\n  isEncryptedSecretValue,\n} from \"../secrets/crypto.js\";\nimport { readAppSecret, type SecretRef } from \"../secrets/storage.js\";\nimport { getSetting, putSetting, deleteSetting } from \"../settings/store.js\";\n\nconst SETTING_PREFIX = \"credential:\";\n\nexport interface CredentialContext {\n  userEmail: string;\n  orgId?: string | null;\n}\n\nexport type CredentialStorageScope = \"user\" | \"org\";\n\nfunction userCredentialSettingKey(email: string, key: string): string {\n  return `u:${email.toLowerCase()}:${SETTING_PREFIX}${key}`;\n}\n\nfunction orgCredentialSettingKey(orgId: string, key: string): string {\n  return `o:${orgId}:${SETTING_PREFIX}${key}`;\n}\n\nasync function readCredentialSetting(\n  settingKey: string,\n): Promise<string | undefined> {\n  const setting = await getSetting(settingKey);\n  if (!setting || typeof setting.value !== \"string\") return undefined;\n  const stored = setting.value;\n  // Values written by saveCredential are AES-256-GCM encrypted at rest.\n  // Rows that predate encryption are plaintext — read them transparently\n  // (the migrate-encrypt-credentials script re-encrypts them in place).\n  if (!isEncryptedSecretValue(stored)) return stored;\n  try {\n    return decryptSecretValue(stored);\n  } catch {\n    // Key rotated, corrupt, or tampered row — treat as not set rather than\n    // surfacing ciphertext or throwing into every credential lookup.\n    return undefined;\n  }\n}\n\nasync function readScopedAppSecret(\n  key: string,\n  scope: SecretRef[\"scope\"],\n  scopeId: string,\n): Promise<string | undefined> {\n  try {\n    return (await readAppSecret({ key, scope, scopeId }))?.value;\n  } catch {\n    // Older databases may not have app_secrets yet. Keep the legacy\n    // credential store available while the table bootstraps.\n    return undefined;\n  }\n}\n\n/**\n * Resolve a credential from one explicit legacy SQL credential scope.\n *\n * Prefer `resolveCredential()` for normal app-local credential lookup. This\n * helper exists for workspace connection refs, where a ref can explicitly say\n * \"use the org-scoped key\" and must not accidentally read a user override.\n */\nexport async function resolveCredentialForScope(\n  key: string,\n  ctx: CredentialContext & { scope: CredentialStorageScope },\n): Promise<string | undefined> {\n  if (!ctx?.userEmail) return undefined;\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) return undefined;\n    return readCredentialSetting(orgCredentialSettingKey(ctx.orgId, key));\n  }\n  return readCredentialSetting(userCredentialSettingKey(ctx.userEmail, key));\n}\n\n/**\n * Resolve a credential across the encrypted app_secrets store and the legacy\n * settings-backed credential store. User overrides win, followed by the\n * active org/workspace shared value.\n *\n * SECURITY: NEVER reads from process.env. Env vars are global to the\n * deployment and would leak across users in a multi-tenant app.\n *\n * Read order:\n *   1. user-scoped app_secrets\n *   2. user-scoped legacy settings credential\n *   3. org-scoped app_secrets\n *   4. legacy workspace-scoped app_secrets for the org\n *   5. org-scoped legacy settings credential\n *   6. solo workspace-scoped app_secrets (`solo:<email>`)\n *\n * Steps 3-5 are skipped without an active org.\n */\nexport async function resolveCredential(\n  key: string,\n  ctx: CredentialContext,\n): Promise<string | undefined> {\n  if (!ctx?.userEmail) return undefined;\n\n  const userSecret = await readScopedAppSecret(key, \"user\", ctx.userEmail);\n  if (userSecret) return userSecret;\n\n  const userSetting = await resolveCredentialForScope(key, {\n    ...ctx,\n    scope: \"user\",\n  });\n  if (userSetting) return userSetting;\n\n  if (ctx.orgId) {\n    const orgSecret = await readScopedAppSecret(key, \"org\", ctx.orgId);\n    if (orgSecret) return orgSecret;\n\n    const workspaceSecret = await readScopedAppSecret(\n      key,\n      \"workspace\",\n      ctx.orgId,\n    );\n    if (workspaceSecret) return workspaceSecret;\n\n    const orgSetting = await resolveCredentialForScope(key, {\n      ...ctx,\n      scope: \"org\",\n    });\n    if (orgSetting) return orgSetting;\n  }\n\n  // Solo-workspace fallback: always checked, even when an org id was found\n  // above. A credential written before the user joined/created an org lives\n  // here, and must not become unreachable once that org exists. Last on\n  // purpose — a current org-scoped value always wins over a pre-org one.\n  return readScopedAppSecret(key, \"workspace\", `solo:${ctx.userEmail}`);\n}\n\n/**\n * Explain an empty credential lookup when a key of that name is saved in a\n * scope the caller cannot read.\n *\n * Two distinct causes produce the same \"the key is right there and it still\n * says it's missing\" report:\n *\n *  - Non-interactive runs — integration/webhook deliveries, scheduled jobs,\n *    automations, and inbound A2A calls — resolve credentials as an owner\n *    identity rather than as the person who triggered them, so a teammate's\n *    Personal key is invisible to them even though the vault visibly holds it.\n *  - The key is saved in a DIFFERENT organization the caller also belongs to.\n *    Credentials are per-organization, so gaining a second organization (or\n *    having `active-org-id` repointed at one) orphans every key synced under\n *    the first. Without this, the only symptom is a missing-env-var error that\n *    names the key rather than the org mismatch that actually caused it.\n *\n * SECURITY: both probes are bounded to organizations the caller is a member\n * of, report only the scope kind (and, for the cross-org case, the name of an\n * org the caller already belongs to), and never return the owning account, how\n * many rows matched, or any part of the value. Without an active org there is\n * no boundary to bound the probe to, so it declines to answer rather than\n * revealing that some other tenant holds a key of the same name.\n *\n * Returns null when nothing safe and useful can be said.\n */\nexport async function describeCredentialScopeGap(\n  keys: readonly string[],\n  ctx: CredentialContext,\n): Promise<string | null> {\n  if (!ctx?.userEmail || !ctx.orgId) return null;\n\n  for (const key of keys) {\n    if (await hasForeignPersonalCredentialInOrg(key, ctx)) {\n      return (\n        `A \"${key}\" key is saved in this workspace with Personal scope. ` +\n        `Personal keys are readable only by their own owner's signed-in sessions, ` +\n        `and this run resolves credentials as the owner identity behind the ` +\n        `integration, job, or automation — so it needs \"${key}\" saved with ` +\n        `Workspace or Organization scope instead.`\n      );\n    }\n\n    const holder = await findMemberOrgHoldingCredential(key, ctx);\n    if (holder) {\n      return (\n        `A \"${key}\" key is saved in the ${holder} organization, but this ` +\n        `request resolved to a different organization you also belong to. ` +\n        `Credentials are scoped per organization and are not shared between ` +\n        `them, so this is an organization mismatch rather than a missing key. ` +\n        `Either switch your active organization back to ${holder}, or save ` +\n        `\"${key}\" in the organization this request runs in.`\n      );\n    }\n  }\n  return null;\n}\n\nasync function hasForeignPersonalCredentialInOrg(\n  key: string,\n  ctx: CredentialContext,\n): Promise<boolean> {\n  try {\n    const { rows } = await getDbExec().execute({\n      sql: `SELECT 1 FROM app_secrets s\n              JOIN org_members m ON LOWER(m.email) = LOWER(s.scope_id)\n             WHERE s.key = ? AND s.scope = 'user'\n               AND m.org_id = ? AND LOWER(s.scope_id) <> ?\n             LIMIT 1`,\n      args: [key, ctx.orgId!, ctx.userEmail.toLowerCase()],\n    });\n    return rows.length > 0;\n  } catch {\n    // Missing app_secrets/org_members table, or any other read failure — a\n    // diagnostic must never replace the real \"not configured\" error.\n    return false;\n  }\n}\n\n/**\n * Name an organization the caller is a member of that holds this key, other\n * than the one the request resolved to. Returns a quoted display name, or the\n * bare word `another` when the org row is unreadable — never an org id, which\n * would be useless to the person reading the error.\n */\nasync function findMemberOrgHoldingCredential(\n  key: string,\n  ctx: CredentialContext,\n): Promise<string | null> {\n  try {\n    const { rows } = await getDbExec().execute({\n      sql: `SELECT o.name AS org_name\n              FROM app_secrets s\n              JOIN org_members m ON m.org_id = s.scope_id\n                                AND LOWER(m.email) = ?\n              LEFT JOIN organizations o ON o.id = s.scope_id\n             WHERE s.key = ?\n               AND s.scope IN ('org', 'workspace')\n               AND s.scope_id <> ?\n             LIMIT 1`,\n      args: [ctx.userEmail.toLowerCase(), key, ctx.orgId!],\n    });\n    if (rows.length === 0) return null;\n    const name = (rows[0] as { org_name?: unknown }).org_name;\n    return typeof name === \"string\" && name.trim()\n      ? `\"${name.trim()}\"`\n      : \"another\";\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Check if a credential is available for the given context.\n */\nexport async function hasCredential(\n  key: string,\n  ctx: CredentialContext,\n): Promise<boolean> {\n  return (await resolveCredential(key, ctx)) !== undefined;\n}\n\n/**\n * Save a credential. By default writes to the per-user store; pass\n * `scope: \"org\"` to write to the active org's shared credentials.\n */\nexport async function saveCredential(\n  key: string,\n  value: string,\n  ctx: CredentialContext & { scope?: \"user\" | \"org\" },\n): Promise<void> {\n  if (!ctx?.userEmail) {\n    throw new Error(\"saveCredential requires CredentialContext with userEmail\");\n  }\n  // Encrypt at rest (AES-256-GCM) so a leaked DB backup / pg_dump / read\n  // replica doesn't expose plaintext keys. resolveCredential decrypts\n  // transparently on read.\n  const encrypted = encryptSecretValue(value);\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) {\n      throw new Error(\"saveCredential scope='org' requires orgId\");\n    }\n    await putSetting(orgCredentialSettingKey(ctx.orgId, key), {\n      value: encrypted,\n    });\n    return;\n  }\n  await putSetting(userCredentialSettingKey(ctx.userEmail, key), {\n    value: encrypted,\n  });\n}\n\n/**\n * Delete a credential from the per-user (default) or per-org store.\n */\nexport async function deleteCredential(\n  key: string,\n  ctx: CredentialContext & { scope?: \"user\" | \"org\" },\n): Promise<void> {\n  if (!ctx?.userEmail) {\n    throw new Error(\n      \"deleteCredential requires CredentialContext with userEmail\",\n    );\n  }\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) {\n      throw new Error(\"deleteCredential scope='org' requires orgId\");\n    }\n    await deleteSetting(orgCredentialSettingKey(ctx.orgId, key));\n    return;\n  }\n  await deleteSetting(userCredentialSettingKey(ctx.userEmail, key));\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAkB,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,kCAAkC,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE7E,MAAM,cAAc,GAAG,aAAa,CAAC;AASrC,SAAS,wBAAwB,CAAC,KAAa,EAAE,GAAW;IAC1D,OAAO,KAAK,KAAK,CAAC,WAAW,EAAE,IAAI,cAAc,GAAG,GAAG,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAa,EAAE,GAAW;IACzD,OAAO,KAAK,KAAK,IAAI,cAAc,GAAG,GAAG,EAAE,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAW,EACX,KAAyB,EACzB,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,yDAAyD;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAW,EACX,GAA0D;IAE1D,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,qBAAqB,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,qBAAqB,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,qBAAqB,CAClC,GAAsB;IAEtB,IAAI,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACnE,OAAO;YACL,KAAK,EAAE,MAAM,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC;YAChD,YAAY,EAAE,KAAK;SACpB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,sEAAsE;QACtE,uEAAuE;QACvE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,GAAsB;IAEtB,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,SAAS,CAAC;IAEtC,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE;QACvD,GAAG,GAAG;QACN,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACnD,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;IAE5B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/D,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAEhC,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QAC3E,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;QAE5C,MAAM,UAAU,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE;YACtD,GAAG,GAAG;YACN,KAAK;YACL,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QACH,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACpC,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,OAAO,mBAAmB,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAuB,EACvB,GAAsB;IAEtB,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,SAAS,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,SAAS,GAAsB,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC;IAExE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,MAAM,iCAAiC,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;YAC5D,OAAO,CACL,MAAM,GAAG,wDAAwD;gBACjE,2EAA2E;gBAC3E,qEAAqE;gBACrE,kDAAkD,GAAG,eAAe;gBACpE,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CACL,MAAM,GAAG,yBAAyB,MAAM,0BAA0B;gBAClE,mEAAmE;gBACnE,qEAAqE;gBACrE,uEAAuE;gBACvE,kDAAkD,MAAM,YAAY;gBACpE,IAAI,GAAG,6CAA6C,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,GAAW,EACX,GAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE;;;;qBAIU;YACf,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,KAAM,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,8BAA8B,CAC3C,GAAW,EACX,GAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACzC,GAAG,EAAE;;;;;;;;qBAQU;YACf,IAAI,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,KAAM,CAAC;SACrD,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,GAAI,IAAI,CAAC,CAAC,CAA4B,CAAC,QAAQ,CAAC;QAC1D,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE;YAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG;YACpB,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,GAAsB;IAEtB,OAAO,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,KAAa,EACb,GAAmD;IAEnD,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,uEAAuE;IACvE,oEAAoE;IACpE,yBAAyB;IACzB,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,UAAU,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE;YACxD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,UAAU,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;QAC7D,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,GAAmD;IAEnD,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,aAAa,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,OAAO;IACT,CAAC;IACD,MAAM,aAAa,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport {\n  encryptSecretValue,\n  decryptSecretValue,\n  isEncryptedSecretValue,\n} from \"../secrets/crypto.js\";\nimport { readAppSecret, type SecretRef } from \"../secrets/storage.js\";\nimport { assertCredentialStoreReadable } from \"../server/credential-provider.js\";\nimport { getSetting, putSetting, deleteSetting } from \"../settings/store.js\";\n\nconst SETTING_PREFIX = \"credential:\";\n\nexport interface CredentialContext {\n  userEmail: string;\n  orgId?: string | null;\n}\n\nexport type CredentialStorageScope = \"user\" | \"org\";\n\nfunction userCredentialSettingKey(email: string, key: string): string {\n  return `u:${email.toLowerCase()}:${SETTING_PREFIX}${key}`;\n}\n\nfunction orgCredentialSettingKey(orgId: string, key: string): string {\n  return `o:${orgId}:${SETTING_PREFIX}${key}`;\n}\n\nasync function readCredentialSetting(\n  settingKey: string,\n): Promise<string | undefined> {\n  const setting = await getSetting(settingKey);\n  if (!setting || typeof setting.value !== \"string\") return undefined;\n  const stored = setting.value;\n  // Values written by saveCredential are AES-256-GCM encrypted at rest.\n  // Rows that predate encryption are plaintext — read them transparently\n  // (the migrate-encrypt-credentials script re-encrypts them in place).\n  if (!isEncryptedSecretValue(stored)) return stored;\n  try {\n    return decryptSecretValue(stored);\n  } catch {\n    // Key rotated, corrupt, or tampered row — treat as not set rather than\n    // surfacing ciphertext or throwing into every credential lookup.\n    return undefined;\n  }\n}\n\nasync function readScopedAppSecret(\n  key: string,\n  scope: SecretRef[\"scope\"],\n  scopeId: string,\n): Promise<string | undefined> {\n  try {\n    return (await readAppSecret({ key, scope, scopeId }))?.value;\n  } catch {\n    // Older databases may not have app_secrets yet. Keep the legacy\n    // credential store available while the table bootstraps.\n    return undefined;\n  }\n}\n\n/**\n * Resolve a credential from one explicit legacy SQL credential scope.\n *\n * Prefer `resolveCredential()` for normal app-local credential lookup. This\n * helper exists for workspace connection refs, where a ref can explicitly say\n * \"use the org-scoped key\" and must not accidentally read a user override.\n */\nexport async function resolveCredentialForScope(\n  key: string,\n  ctx: CredentialContext & { scope: CredentialStorageScope },\n): Promise<string | undefined> {\n  if (!ctx?.userEmail) return undefined;\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) return undefined;\n    return readCredentialSetting(orgCredentialSettingKey(ctx.orgId, key));\n  }\n  return readCredentialSetting(userCredentialSettingKey(ctx.userEmail, key));\n}\n\n/**\n * `ctx.orgId` when the caller supplied one, otherwise the org resolved from\n * `ctx.userEmail`'s membership. Interactive requests always supply `orgId`\n * (session/`getOrgContext` backfill it); CLI runs, cron jobs, and any other\n * caller built straight from `getCredentialContext()` outside a request event\n * do not, and previously fell through as \"no active org\" — invisibly skipping\n * every org-scoped credential a signed-in session could see. Mirrors the\n * fallback already proven in `resolveSecretDetailed`\n * (server/credential-provider.ts).\n */\nasync function resolveEffectiveOrgId(\n  ctx: CredentialContext,\n): Promise<{ orgId: string | null; lookupFailed: boolean; cause?: unknown }> {\n  if (ctx.orgId) return { orgId: ctx.orgId, lookupFailed: false };\n  try {\n    const { resolveOrgIdForEmail } = await import(\"../org/context.js\");\n    return {\n      orgId: await resolveOrgIdForEmail(ctx.userEmail),\n      lookupFailed: false,\n    };\n  } catch (cause) {\n    // Membership was unreadable, not merely absent — must not collapse to\n    // \"caller has no org\", which would silently hide every org-scoped row.\n    return { orgId: null, lookupFailed: true, cause };\n  }\n}\n\n/**\n * Resolve a credential across the encrypted app_secrets store and the legacy\n * settings-backed credential store. User overrides win, followed by the\n * active org/workspace shared value.\n *\n * SECURITY: NEVER reads from process.env. Env vars are global to the\n * deployment and would leak across users in a multi-tenant app.\n *\n * Read order:\n *   1. user-scoped app_secrets\n *   2. user-scoped legacy settings credential\n *   3. org-scoped app_secrets\n *   4. legacy workspace-scoped app_secrets for the org\n *   5. org-scoped legacy settings credential\n *   6. solo workspace-scoped app_secrets (`solo:<email>`)\n *\n * Steps 3-5 use `ctx.orgId` when given, else the org resolved from\n * `ctx.userEmail` (see `resolveEffectiveOrgId`), and are skipped only when the\n * caller truly has no org. A membership lookup that could not be read throws\n * `CredentialStoreUnavailableError` instead of silently reporting the\n * credential as unset — \"the store didn't answer\" and \"nothing is saved\" are\n * different outcomes callers must not conflate.\n */\nexport async function resolveCredential(\n  key: string,\n  ctx: CredentialContext,\n): Promise<string | undefined> {\n  if (!ctx?.userEmail) return undefined;\n\n  const userSecret = await readScopedAppSecret(key, \"user\", ctx.userEmail);\n  if (userSecret) return userSecret;\n\n  const userSetting = await resolveCredentialForScope(key, {\n    ...ctx,\n    scope: \"user\",\n  });\n  if (userSetting) return userSetting;\n\n  const orgLookup = await resolveEffectiveOrgId(ctx);\n  assertCredentialStoreReadable(orgLookup);\n  const { orgId } = orgLookup;\n\n  if (orgId) {\n    const orgSecret = await readScopedAppSecret(key, \"org\", orgId);\n    if (orgSecret) return orgSecret;\n\n    const workspaceSecret = await readScopedAppSecret(key, \"workspace\", orgId);\n    if (workspaceSecret) return workspaceSecret;\n\n    const orgSetting = await resolveCredentialForScope(key, {\n      ...ctx,\n      orgId,\n      scope: \"org\",\n    });\n    if (orgSetting) return orgSetting;\n  }\n\n  // Solo-workspace fallback: always checked, even when an org id was found\n  // above. A credential written before the user joined/created an org lives\n  // here, and must not become unreachable once that org exists. Last on\n  // purpose — a current org-scoped value always wins over a pre-org one.\n  return readScopedAppSecret(key, \"workspace\", `solo:${ctx.userEmail}`);\n}\n\n/**\n * Explain an empty credential lookup when a key of that name is saved in a\n * scope the caller cannot read.\n *\n * Two distinct causes produce the same \"the key is right there and it still\n * says it's missing\" report:\n *\n *  - Non-interactive runs — integration/webhook deliveries, scheduled jobs,\n *    automations, and inbound A2A calls — resolve credentials as an owner\n *    identity rather than as the person who triggered them, so a teammate's\n *    Personal key is invisible to them even though the vault visibly holds it.\n *  - The key is saved in a DIFFERENT organization the caller also belongs to.\n *    Credentials are per-organization, so gaining a second organization (or\n *    having `active-org-id` repointed at one) orphans every key synced under\n *    the first. Without this, the only symptom is a missing-env-var error that\n *    names the key rather than the org mismatch that actually caused it.\n *\n * SECURITY: both probes are bounded to organizations the caller is a member\n * of, report only the scope kind (and, for the cross-org case, the name of an\n * org the caller already belongs to), and never return the owning account, how\n * many rows matched, or any part of the value. Without an active org there is\n * no boundary to bound the probe to, so it declines to answer rather than\n * revealing that some other tenant holds a key of the same name — this\n * includes callers whose `ctx.orgId` is unset AND whose org could not be\n * resolved from `ctx.userEmail` (see `resolveEffectiveOrgId`).\n *\n * Returns null when nothing safe and useful can be said.\n */\nexport async function describeCredentialScopeGap(\n  keys: readonly string[],\n  ctx: CredentialContext,\n): Promise<string | null> {\n  if (!ctx?.userEmail) return null;\n  const orgLookup = await resolveEffectiveOrgId(ctx);\n  if (orgLookup.lookupFailed || !orgLookup.orgId) return null;\n  const scopedCtx: CredentialContext = { ...ctx, orgId: orgLookup.orgId };\n\n  for (const key of keys) {\n    if (await hasForeignPersonalCredentialInOrg(key, scopedCtx)) {\n      return (\n        `A \"${key}\" key is saved in this workspace with Personal scope. ` +\n        `Personal keys are readable only by their own owner's signed-in sessions, ` +\n        `and this run resolves credentials as the owner identity behind the ` +\n        `integration, job, or automation — so it needs \"${key}\" saved with ` +\n        `Workspace or Organization scope instead.`\n      );\n    }\n\n    const holder = await findMemberOrgHoldingCredential(key, scopedCtx);\n    if (holder) {\n      return (\n        `A \"${key}\" key is saved in the ${holder} organization, but this ` +\n        `request resolved to a different organization you also belong to. ` +\n        `Credentials are scoped per organization and are not shared between ` +\n        `them, so this is an organization mismatch rather than a missing key. ` +\n        `Either switch your active organization back to ${holder}, or save ` +\n        `\"${key}\" in the organization this request runs in.`\n      );\n    }\n  }\n  return null;\n}\n\nasync function hasForeignPersonalCredentialInOrg(\n  key: string,\n  ctx: CredentialContext,\n): Promise<boolean> {\n  try {\n    const { rows } = await getDbExec().execute({\n      sql: `SELECT 1 FROM app_secrets s\n              JOIN org_members m ON LOWER(m.email) = LOWER(s.scope_id)\n             WHERE s.key = ? AND s.scope = 'user'\n               AND m.org_id = ? AND LOWER(s.scope_id) <> ?\n             LIMIT 1`,\n      args: [key, ctx.orgId!, ctx.userEmail.toLowerCase()],\n    });\n    return rows.length > 0;\n  } catch {\n    // Missing app_secrets/org_members table, or any other read failure — a\n    // diagnostic must never replace the real \"not configured\" error.\n    return false;\n  }\n}\n\n/**\n * Name an organization the caller is a member of that holds this key, other\n * than the one the request resolved to. Returns a quoted display name, or the\n * bare word `another` when the org row is unreadable — never an org id, which\n * would be useless to the person reading the error.\n */\nasync function findMemberOrgHoldingCredential(\n  key: string,\n  ctx: CredentialContext,\n): Promise<string | null> {\n  try {\n    const { rows } = await getDbExec().execute({\n      sql: `SELECT o.name AS org_name\n              FROM app_secrets s\n              JOIN org_members m ON m.org_id = s.scope_id\n                                AND LOWER(m.email) = ?\n              LEFT JOIN organizations o ON o.id = s.scope_id\n             WHERE s.key = ?\n               AND s.scope IN ('org', 'workspace')\n               AND s.scope_id <> ?\n             LIMIT 1`,\n      args: [ctx.userEmail.toLowerCase(), key, ctx.orgId!],\n    });\n    if (rows.length === 0) return null;\n    const name = (rows[0] as { org_name?: unknown }).org_name;\n    return typeof name === \"string\" && name.trim()\n      ? `\"${name.trim()}\"`\n      : \"another\";\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Check if a credential is available for the given context.\n */\nexport async function hasCredential(\n  key: string,\n  ctx: CredentialContext,\n): Promise<boolean> {\n  return (await resolveCredential(key, ctx)) !== undefined;\n}\n\n/**\n * Save a credential. By default writes to the per-user store; pass\n * `scope: \"org\"` to write to the active org's shared credentials.\n */\nexport async function saveCredential(\n  key: string,\n  value: string,\n  ctx: CredentialContext & { scope?: \"user\" | \"org\" },\n): Promise<void> {\n  if (!ctx?.userEmail) {\n    throw new Error(\"saveCredential requires CredentialContext with userEmail\");\n  }\n  // Encrypt at rest (AES-256-GCM) so a leaked DB backup / pg_dump / read\n  // replica doesn't expose plaintext keys. resolveCredential decrypts\n  // transparently on read.\n  const encrypted = encryptSecretValue(value);\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) {\n      throw new Error(\"saveCredential scope='org' requires orgId\");\n    }\n    await putSetting(orgCredentialSettingKey(ctx.orgId, key), {\n      value: encrypted,\n    });\n    return;\n  }\n  await putSetting(userCredentialSettingKey(ctx.userEmail, key), {\n    value: encrypted,\n  });\n}\n\n/**\n * Delete a credential from the per-user (default) or per-org store.\n */\nexport async function deleteCredential(\n  key: string,\n  ctx: CredentialContext & { scope?: \"user\" | \"org\" },\n): Promise<void> {\n  if (!ctx?.userEmail) {\n    throw new Error(\n      \"deleteCredential requires CredentialContext with userEmail\",\n    );\n  }\n  if (ctx.scope === \"org\") {\n    if (!ctx.orgId) {\n      throw new Error(\"deleteCredential scope='org' requires orgId\");\n    }\n    await deleteSetting(orgCredentialSettingKey(ctx.orgId, key));\n    return;\n  }\n  await deleteSetting(userCredentialSettingKey(ctx.userEmail, key));\n}\n"]}

package/dist/extensions/url-safety.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-safety.d.ts","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AA4FA,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAoB1D;AASD;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAoBlB;AAwCD,wBAAsB,wBAAwB,CAC5C,qBAAqB,GAAE,SAAS,MAAM,EAAO,GAC5C,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAyEzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE;IACP,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACL,OAAO,CAAC,QAAQ,CAAC,CA8DnB;AAQD,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"url-safety.d.ts","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AA4FA,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAoB1D;AASD;;;;GAIG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAoBlB;AA8ED,wBAAsB,wBAAwB,CAC5C,qBAAqB,GAAE,SAAS,MAAM,EAAO,GAC5C,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAyEzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,WAAgB,EACtB,OAAO,GAAE;IACP,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GACL,OAAO,CAAC,QAAQ,CAAC,CA0DnB;AAQD,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC"}

package/dist/extensions/url-safety.js

@@ -175,6 +175,18 @@ export async function isBlockedExtensionUrlWithDns(url) {
 function normalizeLookupHostname(hostname) {
     return hostname.toLowerCase().replace(/^\[|\]$/g, "");
 }
+function loopbackHostnameVariants(hostname) {
+    const normalized = normalizeLookupHostname(hostname);
+    if (normalized !== "localhost" &&
+        normalized !== "127.0.0.1" &&
+        normalized !== "::1") {
+        return [normalized];
+    }
+    // Local workspace manifests can identify the same child server as
+    // localhost, 127.0.0.1, or ::1. They are equivalent only for loopback; do
+    // not alias arbitrary private or public hostnames.
+    return ["localhost", "127.0.0.1", "::1"];
+}
 function normalizeAllowedPrivateOriginKeys(origins) {
     const keys = new Set();
     for (const origin of origins) {
@@ -184,7 +196,28 @@ function normalizeAllowedPrivateOriginKeys(origins) {
                 continue;
             }
             const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
-            keys.add(`${normalizeLookupHostname(parsed.hostname)}:${port}`);
+            for (const hostname of loopbackHostnameVariants(parsed.hostname)) {
+                keys.add(`${hostname}:${port}`);
+            }
+        }
+        catch {
+            // coercion-ok: malformed deployment configuration is omitted, preserving the fail-closed private-IP guard.
+        }
+    }
+    return keys;
+}
+function normalizeAllowedPrivateOriginOriginKeys(origins) {
+    const keys = new Set();
+    for (const origin of origins) {
+        try {
+            const parsed = new URL(origin);
+            if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+                continue;
+            }
+            const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+            for (const hostname of loopbackHostnameVariants(parsed.hostname)) {
+                keys.add(`${parsed.protocol}//${hostname}:${port}`);
+            }
         }
         catch {
             // Ignore malformed deployment configuration and retain the private-IP guard.
@@ -273,21 +306,14 @@ export async function ssrfSafeFetch(url, init = {}, options = {}) {
     const maxRedirects = options.maxRedirects ?? 3;
     const dispatcher = (await createSsrfSafeDispatcher(options.allowedPrivateOrigins)) ??
         undefined;
-    const allowedPrivateOrigins = new Set((options.allowedPrivateOrigins ?? [])
-        .map((origin) => {
-        try {
-            return new URL(origin).origin;
-        }
-        catch {
-            return "";
-        }
-    })
-        .filter(Boolean));
+    const allowedPrivateOrigins = normalizeAllowedPrivateOriginOriginKeys(options.allowedPrivateOrigins ?? []);
     const isAllowedPrivateOrigin = (candidate) => {
         if (allowedPrivateOrigins.size === 0)
             return false;
         try {
-            return allowedPrivateOrigins.has(new URL(candidate).origin);
+            const parsed = new URL(candidate);
+            const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+            return allowedPrivateOrigins.has(`${parsed.protocol}//${normalizeLookupHostname(parsed.hostname)}:${port}`);
         }
         catch {
             return false;

package/dist/extensions/url-safety.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-safety.js","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG;IACrB,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,SAAS;IACT,WAAW;IACX,SAAS;IACT,eAAe;IACf,SAAS;CACV,CAAC;AAEF,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC;IACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;IACrB,OAAO,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IACE,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,IAAI,EACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,iCAAiC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IAED,wBAAwB;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;YACrB,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IACE,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC,EACF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW;IAEX,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,iCAAiC,CACxC,OAA0B;IAE1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChE,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1E,IAAI,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,qBAAqB,GAAsB,EAAE;IAE7C,oEAAoE;IACpE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,MAAW,CAAC;IAChB,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,QAAQ,CAChC,WAAW,EACX,0BAA0B,CACY,CAAC;QACzC,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,SAAS,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7B,MAAM,wBAAwB,GAAG,iCAAiC,CAChE,qBAAqB,CACtB,CAAC;IACF,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEnC,OAAO,IAAI,KAAK,CAAC;QACf,OAAO,EAAE;YACP,oEAAoE;YACpE,oEAAoE;YACpE,gCAAgC;YAChC,MAAM,EAAE,CACN,QAAgB,EAChB,OAAY,EACZ,QAIS,EACT,EAAE;gBACF,MAAM,CACJ,QAAQ,EACR,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAC7B,CAAC,GAAiC,EAAE,SAAc,EAAE,EAAE;oBACpD,IAAI,GAAG;wBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC9B,MAAM,IAAI,GAA0C,KAAK,CAAC,OAAO,CAC/D,SAAS,CACV;wBACC,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;wBAC1B,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAChD,GAAG,uBAAuB,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,CACtE,CAAC;wBACF,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;4BACpD,MAAM,CAAC,GAAG,IAAI,KAAK,CACjB,oBAAoB,QAAQ,gCAAgC,MAAM,CAAC,OAAO,EAAE,CACpD,CAAC;4BAC3B,CAAC,CAAC,IAAI,GAAG,aAAa,CAAC;4BACvB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;wBACrB,CAAC;oBACH,CAAC;oBACD,gEAAgE;oBAChE,4DAA4D;oBAC5D,iBAAiB;oBACjB,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;wBAC3B,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAW,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;oBACtB,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrD,CAAC,CACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,IAAI,GAAgB,EAAE,EACtB,OAAO,GAYH,EAAE;IAEN,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GACd,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC/D,SAAS,CAAC;IACZ,MAAM,qBAAqB,GAAG,IAAI,GAAG,CACnC,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC;SAClC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACd,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;IACF,MAAM,sBAAsB,GAAG,CAAC,SAAiB,EAAW,EAAE;QAC5D,IAAI,qBAAqB,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;QAC7C,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,IACE,CAAC,sBAAsB,CAAC,UAAU,CAAC;YACnC,CAAC,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,EAChD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,6DAA6D,UAAU,GAAG,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAA2C;YACxD,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC/B,sEAAsE;YACtE,0BAA0B;YAC1B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;YAChD,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,sCAAsC,YAAY,oBAAoB,GAAG,EAAE,CAC5E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,gFAAgF;AAEhF,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC","sourcesContent":["const METADATA_HOSTS = [\n  \"metadata.google.internal\",\n  \"metadata.google.internal.\",\n];\n\nconst DNS_REBIND_SUFFIXES = [\n  \".nip.io\",\n  \".sslip.io\",\n  \".xip.io\",\n  \".localtest.me\",\n  \".lvh.me\",\n];\n\nfunction isPrivateIpv4(a: number, b: number, c = 0, d = 0): boolean {\n  if (![a, b, c, d].every((part) => part >= 0 && part <= 255)) return true;\n  if (a === 127) return true;\n  if (a === 10) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 169 && b === 254) return true;\n  if (a === 0) return true;\n  if (a === 100 && b >= 64 && b <= 127) return true;\n  if (a === 192 && b === 0) return true;\n  if (a === 198 && (b === 18 || b === 19)) return true;\n  if (a === 192 && b === 0 && c === 2) return true;\n  if (a === 198 && b === 51 && c === 100) return true;\n  if (a === 203 && b === 0 && c === 113) return true;\n  if (a >= 224) return true;\n  return false;\n}\n\nfunction isPrivateIpv4MappedHex(host: string): boolean {\n  const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);\n  if (!mapped) return false;\n  const high = Number.parseInt(mapped[1], 16);\n  const low = Number.parseInt(mapped[2], 16);\n  if (high < 0 || high > 0xffff || low < 0 || low > 0xffff) return false;\n  const a = (high >> 8) & 0xff;\n  const b = high & 0xff;\n  const c = (low >> 8) & 0xff;\n  const d = low & 0xff;\n  return isPrivateIpv4(a, b, c, d);\n}\n\nfunction isPrivateHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (\n    host === \"localhost\" ||\n    host === \"::1\" ||\n    host === \"::0\" ||\n    host === \"::\"\n  ) {\n    return true;\n  }\n  if (METADATA_HOSTS.includes(host)) return true;\n\n  // IPv6 ULA/link-local/multicast.\n  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host)) return true;\n  if (/^ff/i.test(host)) return true;\n\n  // IPv4-mapped IPv6. URL parsing may preserve dotted form in some runtimes\n  // or normalize it to hex, e.g. [::ffff:127.0.0.1] -> ::ffff:7f00:1.\n  const v4mappedDotted = host.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (v4mappedDotted) {\n    const [a, b, c, d] = v4mappedDotted[1].split(\".\").map(Number);\n    if (isPrivateIpv4(a, b, c, d)) return true;\n  }\n  if (isPrivateIpv4MappedHex(host)) return true;\n\n  // Dotted IPv4. URL parsing normalizes shorthand/octal/hex IPv4 forms to\n  // dotted decimal before we reach this point.\n  const parts = host.split(\".\");\n  if (parts.length === 4 && parts.every((p) => /^\\d+$/.test(p))) {\n    const [a, b, c, d] = parts.map(Number);\n    if (isPrivateIpv4(a, b, c, d)) return true;\n  }\n\n  // Decimal integer IPv4.\n  if (/^\\d+$/.test(host)) {\n    const num = Number(host);\n    if (num >= 0 && num <= 0xffffffff) {\n      const a = (num >>> 24) & 0xff;\n      const b = (num >>> 16) & 0xff;\n      const c = (num >>> 8) & 0xff;\n      const d = num & 0xff;\n      if (isPrivateIpv4(a, b, c, d)) return true;\n    }\n  }\n\n  return false;\n}\n\nexport function isBlockedExtensionUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n      return true;\n    }\n    const host = parsed.hostname.toLowerCase();\n    if (isPrivateHost(host)) return true;\n    if (\n      DNS_REBIND_SUFFIXES.some((suffix) => {\n        const bare = suffix.slice(1);\n        return host === bare || host.endsWith(suffix);\n      })\n    ) {\n      return true;\n    }\n  } catch {\n    return true;\n  }\n  return false;\n}\n\nfunction isIpLiteralHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (host.includes(\":\")) return true;\n  const parts = host.split(\".\");\n  return parts.length === 4 && parts.every((p) => /^\\d+$/.test(p));\n}\n\n/**\n * Async SSRF guard for environments that can resolve DNS. The synchronous\n * guard catches literals and known rebinding domains; this closes the common\n * \"public hostname resolves to a private address\" gap before dispatch.\n */\nexport async function isBlockedExtensionUrlWithDns(\n  url: string,\n): Promise<boolean> {\n  if (isBlockedExtensionUrl(url)) return true;\n\n  let hostname: string;\n  try {\n    hostname = new URL(url).hostname.toLowerCase();\n  } catch {\n    return true;\n  }\n  if (!hostname || isIpLiteralHost(hostname)) return false;\n\n  try {\n    const { lookup } = await import(\"node:dns/promises\");\n    const records = await lookup(hostname, { all: true, verbatim: true });\n    return records.some((record) => isPrivateHost(record.address));\n  } catch {\n    // Some edge runtimes do not expose DNS lookup. Keep the deterministic\n    // parser-based protections instead of failing every outbound request.\n    return false;\n  }\n}\n\n/**\n * Build an undici Dispatcher whose connect-time DNS lookup runs through a\n * private-IP guard. This closes the TOCTOU gap where:\n *   1. We resolve hostname → public IP and pass.\n *   2. Between that lookup and the actual connect, DNS rebinding flips the\n *      record to a private IP.\n *   3. fetch() resolves again and connects to the private IP.\n *\n * With a custom dispatcher, the same lookup that produces the IP also gates\n * the connect: if the IP is in the private set, the connect throws.\n *\n * Returns `null` if undici / node:dns are not available (e.g. some edge\n * runtimes); the caller should fall back to the regular `fetch` path —\n * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.\n */\nfunction normalizeLookupHostname(hostname: string): string {\n  return hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n}\n\nfunction normalizeAllowedPrivateOriginKeys(\n  origins: readonly string[],\n): Set<string> {\n  const keys = new Set<string>();\n  for (const origin of origins) {\n    try {\n      const parsed = new URL(origin);\n      if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n        continue;\n      }\n      const port = parsed.port || (parsed.protocol === \"https:\" ? \"443\" : \"80\");\n      keys.add(`${normalizeLookupHostname(parsed.hostname)}:${port}`);\n    } catch {\n      // Ignore malformed deployment configuration and retain the private-IP guard.\n    }\n  }\n  return keys;\n}\n\nexport async function createSsrfSafeDispatcher(\n  allowedPrivateOrigins: readonly string[] = [],\n): Promise<unknown | null> {\n  // Keep the optional undici import opaque to Vite/Rolldown. A static\n  // `import(\"undici\")` makes browser builds try to resolve and bundle undici\n  // even though this dispatcher is only useful in Node server runtimes.\n  let undici: any;\n  let dnsModule: any;\n  try {\n    const runtimeImport = new Function(\n      \"specifier\",\n      \"return import(specifier)\",\n    ) as (specifier: string) => Promise<any>;\n    undici = await runtimeImport(\"undici\");\n    dnsModule = await import(\"node:dns\");\n  } catch {\n    return null;\n  }\n\n  const { Agent } = undici;\n  const { lookup } = dnsModule;\n  const allowedPrivateOriginKeys = normalizeAllowedPrivateOriginKeys(\n    allowedPrivateOrigins,\n  );\n  if (!Agent || !lookup) return null;\n\n  return new Agent({\n    connect: {\n      // Override DNS lookup at connect time so the IP we hand to undici's\n      // socket is the one we authorized. Reject any record in the private\n      // set BEFORE the TCP handshake.\n      lookup: (\n        hostname: string,\n        options: any,\n        callback: (\n          err: NodeJS.ErrnoException | null,\n          address?: string | { address: string; family: number }[],\n          family?: number,\n        ) => void,\n      ) => {\n        lookup(\n          hostname,\n          { all: true, verbatim: true },\n          (err: NodeJS.ErrnoException | null, addresses: any) => {\n            if (err) return callback(err);\n            const list: { address: string; family: number }[] = Array.isArray(\n              addresses,\n            )\n              ? addresses\n              : [{ address: addresses, family: 4 }];\n            for (const record of list) {\n              const allowedOrigin = allowedPrivateOriginKeys.has(\n                `${normalizeLookupHostname(hostname)}:${String(options?.port ?? \"\")}`,\n              );\n              if (isPrivateHost(record.address) && !allowedOrigin) {\n                const e = new Error(\n                  `Connect blocked: ${hostname} resolved to private address ${record.address}`,\n                ) as NodeJS.ErrnoException;\n                e.code = \"EAI_BLOCKED\";\n                return callback(e);\n              }\n            }\n            // Mirror Node's lookup behavior: when `all` is true, return the\n            // array; otherwise the first entry. undici's connect honors\n            // `options.all`.\n            if (options && options.all) {\n              return callback(null, list as any);\n            }\n            const first = list[0];\n            return callback(null, first.address, first.family);\n          },\n        );\n      },\n    },\n  });\n}\n\n/**\n * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.\n *\n * Applies the same protections the extension proxy uses, so every call site\n * that fetches an untrusted URL gets them without re-implementing the loop:\n *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)\n *      on the initial URL and on every redirect hop.\n *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect\n *      time (closes the DNS-rebinding TOCTOU) when undici is available.\n *   3. Manual redirect handling — a public URL cannot 30x-redirect into the\n *      private network because each hop is re-validated before it is followed.\n *\n * Throws an Error whose message starts with \"SSRF blocked:\" when a target\n * (initial or via redirect) resolves to a private/internal address, or when the\n * redirect limit is exceeded. Otherwise returns the final Response.\n *\n * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are\n * followed only to `https:` targets, so an HTTPS-only caller cannot be\n * downgraded to plain HTTP by a 30x from the (untrusted) origin.\n *\n * `assertUrlAllowed` lets callers layer a stricter destination policy (for\n * example, a credential's origin allowlist) on top of the SSRF checks. It runs\n * before the initial request and before every redirect hop, so sensitive\n * headers and bodies are never forwarded to a destination the caller rejects.\n */\nexport async function ssrfSafeFetch(\n  url: string,\n  init: RequestInit = {},\n  options: {\n    maxRedirects?: number;\n    httpsOnly?: boolean;\n    assertUrlAllowed?: (url: string) => void | Promise<void>;\n    /**\n     * Exact origins that may resolve to a private address. A workspace runs\n     * every app on loopback behind one gateway, so sibling A2A calls are\n     * private by construction; without this they are indistinguishable from an\n     * SSRF attempt and get blocked. Only ever pass origins the deployment\n     * itself configured (never a request-supplied value).\n     */\n    allowedPrivateOrigins?: readonly string[];\n  } = {},\n): Promise<Response> {\n  const maxRedirects = options.maxRedirects ?? 3;\n  const dispatcher =\n    (await createSsrfSafeDispatcher(options.allowedPrivateOrigins)) ??\n    undefined;\n  const allowedPrivateOrigins = new Set(\n    (options.allowedPrivateOrigins ?? [])\n      .map((origin) => {\n        try {\n          return new URL(origin).origin;\n        } catch {\n          return \"\";\n        }\n      })\n      .filter(Boolean),\n  );\n  const isAllowedPrivateOrigin = (candidate: string): boolean => {\n    if (allowedPrivateOrigins.size === 0) return false;\n    try {\n      return allowedPrivateOrigins.has(new URL(candidate).origin);\n    } catch {\n      return false;\n    }\n  };\n\n  let currentUrl = url;\n  for (let hop = 0; hop <= maxRedirects; hop++) {\n    await options.assertUrlAllowed?.(currentUrl);\n    if (options.httpsOnly && new URL(currentUrl).protocol !== \"https:\") {\n      throw new Error(\n        `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,\n      );\n    }\n    if (\n      !isAllowedPrivateOrigin(currentUrl) &&\n      (await isBlockedExtensionUrlWithDns(currentUrl))\n    ) {\n      throw new Error(\n        `SSRF blocked: refusing to fetch private/internal address (${currentUrl})`,\n      );\n    }\n    const fetchOpts: RequestInit & { dispatcher?: unknown } = {\n      ...init,\n      redirect: \"manual\",\n    };\n    if (dispatcher) fetchOpts.dispatcher = dispatcher;\n\n    const response = await fetch(currentUrl, fetchOpts);\n    if (response.status >= 300 && response.status < 400) {\n      const location = response.headers.get(\"location\");\n      if (!location) return response;\n      // Drain the redirect body so the hop's connection is released instead\n      // of being held until GC.\n      await response.body?.cancel().catch(() => {});\n      currentUrl = new URL(location, currentUrl).href;\n      continue;\n    }\n    return response;\n  }\n  throw new Error(\n    `SSRF blocked: too many redirects (>${maxRedirects}) while fetching ${url}`,\n  );\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Legacy aliases — predate the Tools → Extensions rename. Templates import\n// these via the legacy `@agent-native/core/tools/url-safety` subpath; keep\n// the names exported so they keep resolving until every consumer updates.\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport { isBlockedExtensionUrl as isBlockedToolUrl };\nexport { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };\nexport { ssrfSafeFetch as ssrfSafeToolFetch };\n"]}
+{"version":3,"file":"url-safety.js","sourceRoot":"","sources":["../../src/extensions/url-safety.ts"],"names":[],"mappings":"AAAA,MAAM,cAAc,GAAG;IACrB,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,SAAS;IACT,WAAW;IACX,SAAS;IACT,eAAe;IACf,SAAS;CACV,CAAC;AAEF,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC;IACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;IACrB,OAAO,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IACE,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,IAAI,EACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,iCAAiC;IACjC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IAED,wBAAwB;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;YAC7B,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;YACrB,IAAI,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IACE,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC,EACF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW;IAEX,IAAI,qBAAqB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,MAAM,UAAU,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACrD,IACE,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,KAAK,EACpB,CAAC;QACD,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IACD,kEAAkE;IAClE,0EAA0E;IAC1E,mDAAmD;IACnD,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,iCAAiC,CACxC,OAA0B;IAE1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChE,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1E,KAAK,MAAM,QAAQ,IAAI,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjE,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2GAA2G;QAC7G,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,uCAAuC,CAC9C,OAA0B;IAE1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChE,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1E,KAAK,MAAM,QAAQ,IAAI,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjE,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,qBAAqB,GAAsB,EAAE;IAE7C,oEAAoE;IACpE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,MAAW,CAAC;IAChB,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,QAAQ,CAChC,WAAW,EACX,0BAA0B,CACY,CAAC;QACzC,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,SAAS,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7B,MAAM,wBAAwB,GAAG,iCAAiC,CAChE,qBAAqB,CACtB,CAAC;IACF,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEnC,OAAO,IAAI,KAAK,CAAC;QACf,OAAO,EAAE;YACP,oEAAoE;YACpE,oEAAoE;YACpE,gCAAgC;YAChC,MAAM,EAAE,CACN,QAAgB,EAChB,OAAY,EACZ,QAIS,EACT,EAAE;gBACF,MAAM,CACJ,QAAQ,EACR,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAC7B,CAAC,GAAiC,EAAE,SAAc,EAAE,EAAE;oBACpD,IAAI,GAAG;wBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC9B,MAAM,IAAI,GAA0C,KAAK,CAAC,OAAO,CAC/D,SAAS,CACV;wBACC,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;oBACxC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;wBAC1B,MAAM,aAAa,GAAG,wBAAwB,CAAC,GAAG,CAChD,GAAG,uBAAuB,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,CACtE,CAAC;wBACF,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;4BACpD,MAAM,CAAC,GAAG,IAAI,KAAK,CACjB,oBAAoB,QAAQ,gCAAgC,MAAM,CAAC,OAAO,EAAE,CACpD,CAAC;4BAC3B,CAAC,CAAC,IAAI,GAAG,aAAa,CAAC;4BACvB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;wBACrB,CAAC;oBACH,CAAC;oBACD,gEAAgE;oBAChE,4DAA4D;oBAC5D,iBAAiB;oBACjB,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;wBAC3B,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAW,CAAC,CAAC;oBACrC,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;oBACtB,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrD,CAAC,CACF,CAAC;YACJ,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,IAAI,GAAgB,EAAE,EACtB,OAAO,GAYH,EAAE;IAEN,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GACd,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC/D,SAAS,CAAC;IACZ,MAAM,qBAAqB,GAAG,uCAAuC,CACnE,OAAO,CAAC,qBAAqB,IAAI,EAAE,CACpC,CAAC;IACF,MAAM,sBAAsB,GAAG,CAAC,SAAiB,EAAW,EAAE;QAC5D,IAAI,qBAAqB,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC1E,OAAO,qBAAqB,CAAC,GAAG,CAC9B,GAAG,MAAM,CAAC,QAAQ,KAAK,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAC1E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;QAC7C,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,IACE,CAAC,sBAAsB,CAAC,UAAU,CAAC;YACnC,CAAC,MAAM,4BAA4B,CAAC,UAAU,CAAC,CAAC,EAChD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,6DAA6D,UAAU,GAAG,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAA2C;YACxD,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,UAAU;YAAE,SAAS,CAAC,UAAU,GAAG,UAAU,CAAC;QAElD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,OAAO,QAAQ,CAAC;YAC/B,sEAAsE;YACtE,0BAA0B;YAC1B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC;YAChD,SAAS;QACX,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CACb,sCAAsC,YAAY,oBAAoB,GAAG,EAAE,CAC5E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,gFAAgF;AAEhF,OAAO,EAAE,qBAAqB,IAAI,gBAAgB,EAAE,CAAC;AACrD,OAAO,EAAE,4BAA4B,IAAI,uBAAuB,EAAE,CAAC;AACnE,OAAO,EAAE,aAAa,IAAI,iBAAiB,EAAE,CAAC","sourcesContent":["const METADATA_HOSTS = [\n  \"metadata.google.internal\",\n  \"metadata.google.internal.\",\n];\n\nconst DNS_REBIND_SUFFIXES = [\n  \".nip.io\",\n  \".sslip.io\",\n  \".xip.io\",\n  \".localtest.me\",\n  \".lvh.me\",\n];\n\nfunction isPrivateIpv4(a: number, b: number, c = 0, d = 0): boolean {\n  if (![a, b, c, d].every((part) => part >= 0 && part <= 255)) return true;\n  if (a === 127) return true;\n  if (a === 10) return true;\n  if (a === 172 && b >= 16 && b <= 31) return true;\n  if (a === 192 && b === 168) return true;\n  if (a === 169 && b === 254) return true;\n  if (a === 0) return true;\n  if (a === 100 && b >= 64 && b <= 127) return true;\n  if (a === 192 && b === 0) return true;\n  if (a === 198 && (b === 18 || b === 19)) return true;\n  if (a === 192 && b === 0 && c === 2) return true;\n  if (a === 198 && b === 51 && c === 100) return true;\n  if (a === 203 && b === 0 && c === 113) return true;\n  if (a >= 224) return true;\n  return false;\n}\n\nfunction isPrivateIpv4MappedHex(host: string): boolean {\n  const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);\n  if (!mapped) return false;\n  const high = Number.parseInt(mapped[1], 16);\n  const low = Number.parseInt(mapped[2], 16);\n  if (high < 0 || high > 0xffff || low < 0 || low > 0xffff) return false;\n  const a = (high >> 8) & 0xff;\n  const b = high & 0xff;\n  const c = (low >> 8) & 0xff;\n  const d = low & 0xff;\n  return isPrivateIpv4(a, b, c, d);\n}\n\nfunction isPrivateHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (\n    host === \"localhost\" ||\n    host === \"::1\" ||\n    host === \"::0\" ||\n    host === \"::\"\n  ) {\n    return true;\n  }\n  if (METADATA_HOSTS.includes(host)) return true;\n\n  // IPv6 ULA/link-local/multicast.\n  if (/^f[cd]/.test(host) || /^fe[89ab]/.test(host)) return true;\n  if (/^ff/i.test(host)) return true;\n\n  // IPv4-mapped IPv6. URL parsing may preserve dotted form in some runtimes\n  // or normalize it to hex, e.g. [::ffff:127.0.0.1] -> ::ffff:7f00:1.\n  const v4mappedDotted = host.match(/^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/);\n  if (v4mappedDotted) {\n    const [a, b, c, d] = v4mappedDotted[1].split(\".\").map(Number);\n    if (isPrivateIpv4(a, b, c, d)) return true;\n  }\n  if (isPrivateIpv4MappedHex(host)) return true;\n\n  // Dotted IPv4. URL parsing normalizes shorthand/octal/hex IPv4 forms to\n  // dotted decimal before we reach this point.\n  const parts = host.split(\".\");\n  if (parts.length === 4 && parts.every((p) => /^\\d+$/.test(p))) {\n    const [a, b, c, d] = parts.map(Number);\n    if (isPrivateIpv4(a, b, c, d)) return true;\n  }\n\n  // Decimal integer IPv4.\n  if (/^\\d+$/.test(host)) {\n    const num = Number(host);\n    if (num >= 0 && num <= 0xffffffff) {\n      const a = (num >>> 24) & 0xff;\n      const b = (num >>> 16) & 0xff;\n      const c = (num >>> 8) & 0xff;\n      const d = num & 0xff;\n      if (isPrivateIpv4(a, b, c, d)) return true;\n    }\n  }\n\n  return false;\n}\n\nexport function isBlockedExtensionUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n      return true;\n    }\n    const host = parsed.hostname.toLowerCase();\n    if (isPrivateHost(host)) return true;\n    if (\n      DNS_REBIND_SUFFIXES.some((suffix) => {\n        const bare = suffix.slice(1);\n        return host === bare || host.endsWith(suffix);\n      })\n    ) {\n      return true;\n    }\n  } catch {\n    return true;\n  }\n  return false;\n}\n\nfunction isIpLiteralHost(hostname: string): boolean {\n  const host = hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n  if (host.includes(\":\")) return true;\n  const parts = host.split(\".\");\n  return parts.length === 4 && parts.every((p) => /^\\d+$/.test(p));\n}\n\n/**\n * Async SSRF guard for environments that can resolve DNS. The synchronous\n * guard catches literals and known rebinding domains; this closes the common\n * \"public hostname resolves to a private address\" gap before dispatch.\n */\nexport async function isBlockedExtensionUrlWithDns(\n  url: string,\n): Promise<boolean> {\n  if (isBlockedExtensionUrl(url)) return true;\n\n  let hostname: string;\n  try {\n    hostname = new URL(url).hostname.toLowerCase();\n  } catch {\n    return true;\n  }\n  if (!hostname || isIpLiteralHost(hostname)) return false;\n\n  try {\n    const { lookup } = await import(\"node:dns/promises\");\n    const records = await lookup(hostname, { all: true, verbatim: true });\n    return records.some((record) => isPrivateHost(record.address));\n  } catch {\n    // Some edge runtimes do not expose DNS lookup. Keep the deterministic\n    // parser-based protections instead of failing every outbound request.\n    return false;\n  }\n}\n\n/**\n * Build an undici Dispatcher whose connect-time DNS lookup runs through a\n * private-IP guard. This closes the TOCTOU gap where:\n *   1. We resolve hostname → public IP and pass.\n *   2. Between that lookup and the actual connect, DNS rebinding flips the\n *      record to a private IP.\n *   3. fetch() resolves again and connects to the private IP.\n *\n * With a custom dispatcher, the same lookup that produces the IP also gates\n * the connect: if the IP is in the private set, the connect throws.\n *\n * Returns `null` if undici / node:dns are not available (e.g. some edge\n * runtimes); the caller should fall back to the regular `fetch` path —\n * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.\n */\nfunction normalizeLookupHostname(hostname: string): string {\n  return hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n}\n\nfunction loopbackHostnameVariants(hostname: string): string[] {\n  const normalized = normalizeLookupHostname(hostname);\n  if (\n    normalized !== \"localhost\" &&\n    normalized !== \"127.0.0.1\" &&\n    normalized !== \"::1\"\n  ) {\n    return [normalized];\n  }\n  // Local workspace manifests can identify the same child server as\n  // localhost, 127.0.0.1, or ::1. They are equivalent only for loopback; do\n  // not alias arbitrary private or public hostnames.\n  return [\"localhost\", \"127.0.0.1\", \"::1\"];\n}\n\nfunction normalizeAllowedPrivateOriginKeys(\n  origins: readonly string[],\n): Set<string> {\n  const keys = new Set<string>();\n  for (const origin of origins) {\n    try {\n      const parsed = new URL(origin);\n      if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n        continue;\n      }\n      const port = parsed.port || (parsed.protocol === \"https:\" ? \"443\" : \"80\");\n      for (const hostname of loopbackHostnameVariants(parsed.hostname)) {\n        keys.add(`${hostname}:${port}`);\n      }\n    } catch {\n      // coercion-ok: malformed deployment configuration is omitted, preserving the fail-closed private-IP guard.\n    }\n  }\n  return keys;\n}\n\nfunction normalizeAllowedPrivateOriginOriginKeys(\n  origins: readonly string[],\n): Set<string> {\n  const keys = new Set<string>();\n  for (const origin of origins) {\n    try {\n      const parsed = new URL(origin);\n      if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n        continue;\n      }\n      const port = parsed.port || (parsed.protocol === \"https:\" ? \"443\" : \"80\");\n      for (const hostname of loopbackHostnameVariants(parsed.hostname)) {\n        keys.add(`${parsed.protocol}//${hostname}:${port}`);\n      }\n    } catch {\n      // Ignore malformed deployment configuration and retain the private-IP guard.\n    }\n  }\n  return keys;\n}\n\nexport async function createSsrfSafeDispatcher(\n  allowedPrivateOrigins: readonly string[] = [],\n): Promise<unknown | null> {\n  // Keep the optional undici import opaque to Vite/Rolldown. A static\n  // `import(\"undici\")` makes browser builds try to resolve and bundle undici\n  // even though this dispatcher is only useful in Node server runtimes.\n  let undici: any;\n  let dnsModule: any;\n  try {\n    const runtimeImport = new Function(\n      \"specifier\",\n      \"return import(specifier)\",\n    ) as (specifier: string) => Promise<any>;\n    undici = await runtimeImport(\"undici\");\n    dnsModule = await import(\"node:dns\");\n  } catch {\n    return null;\n  }\n\n  const { Agent } = undici;\n  const { lookup } = dnsModule;\n  const allowedPrivateOriginKeys = normalizeAllowedPrivateOriginKeys(\n    allowedPrivateOrigins,\n  );\n  if (!Agent || !lookup) return null;\n\n  return new Agent({\n    connect: {\n      // Override DNS lookup at connect time so the IP we hand to undici's\n      // socket is the one we authorized. Reject any record in the private\n      // set BEFORE the TCP handshake.\n      lookup: (\n        hostname: string,\n        options: any,\n        callback: (\n          err: NodeJS.ErrnoException | null,\n          address?: string | { address: string; family: number }[],\n          family?: number,\n        ) => void,\n      ) => {\n        lookup(\n          hostname,\n          { all: true, verbatim: true },\n          (err: NodeJS.ErrnoException | null, addresses: any) => {\n            if (err) return callback(err);\n            const list: { address: string; family: number }[] = Array.isArray(\n              addresses,\n            )\n              ? addresses\n              : [{ address: addresses, family: 4 }];\n            for (const record of list) {\n              const allowedOrigin = allowedPrivateOriginKeys.has(\n                `${normalizeLookupHostname(hostname)}:${String(options?.port ?? \"\")}`,\n              );\n              if (isPrivateHost(record.address) && !allowedOrigin) {\n                const e = new Error(\n                  `Connect blocked: ${hostname} resolved to private address ${record.address}`,\n                ) as NodeJS.ErrnoException;\n                e.code = \"EAI_BLOCKED\";\n                return callback(e);\n              }\n            }\n            // Mirror Node's lookup behavior: when `all` is true, return the\n            // array; otherwise the first entry. undici's connect honors\n            // `options.all`.\n            if (options && options.all) {\n              return callback(null, list as any);\n            }\n            const first = list[0];\n            return callback(null, first.address, first.family);\n          },\n        );\n      },\n    },\n  });\n}\n\n/**\n * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.\n *\n * Applies the same protections the extension proxy uses, so every call site\n * that fetches an untrusted URL gets them without re-implementing the loop:\n *   1. Pre-flight DNS-aware private-address check (isBlockedExtensionUrlWithDns)\n *      on the initial URL and on every redirect hop.\n *   2. A connect-time dispatcher that re-checks the resolved IP at TCP-connect\n *      time (closes the DNS-rebinding TOCTOU) when undici is available.\n *   3. Manual redirect handling — a public URL cannot 30x-redirect into the\n *      private network because each hop is re-validated before it is followed.\n *\n * Throws an Error whose message starts with \"SSRF blocked:\" when a target\n * (initial or via redirect) resolves to a private/internal address, or when the\n * redirect limit is exceeded. Otherwise returns the final Response.\n *\n * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are\n * followed only to `https:` targets, so an HTTPS-only caller cannot be\n * downgraded to plain HTTP by a 30x from the (untrusted) origin.\n *\n * `assertUrlAllowed` lets callers layer a stricter destination policy (for\n * example, a credential's origin allowlist) on top of the SSRF checks. It runs\n * before the initial request and before every redirect hop, so sensitive\n * headers and bodies are never forwarded to a destination the caller rejects.\n */\nexport async function ssrfSafeFetch(\n  url: string,\n  init: RequestInit = {},\n  options: {\n    maxRedirects?: number;\n    httpsOnly?: boolean;\n    assertUrlAllowed?: (url: string) => void | Promise<void>;\n    /**\n     * Exact origins that may resolve to a private address. A workspace runs\n     * every app on loopback behind one gateway, so sibling A2A calls are\n     * private by construction; without this they are indistinguishable from an\n     * SSRF attempt and get blocked. Only ever pass origins the deployment\n     * itself configured (never a request-supplied value).\n     */\n    allowedPrivateOrigins?: readonly string[];\n  } = {},\n): Promise<Response> {\n  const maxRedirects = options.maxRedirects ?? 3;\n  const dispatcher =\n    (await createSsrfSafeDispatcher(options.allowedPrivateOrigins)) ??\n    undefined;\n  const allowedPrivateOrigins = normalizeAllowedPrivateOriginOriginKeys(\n    options.allowedPrivateOrigins ?? [],\n  );\n  const isAllowedPrivateOrigin = (candidate: string): boolean => {\n    if (allowedPrivateOrigins.size === 0) return false;\n    try {\n      const parsed = new URL(candidate);\n      const port = parsed.port || (parsed.protocol === \"https:\" ? \"443\" : \"80\");\n      return allowedPrivateOrigins.has(\n        `${parsed.protocol}//${normalizeLookupHostname(parsed.hostname)}:${port}`,\n      );\n    } catch {\n      return false;\n    }\n  };\n\n  let currentUrl = url;\n  for (let hop = 0; hop <= maxRedirects; hop++) {\n    await options.assertUrlAllowed?.(currentUrl);\n    if (options.httpsOnly && new URL(currentUrl).protocol !== \"https:\") {\n      throw new Error(\n        `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,\n      );\n    }\n    if (\n      !isAllowedPrivateOrigin(currentUrl) &&\n      (await isBlockedExtensionUrlWithDns(currentUrl))\n    ) {\n      throw new Error(\n        `SSRF blocked: refusing to fetch private/internal address (${currentUrl})`,\n      );\n    }\n    const fetchOpts: RequestInit & { dispatcher?: unknown } = {\n      ...init,\n      redirect: \"manual\",\n    };\n    if (dispatcher) fetchOpts.dispatcher = dispatcher;\n\n    const response = await fetch(currentUrl, fetchOpts);\n    if (response.status >= 300 && response.status < 400) {\n      const location = response.headers.get(\"location\");\n      if (!location) return response;\n      // Drain the redirect body so the hop's connection is released instead\n      // of being held until GC.\n      await response.body?.cancel().catch(() => {});\n      currentUrl = new URL(location, currentUrl).href;\n      continue;\n    }\n    return response;\n  }\n  throw new Error(\n    `SSRF blocked: too many redirects (>${maxRedirects}) while fetching ${url}`,\n  );\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Legacy aliases — predate the Tools → Extensions rename. Templates import\n// these via the legacy `@agent-native/core/tools/url-safety` subpath; keep\n// the names exported so they keep resolving until every consumer updates.\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport { isBlockedExtensionUrl as isBlockedToolUrl };\nexport { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };\nexport { ssrfSafeFetch as ssrfSafeToolFetch };\n"]}

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,12 +17,12 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
+    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
 }>;
 export default _default;
 //# sourceMappingURL=upload-image.d.ts.map

package/dist/integrations/adapters/slack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/slack.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EAUhB,MAAM,aAAa,CAAC;AAsErB,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7E,kEAAkE;IAClE,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,OAAO,GAAE,mBAAwB,GAChC,eAAe,CAwnBjB;AAkBD,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B"}
+{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/slack.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EAUhB,MAAM,aAAa,CAAC;AAsErB,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7E,kEAAkE;IAClE,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxE;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,OAAO,GAAE,mBAAwB,GAChC,eAAe,CA6nBjB;AAkBD,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B"}

package/dist/integrations/adapters/slack.js

@@ -5,7 +5,7 @@ import { getRequestContext } from "../../server/request-context.js";
 import { getIntegrationRequestContext } from "../../server/request-context.js";
 import { consumeIntegrationAwaitingInput } from "../awaiting-input-store.js";
 import { createIntegrationControl } from "../controls-store.js";
-import { getActiveIntegrationInstallationByKey, getActiveIntegrationInstallationForTenant, listIntegrationInstallations, resolveIntegrationTokenBundle, } from "../installations-store.js";
+import { getActiveIntegrationInstallationByKey, listActiveIntegrationInstallationsForTenant, listIntegrationInstallations, resolveIntegrationTokenBundle, } from "../installations-store.js";
 import { hasActivePendingTask } from "../pending-tasks-store.js";
 import { slackInstallationKey } from "../slack-oauth.js";
 /** Slack's max message length */
@@ -510,13 +510,16 @@ export function slackAdapter(options = {}) {
                     channelId: target.destination,
                     threadTs: target.threadRef,
                     teamId: target.tenantId,
+                    installationKey: target.installationKey,
                 },
                 tenantId: target.tenantId,
                 timestamp: Date.now(),
             };
             const token = await resolveBotToken(targetContext);
             if (!token) {
-                console.error("[slack] SLACK_BOT_TOKEN not configured");
+                console.error("[slack] no bot token for outbound target" +
+                    (target.tenantId ? ` (tenant ${target.tenantId})` : "") +
+                    "; set SLACK_BOT_TOKEN or pass installationKey to name the app");
                 return;
             }
             const chunks = splitNonEmptyMessage(message.text, SLACK_MAX_LENGTH);
@@ -631,17 +634,31 @@ async function resolveManagedSlackBotToken(incoming) {
     const enterpriseId = typeof incoming.platformContext.enterpriseId === "string"
         ? incoming.platformContext.enterpriseId
         : undefined;
+    const installationKeyHint = typeof incoming.platformContext.installationKey === "string"
+        ? incoming.platformContext.installationKey
+        : undefined;
     if (!teamId && !enterpriseId)
         return undefined;
     try {
-        let installation = apiAppId
-            ? await getActiveIntegrationInstallationByKey("slack", slackInstallationKey({ teamId, enterpriseId, apiAppId }))
+        let installation = installationKeyHint
+            ? await getActiveIntegrationInstallationByKey("slack", installationKeyHint)
             : null;
-        if (!installation && !apiAppId && teamId) {
-            installation = await getActiveIntegrationInstallationForTenant("slack", teamId);
+        if (!installation && apiAppId) {
+            installation = await getActiveIntegrationInstallationByKey("slack", slackInstallationKey({ teamId, enterpriseId, apiAppId }));
         }
-        if (!installation && !apiAppId && enterpriseId) {
-            installation = await getActiveIntegrationInstallationForTenant("slack", enterpriseId);
+        if (!installation && !apiAppId) {
+            // Without an app id the tenant can match several connected Slack apps.
+            // Sending as an arbitrary one posts under the wrong bot identity, so
+            // only proceed when the tenant resolves to exactly one installation.
+            const tenant = teamId ?? enterpriseId;
+            const candidates = await listActiveIntegrationInstallationsForTenant("slack", tenant);
+            if (candidates.length > 1) {
+                console.error(`[slack] ${candidates.length} connected Slack apps for tenant ${tenant}; ` +
+                    `cannot choose one without an app id. Pass installationKey on the outbound target. ` +
+                    `Candidates: ${candidates.map((c) => c.installationKey).join(", ")}`);
+                return undefined;
+            }
+            installation = candidates[0] ?? null;
         }
         const key = installation?.installationKey ??
             slackInstallationKey({ teamId, enterpriseId, apiAppId });