@agent-native/core 0.30.6 → 0.31.0

package/dist/a2a/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EACL,kBAAkB,EAElB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAC7B,SAAS,iBAAiB;IACxB,IAAI,gBAAgB;QAAE,OAAO;IAC7B,gBAAgB,GAAG,IAAI,CAAC;IACxB,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,mFAAmF;QACjF,4FAA4F,CAC/F,CAAC;AACJ,CAAC;AAWD,SAAS,kBAAkB,CACzB,UAAoB,EACpB,MAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO;IACrD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAsB;IACjD,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC;QACtE,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAa,EACb,KAAsB;IAEtB,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,wBAAwB;IACxB,IAAI,aAAiC,CAAC;IACtC,IAAI,iBAA8C,CAAC;IACnD,IAAI,CAAC;QACH,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,aAAa,GAAG,iBAAiB,CAAC,UAAgC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC5D,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAE3E,iDAAiD;IACjD,EAAE;IACF,kEAAkE;IAClE,qEAAqE;IACrE,wBAAwB;IACxB,kEAAkE;IAClE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,qCAAqC;IACrC,IAAI,CAAC;QACH,MAAM,aAAa,GAA0B,EAAE,CAAC;QAChD,IAAI,iBAAiB,IAAI,OAAO,iBAAiB,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,GAAG;gBAAE,aAAa,CAAC,QAAQ,GAAG,GAAG,CAAC;QACxC,CAAC;QACD,IACE,iBAAiB;YACjB,OAAO,iBAAiB,CAAC,GAAG,KAAK,QAAQ;YACzC,iBAAiB,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAChC,CAAC;YACD,aAAa,CAAC,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CACtC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,aAAa,CACd,CAAC;gBACF,OAAO;oBACL,KAAK,EAAG,OAAO,CAAC,GAAc,IAAI,IAAI;oBACtC,SAAS,EAAG,OAAO,CAAC,UAAqB,IAAI,IAAI;iBAClD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,iDAAiD;IACjD,EAAE;IACF,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,wDAAwD;IACxD,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,8BAA8B,EAC9B,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,QAAQ,GACZ,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC;YAC5C,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;QAExC,MAAM,cAAc,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAE3D,OAAO,iBAAiB,CACtB,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,EACrC,OAAO,EACP,GAAG,WAAW,MAAM,CACrB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,oBAAoB,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAgC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,8DAA8D;QAC9D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,sBAAsB,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;YACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,uFAAuF;aAC1F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,iBAAiB,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,MAAM,EACpB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,iEAAiE;QACjE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO;QAE5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,mBAAmB,GAAkB,IAAI,CAAC;QAC9C,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,wBAAwB,GAAG,KAAK,CAAC;QAErC,oEAAoE;QACpE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAExE,6EAA6E;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9D,mBAAmB,GAAG,YAAY,CAAC,KAAK,CAAC;YACzC,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC;YAC3C,wBAAwB,GAAG,CAAC,mBAAmB,CAAC;QAClD,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,mBAAmB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE;qBAC5D,CAAC;gBACJ,CAAC;gBACD,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;oBAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBACpD,CAAC;gBACJ,CAAC;gBACD,yBAAyB,GAAG,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,mBAAmB,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACvD,oEAAoE;YACpE,gEAAgE;YAChE,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,8BAA8B;qBACxC;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,IAAI,sBAAsB,EAAE,EAAE,CAAC;oBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,qHAAqH;yBACxH;qBACF,CAAC;gBACJ,CAAC;gBACD,iBAAiB,EAAE,CAAC;YACtB,CAAC;iBAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;gBACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,yBAAyB;qBACnC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,mBAAmB,EAAE,CAAC;YACxB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;QACzD,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,iBAAiB,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAiB;IAC3D,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5C,MAAM,EAAE,GACL,KAAwC,CAAC,EAAE;YAC3C,KAA2B,CAAC,IAAI;YACjC,EAAE,CAAC;QACL,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,CACL,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,IAAI;gBACjC,KAAK,CAAC,WAAW,CAAC,QAAQ,KAAK,IAAI;gBACnC,KAAK,CAAC,WAAW,CAAC,YAAY,KAAK,IAAI;gBACvC,KAAK,CAAC,WAAW,CAAC,eAAe,KAAK,IAAI,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import * as jose from \"jose\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport {\n  defineEventHandler,\n  setResponseHeader,\n  setResponseStatus,\n  getMethod,\n  getRequestHeader,\n} from \"h3\";\nimport type { A2AConfig } from \"./types.js\";\nimport { generateAgentCard } from \"./agent-card.js\";\nimport { handleJsonRpcH3, processA2ATaskFromQueue } from \"./handlers.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  extractBearerToken,\n  verifyInternalToken,\n} from \"../integrations/internal-token.js\";\nimport {\n  hasConfiguredA2ASecret,\n  isA2AProductionRuntime,\n} from \"./auth-policy.js\";\n\n/**\n * One-time warning when A2A is running unauthenticated in development. We\n * don't refuse the request (local templates need to work out of the box),\n * but we log a single noisy line so operators notice if they accidentally\n * deploy with no auth configured.\n */\nlet _warnedUnauthA2A = false;\nfunction warnA2AUnauthOnce(): void {\n  if (_warnedUnauthA2A) return;\n  _warnedUnauthA2A = true;\n  // eslint-disable-next-line no-console\n  console.warn(\n    \"[a2a] No A2A_SECRET or apiKeyEnv configured — A2A endpoint runs unauthenticated. \" +\n      \"This is allowed in development but blocked in production. Set A2A_SECRET before deploying.\",\n  );\n}\n\n/**\n * Verify an inbound A2A JWT signed with the shared A2A_SECRET.\n * Returns the caller's email (from `sub` claim) if valid, null otherwise.\n */\ninterface A2ATokenPayload {\n  email: string | null;\n  orgDomain: string | null;\n}\n\nfunction addSecretCandidate(\n  candidates: string[],\n  secret: string | undefined,\n): void {\n  const trimmed = secret?.trim();\n  if (!trimmed || candidates.includes(trimmed)) return;\n  candidates.push(trimmed);\n}\n\n/**\n * Resolve the audience (`aud`) value to expect in an inbound JWT. We use the\n * receiver's app URL — it's the natural identifier of \"who this token was\n * minted for\". Falls back to undefined when no app URL is configured, in\n * which case the audience check is skipped (backward-compat with tokens\n * minted before the audience claim shipped).\n */\nfunction expectedJwtAudience(event: any | undefined): string | undefined {\n  const fromEnv =\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    process.env.BETTER_AUTH_URL;\n  if (fromEnv) return String(fromEnv);\n  // Best-effort: derive from the inbound request host. This is forgeable\n  // (Host-header attack), but only useful as a hint when env-derived URL\n  // is unset; the rest of the JWT verification still uses the secret.\n  try {\n    const proto = getRequestHeader(event, \"x-forwarded-proto\") || \"https\";\n    const host = getRequestHeader(event, \"host\");\n    if (host) return `${proto}://${host}`;\n  } catch {}\n  return undefined;\n}\n\nasync function verifyA2AToken(\n  token: string,\n  event: any | undefined,\n): Promise<A2ATokenPayload> {\n  // Step 1: Peek at JWT claims WITHOUT verification to get org_domain.\n  // This is safe because we only use org_domain to look up the secret,\n  // then verify the full JWT with that secret. If someone forges a JWT\n  // with a fake org_domain, verification will fail because they don't\n  // have the real secret.\n  let orgDomainHint: string | undefined;\n  let unverifiedPayload: jose.JWTPayload | undefined;\n  try {\n    unverifiedPayload = jose.decodeJwt(token);\n    orgDomainHint = unverifiedPayload.org_domain as string | undefined;\n  } catch {\n    // Malformed token — fall through to global secret attempt\n  }\n\n  // Step 2: Build a small, ordered set of candidate secrets. Tokens minted by\n  // current callers prefer the shared A2A_SECRET; older callers may still use\n  // an org-level secret. Try both without logging or reflecting secret details.\n  const candidateSecrets: string[] = [];\n  addSecretCandidate(candidateSecrets, process.env.A2A_SECRET);\n  if (orgDomainHint) {\n    try {\n      const { getA2ASecretByDomain } = await import(\"../org/context.js\");\n      const orgSecret = await getA2ASecretByDomain(orgDomainHint);\n      addSecretCandidate(candidateSecrets, orgSecret);\n    } catch {\n      // DB not ready or column doesn't exist yet — fall through\n    }\n  }\n  if (candidateSecrets.length === 0) return { email: null, orgDomain: null };\n\n  // Step 3: Verify JWT with the candidate secrets.\n  //\n  // - `audience`: passed only when the token carries an `aud` claim\n  //   (backward-compat: tokens minted by older `signA2AToken` versions\n  //   don't include one).\n  // - `issuer`: enforced when the token carries an `iss` claim. The\n  //   sender's `signA2AToken` (`a2a/client.ts:42`) sets the issuer to its\n  //   own app URL, so a verified token must self-identify a non-empty\n  //   string issuer. We accept any string the token claims (we don't pin\n  //   a specific expected issuer because dispatchers may legitimately\n  //   mint tokens from many sender URLs — dev tunnels, multi-deploy\n  //   setups). The pin is \"issuer must match the value the token says\n  //   it was minted from\", which `jose.jwtVerify` validates exactly when\n  //   `issuer` is supplied as a string. Backward-compat: when the token\n  //   has no `iss`, we skip the check.\n  try {\n    const verifyOptions: jose.JWTVerifyOptions = {};\n    if (unverifiedPayload && typeof unverifiedPayload.aud !== \"undefined\") {\n      const aud = expectedJwtAudience(event);\n      if (aud) verifyOptions.audience = aud;\n    }\n    if (\n      unverifiedPayload &&\n      typeof unverifiedPayload.iss === \"string\" &&\n      unverifiedPayload.iss.length > 0\n    ) {\n      verifyOptions.issuer = unverifiedPayload.iss;\n    }\n    for (const secret of candidateSecrets) {\n      try {\n        const { payload } = await jose.jwtVerify(\n          token,\n          new TextEncoder().encode(secret),\n          verifyOptions,\n        );\n        return {\n          email: (payload.sub as string) ?? null,\n          orgDomain: (payload.org_domain as string) ?? null,\n        };\n      } catch {\n        // Try the next candidate without leaking which secret failed.\n      }\n    }\n  } catch {\n    // Keep malformed option construction indistinguishable from auth failure.\n  }\n  return { email: null, orgDomain: null };\n}\n\n/**\n * Mount A2A protocol endpoints on an H3/Nitro app.\n *\n * - GET /.well-known/agent-card.json — public agent card (no auth)\n * - POST /_agent-native/a2a — JSON-RPC endpoint (with optional auth)\n *\n * When A2A_SECRET is set, inbound Bearer tokens are verified as JWTs\n * and the caller's email is extracted from the `sub` claim. This provides\n * cryptographic identity verification for cross-app A2A calls.\n */\nexport function mountA2A(\n  nitroApp: any,\n  config: A2AConfig,\n  routePrefix = \"/_agent-native\",\n): void {\n  // Public agent card endpoint (no auth required).\n  //\n  // SECURITY: per-user / per-org MCP tools are filtered out of the public\n  // skills list. Their merged-key prefix (`mcp__user_<emailhash>_…` or\n  // `mcp__org_<orgid>_…`) discloses (a) which users have integrations\n  // attached, and (b) what those integrations are — fingerprinting the\n  // tenant. Template- and framework-defined skills stay; only the dynamic\n  // per-tenant MCP entries are dropped. See finding #7 in\n  // /tmp/security-audit/12-mcp-a2a-agent.md.\n  getH3App(nitroApp).use(\n    \"/.well-known/agent-card.json\",\n    defineEventHandler((event) => {\n      if (getMethod(event) !== \"GET\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n      const protocol =\n        getRequestHeader(event, \"x-forwarded-proto\") ||\n        (event.url?.protocol?.replace(\":\", \"\") ?? \"http\");\n      const host = getRequestHeader(event, \"host\") ?? \"localhost\";\n      const baseUrl = `${protocol}://${host}`;\n\n      const filteredSkills = filterPublicAgentCardSkills(config);\n\n      return generateAgentCard(\n        { ...config, skills: filteredSkills },\n        baseUrl,\n        `${routePrefix}/a2a`,\n      );\n    }),\n  );\n\n  // Async-mode processor route. MUST be mounted BEFORE the `/a2a` catch-all\n  // below, since h3's `.use()` matches by prefix and `/a2a` would otherwise\n  // swallow `/a2a/_process-task` and return a JSON-RPC \"Invalid token\" error\n  // (the JSON-RPC handler doesn't know about taskId-only bodies).\n  //\n  // When `message/send` is called with `async: true`, the JSON-RPC handler\n  // enqueues the task and self-fires a POST to this route on the same\n  // deployment so the actual handler runs in a fresh function execution (its\n  // own full timeout). Authenticated with an HMAC token bound to the task id\n  // (5-minute lifetime, signed with A2A_SECRET — same scheme as the\n  // integration webhook queue).\n  getH3App(nitroApp).use(\n    `${routePrefix}/a2a/_process-task`,\n    defineEventHandler(async (event) => {\n      if (getMethod(event) !== \"POST\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n\n      const body = (await readBody(event)) as { taskId?: unknown } | null;\n      const taskId = body && typeof body.taskId === \"string\" ? body.taskId : \"\";\n      if (!taskId) {\n        setResponseStatus(event, 400);\n        return { error: \"taskId required\" };\n      }\n\n      // When A2A_SECRET is set, require a valid HMAC token bound to this\n      // taskId. In production, we REQUIRE A2A_SECRET to be set so unsigned\n      // dispatches are never accepted (an attacker who fishes a taskId out\n      // of logs / a share link could otherwise force-replay it). In\n      // development, a missing secret is permitted so local templates work\n      // out of the box, but we log a one-time warning so operators notice.\n      if (hasConfiguredA2ASecret()) {\n        const auth = getRequestHeader(event, \"authorization\");\n        const tok = extractBearerToken(auth);\n        if (!verifyInternalToken(taskId, tok)) {\n          setResponseStatus(event, 401);\n          return { error: \"Invalid or expired processor token\" };\n        }\n      } else if (isA2AProductionRuntime()) {\n        setResponseStatus(event, 503);\n        return {\n          error:\n            \"A2A processor not configured — set A2A_SECRET on this deployment to enable async A2A.\",\n        };\n      } else {\n        warnA2AUnauthOnce();\n      }\n\n      try {\n        await processA2ATaskFromQueue(taskId, config, event);\n        return { ok: true };\n      } catch (err: any) {\n        console.error(\"[a2a] process-task failed:\", err);\n        setResponseStatus(event, 500);\n        return { error: err?.message ?? \"process-task failed\" };\n      }\n    }),\n  );\n\n  // JSON-RPC A2A endpoint (with optional auth)\n  getH3App(nitroApp).use(\n    `${routePrefix}/a2a`,\n    defineEventHandler(async (event) => {\n      if (getMethod(event) !== \"POST\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n\n      // h3 prefix-matches mounts, so a request to `/a2a/_process-task`\n      // reaches this handler too. The dedicated mount above runs first and\n      // takes the request, but if that returns `undefined` (or h3 ever\n      // changes ordering semantics) defensively bail here. event.path is\n      // stripped to the remainder after the mount prefix.\n      const sub = (event.path || \"/\").split(\"?\")[0].replace(/^\\//, \"\");\n      if (sub.startsWith(\"_process-task\")) return;\n\n      const authHeader = getRequestHeader(event, \"authorization\");\n      const bearerToken = extractBearerToken(authHeader);\n      let verifiedCallerEmail: string | null = null;\n      let verifiedOrgDomain: string | null = null;\n      let legacyApiKeyAuthenticated = false;\n      let bearerTokenRejectedByJwt = false;\n\n      // SECURITY: when neither A2A_SECRET nor an apiKeyEnv is configured,\n      // there's no way to authenticate the caller. Default to \"auth required\"\n      // in production — return 503 with a clear message instead of running\n      // the agent loop unauthenticated. In development, log a one-time\n      // warning but allow so local templates work out of the box.\n      const hasA2ASecret = hasConfiguredA2ASecret();\n      const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);\n\n      // Try JWT verification first (org-level or global A2A_SECRET-based identity)\n      if (bearerToken) {\n        const tokenPayload = await verifyA2AToken(bearerToken, event);\n        verifiedCallerEmail = tokenPayload.email;\n        verifiedOrgDomain = tokenPayload.orgDomain;\n        bearerTokenRejectedByJwt = !verifiedCallerEmail;\n      }\n\n      // Fall back to legacy API key check (exact string match)\n      if (!verifiedCallerEmail && config.apiKeyEnv) {\n        const expectedKey = process.env[config.apiKeyEnv];\n        if (expectedKey) {\n          if (!bearerToken) {\n            setResponseStatus(event, 401);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: { code: -32001, message: \"Authentication required\" },\n            };\n          }\n          if (bearerToken !== expectedKey) {\n            setResponseStatus(event, 401);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: { code: -32001, message: \"Invalid API key\" },\n            };\n          }\n          legacyApiKeyAuthenticated = true;\n        }\n      }\n\n      if (!verifiedCallerEmail && !legacyApiKeyAuthenticated) {\n        // Any supplied bearer token that failed JWT verification is an auth\n        // failure after the legacy exact-match apiKeyEnv path has had a\n        // chance to succeed. Do not let bad tokens fall through to tasks/get\n        // and get reported as lookup misses.\n        if (bearerTokenRejectedByJwt) {\n          setResponseStatus(event, 401);\n          return {\n            jsonrpc: \"2.0\",\n            id: null,\n            error: {\n              code: -32001,\n              message: \"Invalid or expired A2A token\",\n            },\n          };\n        }\n\n        if (!hasA2ASecret && !hasApiKey) {\n          if (isA2AProductionRuntime()) {\n            setResponseStatus(event, 503);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: {\n                code: -32001,\n                message:\n                  \"A2A authentication not configured. Set A2A_SECRET (preferred) or configure apiKeyEnv to accept inbound A2A traffic.\",\n              },\n            };\n          }\n          warnA2AUnauthOnce();\n        } else if (isA2AProductionRuntime()) {\n          setResponseStatus(event, 401);\n          return {\n            jsonrpc: \"2.0\",\n            id: null,\n            error: {\n              code: -32001,\n              message: \"Authentication required\",\n            },\n          };\n        }\n      }\n\n      // Store verified caller identity on the event context so the handler\n      // can set request context from a trusted source instead of metadata\n      if (verifiedCallerEmail) {\n        event.context.__a2aVerifiedEmail = verifiedCallerEmail;\n      }\n      if (verifiedOrgDomain) {\n        event.context.__a2aOrgDomain = verifiedOrgDomain;\n      }\n\n      const body = await readBody(event);\n      return handleJsonRpcH3(body, event, config);\n    }),\n  );\n}\n\nexport function filterPublicAgentCardSkills(config: A2AConfig) {\n  return (config.skills ?? []).filter((skill) => {\n    const id =\n      (skill as { id?: string; name?: string }).id ??\n      (skill as { name?: string }).name ??\n      \"\";\n    if (typeof id === \"string\") {\n      if (id.startsWith(\"mcp__user_\") || id.startsWith(\"mcp__org_\")) {\n        return false;\n      }\n    }\n\n    if (skill.public === false || skill.requiresAuth || skill.isConsequential) {\n      return false;\n    }\n\n    if (!config.publicSkillsOnly) return true;\n\n    if (skill.publicAgent) {\n      return (\n        skill.publicAgent.expose === true &&\n        skill.publicAgent.readOnly === true &&\n        skill.publicAgent.requiresAuth !== true &&\n        skill.publicAgent.isConsequential !== true\n      );\n    }\n\n    return skill.public === true && skill.readOnly !== false;\n  });\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAC7B,SAAS,iBAAiB;IACxB,IAAI,gBAAgB;QAAE,OAAO;IAC7B,gBAAgB,GAAG,IAAI,CAAC;IACxB,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,mFAAmF;QACjF,4FAA4F,CAC/F,CAAC;AACJ,CAAC;AAWD,SAAS,kBAAkB,CACzB,UAAoB,EACpB,MAA0B;IAE1B,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO;IACrD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAsB;IACjD,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC;QACtE,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAa,EACb,KAAsB;IAEtB,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,wBAAwB;IACxB,IAAI,aAAiC,CAAC;IACtC,IAAI,iBAA8C,CAAC;IACnD,IAAI,CAAC;QACH,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,aAAa,GAAG,iBAAiB,CAAC,UAAgC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,kBAAkB,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC5D,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAE3E,iDAAiD;IACjD,EAAE;IACF,kEAAkE;IAClE,qEAAqE;IACrE,wBAAwB;IACxB,kEAAkE;IAClE,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAClE,oEAAoE;IACpE,uEAAuE;IACvE,sEAAsE;IACtE,qCAAqC;IACrC,IAAI,CAAC;QACH,MAAM,aAAa,GAA0B,EAAE,CAAC;QAChD,IAAI,iBAAiB,IAAI,OAAO,iBAAiB,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,GAAG;gBAAE,aAAa,CAAC,QAAQ,GAAG,GAAG,CAAC;QACxC,CAAC;QACD,IACE,iBAAiB;YACjB,OAAO,iBAAiB,CAAC,GAAG,KAAK,QAAQ;YACzC,iBAAiB,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAChC,CAAC;YACD,aAAa,CAAC,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CACtC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,aAAa,CACd,CAAC;gBACF,OAAO;oBACL,KAAK,EAAG,OAAO,CAAC,GAAc,IAAI,IAAI;oBACtC,SAAS,EAAG,OAAO,CAAC,UAAqB,IAAI,IAAI;iBAClD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,iDAAiD;IACjD,EAAE;IACF,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,wDAAwD;IACxD,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,8BAA8B,EAC9B,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,QAAQ,GACZ,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC;YAC5C,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;QAExC,MAAM,cAAc,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAE3D,OAAO,iBAAiB,CACtB,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,EACrC,OAAO,EACP,GAAG,WAAW,MAAM,CACrB,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,oBAAoB,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAgC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,8DAA8D;QAC9D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,sBAAsB,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;YACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,uFAAuF;aAC1F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,iBAAiB,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,MAAM,EACpB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,iEAAiE;QACjE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO;QAE5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,mBAAmB,GAAkB,IAAI,CAAC;QAC9C,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAC5C,IAAI,yBAAyB,GAAG,KAAK,CAAC;QACtC,IAAI,wBAAwB,GAAG,KAAK,CAAC;QAErC,oEAAoE;QACpE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,sBAAsB,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAExE,6EAA6E;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9D,mBAAmB,GAAG,YAAY,CAAC,KAAK,CAAC;YACzC,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC;YAC3C,wBAAwB,GAAG,CAAC,mBAAmB,CAAC;QAClD,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,mBAAmB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE;qBAC5D,CAAC;gBACJ,CAAC;gBACD,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;oBAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBACpD,CAAC;gBACJ,CAAC;gBACD,yBAAyB,GAAG,IAAI,CAAC;YACnC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,mBAAmB,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACvD,oEAAoE;YACpE,gEAAgE;YAChE,qEAAqE;YACrE,qCAAqC;YACrC,IAAI,wBAAwB,EAAE,CAAC;gBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,8BAA8B;qBACxC;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChC,IAAI,sBAAsB,EAAE,EAAE,CAAC;oBAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE;4BACL,IAAI,EAAE,CAAC,KAAK;4BACZ,OAAO,EACL,qHAAqH;yBACxH;qBACF,CAAC;gBACJ,CAAC;gBACD,iBAAiB,EAAE,CAAC;YACtB,CAAC;iBAAM,IAAI,sBAAsB,EAAE,EAAE,CAAC;gBACpC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,yBAAyB;qBACnC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,mBAAmB,EAAE,CAAC;YACxB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;QACzD,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,iBAAiB,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAiB;IAC3D,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC5C,MAAM,EAAE,GACL,KAAwC,CAAC,EAAE;YAC3C,KAA2B,CAAC,IAAI;YACjC,EAAE,CAAC;QACL,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9D,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAE1C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,CACL,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,IAAI;gBACjC,KAAK,CAAC,WAAW,CAAC,QAAQ,KAAK,IAAI;gBACnC,KAAK,CAAC,WAAW,CAAC,YAAY,KAAK,IAAI;gBACvC,KAAK,CAAC,WAAW,CAAC,eAAe,KAAK,IAAI,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import * as jose from \"jose\";\nimport { getH3App } from \"../server/framework-request-handler.js\";\nimport {\n  defineEventHandler,\n  setResponseStatus,\n  getMethod,\n  getRequestHeader,\n} from \"h3\";\nimport type { A2AConfig } from \"./types.js\";\nimport { generateAgentCard } from \"./agent-card.js\";\nimport { handleJsonRpcH3, processA2ATaskFromQueue } from \"./handlers.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  extractBearerToken,\n  verifyInternalToken,\n} from \"../integrations/internal-token.js\";\nimport {\n  hasConfiguredA2ASecret,\n  isA2AProductionRuntime,\n} from \"./auth-policy.js\";\n\n/**\n * One-time warning when A2A is running unauthenticated in development. We\n * don't refuse the request (local templates need to work out of the box),\n * but we log a single noisy line so operators notice if they accidentally\n * deploy with no auth configured.\n */\nlet _warnedUnauthA2A = false;\nfunction warnA2AUnauthOnce(): void {\n  if (_warnedUnauthA2A) return;\n  _warnedUnauthA2A = true;\n  // eslint-disable-next-line no-console\n  console.warn(\n    \"[a2a] No A2A_SECRET or apiKeyEnv configured — A2A endpoint runs unauthenticated. \" +\n      \"This is allowed in development but blocked in production. Set A2A_SECRET before deploying.\",\n  );\n}\n\n/**\n * Verify an inbound A2A JWT signed with the shared A2A_SECRET.\n * Returns the caller's email (from `sub` claim) if valid, null otherwise.\n */\ninterface A2ATokenPayload {\n  email: string | null;\n  orgDomain: string | null;\n}\n\nfunction addSecretCandidate(\n  candidates: string[],\n  secret: string | undefined,\n): void {\n  const trimmed = secret?.trim();\n  if (!trimmed || candidates.includes(trimmed)) return;\n  candidates.push(trimmed);\n}\n\n/**\n * Resolve the audience (`aud`) value to expect in an inbound JWT. We use the\n * receiver's app URL — it's the natural identifier of \"who this token was\n * minted for\". Falls back to undefined when no app URL is configured, in\n * which case the audience check is skipped (backward-compat with tokens\n * minted before the audience claim shipped).\n */\nfunction expectedJwtAudience(event: any | undefined): string | undefined {\n  const fromEnv =\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    process.env.BETTER_AUTH_URL;\n  if (fromEnv) return String(fromEnv);\n  // Best-effort: derive from the inbound request host. This is forgeable\n  // (Host-header attack), but only useful as a hint when env-derived URL\n  // is unset; the rest of the JWT verification still uses the secret.\n  try {\n    const proto = getRequestHeader(event, \"x-forwarded-proto\") || \"https\";\n    const host = getRequestHeader(event, \"host\");\n    if (host) return `${proto}://${host}`;\n  } catch {}\n  return undefined;\n}\n\nasync function verifyA2AToken(\n  token: string,\n  event: any | undefined,\n): Promise<A2ATokenPayload> {\n  // Step 1: Peek at JWT claims WITHOUT verification to get org_domain.\n  // This is safe because we only use org_domain to look up the secret,\n  // then verify the full JWT with that secret. If someone forges a JWT\n  // with a fake org_domain, verification will fail because they don't\n  // have the real secret.\n  let orgDomainHint: string | undefined;\n  let unverifiedPayload: jose.JWTPayload | undefined;\n  try {\n    unverifiedPayload = jose.decodeJwt(token);\n    orgDomainHint = unverifiedPayload.org_domain as string | undefined;\n  } catch {\n    // Malformed token — fall through to global secret attempt\n  }\n\n  // Step 2: Build a small, ordered set of candidate secrets. Tokens minted by\n  // current callers prefer the shared A2A_SECRET; older callers may still use\n  // an org-level secret. Try both without logging or reflecting secret details.\n  const candidateSecrets: string[] = [];\n  addSecretCandidate(candidateSecrets, process.env.A2A_SECRET);\n  if (orgDomainHint) {\n    try {\n      const { getA2ASecretByDomain } = await import(\"../org/context.js\");\n      const orgSecret = await getA2ASecretByDomain(orgDomainHint);\n      addSecretCandidate(candidateSecrets, orgSecret);\n    } catch {\n      // DB not ready or column doesn't exist yet — fall through\n    }\n  }\n  if (candidateSecrets.length === 0) return { email: null, orgDomain: null };\n\n  // Step 3: Verify JWT with the candidate secrets.\n  //\n  // - `audience`: passed only when the token carries an `aud` claim\n  //   (backward-compat: tokens minted by older `signA2AToken` versions\n  //   don't include one).\n  // - `issuer`: enforced when the token carries an `iss` claim. The\n  //   sender's `signA2AToken` (`a2a/client.ts:42`) sets the issuer to its\n  //   own app URL, so a verified token must self-identify a non-empty\n  //   string issuer. We accept any string the token claims (we don't pin\n  //   a specific expected issuer because dispatchers may legitimately\n  //   mint tokens from many sender URLs — dev tunnels, multi-deploy\n  //   setups). The pin is \"issuer must match the value the token says\n  //   it was minted from\", which `jose.jwtVerify` validates exactly when\n  //   `issuer` is supplied as a string. Backward-compat: when the token\n  //   has no `iss`, we skip the check.\n  try {\n    const verifyOptions: jose.JWTVerifyOptions = {};\n    if (unverifiedPayload && typeof unverifiedPayload.aud !== \"undefined\") {\n      const aud = expectedJwtAudience(event);\n      if (aud) verifyOptions.audience = aud;\n    }\n    if (\n      unverifiedPayload &&\n      typeof unverifiedPayload.iss === \"string\" &&\n      unverifiedPayload.iss.length > 0\n    ) {\n      verifyOptions.issuer = unverifiedPayload.iss;\n    }\n    for (const secret of candidateSecrets) {\n      try {\n        const { payload } = await jose.jwtVerify(\n          token,\n          new TextEncoder().encode(secret),\n          verifyOptions,\n        );\n        return {\n          email: (payload.sub as string) ?? null,\n          orgDomain: (payload.org_domain as string) ?? null,\n        };\n      } catch {\n        // Try the next candidate without leaking which secret failed.\n      }\n    }\n  } catch {\n    // Keep malformed option construction indistinguishable from auth failure.\n  }\n  return { email: null, orgDomain: null };\n}\n\n/**\n * Mount A2A protocol endpoints on an H3/Nitro app.\n *\n * - GET /.well-known/agent-card.json — public agent card (no auth)\n * - POST /_agent-native/a2a — JSON-RPC endpoint (with optional auth)\n *\n * When A2A_SECRET is set, inbound Bearer tokens are verified as JWTs\n * and the caller's email is extracted from the `sub` claim. This provides\n * cryptographic identity verification for cross-app A2A calls.\n */\nexport function mountA2A(\n  nitroApp: any,\n  config: A2AConfig,\n  routePrefix = \"/_agent-native\",\n): void {\n  // Public agent card endpoint (no auth required).\n  //\n  // SECURITY: per-user / per-org MCP tools are filtered out of the public\n  // skills list. Their merged-key prefix (`mcp__user_<emailhash>_…` or\n  // `mcp__org_<orgid>_…`) discloses (a) which users have integrations\n  // attached, and (b) what those integrations are — fingerprinting the\n  // tenant. Template- and framework-defined skills stay; only the dynamic\n  // per-tenant MCP entries are dropped. See finding #7 in\n  // /tmp/security-audit/12-mcp-a2a-agent.md.\n  getH3App(nitroApp).use(\n    \"/.well-known/agent-card.json\",\n    defineEventHandler((event) => {\n      if (getMethod(event) !== \"GET\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n      const protocol =\n        getRequestHeader(event, \"x-forwarded-proto\") ||\n        (event.url?.protocol?.replace(\":\", \"\") ?? \"http\");\n      const host = getRequestHeader(event, \"host\") ?? \"localhost\";\n      const baseUrl = `${protocol}://${host}`;\n\n      const filteredSkills = filterPublicAgentCardSkills(config);\n\n      return generateAgentCard(\n        { ...config, skills: filteredSkills },\n        baseUrl,\n        `${routePrefix}/a2a`,\n      );\n    }),\n  );\n\n  // Async-mode processor route. MUST be mounted BEFORE the `/a2a` catch-all\n  // below, since h3's `.use()` matches by prefix and `/a2a` would otherwise\n  // swallow `/a2a/_process-task` and return a JSON-RPC \"Invalid token\" error\n  // (the JSON-RPC handler doesn't know about taskId-only bodies).\n  //\n  // When `message/send` is called with `async: true`, the JSON-RPC handler\n  // enqueues the task and self-fires a POST to this route on the same\n  // deployment so the actual handler runs in a fresh function execution (its\n  // own full timeout). Authenticated with an HMAC token bound to the task id\n  // (5-minute lifetime, signed with A2A_SECRET — same scheme as the\n  // integration webhook queue).\n  getH3App(nitroApp).use(\n    `${routePrefix}/a2a/_process-task`,\n    defineEventHandler(async (event) => {\n      if (getMethod(event) !== \"POST\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n\n      const body = (await readBody(event)) as { taskId?: unknown } | null;\n      const taskId = body && typeof body.taskId === \"string\" ? body.taskId : \"\";\n      if (!taskId) {\n        setResponseStatus(event, 400);\n        return { error: \"taskId required\" };\n      }\n\n      // When A2A_SECRET is set, require a valid HMAC token bound to this\n      // taskId. In production, we REQUIRE A2A_SECRET to be set so unsigned\n      // dispatches are never accepted (an attacker who fishes a taskId out\n      // of logs / a share link could otherwise force-replay it). In\n      // development, a missing secret is permitted so local templates work\n      // out of the box, but we log a one-time warning so operators notice.\n      if (hasConfiguredA2ASecret()) {\n        const auth = getRequestHeader(event, \"authorization\");\n        const tok = extractBearerToken(auth);\n        if (!verifyInternalToken(taskId, tok)) {\n          setResponseStatus(event, 401);\n          return { error: \"Invalid or expired processor token\" };\n        }\n      } else if (isA2AProductionRuntime()) {\n        setResponseStatus(event, 503);\n        return {\n          error:\n            \"A2A processor not configured — set A2A_SECRET on this deployment to enable async A2A.\",\n        };\n      } else {\n        warnA2AUnauthOnce();\n      }\n\n      try {\n        await processA2ATaskFromQueue(taskId, config, event);\n        return { ok: true };\n      } catch (err: any) {\n        console.error(\"[a2a] process-task failed:\", err);\n        setResponseStatus(event, 500);\n        return { error: err?.message ?? \"process-task failed\" };\n      }\n    }),\n  );\n\n  // JSON-RPC A2A endpoint (with optional auth)\n  getH3App(nitroApp).use(\n    `${routePrefix}/a2a`,\n    defineEventHandler(async (event) => {\n      if (getMethod(event) !== \"POST\") {\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }\n\n      // h3 prefix-matches mounts, so a request to `/a2a/_process-task`\n      // reaches this handler too. The dedicated mount above runs first and\n      // takes the request, but if that returns `undefined` (or h3 ever\n      // changes ordering semantics) defensively bail here. event.path is\n      // stripped to the remainder after the mount prefix.\n      const sub = (event.path || \"/\").split(\"?\")[0].replace(/^\\//, \"\");\n      if (sub.startsWith(\"_process-task\")) return;\n\n      const authHeader = getRequestHeader(event, \"authorization\");\n      const bearerToken = extractBearerToken(authHeader);\n      let verifiedCallerEmail: string | null = null;\n      let verifiedOrgDomain: string | null = null;\n      let legacyApiKeyAuthenticated = false;\n      let bearerTokenRejectedByJwt = false;\n\n      // SECURITY: when neither A2A_SECRET nor an apiKeyEnv is configured,\n      // there's no way to authenticate the caller. Default to \"auth required\"\n      // in production — return 503 with a clear message instead of running\n      // the agent loop unauthenticated. In development, log a one-time\n      // warning but allow so local templates work out of the box.\n      const hasA2ASecret = hasConfiguredA2ASecret();\n      const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);\n\n      // Try JWT verification first (org-level or global A2A_SECRET-based identity)\n      if (bearerToken) {\n        const tokenPayload = await verifyA2AToken(bearerToken, event);\n        verifiedCallerEmail = tokenPayload.email;\n        verifiedOrgDomain = tokenPayload.orgDomain;\n        bearerTokenRejectedByJwt = !verifiedCallerEmail;\n      }\n\n      // Fall back to legacy API key check (exact string match)\n      if (!verifiedCallerEmail && config.apiKeyEnv) {\n        const expectedKey = process.env[config.apiKeyEnv];\n        if (expectedKey) {\n          if (!bearerToken) {\n            setResponseStatus(event, 401);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: { code: -32001, message: \"Authentication required\" },\n            };\n          }\n          if (bearerToken !== expectedKey) {\n            setResponseStatus(event, 401);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: { code: -32001, message: \"Invalid API key\" },\n            };\n          }\n          legacyApiKeyAuthenticated = true;\n        }\n      }\n\n      if (!verifiedCallerEmail && !legacyApiKeyAuthenticated) {\n        // Any supplied bearer token that failed JWT verification is an auth\n        // failure after the legacy exact-match apiKeyEnv path has had a\n        // chance to succeed. Do not let bad tokens fall through to tasks/get\n        // and get reported as lookup misses.\n        if (bearerTokenRejectedByJwt) {\n          setResponseStatus(event, 401);\n          return {\n            jsonrpc: \"2.0\",\n            id: null,\n            error: {\n              code: -32001,\n              message: \"Invalid or expired A2A token\",\n            },\n          };\n        }\n\n        if (!hasA2ASecret && !hasApiKey) {\n          if (isA2AProductionRuntime()) {\n            setResponseStatus(event, 503);\n            return {\n              jsonrpc: \"2.0\",\n              id: null,\n              error: {\n                code: -32001,\n                message:\n                  \"A2A authentication not configured. Set A2A_SECRET (preferred) or configure apiKeyEnv to accept inbound A2A traffic.\",\n              },\n            };\n          }\n          warnA2AUnauthOnce();\n        } else if (isA2AProductionRuntime()) {\n          setResponseStatus(event, 401);\n          return {\n            jsonrpc: \"2.0\",\n            id: null,\n            error: {\n              code: -32001,\n              message: \"Authentication required\",\n            },\n          };\n        }\n      }\n\n      // Store verified caller identity on the event context so the handler\n      // can set request context from a trusted source instead of metadata\n      if (verifiedCallerEmail) {\n        event.context.__a2aVerifiedEmail = verifiedCallerEmail;\n      }\n      if (verifiedOrgDomain) {\n        event.context.__a2aOrgDomain = verifiedOrgDomain;\n      }\n\n      const body = await readBody(event);\n      return handleJsonRpcH3(body, event, config);\n    }),\n  );\n}\n\nexport function filterPublicAgentCardSkills(config: A2AConfig) {\n  return (config.skills ?? []).filter((skill) => {\n    const id =\n      (skill as { id?: string; name?: string }).id ??\n      (skill as { name?: string }).name ??\n      \"\";\n    if (typeof id === \"string\") {\n      if (id.startsWith(\"mcp__user_\") || id.startsWith(\"mcp__org_\")) {\n        return false;\n      }\n    }\n\n    if (skill.public === false || skill.requiresAuth || skill.isConsequential) {\n      return false;\n    }\n\n    if (!config.publicSkillsOnly) return true;\n\n    if (skill.publicAgent) {\n      return (\n        skill.publicAgent.expose === true &&\n        skill.publicAgent.readOnly === true &&\n        skill.publicAgent.requiresAuth !== true &&\n        skill.publicAgent.isConsequential !== true\n      );\n    }\n\n    return skill.public === true && skill.readOnly !== false;\n  });\n}\n"]}

package/dist/a2a/task-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"task-store.js","sourceRoot":"","sources":["../../src/a2a/task-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAc,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAGjE,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;;;uBAUJ,OAAO,EAAE;uBACT,OAAO,EAAE;;OAEzB,CAAC,CAAC;YACH,oEAAoE;YACpE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,WAAW;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,mDAAmD,CACpD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,GAAQ;IAC3B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,SAAS,EAAG,GAAG,CAAC,UAAqB,IAAI,SAAS;QAClD,MAAM,EAAE;YACN,KAAK,EAAE,GAAG,CAAC,YAAyB;YACpC,OAAO,EAAE,GAAG,CAAC,cAAc;gBACzB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAwB,CAAC;gBAC1C,CAAC,CAAC,SAAS;YACb,SAAS,EAAE,GAAG,CAAC,gBAA0B;SAC1C;QACD,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAiB,CAAC;QAC1C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAmB,CAAC;QAC9C,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,UAAU,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAe;IAC1C,MAAM,YAAY,GAAG,MAMR,CAAC;IACd,OAAO,CACL,YAAY,EAAE,YAAY,IAAI,YAAY,EAAE,QAAQ,IAAI,YAAY,EAAE,KAAK,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAgB,EAChB,SAAkB,EAClB,QAAkC,EAClC,UAA0B;IAE1B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,IAAI,GAAS;QACjB,EAAE;QACF,SAAS;QACT,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE;QACzC,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,SAAS,EAAE,EAAE;QACb,QAAQ;KACT,CAAC;IAEF,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,iLAAiL;QACtL,IAAI,EAAE;YACJ,EAAE;YACF,SAAS,IAAI,IAAI;YACjB,WAAW;YACX,SAAS;YACT,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI;YACJ,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YAC1C,UAAU,IAAI,IAAI;YAClB,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,gDAAgD;QACrD,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAI,IAAI,CAAC,CAAC,CAAS,CAAC,WAAW,CAAC;IAChD,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;;yDAKgD;QACrD,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAU;IAMtD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,2EAA2E;QAChF,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAQ,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,WAAW,EAAE,GAAG,CAAC,YAAsB;QACvC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAAU;IACzD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;yDAGgD;QACrD,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;KAChB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAU;IACrD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;4CAGmC;QACxC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;KAChB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAU,EACV,gBAAwB;IAExB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;;;gCAMuB;QAC5B,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,gBAAgB,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,gBAAwB,EACxB,MAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAY;QACvB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACxC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;;;;gCAOuB;QAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,gBAAgB,CAAC;KACtE,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAU;IACtC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,MAIC;IAED,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,oBAAoB;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YAC9C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,0IAA0I;QAC/I,IAAI,EAAE;YACJ,IAAI,CAAC,MAAM,CAAC,KAAK;YACjB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YAChE,IAAI,CAAC,MAAM,CAAC,SAAS;YACrB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9B,GAAG;YACH,EAAE;SACH;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAU,EACV,OAAgB;IAEhB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;;;;uEAK8D;QACnE,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAkB;IAChD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,uEAAuE;YAC5E,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CACnC,kDAAkD,CACnD,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["import crypto from \"crypto\";\nimport { getDbExec, isPostgres, intType } from \"../db/client.js\";\nimport type { Task, Message, TaskState, Artifact } from \"./types.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS a2a_tasks (\n          id TEXT PRIMARY KEY,\n          context_id TEXT,\n          status_state TEXT NOT NULL DEFAULT 'submitted',\n          status_message TEXT,\n          status_timestamp TEXT NOT NULL,\n          history TEXT NOT NULL DEFAULT '[]',\n          artifacts TEXT NOT NULL DEFAULT '[]',\n          metadata TEXT,\n          created_at ${intType()} NOT NULL,\n          updated_at ${intType()} NOT NULL\n        )\n      `);\n      // Additive migration: owner_email column. Bound to the JWT-verified\n      // caller at task-creation time so handleGet / handleCancel can reject\n      // mismatched callers (the IDOR class fixed in PR #369). Existing rows\n      // have NULL owner_email and remain accessible to legacy callers via\n      // the legacy-token apiKeyEnv path; new rows are scoped from this point\n      // forward.\n      try {\n        await client.execute(\n          `ALTER TABLE a2a_tasks ADD COLUMN owner_email TEXT`,\n        );\n      } catch {\n        // Column already exists — expected on every restart after first run.\n      }\n    })();\n  }\n  return _initPromise;\n}\n\nfunction taskFromRow(row: any): Task & { ownerEmail?: string | null } {\n  return {\n    id: row.id as string,\n    contextId: (row.context_id as string) || undefined,\n    status: {\n      state: row.status_state as TaskState,\n      message: row.status_message\n        ? JSON.parse(row.status_message as string)\n        : undefined,\n      timestamp: row.status_timestamp as string,\n    },\n    history: JSON.parse(row.history as string),\n    artifacts: JSON.parse(row.artifacts as string),\n    metadata: row.metadata ? JSON.parse(row.metadata as string) : undefined,\n    ownerEmail: (row.owner_email as string | null) ?? null,\n  };\n}\n\nfunction getAffectedRowCount(result: unknown): number | undefined {\n  const resultRecord = result as\n    | {\n        rowsAffected?: number;\n        rowCount?: number;\n        count?: number;\n      }\n    | undefined;\n  return (\n    resultRecord?.rowsAffected ?? resultRecord?.rowCount ?? resultRecord?.count\n  );\n}\n\nexport async function createTask(\n  message: Message,\n  contextId?: string,\n  metadata?: Record<string, unknown>,\n  ownerEmail?: string | null,\n): Promise<Task> {\n  await ensureTable();\n  const client = getDbExec();\n  const id = crypto.randomUUID();\n  const now = Date.now();\n  const timestamp = new Date().toISOString();\n\n  const task: Task = {\n    id,\n    contextId,\n    status: { state: \"submitted\", timestamp },\n    history: [message],\n    artifacts: [],\n    metadata,\n  };\n\n  await client.execute({\n    sql: `INSERT INTO a2a_tasks (id, context_id, status_state, status_timestamp, history, artifacts, metadata, owner_email, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      contextId ?? null,\n      \"submitted\",\n      timestamp,\n      JSON.stringify([message]),\n      \"[]\",\n      metadata ? JSON.stringify(metadata) : null,\n      ownerEmail ?? null,\n      now,\n      now,\n    ],\n  });\n\n  return task;\n}\n\n/**\n * Fetch the verified owner email recorded against a task at creation time.\n * Returns null when the task has no owner (legacy rows or unauthenticated\n * deployments) or when the task is missing.\n *\n * Used by `handleGet` / `handleCancel` to reject IDOR access — the JWT-\n * verified caller's email must match `owner_email` to read or cancel.\n */\nexport async function getTaskOwner(id: string): Promise<string | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT owner_email FROM a2a_tasks WHERE id = ?`,\n    args: [id],\n  });\n  if (rows.length === 0) return null;\n  const ownerEmail = (rows[0] as any).owner_email;\n  return typeof ownerEmail === \"string\" && ownerEmail ? ownerEmail : null;\n}\n\n/**\n * Atomically claim a task for processing. Only succeeds when the task is in\n * state 'submitted' or 'working' — flipping it to 'processing' so concurrent\n * processors can't pick it up twice. Returns the task if claimed, null if it\n * was already claimed/completed/missing.\n *\n * Used by the cross-platform async processor (`_process-task` route) to avoid\n * duplicate handler runs when retries fire.\n */\nexport async function claimA2ATaskForProcessing(\n  id: string,\n): Promise<Task | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const timestamp = new Date().toISOString();\n\n  const result = await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET status_state = 'processing',\n                status_timestamp = ?,\n                updated_at = ?\n          WHERE id = ?\n            AND status_state IN ('submitted', 'working')`,\n    args: [timestamp, now, id],\n  });\n  const affected = getAffectedRowCount(result);\n  if (affected === 0) return null;\n\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM a2a_tasks WHERE id = ?`,\n    args: [id],\n  });\n  if (rows.length === 0) return null;\n  return taskFromRow(rows[0]);\n}\n\nexport async function getA2ATaskDispatchState(id: string): Promise<{\n  id: string;\n  statusState: string;\n  metadata: Record<string, unknown> | undefined;\n  updatedAt: number;\n} | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT id, status_state, metadata, updated_at FROM a2a_tasks WHERE id = ?`,\n    args: [id],\n  });\n  const row = rows[0] as any;\n  if (!row) return null;\n  return {\n    id: row.id as string,\n    statusState: row.status_state as string,\n    metadata: row.metadata ? JSON.parse(row.metadata as string) : undefined,\n    updatedAt: Number(row.updated_at ?? 0),\n  };\n}\n\nexport async function touchQueuedA2ATaskDispatch(id: string): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const result = await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET updated_at = ?\n          WHERE id = ?\n            AND status_state IN ('submitted', 'working')`,\n    args: [now, id],\n  });\n  const affected = getAffectedRowCount(result);\n  return affected !== 0;\n}\n\nexport async function touchProcessingA2ATask(id: string): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const result = await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET updated_at = ?\n          WHERE id = ?\n            AND status_state = 'processing'`,\n    args: [now, id],\n  });\n  const affected = getAffectedRowCount(result);\n  return affected !== 0;\n}\n\nexport async function resetStuckA2ATaskForRetry(\n  id: string,\n  processingCutoff: number,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const timestamp = new Date().toISOString();\n  const result = await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET status_state = 'working',\n                status_timestamp = ?,\n                updated_at = ?\n          WHERE id = ?\n            AND status_state = 'processing'\n            AND updated_at <= ?`,\n    args: [timestamp, now, id, processingCutoff],\n  });\n  const affected = getAffectedRowCount(result);\n  return affected !== 0;\n}\n\nexport async function failStuckA2ATask(\n  id: string,\n  processingCutoff: number,\n  reason: string,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const timestamp = new Date().toISOString();\n  const message: Message = {\n    role: \"agent\",\n    parts: [{ type: \"text\", text: reason }],\n  };\n  const result = await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET status_state = 'failed',\n                status_message = ?,\n                status_timestamp = ?,\n                updated_at = ?\n          WHERE id = ?\n            AND status_state = 'processing'\n            AND updated_at <= ?`,\n    args: [JSON.stringify(message), timestamp, now, id, processingCutoff],\n  });\n  const affected = getAffectedRowCount(result);\n  return affected !== 0;\n}\n\nexport async function getTask(id: string): Promise<Task | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM a2a_tasks WHERE id = ?`,\n    args: [id],\n  });\n  if (rows.length === 0) return null;\n  return taskFromRow(rows[0]);\n}\n\nexport async function updateTask(\n  id: string,\n  update: {\n    state?: TaskState;\n    message?: Message;\n    artifacts?: Artifact[];\n  },\n): Promise<Task | null> {\n  await ensureTable();\n  const client = getDbExec();\n\n  // Read current task\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM a2a_tasks WHERE id = ?`,\n    args: [id],\n  });\n  if (rows.length === 0) return null;\n\n  const task = taskFromRow(rows[0]);\n  const now = Date.now();\n\n  if (update.state) {\n    task.status = {\n      state: update.state,\n      message: update.message ?? task.status.message,\n      timestamp: new Date().toISOString(),\n    };\n  }\n\n  if (update.message && task.history) {\n    task.history.push(update.message);\n  }\n\n  if (update.artifacts) {\n    task.artifacts = [...(task.artifacts ?? []), ...update.artifacts];\n  }\n\n  await client.execute({\n    sql: `UPDATE a2a_tasks SET status_state = ?, status_message = ?, status_timestamp = ?, history = ?, artifacts = ?, updated_at = ? WHERE id = ?`,\n    args: [\n      task.status.state,\n      task.status.message ? JSON.stringify(task.status.message) : null,\n      task.status.timestamp,\n      JSON.stringify(task.history),\n      JSON.stringify(task.artifacts),\n      now,\n      id,\n    ],\n  });\n\n  return task;\n}\n\nexport async function updateTaskStatusMessage(\n  id: string,\n  message: Message,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const timestamp = new Date().toISOString();\n  await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET status_message = ?,\n                status_timestamp = ?,\n                updated_at = ?\n          WHERE id = ?\n            AND status_state IN ('submitted', 'working', 'processing')`,\n    args: [JSON.stringify(message), timestamp, now, id],\n  });\n}\n\nexport async function listTasks(contextId?: string): Promise<Task[]> {\n  await ensureTable();\n  const client = getDbExec();\n\n  if (contextId) {\n    const { rows } = await client.execute({\n      sql: `SELECT * FROM a2a_tasks WHERE context_id = ? ORDER BY created_at DESC`,\n      args: [contextId],\n    });\n    return rows.map(taskFromRow);\n  }\n\n  const { rows } = await client.execute(\n    `SELECT * FROM a2a_tasks ORDER BY created_at DESC`,\n  );\n  return rows.map(taskFromRow);\n}\n"]}
+{"version":3,"file":"task-store.js","sourceRoot":"","sources":["../../src/a2a/task-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAGrD,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;;;uBAUJ,OAAO,EAAE;uBACT,OAAO,EAAE;;OAEzB,CAAC,CAAC;YACH,oEAAoE;YACpE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,WAAW;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,mDAAmD,CACpD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,GAAQ;IAC3B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,SAAS,EAAG,GAAG,CAAC,UAAqB,IAAI,SAAS;QAClD,MAAM,EAAE;YACN,KAAK,EAAE,GAAG,CAAC,YAAyB;YACpC,OAAO,EAAE,GAAG,CAAC,cAAc;gBACzB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAwB,CAAC;gBAC1C,CAAC,CAAC,SAAS;YACb,SAAS,EAAE,GAAG,CAAC,gBAA0B;SAC1C;QACD,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAiB,CAAC;QAC1C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAmB,CAAC;QAC9C,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,UAAU,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;KACvD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAe;IAC1C,MAAM,YAAY,GAAG,MAMR,CAAC;IACd,OAAO,CACL,YAAY,EAAE,YAAY,IAAI,YAAY,EAAE,QAAQ,IAAI,YAAY,EAAE,KAAK,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAgB,EAChB,SAAkB,EAClB,QAAkC,EAClC,UAA0B;IAE1B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,IAAI,GAAS;QACjB,EAAE;QACF,SAAS;QACT,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE;QACzC,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,SAAS,EAAE,EAAE;QACb,QAAQ;KACT,CAAC;IAEF,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,iLAAiL;QACtL,IAAI,EAAE;YACJ,EAAE;YACF,SAAS,IAAI,IAAI;YACjB,WAAW;YACX,SAAS;YACT,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI;YACJ,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YAC1C,UAAU,IAAI,IAAI;YAClB,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,gDAAgD;QACrD,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAI,IAAI,CAAC,CAAC,CAAS,CAAC,WAAW,CAAC;IAChD,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;;yDAKgD;QACrD,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAU;IAMtD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,2EAA2E;QAChF,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAQ,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,WAAW,EAAE,GAAG,CAAC,YAAsB;QACvC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAAU;IACzD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;yDAGgD;QACrD,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;KAChB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAU;IACrD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;4CAGmC;QACxC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;KAChB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAU,EACV,gBAAwB;IAExB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;;;gCAMuB;QAC5B,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,gBAAgB,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,gBAAwB,EACxB,MAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAY;QACvB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;KACxC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;;;;gCAOuB;QAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,gBAAgB,CAAC;KACtE,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAU;IACtC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,MAIC;IAED,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,oBAAoB;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YAC9C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,0IAA0I;QAC/I,IAAI,EAAE;YACJ,IAAI,CAAC,MAAM,CAAC,KAAK;YACjB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YAChE,IAAI,CAAC,MAAM,CAAC,SAAS;YACrB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9B,GAAG;YACH,EAAE;SACH;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAU,EACV,OAAgB;IAEhB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;;;;uEAK8D;QACnE,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;KACpD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAkB;IAChD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,uEAAuE;YAC5E,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CACnC,kDAAkD,CACnD,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["import crypto from \"crypto\";\nimport { getDbExec, intType } from \"../db/client.js\";\nimport type { Task, Message, TaskState, Artifact } from \"./types.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS a2a_tasks (\n          id TEXT PRIMARY KEY,\n          context_id TEXT,\n          status_state TEXT NOT NULL DEFAULT 'submitted',\n          status_message TEXT,\n          status_timestamp TEXT NOT NULL,\n          history TEXT NOT NULL DEFAULT '[]',\n          artifacts TEXT NOT NULL DEFAULT '[]',\n          metadata TEXT,\n          created_at ${intType()} NOT NULL,\n          updated_at ${intType()} NOT NULL\n        )\n      `);\n      // Additive migration: owner_email column. Bound to the JWT-verified\n      // caller at task-creation time so handleGet / handleCancel can reject\n      // mismatched callers (the IDOR class fixed in PR #369). Existing rows\n      // have NULL owner_email and remain accessible to legacy callers via\n      // the legacy-token apiKeyEnv path; new rows are scoped from this point\n      // forward.\n      try {\n        await client.execute(\n          `ALTER TABLE a2a_tasks ADD COLUMN owner_email TEXT`,\n        );\n      } catch {\n        // Column already exists — expected on every restart after first run.\n      }\n    })();\n  }\n  return _initPromise;\n}\n\nfunction taskFromRow(row: any): Task & { ownerEmail?: string | null } {\n  return {\n    id: row.id as string,\n    contextId: (row.context_id as string) || undefined,\n    status: {\n      state: row.status_state as TaskState,\n      message: row.status_message\n        ? JSON.parse(row.status_message as string)\n        : undefined,\n      timestamp: row.status_timestamp as string,\n    },\n    history: JSON.parse(row.history as string),\n    artifacts: JSON.parse(row.artifacts as string),\n    metadata: row.metadata ? JSON.parse(row.metadata as string) : undefined,\n    ownerEmail: (row.owner_email as string | null) ?? null,\n  };\n}\n\nfunction getAffectedRowCount(result: unknown): number | undefined {\n  const resultRecord = result as\n    | {\n        rowsAffected?: number;\n        rowCount?: number;\n        count?: number;\n      }\n    | undefined;\n  return (\n    resultRecord?.rowsAffected ?? resultRecord?.rowCount ?? resultRecord?.count\n  );\n}\n\nexport async function createTask(\n  message: Message,\n  contextId?: string,\n  metadata?: Record<string, unknown>,\n  ownerEmail?: string | null,\n): Promise<Task> {\n  await ensureTable();\n  const client = getDbExec();\n  const id = crypto.randomUUID();\n  const now = Date.now();\n  const timestamp = new Date().toISOString();\n\n  const task: Task = {\n    id,\n    contextId,\n    status: { state: \"submitted\", timestamp },\n    history: [message],\n    artifacts: [],\n    metadata,\n  };\n\n  await client.execute({\n    sql: `INSERT INTO a2a_tasks (id, context_id, status_state, status_timestamp, history, artifacts, metadata, owner_email, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      contextId ?? null,\n      \"submitted\",\n      timestamp,\n      JSON.stringify([message]),\n      \"[]\",\n      metadata ? JSON.stringify(metadata) : null,\n      ownerEmail ?? null,\n      now,\n      now,\n    ],\n  });\n\n  return task;\n}\n\n/**\n * Fetch the verified owner email recorded against a task at creation time.\n * Returns null when the task has no owner (legacy rows or unauthenticated\n * deployments) or when the task is missing.\n *\n * Used by `handleGet` / `handleCancel` to reject IDOR access — the JWT-\n * verified caller's email must match `owner_email` to read or cancel.\n */\nexport async function getTaskOwner(id: string): Promise<string | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT owner_email FROM a2a_tasks WHERE id = ?`,\n    args: [id],\n  });\n  if (rows.length === 0) return null;\n  const ownerEmail = (rows[0] as any).owner_email;\n  return typeof ownerEmail === \"string\" && ownerEmail ? ownerEmail : null;\n}\n\n/**\n * Atomically claim a task for processing. Only succeeds when the task is in\n * state 'submitted' or 'working' — flipping it to 'processing' so concurrent\n * processors can't pick it up twice. Returns the task if claimed, null if it\n * was already claimed/completed/missing.\n *\n * Used by the cross-platform async processor (`_process-task` route) to avoid\n * duplicate handler runs when retries fire.\n */\nexport async function claimA2ATaskForProcessing(\n  id: string,\n): Promise<Task | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const timestamp = new Date().toISOString();\n\n  const result = await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET status_state = 'processing',\n                status_timestamp = ?,\n                updated_at = ?\n          WHERE id = ?\n            AND status_state IN ('submitted', 'working')`,\n    args: [timestamp, now, id],\n  });\n  const affected = getAffectedRowCount(result);\n  if (affected === 0) return null;\n\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM a2a_tasks WHERE id = ?`,\n    args: [id],\n  });\n  if (rows.length === 0) return null;\n  return taskFromRow(rows[0]);\n}\n\nexport async function getA2ATaskDispatchState(id: string): Promise<{\n  id: string;\n  statusState: string;\n  metadata: Record<string, unknown> | undefined;\n  updatedAt: number;\n} | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT id, status_state, metadata, updated_at FROM a2a_tasks WHERE id = ?`,\n    args: [id],\n  });\n  const row = rows[0] as any;\n  if (!row) return null;\n  return {\n    id: row.id as string,\n    statusState: row.status_state as string,\n    metadata: row.metadata ? JSON.parse(row.metadata as string) : undefined,\n    updatedAt: Number(row.updated_at ?? 0),\n  };\n}\n\nexport async function touchQueuedA2ATaskDispatch(id: string): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const result = await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET updated_at = ?\n          WHERE id = ?\n            AND status_state IN ('submitted', 'working')`,\n    args: [now, id],\n  });\n  const affected = getAffectedRowCount(result);\n  return affected !== 0;\n}\n\nexport async function touchProcessingA2ATask(id: string): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const result = await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET updated_at = ?\n          WHERE id = ?\n            AND status_state = 'processing'`,\n    args: [now, id],\n  });\n  const affected = getAffectedRowCount(result);\n  return affected !== 0;\n}\n\nexport async function resetStuckA2ATaskForRetry(\n  id: string,\n  processingCutoff: number,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const timestamp = new Date().toISOString();\n  const result = await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET status_state = 'working',\n                status_timestamp = ?,\n                updated_at = ?\n          WHERE id = ?\n            AND status_state = 'processing'\n            AND updated_at <= ?`,\n    args: [timestamp, now, id, processingCutoff],\n  });\n  const affected = getAffectedRowCount(result);\n  return affected !== 0;\n}\n\nexport async function failStuckA2ATask(\n  id: string,\n  processingCutoff: number,\n  reason: string,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const timestamp = new Date().toISOString();\n  const message: Message = {\n    role: \"agent\",\n    parts: [{ type: \"text\", text: reason }],\n  };\n  const result = await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET status_state = 'failed',\n                status_message = ?,\n                status_timestamp = ?,\n                updated_at = ?\n          WHERE id = ?\n            AND status_state = 'processing'\n            AND updated_at <= ?`,\n    args: [JSON.stringify(message), timestamp, now, id, processingCutoff],\n  });\n  const affected = getAffectedRowCount(result);\n  return affected !== 0;\n}\n\nexport async function getTask(id: string): Promise<Task | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM a2a_tasks WHERE id = ?`,\n    args: [id],\n  });\n  if (rows.length === 0) return null;\n  return taskFromRow(rows[0]);\n}\n\nexport async function updateTask(\n  id: string,\n  update: {\n    state?: TaskState;\n    message?: Message;\n    artifacts?: Artifact[];\n  },\n): Promise<Task | null> {\n  await ensureTable();\n  const client = getDbExec();\n\n  // Read current task\n  const { rows } = await client.execute({\n    sql: `SELECT * FROM a2a_tasks WHERE id = ?`,\n    args: [id],\n  });\n  if (rows.length === 0) return null;\n\n  const task = taskFromRow(rows[0]);\n  const now = Date.now();\n\n  if (update.state) {\n    task.status = {\n      state: update.state,\n      message: update.message ?? task.status.message,\n      timestamp: new Date().toISOString(),\n    };\n  }\n\n  if (update.message && task.history) {\n    task.history.push(update.message);\n  }\n\n  if (update.artifacts) {\n    task.artifacts = [...(task.artifacts ?? []), ...update.artifacts];\n  }\n\n  await client.execute({\n    sql: `UPDATE a2a_tasks SET status_state = ?, status_message = ?, status_timestamp = ?, history = ?, artifacts = ?, updated_at = ? WHERE id = ?`,\n    args: [\n      task.status.state,\n      task.status.message ? JSON.stringify(task.status.message) : null,\n      task.status.timestamp,\n      JSON.stringify(task.history),\n      JSON.stringify(task.artifacts),\n      now,\n      id,\n    ],\n  });\n\n  return task;\n}\n\nexport async function updateTaskStatusMessage(\n  id: string,\n  message: Message,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  const timestamp = new Date().toISOString();\n  await client.execute({\n    sql: `UPDATE a2a_tasks\n            SET status_message = ?,\n                status_timestamp = ?,\n                updated_at = ?\n          WHERE id = ?\n            AND status_state IN ('submitted', 'working', 'processing')`,\n    args: [JSON.stringify(message), timestamp, now, id],\n  });\n}\n\nexport async function listTasks(contextId?: string): Promise<Task[]> {\n  await ensureTable();\n  const client = getDbExec();\n\n  if (contextId) {\n    const { rows } = await client.execute({\n      sql: `SELECT * FROM a2a_tasks WHERE context_id = ? ORDER BY created_at DESC`,\n      args: [contextId],\n    });\n    return rows.map(taskFromRow);\n  }\n\n  const { rows } = await client.execute(\n    `SELECT * FROM a2a_tasks ORDER BY created_at DESC`,\n  );\n  return rows.map(taskFromRow);\n}\n"]}

package/dist/agent/engine/anthropic-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anthropic-engine.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/anthropic-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAGnB,MAAM,YAAY,CAAC;AAiBpB,eAAO,MAAM,sBAAsB,EAAE,kBAMpC,CAAC;AAEF,eAAO,MAAM,0BAA0B,gFACC,CAAC;AACzC,eAAO,MAAM,uBAAuB,qBAAsC,CAAC;AAqJ3E;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,WAAW,CAyBb"}
+{"version":3,"file":"anthropic-engine.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/anthropic-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAGnB,MAAM,YAAY,CAAC;AAiBpB,eAAO,MAAM,sBAAsB,EAAE,kBAMpC,CAAC;AAEF,eAAO,MAAM,0BAA0B,gFACC,CAAC;AACzC,eAAO,MAAM,uBAAuB,qBAAsC,CAAC;AA8I3E;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,WAAW,CAyBb"}

package/dist/agent/engine/anthropic-engine.js

@@ -92,8 +92,6 @@ class AnthropicEngine {
         const apiStream = client.messages.stream(requestParams, {
             signal: opts.abortSignal,
         });
-        let thinkingText = "";
-        let thinkingSignature = "";
         // Per-stream state lets the translator carry each tool-call's id/name from
         // its `content_block_start` onto the streamed `input_json_delta` chunks, so
         // long tool-input generation emits countable `tool-input-start` /
@@ -103,11 +101,6 @@ class AnthropicEngine {
             for await (const chunk of apiStream) {
                 const events = anthropicChunkToEngineEvents(chunk, chunkState);
                 for (const event of events) {
-                    if (event.type === "thinking-delta") {
-                        thinkingText += event.text;
-                        if (event.signature)
-                            thinkingSignature = event.signature;
-                    }
                     yield event;
                 }
             }

package/dist/agent/engine/anthropic-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"anthropic-engine.js","sourceRoot":"","sources":["../../../src/agent/engine/anthropic-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EACL,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAErE,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IACnB,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,IAAI;IACjB,iBAAiB,EAAE,IAAI;CACxB,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GACrC,sBAAsB,CAAC,eAAe,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,CAAC,YAAY,CAAC;AAE3E,MAAM,eAAe;IACV,IAAI,GAAG,WAAW,CAAC;IACnB,KAAK,GAAG,wBAAwB,CAAC;IACjC,YAAY,GAAG,uBAAuB,CAAC;IACvC,eAAe,GAAG,0BAA0B,CAAC;IAC7C,YAAY,GAAG,sBAAsB,CAAC;IAE9B,MAAM,CAAS;IAEhC,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,IAAyB;QACrC,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC;QAEtD,wDAAwD;QACxD,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,IAAI,aAAa,EAAE,QAAQ,EAAE,CAAC;YAC5B,KAAK,CAAC,QAAQ,GAAG;gBACf,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI;gBACjC,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,YAAY;aACnD,CAAC;QACJ,CAAC;QACD,IAAI,aAAa,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,KAAK,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC;QACnC,CAAC;QACD,MAAM,eAAe,GAAG,gCAAgC,CACtD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,CACrB,CAAC;QACF,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,KAAK,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,CAAC,aAAa,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACpD,CAAC;QAED,kEAAkE;QAClE,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,YAAY,GAAG,aAAa,EAAE,YAAY,KAAK,KAAK,CAAC;QAC3D,MAAM,YAAY,GAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACxE,IAAI,YAAY,EAAE,CAAC;YACjB,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACxD,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EAAS,CAAC;YAC/D,IAAI,CAAC,aAAa,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAC3C,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;QAC7C,CAAC;QAED,MAAM,aAAa,GAAQ;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,+BAA+B,CACzC,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,eAAe,CACrB;YACD,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YACvD,QAAQ;YACR,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;gBACnC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,KAAK;SACT,CAAC;QAEF,kEAAkE;QAClE,IAAI,CAAC,aAAa,CAAC,KAAK;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC;QAErD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE;YACtD,MAAM,EAAE,IAAI,CAAC,WAAW;SACzB,CAAC,CAAC;QAEH,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,iBAAiB,GAAG,EAAE,CAAC;QAE3B,2EAA2E;QAC3E,4EAA4E;QAC5E,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,UAAU,GAAG,+BAA+B,EAAE,CAAC;QAErD,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;wBACpC,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC;wBAC3B,IAAI,KAAK,CAAC,SAAS;4BAAE,iBAAiB,GAAG,KAAK,CAAC,SAAS,CAAC;oBAC3D,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC;YACpD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAExE,aAAa;YACb,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;gBACvB,MAAM;oBACJ,IAAI,EAAE,OAAO;oBACb,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC;oBACjD,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC;oBACnD,eAAe,EACZ,YAAY,CAAC,KAAa,CAAC,uBAAuB,IAAI,CAAC;oBAC1D,gBAAgB,EACb,YAAY,CAAC,KAAa,CAAC,2BAA2B,IAAI,CAAC;iBAC/D,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YAE7D,mBAAmB;YACnB,MAAM,UAAU,GAAG,YAAY,CAAC,WAAW,IAAI,UAAU,CAAC;YAC1D,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EACJ,UAAU,KAAK,UAAU;oBACvB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,UAAU,KAAK,YAAY;wBAC3B,CAAC,CAAC,YAAY;wBACd,CAAC,CAAC,UAAU;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;aACnC,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAkC,EAAE;IAEpC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC;IAC3D,MAAM,MAAM,GACT,MAAM,CAAC,MAA6B;QACrC,CAAC,gBAAgB,CAAC,CAAC,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,EAAE,CAAC;IACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,wDAAwD;QACxD,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,wBAAwB;YAC/B,YAAY,EAAE,uBAAuB;YACrC,eAAe,EAAE,0BAA0B;YAC3C,YAAY,EAAE,sBAAsB;YACpC,KAAK,CAAC,CAAC,MAAM;gBACX,MAAM;oBACJ,IAAI,EAAE,MAAe;oBACrB,MAAM,EAAE,OAAgB;oBACxB,KAAK,EAAE,+BAA+B;oBACtC,SAAS,EAAE,kCAAkC;iBAC9C,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC","sourcesContent":["/**\n * AnthropicEngine — wraps @anthropic-ai/sdk for use as an AgentEngine.\n *\n * This is the default, best-in-class engine. It supports all Anthropic-native\n * features: extended thinking, prompt caching, vision, computer use, and\n * parallel tool calls.\n *\n * All providerOptions.anthropic fields are forwarded directly to the SDK.\n */\n\nimport type {\n  AgentEngine,\n  EngineCapabilities,\n  EngineStreamOptions,\n  EngineEvent,\n} from \"./types.js\";\nimport {\n  engineToolsToAnthropic,\n  engineMessagesToAnthropic,\n  anthropicContentToEngine,\n  anthropicChunkToEngineEvents,\n  createAnthropicChunkStreamState,\n} from \"./translate-anthropic.js\";\nimport { readDeployCredentialEnv } from \"../../server/credential-provider.js\";\nimport { normalizeReasoningEffortForModel } from \"../../shared/reasoning-effort.js\";\nimport {\n  LLM_MISSING_CREDENTIALS_ERROR_CODE,\n  LLM_MISSING_CREDENTIALS_MESSAGE,\n} from \"./credential-errors.js\";\nimport { ANTHROPIC_MODEL_CONFIG } from \"../model-config.js\";\nimport { resolveMaxOutputTokensForEngine } from \"./output-tokens.js\";\n\nexport const ANTHROPIC_CAPABILITIES: EngineCapabilities = {\n  thinking: true,\n  promptCaching: true,\n  vision: true,\n  computerUse: true,\n  parallelToolCalls: true,\n};\n\nexport const ANTHROPIC_SUPPORTED_MODELS =\n  ANTHROPIC_MODEL_CONFIG.supportedModels;\nexport const ANTHROPIC_DEFAULT_MODEL = ANTHROPIC_MODEL_CONFIG.defaultModel;\n\nclass AnthropicEngine implements AgentEngine {\n  readonly name = \"anthropic\";\n  readonly label = \"Claude (Anthropic SDK)\";\n  readonly defaultModel = ANTHROPIC_DEFAULT_MODEL;\n  readonly supportedModels = ANTHROPIC_SUPPORTED_MODELS;\n  readonly capabilities = ANTHROPIC_CAPABILITIES;\n\n  private readonly apiKey: string;\n\n  constructor(apiKey: string) {\n    this.apiKey = apiKey;\n  }\n\n  async *stream(opts: EngineStreamOptions): AsyncIterable<EngineEvent> {\n    const Anthropic = (await import(\"@anthropic-ai/sdk\")).default;\n    const client = new Anthropic({ apiKey: this.apiKey });\n\n    const tools = engineToolsToAnthropic(opts.tools);\n    const messages = engineMessagesToAnthropic(opts.messages);\n    const anthropicOpts = opts.providerOptions?.anthropic;\n\n    // Build extra body params for Anthropic-native features\n    const extra: Record<string, unknown> = {};\n    if (anthropicOpts?.thinking) {\n      extra.thinking = {\n        type: anthropicOpts.thinking.type,\n        budget_tokens: anthropicOpts.thinking.budgetTokens,\n      };\n    }\n    if (anthropicOpts?.topK !== undefined) {\n      extra.top_k = anthropicOpts.topK;\n    }\n    const reasoningEffort = normalizeReasoningEffortForModel(\n      opts.model,\n      opts.reasoningEffort,\n    );\n    if (reasoningEffort) {\n      if (!extra.thinking) {\n        extra.thinking = { type: \"adaptive\" };\n      }\n      extra.output_config = { effort: reasoningEffort };\n    }\n\n    // Apply prompt caching to the system prompt and tools by default.\n    // Cache is pure upside: identical prefixes on subsequent turns get ~90%\n    // off input cost and much faster time-to-first-token. If the prefix\n    // changes turn-to-turn, it's a no-op. Templates can opt out by setting\n    // providerOptions.anthropic.cacheControl = false.\n    const cacheEnabled = anthropicOpts?.cacheControl !== false;\n    const systemBlocks: any[] = [{ type: \"text\", text: opts.systemPrompt }];\n    if (cacheEnabled) {\n      systemBlocks[0].cache_control = { type: \"ephemeral\" };\n    }\n\n    // Apply cache_control to the last tool definition when caching is enabled.\n    // Anthropic caches the prefix up to and including the last cached block.\n    let cachedTools = tools;\n    if (cacheEnabled && tools.length > 0) {\n      cachedTools = [...tools];\n      const last = { ...cachedTools[cachedTools.length - 1] } as any;\n      last.cache_control = { type: \"ephemeral\" };\n      cachedTools[cachedTools.length - 1] = last;\n    }\n\n    const requestParams: any = {\n      model: opts.model,\n      max_tokens: resolveMaxOutputTokensForEngine(\n        this.name,\n        opts.maxOutputTokens,\n      ),\n      system: systemBlocks,\n      tools: cachedTools.length > 0 ? cachedTools : undefined,\n      messages,\n      ...(opts.temperature !== undefined\n        ? { temperature: opts.temperature }\n        : {}),\n      ...extra,\n    };\n\n    // Remove undefined tools to avoid Anthropic API validation errors\n    if (!requestParams.tools) delete requestParams.tools;\n\n    const apiStream = client.messages.stream(requestParams, {\n      signal: opts.abortSignal,\n    });\n\n    let thinkingText = \"\";\n    let thinkingSignature = \"\";\n\n    // Per-stream state lets the translator carry each tool-call's id/name from\n    // its `content_block_start` onto the streamed `input_json_delta` chunks, so\n    // long tool-input generation emits countable `tool-input-start` /\n    // `tool-input-delta` progress events (mirroring the Builder engine).\n    const chunkState = createAnthropicChunkStreamState();\n\n    try {\n      for await (const chunk of apiStream) {\n        const events = anthropicChunkToEngineEvents(chunk, chunkState);\n        for (const event of events) {\n          if (event.type === \"thinking-delta\") {\n            thinkingText += event.text;\n            if (event.signature) thinkingSignature = event.signature;\n          }\n          yield event;\n        }\n      }\n\n      const finalMessage = await apiStream.finalMessage();\n      const assistantContent = anthropicContentToEngine(finalMessage.content);\n\n      // Emit usage\n      if (finalMessage.usage) {\n        yield {\n          type: \"usage\",\n          inputTokens: finalMessage.usage.input_tokens ?? 0,\n          outputTokens: finalMessage.usage.output_tokens ?? 0,\n          cacheReadTokens:\n            (finalMessage.usage as any).cache_read_input_tokens ?? 0,\n          cacheWriteTokens:\n            (finalMessage.usage as any).cache_creation_input_tokens ?? 0,\n        };\n      }\n\n      yield { type: \"assistant-content\", parts: assistantContent };\n\n      // Emit stop reason\n      const stopReason = finalMessage.stop_reason ?? \"end_turn\";\n      yield {\n        type: \"stop\",\n        reason:\n          stopReason === \"tool_use\"\n            ? \"tool_use\"\n            : stopReason === \"max_tokens\"\n              ? \"max_tokens\"\n              : \"end_turn\",\n      };\n    } catch (err: any) {\n      yield {\n        type: \"stop\",\n        reason: \"error\",\n        error: err?.message ?? String(err),\n      };\n      throw err;\n    }\n  }\n}\n\n/**\n * Create an AnthropicEngine instance.\n * Falls back to the deployment Anthropic key if no key is provided.\n */\nexport function createAnthropicEngine(\n  config: Record<string, unknown> = {},\n): AgentEngine {\n  const allowEnvFallback = config.allowEnvFallback !== false;\n  const apiKey =\n    (config.apiKey as string | undefined) ??\n    (allowEnvFallback ? readDeployCredentialEnv(\"ANTHROPIC_API_KEY\") : \"\") ??\n    \"\";\n  if (!apiKey) {\n    // Return a \"missing key\" engine that immediately errors\n    return {\n      name: \"anthropic\",\n      label: \"Claude (Anthropic SDK)\",\n      defaultModel: ANTHROPIC_DEFAULT_MODEL,\n      supportedModels: ANTHROPIC_SUPPORTED_MODELS,\n      capabilities: ANTHROPIC_CAPABILITIES,\n      async *stream() {\n        yield {\n          type: \"stop\" as const,\n          reason: \"error\" as const,\n          error: LLM_MISSING_CREDENTIALS_MESSAGE,\n          errorCode: LLM_MISSING_CREDENTIALS_ERROR_CODE,\n        };\n      },\n    };\n  }\n  return new AnthropicEngine(apiKey);\n}\n"]}
+{"version":3,"file":"anthropic-engine.js","sourceRoot":"","sources":["../../../src/agent/engine/anthropic-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,4BAA4B,EAC5B,+BAA+B,GAChC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AACpF,OAAO,EACL,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAErE,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,QAAQ,EAAE,IAAI;IACd,aAAa,EAAE,IAAI;IACnB,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,IAAI;IACjB,iBAAiB,EAAE,IAAI;CACxB,CAAC;AAEF,MAAM,CAAC,MAAM,0BAA0B,GACrC,sBAAsB,CAAC,eAAe,CAAC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,CAAC,YAAY,CAAC;AAE3E,MAAM,eAAe;IACV,IAAI,GAAG,WAAW,CAAC;IACnB,KAAK,GAAG,wBAAwB,CAAC;IACjC,YAAY,GAAG,uBAAuB,CAAC;IACvC,eAAe,GAAG,0BAA0B,CAAC;IAC7C,YAAY,GAAG,sBAAsB,CAAC;IAE9B,MAAM,CAAS;IAEhC,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,IAAyB;QACrC,MAAM,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC;QAC9D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAEtD,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC;QAEtD,wDAAwD;QACxD,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,IAAI,aAAa,EAAE,QAAQ,EAAE,CAAC;YAC5B,KAAK,CAAC,QAAQ,GAAG;gBACf,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI;gBACjC,aAAa,EAAE,aAAa,CAAC,QAAQ,CAAC,YAAY;aACnD,CAAC;QACJ,CAAC;QACD,IAAI,aAAa,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,KAAK,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC;QACnC,CAAC;QACD,MAAM,eAAe,GAAG,gCAAgC,CACtD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,eAAe,CACrB,CAAC;QACF,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACpB,KAAK,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,CAAC,aAAa,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;QACpD,CAAC;QAED,kEAAkE;QAClE,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,YAAY,GAAG,aAAa,EAAE,YAAY,KAAK,KAAK,CAAC;QAC3D,MAAM,YAAY,GAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACxE,IAAI,YAAY,EAAE,CAAC;YACjB,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACxD,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EAAS,CAAC;YAC/D,IAAI,CAAC,aAAa,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAC3C,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;QAC7C,CAAC;QAED,MAAM,aAAa,GAAQ;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,+BAA+B,CACzC,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,eAAe,CACrB;YACD,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YACvD,QAAQ;YACR,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;gBACnC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,KAAK;SACT,CAAC;QAEF,kEAAkE;QAClE,IAAI,CAAC,aAAa,CAAC,KAAK;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC;QAErD,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE;YACtD,MAAM,EAAE,IAAI,CAAC,WAAW;SACzB,CAAC,CAAC;QAEH,2EAA2E;QAC3E,4EAA4E;QAC5E,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,UAAU,GAAG,+BAA+B,EAAE,CAAC;QAErD,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;gBAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;oBAC3B,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,CAAC;YACpD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAExE,aAAa;YACb,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;gBACvB,MAAM;oBACJ,IAAI,EAAE,OAAO;oBACb,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC;oBACjD,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC;oBACnD,eAAe,EACZ,YAAY,CAAC,KAAa,CAAC,uBAAuB,IAAI,CAAC;oBAC1D,gBAAgB,EACb,YAAY,CAAC,KAAa,CAAC,2BAA2B,IAAI,CAAC;iBAC/D,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YAE7D,mBAAmB;YACnB,MAAM,UAAU,GAAG,YAAY,CAAC,WAAW,IAAI,UAAU,CAAC;YAC1D,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EACJ,UAAU,KAAK,UAAU;oBACvB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,UAAU,KAAK,YAAY;wBAC3B,CAAC,CAAC,YAAY;wBACd,CAAC,CAAC,UAAU;aACnB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;aACnC,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAkC,EAAE;IAEpC,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC;IAC3D,MAAM,MAAM,GACT,MAAM,CAAC,MAA6B;QACrC,CAAC,gBAAgB,CAAC,CAAC,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,EAAE,CAAC;IACL,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,wDAAwD;QACxD,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,wBAAwB;YAC/B,YAAY,EAAE,uBAAuB;YACrC,eAAe,EAAE,0BAA0B;YAC3C,YAAY,EAAE,sBAAsB;YACpC,KAAK,CAAC,CAAC,MAAM;gBACX,MAAM;oBACJ,IAAI,EAAE,MAAe;oBACrB,MAAM,EAAE,OAAgB;oBACxB,KAAK,EAAE,+BAA+B;oBACtC,SAAS,EAAE,kCAAkC;iBAC9C,CAAC;YACJ,CAAC;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC","sourcesContent":["/**\n * AnthropicEngine — wraps @anthropic-ai/sdk for use as an AgentEngine.\n *\n * This is the default, best-in-class engine. It supports all Anthropic-native\n * features: extended thinking, prompt caching, vision, computer use, and\n * parallel tool calls.\n *\n * All providerOptions.anthropic fields are forwarded directly to the SDK.\n */\n\nimport type {\n  AgentEngine,\n  EngineCapabilities,\n  EngineStreamOptions,\n  EngineEvent,\n} from \"./types.js\";\nimport {\n  engineToolsToAnthropic,\n  engineMessagesToAnthropic,\n  anthropicContentToEngine,\n  anthropicChunkToEngineEvents,\n  createAnthropicChunkStreamState,\n} from \"./translate-anthropic.js\";\nimport { readDeployCredentialEnv } from \"../../server/credential-provider.js\";\nimport { normalizeReasoningEffortForModel } from \"../../shared/reasoning-effort.js\";\nimport {\n  LLM_MISSING_CREDENTIALS_ERROR_CODE,\n  LLM_MISSING_CREDENTIALS_MESSAGE,\n} from \"./credential-errors.js\";\nimport { ANTHROPIC_MODEL_CONFIG } from \"../model-config.js\";\nimport { resolveMaxOutputTokensForEngine } from \"./output-tokens.js\";\n\nexport const ANTHROPIC_CAPABILITIES: EngineCapabilities = {\n  thinking: true,\n  promptCaching: true,\n  vision: true,\n  computerUse: true,\n  parallelToolCalls: true,\n};\n\nexport const ANTHROPIC_SUPPORTED_MODELS =\n  ANTHROPIC_MODEL_CONFIG.supportedModels;\nexport const ANTHROPIC_DEFAULT_MODEL = ANTHROPIC_MODEL_CONFIG.defaultModel;\n\nclass AnthropicEngine implements AgentEngine {\n  readonly name = \"anthropic\";\n  readonly label = \"Claude (Anthropic SDK)\";\n  readonly defaultModel = ANTHROPIC_DEFAULT_MODEL;\n  readonly supportedModels = ANTHROPIC_SUPPORTED_MODELS;\n  readonly capabilities = ANTHROPIC_CAPABILITIES;\n\n  private readonly apiKey: string;\n\n  constructor(apiKey: string) {\n    this.apiKey = apiKey;\n  }\n\n  async *stream(opts: EngineStreamOptions): AsyncIterable<EngineEvent> {\n    const Anthropic = (await import(\"@anthropic-ai/sdk\")).default;\n    const client = new Anthropic({ apiKey: this.apiKey });\n\n    const tools = engineToolsToAnthropic(opts.tools);\n    const messages = engineMessagesToAnthropic(opts.messages);\n    const anthropicOpts = opts.providerOptions?.anthropic;\n\n    // Build extra body params for Anthropic-native features\n    const extra: Record<string, unknown> = {};\n    if (anthropicOpts?.thinking) {\n      extra.thinking = {\n        type: anthropicOpts.thinking.type,\n        budget_tokens: anthropicOpts.thinking.budgetTokens,\n      };\n    }\n    if (anthropicOpts?.topK !== undefined) {\n      extra.top_k = anthropicOpts.topK;\n    }\n    const reasoningEffort = normalizeReasoningEffortForModel(\n      opts.model,\n      opts.reasoningEffort,\n    );\n    if (reasoningEffort) {\n      if (!extra.thinking) {\n        extra.thinking = { type: \"adaptive\" };\n      }\n      extra.output_config = { effort: reasoningEffort };\n    }\n\n    // Apply prompt caching to the system prompt and tools by default.\n    // Cache is pure upside: identical prefixes on subsequent turns get ~90%\n    // off input cost and much faster time-to-first-token. If the prefix\n    // changes turn-to-turn, it's a no-op. Templates can opt out by setting\n    // providerOptions.anthropic.cacheControl = false.\n    const cacheEnabled = anthropicOpts?.cacheControl !== false;\n    const systemBlocks: any[] = [{ type: \"text\", text: opts.systemPrompt }];\n    if (cacheEnabled) {\n      systemBlocks[0].cache_control = { type: \"ephemeral\" };\n    }\n\n    // Apply cache_control to the last tool definition when caching is enabled.\n    // Anthropic caches the prefix up to and including the last cached block.\n    let cachedTools = tools;\n    if (cacheEnabled && tools.length > 0) {\n      cachedTools = [...tools];\n      const last = { ...cachedTools[cachedTools.length - 1] } as any;\n      last.cache_control = { type: \"ephemeral\" };\n      cachedTools[cachedTools.length - 1] = last;\n    }\n\n    const requestParams: any = {\n      model: opts.model,\n      max_tokens: resolveMaxOutputTokensForEngine(\n        this.name,\n        opts.maxOutputTokens,\n      ),\n      system: systemBlocks,\n      tools: cachedTools.length > 0 ? cachedTools : undefined,\n      messages,\n      ...(opts.temperature !== undefined\n        ? { temperature: opts.temperature }\n        : {}),\n      ...extra,\n    };\n\n    // Remove undefined tools to avoid Anthropic API validation errors\n    if (!requestParams.tools) delete requestParams.tools;\n\n    const apiStream = client.messages.stream(requestParams, {\n      signal: opts.abortSignal,\n    });\n\n    // Per-stream state lets the translator carry each tool-call's id/name from\n    // its `content_block_start` onto the streamed `input_json_delta` chunks, so\n    // long tool-input generation emits countable `tool-input-start` /\n    // `tool-input-delta` progress events (mirroring the Builder engine).\n    const chunkState = createAnthropicChunkStreamState();\n\n    try {\n      for await (const chunk of apiStream) {\n        const events = anthropicChunkToEngineEvents(chunk, chunkState);\n        for (const event of events) {\n          yield event;\n        }\n      }\n\n      const finalMessage = await apiStream.finalMessage();\n      const assistantContent = anthropicContentToEngine(finalMessage.content);\n\n      // Emit usage\n      if (finalMessage.usage) {\n        yield {\n          type: \"usage\",\n          inputTokens: finalMessage.usage.input_tokens ?? 0,\n          outputTokens: finalMessage.usage.output_tokens ?? 0,\n          cacheReadTokens:\n            (finalMessage.usage as any).cache_read_input_tokens ?? 0,\n          cacheWriteTokens:\n            (finalMessage.usage as any).cache_creation_input_tokens ?? 0,\n        };\n      }\n\n      yield { type: \"assistant-content\", parts: assistantContent };\n\n      // Emit stop reason\n      const stopReason = finalMessage.stop_reason ?? \"end_turn\";\n      yield {\n        type: \"stop\",\n        reason:\n          stopReason === \"tool_use\"\n            ? \"tool_use\"\n            : stopReason === \"max_tokens\"\n              ? \"max_tokens\"\n              : \"end_turn\",\n      };\n    } catch (err: any) {\n      yield {\n        type: \"stop\",\n        reason: \"error\",\n        error: err?.message ?? String(err),\n      };\n      throw err;\n    }\n  }\n}\n\n/**\n * Create an AnthropicEngine instance.\n * Falls back to the deployment Anthropic key if no key is provided.\n */\nexport function createAnthropicEngine(\n  config: Record<string, unknown> = {},\n): AgentEngine {\n  const allowEnvFallback = config.allowEnvFallback !== false;\n  const apiKey =\n    (config.apiKey as string | undefined) ??\n    (allowEnvFallback ? readDeployCredentialEnv(\"ANTHROPIC_API_KEY\") : \"\") ??\n    \"\";\n  if (!apiKey) {\n    // Return a \"missing key\" engine that immediately errors\n    return {\n      name: \"anthropic\",\n      label: \"Claude (Anthropic SDK)\",\n      defaultModel: ANTHROPIC_DEFAULT_MODEL,\n      supportedModels: ANTHROPIC_SUPPORTED_MODELS,\n      capabilities: ANTHROPIC_CAPABILITIES,\n      async *stream() {\n        yield {\n          type: \"stop\" as const,\n          reason: \"error\" as const,\n          error: LLM_MISSING_CREDENTIALS_MESSAGE,\n          errorCode: LLM_MISSING_CREDENTIALS_ERROR_CODE,\n        };\n      },\n    };\n  }\n  return new AnthropicEngine(apiKey);\n}\n"]}

package/dist/agent/engine/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAEnB,MAAM,YAAY,CAAC;AAYpB,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0BAA0B;IAC1B,YAAY,EAAE,kBAAkB,CAAC;IACjC,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6DAA6D;IAC7D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,4CAA4C;IAC5C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC;CACtD;AAKD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAajE;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,GACX,gBAAgB,GAAG,SAAS,CAE9B;AAED,yCAAyC;AACzC,wBAAgB,gBAAgB,IAAI,gBAAgB,EAAE,CAErD;AA8BD,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAOT;AAYD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAyB7D;AAUD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8EpF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAOvE;AAqBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAKT;AAED;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EACT,MAAM,GACN,WAAW,GACX;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAmHtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,WAAW,GAAG,MAAM,EAC5B,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAgC7B"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAYlE,MAAM,WAAW,gBAAgB;IAC/B,yEAAyE;IACzE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0BAA0B;IAC1B,YAAY,EAAE,kBAAkB,CAAC;IACjC,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6DAA6D;IAC7D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,4CAA4C;IAC5C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC;CACtD;AAKD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAajE;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,GACX,gBAAgB,GAAG,SAAS,CAE9B;AAED,yCAAyC;AACzC,wBAAgB,gBAAgB,IAAI,gBAAgB,EAAE,CAErD;AA8BD,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAOT;AAYD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAyB7D;AAUD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA8EpF;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAOvE;AAqBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAKT;AAED;;;;;;;GAOG;AACH,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAED,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,YAAY,CAAC,EACT,MAAM,GACN,WAAW,GACX;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAmHtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,WAAW,GAAG,MAAM,EAC5B,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAgC7B"}

package/dist/agent/engine/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/agent/engine/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAM5C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,wCAAwC,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EACL,wCAAwC,EACxC,uBAAuB,EACvB,yBAAyB,EACzB,aAAa,GACd,MAAM,qCAAqC,CAAC;AAE7C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAuB/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;AACtD,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAmB,CAAC;AAE7D;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAuB;IACzD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CACV,0BAA0B,KAAK,CAAC,IAAI,oCAAoC,CACzE,CAAC;QACF,OAAO;IACT,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CACjC,IAAY;IAEZ,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,+BAA+B,CAAC,SAAiB;IACxD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,UAAU,KAAK,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QACtC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;QAC1D,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7B,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,yBAAyB,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACtD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAuB;IAEvB,MAAM,YAAY,GAChB,KAAK,CAAC,cAAc;QAClB,EAAE,KAAK,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,+BAA+B,CAAC;SACpC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,OAAO,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,iCAAiC,CAAC,KAAuB;IAChE,IAAI,6BAA6B,CAAC,KAAK,CAAC;QAAE,OAAO;IACjD,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc;QACtC,CAAC,CAAC,kBAAkB,KAAK,CAAC,cAAc,EAAE;QAC1C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,CAAC,IAAI,mEAAmE,WAAW,EAAE,CACrH,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAClC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAC9C,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YACvC,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACjD,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpD,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,oEAAoE;IACtE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjD,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;YAAE,SAAS;QACpD,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO,aAAa,CAAC,IAAI,CACvB,OAAO,CAAC,GAAG,CAAC,sCAAsC;QAChD,OAAO,CAAC,GAAG,CAAC,qCAAqC;QACjD,EAAE,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,MAAM,WAAW,GAAG,0BAA0B,EAAE,CAAC;IACjD,IAAI,KAAyB,CAAC;IAC9B,IAAI,KAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,mBAAmB,EAAE,eAAe,EAAE,GAC5C,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAClD,KAAK,GAAG,mBAAmB,EAAE,CAAC;QAC9B,KAAK,GAAG,eAAe,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,mEAAmE,KAAK,IAAI,QAAQ,EAAE,CACvF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,EAAE,KAAuB,EAAoB,EAAE;QACrE,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAClC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAC9C,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YACvC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,0BAA0B,KAAK,CAAC,IAAI,UAAU,KAAK,UAAU,KAAK,IAAI,QAAQ,WAAW,CAC1F,CAAC;gBACJ,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,oEAAoE;IACtE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,0BAA0B,KAAK,CAAC,IAAI,UAAU,KAAK,UAAU,KAAK,IAAI,QAAQ,EAAE,CACjF,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,iEAAiE,KAAK,UAAU,KAAK,IAAI,QAAQ,EAAE,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,CAAC,GAAG,MAET,CAAC;IACF,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAA2C;IAE3C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;IAC3D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CACzB,MAA0B,EAC1B,KAA+B;IAE/B,OAAO;QACL,MAAM;QACN,gBAAgB,EAAE,wCAAwC,EAAE;QAC5D,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACjB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAe,EACf,KAAuB;IAEvB,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,8BAA8B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAe,EACf,KAAuB;IAEvB,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,8BAA8B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,IAAI,MAAM,aAAa,CAAC,GAAG,CAAC;gBAAE,SAAS;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,IACE,CAAC,wCAAwC,EAAE;YAC3C,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAE9D,uCAAuC;IACvC,IACE,YAAY;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,QAAQ,IAAI,YAAY,EACxB,CAAC;QACD,OAAO,YAA2B,CAAC;IACrC,CAAC;IAED,oCAAoC;IACpC,IACE,YAAY;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,MAAM,IAAI,YAAY,EACtB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,YAGtC,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,kBAAkB,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;QACJ,iCAAiC,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,uCAAuC;IACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CACb,mCAAmC,YAAY,kBAAkB,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;QACJ,iCAAiC,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,6CAA6C;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC3C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,iCAAiC,CAAC,KAAK,CAAC,CAAC;YACzC,OAAO,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,wCAAwC,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,KAAK,IAAI,CAAC,MAAM,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAEC,IAAI,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,CAAkB,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,EAAE,CAAC;IAC7D,IAAI,gBAAgB,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,IAAI,CAAC,MAAM,8BAA8B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC,MAAM,CAAC;gBAClB,GAAG,kBAAkB,CACnB,MAAM,EACN,uBAAuB,CACrB,MAAM,CAAC,MAA6C,CACrD,CACF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,QAAQ,GAAG,wCAAwC,EAAE;QACzD,CAAC,CAAC,mBAAmB,EAAE;QACvB,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEjE,wBAAwB;IACxB,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAA4B,EAC5B,UAA8B,EAAE;IAEhC,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,wCAAwC,CAC/D,OAAO,CAAC,KAAK,CACd,CAAC;QACF,IACE,UAAU,EAAE,MAAM,KAAK,UAAU;YACjC,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;YACpC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAC3B,CAAC;YACD,OAAO,UAAU,CAAC,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;QAChD,IACE,MAAM;YACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,MAAM,CAAC,MAAM,KAAK,UAAU;YAC5B,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EACvB,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * Agent Engine Registry.\n *\n * Mirrors the CLI_REGISTRY pattern (packages/core/src/terminal/cli-registry.ts)\n * but is open — anyone can register a custom engine via registerAgentEngine()\n * from a server plugin at startup.\n *\n * Built-in engines (anthropic, ai-sdk) are auto-registered by builtin.ts.\n */\n\nimport { createRequire } from \"node:module\";\nimport type {\n  AgentEngine,\n  EngineCapabilities,\n  EngineStreamOptions,\n} from \"./types.js\";\nimport { getSetting } from \"../../settings/store.js\";\nimport { getAgentAppModelDefaultForCurrentRequest } from \"../app-model-defaults.js\";\nimport {\n  canUseDeployCredentialFallbackForRequest,\n  readDeployCredentialEnv,\n  resolveBuilderCredentials,\n  resolveSecret,\n} from \"../../server/credential-provider.js\";\n\nconst require = createRequire(import.meta.url);\n\nexport interface AgentEngineEntry {\n  /** Unique name, e.g. \"anthropic\", \"ai-sdk:anthropic\", \"ai-sdk:openai\" */\n  name: string;\n  /** Human-readable label for UI */\n  label: string;\n  /** Short description for engine picker */\n  description: string;\n  /** npm package hint displayed in UI when package is missing */\n  installPackage?: string;\n  /** Engine capabilities */\n  capabilities: EngineCapabilities;\n  /** Default model string */\n  defaultModel: string;\n  /** All supported models (shown in model picker) */\n  supportedModels: readonly string[];\n  /** Environment variables required for this engine to work */\n  requiredEnvVars: string[];\n  /** Create an engine instance from config */\n  create(config: Record<string, unknown>): AgentEngine;\n}\n\nconst _registry = new Map<string, AgentEngineEntry>();\nconst _packageAvailabilityCache = new Map<string, boolean>();\n\n/**\n * Register a custom agent engine. Called at server startup (e.g., from a\n * server plugin or builtin.ts). Throws if name is already registered.\n */\nexport function registerAgentEngine(entry: AgentEngineEntry): void {\n  if (_registry.has(entry.name)) {\n    // Allow re-registration in tests / hot-reload — just overwrite\n    if (process.env.NODE_ENV === \"test\") {\n      _registry.set(entry.name, entry);\n      return;\n    }\n    console.warn(\n      `[agent-engine] Engine \"${entry.name}\" is already registered. Skipping.`,\n    );\n    return;\n  }\n  _registry.set(entry.name, entry);\n}\n\n/** Get a registered engine entry by name, or undefined if not found */\nexport function getAgentEngineEntry(\n  name: string,\n): AgentEngineEntry | undefined {\n  return _registry.get(name);\n}\n\n/** List all registered engine entries */\nexport function listAgentEngines(): AgentEngineEntry[] {\n  return Array.from(_registry.values());\n}\n\nfunction packageNameFromInstallSpecifier(specifier: string): string | null {\n  const trimmed = specifier.trim();\n  if (!trimmed) return null;\n  if (trimmed.startsWith(\"-\")) return null;\n  if (trimmed.startsWith(\"@\")) {\n    const slashIndex = trimmed.indexOf(\"/\");\n    if (slashIndex === -1) return trimmed;\n    const versionIndex = trimmed.indexOf(\"@\", slashIndex + 1);\n    return versionIndex === -1 ? trimmed : trimmed.slice(0, versionIndex);\n  }\n  const versionIndex = trimmed.indexOf(\"@\");\n  return versionIndex === -1 ? trimmed : trimmed.slice(0, versionIndex);\n}\n\nfunction canResolvePackage(packageName: string): boolean {\n  const cached = _packageAvailabilityCache.get(packageName);\n  if (cached !== undefined) return cached;\n  let available = false;\n  try {\n    require.resolve(packageName);\n    available = true;\n  } catch {\n    available = false;\n  }\n  _packageAvailabilityCache.set(packageName, available);\n  return available;\n}\n\nexport function isAgentEnginePackageInstalled(\n  entry: AgentEngineEntry,\n): boolean {\n  const packageNames =\n    entry.installPackage\n      ?.split(/\\s+/)\n      .map(packageNameFromInstallSpecifier)\n      .filter((name): name is string => Boolean(name)) ?? [];\n  return packageNames.every(canResolvePackage);\n}\n\nfunction assertAgentEnginePackageInstalled(entry: AgentEngineEntry): void {\n  if (isAgentEnginePackageInstalled(entry)) return;\n  const installHint = entry.installPackage\n    ? ` Run: pnpm add ${entry.installPackage}`\n    : \"\";\n  throw new Error(\n    `[agent-engine] Engine \"${entry.name}\" requires optional packages that are not installed in this app.${installHint}`,\n  );\n}\n\n/**\n * First registered engine whose requiredEnvVars are all set. Registration\n * order controls priority — the Builder gateway is registered first so it\n * wins when the Builder private key is present.\n *\n * Escape hatch: AGENT_ENGINE_PREFER_BYO_KEY=true skips the Builder engine\n * on the first pass, so an explicit provider key (ANTHROPIC_API_KEY etc.)\n * is picked instead. Builder is still used as the fallback when no other\n * provider key is set.\n */\nexport function detectEngineFromEnv(): AgentEngineEntry | null {\n  const preferByo = /^(1|true)$/i.test(\n    process.env.AGENT_ENGINE_PREFER_BYO_KEY ?? \"\",\n  );\n\n  if (preferByo) {\n    for (const entry of _registry.values()) {\n      if (entry.name === \"builder\") continue;\n      if (entry.requiredEnvVars.length === 0) continue;\n      if (!isAgentEnginePackageInstalled(entry)) continue;\n      if (entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v))) {\n        return entry;\n      }\n    }\n    // No BYO key matched — fall through to include Builder as fallback.\n  }\n\n  for (const entry of _registry.values()) {\n    if (entry.requiredEnvVars.length === 0) continue;\n    if (!isAgentEnginePackageInstalled(entry)) continue;\n    if (entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v))) {\n      return entry;\n    }\n  }\n  return null;\n}\n\nfunction shouldTraceEngineDetection(): boolean {\n  return /^(1|true)$/i.test(\n    process.env.AGENT_NATIVE_DEBUG_AGENT_ENGINE_DETECT ??\n      process.env.AGENT_NATIVE_DEBUG_CREDENTIAL_RESOLVE ??\n      \"\",\n  );\n}\n\n/**\n * Detect a usable engine from the current request user's accessible\n * `app_secrets` rows. Mirrors `detectEngineFromEnv` but consults the\n * encrypted secret store instead of `process.env`, including org-scoped\n * credentials shared with the active organization.\n *\n * Required because the Builder OAuth callback (and the settings UI's\n * \"paste your own key\" flow) writes credentials to app_secrets, not env.\n * Without this check, a user who connected Builder would see status\n * \"configured\" but the next chat turn would fall through to the default\n * Anthropic engine and hit `missing_api_key` — exactly Brent's symptom\n * on the docs site (Loom 2026-04-28: \"It doesn't seem to realize I'm\n * connected once I do a chat\").\n *\n * Includes the local dev session (`local@localhost`): the Builder\n * OAuth flow writes credentials scoped to that email when run from\n * `pnpm dev`, so detection has to consult those rows or the dev user\n * sees the same \"Connect your AI\" card after they've already connected\n * (Sami, 2026-04-30). Org-scoped Builder credentials must also count here:\n * `/builder/status` resolves them via the same request org context, and the\n * chat engine picker must not disagree with that card.\n */\nexport async function detectEngineFromUserSecrets(): Promise<AgentEngineEntry | null> {\n  const traceLookup = shouldTraceEngineDetection();\n  let email: string | undefined;\n  let orgId: string | null | undefined;\n  try {\n    const { getRequestUserEmail, getRequestOrgId } =\n      await import(\"../../server/request-context.js\");\n    email = getRequestUserEmail();\n    orgId = getRequestOrgId();\n  } catch {\n    if (traceLookup) {\n      console.log(\n        `[engine-detect] result=null reason=no-request-context email=(unknown) orgId=(unknown)`,\n      );\n    }\n    return null;\n  }\n  if (!email) {\n    if (traceLookup) {\n      console.log(\n        `[engine-detect] result=null reason=no-email email=(empty) orgId=${orgId ?? \"(none)\"}`,\n      );\n    }\n    return null;\n  }\n\n  const hasAllKeys = async (entry: AgentEngineEntry): Promise<boolean> => {\n    if (!isAgentEnginePackageInstalled(entry)) return false;\n    if (entry.requiredEnvVars.length === 0) return false;\n    if (entry.name === \"builder\") {\n      const creds = await resolveBuilderCredentials();\n      return Boolean(creds.privateKey && creds.publicKey);\n    }\n    for (const key of entry.requiredEnvVars) {\n      try {\n        if (!(await resolveSecret(key))) return false;\n      } catch {\n        return false;\n      }\n    }\n    return true;\n  };\n\n  const preferByo = /^(1|true)$/i.test(\n    process.env.AGENT_ENGINE_PREFER_BYO_KEY ?? \"\",\n  );\n\n  if (preferByo) {\n    for (const entry of _registry.values()) {\n      if (entry.name === \"builder\") continue;\n      if (await hasAllKeys(entry)) {\n        if (traceLookup) {\n          console.log(\n            `[engine-detect] result=${entry.name} email=${email} orgId=${orgId ?? \"(none)\"} byo=true`,\n          );\n        }\n        return entry;\n      }\n    }\n    // No BYO key matched — fall through to include Builder as fallback.\n  }\n\n  for (const entry of _registry.values()) {\n    if (await hasAllKeys(entry)) {\n      if (traceLookup) {\n        console.log(\n          `[engine-detect] result=${entry.name} email=${email} orgId=${orgId ?? \"(none)\"}`,\n        );\n      }\n      return entry;\n    }\n  }\n  if (traceLookup) {\n    console.log(\n      `[engine-detect] result=null reason=no-engine-keys-found email=${email} orgId=${orgId ?? \"(none)\"}`,\n    );\n  }\n  return null;\n}\n\n/**\n * Legacy inline API keys on the global `agent-engine` settings row are\n * intentionally ignored. That row is deployment-wide, so treating\n * `{ apiKey }` or `{ config: { apiKey } }` as configured would let one\n * user's pasted key power every other user. Per-user keys live in\n * `app_secrets` and are resolved separately.\n */\nexport function isAgentEngineSettingConfigured(stored: unknown): boolean {\n  if (!stored || typeof stored !== \"object\") return false;\n  const s = stored as {\n    engine?: unknown;\n  };\n  if (typeof s.engine !== \"string\" || !s.engine) return false;\n  return false;\n}\n\nfunction stripInlineApiKeyConfig(\n  config: Record<string, unknown> | undefined,\n): Record<string, unknown> {\n  if (!config) return {};\n  const { apiKey: _discardedApiKey, ...safeConfig } = config;\n  return safeConfig;\n}\n\nfunction engineCreateConfig(\n  apiKey: string | undefined,\n  extra?: Record<string, unknown>,\n): Record<string, unknown> {\n  return {\n    apiKey,\n    allowEnvFallback: canUseDeployCredentialFallbackForRequest(),\n    ...(extra ?? {}),\n  };\n}\n\n/**\n * True when the stored `agent-engine` row points at a registered engine\n * AND an API key for it is reachable via the engine's required env vars.\n * Inline keys on the global settings row are ignored; see\n * `isAgentEngineSettingConfigured`.\n */\nexport function isStoredEngineUsable(\n  stored: unknown,\n  entry: AgentEngineEntry,\n): boolean {\n  if (!isAgentEnginePackageInstalled(entry)) return false;\n  if (isAgentEngineSettingConfigured(stored)) return true;\n  if (entry.requiredEnvVars.length === 0) return true;\n  return entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v));\n}\n\n/**\n * Request-aware version of `isStoredEngineUsable`.\n *\n * The settings row stores the selected engine/model, while credentials may\n * live in per-user/org `app_secrets`. The sync helper intentionally only sees\n * deploy env vars; this async helper is what request-time routes should use\n * when deciding whether a stored engine can actually run for the current user.\n */\nexport async function isStoredEngineUsableForRequest(\n  stored: unknown,\n  entry: AgentEngineEntry,\n): Promise<boolean> {\n  if (!isAgentEnginePackageInstalled(entry)) return false;\n  if (isAgentEngineSettingConfigured(stored)) return true;\n  if (entry.requiredEnvVars.length === 0) return true;\n  if (entry.name === \"builder\") {\n    const creds = await resolveBuilderCredentials();\n    return Boolean(creds.privateKey && creds.publicKey);\n  }\n  for (const key of entry.requiredEnvVars) {\n    try {\n      if (await resolveSecret(key)) continue;\n    } catch {\n      // Fall through to the deployment-level check below.\n    }\n    if (\n      !canUseDeployCredentialFallbackForRequest() ||\n      !readDeployCredentialEnv(key)\n    ) {\n      return false;\n    }\n  }\n  return true;\n}\n\nexport interface ResolveEngineConfig {\n  /** Explicit engine name or instance from createAgentChatPlugin options */\n  engineOption?:\n    | string\n    | AgentEngine\n    | { name: string; config: Record<string, unknown> };\n  /** API key (used as config for the resolved engine) */\n  apiKey?: string;\n  /** Model override (used as part of engine config) */\n  model?: string;\n  /** App/template id used for org-scoped per-app model defaults. */\n  appId?: string;\n}\n\n/**\n * Resolve an AgentEngine from options → explicit env → app default →\n * request credentials → settings → env → default.\n *\n * Resolution order:\n * 1. Explicit `engineOption` from plugin options (string name, instance, or {name, config})\n * 2. Env var AGENT_ENGINE\n * 3. Org/user app-template default, when usable\n * 4. Current request's app_secrets; Builder wins by default when connected\n * 5. Settings store key \"agent-engine\" → { engine: string }, when usable\n * 6. Auto-detect deployment env credentials\n * 7. Default \"anthropic\" (requires ANTHROPIC_API_KEY)\n */\nexport async function resolveEngine(\n  config: ResolveEngineConfig,\n): Promise<AgentEngine> {\n  const { engineOption, apiKey, model: _model, appId } = config;\n\n  // 1. Explicit instance passed directly\n  if (\n    engineOption &&\n    typeof engineOption === \"object\" &&\n    \"stream\" in engineOption\n  ) {\n    return engineOption as AgentEngine;\n  }\n\n  // 2. Explicit {name, config} object\n  if (\n    engineOption &&\n    typeof engineOption === \"object\" &&\n    \"name\" in engineOption\n  ) {\n    const { name, config: engineConfig } = engineOption as {\n      name: string;\n      config: Record<string, unknown>;\n    };\n    const entry = _registry.get(name);\n    if (!entry)\n      throw new Error(\n        `[agent-engine] Unknown engine: \"${name}\". Registered: ${[..._registry.keys()].join(\", \")}`,\n      );\n    assertAgentEnginePackageInstalled(entry);\n    return entry.create(engineCreateConfig(apiKey, engineConfig));\n  }\n\n  // 3. Explicit string name from options\n  if (typeof engineOption === \"string\") {\n    const entry = _registry.get(engineOption);\n    if (!entry)\n      throw new Error(\n        `[agent-engine] Unknown engine: \"${engineOption}\". Registered: ${[..._registry.keys()].join(\", \")}`,\n      );\n    assertAgentEnginePackageInstalled(entry);\n    return entry.create(engineCreateConfig(apiKey));\n  }\n\n  // 4. Env var — explicit engine name override\n  const envEngine = process.env.AGENT_ENGINE;\n  if (envEngine) {\n    const entry = _registry.get(envEngine);\n    if (entry) {\n      assertAgentEnginePackageInstalled(entry);\n      return entry.create(engineCreateConfig(apiKey));\n    }\n  }\n\n  const appDefault = await getAgentAppModelDefaultForCurrentRequest(appId);\n  if (appDefault?.engine) {\n    const entry = _registry.get(appDefault.engine);\n    if (entry && (await isStoredEngineUsableForRequest(appDefault, entry))) {\n      return entry.create(engineCreateConfig(apiKey));\n    }\n  }\n\n  let stored:\n    | (Record<string, unknown> & { engine?: unknown; config?: unknown })\n    | null = null;\n  try {\n    stored = (await getSetting(\"agent-engine\")) as typeof stored;\n  } catch {\n    // Settings not available — fall through\n  }\n\n  // 5. Auto-detect from the current user's per-user `app_secrets` rows\n  // (Builder OAuth callback + \"paste your own key\" settings flow write\n  // here, not env). Comes before env-detection so a user-specific\n  // Builder connection wins over a stale deploy-level/provider key.\n  const detectedFromUser = await detectEngineFromUserSecrets();\n  if (detectedFromUser?.name === \"builder\") {\n    return detectedFromUser.create(engineCreateConfig(apiKey));\n  }\n\n  // 6. Settings store — only when the stored row's API key is reachable.\n  // This remains below Builder detection so \"Builder.io connected\" and the\n  // runtime agree on the default managed gateway path. Non-Builder user keys\n  // still honor the stored provider/model when Builder is not connected.\n  if (stored && typeof stored.engine === \"string\") {\n    const entry = _registry.get(stored.engine);\n    if (entry && (await isStoredEngineUsableForRequest(stored, entry))) {\n      return entry.create({\n        ...engineCreateConfig(\n          apiKey,\n          stripInlineApiKeyConfig(\n            stored.config as Record<string, unknown> | undefined,\n          ),\n        ),\n      });\n    }\n  }\n\n  if (detectedFromUser) {\n    return detectedFromUser.create(engineCreateConfig(apiKey));\n  }\n\n  // 8. Auto-detect from any provider env var — so just dropping a key in\n  // .env works without also setting AGENT_ENGINE.\n  const detected = canUseDeployCredentialFallbackForRequest()\n    ? detectEngineFromEnv()\n    : null;\n  if (detected) return detected.create(engineCreateConfig(apiKey));\n\n  // 9. Default: anthropic\n  const anthropicEntry = _registry.get(\"anthropic\");\n  if (!anthropicEntry) {\n    throw new Error(\n      \"[agent-engine] Default Anthropic engine is not registered. Did builtin.ts fail to load?\",\n    );\n  }\n  return anthropicEntry.create(engineCreateConfig(apiKey));\n}\n\n/**\n * Read the user-selected model for an engine from the `agent-engine` setting.\n *\n * The settings UI writes `{engine, model}` via the `manage-agent-engine` action=\"set\",\n * but `resolveEngine` only uses the stored engine (the model is a separate\n * per-request concern). Call this helper alongside `resolveEngine` to honor\n * the user's model choice without requiring a process restart.\n *\n * Returns the stored model only when the stored engine name matches `engine`\n * — otherwise returns `undefined` to avoid applying an Anthropic model string\n * to, say, an OpenRouter engine.\n */\nexport async function getStoredModelForEngine(\n  engine: AgentEngine | string,\n  options: { appId?: string } = {},\n): Promise<string | undefined> {\n  const engineName = typeof engine === \"string\" ? engine : engine.name;\n  try {\n    const appDefault = await getAgentAppModelDefaultForCurrentRequest(\n      options.appId,\n    );\n    if (\n      appDefault?.engine === engineName &&\n      typeof appDefault.model === \"string\" &&\n      appDefault.model.length > 0\n    ) {\n      return appDefault.model;\n    }\n  } catch {\n    // Settings/request context may not be available — fall through.\n  }\n\n  try {\n    const stored = await getSetting(\"agent-engine\");\n    if (\n      stored &&\n      typeof stored.engine === \"string\" &&\n      stored.engine === engineName &&\n      typeof stored.model === \"string\" &&\n      stored.model.length > 0\n    ) {\n      return stored.model;\n    }\n  } catch {\n    // Settings store not ready (fresh install, migration pending) — skip.\n  }\n  return undefined;\n}\n"]}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/agent/engine/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,wCAAwC,EAAE,MAAM,0BAA0B,CAAC;AACpF,OAAO,EACL,wCAAwC,EACxC,uBAAuB,EACvB,yBAAyB,EACzB,aAAa,GACd,MAAM,qCAAqC,CAAC;AAE7C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAuB/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;AACtD,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAmB,CAAC;AAE7D;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAuB;IACzD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACpC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CACV,0BAA0B,KAAK,CAAC,IAAI,oCAAoC,CACzE,CAAC;QACF,OAAO;IACT,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CACjC,IAAY;IAEZ,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,+BAA+B,CAAC,SAAiB;IACxD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,UAAU,KAAK,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QACtC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;QAC1D,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7B,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,KAAK,CAAC;IACpB,CAAC;IACD,yBAAyB,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACtD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,KAAuB;IAEvB,MAAM,YAAY,GAChB,KAAK,CAAC,cAAc;QAClB,EAAE,KAAK,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,+BAA+B,CAAC;SACpC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,OAAO,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,iCAAiC,CAAC,KAAuB;IAChE,IAAI,6BAA6B,CAAC,KAAK,CAAC;QAAE,OAAO;IACjD,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc;QACtC,CAAC,CAAC,kBAAkB,KAAK,CAAC,cAAc,EAAE;QAC1C,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,CAAC,IAAI,mEAAmE,WAAW,EAAE,CACrH,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAClC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAC9C,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YACvC,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACjD,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpD,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,oEAAoE;IACtE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjD,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;YAAE,SAAS;QACpD,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B;IACjC,OAAO,aAAa,CAAC,IAAI,CACvB,OAAO,CAAC,GAAG,CAAC,sCAAsC;QAChD,OAAO,CAAC,GAAG,CAAC,qCAAqC;QACjD,EAAE,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,MAAM,WAAW,GAAG,0BAA0B,EAAE,CAAC;IACjD,IAAI,KAAyB,CAAC;IAC9B,IAAI,KAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,mBAAmB,EAAE,eAAe,EAAE,GAC5C,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QAClD,KAAK,GAAG,mBAAmB,EAAE,CAAC;QAC9B,KAAK,GAAG,eAAe,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CACT,mEAAmE,KAAK,IAAI,QAAQ,EAAE,CACvF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,EAAE,KAAuB,EAAoB,EAAE;QACrE,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAClC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,EAAE,CAC9C,CAAC;IAEF,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,SAAS;YACvC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,GAAG,CACT,0BAA0B,KAAK,CAAC,IAAI,UAAU,KAAK,UAAU,KAAK,IAAI,QAAQ,WAAW,CAC1F,CAAC;gBACJ,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,oEAAoE;IACtE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,GAAG,CACT,0BAA0B,KAAK,CAAC,IAAI,UAAU,KAAK,UAAU,KAAK,IAAI,QAAQ,EAAE,CACjF,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,iEAAiE,KAAK,UAAU,KAAK,IAAI,QAAQ,EAAE,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAe;IAC5D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,CAAC,GAAG,MAET,CAAC;IACF,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAA2C;IAE3C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;IAC3D,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CACzB,MAA0B,EAC1B,KAA+B;IAE/B,OAAO;QACL,MAAM;QACN,gBAAgB,EAAE,wCAAwC,EAAE;QAC5D,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KACjB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAe,EACf,KAAuB;IAEvB,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,8BAA8B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,MAAe,EACf,KAAuB;IAEvB,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,8BAA8B,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC;YACH,IAAI,MAAM,aAAa,CAAC,GAAG,CAAC;gBAAE,SAAS;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;QACD,IACE,CAAC,wCAAwC,EAAE;YAC3C,CAAC,uBAAuB,CAAC,GAAG,CAAC,EAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAgBD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAA2B;IAE3B,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAE9D,uCAAuC;IACvC,IACE,YAAY;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,QAAQ,IAAI,YAAY,EACxB,CAAC;QACD,OAAO,YAA2B,CAAC;IACrC,CAAC;IAED,oCAAoC;IACpC,IACE,YAAY;QACZ,OAAO,YAAY,KAAK,QAAQ;QAChC,MAAM,IAAI,YAAY,EACtB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,YAGtC,CAAC;QACF,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,kBAAkB,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;QACJ,iCAAiC,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,uCAAuC;IACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YACR,MAAM,IAAI,KAAK,CACb,mCAAmC,YAAY,kBAAkB,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;QACJ,iCAAiC,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,6CAA6C;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC3C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,iCAAiC,CAAC,KAAK,CAAC,CAAC;YACzC,OAAO,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,wCAAwC,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,KAAK,IAAI,CAAC,MAAM,8BAA8B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAEC,IAAI,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,CAAkB,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,EAAE,CAAC;IAC7D,IAAI,gBAAgB,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,IAAI,CAAC,MAAM,8BAA8B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC,MAAM,CAAC;gBAClB,GAAG,kBAAkB,CACnB,MAAM,EACN,uBAAuB,CACrB,MAAM,CAAC,MAA6C,CACrD,CACF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,uEAAuE;IACvE,gDAAgD;IAChD,MAAM,QAAQ,GAAG,wCAAwC,EAAE;QACzD,CAAC,CAAC,mBAAmB,EAAE;QACvB,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;IAEjE,wBAAwB;IACxB,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAA4B,EAC5B,UAA8B,EAAE;IAEhC,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,wCAAwC,CAC/D,OAAO,CAAC,KAAK,CACd,CAAC;QACF,IACE,UAAU,EAAE,MAAM,KAAK,UAAU;YACjC,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;YACpC,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAC3B,CAAC;YACD,OAAO,UAAU,CAAC,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;QAChD,IACE,MAAM;YACN,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,MAAM,CAAC,MAAM,KAAK,UAAU;YAC5B,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAChC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EACvB,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["/**\n * Agent Engine Registry.\n *\n * Mirrors the CLI_REGISTRY pattern (packages/core/src/terminal/cli-registry.ts)\n * but is open — anyone can register a custom engine via registerAgentEngine()\n * from a server plugin at startup.\n *\n * Built-in engines (anthropic, ai-sdk) are auto-registered by builtin.ts.\n */\n\nimport { createRequire } from \"node:module\";\nimport type { AgentEngine, EngineCapabilities } from \"./types.js\";\nimport { getSetting } from \"../../settings/store.js\";\nimport { getAgentAppModelDefaultForCurrentRequest } from \"../app-model-defaults.js\";\nimport {\n  canUseDeployCredentialFallbackForRequest,\n  readDeployCredentialEnv,\n  resolveBuilderCredentials,\n  resolveSecret,\n} from \"../../server/credential-provider.js\";\n\nconst require = createRequire(import.meta.url);\n\nexport interface AgentEngineEntry {\n  /** Unique name, e.g. \"anthropic\", \"ai-sdk:anthropic\", \"ai-sdk:openai\" */\n  name: string;\n  /** Human-readable label for UI */\n  label: string;\n  /** Short description for engine picker */\n  description: string;\n  /** npm package hint displayed in UI when package is missing */\n  installPackage?: string;\n  /** Engine capabilities */\n  capabilities: EngineCapabilities;\n  /** Default model string */\n  defaultModel: string;\n  /** All supported models (shown in model picker) */\n  supportedModels: readonly string[];\n  /** Environment variables required for this engine to work */\n  requiredEnvVars: string[];\n  /** Create an engine instance from config */\n  create(config: Record<string, unknown>): AgentEngine;\n}\n\nconst _registry = new Map<string, AgentEngineEntry>();\nconst _packageAvailabilityCache = new Map<string, boolean>();\n\n/**\n * Register a custom agent engine. Called at server startup (e.g., from a\n * server plugin or builtin.ts). Throws if name is already registered.\n */\nexport function registerAgentEngine(entry: AgentEngineEntry): void {\n  if (_registry.has(entry.name)) {\n    // Allow re-registration in tests / hot-reload — just overwrite\n    if (process.env.NODE_ENV === \"test\") {\n      _registry.set(entry.name, entry);\n      return;\n    }\n    console.warn(\n      `[agent-engine] Engine \"${entry.name}\" is already registered. Skipping.`,\n    );\n    return;\n  }\n  _registry.set(entry.name, entry);\n}\n\n/** Get a registered engine entry by name, or undefined if not found */\nexport function getAgentEngineEntry(\n  name: string,\n): AgentEngineEntry | undefined {\n  return _registry.get(name);\n}\n\n/** List all registered engine entries */\nexport function listAgentEngines(): AgentEngineEntry[] {\n  return Array.from(_registry.values());\n}\n\nfunction packageNameFromInstallSpecifier(specifier: string): string | null {\n  const trimmed = specifier.trim();\n  if (!trimmed) return null;\n  if (trimmed.startsWith(\"-\")) return null;\n  if (trimmed.startsWith(\"@\")) {\n    const slashIndex = trimmed.indexOf(\"/\");\n    if (slashIndex === -1) return trimmed;\n    const versionIndex = trimmed.indexOf(\"@\", slashIndex + 1);\n    return versionIndex === -1 ? trimmed : trimmed.slice(0, versionIndex);\n  }\n  const versionIndex = trimmed.indexOf(\"@\");\n  return versionIndex === -1 ? trimmed : trimmed.slice(0, versionIndex);\n}\n\nfunction canResolvePackage(packageName: string): boolean {\n  const cached = _packageAvailabilityCache.get(packageName);\n  if (cached !== undefined) return cached;\n  let available = false;\n  try {\n    require.resolve(packageName);\n    available = true;\n  } catch {\n    available = false;\n  }\n  _packageAvailabilityCache.set(packageName, available);\n  return available;\n}\n\nexport function isAgentEnginePackageInstalled(\n  entry: AgentEngineEntry,\n): boolean {\n  const packageNames =\n    entry.installPackage\n      ?.split(/\\s+/)\n      .map(packageNameFromInstallSpecifier)\n      .filter((name): name is string => Boolean(name)) ?? [];\n  return packageNames.every(canResolvePackage);\n}\n\nfunction assertAgentEnginePackageInstalled(entry: AgentEngineEntry): void {\n  if (isAgentEnginePackageInstalled(entry)) return;\n  const installHint = entry.installPackage\n    ? ` Run: pnpm add ${entry.installPackage}`\n    : \"\";\n  throw new Error(\n    `[agent-engine] Engine \"${entry.name}\" requires optional packages that are not installed in this app.${installHint}`,\n  );\n}\n\n/**\n * First registered engine whose requiredEnvVars are all set. Registration\n * order controls priority — the Builder gateway is registered first so it\n * wins when the Builder private key is present.\n *\n * Escape hatch: AGENT_ENGINE_PREFER_BYO_KEY=true skips the Builder engine\n * on the first pass, so an explicit provider key (ANTHROPIC_API_KEY etc.)\n * is picked instead. Builder is still used as the fallback when no other\n * provider key is set.\n */\nexport function detectEngineFromEnv(): AgentEngineEntry | null {\n  const preferByo = /^(1|true)$/i.test(\n    process.env.AGENT_ENGINE_PREFER_BYO_KEY ?? \"\",\n  );\n\n  if (preferByo) {\n    for (const entry of _registry.values()) {\n      if (entry.name === \"builder\") continue;\n      if (entry.requiredEnvVars.length === 0) continue;\n      if (!isAgentEnginePackageInstalled(entry)) continue;\n      if (entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v))) {\n        return entry;\n      }\n    }\n    // No BYO key matched — fall through to include Builder as fallback.\n  }\n\n  for (const entry of _registry.values()) {\n    if (entry.requiredEnvVars.length === 0) continue;\n    if (!isAgentEnginePackageInstalled(entry)) continue;\n    if (entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v))) {\n      return entry;\n    }\n  }\n  return null;\n}\n\nfunction shouldTraceEngineDetection(): boolean {\n  return /^(1|true)$/i.test(\n    process.env.AGENT_NATIVE_DEBUG_AGENT_ENGINE_DETECT ??\n      process.env.AGENT_NATIVE_DEBUG_CREDENTIAL_RESOLVE ??\n      \"\",\n  );\n}\n\n/**\n * Detect a usable engine from the current request user's accessible\n * `app_secrets` rows. Mirrors `detectEngineFromEnv` but consults the\n * encrypted secret store instead of `process.env`, including org-scoped\n * credentials shared with the active organization.\n *\n * Required because the Builder OAuth callback (and the settings UI's\n * \"paste your own key\" flow) writes credentials to app_secrets, not env.\n * Without this check, a user who connected Builder would see status\n * \"configured\" but the next chat turn would fall through to the default\n * Anthropic engine and hit `missing_api_key` — exactly Brent's symptom\n * on the docs site (Loom 2026-04-28: \"It doesn't seem to realize I'm\n * connected once I do a chat\").\n *\n * Includes the local dev session (`local@localhost`): the Builder\n * OAuth flow writes credentials scoped to that email when run from\n * `pnpm dev`, so detection has to consult those rows or the dev user\n * sees the same \"Connect your AI\" card after they've already connected\n * (Sami, 2026-04-30). Org-scoped Builder credentials must also count here:\n * `/builder/status` resolves them via the same request org context, and the\n * chat engine picker must not disagree with that card.\n */\nexport async function detectEngineFromUserSecrets(): Promise<AgentEngineEntry | null> {\n  const traceLookup = shouldTraceEngineDetection();\n  let email: string | undefined;\n  let orgId: string | null | undefined;\n  try {\n    const { getRequestUserEmail, getRequestOrgId } =\n      await import(\"../../server/request-context.js\");\n    email = getRequestUserEmail();\n    orgId = getRequestOrgId();\n  } catch {\n    if (traceLookup) {\n      console.log(\n        `[engine-detect] result=null reason=no-request-context email=(unknown) orgId=(unknown)`,\n      );\n    }\n    return null;\n  }\n  if (!email) {\n    if (traceLookup) {\n      console.log(\n        `[engine-detect] result=null reason=no-email email=(empty) orgId=${orgId ?? \"(none)\"}`,\n      );\n    }\n    return null;\n  }\n\n  const hasAllKeys = async (entry: AgentEngineEntry): Promise<boolean> => {\n    if (!isAgentEnginePackageInstalled(entry)) return false;\n    if (entry.requiredEnvVars.length === 0) return false;\n    if (entry.name === \"builder\") {\n      const creds = await resolveBuilderCredentials();\n      return Boolean(creds.privateKey && creds.publicKey);\n    }\n    for (const key of entry.requiredEnvVars) {\n      try {\n        if (!(await resolveSecret(key))) return false;\n      } catch {\n        return false;\n      }\n    }\n    return true;\n  };\n\n  const preferByo = /^(1|true)$/i.test(\n    process.env.AGENT_ENGINE_PREFER_BYO_KEY ?? \"\",\n  );\n\n  if (preferByo) {\n    for (const entry of _registry.values()) {\n      if (entry.name === \"builder\") continue;\n      if (await hasAllKeys(entry)) {\n        if (traceLookup) {\n          console.log(\n            `[engine-detect] result=${entry.name} email=${email} orgId=${orgId ?? \"(none)\"} byo=true`,\n          );\n        }\n        return entry;\n      }\n    }\n    // No BYO key matched — fall through to include Builder as fallback.\n  }\n\n  for (const entry of _registry.values()) {\n    if (await hasAllKeys(entry)) {\n      if (traceLookup) {\n        console.log(\n          `[engine-detect] result=${entry.name} email=${email} orgId=${orgId ?? \"(none)\"}`,\n        );\n      }\n      return entry;\n    }\n  }\n  if (traceLookup) {\n    console.log(\n      `[engine-detect] result=null reason=no-engine-keys-found email=${email} orgId=${orgId ?? \"(none)\"}`,\n    );\n  }\n  return null;\n}\n\n/**\n * Legacy inline API keys on the global `agent-engine` settings row are\n * intentionally ignored. That row is deployment-wide, so treating\n * `{ apiKey }` or `{ config: { apiKey } }` as configured would let one\n * user's pasted key power every other user. Per-user keys live in\n * `app_secrets` and are resolved separately.\n */\nexport function isAgentEngineSettingConfigured(stored: unknown): boolean {\n  if (!stored || typeof stored !== \"object\") return false;\n  const s = stored as {\n    engine?: unknown;\n  };\n  if (typeof s.engine !== \"string\" || !s.engine) return false;\n  return false;\n}\n\nfunction stripInlineApiKeyConfig(\n  config: Record<string, unknown> | undefined,\n): Record<string, unknown> {\n  if (!config) return {};\n  const { apiKey: _discardedApiKey, ...safeConfig } = config;\n  return safeConfig;\n}\n\nfunction engineCreateConfig(\n  apiKey: string | undefined,\n  extra?: Record<string, unknown>,\n): Record<string, unknown> {\n  return {\n    apiKey,\n    allowEnvFallback: canUseDeployCredentialFallbackForRequest(),\n    ...(extra ?? {}),\n  };\n}\n\n/**\n * True when the stored `agent-engine` row points at a registered engine\n * AND an API key for it is reachable via the engine's required env vars.\n * Inline keys on the global settings row are ignored; see\n * `isAgentEngineSettingConfigured`.\n */\nexport function isStoredEngineUsable(\n  stored: unknown,\n  entry: AgentEngineEntry,\n): boolean {\n  if (!isAgentEnginePackageInstalled(entry)) return false;\n  if (isAgentEngineSettingConfigured(stored)) return true;\n  if (entry.requiredEnvVars.length === 0) return true;\n  return entry.requiredEnvVars.every((v) => !!readDeployCredentialEnv(v));\n}\n\n/**\n * Request-aware version of `isStoredEngineUsable`.\n *\n * The settings row stores the selected engine/model, while credentials may\n * live in per-user/org `app_secrets`. The sync helper intentionally only sees\n * deploy env vars; this async helper is what request-time routes should use\n * when deciding whether a stored engine can actually run for the current user.\n */\nexport async function isStoredEngineUsableForRequest(\n  stored: unknown,\n  entry: AgentEngineEntry,\n): Promise<boolean> {\n  if (!isAgentEnginePackageInstalled(entry)) return false;\n  if (isAgentEngineSettingConfigured(stored)) return true;\n  if (entry.requiredEnvVars.length === 0) return true;\n  if (entry.name === \"builder\") {\n    const creds = await resolveBuilderCredentials();\n    return Boolean(creds.privateKey && creds.publicKey);\n  }\n  for (const key of entry.requiredEnvVars) {\n    try {\n      if (await resolveSecret(key)) continue;\n    } catch {\n      // Fall through to the deployment-level check below.\n    }\n    if (\n      !canUseDeployCredentialFallbackForRequest() ||\n      !readDeployCredentialEnv(key)\n    ) {\n      return false;\n    }\n  }\n  return true;\n}\n\nexport interface ResolveEngineConfig {\n  /** Explicit engine name or instance from createAgentChatPlugin options */\n  engineOption?:\n    | string\n    | AgentEngine\n    | { name: string; config: Record<string, unknown> };\n  /** API key (used as config for the resolved engine) */\n  apiKey?: string;\n  /** Model override (used as part of engine config) */\n  model?: string;\n  /** App/template id used for org-scoped per-app model defaults. */\n  appId?: string;\n}\n\n/**\n * Resolve an AgentEngine from options → explicit env → app default →\n * request credentials → settings → env → default.\n *\n * Resolution order:\n * 1. Explicit `engineOption` from plugin options (string name, instance, or {name, config})\n * 2. Env var AGENT_ENGINE\n * 3. Org/user app-template default, when usable\n * 4. Current request's app_secrets; Builder wins by default when connected\n * 5. Settings store key \"agent-engine\" → { engine: string }, when usable\n * 6. Auto-detect deployment env credentials\n * 7. Default \"anthropic\" (requires ANTHROPIC_API_KEY)\n */\nexport async function resolveEngine(\n  config: ResolveEngineConfig,\n): Promise<AgentEngine> {\n  const { engineOption, apiKey, model: _model, appId } = config;\n\n  // 1. Explicit instance passed directly\n  if (\n    engineOption &&\n    typeof engineOption === \"object\" &&\n    \"stream\" in engineOption\n  ) {\n    return engineOption as AgentEngine;\n  }\n\n  // 2. Explicit {name, config} object\n  if (\n    engineOption &&\n    typeof engineOption === \"object\" &&\n    \"name\" in engineOption\n  ) {\n    const { name, config: engineConfig } = engineOption as {\n      name: string;\n      config: Record<string, unknown>;\n    };\n    const entry = _registry.get(name);\n    if (!entry)\n      throw new Error(\n        `[agent-engine] Unknown engine: \"${name}\". Registered: ${[..._registry.keys()].join(\", \")}`,\n      );\n    assertAgentEnginePackageInstalled(entry);\n    return entry.create(engineCreateConfig(apiKey, engineConfig));\n  }\n\n  // 3. Explicit string name from options\n  if (typeof engineOption === \"string\") {\n    const entry = _registry.get(engineOption);\n    if (!entry)\n      throw new Error(\n        `[agent-engine] Unknown engine: \"${engineOption}\". Registered: ${[..._registry.keys()].join(\", \")}`,\n      );\n    assertAgentEnginePackageInstalled(entry);\n    return entry.create(engineCreateConfig(apiKey));\n  }\n\n  // 4. Env var — explicit engine name override\n  const envEngine = process.env.AGENT_ENGINE;\n  if (envEngine) {\n    const entry = _registry.get(envEngine);\n    if (entry) {\n      assertAgentEnginePackageInstalled(entry);\n      return entry.create(engineCreateConfig(apiKey));\n    }\n  }\n\n  const appDefault = await getAgentAppModelDefaultForCurrentRequest(appId);\n  if (appDefault?.engine) {\n    const entry = _registry.get(appDefault.engine);\n    if (entry && (await isStoredEngineUsableForRequest(appDefault, entry))) {\n      return entry.create(engineCreateConfig(apiKey));\n    }\n  }\n\n  let stored:\n    | (Record<string, unknown> & { engine?: unknown; config?: unknown })\n    | null = null;\n  try {\n    stored = (await getSetting(\"agent-engine\")) as typeof stored;\n  } catch {\n    // Settings not available — fall through\n  }\n\n  // 5. Auto-detect from the current user's per-user `app_secrets` rows\n  // (Builder OAuth callback + \"paste your own key\" settings flow write\n  // here, not env). Comes before env-detection so a user-specific\n  // Builder connection wins over a stale deploy-level/provider key.\n  const detectedFromUser = await detectEngineFromUserSecrets();\n  if (detectedFromUser?.name === \"builder\") {\n    return detectedFromUser.create(engineCreateConfig(apiKey));\n  }\n\n  // 6. Settings store — only when the stored row's API key is reachable.\n  // This remains below Builder detection so \"Builder.io connected\" and the\n  // runtime agree on the default managed gateway path. Non-Builder user keys\n  // still honor the stored provider/model when Builder is not connected.\n  if (stored && typeof stored.engine === \"string\") {\n    const entry = _registry.get(stored.engine);\n    if (entry && (await isStoredEngineUsableForRequest(stored, entry))) {\n      return entry.create({\n        ...engineCreateConfig(\n          apiKey,\n          stripInlineApiKeyConfig(\n            stored.config as Record<string, unknown> | undefined,\n          ),\n        ),\n      });\n    }\n  }\n\n  if (detectedFromUser) {\n    return detectedFromUser.create(engineCreateConfig(apiKey));\n  }\n\n  // 8. Auto-detect from any provider env var — so just dropping a key in\n  // .env works without also setting AGENT_ENGINE.\n  const detected = canUseDeployCredentialFallbackForRequest()\n    ? detectEngineFromEnv()\n    : null;\n  if (detected) return detected.create(engineCreateConfig(apiKey));\n\n  // 9. Default: anthropic\n  const anthropicEntry = _registry.get(\"anthropic\");\n  if (!anthropicEntry) {\n    throw new Error(\n      \"[agent-engine] Default Anthropic engine is not registered. Did builtin.ts fail to load?\",\n    );\n  }\n  return anthropicEntry.create(engineCreateConfig(apiKey));\n}\n\n/**\n * Read the user-selected model for an engine from the `agent-engine` setting.\n *\n * The settings UI writes `{engine, model}` via the `manage-agent-engine` action=\"set\",\n * but `resolveEngine` only uses the stored engine (the model is a separate\n * per-request concern). Call this helper alongside `resolveEngine` to honor\n * the user's model choice without requiring a process restart.\n *\n * Returns the stored model only when the stored engine name matches `engine`\n * — otherwise returns `undefined` to avoid applying an Anthropic model string\n * to, say, an OpenRouter engine.\n */\nexport async function getStoredModelForEngine(\n  engine: AgentEngine | string,\n  options: { appId?: string } = {},\n): Promise<string | undefined> {\n  const engineName = typeof engine === \"string\" ? engine : engine.name;\n  try {\n    const appDefault = await getAgentAppModelDefaultForCurrentRequest(\n      options.appId,\n    );\n    if (\n      appDefault?.engine === engineName &&\n      typeof appDefault.model === \"string\" &&\n      appDefault.model.length > 0\n    ) {\n      return appDefault.model;\n    }\n  } catch {\n    // Settings/request context may not be available — fall through.\n  }\n\n  try {\n    const stored = await getSetting(\"agent-engine\");\n    if (\n      stored &&\n      typeof stored.engine === \"string\" &&\n      stored.engine === engineName &&\n      typeof stored.model === \"string\" &&\n      stored.model.length > 0\n    ) {\n      return stored.model;\n    }\n  } catch {\n    // Settings store not ready (fresh install, migration pending) — skip.\n  }\n  return undefined;\n}\n"]}

package/dist/agent/engine/translate-ai-sdk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"translate-ai-sdk.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/translate-ai-sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,WAAW,EACZ,MAAM,YAAY,CAAC;AAOpB;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EAAE,EACnB,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,GACxD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAcrB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,aAAa,GAAG,GAAG,EAAE,CAwF9D;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,GAAG,EAAE,CAItE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,EAAE,CA+GhE;AAuCD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,GAAG,GAAG,iBAAiB,EAAE,CA8B1E"}
+{"version":3,"file":"translate-ai-sdk.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/translate-ai-sdk.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EACb,iBAAiB,EACjB,WAAW,EACZ,MAAM,YAAY,CAAC;AAOpB;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EAAE,EACnB,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,GACxD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAcrB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,aAAa,GAAG,GAAG,EAAE,CAwF9D;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,GAAG,EAAE,CAItE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,EAAE,CAiHhE;AAuCD;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,GAAG,GAAG,iBAAiB,EAAE,CA8B1E"}

package/dist/agent/engine/translate-ai-sdk.js

@@ -225,9 +225,11 @@ export function aiSdkPartToEngineEvents(part) {
             break;
         }
         case "finish-step":
-            if (part.usage) {
-                events.push(usageEventFromLanguageModelUsage(part.usage));
-            }
+            // Usage is intentionally NOT emitted here. AI SDK's fullStream emits both
+            // a per-step `finish-step` (part.usage) and a terminal `finish`
+            // (part.totalUsage) for every step. runAgentLoop runs one model step per
+            // stream() call, so totalUsage already covers it; emitting here too would
+            // double-count tokens into recordUsage / cost tracking.
             break;
         case "finish":
             if (part.totalUsage) {