@agent-native/core 0.7.14 → 0.7.15

package/dist/a2a/server.js

@@ -5,7 +5,48 @@ import { generateAgentCard } from "./agent-card.js";
 import { handleJsonRpcH3, processA2ATaskFromQueue } from "./handlers.js";
 import { readBody } from "../server/h3-helpers.js";
 import { extractBearerToken, verifyInternalToken, } from "../integrations/internal-token.js";
-async function verifyA2AToken(authHeader) {
+/**
+ * One-time warning when A2A is running unauthenticated in development. We
+ * don't refuse the request (local templates need to work out of the box),
+ * but we log a single noisy line so operators notice if they accidentally
+ * deploy with no auth configured.
+ */
+let _warnedUnauthA2A = false;
+function warnA2AUnauthOnce() {
+    if (_warnedUnauthA2A)
+        return;
+    _warnedUnauthA2A = true;
+    // eslint-disable-next-line no-console
+    console.warn("[a2a] No A2A_SECRET or apiKeyEnv configured — A2A endpoint runs unauthenticated. " +
+        "This is allowed in development but blocked in production. Set A2A_SECRET before deploying.");
+}
+/**
+ * Resolve the audience (`aud`) value to expect in an inbound JWT. We use the
+ * receiver's app URL — it's the natural identifier of "who this token was
+ * minted for". Falls back to undefined when no app URL is configured, in
+ * which case the audience check is skipped (backward-compat with tokens
+ * minted before the audience claim shipped).
+ */
+function expectedJwtAudience(event) {
+    const fromEnv = process.env.APP_URL ||
+        process.env.URL ||
+        process.env.DEPLOY_URL ||
+        process.env.BETTER_AUTH_URL;
+    if (fromEnv)
+        return String(fromEnv);
+    // Best-effort: derive from the inbound request host. This is forgeable
+    // (Host-header attack), but only useful as a hint when env-derived URL
+    // is unset; the rest of the JWT verification still uses the secret.
+    try {
+        const proto = getRequestHeader(event, "x-forwarded-proto") || "https";
+        const host = getRequestHeader(event, "host");
+        if (host)
+            return `${proto}://${host}`;
+    }
+    catch { }
+    return undefined;
+}
+async function verifyA2AToken(authHeader, event) {
     const token = authHeader.replace("Bearer ", "");
     // Step 1: Peek at JWT claims WITHOUT verification to get org_domain.
     // This is safe because we only use org_domain to look up the secret,
@@ -13,9 +54,10 @@ async function verifyA2AToken(authHeader) {
     // with a fake org_domain, verification will fail because they don't
     // have the real secret.
     let orgDomainHint;
+    let unverifiedPayload;
     try {
-        const unverified = jose.decodeJwt(token);
-        orgDomainHint = unverified.org_domain;
+        unverifiedPayload = jose.decodeJwt(token);
+        orgDomainHint = unverifiedPayload.org_domain;
     }
     catch {
         // Malformed token — fall through to global secret attempt
@@ -38,9 +80,20 @@ async function verifyA2AToken(authHeader) {
         secret = process.env.A2A_SECRET;
     if (!secret)
         return { email: null, orgDomain: null };
-    // Step 4: Verify JWT with the resolved secret
+    // Step 4: Verify JWT with the resolved secret. Pass `audience` only when
+    // the token actually carries an `aud` claim (backward-compat: tokens
+    // minted by older `signA2AToken` versions don't include one). The
+    // issuer is always present per `signA2AToken` at client.ts:42 — but
+    // we don't enforce it because operators may legitimately mint tokens
+    // from arbitrary issuer URLs (e.g. dev tunnels, behind reverse proxies).
     try {
-        const { payload } = await jose.jwtVerify(token, new TextEncoder().encode(secret));
+        const verifyOptions = {};
+        if (unverifiedPayload && typeof unverifiedPayload.aud !== "undefined") {
+            const aud = expectedJwtAudience(event);
+            if (aud)
+                verifyOptions.audience = aud;
+        }
+        const { payload } = await jose.jwtVerify(token, new TextEncoder().encode(secret), verifyOptions);
         return {
             email: payload.sub ?? null,
             orgDomain: payload.org_domain ?? null,
@@ -61,7 +114,15 @@ async function verifyA2AToken(authHeader) {
  * cryptographic identity verification for cross-app A2A calls.
  */
 export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
-    // Public agent card endpoint (no auth required)
+    // Public agent card endpoint (no auth required).
+    //
+    // SECURITY: per-user / per-org MCP tools are filtered out of the public
+    // skills list. Their merged-key prefix (`mcp__user_<emailhash>_…` or
+    // `mcp__org_<orgid>_…`) discloses (a) which users have integrations
+    // attached, and (b) what those integrations are — fingerprinting the
+    // tenant. Template- and framework-defined skills stay; only the dynamic
+    // per-tenant MCP entries are dropped. See finding #7 in
+    // /tmp/security-audit/12-mcp-a2a-agent.md.
     getH3App(nitroApp).use("/.well-known/agent-card.json", defineEventHandler((event) => {
         if (getMethod(event) !== "GET") {
             setResponseStatus(event, 405);
@@ -71,7 +132,75 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
             (event.url?.protocol?.replace(":", "") ?? "http");
         const host = getRequestHeader(event, "host") ?? "localhost";
         const baseUrl = `${protocol}://${host}`;
-        return generateAgentCard(config, baseUrl);
+        // Filter out per-user/per-org MCP tools to avoid tenant disclosure.
+        // Note: stdio MCP tools loaded from a file-based mcp.config.json are
+        // process-wide and don't carry a per-user/per-org prefix, so they
+        // remain visible. That's intentional — they're an operator-controlled
+        // capability list.
+        const filteredSkills = (config.skills ?? []).filter((skill) => {
+            const id = skill.id ??
+                skill.name ??
+                "";
+            if (typeof id !== "string")
+                return true;
+            return !id.startsWith("mcp__user_") && !id.startsWith("mcp__org_");
+        });
+        return generateAgentCard({ ...config, skills: filteredSkills }, baseUrl);
+    }));
+    // Async-mode processor route. MUST be mounted BEFORE the `/a2a` catch-all
+    // below, since h3's `.use()` matches by prefix and `/a2a` would otherwise
+    // swallow `/a2a/_process-task` and return a JSON-RPC "Invalid token" error
+    // (the JSON-RPC handler doesn't know about taskId-only bodies).
+    //
+    // When `message/send` is called with `async: true`, the JSON-RPC handler
+    // enqueues the task and self-fires a POST to this route on the same
+    // deployment so the actual handler runs in a fresh function execution (its
+    // own full timeout). Authenticated with an HMAC token bound to the task id
+    // (5-minute lifetime, signed with A2A_SECRET — same scheme as the
+    // integration webhook queue).
+    getH3App(nitroApp).use(`${routePrefix}/a2a/_process-task`, defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const body = (await readBody(event));
+        const taskId = body && typeof body.taskId === "string" ? body.taskId : "";
+        if (!taskId) {
+            setResponseStatus(event, 400);
+            return { error: "taskId required" };
+        }
+        // When A2A_SECRET is set, require a valid HMAC token bound to this
+        // taskId. In production, we REQUIRE A2A_SECRET to be set so unsigned
+        // dispatches are never accepted (an attacker who fishes a taskId out
+        // of logs / a share link could otherwise force-replay it). In
+        // development, a missing secret is permitted so local templates work
+        // out of the box, but we log a one-time warning so operators notice.
+        if (process.env.A2A_SECRET) {
+            const auth = getRequestHeader(event, "authorization");
+            const tok = extractBearerToken(auth);
+            if (!verifyInternalToken(taskId, tok)) {
+                setResponseStatus(event, 401);
+                return { error: "Invalid or expired processor token" };
+            }
+        }
+        else if (process.env.NODE_ENV === "production") {
+            setResponseStatus(event, 503);
+            return {
+                error: "A2A processor not configured — set A2A_SECRET on this deployment to enable async A2A.",
+            };
+        }
+        else {
+            warnA2AUnauthOnce();
+        }
+        try {
+            await processA2ATaskFromQueue(taskId, config);
+            return { ok: true };
+        }
+        catch (err) {
+            console.error("[a2a] process-task failed:", err);
+            setResponseStatus(event, 500);
+            return { error: err?.message ?? "process-task failed" };
+        }
     }));
     // JSON-RPC A2A endpoint (with optional auth)
     getH3App(nitroApp).use(`${routePrefix}/a2a`, defineEventHandler(async (event) => {
@@ -79,12 +208,41 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
         }
+        // h3 prefix-matches mounts, so a request to `/a2a/_process-task`
+        // reaches this handler too. The dedicated mount above runs first and
+        // takes the request, but if that returns `undefined` (or h3 ever
+        // changes ordering semantics) defensively bail here. event.path is
+        // stripped to the remainder after the mount prefix.
+        const sub = (event.path || "/").split("?")[0].replace(/^\//, "");
+        if (sub.startsWith("_process-task"))
+            return;
         const authHeader = getRequestHeader(event, "authorization");
         let verifiedCallerEmail = null;
         let verifiedOrgDomain = null;
+        // SECURITY: when neither A2A_SECRET nor an apiKeyEnv is configured,
+        // there's no way to authenticate the caller. Default to "auth required"
+        // in production — return 503 with a clear message instead of running
+        // the agent loop unauthenticated. In development, log a one-time
+        // warning but allow so local templates work out of the box.
+        const hasA2ASecret = !!process.env.A2A_SECRET;
+        const hasApiKey = !!(config.apiKeyEnv && process.env[config.apiKeyEnv]);
+        if (!hasA2ASecret && !hasApiKey) {
+            if (process.env.NODE_ENV === "production") {
+                setResponseStatus(event, 503);
+                return {
+                    jsonrpc: "2.0",
+                    id: null,
+                    error: {
+                        code: -32001,
+                        message: "A2A authentication not configured. Set A2A_SECRET (preferred) or configure apiKeyEnv to accept inbound A2A traffic.",
+                    },
+                };
+            }
+            warnA2AUnauthOnce();
+        }
         // Try JWT verification first (org-level or global A2A_SECRET-based identity)
         if (authHeader?.startsWith("Bearer ")) {
-            const tokenPayload = await verifyA2AToken(authHeader);
+            const tokenPayload = await verifyA2AToken(authHeader, event);
             verifiedCallerEmail = tokenPayload.email;
             verifiedOrgDomain = tokenPayload.orgDomain;
             // If a secret exists (org-level or global) and token fails verification, reject
@@ -134,48 +292,5 @@ export function mountA2A(nitroApp, config, routePrefix = "/_agent-native") {
         const body = await readBody(event);
         return handleJsonRpcH3(body, event, config);
     }));
-    // Async-mode processor route. When `message/send` is called with
-    // `async: true`, the JSON-RPC handler enqueues the task and self-fires a
-    // POST to this route on the same deployment so the actual handler runs in
-    // a fresh function execution (its own full timeout). Authenticated with an
-    // HMAC token bound to the task id (5-minute lifetime, signed with
-    // A2A_SECRET — the same scheme the integration webhook queue uses).
-    getH3App(nitroApp).use(`${routePrefix}/a2a/_process-task`, defineEventHandler(async (event) => {
-        if (getMethod(event) !== "POST") {
-            setResponseStatus(event, 405);
-            return { error: "Method not allowed" };
-        }
-        const body = (await readBody(event));
-        const taskId = body && typeof body.taskId === "string" ? body.taskId : "";
-        if (!taskId) {
-            setResponseStatus(event, 400);
-            return { error: "taskId required" };
-        }
-        // When A2A_SECRET is set, require a valid HMAC token bound to this
-        // taskId. Without a secret, accept unsigned dispatches — the task store
-        // claim is atomic and the body only carries an opaque task id, so an
-        // unsigned dispatch is bounded in damage to re-running already-queued
-        // work that the original sender already approved.
-        if (process.env.A2A_SECRET) {
-            const auth = getRequestHeader(event, "authorization");
-            const token = extractBearerToken(auth);
-            if (!verifyInternalToken(taskId, token)) {
-                setResponseStatus(event, 401);
-                return { error: "Invalid or expired processor token" };
-            }
-        }
-        // Run the handler in this fresh function execution. We await so any
-        // exception surfaces in logs, but the response body is just an
-        // acknowledgement — the actual result lives on the task row.
-        try {
-            await processA2ATaskFromQueue(taskId, config);
-            return { ok: true };
-        }
-        catch (err) {
-            console.error("[a2a] process-task failed:", err);
-            setResponseStatus(event, 500);
-            return { error: err?.message ?? "process-task failed" };
-        }
-    }));
 }
 //# sourceMappingURL=server.js.map

package/dist/a2a/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EACL,kBAAkB,EAElB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAW3C,KAAK,UAAU,cAAc,CAAC,UAAkB;IAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAEhD,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,wBAAwB;IACxB,IAAI,aAAiC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,aAAa,GAAG,UAAU,CAAC,UAAgC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,iDAAiD;IACjD,IAAI,MAA0B,CAAC;IAC/B,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC5D,IAAI,SAAS;gBAAE,MAAM,GAAG,SAAS,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,MAAM;QAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAErD,8CAA8C;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CACtC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CACjC,CAAC;QACF,OAAO;YACL,KAAK,EAAG,OAAO,CAAC,GAAc,IAAI,IAAI;YACtC,SAAS,EAAG,OAAO,CAAC,UAAqB,IAAI,IAAI;SAClD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,8BAA8B,EAC9B,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,QAAQ,GACZ,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC;YAC5C,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;QACxC,OAAO,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,MAAM,EACpB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,IAAI,mBAAmB,GAAkB,IAAI,CAAC;QAC9C,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAE5C,6EAA6E;QAC7E,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;YACtD,mBAAmB,GAAG,YAAY,CAAC,KAAK,CAAC;YACzC,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC;YAC3C,gFAAgF;YAChF,IAAI,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,8BAA8B;qBACxC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,mBAAmB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBACrD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE;qBAC5D,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAClC,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;oBAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBACpD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,mBAAmB,EAAE,CAAC;YACxB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;QACzD,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,iBAAiB,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;IAEF,iEAAiE;IACjE,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,kEAAkE;IAClE,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,oBAAoB,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAgC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QAED,mEAAmE;QACnE,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,kDAAkD;QAClD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBACxC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,+DAA+D;QAC/D,6DAA6D;QAC7D,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/a2a/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AAClE,OAAO,EACL,kBAAkB,EAElB,iBAAiB,EACjB,SAAS,EACT,gBAAgB,GACjB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAE3C;;;;;GAKG;AACH,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAC7B,SAAS,iBAAiB;IACxB,IAAI,gBAAgB;QAAE,OAAO;IAC7B,gBAAgB,GAAG,IAAI,CAAC;IACxB,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,mFAAmF;QACjF,4FAA4F,CAC/F,CAAC;AACJ,CAAC;AAWD;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,KAAsB;IACjD,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC9B,IAAI,OAAO;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC;QACtE,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI;YAAE,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,UAAkB,EAClB,KAAsB;IAEtB,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAEhD,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,oEAAoE;IACpE,wBAAwB;IACxB,IAAI,aAAiC,CAAC;IACtC,IAAI,iBAA8C,CAAC;IACnD,IAAI,CAAC;QACH,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,aAAa,GAAG,iBAAiB,CAAC,UAAgC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,iDAAiD;IACjD,IAAI,MAA0B,CAAC;IAC/B,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACnE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,aAAa,CAAC,CAAC;YAC5D,IAAI,SAAS;gBAAE,MAAM,GAAG,SAAS,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,CAAC,MAAM;QAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAErD,yEAAyE;IACzE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,CAAC;QACH,MAAM,aAAa,GAA0B,EAAE,CAAC;QAChD,IAAI,iBAAiB,IAAI,OAAO,iBAAiB,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,GAAG;gBAAE,aAAa,CAAC,QAAQ,GAAG,GAAG,CAAC;QACxC,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CACtC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,aAAa,CACd,CAAC;QACF,OAAO;YACL,KAAK,EAAG,OAAO,CAAC,GAAc,IAAI,IAAI;YACtC,SAAS,EAAG,OAAO,CAAC,UAAqB,IAAI,IAAI;SAClD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,QAAQ,CACtB,QAAa,EACb,MAAiB,EACjB,WAAW,GAAG,gBAAgB;IAE9B,iDAAiD;IACjD,EAAE;IACF,wEAAwE;IACxE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,wEAAwE;IACxE,wDAAwD;IACxD,2CAA2C;IAC3C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,8BAA8B,EAC9B,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QACD,MAAM,QAAQ,GACZ,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC;YAC5C,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC;QAExC,oEAAoE;QACpE,qEAAqE;QACrE,kEAAkE;QAClE,sEAAsE;QACtE,mBAAmB;QACnB,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5D,MAAM,EAAE,GACL,KAAwC,CAAC,EAAE;gBAC3C,KAA2B,CAAC,IAAI;gBACjC,EAAE,CAAC;YACL,IAAI,OAAO,EAAE,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACxC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC,CACH,CAAC;IAEF,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,gEAAgE;IAChE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,kEAAkE;IAClE,8BAA8B;IAC9B,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,oBAAoB,EAClC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAgC,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QAED,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,8DAA8D;QAC9D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;YACtD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACjD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EACH,uFAAuF;aAC1F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,iBAAiB,EAAE,CAAC;QACtB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,GAAG,WAAW,MAAM,EACpB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,iEAAiE;QACjE,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,oDAAoD;QACpD,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO;QAE5C,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5D,IAAI,mBAAmB,GAAkB,IAAI,CAAC;QAC9C,IAAI,iBAAiB,GAAkB,IAAI,CAAC;QAE5C,oEAAoE;QACpE,wEAAwE;QACxE,qEAAqE;QACrE,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAC1C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EACL,qHAAqH;qBACxH;iBACF,CAAC;YACJ,CAAC;YACD,iBAAiB,EAAE,CAAC;QACtB,CAAC;QAED,6EAA6E;QAC7E,IAAI,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC7D,mBAAmB,GAAG,YAAY,CAAC,KAAK,CAAC;YACzC,iBAAiB,GAAG,YAAY,CAAC,SAAS,CAAC;YAC3C,gFAAgF;YAChF,IAAI,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE;wBACL,IAAI,EAAE,CAAC,KAAK;wBACZ,OAAO,EAAE,8BAA8B;qBACxC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,mBAAmB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBACrD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE;qBAC5D,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAClC,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;oBAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAC9B,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,IAAI;wBACR,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE;qBACpD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,qEAAqE;QACrE,oEAAoE;QACpE,IAAI,mBAAmB,EAAE,CAAC;YACxB,KAAK,CAAC,OAAO,CAAC,kBAAkB,GAAG,mBAAmB,CAAC;QACzD,CAAC;QACD,IAAI,iBAAiB,EAAE,CAAC;YACtB,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,iBAAiB,CAAC;QACnD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/a2a/task-store.d.ts

@@ -1,5 +1,14 @@
 import type { Task, Message, TaskState, Artifact } from "./types.js";
-export declare function createTask(message: Message, contextId?: string, metadata?: Record<string, unknown>): Promise<Task>;
+export declare function createTask(message: Message, contextId?: string, metadata?: Record<string, unknown>, ownerEmail?: string | null): Promise<Task>;
+/**
+ * Fetch the verified owner email recorded against a task at creation time.
+ * Returns null when the task has no owner (legacy rows or unauthenticated
+ * deployments) or when the task is missing.
+ *
+ * Used by `handleGet` / `handleCancel` to reject IDOR access — the JWT-
+ * verified caller's email must match `owner_email` to read or cancel.
+ */
+export declare function getTaskOwner(id: string): Promise<string | null>;
 /**
  * Atomically claim a task for processing. Only succeeds when the task is in
  * state 'submitted' or 'working' — flipping it to 'processing' so concurrent

package/dist/a2a/task-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-store.d.ts","sourceRoot":"","sources":["../../src/a2a/task-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA4CrE,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAwBtB;AAED,wBAAsB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAS9D;AAED,wBAAsB,UAAU,CAC9B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;IACN,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CA4CtB;AAED,wBAAsB,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAgBnE"}
+{"version":3,"file":"task-store.d.ts","sourceRoot":"","sources":["../../src/a2a/task-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA0DrE,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GACzB,OAAO,CAAC,IAAI,CAAC,CAiCf;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUrE;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAwBtB;AAED,wBAAsB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAS9D;AAED,wBAAsB,UAAU,CAC9B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE;IACN,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CA4CtB;AAED,wBAAsB,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAgBnE"}

package/dist/a2a/task-store.js

@@ -19,6 +19,18 @@ async function ensureTable() {
           updated_at ${intType()} NOT NULL
         )
       `);
+            // Additive migration: owner_email column. Bound to the JWT-verified
+            // caller at task-creation time so handleGet / handleCancel can reject
+            // mismatched callers (the IDOR class fixed in PR #369). Existing rows
+            // have NULL owner_email and remain accessible to legacy callers via
+            // the legacy-token apiKeyEnv path; new rows are scoped from this point
+            // forward.
+            try {
+                await client.execute(`ALTER TABLE a2a_tasks ADD COLUMN owner_email TEXT`);
+            }
+            catch {
+                // Column already exists — expected on every restart after first run.
+            }
         })();
     }
     return _initPromise;
@@ -37,9 +49,10 @@ function taskFromRow(row) {
         history: JSON.parse(row.history),
         artifacts: JSON.parse(row.artifacts),
         metadata: row.metadata ? JSON.parse(row.metadata) : undefined,
+        ownerEmail: row.owner_email ?? null,
     };
 }
-export async function createTask(message, contextId, metadata) {
+export async function createTask(message, contextId, metadata, ownerEmail) {
     await ensureTable();
     const client = getDbExec();
     const id = crypto.randomUUID();
@@ -54,7 +67,7 @@ export async function createTask(message, contextId, metadata) {
         metadata,
     };
     await client.execute({
-        sql: `INSERT INTO a2a_tasks (id, context_id, status_state, status_timestamp, history, artifacts, metadata, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        sql: `INSERT INTO a2a_tasks (id, context_id, status_state, status_timestamp, history, artifacts, metadata, owner_email, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
         args: [
             id,
             contextId ?? null,
@@ -63,12 +76,33 @@ export async function createTask(message, contextId, metadata) {
             JSON.stringify([message]),
             "[]",
             metadata ? JSON.stringify(metadata) : null,
+            ownerEmail ?? null,
             now,
             now,
         ],
     });
     return task;
 }
+/**
+ * Fetch the verified owner email recorded against a task at creation time.
+ * Returns null when the task has no owner (legacy rows or unauthenticated
+ * deployments) or when the task is missing.
+ *
+ * Used by `handleGet` / `handleCancel` to reject IDOR access — the JWT-
+ * verified caller's email must match `owner_email` to read or cancel.
+ */
+export async function getTaskOwner(id) {
+    await ensureTable();
+    const client = getDbExec();
+    const { rows } = await client.execute({
+        sql: `SELECT owner_email FROM a2a_tasks WHERE id = ?`,
+        args: [id],
+    });
+    if (rows.length === 0)
+        return null;
+    const ownerEmail = rows[0].owner_email;
+    return typeof ownerEmail === "string" && ownerEmail ? ownerEmail : null;
+}
 /**
  * Atomically claim a task for processing. Only succeeds when the task is in
  * state 'submitted' or 'working' — flipping it to 'processing' so concurrent

package/dist/a2a/task-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"task-store.js","sourceRoot":"","sources":["../../src/a2a/task-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAc,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAGjE,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;;;uBAUJ,OAAO,EAAE;uBACT,OAAO,EAAE;;OAEzB,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,GAAQ;IAC3B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,SAAS,EAAG,GAAG,CAAC,UAAqB,IAAI,SAAS;QAClD,MAAM,EAAE;YACN,KAAK,EAAE,GAAG,CAAC,YAAyB;YACpC,OAAO,EAAE,GAAG,CAAC,cAAc;gBACzB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAwB,CAAC;gBAC1C,CAAC,CAAC,SAAS;YACb,SAAS,EAAE,GAAG,CAAC,gBAA0B;SAC1C;QACD,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAiB,CAAC;QAC1C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAmB,CAAC;QAC9C,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAgB,EAChB,SAAkB,EAClB,QAAkC;IAElC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,IAAI,GAAS;QACjB,EAAE;QACF,SAAS;QACT,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE;QACzC,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,SAAS,EAAE,EAAE;QACb,QAAQ;KACT,CAAC;IAEF,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,iKAAiK;QACtK,IAAI,EAAE;YACJ,EAAE;YACF,SAAS,IAAI,IAAI;YACjB,WAAW;YACX,SAAS;YACT,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI;YACJ,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YAC1C,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;;yDAKgD;QACrD,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAI,MAAc,EAAE,YAAY,IAAK,MAAc,EAAE,QAAQ,CAAC;IAC5E,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAU;IACtC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,MAIC;IAED,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,oBAAoB;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YAC9C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,0IAA0I;QAC/I,IAAI,EAAE;YACJ,IAAI,CAAC,MAAM,CAAC,KAAK;YACjB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YAChE,IAAI,CAAC,MAAM,CAAC,SAAS;YACrB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9B,GAAG;YACH,EAAE;SACH;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAkB;IAChD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,uEAAuE;YAC5E,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CACnC,kDAAkD,CACnD,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"task-store.js","sourceRoot":"","sources":["../../src/a2a/task-store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAc,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAGjE,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;;;uBAUJ,OAAO,EAAE;uBACT,OAAO,EAAE;;OAEzB,CAAC,CAAC;YACH,oEAAoE;YACpE,sEAAsE;YACtE,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,WAAW;YACX,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,mDAAmD,CACpD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,GAAQ;IAC3B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,SAAS,EAAG,GAAG,CAAC,UAAqB,IAAI,SAAS;QAClD,MAAM,EAAE;YACN,KAAK,EAAE,GAAG,CAAC,YAAyB;YACpC,OAAO,EAAE,GAAG,CAAC,cAAc;gBACzB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAwB,CAAC;gBAC1C,CAAC,CAAC,SAAS;YACb,SAAS,EAAE,GAAG,CAAC,gBAA0B;SAC1C;QACD,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAiB,CAAC;QAC1C,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAmB,CAAC;QAC9C,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAkB,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,UAAU,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAgB,EAChB,SAAkB,EAClB,QAAkC,EAClC,UAA0B;IAE1B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,IAAI,GAAS;QACjB,EAAE;QACF,SAAS;QACT,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE;QACzC,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,SAAS,EAAE,EAAE;QACb,QAAQ;KACT,CAAC;IAEF,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,iLAAiL;QACtL,IAAI,EAAE;YACJ,EAAE;YACF,SAAS,IAAI,IAAI;YACjB,WAAW;YACX,SAAS;YACT,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;YACzB,IAAI;YACJ,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YAC1C,UAAU,IAAI,IAAI;YAClB,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU;IAC3C,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,gDAAgD;QACrD,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAI,IAAI,CAAC,CAAC,CAAS,CAAC,WAAW,CAAC;IAChD,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE;;;;;yDAKgD;QACrD,IAAI,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAI,MAAc,EAAE,YAAY,IAAK,MAAc,EAAE,QAAQ,CAAC;IAC5E,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAU;IACtC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,MAIC;IAED,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,oBAAoB;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,sCAAsC;QAC3C,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YAC9C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,0IAA0I;QAC/I,IAAI,EAAE;YACJ,IAAI,CAAC,MAAM,CAAC,KAAK;YACjB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YAChE,IAAI,CAAC,MAAM,CAAC,SAAS;YACrB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;YAC9B,GAAG;YACH,EAAE;SACH;KACF,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAkB;IAChD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,uEAAuE;YAC5E,IAAI,EAAE,CAAC,SAAS,CAAC;SAClB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CACnC,kDAAkD,CACnD,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC"}

package/dist/agent/default-model.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The framework-wide default model.
+ *
+ * One place to bump the default when a new Claude model ships. Everything
+ * that needs a default model fallback (agent chat, A2A handler, integration
+ * agent, MCP askAgent, etc.) imports this constant — there are no hardcoded
+ * model ID literals scattered across the codebase.
+ *
+ * Templates and apps can still override per-call by passing `model: "..."`
+ * in their plugin options; this is just the value used when no override is
+ * provided.
+ *
+ * Why sonnet (not haiku): the agent makes user-facing decisions (URLs, IDs,
+ * delegated answers). Haiku is fast and cheap but hallucinates slugs and
+ * paths in user-facing text often enough that we hit it during normal use
+ * (e.g. a Slack reply with a deck URL pointing to a host that doesn't exist).
+ * Sonnet's accuracy at the same task is dramatically better and the latency
+ * cost is acceptable for the cross-app A2A path.
+ */
+export declare const DEFAULT_MODEL = "claude-sonnet-4-6";
+//# sourceMappingURL=default-model.d.ts.map

package/dist/agent/default-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-model.d.ts","sourceRoot":"","sources":["../../src/agent/default-model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,sBAAsB,CAAC"}

package/dist/agent/default-model.js

@@ -0,0 +1,21 @@
+/**
+ * The framework-wide default model.
+ *
+ * One place to bump the default when a new Claude model ships. Everything
+ * that needs a default model fallback (agent chat, A2A handler, integration
+ * agent, MCP askAgent, etc.) imports this constant — there are no hardcoded
+ * model ID literals scattered across the codebase.
+ *
+ * Templates and apps can still override per-call by passing `model: "..."`
+ * in their plugin options; this is just the value used when no override is
+ * provided.
+ *
+ * Why sonnet (not haiku): the agent makes user-facing decisions (URLs, IDs,
+ * delegated answers). Haiku is fast and cheap but hallucinates slugs and
+ * paths in user-facing text often enough that we hit it during normal use
+ * (e.g. a Slack reply with a deck URL pointing to a host that doesn't exist).
+ * Sonnet's accuracy at the same task is dramatically better and the latency
+ * cost is acceptable for the cross-app A2A path.
+ */
+export const DEFAULT_MODEL = "claude-sonnet-4-6";
+//# sourceMappingURL=default-model.js.map

package/dist/agent/default-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-model.js","sourceRoot":"","sources":["../../src/agent/default-model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,mBAAmB,CAAC"}

package/dist/agent/engine/ai-sdk-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-sdk-engine.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/ai-sdk-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAInB,MAAM,YAAY,CAAC;AAYpB,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,QAAQ,GACR,YAAY,GACZ,QAAQ,GACR,MAAM,GACN,SAAS,GACT,QAAQ,GACR,QAAQ,CAAC;AAEb,QAAA,MAAM,qBAAqB,EAAE,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAyDpE,CAAC;AAEF,QAAA,MAAM,uBAAuB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAS1D,CAAC;AAEF,QAAA,MAAM,yBAAyB,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CA0BvE,CAAC;AAEF,QAAA,MAAM,iBAAiB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAStD,CAAC;AAEF,QAAA,MAAM,iBAAiB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CASpD,CAAC;AAkBF,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAsKD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,aAAa,EACvB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,WAAW,CAEb;AA6CD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,CAAC"}
+{"version":3,"file":"ai-sdk-engine.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/ai-sdk-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAInB,MAAM,YAAY,CAAC;AAcpB,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,QAAQ,GACR,YAAY,GACZ,QAAQ,GACR,MAAM,GACN,SAAS,GACT,QAAQ,GACR,QAAQ,CAAC;AAEb,QAAA,MAAM,qBAAqB,EAAE,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAyDpE,CAAC;AAEF,QAAA,MAAM,uBAAuB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAS1D,CAAC;AAEF,QAAA,MAAM,yBAAyB,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CA0BvE,CAAC;AAEF,QAAA,MAAM,iBAAiB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAStD,CAAC;AAEF,QAAA,MAAM,iBAAiB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CASpD,CAAC;AAkBF,kDAAkD;AAClD,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAsKD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,aAAa,EACvB,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,WAAW,CAEb;AA8CD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,CAAC"}

package/dist/agent/engine/ai-sdk-engine.js

@@ -12,6 +12,8 @@
  * so the core package remains installable without the AI SDK.
  */
 import { engineToolsToAISDK, engineMessagesToAISDK, aiSdkPartToEngineEvents, aiSdkStepToAssistantContent, } from "./translate-ai-sdk.js";
+import { DEFAULT_MODEL } from "../default-model.js";
+import { readDeployCredentialEnv } from "../../server/credential-provider.js";
 const PROVIDER_CAPABILITIES = {
     anthropic: {
         thinking: true,
@@ -71,7 +73,7 @@ const PROVIDER_CAPABILITIES = {
     },
 };
 const PROVIDER_DEFAULT_MODELS = {
-    anthropic: "claude-sonnet-4-6",
+    anthropic: DEFAULT_MODEL,
     openai: "gpt-5.4",
     openrouter: "anthropic/claude-sonnet-4.6",
     google: "gemini-3-flash-preview",
@@ -218,7 +220,7 @@ class AISDKEngine {
                 system: opts.systemPrompt,
                 messages,
                 tools: aiSdkTools,
-                maxOutputTokens: opts.maxOutputTokens ?? 16384,
+                maxOutputTokens: opts.maxOutputTokens ?? 32768,
                 ...(opts.temperature !== undefined
                     ? { temperature: opts.temperature }
                     : {}),
@@ -324,8 +326,9 @@ function capitalize(s) {
 function getProviderApiKey(provider) {
     const envVars = PROVIDER_ENV_VARS[provider];
     for (const v of envVars) {
-        if (process.env[v])
-            return process.env[v];
+        const value = readDeployCredentialEnv(v);
+        if (value)
+            return value;
     }
     return undefined;
 }

package/dist/agent/engine/ai-sdk-engine.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-sdk-engine.js","sourceRoot":"","sources":["../../../src/agent/engine/ai-sdk-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAgB/B,MAAM,qBAAqB,GAA8C;IACvE,SAAS,EAAE;QACT,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,KAAK,EAAE,iCAAiC;QACrD,iBAAiB,EAAE,IAAI;KACxB;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,KAAK;KACzB;CACF,CAAC;AAEF,MAAM,uBAAuB,GAAkC;IAC7D,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,SAAS;IACjB,UAAU,EAAE,6BAA6B;IACzC,MAAM,EAAE,wBAAwB;IAChC,IAAI,EAAE,yBAAyB;IAC/B,OAAO,EAAE,sBAAsB;IAC/B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,UAAU;CACnB,CAAC;AAEF,MAAM,yBAAyB,GAA6C;IAC1E,SAAS,EAAE;QACT,iBAAiB;QACjB,mBAAmB;QACnB,2BAA2B;KAC5B;IACD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC;IAC9C,UAAU,EAAE;QACV,2BAA2B;QAC3B,6BAA6B;QAC7B,gBAAgB;QAChB,yBAAyB;KAC1B;IACD,MAAM,EAAE,CAAC,wBAAwB,EAAE,wBAAwB,CAAC;IAC5D,IAAI,EAAE;QACJ,yBAAyB;QACzB,yBAAyB;QACzB,oBAAoB;KACrB;IACD,OAAO,EAAE;QACP,sBAAsB;QACtB,uBAAuB;QACvB,sBAAsB;KACvB;IACD,MAAM,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC;IACvC,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC;CACzD,CAAC;AAEF,MAAM,iBAAiB,GAAoC;IACzD,SAAS,EAAE,CAAC,mBAAmB,CAAC;IAChC,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,UAAU,EAAE,CAAC,oBAAoB,CAAC;IAClC,MAAM,EAAE,CAAC,8BAA8B,CAAC;IACxC,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,OAAO,EAAE,CAAC,iBAAiB,CAAC;IAC5B,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,MAAM,EAAE,EAAE,EAAE,eAAe;CAC5B,CAAC;AAEF,MAAM,iBAAiB,GAAkC;IACvD,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,UAAU,EAAE,6BAA6B;IACzC,MAAM,EAAE,gBAAgB;IACxB,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,iBAAiB;IAC1B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,eAAe;CACxB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,kBAAkB,GAAkC;IACxD,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,kBAAkB;IAC9B,MAAM,EAAE,0BAA0B;IAClC,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;CACvB,CAAC;AAoBF,MAAM,WAAW;IACN,IAAI,CAAS;IACb,KAAK,CAAS;IACd,YAAY,CAAS;IACrB,eAAe,CAAoB;IACnC,YAAY,CAAqB;IAEzB,QAAQ,CAAgB;IACxB,MAAM,CAAU;IAChB,OAAO,CAAU;IACjB,OAAO,CAAU;IACjB,MAAM,CAAU;IAEjC,YAAY,QAAuB,EAAE,MAAyB;QAC5D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,UAAU,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,eAAe,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,IAAyB;QACrC,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,uDAAuD,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;aACjG,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC;QAE5C,IAAI,aAAkB,CAAC;QACvB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;aACnC,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACnB,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC;YAC5C,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEtD,oFAAoF;QACpF,MAAM,YAAY,GAA4B,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,CAAC;YACrE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;YACrD,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;gBAC3B,YAAY,CAAC,SAAS,GAAG;oBACvB,GAAG,CAAE,YAAY,CAAC,SAAoB,IAAI,EAAE,CAAC;oBAC7C,QAAQ,EAAE;wBACR,IAAI,EAAE,SAAS;wBACf,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC,YAAY;qBAClD;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;gBAC/B,YAAY,CAAC,SAAS,GAAG;oBACvB,GAAG,CAAE,YAAY,CAAC,SAAoB,IAAI,EAAE,CAAC;oBAC7C,YAAY,EAAE,aAAa,CAAC,YAAY;iBACzC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB,GAAwB,EAAE,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC;gBACxB,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,QAAQ;gBACR,KAAK,EAAE,UAAU;gBACjB,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,KAAK;gBAC9C,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;oBACnC,CAAC,CAAC,EAAE,CAAC;gBACP,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,CAAC,IAAS,EAAE,EAAE;oBAC1B,gBAAgB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;gBACvD,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;oBACtC,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,EAAE;oBACnC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YAEH,oEAAoE;YACpE,iEAAiE;YACjE,IAAI,YAAqC,CAAC;YAE1C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC3C,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBAC1B,YAAY,GAAG,KAAK,CAAC;oBACvB,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YAC7D,MAAM,YAAY,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;aACnC,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,cAAmB,CAAC;QACxB,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,qBAAqB,GAAG,wCAAwC,GAAG,EAAE,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC;QAClE,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,IAAI,GAAG,qBAAqB,MAAM,aAAa,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7C,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAChD,6EAA6E;QAC7E,IAAI,IAAI,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAChD,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClC,yEAAyE;QACzE,0EAA0E;QAC1E,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAC/B,QAAuB,EACvB,SAAkC,EAAE;IAEpC,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,MAA2B,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,8EAA8E;AAC9E,8EAA8E;AAC9E,KAAK,UAAU,qBAAqB,CAAC,QAAuB;IAC1D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClC,KAAK,YAAY;YACf,OAAO,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC/C,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClC,KAAK,MAAM;YACT,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;QAChC,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACnC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAuB;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,CAAC"}
+{"version":3,"file":"ai-sdk-engine.js","sourceRoot":"","sources":["../../../src/agent/engine/ai-sdk-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAgB9E,MAAM,qBAAqB,GAA8C;IACvE,SAAS,EAAE;QACT,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,KAAK,EAAE,iCAAiC;QACrD,iBAAiB,EAAE,IAAI;KACxB;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,IAAI;QACZ,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,IAAI;KACxB;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,KAAK;KACzB;CACF,CAAC;AAEF,MAAM,uBAAuB,GAAkC;IAC7D,SAAS,EAAE,aAAa;IACxB,MAAM,EAAE,SAAS;IACjB,UAAU,EAAE,6BAA6B;IACzC,MAAM,EAAE,wBAAwB;IAChC,IAAI,EAAE,yBAAyB;IAC/B,OAAO,EAAE,sBAAsB;IAC/B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,UAAU;CACnB,CAAC;AAEF,MAAM,yBAAyB,GAA6C;IAC1E,SAAS,EAAE;QACT,iBAAiB;QACjB,mBAAmB;QACnB,2BAA2B;KAC5B;IACD,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC;IAC9C,UAAU,EAAE;QACV,2BAA2B;QAC3B,6BAA6B;QAC7B,gBAAgB;QAChB,yBAAyB;KAC1B;IACD,MAAM,EAAE,CAAC,wBAAwB,EAAE,wBAAwB,CAAC;IAC5D,IAAI,EAAE;QACJ,yBAAyB;QACzB,yBAAyB;QACzB,oBAAoB;KACrB;IACD,OAAO,EAAE;QACP,sBAAsB;QACtB,uBAAuB;QACvB,sBAAsB;KACvB;IACD,MAAM,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC;IACvC,MAAM,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC;CACzD,CAAC;AAEF,MAAM,iBAAiB,GAAoC;IACzD,SAAS,EAAE,CAAC,mBAAmB,CAAC;IAChC,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,UAAU,EAAE,CAAC,oBAAoB,CAAC;IAClC,MAAM,EAAE,CAAC,8BAA8B,CAAC;IACxC,IAAI,EAAE,CAAC,cAAc,CAAC;IACtB,OAAO,EAAE,CAAC,iBAAiB,CAAC;IAC5B,MAAM,EAAE,CAAC,gBAAgB,CAAC;IAC1B,MAAM,EAAE,EAAE,EAAE,eAAe;CAC5B,CAAC;AAEF,MAAM,iBAAiB,GAAkC;IACvD,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,UAAU,EAAE,6BAA6B;IACzC,MAAM,EAAE,gBAAgB;IACxB,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,iBAAiB;IAC1B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,eAAe;CACxB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,kBAAkB,GAAkC;IACxD,SAAS,EAAE,iBAAiB;IAC5B,MAAM,EAAE,cAAc;IACtB,UAAU,EAAE,kBAAkB;IAC9B,MAAM,EAAE,0BAA0B;IAClC,IAAI,EAAE,YAAY;IAClB,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;CACvB,CAAC;AAoBF,MAAM,WAAW;IACN,IAAI,CAAS;IACb,KAAK,CAAS;IACd,YAAY,CAAS;IACrB,eAAe,CAAoB;IACnC,YAAY,CAAqB;IAEzB,QAAQ,CAAgB;IACxB,MAAM,CAAU;IAChB,OAAO,CAAU;IACjB,OAAO,CAAU;IACjB,MAAM,CAAU;IAEjC,YAAY,QAAuB,EAAE,MAAyB;QAC5D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,UAAU,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChD,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,eAAe,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,YAAY,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,CAAC,MAAM,CAAC,IAAyB;QACrC,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,uDAAuD,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;aACjG,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC;QAE5C,IAAI,aAAkB,CAAC;QACvB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;aACnC,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GACd,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACnB,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC;YAC5C,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEtD,oFAAoF;QACpF,MAAM,YAAY,GAA4B,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,CAAC;YACrE,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;YACrD,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC;gBAC3B,YAAY,CAAC,SAAS,GAAG;oBACvB,GAAG,CAAE,YAAY,CAAC,SAAoB,IAAI,EAAE,CAAC;oBAC7C,QAAQ,EAAE;wBACR,IAAI,EAAE,SAAS;wBACf,YAAY,EAAE,aAAa,CAAC,QAAQ,CAAC,YAAY;qBAClD;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,aAAa,CAAC,YAAY,EAAE,CAAC;gBAC/B,YAAY,CAAC,SAAS,GAAG;oBACvB,GAAG,CAAE,YAAY,CAAC,SAAoB,IAAI,EAAE,CAAC;oBAC7C,YAAY,EAAE,aAAa,CAAC,YAAY;iBACzC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB,GAAwB,EAAE,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC;gBACxB,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,QAAQ;gBACR,KAAK,EAAE,UAAU;gBACjB,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,KAAK;gBAC9C,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS;oBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;oBACnC,CAAC,CAAC,EAAE,CAAC;gBACP,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,CAAC,IAAS,EAAE,EAAE;oBAC1B,gBAAgB,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;gBACvD,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;oBACtC,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,EAAE;oBACnC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YAEH,oEAAoE;YACpE,iEAAiE;YACjE,IAAI,YAAqC,CAAC;YAE1C,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC3C,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;wBAC1B,YAAY,GAAG,KAAK,CAAC;oBACvB,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;YAC7D,MAAM,YAAY,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM;gBACJ,IAAI,EAAE,MAAM;gBACZ,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;aACnC,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC7C,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,cAAmB,CAAC;QACxB,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,qBAAqB,GAAG,wCAAwC,GAAG,EAAE,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC;QAClE,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,IAAI,GAAG,qBAAqB,MAAM,aAAa,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7C,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAChD,6EAA6E;QAC7E,IAAI,IAAI,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,OAAO;gBAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YAChD,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC/C,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClC,yEAAyE;QACzE,0EAA0E;QAC1E,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC;CACF;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,MAAM,UAAU,iBAAiB,CAC/B,QAAuB,EACvB,SAAkC,EAAE;IAEpC,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,MAA2B,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,8EAA8E;AAC9E,8EAA8E;AAC9E,KAAK,UAAU,qBAAqB,CAAC,QAAuB;IAC1D,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClC,KAAK,YAAY;YACf,OAAO,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC/C,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClC,KAAK,MAAM;YACT,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;QAChC,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACnC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAClC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAuB;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,GAClB,CAAC"}

package/dist/agent/engine/anthropic-engine.d.ts

@@ -13,7 +13,7 @@ export declare const ANTHROPIC_SUPPORTED_MODELS: readonly ["claude-opus-4-7", "c
 export declare const ANTHROPIC_DEFAULT_MODEL = "claude-sonnet-4-6";
 /**
  * Create an AnthropicEngine instance.
- * Falls back to ANTHROPIC_API_KEY env var if no key is provided.
+ * Falls back to the deployment Anthropic key if no key is provided.
  */
 export declare function createAnthropicEngine(config?: Record<string, unknown>): AgentEngine;
 //# sourceMappingURL=anthropic-engine.d.ts.map

package/dist/agent/engine/anthropic-engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anthropic-engine.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/anthropic-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAGnB,MAAM,YAAY,CAAC;AAQpB,eAAO,MAAM,sBAAsB,EAAE,kBAMpC,CAAC;AAEF,eAAO,MAAM,0BAA0B,gFAI7B,CAAC;AAEX,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAkI3D;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,WAAW,CAuBb"}
+{"version":3,"file":"anthropic-engine.d.ts","sourceRoot":"","sources":["../../../src/agent/engine/anthropic-engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAGnB,MAAM,YAAY,CAAC;AASpB,eAAO,MAAM,sBAAsB,EAAE,kBAMpC,CAAC;AAEF,eAAO,MAAM,0BAA0B,gFAI7B,CAAC;AAOX,eAAO,MAAM,uBAAuB,sBAAgB,CAAC;AAkIrD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACnC,WAAW,CAuBb"}