@agent-native/core 0.7.69 → 0.7.71

package/dist/integrations/a2a-continuation-processor.js

@@ -15,8 +15,8 @@ const MAX_REMOTE_WORK_MS = 10 * 60_000;
 const RESCHEDULE_DELAY_MS = 60_000;
 const MAX_PRE_CLAIM_WAIT_MS = 10_000;
 const POLL_INTERVAL_MS = 2_000;
-const PROCESSOR_WAIT_MS = 20_000;
-const POLL_REQUEST_TIMEOUT_MS = 25_000;
+const PROCESSOR_WAIT_MS = 10_000;
+const POLL_REQUEST_TIMEOUT_MS = 8_000;
 const PLATFORM_SEND_TIMEOUT_MS = 12_000;
 const DISPATCH_SETTLE_WAIT_MS = 2_000;
 const COMPLETE_AFTER_DELIVERY_ATTEMPTS = 3;
@@ -106,8 +106,8 @@ async function processClaimedContinuation(continuation, options) {
     }
     catch (err) {
         if (isTransientA2APollError(err)) {
-            if (isRemoteWorkExpired(continuation)) {
-                await notifyAndFailA2AContinuation(continuation, adapter, remotePollTimeoutReason(continuation));
+            if (shouldStopPollingRemoteTask(continuation)) {
+                await notifyAndFailA2AContinuation(continuation, adapter, remotePollFailureReason(continuation));
                 return;
             }
             await rescheduleA2AContinuation(continuation.id, RESCHEDULE_DELAY_MS);
@@ -126,8 +126,8 @@ async function processClaimedContinuation(continuation, options) {
             await deliverAndCompleteA2AContinuation(continuation, adapter, formatContinuationArtifactText(recoverableArtifactText, continuation.agentUrl));
             return;
         }
-        if (isRemoteWorkExpired(continuation)) {
-            await notifyAndFailA2AContinuation(continuation, adapter, `Remote A2A task ${continuation.a2aTaskId} did not complete within ${Math.round(MAX_REMOTE_WORK_MS / 60_000)} minutes`);
+        if (shouldStopPollingRemoteTask(continuation)) {
+            await notifyAndFailA2AContinuation(continuation, adapter, remotePollFailureReason(continuation));
             return;
         }
         await rescheduleA2AContinuation(continuation.id, RESCHEDULE_DELAY_MS);
@@ -218,6 +218,9 @@ function formatContinuationFailureMessage(continuation, reason) {
 function isRemoteWorkExpired(continuation) {
     return Date.now() - continuation.createdAt >= MAX_REMOTE_WORK_MS;
 }
+function shouldStopPollingRemoteTask(continuation) {
+    return (continuation.attempts >= MAX_ATTEMPTS || isRemoteWorkExpired(continuation));
+}
 function isTransientA2APollError(err) {
     if (!(err instanceof Error))
         return false;
@@ -225,8 +228,11 @@ function isTransientA2APollError(err) {
         return true;
     return /operation was aborted|aborted|timed out|timeout|Invalid or expired A2A token|A2A request failed \((?:401|508)\)/i.test(err.message);
 }
-function remotePollTimeoutReason(continuation) {
-    return `Timed out polling the ${continuation.agentName} A2A task ${continuation.a2aTaskId} after ${Math.round(MAX_REMOTE_WORK_MS / 60_000)} minutes. The downstream agent did not return a final result.`;
+function remotePollFailureReason(continuation) {
+    if (isRemoteWorkExpired(continuation)) {
+        return `Timed out polling the ${continuation.agentName} A2A task ${continuation.a2aTaskId} after ${Math.round(MAX_REMOTE_WORK_MS / 60_000)} minutes. The downstream agent did not return a final result.`;
+    }
+    return `Timed out polling the ${continuation.agentName} A2A task ${continuation.a2aTaskId} after ${MAX_ATTEMPTS} attempts. The downstream agent did not return a final result.`;
 }
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
@@ -324,7 +330,23 @@ function resolveArtifactBaseUrl() {
 function expandRelativeUrls(text, agentUrl) {
     if (!text || !agentUrl)
         return text;
-    const base = agentUrl.replace(/\/$/, "");
+    const base = publicAgentBaseUrl(agentUrl);
     return text.replace(/(^|[\s(\[<"'`])(\/[a-z0-9_-][a-z0-9_/?&=%#.,:-]*)/gi, (_match, lead, path) => `${lead}${base}${path}`);
 }
+function publicAgentBaseUrl(agentUrl) {
+    try {
+        const url = new URL(agentUrl);
+        const routeIndex = url.pathname.indexOf(FRAMEWORK_ROUTE_PREFIX);
+        url.pathname =
+            routeIndex >= 0
+                ? url.pathname.slice(0, routeIndex) || "/"
+                : url.pathname.replace(/\/+$/, "") || "/";
+        url.search = "";
+        url.hash = "";
+        return url.toString().replace(/\/$/, "");
+    }
+    catch {
+        return agentUrl.replace(/\/$/, "");
+    }
+}
 //# sourceMappingURL=a2a-continuation-processor.js.map

package/dist/integrations/a2a-continuation-processor.js.map

@@ -1 +1 @@
-{"version":3,"file":"a2a-continuation-processor.js","sourceRoot":"","sources":["../../src/integrations/a2a-continuation-processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,cAAc,GAAG,GAAG,sBAAsB,wCAAwC,CAAC;AACzF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AACvC,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,cAAsB,EACtB,cAAuB;IAEvB,MAAM,OAAO,GACX,cAAc;QACd,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,oBAAoB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;IAEjD,MAAM,GAAG,GAAG,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,cAAc,EAAE,CAAC;IACrE,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CACX,wDAAwD,cAAc,+BAA+B,CACtG,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO,CAAC,KAAK,CACX,4DAA4D,cAAc,GAAG,EAC7E,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;KACzC,CAAC;SACC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACvB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,yBAAyB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,OAAO,CAAC,KAAK,CACX,sDAAsD,cAAc,GAAG,EACvE,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,CAAC,IAAI,CAAC;QACjB,eAAe;QACf,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAC5B,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAC7C;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,cAAsB,EACtB,QAAkB;IAElB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,CAAC,KAAK,CACX,mCAAmC,cAAc,oCAAoC;QACnF,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3E,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,cAAsB,EACtB,OAAmD;IAEnD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACjE,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAChE,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,MAAM,0BAA0B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAGhD;IACC,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,0BAA0B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACpE,OAAO,CAAC,KAAK,CACX,mCAAmC,YAAY,CAAC,EAAE,UAAU,EAC5D,GAAG,CACJ,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,YAA6B,EAC7B,OAAmD;IAEnD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,mBAAmB,CACvB,YAAY,CAAC,EAAE,EACf,qBAAqB,YAAY,CAAC,QAAQ,EAAE,CAC7C,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,YAAY,CAAC,QAAQ,EACrB,MAAM,qBAAqB,CAAC,YAAY,CAAC,EACzC,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,CAC9C,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;IAChD,IAAI,IAAI,GAAgB,IAAI,CAAC;IAE7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM;YAClD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;gBACtC,MAAM,4BAA4B,CAChC,YAAY,EACZ,OAAO,EACP,uBAAuB,CAAC,YAAY,CAAC,CACtC,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;YAC1C,MAAM,4BAA4B,CAChC,YAAY,EACZ,OAAO,EACP,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,uBAAuB,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,uBAAuB,EAAE,CAAC;YAC5B,MAAM,iCAAiC,CACrC,YAAY,EACZ,OAAO,EACP,8BAA8B,CAC5B,uBAAuB,EACvB,YAAY,CAAC,QAAQ,CACtB,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,MAAM,4BAA4B,CAChC,YAAY,EACZ,OAAO,EACP,mBAAmB,YAAY,CAAC,SAAS,4BAA4B,IAAI,CAAC,KAAK,CAC7E,kBAAkB,GAAG,MAAM,CAC5B,UAAU,CACZ,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACtC,MAAM,MAAM,GACV,eAAe,CAAC,IAAI,CAAC;YACrB,mBAAmB,YAAY,CAAC,SAAS,qBAAqB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpF,MAAM,4BAA4B,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,8BAA8B,CACzC,eAAe,CAAC,IAAI,CAAC,EACrB,YAAY,CAAC,QAAQ,CACtB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,MAAM,4BAA4B,CAChC,YAAY,EACZ,OAAO,EACP,mBAAmB,YAAY,CAAC,SAAS,yBAAyB,CACnE,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,iCAAiC,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,cAAsB;IAEtB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAC9D,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,YAAY,CAAC,MAAM,KAAK,WAAW,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrD,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7B,IAAI,MAAM,GAAG,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAEjD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,YAA6B,EAC7B,OAAwB,EACxB,MAAc;IAEd,MAAM,oBAAoB,GAAG,MAAM,4BAA4B,CAC7D,YAAY,CAAC,EAAE,CAChB,CAAC;IACF,IAAI,CAAC,oBAAoB;QAAE,OAAO;IAElC,MAAM,OAAO,GAAG,gCAAgC,CAC9C,oBAAoB,EACpB,MAAM,CACP,CAAC;IACF,IAAI,CAAC;QACH,MAAM,WAAW,CACf,OAAO,CAAC,YAAY,CAClB,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,EACpC,oBAAoB,CAAC,QAAQ,EAC7B,EAAE,cAAc,EAAE,oBAAoB,CAAC,cAAc,IAAI,SAAS,EAAE,CACrE,EACD,wBAAwB,EACxB,GAAG,oBAAoB,CAAC,QAAQ,iCAAiC,CAClE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,mCAAmC,oBAAoB,CAAC,QAAQ,kCAAkC,oBAAoB,CAAC,EAAE,GAAG,EAC5H,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,YAA6B,EAC7B,OAAwB,EACxB,IAAY;IAEZ,MAAM,oBAAoB,GAAG,MAAM,4BAA4B,CAC7D,YAAY,CAAC,EAAE,CAChB,CAAC;IACF,IAAI,CAAC,oBAAoB;QAAE,OAAO;IAElC,IAAI,CAAC;QACH,MAAM,WAAW,CACf,OAAO,CAAC,YAAY,CAClB,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,EACjC,oBAAoB,CAAC,QAAQ,EAC7B,EAAE,cAAc,EAAE,oBAAoB,CAAC,cAAc,IAAI,SAAS,EAAE,CACrE,EACD,wBAAwB,EACxB,GAAG,oBAAoB,CAAC,QAAQ,8BAA8B,CAC/D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,oBAAoB,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;YAClD,MAAM,mBAAmB,CACvB,oBAAoB,CAAC,EAAE,EACvB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAC7B,oBAAoB,CAAC,EAAE,EACvB,mBAAmB,CACpB,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,+BAA+B,CAAC,oBAAoB,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,YAA6B;IAE7B,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gCAAgC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CACX,kBAAkB,YAAY,CAAC,QAAQ,8BAA8B,YAAY,CAAC,EAAE,IAAI;QACtF,wFAAwF,EAC1F,SAAS,CACV,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,YAA6B,EAC7B,MAAc;IAEd,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,+BAA+B,CAAC;YACrC,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,YAAY,CAAC,SAAS,yCAAyC,qBAAqB,CAChG,MAAM,CACP,EAAE,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,YAA6B;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,SAAS,IAAI,kBAAkB,CAAC;AACnE,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAY;IAC3C,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,kHAAkH,CAAC,IAAI,CAC5H,GAAG,CAAC,OAAO,CACZ,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,YAA6B;IAC5D,OAAO,yBAAyB,YAAY,CAAC,SAAS,aAAa,YAAY,CAAC,SAAS,UAAU,IAAI,CAAC,KAAK,CAC3G,kBAAkB,GAAG,MAAM,CAC5B,+DAA+D,CAAC;AACnE,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAmB,EACnB,SAAiB,EACjB,OAAe;IAEf,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO;YACP,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAClE,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CACrC,0DAA0D,EAC1D,uBAAuB,CACxB,CAAC;IACF,OAAO,CACL,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC7B,8CAA8C,CAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,YAA6B;IAE7B,IAAI,YAAY,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC;IAC9C,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAEjE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAClE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAEnC,4EAA4E;IAC5E,4EAA4E;IAC5E,0CAA0C;IAC1C,IAAI,WAAW,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,YAA6B;IAE7B,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GACrC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACpC,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YAClE,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE;YACvE,SAAS,EAAE,KAAK;YAChB,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,eAAe,CAAC,IAAU;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;IAC/C,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE;QACvD,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;IAC/D,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,8BAA8B,CAAC,IAAiB;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC;QACrE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,8BAA8B,CACrC,IAAY,EACZ,QAAgB;IAEhB,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxD,OAAO,sBAAsB,CAC3B,YAAY,EACZ,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAC9C,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACnE,OAAO,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IACxD,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,OAAO,CACjB,qDAAqD,EACrD,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAChD,CAAC;AACJ,CAAC","sourcesContent":["import { A2AClient, signA2AToken } from \"../a2a/client.js\";\nimport { appendA2AArtifactLinks } from \"../a2a/artifact-response.js\";\nimport type { Task } from \"../a2a/types.js\";\nimport { withConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport { FRAMEWORK_ROUTE_PREFIX } from \"../server/core-routes-plugin.js\";\nimport { signInternalToken } from \"./internal-token.js\";\nimport type { PlatformAdapter } from \"./types.js\";\nimport {\n  formatLlmCredentialErrorMessage,\n  isLlmCredentialError,\n} from \"../agent/engine/credential-errors.js\";\nimport {\n  claimA2AContinuation,\n  claimA2AContinuationDelivery,\n  claimDueA2AContinuations,\n  completeA2AContinuation,\n  failA2AContinuation,\n  getA2AContinuation,\n  rescheduleA2AContinuation,\n  type A2AContinuation,\n} from \"./a2a-continuations-store.js\";\n\nconst PROCESSOR_PATH = `${FRAMEWORK_ROUTE_PREFIX}/integrations/process-a2a-continuation`;\nconst TERMINAL_STATES = new Set([\"completed\", \"failed\", \"canceled\"]);\nconst MAX_ATTEMPTS = 6;\nconst MAX_REMOTE_WORK_MS = 10 * 60_000;\n// Do not chain immediate self-dispatches for long-running remote A2A tasks.\n// Netlify and similar hosts can reject repeated same-site self-invocations\n// with loop-protection responses. The integration retry job sweeps due rows.\nconst RESCHEDULE_DELAY_MS = 60_000;\nconst MAX_PRE_CLAIM_WAIT_MS = 10_000;\nconst POLL_INTERVAL_MS = 2_000;\nconst PROCESSOR_WAIT_MS = 20_000;\nconst POLL_REQUEST_TIMEOUT_MS = 25_000;\nconst PLATFORM_SEND_TIMEOUT_MS = 12_000;\nconst DISPATCH_SETTLE_WAIT_MS = 2_000;\nconst COMPLETE_AFTER_DELIVERY_ATTEMPTS = 3;\n\nexport async function dispatchA2AContinuation(\n  continuationId: string,\n  webhookBaseUrl?: string,\n): Promise<void> {\n  const baseUrl =\n    webhookBaseUrl ||\n    process.env.WEBHOOK_BASE_URL ||\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    `http://localhost:${process.env.PORT || 3000}`;\n\n  const url = `${withConfiguredAppBasePath(baseUrl)}${PROCESSOR_PATH}`;\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n  };\n  try {\n    headers[\"Authorization\"] = `Bearer ${signInternalToken(continuationId)}`;\n  } catch (err) {\n    if (process.env.NODE_ENV === \"production\") {\n      console.error(\n        `[integrations] Refusing to dispatch A2A continuation ${continuationId} — A2A_SECRET not configured.`,\n      );\n      return;\n    }\n    if (err instanceof Error && !/A2A_SECRET/i.test(err.message)) {\n      console.error(\n        `[integrations] signInternalToken failed unexpectedly for ${continuationId}:`,\n        err,\n      );\n    }\n  }\n\n  const dispatchPromise = fetch(url, {\n    method: \"POST\",\n    headers,\n    body: JSON.stringify({ continuationId }),\n  })\n    .then(async (response) => {\n      if (!response.ok) {\n        await logFailedDispatchResponse(continuationId, response);\n      }\n    })\n    .catch((err) => {\n      console.error(\n        `[integrations] Failed to dispatch A2A continuation ${continuationId}:`,\n        err,\n      );\n    });\n\n  await Promise.race([\n    dispatchPromise,\n    new Promise<void>((resolve) =>\n      setTimeout(resolve, DISPATCH_SETTLE_WAIT_MS),\n    ),\n  ]);\n}\n\nasync function logFailedDispatchResponse(\n  continuationId: string,\n  response: Response,\n): Promise<void> {\n  let body = \"\";\n  try {\n    body = await response.text();\n  } catch {}\n\n  const trimmedBody = body.trim();\n  console.error(\n    `[integrations] A2A continuation ${continuationId} processor dispatch returned HTTP ` +\n      `${response.status}${response.statusText ? ` ${response.statusText}` : \"\"}` +\n      `${trimmedBody ? `: ${trimmedBody.slice(0, 500)}` : \"\"}`,\n  );\n}\n\nexport async function processA2AContinuationById(\n  continuationId: string,\n  options: { adapters: Map<string, PlatformAdapter> },\n): Promise<void> {\n  const shouldClaim = await waitForContinuationDue(continuationId);\n  if (!shouldClaim) return;\n  const continuation = await claimA2AContinuation(continuationId);\n  if (!continuation) return;\n  await processClaimedContinuation(continuation, options);\n}\n\nexport async function processDueA2AContinuations(options: {\n  adapters: Map<string, PlatformAdapter>;\n  limit?: number;\n}): Promise<void> {\n  const continuations = await claimDueA2AContinuations(options.limit ?? 5);\n  for (const continuation of continuations) {\n    await processClaimedContinuation(continuation, options).catch((err) =>\n      console.error(\n        `[integrations] A2A continuation ${continuation.id} failed:`,\n        err,\n      ),\n    );\n  }\n}\n\nasync function processClaimedContinuation(\n  continuation: A2AContinuation,\n  options: { adapters: Map<string, PlatformAdapter> },\n): Promise<void> {\n  const adapter = options.adapters.get(continuation.platform);\n  if (!adapter) {\n    await failA2AContinuation(\n      continuation.id,\n      `Unknown platform: ${continuation.platform}`,\n    );\n    return;\n  }\n\n  const client = new A2AClient(\n    continuation.agentUrl,\n    await signContinuationToken(continuation),\n    { requestTimeoutMs: POLL_REQUEST_TIMEOUT_MS },\n  );\n  const deadline = Date.now() + PROCESSOR_WAIT_MS;\n  let task: Task | null = null;\n\n  try {\n    while (Date.now() < deadline) {\n      task = await client.getTask(continuation.a2aTaskId);\n      if (TERMINAL_STATES.has(task.status.state)) break;\n      await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));\n    }\n  } catch (err) {\n    if (isTransientA2APollError(err)) {\n      if (isRemoteWorkExpired(continuation)) {\n        await notifyAndFailA2AContinuation(\n          continuation,\n          adapter,\n          remotePollTimeoutReason(continuation),\n        );\n        return;\n      }\n      await rescheduleA2AContinuation(continuation.id, RESCHEDULE_DELAY_MS);\n      return;\n    }\n    if (continuation.attempts >= MAX_ATTEMPTS) {\n      await notifyAndFailA2AContinuation(\n        continuation,\n        adapter,\n        err instanceof Error ? err.message : String(err),\n      );\n      return;\n    }\n    await rescheduleA2AContinuation(continuation.id, RESCHEDULE_DELAY_MS);\n    return;\n  }\n\n  if (!task || !TERMINAL_STATES.has(task.status.state)) {\n    const recoverableArtifactText = extractRecoverableArtifactText(task);\n    if (recoverableArtifactText) {\n      await deliverAndCompleteA2AContinuation(\n        continuation,\n        adapter,\n        formatContinuationArtifactText(\n          recoverableArtifactText,\n          continuation.agentUrl,\n        ),\n      );\n      return;\n    }\n\n    if (isRemoteWorkExpired(continuation)) {\n      await notifyAndFailA2AContinuation(\n        continuation,\n        adapter,\n        `Remote A2A task ${continuation.a2aTaskId} did not complete within ${Math.round(\n          MAX_REMOTE_WORK_MS / 60_000,\n        )} minutes`,\n      );\n      return;\n    }\n    await rescheduleA2AContinuation(continuation.id, RESCHEDULE_DELAY_MS);\n    return;\n  }\n\n  if (task.status.state !== \"completed\") {\n    const reason =\n      extractTaskText(task) ||\n      `Remote A2A task ${continuation.a2aTaskId} ended with state ${task.status.state}`;\n    await notifyAndFailA2AContinuation(continuation, adapter, reason);\n    return;\n  }\n\n  const text = formatContinuationArtifactText(\n    extractTaskText(task),\n    continuation.agentUrl,\n  );\n  if (!text.trim()) {\n    await notifyAndFailA2AContinuation(\n      continuation,\n      adapter,\n      `Remote A2A task ${continuation.a2aTaskId} completed without text`,\n    );\n    return;\n  }\n\n  await deliverAndCompleteA2AContinuation(continuation, adapter, text);\n}\n\nasync function waitForContinuationDue(\n  continuationId: string,\n): Promise<boolean> {\n  const continuation = await getA2AContinuation(continuationId);\n  if (!continuation) return false;\n  if (continuation.status === \"completed\" || continuation.status === \"failed\") {\n    return false;\n  }\n  if (continuation.status !== \"pending\") return true;\n\n  const waitMs = continuation.nextCheckAt - Date.now();\n  if (waitMs <= 0) return true;\n\n  if (waitMs > MAX_PRE_CLAIM_WAIT_MS) return false;\n\n  await sleep(waitMs);\n  return true;\n}\n\nasync function notifyAndFailA2AContinuation(\n  continuation: A2AContinuation,\n  adapter: PlatformAdapter,\n  reason: string,\n): Promise<void> {\n  const deliveryContinuation = await claimA2AContinuationDelivery(\n    continuation.id,\n  );\n  if (!deliveryContinuation) return;\n\n  const message = formatContinuationFailureMessage(\n    deliveryContinuation,\n    reason,\n  );\n  try {\n    await withTimeout(\n      adapter.sendResponse(\n        adapter.formatAgentResponse(message),\n        deliveryContinuation.incoming,\n        { placeholderRef: deliveryContinuation.placeholderRef ?? undefined },\n      ),\n      PLATFORM_SEND_TIMEOUT_MS,\n      `${deliveryContinuation.platform} failure notification timed out`,\n    );\n  } catch (err) {\n    console.error(\n      `[integrations] Failed to notify ${deliveryContinuation.platform} about failed A2A continuation ${deliveryContinuation.id}:`,\n      err,\n    );\n  }\n\n  await failA2AContinuation(deliveryContinuation.id, reason);\n}\n\nasync function deliverAndCompleteA2AContinuation(\n  continuation: A2AContinuation,\n  adapter: PlatformAdapter,\n  text: string,\n): Promise<void> {\n  const deliveryContinuation = await claimA2AContinuationDelivery(\n    continuation.id,\n  );\n  if (!deliveryContinuation) return;\n\n  try {\n    await withTimeout(\n      adapter.sendResponse(\n        adapter.formatAgentResponse(text),\n        deliveryContinuation.incoming,\n        { placeholderRef: deliveryContinuation.placeholderRef ?? undefined },\n      ),\n      PLATFORM_SEND_TIMEOUT_MS,\n      `${deliveryContinuation.platform} response delivery timed out`,\n    );\n  } catch (err) {\n    if (deliveryContinuation.attempts >= MAX_ATTEMPTS) {\n      await failA2AContinuation(\n        deliveryContinuation.id,\n        err instanceof Error ? err.message : String(err),\n      );\n      return;\n    }\n    await rescheduleA2AContinuation(\n      deliveryContinuation.id,\n      RESCHEDULE_DELAY_MS,\n    );\n    return;\n  }\n\n  await completeAfterSuccessfulDelivery(deliveryContinuation);\n}\n\nasync function completeAfterSuccessfulDelivery(\n  continuation: A2AContinuation,\n): Promise<void> {\n  let lastError: unknown;\n  for (let attempt = 0; attempt < COMPLETE_AFTER_DELIVERY_ATTEMPTS; attempt++) {\n    try {\n      await completeA2AContinuation(continuation.id);\n      return;\n    } catch (err) {\n      lastError = err;\n    }\n  }\n\n  console.error(\n    `[integrations] ${continuation.platform} accepted A2A continuation ${continuation.id}, ` +\n      \"but marking it completed failed. Leaving it in delivering for stale-delivery recovery.\",\n    lastError,\n  );\n}\n\nfunction formatContinuationFailureMessage(\n  continuation: A2AContinuation,\n  reason: string,\n): string {\n  if (isLlmCredentialError(reason)) {\n    return formatLlmCredentialErrorMessage({\n      agentName: continuation.agentName,\n    });\n  }\n\n  return `The ${continuation.agentName} agent could not finish this request: ${sanitizeFailureReason(\n    reason,\n  )}`;\n}\n\nfunction isRemoteWorkExpired(continuation: A2AContinuation): boolean {\n  return Date.now() - continuation.createdAt >= MAX_REMOTE_WORK_MS;\n}\n\nfunction isTransientA2APollError(err: unknown): boolean {\n  if (!(err instanceof Error)) return false;\n  if (err.name === \"AbortError\") return true;\n  return /operation was aborted|aborted|timed out|timeout|Invalid or expired A2A token|A2A request failed \\((?:401|508)\\)/i.test(\n    err.message,\n  );\n}\n\nfunction remotePollTimeoutReason(continuation: A2AContinuation): string {\n  return `Timed out polling the ${continuation.agentName} A2A task ${continuation.a2aTaskId} after ${Math.round(\n    MAX_REMOTE_WORK_MS / 60_000,\n  )} minutes. The downstream agent did not return a final result.`;\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nasync function withTimeout<T>(\n  promise: Promise<T>,\n  timeoutMs: number,\n  message: string,\n): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => reject(new Error(message)), timeoutMs);\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nfunction sanitizeFailureReason(reason: string): string {\n  const oneLine = reason.replace(/\\s+/g, \" \").trim();\n  const withoutEnvNames = oneLine.replace(\n    /\\b[A-Z][A-Z0-9_]*(?:API_KEY|PRIVATE_KEY|SECRET|TOKEN)\\b/g,\n    \"a required credential\",\n  );\n  return (\n    withoutEnvNames.slice(0, 500) ||\n    \"the downstream agent returned an empty error\"\n  );\n}\n\nasync function signContinuationToken(\n  continuation: A2AContinuation,\n): Promise<string | undefined> {\n  if (continuation.a2aAuthToken === \"\") {\n    return undefined;\n  }\n\n  const storedToken = continuation.a2aAuthToken;\n  if (storedToken && !isLikelyJwt(storedToken)) return storedToken;\n\n  const freshToken = await signFreshContinuationToken(continuation);\n  if (freshToken) return freshToken;\n  if (!storedToken) return undefined;\n\n  // Older continuations may have persisted the initial short-lived JWT. Avoid\n  // replaying it forever after expiry; opaque legacy bearer keys can still be\n  // reused because we cannot re-mint those.\n  if (isLikelyJwt(storedToken)) return undefined;\n  return storedToken;\n}\n\nasync function signFreshContinuationToken(\n  continuation: A2AContinuation,\n): Promise<string | undefined> {\n  let orgDomain: string | undefined;\n  let orgSecret: string | undefined;\n  if (continuation.orgId) {\n    try {\n      const { getOrgDomain, getOrgA2ASecret } =\n        await import(\"../org/context.js\");\n      orgDomain = (await getOrgDomain(continuation.orgId)) ?? undefined;\n      orgSecret = (await getOrgA2ASecret(continuation.orgId)) ?? undefined;\n    } catch {}\n  }\n\n  if (!continuation.ownerEmail || !(orgSecret || process.env.A2A_SECRET)) {\n    return undefined;\n  }\n\n  try {\n    return await signA2AToken(continuation.ownerEmail, orgDomain, orgSecret, {\n      expiresIn: \"30m\",\n      preferGlobalSecret: true,\n    });\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isLikelyJwt(token: string): boolean {\n  return token.split(\".\").length === 3;\n}\n\nfunction extractTaskText(task: Task): string {\n  const parts = task.status.message?.parts ?? [];\n  return parts\n    .filter((part): part is { type: \"text\"; text: string } => {\n      return part.type === \"text\" && typeof part.text === \"string\";\n    })\n    .map((part) => part.text)\n    .join(\"\\n\");\n}\n\nfunction extractRecoverableArtifactText(task: Task | null): string {\n  if (!task?.status.message?.metadata?.agentNativeRecoverableArtifacts) {\n    return \"\";\n  }\n  return extractTaskText(task);\n}\n\nfunction formatContinuationArtifactText(\n  text: string,\n  agentUrl: string,\n): string {\n  const expandedText = expandRelativeUrls(text, agentUrl);\n  return appendA2AArtifactLinks(\n    expandedText,\n    [{ tool: \"call-agent\", result: expandedText }],\n    { baseUrl: resolveArtifactBaseUrl() },\n  );\n}\n\nfunction resolveArtifactBaseUrl(): string | undefined {\n  const baseUrl =\n    process.env.APP_URL || process.env.URL || process.env.DEPLOY_URL;\n  return baseUrl ? withConfiguredAppBasePath(baseUrl) : undefined;\n}\n\nfunction expandRelativeUrls(text: string, agentUrl: string): string {\n  if (!text || !agentUrl) return text;\n  const base = agentUrl.replace(/\\/$/, \"\");\n  return text.replace(\n    /(^|[\\s(\\[<\"'`])(\\/[a-z0-9_-][a-z0-9_/?&=%#.,:-]*)/gi,\n    (_match, lead, path) => `${lead}${base}${path}`,\n  );\n}\n"]}
+{"version":3,"file":"a2a-continuation-processor.js","sourceRoot":"","sources":["../../src/integrations/a2a-continuation-processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,cAAc,GAAG,GAAG,sBAAsB,wCAAwC,CAAC;AACzF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AACvC,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAE3C,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,cAAsB,EACtB,cAAuB;IAEvB,MAAM,OAAO,GACX,cAAc;QACd,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,oBAAoB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;IAEjD,MAAM,GAAG,GAAG,GAAG,yBAAyB,CAAC,OAAO,CAAC,GAAG,cAAc,EAAE,CAAC;IACrE,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CACX,wDAAwD,cAAc,+BAA+B,CACtG,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO,CAAC,KAAK,CACX,4DAA4D,cAAc,GAAG,EAC7E,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;KACzC,CAAC;SACC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;QACvB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,yBAAyB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,OAAO,CAAC,KAAK,CACX,sDAAsD,cAAc,GAAG,EACvE,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,OAAO,CAAC,IAAI,CAAC;QACjB,eAAe;QACf,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAC5B,UAAU,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAC7C;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,cAAsB,EACtB,QAAkB;IAElB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,OAAO,CAAC,KAAK,CACX,mCAAmC,cAAc,oCAAoC;QACnF,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3E,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,cAAsB,EACtB,OAAmD;IAEnD,MAAM,WAAW,GAAG,MAAM,sBAAsB,CAAC,cAAc,CAAC,CAAC;IACjE,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAChE,IAAI,CAAC,YAAY;QAAE,OAAO;IAC1B,MAAM,0BAA0B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,OAGhD;IACC,MAAM,aAAa,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,0BAA0B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CACpE,OAAO,CAAC,KAAK,CACX,mCAAmC,YAAY,CAAC,EAAE,UAAU,EAC5D,GAAG,CACJ,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,YAA6B,EAC7B,OAAmD;IAEnD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,mBAAmB,CACvB,YAAY,CAAC,EAAE,EACf,qBAAqB,YAAY,CAAC,QAAQ,EAAE,CAC7C,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,YAAY,CAAC,QAAQ,EACrB,MAAM,qBAAqB,CAAC,YAAY,CAAC,EACzC,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,CAC9C,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;IAChD,IAAI,IAAI,GAAgB,IAAI,CAAC;IAE7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAAE,MAAM;YAClD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,IAAI,2BAA2B,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC9C,MAAM,4BAA4B,CAChC,YAAY,EACZ,OAAO,EACP,uBAAuB,CAAC,YAAY,CAAC,CACtC,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QACD,IAAI,YAAY,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;YAC1C,MAAM,4BAA4B,CAChC,YAAY,EACZ,OAAO,EACP,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,uBAAuB,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,uBAAuB,EAAE,CAAC;YAC5B,MAAM,iCAAiC,CACrC,YAAY,EACZ,OAAO,EACP,8BAA8B,CAC5B,uBAAuB,EACvB,YAAY,CAAC,QAAQ,CACtB,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,2BAA2B,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9C,MAAM,4BAA4B,CAChC,YAAY,EACZ,OAAO,EACP,uBAAuB,CAAC,YAAY,CAAC,CACtC,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAAC,YAAY,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACtC,MAAM,MAAM,GACV,eAAe,CAAC,IAAI,CAAC;YACrB,mBAAmB,YAAY,CAAC,SAAS,qBAAqB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpF,MAAM,4BAA4B,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,8BAA8B,CACzC,eAAe,CAAC,IAAI,CAAC,EACrB,YAAY,CAAC,QAAQ,CACtB,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,MAAM,4BAA4B,CAChC,YAAY,EACZ,OAAO,EACP,mBAAmB,YAAY,CAAC,SAAS,yBAAyB,CACnE,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,iCAAiC,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,cAAsB;IAEtB,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAC9D,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,YAAY,CAAC,MAAM,KAAK,WAAW,IAAI,YAAY,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrD,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7B,IAAI,MAAM,GAAG,qBAAqB;QAAE,OAAO,KAAK,CAAC;IAEjD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,YAA6B,EAC7B,OAAwB,EACxB,MAAc;IAEd,MAAM,oBAAoB,GAAG,MAAM,4BAA4B,CAC7D,YAAY,CAAC,EAAE,CAChB,CAAC;IACF,IAAI,CAAC,oBAAoB;QAAE,OAAO;IAElC,MAAM,OAAO,GAAG,gCAAgC,CAC9C,oBAAoB,EACpB,MAAM,CACP,CAAC;IACF,IAAI,CAAC;QACH,MAAM,WAAW,CACf,OAAO,CAAC,YAAY,CAClB,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,EACpC,oBAAoB,CAAC,QAAQ,EAC7B,EAAE,cAAc,EAAE,oBAAoB,CAAC,cAAc,IAAI,SAAS,EAAE,CACrE,EACD,wBAAwB,EACxB,GAAG,oBAAoB,CAAC,QAAQ,iCAAiC,CAClE,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,mCAAmC,oBAAoB,CAAC,QAAQ,kCAAkC,oBAAoB,CAAC,EAAE,GAAG,EAC5H,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,iCAAiC,CAC9C,YAA6B,EAC7B,OAAwB,EACxB,IAAY;IAEZ,MAAM,oBAAoB,GAAG,MAAM,4BAA4B,CAC7D,YAAY,CAAC,EAAE,CAChB,CAAC;IACF,IAAI,CAAC,oBAAoB;QAAE,OAAO;IAElC,IAAI,CAAC;QACH,MAAM,WAAW,CACf,OAAO,CAAC,YAAY,CAClB,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,EACjC,oBAAoB,CAAC,QAAQ,EAC7B,EAAE,cAAc,EAAE,oBAAoB,CAAC,cAAc,IAAI,SAAS,EAAE,CACrE,EACD,wBAAwB,EACxB,GAAG,oBAAoB,CAAC,QAAQ,8BAA8B,CAC/D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,oBAAoB,CAAC,QAAQ,IAAI,YAAY,EAAE,CAAC;YAClD,MAAM,mBAAmB,CACvB,oBAAoB,CAAC,EAAE,EACvB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,yBAAyB,CAC7B,oBAAoB,CAAC,EAAE,EACvB,mBAAmB,CACpB,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,+BAA+B,CAAC,oBAAoB,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,YAA6B;IAE7B,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,gCAAgC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CACX,kBAAkB,YAAY,CAAC,QAAQ,8BAA8B,YAAY,CAAC,EAAE,IAAI;QACtF,wFAAwF,EAC1F,SAAS,CACV,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,YAA6B,EAC7B,MAAc;IAEd,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,+BAA+B,CAAC;YACrC,SAAS,EAAE,YAAY,CAAC,SAAS;SAClC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,YAAY,CAAC,SAAS,yCAAyC,qBAAqB,CAChG,MAAM,CACP,EAAE,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,YAA6B;IACxD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,SAAS,IAAI,kBAAkB,CAAC;AACnE,CAAC;AAED,SAAS,2BAA2B,CAAC,YAA6B;IAChE,OAAO,CACL,YAAY,CAAC,QAAQ,IAAI,YAAY,IAAI,mBAAmB,CAAC,YAAY,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAY;IAC3C,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,kHAAkH,CAAC,IAAI,CAC5H,GAAG,CAAC,OAAO,CACZ,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,YAA6B;IAC5D,IAAI,mBAAmB,CAAC,YAAY,CAAC,EAAE,CAAC;QACtC,OAAO,yBAAyB,YAAY,CAAC,SAAS,aAAa,YAAY,CAAC,SAAS,UAAU,IAAI,CAAC,KAAK,CAC3G,kBAAkB,GAAG,MAAM,CAC5B,+DAA+D,CAAC;IACnE,CAAC;IAED,OAAO,yBAAyB,YAAY,CAAC,SAAS,aAAa,YAAY,CAAC,SAAS,UAAU,YAAY,gEAAgE,CAAC;AAClL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAmB,EACnB,SAAiB,EACjB,OAAe;IAEf,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,OAAO;YACP,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAClE,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CACrC,0DAA0D,EAC1D,uBAAuB,CACxB,CAAC;IACF,OAAO,CACL,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC7B,8CAA8C,CAC/C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,YAA6B;IAE7B,IAAI,YAAY,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAC,YAAY,CAAC;IAC9C,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAEjE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAClE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAEnC,4EAA4E;IAC5E,4EAA4E;IAC5E,0CAA0C;IAC1C,IAAI,WAAW,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,YAA6B;IAE7B,IAAI,SAA6B,CAAC;IAClC,IAAI,SAA6B,CAAC;IAClC,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GACrC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACpC,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;YAClE,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,SAAS,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,YAAY,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE;YACvE,SAAS,EAAE,KAAK;YAChB,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,eAAe,CAAC,IAAU;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;IAC/C,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,IAAI,EAA0C,EAAE;QACvD,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;IAC/D,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,8BAA8B,CAAC,IAAiB;IACvD,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,+BAA+B,EAAE,CAAC;QACrE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,8BAA8B,CACrC,IAAY,EACZ,QAAgB;IAEhB,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxD,OAAO,sBAAsB,CAC3B,YAAY,EACZ,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,EAC9C,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACnE,OAAO,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IACxD,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,OAAO,CACjB,qDAAqD,EACrD,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAChE,GAAG,CAAC,QAAQ;YACV,UAAU,IAAI,CAAC;gBACb,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,GAAG;gBAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QAC9C,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrC,CAAC;AACH,CAAC","sourcesContent":["import { A2AClient, signA2AToken } from \"../a2a/client.js\";\nimport { appendA2AArtifactLinks } from \"../a2a/artifact-response.js\";\nimport type { Task } from \"../a2a/types.js\";\nimport { withConfiguredAppBasePath } from \"../server/app-base-path.js\";\nimport { FRAMEWORK_ROUTE_PREFIX } from \"../server/core-routes-plugin.js\";\nimport { signInternalToken } from \"./internal-token.js\";\nimport type { PlatformAdapter } from \"./types.js\";\nimport {\n  formatLlmCredentialErrorMessage,\n  isLlmCredentialError,\n} from \"../agent/engine/credential-errors.js\";\nimport {\n  claimA2AContinuation,\n  claimA2AContinuationDelivery,\n  claimDueA2AContinuations,\n  completeA2AContinuation,\n  failA2AContinuation,\n  getA2AContinuation,\n  rescheduleA2AContinuation,\n  type A2AContinuation,\n} from \"./a2a-continuations-store.js\";\n\nconst PROCESSOR_PATH = `${FRAMEWORK_ROUTE_PREFIX}/integrations/process-a2a-continuation`;\nconst TERMINAL_STATES = new Set([\"completed\", \"failed\", \"canceled\"]);\nconst MAX_ATTEMPTS = 6;\nconst MAX_REMOTE_WORK_MS = 10 * 60_000;\n// Do not chain immediate self-dispatches for long-running remote A2A tasks.\n// Netlify and similar hosts can reject repeated same-site self-invocations\n// with loop-protection responses. The integration retry job sweeps due rows.\nconst RESCHEDULE_DELAY_MS = 60_000;\nconst MAX_PRE_CLAIM_WAIT_MS = 10_000;\nconst POLL_INTERVAL_MS = 2_000;\nconst PROCESSOR_WAIT_MS = 10_000;\nconst POLL_REQUEST_TIMEOUT_MS = 8_000;\nconst PLATFORM_SEND_TIMEOUT_MS = 12_000;\nconst DISPATCH_SETTLE_WAIT_MS = 2_000;\nconst COMPLETE_AFTER_DELIVERY_ATTEMPTS = 3;\n\nexport async function dispatchA2AContinuation(\n  continuationId: string,\n  webhookBaseUrl?: string,\n): Promise<void> {\n  const baseUrl =\n    webhookBaseUrl ||\n    process.env.WEBHOOK_BASE_URL ||\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    `http://localhost:${process.env.PORT || 3000}`;\n\n  const url = `${withConfiguredAppBasePath(baseUrl)}${PROCESSOR_PATH}`;\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n  };\n  try {\n    headers[\"Authorization\"] = `Bearer ${signInternalToken(continuationId)}`;\n  } catch (err) {\n    if (process.env.NODE_ENV === \"production\") {\n      console.error(\n        `[integrations] Refusing to dispatch A2A continuation ${continuationId} — A2A_SECRET not configured.`,\n      );\n      return;\n    }\n    if (err instanceof Error && !/A2A_SECRET/i.test(err.message)) {\n      console.error(\n        `[integrations] signInternalToken failed unexpectedly for ${continuationId}:`,\n        err,\n      );\n    }\n  }\n\n  const dispatchPromise = fetch(url, {\n    method: \"POST\",\n    headers,\n    body: JSON.stringify({ continuationId }),\n  })\n    .then(async (response) => {\n      if (!response.ok) {\n        await logFailedDispatchResponse(continuationId, response);\n      }\n    })\n    .catch((err) => {\n      console.error(\n        `[integrations] Failed to dispatch A2A continuation ${continuationId}:`,\n        err,\n      );\n    });\n\n  await Promise.race([\n    dispatchPromise,\n    new Promise<void>((resolve) =>\n      setTimeout(resolve, DISPATCH_SETTLE_WAIT_MS),\n    ),\n  ]);\n}\n\nasync function logFailedDispatchResponse(\n  continuationId: string,\n  response: Response,\n): Promise<void> {\n  let body = \"\";\n  try {\n    body = await response.text();\n  } catch {}\n\n  const trimmedBody = body.trim();\n  console.error(\n    `[integrations] A2A continuation ${continuationId} processor dispatch returned HTTP ` +\n      `${response.status}${response.statusText ? ` ${response.statusText}` : \"\"}` +\n      `${trimmedBody ? `: ${trimmedBody.slice(0, 500)}` : \"\"}`,\n  );\n}\n\nexport async function processA2AContinuationById(\n  continuationId: string,\n  options: { adapters: Map<string, PlatformAdapter> },\n): Promise<void> {\n  const shouldClaim = await waitForContinuationDue(continuationId);\n  if (!shouldClaim) return;\n  const continuation = await claimA2AContinuation(continuationId);\n  if (!continuation) return;\n  await processClaimedContinuation(continuation, options);\n}\n\nexport async function processDueA2AContinuations(options: {\n  adapters: Map<string, PlatformAdapter>;\n  limit?: number;\n}): Promise<void> {\n  const continuations = await claimDueA2AContinuations(options.limit ?? 5);\n  for (const continuation of continuations) {\n    await processClaimedContinuation(continuation, options).catch((err) =>\n      console.error(\n        `[integrations] A2A continuation ${continuation.id} failed:`,\n        err,\n      ),\n    );\n  }\n}\n\nasync function processClaimedContinuation(\n  continuation: A2AContinuation,\n  options: { adapters: Map<string, PlatformAdapter> },\n): Promise<void> {\n  const adapter = options.adapters.get(continuation.platform);\n  if (!adapter) {\n    await failA2AContinuation(\n      continuation.id,\n      `Unknown platform: ${continuation.platform}`,\n    );\n    return;\n  }\n\n  const client = new A2AClient(\n    continuation.agentUrl,\n    await signContinuationToken(continuation),\n    { requestTimeoutMs: POLL_REQUEST_TIMEOUT_MS },\n  );\n  const deadline = Date.now() + PROCESSOR_WAIT_MS;\n  let task: Task | null = null;\n\n  try {\n    while (Date.now() < deadline) {\n      task = await client.getTask(continuation.a2aTaskId);\n      if (TERMINAL_STATES.has(task.status.state)) break;\n      await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));\n    }\n  } catch (err) {\n    if (isTransientA2APollError(err)) {\n      if (shouldStopPollingRemoteTask(continuation)) {\n        await notifyAndFailA2AContinuation(\n          continuation,\n          adapter,\n          remotePollFailureReason(continuation),\n        );\n        return;\n      }\n      await rescheduleA2AContinuation(continuation.id, RESCHEDULE_DELAY_MS);\n      return;\n    }\n    if (continuation.attempts >= MAX_ATTEMPTS) {\n      await notifyAndFailA2AContinuation(\n        continuation,\n        adapter,\n        err instanceof Error ? err.message : String(err),\n      );\n      return;\n    }\n    await rescheduleA2AContinuation(continuation.id, RESCHEDULE_DELAY_MS);\n    return;\n  }\n\n  if (!task || !TERMINAL_STATES.has(task.status.state)) {\n    const recoverableArtifactText = extractRecoverableArtifactText(task);\n    if (recoverableArtifactText) {\n      await deliverAndCompleteA2AContinuation(\n        continuation,\n        adapter,\n        formatContinuationArtifactText(\n          recoverableArtifactText,\n          continuation.agentUrl,\n        ),\n      );\n      return;\n    }\n\n    if (shouldStopPollingRemoteTask(continuation)) {\n      await notifyAndFailA2AContinuation(\n        continuation,\n        adapter,\n        remotePollFailureReason(continuation),\n      );\n      return;\n    }\n    await rescheduleA2AContinuation(continuation.id, RESCHEDULE_DELAY_MS);\n    return;\n  }\n\n  if (task.status.state !== \"completed\") {\n    const reason =\n      extractTaskText(task) ||\n      `Remote A2A task ${continuation.a2aTaskId} ended with state ${task.status.state}`;\n    await notifyAndFailA2AContinuation(continuation, adapter, reason);\n    return;\n  }\n\n  const text = formatContinuationArtifactText(\n    extractTaskText(task),\n    continuation.agentUrl,\n  );\n  if (!text.trim()) {\n    await notifyAndFailA2AContinuation(\n      continuation,\n      adapter,\n      `Remote A2A task ${continuation.a2aTaskId} completed without text`,\n    );\n    return;\n  }\n\n  await deliverAndCompleteA2AContinuation(continuation, adapter, text);\n}\n\nasync function waitForContinuationDue(\n  continuationId: string,\n): Promise<boolean> {\n  const continuation = await getA2AContinuation(continuationId);\n  if (!continuation) return false;\n  if (continuation.status === \"completed\" || continuation.status === \"failed\") {\n    return false;\n  }\n  if (continuation.status !== \"pending\") return true;\n\n  const waitMs = continuation.nextCheckAt - Date.now();\n  if (waitMs <= 0) return true;\n\n  if (waitMs > MAX_PRE_CLAIM_WAIT_MS) return false;\n\n  await sleep(waitMs);\n  return true;\n}\n\nasync function notifyAndFailA2AContinuation(\n  continuation: A2AContinuation,\n  adapter: PlatformAdapter,\n  reason: string,\n): Promise<void> {\n  const deliveryContinuation = await claimA2AContinuationDelivery(\n    continuation.id,\n  );\n  if (!deliveryContinuation) return;\n\n  const message = formatContinuationFailureMessage(\n    deliveryContinuation,\n    reason,\n  );\n  try {\n    await withTimeout(\n      adapter.sendResponse(\n        adapter.formatAgentResponse(message),\n        deliveryContinuation.incoming,\n        { placeholderRef: deliveryContinuation.placeholderRef ?? undefined },\n      ),\n      PLATFORM_SEND_TIMEOUT_MS,\n      `${deliveryContinuation.platform} failure notification timed out`,\n    );\n  } catch (err) {\n    console.error(\n      `[integrations] Failed to notify ${deliveryContinuation.platform} about failed A2A continuation ${deliveryContinuation.id}:`,\n      err,\n    );\n  }\n\n  await failA2AContinuation(deliveryContinuation.id, reason);\n}\n\nasync function deliverAndCompleteA2AContinuation(\n  continuation: A2AContinuation,\n  adapter: PlatformAdapter,\n  text: string,\n): Promise<void> {\n  const deliveryContinuation = await claimA2AContinuationDelivery(\n    continuation.id,\n  );\n  if (!deliveryContinuation) return;\n\n  try {\n    await withTimeout(\n      adapter.sendResponse(\n        adapter.formatAgentResponse(text),\n        deliveryContinuation.incoming,\n        { placeholderRef: deliveryContinuation.placeholderRef ?? undefined },\n      ),\n      PLATFORM_SEND_TIMEOUT_MS,\n      `${deliveryContinuation.platform} response delivery timed out`,\n    );\n  } catch (err) {\n    if (deliveryContinuation.attempts >= MAX_ATTEMPTS) {\n      await failA2AContinuation(\n        deliveryContinuation.id,\n        err instanceof Error ? err.message : String(err),\n      );\n      return;\n    }\n    await rescheduleA2AContinuation(\n      deliveryContinuation.id,\n      RESCHEDULE_DELAY_MS,\n    );\n    return;\n  }\n\n  await completeAfterSuccessfulDelivery(deliveryContinuation);\n}\n\nasync function completeAfterSuccessfulDelivery(\n  continuation: A2AContinuation,\n): Promise<void> {\n  let lastError: unknown;\n  for (let attempt = 0; attempt < COMPLETE_AFTER_DELIVERY_ATTEMPTS; attempt++) {\n    try {\n      await completeA2AContinuation(continuation.id);\n      return;\n    } catch (err) {\n      lastError = err;\n    }\n  }\n\n  console.error(\n    `[integrations] ${continuation.platform} accepted A2A continuation ${continuation.id}, ` +\n      \"but marking it completed failed. Leaving it in delivering for stale-delivery recovery.\",\n    lastError,\n  );\n}\n\nfunction formatContinuationFailureMessage(\n  continuation: A2AContinuation,\n  reason: string,\n): string {\n  if (isLlmCredentialError(reason)) {\n    return formatLlmCredentialErrorMessage({\n      agentName: continuation.agentName,\n    });\n  }\n\n  return `The ${continuation.agentName} agent could not finish this request: ${sanitizeFailureReason(\n    reason,\n  )}`;\n}\n\nfunction isRemoteWorkExpired(continuation: A2AContinuation): boolean {\n  return Date.now() - continuation.createdAt >= MAX_REMOTE_WORK_MS;\n}\n\nfunction shouldStopPollingRemoteTask(continuation: A2AContinuation): boolean {\n  return (\n    continuation.attempts >= MAX_ATTEMPTS || isRemoteWorkExpired(continuation)\n  );\n}\n\nfunction isTransientA2APollError(err: unknown): boolean {\n  if (!(err instanceof Error)) return false;\n  if (err.name === \"AbortError\") return true;\n  return /operation was aborted|aborted|timed out|timeout|Invalid or expired A2A token|A2A request failed \\((?:401|508)\\)/i.test(\n    err.message,\n  );\n}\n\nfunction remotePollFailureReason(continuation: A2AContinuation): string {\n  if (isRemoteWorkExpired(continuation)) {\n    return `Timed out polling the ${continuation.agentName} A2A task ${continuation.a2aTaskId} after ${Math.round(\n      MAX_REMOTE_WORK_MS / 60_000,\n    )} minutes. The downstream agent did not return a final result.`;\n  }\n\n  return `Timed out polling the ${continuation.agentName} A2A task ${continuation.a2aTaskId} after ${MAX_ATTEMPTS} attempts. The downstream agent did not return a final result.`;\n}\n\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nasync function withTimeout<T>(\n  promise: Promise<T>,\n  timeoutMs: number,\n  message: string,\n): Promise<T> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    return await Promise.race([\n      promise,\n      new Promise<never>((_, reject) => {\n        timer = setTimeout(() => reject(new Error(message)), timeoutMs);\n      }),\n    ]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n\nfunction sanitizeFailureReason(reason: string): string {\n  const oneLine = reason.replace(/\\s+/g, \" \").trim();\n  const withoutEnvNames = oneLine.replace(\n    /\\b[A-Z][A-Z0-9_]*(?:API_KEY|PRIVATE_KEY|SECRET|TOKEN)\\b/g,\n    \"a required credential\",\n  );\n  return (\n    withoutEnvNames.slice(0, 500) ||\n    \"the downstream agent returned an empty error\"\n  );\n}\n\nasync function signContinuationToken(\n  continuation: A2AContinuation,\n): Promise<string | undefined> {\n  if (continuation.a2aAuthToken === \"\") {\n    return undefined;\n  }\n\n  const storedToken = continuation.a2aAuthToken;\n  if (storedToken && !isLikelyJwt(storedToken)) return storedToken;\n\n  const freshToken = await signFreshContinuationToken(continuation);\n  if (freshToken) return freshToken;\n  if (!storedToken) return undefined;\n\n  // Older continuations may have persisted the initial short-lived JWT. Avoid\n  // replaying it forever after expiry; opaque legacy bearer keys can still be\n  // reused because we cannot re-mint those.\n  if (isLikelyJwt(storedToken)) return undefined;\n  return storedToken;\n}\n\nasync function signFreshContinuationToken(\n  continuation: A2AContinuation,\n): Promise<string | undefined> {\n  let orgDomain: string | undefined;\n  let orgSecret: string | undefined;\n  if (continuation.orgId) {\n    try {\n      const { getOrgDomain, getOrgA2ASecret } =\n        await import(\"../org/context.js\");\n      orgDomain = (await getOrgDomain(continuation.orgId)) ?? undefined;\n      orgSecret = (await getOrgA2ASecret(continuation.orgId)) ?? undefined;\n    } catch {}\n  }\n\n  if (!continuation.ownerEmail || !(orgSecret || process.env.A2A_SECRET)) {\n    return undefined;\n  }\n\n  try {\n    return await signA2AToken(continuation.ownerEmail, orgDomain, orgSecret, {\n      expiresIn: \"30m\",\n      preferGlobalSecret: true,\n    });\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isLikelyJwt(token: string): boolean {\n  return token.split(\".\").length === 3;\n}\n\nfunction extractTaskText(task: Task): string {\n  const parts = task.status.message?.parts ?? [];\n  return parts\n    .filter((part): part is { type: \"text\"; text: string } => {\n      return part.type === \"text\" && typeof part.text === \"string\";\n    })\n    .map((part) => part.text)\n    .join(\"\\n\");\n}\n\nfunction extractRecoverableArtifactText(task: Task | null): string {\n  if (!task?.status.message?.metadata?.agentNativeRecoverableArtifacts) {\n    return \"\";\n  }\n  return extractTaskText(task);\n}\n\nfunction formatContinuationArtifactText(\n  text: string,\n  agentUrl: string,\n): string {\n  const expandedText = expandRelativeUrls(text, agentUrl);\n  return appendA2AArtifactLinks(\n    expandedText,\n    [{ tool: \"call-agent\", result: expandedText }],\n    { baseUrl: resolveArtifactBaseUrl() },\n  );\n}\n\nfunction resolveArtifactBaseUrl(): string | undefined {\n  const baseUrl =\n    process.env.APP_URL || process.env.URL || process.env.DEPLOY_URL;\n  return baseUrl ? withConfiguredAppBasePath(baseUrl) : undefined;\n}\n\nfunction expandRelativeUrls(text: string, agentUrl: string): string {\n  if (!text || !agentUrl) return text;\n  const base = publicAgentBaseUrl(agentUrl);\n  return text.replace(\n    /(^|[\\s(\\[<\"'`])(\\/[a-z0-9_-][a-z0-9_/?&=%#.,:-]*)/gi,\n    (_match, lead, path) => `${lead}${base}${path}`,\n  );\n}\n\nfunction publicAgentBaseUrl(agentUrl: string): string {\n  try {\n    const url = new URL(agentUrl);\n    const routeIndex = url.pathname.indexOf(FRAMEWORK_ROUTE_PREFIX);\n    url.pathname =\n      routeIndex >= 0\n        ? url.pathname.slice(0, routeIndex) || \"/\"\n        : url.pathname.replace(/\\/+$/, \"\") || \"/\";\n    url.search = \"\";\n    url.hash = \"\";\n    return url.toString().replace(/\\/$/, \"\");\n  } catch {\n    return agentUrl.replace(/\\/$/, \"\");\n  }\n}\n"]}

package/dist/integrations/adapters/slack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/slack.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AASrB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,IAAI,eAAe,CAoU9C"}
+{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/slack.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AASrB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,IAAI,eAAe,CA4U9C"}

package/dist/integrations/adapters/slack.js

@@ -180,8 +180,15 @@ export function slackAdapter() {
             // Block-rich path: split text into chunks but render the FIRST chunk as
             // blocks (so we keep the in-place edit + button) and any overflow as
             // plain follow-up posts. The vast majority of replies fit in one block.
-            const chunks = splitMessage(message.text, SLACK_MAX_LENGTH);
-            const firstChunk = chunks[0] ?? "";
+            const chunks = splitNonEmptyMessage(message.text, SLACK_MAX_LENGTH);
+            const hasProvidedBlocks = Array.isArray(blocks) && blocks.length > 0;
+            const firstChunk = chunks[0] ?? (hasProvidedBlocks ? "Response" : "");
+            if (!firstChunk) {
+                if (threadTs) {
+                    setSlackAssistantStatus(token, channelId, threadTs, "");
+                }
+                return;
+            }
             const restChunks = chunks.slice(1);
             const finalBlocks = blocks ??
                 buildResponseBlocks(firstChunk, {
@@ -244,7 +251,9 @@ export function slackAdapter() {
                 console.error("[slack] SLACK_BOT_TOKEN not configured");
                 return;
             }
-            const chunks = splitMessage(message.text, SLACK_MAX_LENGTH);
+            const chunks = splitNonEmptyMessage(message.text, SLACK_MAX_LENGTH);
+            if (chunks.length === 0)
+                return;
             for (const chunk of chunks) {
                 const body = {
                     channel: target.destination,
@@ -444,6 +453,10 @@ function splitMessage(text, maxLength) {
     }
     return chunks;
 }
+/** Split a message and drop chunks Slack would render as blank messages. */
+function splitNonEmptyMessage(text, maxLength) {
+    return splitMessage(text, maxLength).filter((chunk) => chunk.trim().length > 0);
+}
 /** Hard cap on input length we feed to the regex-based mrkdwn converter.
  *  L2 in the webhook audit: `\*\*(.+?)\*\*` with the `s` flag on a long
  *  string of asterisks can exhibit super-linear backtracking. Slack
@@ -526,6 +539,12 @@ function buildResponseBlocks(text, opts) {
  * (e.g. when chat.update fails) and for follow-up overflow chunks.
  */
 async function postFresh(token, channelId, threadTs, body) {
+    const hasBlocks = Array.isArray(body.blocks) && body.blocks.length > 0;
+    if (typeof body.text === "string" &&
+        body.text.trim().length === 0 &&
+        !hasBlocks) {
+        return;
+    }
     const payload = {
         ...body,
         channel: channelId,

package/dist/integrations/adapters/slack.js.map

@@ -1 +1 @@
-{"version":3,"file":"slack.js","sourceRoot":"","sources":["../../../src/integrations/adapters/slack.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAWzD,iCAAiC;AACjC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAC3C,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,OAAO;QAEd,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,iBAAiB;oBACxB,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,iGAAiG;iBACpG;gBACD;oBACE,GAAG,EAAE,sBAAsB;oBAC3B,KAAK,EAAE,sBAAsB;oBAC7B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,qFAAqF;iBACxF;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,kEAAkE;YAClE,uEAAuE;YACvE,oEAAoE;YACpE,2DAA2D;YAC3D,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBACvC,8DAA8D;oBAC9D,mEAAmE;oBACnE,8DAA8D;oBAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBACvD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACvD,IAAI,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC;YAEjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;YAChE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAE3C,2DAA2D;YAC3D,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAEzD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7C,MAAM,iBAAiB,GACrB,KAAK;gBACL,MAAM;qBACH,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC;qBACnC,MAAM,CAAC,UAAU,CAAC;qBAClB,MAAM,CAAC,KAAK,CAAC,CAAC;YAEnB,yBAAyB;YACzB,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAC/B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAY,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,iCAAiC;YACjC,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAEnC,4BAA4B;YAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;gBACxB,IAAI,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAEpB,sBAAsB;gBACtB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;oBAAE,OAAO,IAAI,CAAC;gBACzD,mCAAmC;gBACnC,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB;oBACpE,OAAO,IAAI,CAAC;gBAEd,+CAA+C;gBAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAEvB,+EAA+E;gBAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,IAAI,CAAC,SAAS;oBAAE,OAAO,IAAI,CAAC;gBAE5B,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrC,MAAM,gBAAgB,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAEpD,OAAO;oBACL,QAAQ,EAAE,OAAO;oBACjB,gBAAgB;oBAChB,IAAI,EAAE,SAAS;oBACf,UAAU,EAAE,CAAC,CAAC,IAAI;oBAClB,QAAQ,EAAE,CAAC,CAAC,IAAI;oBAChB,eAAe,EAAE;wBACf,SAAS,EAAE,CAAC,CAAC,OAAO;wBACpB,QAAQ,EAAE,QAAQ;wBAClB,SAAS,EAAE,CAAC,CAAC,EAAE;wBACf,MAAM,EAAE,OAAO,CAAC,OAAO;wBACvB,OAAO,EAAE,OAAO,CAAC,QAAQ;qBAC1B;oBACD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;iBAC/C,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,yBAAyB,CAC7B,QAAyB;YAEzB,gEAAgE;YAChE,sEAAsE;YACtE,kEAAkE;YAClE,oEAAoE;YACpE,sEAAsE;YACtE,sCAAsC;YACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,SAAmB,CAAC;YAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC,QAAkB,CAAC;YAC7D,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAEzC,sEAAsE;YACtE,qEAAqE;YACrE,mCAAmC;YACnC,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB,EACxB,IAAkC;YAElC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,SAAmB,CAAC;YAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,QAAkB,CAAC;YAC5D,MAAM,MAAM,GAAI,OAAO,CAAC,eAAuB,EAAE,MAEpC,CAAC;YACd,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;YAE5C,wEAAwE;YACxE,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAEnC,MAAM,WAAW,GACf,MAAM;gBACN,mBAAmB,CAAC,UAAU,EAAE;oBAC9B,iBAAiB,EAAG,OAAO,CAAC,eAAuB;wBACjD,EAAE,iBAAiB;iBACtB,CAAC,CAAC;YAEL,MAAM,QAAQ,GAA4B;gBACxC,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,WAAW;gBACnB,YAAY,EAAE,KAAK;gBACnB,YAAY,EAAE,KAAK;gBACnB,MAAM,EAAE,IAAI;aACb,CAAC;YAEF,IAAI,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,gDAAgD;oBAChD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,mCAAmC,EAAE;wBACnE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,KAAK,EAAE;4BAChC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC;qBAC1D,CAAC,CAAC;oBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;wBACxD,2DAA2D;wBAC3D,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACxD,CAAC;gBAED,8DAA8D;gBAC9D,sDAAsD;gBACtD,IAAI,QAAQ,EAAE,CAAC;oBACb,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBAED,uEAAuE;gBACvE,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC/B,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;wBAC1C,OAAO,EAAE,SAAS;wBAClB,IAAI,EAAE,KAAK;wBACX,YAAY,EAAE,KAAK;wBACnB,YAAY,EAAE,KAAK;wBACnB,MAAM,EAAE,IAAI;qBACb,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;gBACtD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAA4B;oBACpC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,IAAI,EAAE,KAAK;iBACZ,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS;oBAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;gBAExD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,wCAAwC,EACxC;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,KAAK,EAAE;4BAChC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoC,CAAC;oBACnE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC;oBAC3D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;oBAChE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CACjB,IAAY,EACZ,IAAqC;YAErC,OAAO;gBACL,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;gBACjC,eAAe,EAAE,IAAI,EAAE,iBAAiB;oBACtC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE;oBAC/C,CAAC,CAAC,EAAE;aACP,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAAgB;YAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACrD,MAAM,UAAU,GAAG,QAAQ,IAAI,SAAS,CAAC;YAEzC,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU;gBACV,OAAO,EAAE;oBACP,QAAQ;oBACR,SAAS;iBACV;gBACD,KAAK,EAAE,CAAC,UAAU;oBAChB,CAAC,CAAC,kEAAkE;oBACpE,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,IAAI,uBAAuB,GAAG,KAAK,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,yBAAyB,CAAC,OAAY;IAC7C,MAAM,MAAM,GACV,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,QAAQ,GACZ,OAAO,OAAO,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3E,MAAM,cAAc,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAErE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,6CAA6C;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,uBAAuB,GAAG,IAAI,CAAC;YAC/B,OAAO,CAAC,IAAI,CACV,6HAA6H;gBAC3H,gHAAgH,CACnH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,8BAA8B;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,8BAA8B;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAc;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,wEAAwE;IACxE,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY,EAAE,SAAiB;IAChE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,GAAG,SAAS,GAAG,SAAS;YAAE,MAAM;QACzC,KAAK,IAAI,SAAS,CAAC;QACnB,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE/D,4BAA4B;QAC5B,IAAI,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,0BAA0B;YAC1B,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;4EAK4E;AAC5E,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,OAAO,CACL,OAAO;SACJ,OAAO,CAAC,0BAA0B,EAAE,SAAS,CAAC;QAC/C,sEAAsE;QACtE,sEAAsE;SACrE,OAAO,CAAC,oCAAoC,EAAE,MAAM,CAAC;QACtD,oEAAoE;QACpE,gEAAgE;QAChE,sEAAsE;QACtE,iEAAiE;QACjE,gDAAgD;SAC/C,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,KAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,MAAc;IAEd,aAAa,CAAC,mDAAmD,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,QAAQ;YACnB,MAAM;SACP,CAAC;KACH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,IAAoC;IAEpC,MAAM,aAAa,GAAG,YAAY,CAChC,IAAI,IAAI,iBAAiB,EACzB,6BAA6B,CAC9B,CAAC;IACF,MAAM,MAAM,GAAU,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE;oBAC9D,GAAG,EAAE,IAAI,CAAC,iBAAiB;oBAC3B,SAAS,EAAE,sBAAsB;iBAClC;aACF;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CACtB,KAAa,EACb,SAAiB,EACjB,QAA4B,EAC5B,IAA6B;IAE7B,MAAM,OAAO,GAA4B;QACvC,GAAG,IAAI;QACP,OAAO,EAAE,SAAS;KACnB,CAAC;IACF,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,wCAAwC,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,IAAiB;IAEjB,MAAM,UAAU,GACd,OAAO,eAAe,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;YACtB,GAAG,IAAI;YACP,MAAM,EAAE,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM;SAC1C,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { createError, getHeader, readRawBody } from \"h3\";\nimport type {\n  PlatformAdapter,\n  IncomingMessage,\n  OutgoingMessage,\n  IntegrationStatus,\n  OutboundTarget,\n} from \"../types.js\";\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { getIntegrationConfig } from \"../config-store.js\";\n\n/** Slack's max message length */\nconst SLACK_MAX_LENGTH = 4000;\nconst SLACK_SECTION_TEXT_MAX_LENGTH = 3000;\nconst SLACK_API_TIMEOUT_MS = 10_000;\n\n/**\n * Create a Slack platform adapter.\n *\n * Required env vars:\n * - SLACK_BOT_TOKEN — Bot user OAuth token (xoxb-...)\n * - SLACK_SIGNING_SECRET — Used to verify webhook signatures\n *\n * Optional env vars:\n * - SLACK_ALLOWED_TEAM_IDS — Comma-separated list of Slack workspace\n *   `team_id` values (e.g. \"T012ABCDEF,T034GHIJKL\") that this deployment\n *   accepts events from. Required in production and strongly recommended\n *   to prevent cross-workspace event injection (H1 in the webhook audit):\n *   the global `SLACK_SIGNING_SECRET` is the same key for every workspace\n *   the app is installed to, so without an allowlist any installed\n *   workspace can drive the agent. When unset the adapter accepts events\n *   from any workspace in development, but rejects events in production.\n * - SLACK_ALLOWED_API_APP_IDS — Comma-separated list of Slack app IDs\n *   (`api_app_id`) to additionally pin events to. Useful when the same\n *   signing secret rotation surfaces multiple app installs.\n */\nexport function slackAdapter(): PlatformAdapter {\n  return {\n    platform: \"slack\",\n    label: \"Slack\",\n\n    getRequiredEnvKeys(): EnvKeyConfig[] {\n      return [\n        {\n          key: \"SLACK_BOT_TOKEN\",\n          label: \"Slack Bot Token\",\n          required: true,\n          helpText:\n            \"In your Slack app's left nav: OAuth & Permissions → Bot User OAuth Token (starts with `xoxb-`).\",\n        },\n        {\n          key: \"SLACK_SIGNING_SECRET\",\n          label: \"Slack Signing Secret\",\n          required: true,\n          helpText:\n            \"In your Slack app's left nav: Basic Information → App Credentials → Signing Secret.\",\n        },\n      ];\n    },\n\n    async handleVerification(\n      event: H3Event,\n    ): Promise<{ handled: boolean; response?: unknown }> {\n      // Slack sends url_verification when first setting up the webhook.\n      // readRawBodyCached caches the raw bytes on event.context.__rawBody so\n      // subsequent verifyWebhook + parseIncomingMessage calls re-use them\n      // without re-stringifying a parsed body (M2 in the audit).\n      const body = await readRawBodyCached(event);\n      try {\n        const parsed = JSON.parse(body);\n        if (parsed.type === \"url_verification\") {\n          // Slack's URL verifier expects the raw challenge value in the\n          // response body. Returning JSON works for some clients but the app\n          // settings verifier rejects it as not matching the challenge.\n          return { handled: true, response: parsed.challenge };\n        }\n      } catch {}\n      return { handled: false };\n    },\n\n    async verifyWebhook(event: H3Event): Promise<boolean> {\n      const signingSecret = process.env.SLACK_SIGNING_SECRET;\n      if (!signingSecret) return false;\n\n      const signature = getHeader(event, \"x-slack-signature\");\n      const timestamp = getHeader(event, \"x-slack-request-timestamp\");\n      if (!signature || !timestamp) return false;\n\n      // Reject requests older than 5 minutes (replay protection)\n      const ts = parseInt(timestamp, 10);\n      if (Math.abs(Date.now() / 1000 - ts) > 300) return false;\n\n      const body = await readRawBodyCached(event);\n      const crypto = await import(\"node:crypto\");\n      const basestring = `v0:${timestamp}:${body}`;\n      const expectedSignature =\n        \"v0=\" +\n        crypto\n          .createHmac(\"sha256\", signingSecret)\n          .update(basestring)\n          .digest(\"hex\");\n\n      // Timing-safe comparison\n      try {\n        return crypto.timingSafeEqual(\n          Buffer.from(signature),\n          Buffer.from(expectedSignature),\n        );\n      } catch {\n        return false;\n      }\n    },\n\n    async parseIncomingMessage(\n      event: H3Event,\n    ): Promise<IncomingMessage | null> {\n      const raw = await readRawBodyCached(event);\n      let payload: any;\n      try {\n        payload = JSON.parse(raw);\n      } catch {\n        return null;\n      }\n\n      // H1 (webhook audit): cross-workspace event injection. The global\n      // SLACK_SIGNING_SECRET is the same key for every workspace this Slack\n      // app is installed to — without a per-tenant allowlist any installed\n      // workspace can drive the agent. We enforce SLACK_ALLOWED_TEAM_IDS\n      // here AFTER the signature has already been verified by the webhook\n      // handler, so this is purely a tenant-isolation gate (not a forgery\n      // defense). When unset in production we surface a one-time warning\n      // recommending it be configured.\n      enforceWorkspaceAllowlist(payload);\n\n      // Handle Events API wrapper\n      if (payload.type === \"event_callback\") {\n        const e = payload.event;\n        if (!e) return null;\n\n        // Ignore bot messages\n        if (e.bot_id || e.subtype === \"bot_message\") return null;\n        // Ignore message edits and deletes\n        if (e.subtype === \"message_changed\" || e.subtype === \"message_deleted\")\n          return null;\n\n        // Handle both direct messages and app_mentions\n        const text = e.text?.trim();\n        if (!text) return null;\n\n        // Remove bot mention from text (e.g., \"<@U123> do something\" → \"do something\")\n        const cleanText = text.replace(/<@[A-Z0-9]+>/g, \"\").trim();\n        if (!cleanText) return null;\n\n        // Thread ID: use thread_ts if in a thread, otherwise message ts\n        const threadTs = e.thread_ts || e.ts;\n        const externalThreadId = `${e.channel}:${threadTs}`;\n\n        return {\n          platform: \"slack\",\n          externalThreadId,\n          text: cleanText,\n          senderName: e.user,\n          senderId: e.user,\n          platformContext: {\n            channelId: e.channel,\n            threadTs: threadTs,\n            messageTs: e.ts,\n            teamId: payload.team_id,\n            eventId: payload.event_id,\n          },\n          timestamp: Math.floor(parseFloat(e.ts) * 1000),\n        };\n      }\n\n      return null;\n    },\n\n    async postProcessingPlaceholder(\n      incoming: IncomingMessage,\n    ): Promise<{ placeholderRef: string } | null> {\n      // No placeholder reply in the thread — Slack's native assistant\n      // status bar (\"agent-native is thinking…\", below the composer) is the\n      // loading affordance. A second visible \"Working on it…\" reply was\n      // redundant and added an extra chunk that we then had to overwrite.\n      // We just set the native status and return null so sendResponse posts\n      // the final reply as a fresh message.\n      const token = process.env.SLACK_BOT_TOKEN;\n      if (!token) return null;\n\n      const channelId = incoming.platformContext.channelId as string;\n      const threadTs = incoming.platformContext.threadTs as string;\n      if (!channelId || !threadTs) return null;\n\n      // Best-effort: flip the native AI-assistant \"is thinking…\" status bar\n      // in the channel input area. Requires `assistant:write` scope on the\n      // app — otherwise silently no-ops.\n      setSlackAssistantStatus(token, channelId, threadTs, \"is thinking…\");\n      return null;\n    },\n\n    async sendResponse(\n      message: OutgoingMessage,\n      context: IncomingMessage,\n      opts?: { placeholderRef?: string },\n    ): Promise<void> {\n      const token = process.env.SLACK_BOT_TOKEN;\n      if (!token) {\n        console.error(\"[slack] SLACK_BOT_TOKEN not configured\");\n        return;\n      }\n\n      const channelId = context.platformContext.channelId as string;\n      const threadTs = context.platformContext.threadTs as string;\n      const blocks = (message.platformContext as any)?.blocks as\n        | unknown[]\n        | undefined;\n      const placeholderRef = opts?.placeholderRef;\n\n      // Block-rich path: split text into chunks but render the FIRST chunk as\n      // blocks (so we keep the in-place edit + button) and any overflow as\n      // plain follow-up posts. The vast majority of replies fit in one block.\n      const chunks = splitMessage(message.text, SLACK_MAX_LENGTH);\n      const firstChunk = chunks[0] ?? \"\";\n      const restChunks = chunks.slice(1);\n\n      const finalBlocks =\n        blocks ??\n        buildResponseBlocks(firstChunk, {\n          threadDeepLinkUrl: (message.platformContext as any)\n            ?.threadDeepLinkUrl,\n        });\n\n      const baseBody: Record<string, unknown> = {\n        channel: channelId,\n        text: firstChunk,\n        blocks: finalBlocks,\n        unfurl_links: false,\n        unfurl_media: false,\n        mrkdwn: true,\n      };\n\n      try {\n        if (placeholderRef) {\n          // Replace the \"thinking…\" placeholder in place.\n          const res = await slackApiFetch(\"https://slack.com/api/chat.update\", {\n            method: \"POST\",\n            headers: {\n              Authorization: `Bearer ${token}`,\n              \"Content-Type\": \"application/json\",\n            },\n            body: JSON.stringify({ ...baseBody, ts: placeholderRef }),\n          });\n          const data = (await res.json()) as {\n            ok: boolean;\n            error?: string;\n          };\n          if (!data.ok) {\n            console.error(\"[slack] chat.update error:\", data.error);\n            // Fall back to a fresh post so the user still sees a reply\n            await postFresh(token, channelId, threadTs, baseBody);\n          }\n        } else {\n          await postFresh(token, channelId, threadTs, baseBody);\n        }\n\n        // Clear the AI-assistant \"is thinking…\" status now that we've\n        // delivered the final answer. Empty status clears it.\n        if (threadTs) {\n          setSlackAssistantStatus(token, channelId, threadTs, \"\");\n        }\n\n        // Overflow chunks (rare) — post as plain follow-ups in the same thread\n        for (const chunk of restChunks) {\n          await postFresh(token, channelId, threadTs, {\n            channel: channelId,\n            text: chunk,\n            unfurl_links: false,\n            unfurl_media: false,\n            mrkdwn: true,\n          });\n        }\n      } catch (err) {\n        console.error(\"[slack] Failed to send message:\", err);\n        throw err;\n      }\n    },\n\n    async sendMessageToTarget(\n      message: OutgoingMessage,\n      target: OutboundTarget,\n    ): Promise<void> {\n      const token = process.env.SLACK_BOT_TOKEN;\n      if (!token) {\n        console.error(\"[slack] SLACK_BOT_TOKEN not configured\");\n        return;\n      }\n\n      const chunks = splitMessage(message.text, SLACK_MAX_LENGTH);\n      for (const chunk of chunks) {\n        const body: Record<string, unknown> = {\n          channel: target.destination,\n          text: chunk,\n        };\n        if (target.threadRef) body.thread_ts = target.threadRef;\n\n        try {\n          const res = await slackApiFetch(\n            \"https://slack.com/api/chat.postMessage\",\n            {\n              method: \"POST\",\n              headers: {\n                Authorization: `Bearer ${token}`,\n                \"Content-Type\": \"application/json\",\n              },\n              body: JSON.stringify(body),\n            },\n          );\n          const data = (await res.json()) as { ok: boolean; error?: string };\n          if (!data.ok) {\n            throw new Error(data.error || \"chat.postMessage failed\");\n          }\n        } catch (err) {\n          console.error(\"[slack] Failed to send proactive message:\", err);\n          throw err;\n        }\n      }\n    },\n\n    formatAgentResponse(\n      text: string,\n      opts?: { threadDeepLinkUrl?: string },\n    ): OutgoingMessage {\n      return {\n        text: markdownToSlackMrkdwn(text),\n        platformContext: opts?.threadDeepLinkUrl\n          ? { threadDeepLinkUrl: opts.threadDeepLinkUrl }\n          : {},\n      };\n    },\n\n    async getStatus(baseUrl?: string): Promise<IntegrationStatus> {\n      const hasToken = !!process.env.SLACK_BOT_TOKEN;\n      const hasSecret = !!process.env.SLACK_SIGNING_SECRET;\n      const configured = hasToken && hasSecret;\n\n      return {\n        platform: \"slack\",\n        label: \"Slack\",\n        enabled: false, // overridden by plugin\n        configured,\n        details: {\n          hasToken,\n          hasSecret,\n        },\n        error: !configured\n          ? \"Set SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET in your environment\"\n          : undefined,\n      };\n    },\n  };\n}\n\n/**\n * Parse a comma-separated env var into a Set of trimmed, non-empty values.\n * Returns null when the env var is unset or empty (so callers can\n * distinguish \"no allowlist configured\" from \"empty allowlist\").\n */\nfunction parseAllowlistEnv(name: string): Set<string> | null {\n  const raw = process.env[name];\n  if (!raw) return null;\n  const values = raw\n    .split(\",\")\n    .map((v) => v.trim())\n    .filter((v) => v.length > 0);\n  if (values.length === 0) return null;\n  return new Set(values);\n}\n\nlet _missingAllowlistWarned = false;\n\n/**\n * Enforce that an incoming Slack event comes from an allowlisted workspace.\n *\n * H1 in the webhook audit: the framework uses a SINGLE global\n * SLACK_SIGNING_SECRET for every workspace the Slack app is installed to,\n * so a valid signature alone doesn't prove the request belongs to the\n * tenant the deployment intends to serve. This helper layers a per-tenant\n * allowlist on top of signature verification.\n *\n * Behavior:\n * - If `SLACK_ALLOWED_TEAM_IDS` is set: reject any payload whose\n *   `team_id` isn't in the list.\n * - If `SLACK_ALLOWED_API_APP_IDS` is set: also reject payloads whose\n *   `api_app_id` isn't in the list (bot apps can be installed under the\n *   same Slack app id across multiple workspaces — pinning both keeps\n *   the surface tight when team_id allows multiple workspaces).\n * - If `SLACK_ALLOWED_TEAM_IDS` is unset/empty in production: reject the\n *   event. Production must fail closed so any workspace with the shared\n *   signing secret cannot drive the agent.\n * - If `SLACK_ALLOWED_TEAM_IDS` is unset/empty in dev / single-tenant: log a\n *   one-time warning and accept (current local setup behavior).\n *\n * Throws an h3 401 error when an allowlisted-but-mismatched payload is\n * received, which the integrations plugin surfaces to the caller as\n * \"Unrecognized Slack workspace\" without enqueuing the event.\n */\nfunction enforceWorkspaceAllowlist(payload: any): void {\n  const teamId =\n    typeof payload?.team_id === \"string\" ? payload.team_id : undefined;\n  const apiAppId =\n    typeof payload?.api_app_id === \"string\" ? payload.api_app_id : undefined;\n\n  const allowedTeamIds = parseAllowlistEnv(\"SLACK_ALLOWED_TEAM_IDS\");\n  const allowedAppIds = parseAllowlistEnv(\"SLACK_ALLOWED_API_APP_IDS\");\n\n  if (!allowedTeamIds) {\n    if (process.env.NODE_ENV === \"production\") {\n      throw createError({\n        statusCode: 401,\n        statusMessage: \"Slack workspace allowlist is not configured\",\n      });\n    }\n    if (!_missingAllowlistWarned) {\n      _missingAllowlistWarned = true;\n      console.warn(\n        \"[slack] SLACK_ALLOWED_TEAM_IDS not set — accepting events from any workspace whose signature matches SLACK_SIGNING_SECRET. \" +\n          \"Set SLACK_ALLOWED_TEAM_IDS to a comma-separated list of allowed team_id values before deploying to production.\",\n      );\n    }\n  }\n\n  if (allowedTeamIds) {\n    if (!teamId || !allowedTeamIds.has(teamId)) {\n      throw createError({\n        statusCode: 401,\n        statusMessage: \"Unrecognized Slack workspace\",\n      });\n    }\n  }\n\n  if (allowedAppIds) {\n    if (!apiAppId || !allowedAppIds.has(apiAppId)) {\n      throw createError({\n        statusCode: 401,\n        statusMessage: \"Unrecognized Slack workspace\",\n      });\n    }\n  }\n}\n\n/**\n * Read the raw request body as a string and cache on the event context.\n *\n * This MUST read raw bytes from the request stream — never `JSON.stringify`\n * a parsed body, because Slack's HMAC is computed over the exact bytes Slack\n * sent. Re-stringifying a parsed object loses key ordering, whitespace, and\n * Unicode-escape choices, so the signature check would silently fail for\n * legitimate requests (M2 in the webhook security audit).\n *\n * h3 v2's body stream is consume-once, so we cache the raw string on the\n * event context after the first read. All call sites (handleVerification,\n * verifyWebhook, parseIncomingMessage) MUST go through this helper.\n */\nasync function readRawBodyCached(event: H3Event): Promise<string> {\n  const cached = event.context.__rawBody;\n  if (typeof cached === \"string\") return cached;\n  // h3's readRawBody returns the bytes Slack actually sent, defaulting to\n  // utf8-decoded. Returns undefined for empty bodies — we coerce to \"\" so\n  // the HMAC check can proceed deterministically.\n  const raw = (await readRawBody(event)) ?? \"\";\n  event.context.__rawBody = raw;\n  return raw;\n}\n\nfunction utf8ByteLength(text: string): number {\n  return new TextEncoder().encode(text).length;\n}\n\nfunction prefixWithinUtf8ByteLimit(text: string, maxLength: number): string {\n  let bytes = 0;\n  let end = 0;\n  for (const char of text) {\n    const nextBytes = utf8ByteLength(char);\n    if (bytes + nextBytes > maxLength) break;\n    bytes += nextBytes;\n    end += char.length;\n  }\n  return text.slice(0, end || 1);\n}\n\n/** Split a message into chunks that fit within the platform's byte limit. */\nfunction splitMessage(text: string, maxLength: number): string[] {\n  if (utf8ByteLength(text) <= maxLength) return [text];\n  const chunks: string[] = [];\n  let remaining = text;\n  while (remaining.length > 0) {\n    if (utf8ByteLength(remaining) <= maxLength) {\n      chunks.push(remaining);\n      break;\n    }\n\n    const prefix = prefixWithinUtf8ByteLimit(remaining, maxLength);\n\n    // Try to split at a newline\n    let splitIdx = prefix.lastIndexOf(\"\\n\");\n    if (splitIdx <= 0) {\n      // Try to split at a space\n      splitIdx = prefix.lastIndexOf(\" \");\n    }\n    if (splitIdx <= 0) {\n      splitIdx = prefix.length;\n    }\n    chunks.push(remaining.slice(0, splitIdx));\n    remaining = remaining.slice(splitIdx).trimStart();\n  }\n  return chunks;\n}\n\n/** Hard cap on input length we feed to the regex-based mrkdwn converter.\n *  L2 in the webhook audit: `\\*\\*(.+?)\\*\\*` with the `s` flag on a long\n *  string of asterisks can exhibit super-linear backtracking. Slack\n *  itself caps message bodies at 4000 chars (SLACK_MAX_LENGTH); we cap\n *  the input here at 10x that as a defensive bound for any caller that\n *  passes a longer rendering source through this helper before chunking. */\nconst MRKDWN_MAX_LENGTH = 40_000;\n\n/**\n * Convert standard markdown to Slack's mrkdwn dialect.\n * - `[text](url)` → `<url|text>`\n * - `**bold**` → `*bold*` (Slack uses single asterisks for bold)\n *\n * Inputs longer than MRKDWN_MAX_LENGTH are truncated before the regex\n * pass to bound worst-case backtracking on pathological input (L2 in the\n * webhook audit).\n */\nfunction markdownToSlackMrkdwn(text: string): string {\n  const bounded =\n    text.length > MRKDWN_MAX_LENGTH ? text.slice(0, MRKDWN_MAX_LENGTH) : text;\n  return (\n    bounded\n      .replace(/\\[([^\\]]+)\\]\\(([^)]+)\\)/g, \"<$2|$1>\")\n      // Do not wrap bare URLs in Slack bold markers. Slack's autolinker can\n      // treat the trailing `*` as part of the URL, producing a broken link.\n      .replace(/\\*\\*<?(https?:\\/\\/[^\\s>*]+)>?\\*\\*/g, \"<$1>\")\n      // Bounded character class instead of `.+?` with the `s` flag — caps\n      // each bold span at 5000 chars so an attacker can't construct a\n      // pathological \"**\" sequence that exhibits super-linear backtracking.\n      // Newlines are allowed because `[^*]` excludes only the asterisk\n      // itself, so multi-line bold spans still match.\n      .replace(/\\*\\*([^*]{1,5000})\\*\\*/g, \"*$1*\")\n  );\n}\n\n/**\n * Optionally set Slack's native AI-assistant status indicator (the small\n * \"is thinking…\" line under the message composer) for an app configured\n * with the `assistant:write` scope. Pure best-effort — fails silently for\n * apps that aren't set up as AI assistants.\n */\nfunction setSlackAssistantStatus(\n  token: string,\n  channelId: string,\n  threadTs: string,\n  status: string,\n): void {\n  slackApiFetch(\"https://slack.com/api/assistant.threads.setStatus\", {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${token}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      channel_id: channelId,\n      thread_ts: threadTs,\n      status,\n    }),\n  }).catch(() => {});\n}\n\n/**\n * Block Kit payload for the final answer. We avoid auto-unfurl previews by\n * separating the deep-link out into a button instead of inlining it as a\n * `<url|text>` markdown link in the section body — that's what was producing\n * the giant \"Agent-Native Dispatch\" card in every thread reply.\n */\nfunction buildResponseBlocks(\n  text: string,\n  opts: { threadDeepLinkUrl?: string },\n): unknown[] {\n  const sectionChunks = splitMessage(\n    text || \"_(no response)_\",\n    SLACK_SECTION_TEXT_MAX_LENGTH,\n  );\n  const blocks: any[] = sectionChunks.map((chunk) => ({\n    type: \"section\",\n    text: { type: \"mrkdwn\", text: chunk },\n  }));\n  if (opts.threadDeepLinkUrl) {\n    blocks.push({\n      type: \"actions\",\n      elements: [\n        {\n          type: \"button\",\n          text: { type: \"plain_text\", text: \"Open thread\", emoji: true },\n          url: opts.threadDeepLinkUrl,\n          action_id: \"open_dispatch_thread\",\n        },\n      ],\n    });\n  }\n  return blocks;\n}\n\n/**\n * Post a fresh message to a thread. Used as the placeholder-fallback path\n * (e.g. when chat.update fails) and for follow-up overflow chunks.\n */\nasync function postFresh(\n  token: string,\n  channelId: string,\n  threadTs: string | undefined,\n  body: Record<string, unknown>,\n): Promise<void> {\n  const payload: Record<string, unknown> = {\n    ...body,\n    channel: channelId,\n  };\n  if (threadTs && !payload.thread_ts) payload.thread_ts = threadTs;\n  const res = await slackApiFetch(\"https://slack.com/api/chat.postMessage\", {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${token}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify(payload),\n  });\n  const data = (await res.json()) as { ok: boolean; error?: string };\n  if (!data.ok) {\n    console.error(\"[slack] chat.postMessage error:\", data.error);\n    throw new Error(data.error || \"chat.postMessage failed\");\n  }\n}\n\nasync function slackApiFetch(\n  url: string,\n  init: RequestInit,\n): Promise<Response> {\n  const controller =\n    typeof AbortController !== \"undefined\" ? new AbortController() : undefined;\n  const timer = controller\n    ? setTimeout(() => controller.abort(), SLACK_API_TIMEOUT_MS)\n    : undefined;\n  try {\n    return await fetch(url, {\n      ...init,\n      signal: controller?.signal ?? init.signal,\n    });\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n"]}
+{"version":3,"file":"slack.js","sourceRoot":"","sources":["../../../src/integrations/adapters/slack.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAWzD,iCAAiC;AACjC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAC3C,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,OAAO;QAEd,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,iBAAiB;oBACxB,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,iGAAiG;iBACpG;gBACD;oBACE,GAAG,EAAE,sBAAsB;oBAC3B,KAAK,EAAE,sBAAsB;oBAC7B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,qFAAqF;iBACxF;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,kEAAkE;YAClE,uEAAuE;YACvE,oEAAoE;YACpE,2DAA2D;YAC3D,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBACvC,8DAA8D;oBAC9D,mEAAmE;oBACnE,8DAA8D;oBAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBACvD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACvD,IAAI,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC;YAEjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;YAChE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAE3C,2DAA2D;YAC3D,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAEzD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7C,MAAM,iBAAiB,GACrB,KAAK;gBACL,MAAM;qBACH,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC;qBACnC,MAAM,CAAC,UAAU,CAAC;qBAClB,MAAM,CAAC,KAAK,CAAC,CAAC;YAEnB,yBAAyB;YACzB,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAC/B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAY,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,iCAAiC;YACjC,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAEnC,4BAA4B;YAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;gBACxB,IAAI,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAEpB,sBAAsB;gBACtB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;oBAAE,OAAO,IAAI,CAAC;gBACzD,mCAAmC;gBACnC,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB;oBACpE,OAAO,IAAI,CAAC;gBAEd,+CAA+C;gBAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAEvB,+EAA+E;gBAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,IAAI,CAAC,SAAS;oBAAE,OAAO,IAAI,CAAC;gBAE5B,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrC,MAAM,gBAAgB,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAEpD,OAAO;oBACL,QAAQ,EAAE,OAAO;oBACjB,gBAAgB;oBAChB,IAAI,EAAE,SAAS;oBACf,UAAU,EAAE,CAAC,CAAC,IAAI;oBAClB,QAAQ,EAAE,CAAC,CAAC,IAAI;oBAChB,eAAe,EAAE;wBACf,SAAS,EAAE,CAAC,CAAC,OAAO;wBACpB,QAAQ,EAAE,QAAQ;wBAClB,SAAS,EAAE,CAAC,CAAC,EAAE;wBACf,MAAM,EAAE,OAAO,CAAC,OAAO;wBACvB,OAAO,EAAE,OAAO,CAAC,QAAQ;qBAC1B;oBACD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;iBAC/C,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,yBAAyB,CAC7B,QAAyB;YAEzB,gEAAgE;YAChE,sEAAsE;YACtE,kEAAkE;YAClE,oEAAoE;YACpE,sEAAsE;YACtE,sCAAsC;YACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,SAAmB,CAAC;YAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC,QAAkB,CAAC;YAC7D,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAEzC,sEAAsE;YACtE,qEAAqE;YACrE,mCAAmC;YACnC,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB,EACxB,IAAkC;YAElC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,SAAmB,CAAC;YAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,QAAkB,CAAC;YAC5D,MAAM,MAAM,GAAI,OAAO,CAAC,eAAuB,EAAE,MAEpC,CAAC;YACd,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;YAE5C,wEAAwE;YACxE,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACpE,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,QAAQ,EAAE,CAAC;oBACb,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAEnC,MAAM,WAAW,GACf,MAAM;gBACN,mBAAmB,CAAC,UAAU,EAAE;oBAC9B,iBAAiB,EAAG,OAAO,CAAC,eAAuB;wBACjD,EAAE,iBAAiB;iBACtB,CAAC,CAAC;YAEL,MAAM,QAAQ,GAA4B;gBACxC,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,WAAW;gBACnB,YAAY,EAAE,KAAK;gBACnB,YAAY,EAAE,KAAK;gBACnB,MAAM,EAAE,IAAI;aACb,CAAC;YAEF,IAAI,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,gDAAgD;oBAChD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,mCAAmC,EAAE;wBACnE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,KAAK,EAAE;4BAChC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC;qBAC1D,CAAC,CAAC;oBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;wBACxD,2DAA2D;wBAC3D,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACxD,CAAC;gBAED,8DAA8D;gBAC9D,sDAAsD;gBACtD,IAAI,QAAQ,EAAE,CAAC;oBACb,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBAED,uEAAuE;gBACvE,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC/B,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;wBAC1C,OAAO,EAAE,SAAS;wBAClB,IAAI,EAAE,KAAK;wBACX,YAAY,EAAE,KAAK;wBACnB,YAAY,EAAE,KAAK;wBACnB,MAAM,EAAE,IAAI;qBACb,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;gBACtD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAA4B;oBACpC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,IAAI,EAAE,KAAK;iBACZ,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS;oBAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;gBAExD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,wCAAwC,EACxC;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,KAAK,EAAE;4BAChC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoC,CAAC;oBACnE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC;oBAC3D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;oBAChE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CACjB,IAAY,EACZ,IAAqC;YAErC,OAAO;gBACL,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;gBACjC,eAAe,EAAE,IAAI,EAAE,iBAAiB;oBACtC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE;oBAC/C,CAAC,CAAC,EAAE;aACP,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAAgB;YAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACrD,MAAM,UAAU,GAAG,QAAQ,IAAI,SAAS,CAAC;YAEzC,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU;gBACV,OAAO,EAAE;oBACP,QAAQ;oBACR,SAAS;iBACV;gBACD,KAAK,EAAE,CAAC,UAAU;oBAChB,CAAC,CAAC,kEAAkE;oBACpE,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,IAAI,uBAAuB,GAAG,KAAK,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,yBAAyB,CAAC,OAAY;IAC7C,MAAM,MAAM,GACV,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,QAAQ,GACZ,OAAO,OAAO,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3E,MAAM,cAAc,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAErE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,6CAA6C;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,uBAAuB,GAAG,IAAI,CAAC;YAC/B,OAAO,CAAC,IAAI,CACV,6HAA6H;gBAC3H,gHAAgH,CACnH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,8BAA8B;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,8BAA8B;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAc;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,wEAAwE;IACxE,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY,EAAE,SAAiB;IAChE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,GAAG,SAAS,GAAG,SAAS;YAAE,MAAM;QACzC,KAAK,IAAI,SAAS,CAAC;QACnB,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE/D,4BAA4B;QAC5B,IAAI,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,0BAA0B;YAC1B,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,SAAS,oBAAoB,CAAC,IAAY,EAAE,SAAiB;IAC3D,OAAO,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;4EAK4E;AAC5E,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,OAAO,CACL,OAAO;SACJ,OAAO,CAAC,0BAA0B,EAAE,SAAS,CAAC;QAC/C,sEAAsE;QACtE,sEAAsE;SACrE,OAAO,CAAC,oCAAoC,EAAE,MAAM,CAAC;QACtD,oEAAoE;QACpE,gEAAgE;QAChE,sEAAsE;QACtE,iEAAiE;QACjE,gDAAgD;SAC/C,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,KAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,MAAc;IAEd,aAAa,CAAC,mDAAmD,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,QAAQ;YACnB,MAAM;SACP,CAAC;KACH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,IAAoC;IAEpC,MAAM,aAAa,GAAG,YAAY,CAChC,IAAI,IAAI,iBAAiB,EACzB,6BAA6B,CAC9B,CAAC;IACF,MAAM,MAAM,GAAU,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE;oBAC9D,GAAG,EAAE,IAAI,CAAC,iBAAiB;oBAC3B,SAAS,EAAE,sBAAsB;iBAClC;aACF;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CACtB,KAAa,EACb,SAAiB,EACjB,QAA4B,EAC5B,IAA6B;IAE7B,MAAM,SAAS,GACb,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAK,IAAI,CAAC,MAAoB,CAAC,MAAM,GAAG,CAAC,CAAC;IACtE,IACE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC7B,CAAC,SAAS,EACV,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAA4B;QACvC,GAAG,IAAI;QACP,OAAO,EAAE,SAAS;KACnB,CAAC;IACF,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,wCAAwC,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,IAAiB;IAEjB,MAAM,UAAU,GACd,OAAO,eAAe,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;YACtB,GAAG,IAAI;YACP,MAAM,EAAE,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM;SAC1C,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { createError, getHeader, readRawBody } from \"h3\";\nimport type {\n  PlatformAdapter,\n  IncomingMessage,\n  OutgoingMessage,\n  IntegrationStatus,\n  OutboundTarget,\n} from \"../types.js\";\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { getIntegrationConfig } from \"../config-store.js\";\n\n/** Slack's max message length */\nconst SLACK_MAX_LENGTH = 4000;\nconst SLACK_SECTION_TEXT_MAX_LENGTH = 3000;\nconst SLACK_API_TIMEOUT_MS = 10_000;\n\n/**\n * Create a Slack platform adapter.\n *\n * Required env vars:\n * - SLACK_BOT_TOKEN — Bot user OAuth token (xoxb-...)\n * - SLACK_SIGNING_SECRET — Used to verify webhook signatures\n *\n * Optional env vars:\n * - SLACK_ALLOWED_TEAM_IDS — Comma-separated list of Slack workspace\n *   `team_id` values (e.g. \"T012ABCDEF,T034GHIJKL\") that this deployment\n *   accepts events from. Required in production and strongly recommended\n *   to prevent cross-workspace event injection (H1 in the webhook audit):\n *   the global `SLACK_SIGNING_SECRET` is the same key for every workspace\n *   the app is installed to, so without an allowlist any installed\n *   workspace can drive the agent. When unset the adapter accepts events\n *   from any workspace in development, but rejects events in production.\n * - SLACK_ALLOWED_API_APP_IDS — Comma-separated list of Slack app IDs\n *   (`api_app_id`) to additionally pin events to. Useful when the same\n *   signing secret rotation surfaces multiple app installs.\n */\nexport function slackAdapter(): PlatformAdapter {\n  return {\n    platform: \"slack\",\n    label: \"Slack\",\n\n    getRequiredEnvKeys(): EnvKeyConfig[] {\n      return [\n        {\n          key: \"SLACK_BOT_TOKEN\",\n          label: \"Slack Bot Token\",\n          required: true,\n          helpText:\n            \"In your Slack app's left nav: OAuth & Permissions → Bot User OAuth Token (starts with `xoxb-`).\",\n        },\n        {\n          key: \"SLACK_SIGNING_SECRET\",\n          label: \"Slack Signing Secret\",\n          required: true,\n          helpText:\n            \"In your Slack app's left nav: Basic Information → App Credentials → Signing Secret.\",\n        },\n      ];\n    },\n\n    async handleVerification(\n      event: H3Event,\n    ): Promise<{ handled: boolean; response?: unknown }> {\n      // Slack sends url_verification when first setting up the webhook.\n      // readRawBodyCached caches the raw bytes on event.context.__rawBody so\n      // subsequent verifyWebhook + parseIncomingMessage calls re-use them\n      // without re-stringifying a parsed body (M2 in the audit).\n      const body = await readRawBodyCached(event);\n      try {\n        const parsed = JSON.parse(body);\n        if (parsed.type === \"url_verification\") {\n          // Slack's URL verifier expects the raw challenge value in the\n          // response body. Returning JSON works for some clients but the app\n          // settings verifier rejects it as not matching the challenge.\n          return { handled: true, response: parsed.challenge };\n        }\n      } catch {}\n      return { handled: false };\n    },\n\n    async verifyWebhook(event: H3Event): Promise<boolean> {\n      const signingSecret = process.env.SLACK_SIGNING_SECRET;\n      if (!signingSecret) return false;\n\n      const signature = getHeader(event, \"x-slack-signature\");\n      const timestamp = getHeader(event, \"x-slack-request-timestamp\");\n      if (!signature || !timestamp) return false;\n\n      // Reject requests older than 5 minutes (replay protection)\n      const ts = parseInt(timestamp, 10);\n      if (Math.abs(Date.now() / 1000 - ts) > 300) return false;\n\n      const body = await readRawBodyCached(event);\n      const crypto = await import(\"node:crypto\");\n      const basestring = `v0:${timestamp}:${body}`;\n      const expectedSignature =\n        \"v0=\" +\n        crypto\n          .createHmac(\"sha256\", signingSecret)\n          .update(basestring)\n          .digest(\"hex\");\n\n      // Timing-safe comparison\n      try {\n        return crypto.timingSafeEqual(\n          Buffer.from(signature),\n          Buffer.from(expectedSignature),\n        );\n      } catch {\n        return false;\n      }\n    },\n\n    async parseIncomingMessage(\n      event: H3Event,\n    ): Promise<IncomingMessage | null> {\n      const raw = await readRawBodyCached(event);\n      let payload: any;\n      try {\n        payload = JSON.parse(raw);\n      } catch {\n        return null;\n      }\n\n      // H1 (webhook audit): cross-workspace event injection. The global\n      // SLACK_SIGNING_SECRET is the same key for every workspace this Slack\n      // app is installed to — without a per-tenant allowlist any installed\n      // workspace can drive the agent. We enforce SLACK_ALLOWED_TEAM_IDS\n      // here AFTER the signature has already been verified by the webhook\n      // handler, so this is purely a tenant-isolation gate (not a forgery\n      // defense). When unset in production we surface a one-time warning\n      // recommending it be configured.\n      enforceWorkspaceAllowlist(payload);\n\n      // Handle Events API wrapper\n      if (payload.type === \"event_callback\") {\n        const e = payload.event;\n        if (!e) return null;\n\n        // Ignore bot messages\n        if (e.bot_id || e.subtype === \"bot_message\") return null;\n        // Ignore message edits and deletes\n        if (e.subtype === \"message_changed\" || e.subtype === \"message_deleted\")\n          return null;\n\n        // Handle both direct messages and app_mentions\n        const text = e.text?.trim();\n        if (!text) return null;\n\n        // Remove bot mention from text (e.g., \"<@U123> do something\" → \"do something\")\n        const cleanText = text.replace(/<@[A-Z0-9]+>/g, \"\").trim();\n        if (!cleanText) return null;\n\n        // Thread ID: use thread_ts if in a thread, otherwise message ts\n        const threadTs = e.thread_ts || e.ts;\n        const externalThreadId = `${e.channel}:${threadTs}`;\n\n        return {\n          platform: \"slack\",\n          externalThreadId,\n          text: cleanText,\n          senderName: e.user,\n          senderId: e.user,\n          platformContext: {\n            channelId: e.channel,\n            threadTs: threadTs,\n            messageTs: e.ts,\n            teamId: payload.team_id,\n            eventId: payload.event_id,\n          },\n          timestamp: Math.floor(parseFloat(e.ts) * 1000),\n        };\n      }\n\n      return null;\n    },\n\n    async postProcessingPlaceholder(\n      incoming: IncomingMessage,\n    ): Promise<{ placeholderRef: string } | null> {\n      // No placeholder reply in the thread — Slack's native assistant\n      // status bar (\"agent-native is thinking…\", below the composer) is the\n      // loading affordance. A second visible \"Working on it…\" reply was\n      // redundant and added an extra chunk that we then had to overwrite.\n      // We just set the native status and return null so sendResponse posts\n      // the final reply as a fresh message.\n      const token = process.env.SLACK_BOT_TOKEN;\n      if (!token) return null;\n\n      const channelId = incoming.platformContext.channelId as string;\n      const threadTs = incoming.platformContext.threadTs as string;\n      if (!channelId || !threadTs) return null;\n\n      // Best-effort: flip the native AI-assistant \"is thinking…\" status bar\n      // in the channel input area. Requires `assistant:write` scope on the\n      // app — otherwise silently no-ops.\n      setSlackAssistantStatus(token, channelId, threadTs, \"is thinking…\");\n      return null;\n    },\n\n    async sendResponse(\n      message: OutgoingMessage,\n      context: IncomingMessage,\n      opts?: { placeholderRef?: string },\n    ): Promise<void> {\n      const token = process.env.SLACK_BOT_TOKEN;\n      if (!token) {\n        console.error(\"[slack] SLACK_BOT_TOKEN not configured\");\n        return;\n      }\n\n      const channelId = context.platformContext.channelId as string;\n      const threadTs = context.platformContext.threadTs as string;\n      const blocks = (message.platformContext as any)?.blocks as\n        | unknown[]\n        | undefined;\n      const placeholderRef = opts?.placeholderRef;\n\n      // Block-rich path: split text into chunks but render the FIRST chunk as\n      // blocks (so we keep the in-place edit + button) and any overflow as\n      // plain follow-up posts. The vast majority of replies fit in one block.\n      const chunks = splitNonEmptyMessage(message.text, SLACK_MAX_LENGTH);\n      const hasProvidedBlocks = Array.isArray(blocks) && blocks.length > 0;\n      const firstChunk = chunks[0] ?? (hasProvidedBlocks ? \"Response\" : \"\");\n      if (!firstChunk) {\n        if (threadTs) {\n          setSlackAssistantStatus(token, channelId, threadTs, \"\");\n        }\n        return;\n      }\n      const restChunks = chunks.slice(1);\n\n      const finalBlocks =\n        blocks ??\n        buildResponseBlocks(firstChunk, {\n          threadDeepLinkUrl: (message.platformContext as any)\n            ?.threadDeepLinkUrl,\n        });\n\n      const baseBody: Record<string, unknown> = {\n        channel: channelId,\n        text: firstChunk,\n        blocks: finalBlocks,\n        unfurl_links: false,\n        unfurl_media: false,\n        mrkdwn: true,\n      };\n\n      try {\n        if (placeholderRef) {\n          // Replace the \"thinking…\" placeholder in place.\n          const res = await slackApiFetch(\"https://slack.com/api/chat.update\", {\n            method: \"POST\",\n            headers: {\n              Authorization: `Bearer ${token}`,\n              \"Content-Type\": \"application/json\",\n            },\n            body: JSON.stringify({ ...baseBody, ts: placeholderRef }),\n          });\n          const data = (await res.json()) as {\n            ok: boolean;\n            error?: string;\n          };\n          if (!data.ok) {\n            console.error(\"[slack] chat.update error:\", data.error);\n            // Fall back to a fresh post so the user still sees a reply\n            await postFresh(token, channelId, threadTs, baseBody);\n          }\n        } else {\n          await postFresh(token, channelId, threadTs, baseBody);\n        }\n\n        // Clear the AI-assistant \"is thinking…\" status now that we've\n        // delivered the final answer. Empty status clears it.\n        if (threadTs) {\n          setSlackAssistantStatus(token, channelId, threadTs, \"\");\n        }\n\n        // Overflow chunks (rare) — post as plain follow-ups in the same thread\n        for (const chunk of restChunks) {\n          await postFresh(token, channelId, threadTs, {\n            channel: channelId,\n            text: chunk,\n            unfurl_links: false,\n            unfurl_media: false,\n            mrkdwn: true,\n          });\n        }\n      } catch (err) {\n        console.error(\"[slack] Failed to send message:\", err);\n        throw err;\n      }\n    },\n\n    async sendMessageToTarget(\n      message: OutgoingMessage,\n      target: OutboundTarget,\n    ): Promise<void> {\n      const token = process.env.SLACK_BOT_TOKEN;\n      if (!token) {\n        console.error(\"[slack] SLACK_BOT_TOKEN not configured\");\n        return;\n      }\n\n      const chunks = splitNonEmptyMessage(message.text, SLACK_MAX_LENGTH);\n      if (chunks.length === 0) return;\n      for (const chunk of chunks) {\n        const body: Record<string, unknown> = {\n          channel: target.destination,\n          text: chunk,\n        };\n        if (target.threadRef) body.thread_ts = target.threadRef;\n\n        try {\n          const res = await slackApiFetch(\n            \"https://slack.com/api/chat.postMessage\",\n            {\n              method: \"POST\",\n              headers: {\n                Authorization: `Bearer ${token}`,\n                \"Content-Type\": \"application/json\",\n              },\n              body: JSON.stringify(body),\n            },\n          );\n          const data = (await res.json()) as { ok: boolean; error?: string };\n          if (!data.ok) {\n            throw new Error(data.error || \"chat.postMessage failed\");\n          }\n        } catch (err) {\n          console.error(\"[slack] Failed to send proactive message:\", err);\n          throw err;\n        }\n      }\n    },\n\n    formatAgentResponse(\n      text: string,\n      opts?: { threadDeepLinkUrl?: string },\n    ): OutgoingMessage {\n      return {\n        text: markdownToSlackMrkdwn(text),\n        platformContext: opts?.threadDeepLinkUrl\n          ? { threadDeepLinkUrl: opts.threadDeepLinkUrl }\n          : {},\n      };\n    },\n\n    async getStatus(baseUrl?: string): Promise<IntegrationStatus> {\n      const hasToken = !!process.env.SLACK_BOT_TOKEN;\n      const hasSecret = !!process.env.SLACK_SIGNING_SECRET;\n      const configured = hasToken && hasSecret;\n\n      return {\n        platform: \"slack\",\n        label: \"Slack\",\n        enabled: false, // overridden by plugin\n        configured,\n        details: {\n          hasToken,\n          hasSecret,\n        },\n        error: !configured\n          ? \"Set SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET in your environment\"\n          : undefined,\n      };\n    },\n  };\n}\n\n/**\n * Parse a comma-separated env var into a Set of trimmed, non-empty values.\n * Returns null when the env var is unset or empty (so callers can\n * distinguish \"no allowlist configured\" from \"empty allowlist\").\n */\nfunction parseAllowlistEnv(name: string): Set<string> | null {\n  const raw = process.env[name];\n  if (!raw) return null;\n  const values = raw\n    .split(\",\")\n    .map((v) => v.trim())\n    .filter((v) => v.length > 0);\n  if (values.length === 0) return null;\n  return new Set(values);\n}\n\nlet _missingAllowlistWarned = false;\n\n/**\n * Enforce that an incoming Slack event comes from an allowlisted workspace.\n *\n * H1 in the webhook audit: the framework uses a SINGLE global\n * SLACK_SIGNING_SECRET for every workspace the Slack app is installed to,\n * so a valid signature alone doesn't prove the request belongs to the\n * tenant the deployment intends to serve. This helper layers a per-tenant\n * allowlist on top of signature verification.\n *\n * Behavior:\n * - If `SLACK_ALLOWED_TEAM_IDS` is set: reject any payload whose\n *   `team_id` isn't in the list.\n * - If `SLACK_ALLOWED_API_APP_IDS` is set: also reject payloads whose\n *   `api_app_id` isn't in the list (bot apps can be installed under the\n *   same Slack app id across multiple workspaces — pinning both keeps\n *   the surface tight when team_id allows multiple workspaces).\n * - If `SLACK_ALLOWED_TEAM_IDS` is unset/empty in production: reject the\n *   event. Production must fail closed so any workspace with the shared\n *   signing secret cannot drive the agent.\n * - If `SLACK_ALLOWED_TEAM_IDS` is unset/empty in dev / single-tenant: log a\n *   one-time warning and accept (current local setup behavior).\n *\n * Throws an h3 401 error when an allowlisted-but-mismatched payload is\n * received, which the integrations plugin surfaces to the caller as\n * \"Unrecognized Slack workspace\" without enqueuing the event.\n */\nfunction enforceWorkspaceAllowlist(payload: any): void {\n  const teamId =\n    typeof payload?.team_id === \"string\" ? payload.team_id : undefined;\n  const apiAppId =\n    typeof payload?.api_app_id === \"string\" ? payload.api_app_id : undefined;\n\n  const allowedTeamIds = parseAllowlistEnv(\"SLACK_ALLOWED_TEAM_IDS\");\n  const allowedAppIds = parseAllowlistEnv(\"SLACK_ALLOWED_API_APP_IDS\");\n\n  if (!allowedTeamIds) {\n    if (process.env.NODE_ENV === \"production\") {\n      throw createError({\n        statusCode: 401,\n        statusMessage: \"Slack workspace allowlist is not configured\",\n      });\n    }\n    if (!_missingAllowlistWarned) {\n      _missingAllowlistWarned = true;\n      console.warn(\n        \"[slack] SLACK_ALLOWED_TEAM_IDS not set — accepting events from any workspace whose signature matches SLACK_SIGNING_SECRET. \" +\n          \"Set SLACK_ALLOWED_TEAM_IDS to a comma-separated list of allowed team_id values before deploying to production.\",\n      );\n    }\n  }\n\n  if (allowedTeamIds) {\n    if (!teamId || !allowedTeamIds.has(teamId)) {\n      throw createError({\n        statusCode: 401,\n        statusMessage: \"Unrecognized Slack workspace\",\n      });\n    }\n  }\n\n  if (allowedAppIds) {\n    if (!apiAppId || !allowedAppIds.has(apiAppId)) {\n      throw createError({\n        statusCode: 401,\n        statusMessage: \"Unrecognized Slack workspace\",\n      });\n    }\n  }\n}\n\n/**\n * Read the raw request body as a string and cache on the event context.\n *\n * This MUST read raw bytes from the request stream — never `JSON.stringify`\n * a parsed body, because Slack's HMAC is computed over the exact bytes Slack\n * sent. Re-stringifying a parsed object loses key ordering, whitespace, and\n * Unicode-escape choices, so the signature check would silently fail for\n * legitimate requests (M2 in the webhook security audit).\n *\n * h3 v2's body stream is consume-once, so we cache the raw string on the\n * event context after the first read. All call sites (handleVerification,\n * verifyWebhook, parseIncomingMessage) MUST go through this helper.\n */\nasync function readRawBodyCached(event: H3Event): Promise<string> {\n  const cached = event.context.__rawBody;\n  if (typeof cached === \"string\") return cached;\n  // h3's readRawBody returns the bytes Slack actually sent, defaulting to\n  // utf8-decoded. Returns undefined for empty bodies — we coerce to \"\" so\n  // the HMAC check can proceed deterministically.\n  const raw = (await readRawBody(event)) ?? \"\";\n  event.context.__rawBody = raw;\n  return raw;\n}\n\nfunction utf8ByteLength(text: string): number {\n  return new TextEncoder().encode(text).length;\n}\n\nfunction prefixWithinUtf8ByteLimit(text: string, maxLength: number): string {\n  let bytes = 0;\n  let end = 0;\n  for (const char of text) {\n    const nextBytes = utf8ByteLength(char);\n    if (bytes + nextBytes > maxLength) break;\n    bytes += nextBytes;\n    end += char.length;\n  }\n  return text.slice(0, end || 1);\n}\n\n/** Split a message into chunks that fit within the platform's byte limit. */\nfunction splitMessage(text: string, maxLength: number): string[] {\n  if (utf8ByteLength(text) <= maxLength) return [text];\n  const chunks: string[] = [];\n  let remaining = text;\n  while (remaining.length > 0) {\n    if (utf8ByteLength(remaining) <= maxLength) {\n      chunks.push(remaining);\n      break;\n    }\n\n    const prefix = prefixWithinUtf8ByteLimit(remaining, maxLength);\n\n    // Try to split at a newline\n    let splitIdx = prefix.lastIndexOf(\"\\n\");\n    if (splitIdx <= 0) {\n      // Try to split at a space\n      splitIdx = prefix.lastIndexOf(\" \");\n    }\n    if (splitIdx <= 0) {\n      splitIdx = prefix.length;\n    }\n    chunks.push(remaining.slice(0, splitIdx));\n    remaining = remaining.slice(splitIdx).trimStart();\n  }\n  return chunks;\n}\n\n/** Split a message and drop chunks Slack would render as blank messages. */\nfunction splitNonEmptyMessage(text: string, maxLength: number): string[] {\n  return splitMessage(text, maxLength).filter(\n    (chunk) => chunk.trim().length > 0,\n  );\n}\n\n/** Hard cap on input length we feed to the regex-based mrkdwn converter.\n *  L2 in the webhook audit: `\\*\\*(.+?)\\*\\*` with the `s` flag on a long\n *  string of asterisks can exhibit super-linear backtracking. Slack\n *  itself caps message bodies at 4000 chars (SLACK_MAX_LENGTH); we cap\n *  the input here at 10x that as a defensive bound for any caller that\n *  passes a longer rendering source through this helper before chunking. */\nconst MRKDWN_MAX_LENGTH = 40_000;\n\n/**\n * Convert standard markdown to Slack's mrkdwn dialect.\n * - `[text](url)` → `<url|text>`\n * - `**bold**` → `*bold*` (Slack uses single asterisks for bold)\n *\n * Inputs longer than MRKDWN_MAX_LENGTH are truncated before the regex\n * pass to bound worst-case backtracking on pathological input (L2 in the\n * webhook audit).\n */\nfunction markdownToSlackMrkdwn(text: string): string {\n  const bounded =\n    text.length > MRKDWN_MAX_LENGTH ? text.slice(0, MRKDWN_MAX_LENGTH) : text;\n  return (\n    bounded\n      .replace(/\\[([^\\]]+)\\]\\(([^)]+)\\)/g, \"<$2|$1>\")\n      // Do not wrap bare URLs in Slack bold markers. Slack's autolinker can\n      // treat the trailing `*` as part of the URL, producing a broken link.\n      .replace(/\\*\\*<?(https?:\\/\\/[^\\s>*]+)>?\\*\\*/g, \"<$1>\")\n      // Bounded character class instead of `.+?` with the `s` flag — caps\n      // each bold span at 5000 chars so an attacker can't construct a\n      // pathological \"**\" sequence that exhibits super-linear backtracking.\n      // Newlines are allowed because `[^*]` excludes only the asterisk\n      // itself, so multi-line bold spans still match.\n      .replace(/\\*\\*([^*]{1,5000})\\*\\*/g, \"*$1*\")\n  );\n}\n\n/**\n * Optionally set Slack's native AI-assistant status indicator (the small\n * \"is thinking…\" line under the message composer) for an app configured\n * with the `assistant:write` scope. Pure best-effort — fails silently for\n * apps that aren't set up as AI assistants.\n */\nfunction setSlackAssistantStatus(\n  token: string,\n  channelId: string,\n  threadTs: string,\n  status: string,\n): void {\n  slackApiFetch(\"https://slack.com/api/assistant.threads.setStatus\", {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${token}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      channel_id: channelId,\n      thread_ts: threadTs,\n      status,\n    }),\n  }).catch(() => {});\n}\n\n/**\n * Block Kit payload for the final answer. We avoid auto-unfurl previews by\n * separating the deep-link out into a button instead of inlining it as a\n * `<url|text>` markdown link in the section body — that's what was producing\n * the giant \"Agent-Native Dispatch\" card in every thread reply.\n */\nfunction buildResponseBlocks(\n  text: string,\n  opts: { threadDeepLinkUrl?: string },\n): unknown[] {\n  const sectionChunks = splitMessage(\n    text || \"_(no response)_\",\n    SLACK_SECTION_TEXT_MAX_LENGTH,\n  );\n  const blocks: any[] = sectionChunks.map((chunk) => ({\n    type: \"section\",\n    text: { type: \"mrkdwn\", text: chunk },\n  }));\n  if (opts.threadDeepLinkUrl) {\n    blocks.push({\n      type: \"actions\",\n      elements: [\n        {\n          type: \"button\",\n          text: { type: \"plain_text\", text: \"Open thread\", emoji: true },\n          url: opts.threadDeepLinkUrl,\n          action_id: \"open_dispatch_thread\",\n        },\n      ],\n    });\n  }\n  return blocks;\n}\n\n/**\n * Post a fresh message to a thread. Used as the placeholder-fallback path\n * (e.g. when chat.update fails) and for follow-up overflow chunks.\n */\nasync function postFresh(\n  token: string,\n  channelId: string,\n  threadTs: string | undefined,\n  body: Record<string, unknown>,\n): Promise<void> {\n  const hasBlocks =\n    Array.isArray(body.blocks) && (body.blocks as unknown[]).length > 0;\n  if (\n    typeof body.text === \"string\" &&\n    body.text.trim().length === 0 &&\n    !hasBlocks\n  ) {\n    return;\n  }\n\n  const payload: Record<string, unknown> = {\n    ...body,\n    channel: channelId,\n  };\n  if (threadTs && !payload.thread_ts) payload.thread_ts = threadTs;\n  const res = await slackApiFetch(\"https://slack.com/api/chat.postMessage\", {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${token}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify(payload),\n  });\n  const data = (await res.json()) as { ok: boolean; error?: string };\n  if (!data.ok) {\n    console.error(\"[slack] chat.postMessage error:\", data.error);\n    throw new Error(data.error || \"chat.postMessage failed\");\n  }\n}\n\nasync function slackApiFetch(\n  url: string,\n  init: RequestInit,\n): Promise<Response> {\n  const controller =\n    typeof AbortController !== \"undefined\" ? new AbortController() : undefined;\n  const timer = controller\n    ? setTimeout(() => controller.abort(), SLACK_API_TIMEOUT_MS)\n    : undefined;\n  try {\n    return await fetch(url, {\n      ...init,\n      signal: controller?.signal ?? init.signal,\n    });\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n"]}

package/dist/integrations/pending-tasks-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pending-tasks-store.d.ts","sourceRoot":"","sources":["../../src/integrations/pending-tasks-store.ts"],"names":[],"mappings":"AAgFA,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,YAAY,GACZ,WAAW,GACX,QAAQ,CAAC;AAEb,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAoBD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAU3D;AAED,kCAAkC;AAClC,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAU5E;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA6B7B;AAED,gCAAgC;AAChC,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjE;AAED,wDAAwD;AACxD,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAUf"}
+{"version":3,"file":"pending-tasks-store.d.ts","sourceRoot":"","sources":["../../src/integrations/pending-tasks-store.ts"],"names":[],"mappings":"AAgFA,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,YAAY,GACZ,WAAW,GACX,QAAQ,CAAC;AAEb,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAoBD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAU3D;AAED,kCAAkC;AAClC,wBAAsB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAU5E;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAkC7B;AAED,gCAAgC;AAChC,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUjE;AAED,wDAAwD;AACxD,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/integrations/pending-tasks-store.js

@@ -154,7 +154,7 @@ export async function claimPendingTask(id) {
     const now = Date.now();
     // Conditional update: only flip if currently pending. Failed tasks are
     // terminal unless an explicit retry path resets them to pending first.
-    const { rows } = await client.execute({
+    const result = await client.execute({
         sql: isPostgres()
             ? `UPDATE integration_pending_tasks
          SET status = ?, attempts = attempts + 1, updated_at = ?
@@ -165,6 +165,7 @@ export async function claimPendingTask(id) {
          WHERE id = ? AND status = 'pending'`,
         args: ["processing", now, id],
     });
+    const rows = result.rows ?? [];
     if (isPostgres()) {
         if (rows.length === 0)
             return null;
@@ -172,6 +173,10 @@ export async function claimPendingTask(id) {
     }
     // SQLite: no RETURNING, so re-read after the update. Confirm we actually
     // moved it into 'processing' (vs. lost the race).
+    const affected = result.rowsAffected ??
+        result.rowCount;
+    if (affected === 0)
+        return null;
     const fetched = await getPendingTask(id);
     if (!fetched || fetched.status !== "processing")
         return null;

package/dist/integrations/pending-tasks-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"pending-tasks-store.js","sourceRoot":"","sources":["../../src/integrations/pending-tasks-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAEjE,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;;qBASN,OAAO,EAAE;;uBAEP,OAAO,EAAE;uBACT,OAAO,EAAE;yBACP,OAAO,EAAE;;OAE3B,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAClB,8GAA8G,CAC/G,CAAC;YACF,oEAAoE;YACpE,oEAAoE;YACpE,+DAA+D;YAC/D,kEAAkE;YAClE,iEAAiE;YACjE,+BAA+B;YAC/B,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,MAAM,CAAC,OAAO,CAClB,0HAA0H,CAC3H,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAoC;IAEpC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,OAAO,CAClB,wFAAwF,CACzF,CAAC;QACF,OAAO;IACT,CAAC;IACD,wEAAwE;IACxE,uDAAuD;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAClB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IACE,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC;aACzB,WAAW,EAAE;aACb,QAAQ,CAAC,WAAW,CAAC,EACxB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAwBD,SAAS,SAAS,CAAC,GAA4B;IAC7C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,gBAAgB,EAAE,GAAG,CAAC,kBAA4B;QAClD,OAAO,EAAE,GAAG,CAAC,OAAiB;QAC9B,UAAU,EAAE,GAAG,CAAC,WAAqB;QACrC,KAAK,EAAG,GAAG,CAAC,MAAwB,IAAI,IAAI;QAC5C,MAAM,EAAE,GAAG,CAAC,MAA2B;QACvC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnC,YAAY,EAAG,GAAG,CAAC,aAA+B,IAAI,IAAI;QAC1D,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,WAAW,EACT,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAsB,CAAC;KACvE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAQvC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;+CAEsC;QAC3C,IAAI,EAAE;YACJ,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,gBAAgB;YACtB,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,SAAS;YACT,CAAC;YACD,GAAG;YACH,GAAG;YACH,KAAK,CAAC,gBAAgB,IAAI,IAAI;SAC/B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,MAAM,CAAC,GAAG,GAAiD,CAAC;IAC5D,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtB,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,kCAAkC;AAClC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE;8DACqD;QAC1D,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,UAAU,EAAE;YACf,CAAC,CAAC;;;yJAGiJ;YACnJ,CAAC,CAAC;;6CAEqC;QACzC,IAAI,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;KAC9B,CAAC,CAAC;IAEH,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC;IACvD,CAAC;IAED,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gCAAgC;AAChC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU;IAChD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;uBAEc;QACnB,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAU,EACV,YAAoB;IAEpB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;uBAEc;QACnB,IAAI,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;KACvD,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * SQL-backed pending task queue for integration webhooks.\n *\n * Why this exists: serverless platforms (Netlify Lambda, Vercel, Cloudflare\n * Workers) freeze the function execution as soon as the HTTP response is\n * returned. Fire-and-forget background `Promise`s get killed mid-flight,\n * meaning agent loops triggered from a Slack/Telegram webhook never finish.\n *\n * Solution: persist the inbound message to SQL inside the webhook handler,\n * then dispatch a fresh HTTP POST to a separate processor endpoint. Each\n * invocation gets its own fresh function timeout budget.\n */\nimport { getDbExec, isPostgres, intType } from \"../db/client.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS integration_pending_tasks (\n          id TEXT PRIMARY KEY,\n          platform TEXT NOT NULL,\n          external_thread_id TEXT NOT NULL,\n          payload TEXT NOT NULL,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          status TEXT NOT NULL,\n          attempts ${intType()} NOT NULL DEFAULT 0,\n          error_message TEXT,\n          created_at ${intType()} NOT NULL,\n          updated_at ${intType()} NOT NULL,\n          completed_at ${intType()}\n        )\n      `);\n      await client.execute(\n        `CREATE INDEX IF NOT EXISTS idx_pending_tasks_status_created ON integration_pending_tasks(status, created_at)`,\n      );\n      // Additive migration: add a stable per-event dedup key so duplicate\n      // webhook deliveries from the same platform get rejected at the SQL\n      // layer instead of via an in-memory Map (which doesn't survive\n      // serverless cold starts — H3 in the webhook security audit). The\n      // unique index ensures a duplicate INSERT raises an error we can\n      // catch as \"already-enqueued\".\n      await ensureExternalEventKey(client);\n      await client.execute(\n        `CREATE UNIQUE INDEX IF NOT EXISTS idx_pending_tasks_event_key ON integration_pending_tasks(platform, external_event_key)`,\n      );\n    })();\n  }\n  return _initPromise;\n}\n\nasync function ensureExternalEventKey(\n  client: ReturnType<typeof getDbExec>,\n): Promise<void> {\n  if (isPostgres()) {\n    await client.execute(\n      `ALTER TABLE integration_pending_tasks ADD COLUMN IF NOT EXISTS external_event_key TEXT`,\n    );\n    return;\n  }\n  // SQLite doesn't support `ADD COLUMN IF NOT EXISTS` until 3.35; swallow\n  // the duplicate-column error so reruns are idempotent.\n  try {\n    await client.execute(\n      `ALTER TABLE integration_pending_tasks ADD COLUMN external_event_key TEXT`,\n    );\n  } catch (err: any) {\n    if (\n      !String(err?.message ?? err)\n        .toLowerCase()\n        .includes(\"duplicate\")\n    ) {\n      throw err;\n    }\n  }\n}\n\n/** Status values for an integration pending task. */\nexport type PendingTaskStatus =\n  | \"pending\"\n  | \"processing\"\n  | \"completed\"\n  | \"failed\";\n\nexport interface PendingTask {\n  id: string;\n  platform: string;\n  externalThreadId: string;\n  payload: string;\n  ownerEmail: string;\n  orgId: string | null;\n  status: PendingTaskStatus;\n  attempts: number;\n  errorMessage: string | null;\n  createdAt: number;\n  updatedAt: number;\n  completedAt: number | null;\n}\n\nfunction rowToTask(row: Record<string, unknown>): PendingTask {\n  return {\n    id: row.id as string,\n    platform: row.platform as string,\n    externalThreadId: row.external_thread_id as string,\n    payload: row.payload as string,\n    ownerEmail: row.owner_email as string,\n    orgId: (row.org_id as string | null) ?? null,\n    status: row.status as PendingTaskStatus,\n    attempts: Number(row.attempts ?? 0),\n    errorMessage: (row.error_message as string | null) ?? null,\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n    completedAt:\n      row.completed_at == null ? null : Number(row.completed_at as number),\n  };\n}\n\n/**\n * Insert a new pending task. Returns the generated task id.\n *\n * If `externalEventKey` is supplied, the unique index on\n * `(platform, external_event_key)` will reject duplicates — callers should\n * catch the resulting constraint-violation error and treat it as\n * \"already enqueued\" instead of a hard failure (H3 in the webhook security\n * audit). This is the SQL-backed replacement for the in-memory dedup map.\n */\nexport async function insertPendingTask(input: {\n  id: string;\n  platform: string;\n  externalThreadId: string;\n  payload: string;\n  ownerEmail: string;\n  orgId?: string | null;\n  externalEventKey?: string | null;\n}): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  await client.execute({\n    sql: `INSERT INTO integration_pending_tasks\n      (id, platform, external_thread_id, payload, owner_email, org_id, status, attempts, created_at, updated_at, external_event_key)\n      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      input.id,\n      input.platform,\n      input.externalThreadId,\n      input.payload,\n      input.ownerEmail,\n      input.orgId ?? null,\n      \"pending\",\n      0,\n      now,\n      now,\n      input.externalEventKey ?? null,\n    ],\n  });\n}\n\n/**\n * Returns whether a duplicate-event error from `insertPendingTask` looks\n * like a unique-constraint violation on `(platform, external_event_key)`.\n *\n * Postgres surfaces these as `error.code === \"23505\"`, while SQLite uses\n * a substring match on the error text. Used by the webhook handler to\n * distinguish \"already enqueued\" (silently OK) from genuine insert failures.\n */\nexport function isDuplicateEventError(err: unknown): boolean {\n  const e = err as { code?: string; message?: string } | null;\n  if (!e) return false;\n  if (e.code === \"23505\") return true; // Postgres unique-violation\n  const msg = String(e.message ?? \"\").toLowerCase();\n  return (\n    msg.includes(\"unique\") ||\n    msg.includes(\"duplicate entry\") ||\n    msg.includes(\"duplicate key\")\n  );\n}\n\n/** Fetch a pending task by id. */\nexport async function getPendingTask(id: string): Promise<PendingTask | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT id, platform, external_thread_id, payload, owner_email, org_id, status, attempts, error_message, created_at, updated_at, completed_at\n          FROM integration_pending_tasks WHERE id = ? LIMIT 1`,\n    args: [id],\n  });\n  if (rows.length === 0) return null;\n  return rowToTask(rows[0] as Record<string, unknown>);\n}\n\n/**\n * Atomically claim a task: transition pending → processing and increment\n * attempts. Returns the updated task if the transition succeeded, otherwise\n * null (e.g. the task was already claimed by a concurrent worker).\n */\nexport async function claimPendingTask(\n  id: string,\n): Promise<PendingTask | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n\n  // Conditional update: only flip if currently pending. Failed tasks are\n  // terminal unless an explicit retry path resets them to pending first.\n  const { rows } = await client.execute({\n    sql: isPostgres()\n      ? `UPDATE integration_pending_tasks\n         SET status = ?, attempts = attempts + 1, updated_at = ?\n         WHERE id = ? AND status = 'pending'\n         RETURNING id, platform, external_thread_id, payload, owner_email, org_id, status, attempts, error_message, created_at, updated_at, completed_at`\n      : `UPDATE integration_pending_tasks\n         SET status = ?, attempts = attempts + 1, updated_at = ?\n         WHERE id = ? AND status = 'pending'`,\n    args: [\"processing\", now, id],\n  });\n\n  if (isPostgres()) {\n    if (rows.length === 0) return null;\n    return rowToTask(rows[0] as Record<string, unknown>);\n  }\n\n  // SQLite: no RETURNING, so re-read after the update. Confirm we actually\n  // moved it into 'processing' (vs. lost the race).\n  const fetched = await getPendingTask(id);\n  if (!fetched || fetched.status !== \"processing\") return null;\n  return fetched;\n}\n\n/** Mark a task as completed. */\nexport async function markTaskCompleted(id: string): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  await client.execute({\n    sql: `UPDATE integration_pending_tasks\n          SET status = ?, updated_at = ?, completed_at = ?\n          WHERE id = ?`,\n    args: [\"completed\", now, now, id],\n  });\n}\n\n/** Mark a task as failed and stash an error message. */\nexport async function markTaskFailed(\n  id: string,\n  errorMessage: string,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  await client.execute({\n    sql: `UPDATE integration_pending_tasks\n          SET status = ?, updated_at = ?, error_message = ?\n          WHERE id = ?`,\n    args: [\"failed\", now, errorMessage.slice(0, 2000), id],\n  });\n}\n"]}
+{"version":3,"file":"pending-tasks-store.js","sourceRoot":"","sources":["../../src/integrations/pending-tasks-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAEjE,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;;;qBASN,OAAO,EAAE;;uBAEP,OAAO,EAAE;uBACT,OAAO,EAAE;yBACP,OAAO,EAAE;;OAE3B,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAClB,8GAA8G,CAC/G,CAAC;YACF,oEAAoE;YACpE,oEAAoE;YACpE,+DAA+D;YAC/D,kEAAkE;YAClE,iEAAiE;YACjE,+BAA+B;YAC/B,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,MAAM,CAAC,OAAO,CAClB,0HAA0H,CAC3H,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAoC;IAEpC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,OAAO,CAClB,wFAAwF,CACzF,CAAC;QACF,OAAO;IACT,CAAC;IACD,wEAAwE;IACxE,uDAAuD;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAClB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IACE,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC;aACzB,WAAW,EAAE;aACb,QAAQ,CAAC,WAAW,CAAC,EACxB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAwBD,SAAS,SAAS,CAAC,GAA4B;IAC7C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAkB;QAChC,gBAAgB,EAAE,GAAG,CAAC,kBAA4B;QAClD,OAAO,EAAE,GAAG,CAAC,OAAiB;QAC9B,UAAU,EAAE,GAAG,CAAC,WAAqB;QACrC,KAAK,EAAG,GAAG,CAAC,MAAwB,IAAI,IAAI;QAC5C,MAAM,EAAE,GAAG,CAAC,MAA2B;QACvC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnC,YAAY,EAAG,GAAG,CAAC,aAA+B,IAAI,IAAI;QAC1D,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,WAAW,EACT,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAsB,CAAC;KACvE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAQvC;IACC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;+CAEsC;QAC3C,IAAI,EAAE;YACJ,KAAK,CAAC,EAAE;YACR,KAAK,CAAC,QAAQ;YACd,KAAK,CAAC,gBAAgB;YACtB,KAAK,CAAC,OAAO;YACb,KAAK,CAAC,UAAU;YAChB,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,SAAS;YACT,CAAC;YACD,GAAG;YACH,GAAG;YACH,KAAK,CAAC,gBAAgB,IAAI,IAAI;SAC/B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,MAAM,CAAC,GAAG,GAAiD,CAAC;IAC5D,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtB,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC/B,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,kCAAkC;AAClC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE;8DACqD;QAC1D,IAAI,EAAE,CAAC,EAAE,CAAC;KACX,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,UAAU,EAAE;YACf,CAAC,CAAC;;;yJAGiJ;YACnJ,CAAC,CAAC;;6CAEqC;QACzC,IAAI,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAE/B,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC;IACvD,CAAC;IAED,yEAAyE;IACzE,kDAAkD;IAClD,MAAM,QAAQ,GACX,MAAuD,CAAC,YAAY;QACpE,MAAuD,CAAC,QAAQ,CAAC;IACpE,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gCAAgC;AAChC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAU;IAChD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;uBAEc;QACnB,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAU,EACV,YAAoB;IAEpB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;uBAEc;QACnB,IAAI,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;KACvD,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * SQL-backed pending task queue for integration webhooks.\n *\n * Why this exists: serverless platforms (Netlify Lambda, Vercel, Cloudflare\n * Workers) freeze the function execution as soon as the HTTP response is\n * returned. Fire-and-forget background `Promise`s get killed mid-flight,\n * meaning agent loops triggered from a Slack/Telegram webhook never finish.\n *\n * Solution: persist the inbound message to SQL inside the webhook handler,\n * then dispatch a fresh HTTP POST to a separate processor endpoint. Each\n * invocation gets its own fresh function timeout budget.\n */\nimport { getDbExec, isPostgres, intType } from \"../db/client.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS integration_pending_tasks (\n          id TEXT PRIMARY KEY,\n          platform TEXT NOT NULL,\n          external_thread_id TEXT NOT NULL,\n          payload TEXT NOT NULL,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          status TEXT NOT NULL,\n          attempts ${intType()} NOT NULL DEFAULT 0,\n          error_message TEXT,\n          created_at ${intType()} NOT NULL,\n          updated_at ${intType()} NOT NULL,\n          completed_at ${intType()}\n        )\n      `);\n      await client.execute(\n        `CREATE INDEX IF NOT EXISTS idx_pending_tasks_status_created ON integration_pending_tasks(status, created_at)`,\n      );\n      // Additive migration: add a stable per-event dedup key so duplicate\n      // webhook deliveries from the same platform get rejected at the SQL\n      // layer instead of via an in-memory Map (which doesn't survive\n      // serverless cold starts — H3 in the webhook security audit). The\n      // unique index ensures a duplicate INSERT raises an error we can\n      // catch as \"already-enqueued\".\n      await ensureExternalEventKey(client);\n      await client.execute(\n        `CREATE UNIQUE INDEX IF NOT EXISTS idx_pending_tasks_event_key ON integration_pending_tasks(platform, external_event_key)`,\n      );\n    })();\n  }\n  return _initPromise;\n}\n\nasync function ensureExternalEventKey(\n  client: ReturnType<typeof getDbExec>,\n): Promise<void> {\n  if (isPostgres()) {\n    await client.execute(\n      `ALTER TABLE integration_pending_tasks ADD COLUMN IF NOT EXISTS external_event_key TEXT`,\n    );\n    return;\n  }\n  // SQLite doesn't support `ADD COLUMN IF NOT EXISTS` until 3.35; swallow\n  // the duplicate-column error so reruns are idempotent.\n  try {\n    await client.execute(\n      `ALTER TABLE integration_pending_tasks ADD COLUMN external_event_key TEXT`,\n    );\n  } catch (err: any) {\n    if (\n      !String(err?.message ?? err)\n        .toLowerCase()\n        .includes(\"duplicate\")\n    ) {\n      throw err;\n    }\n  }\n}\n\n/** Status values for an integration pending task. */\nexport type PendingTaskStatus =\n  | \"pending\"\n  | \"processing\"\n  | \"completed\"\n  | \"failed\";\n\nexport interface PendingTask {\n  id: string;\n  platform: string;\n  externalThreadId: string;\n  payload: string;\n  ownerEmail: string;\n  orgId: string | null;\n  status: PendingTaskStatus;\n  attempts: number;\n  errorMessage: string | null;\n  createdAt: number;\n  updatedAt: number;\n  completedAt: number | null;\n}\n\nfunction rowToTask(row: Record<string, unknown>): PendingTask {\n  return {\n    id: row.id as string,\n    platform: row.platform as string,\n    externalThreadId: row.external_thread_id as string,\n    payload: row.payload as string,\n    ownerEmail: row.owner_email as string,\n    orgId: (row.org_id as string | null) ?? null,\n    status: row.status as PendingTaskStatus,\n    attempts: Number(row.attempts ?? 0),\n    errorMessage: (row.error_message as string | null) ?? null,\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n    completedAt:\n      row.completed_at == null ? null : Number(row.completed_at as number),\n  };\n}\n\n/**\n * Insert a new pending task. Returns the generated task id.\n *\n * If `externalEventKey` is supplied, the unique index on\n * `(platform, external_event_key)` will reject duplicates — callers should\n * catch the resulting constraint-violation error and treat it as\n * \"already enqueued\" instead of a hard failure (H3 in the webhook security\n * audit). This is the SQL-backed replacement for the in-memory dedup map.\n */\nexport async function insertPendingTask(input: {\n  id: string;\n  platform: string;\n  externalThreadId: string;\n  payload: string;\n  ownerEmail: string;\n  orgId?: string | null;\n  externalEventKey?: string | null;\n}): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  await client.execute({\n    sql: `INSERT INTO integration_pending_tasks\n      (id, platform, external_thread_id, payload, owner_email, org_id, status, attempts, created_at, updated_at, external_event_key)\n      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      input.id,\n      input.platform,\n      input.externalThreadId,\n      input.payload,\n      input.ownerEmail,\n      input.orgId ?? null,\n      \"pending\",\n      0,\n      now,\n      now,\n      input.externalEventKey ?? null,\n    ],\n  });\n}\n\n/**\n * Returns whether a duplicate-event error from `insertPendingTask` looks\n * like a unique-constraint violation on `(platform, external_event_key)`.\n *\n * Postgres surfaces these as `error.code === \"23505\"`, while SQLite uses\n * a substring match on the error text. Used by the webhook handler to\n * distinguish \"already enqueued\" (silently OK) from genuine insert failures.\n */\nexport function isDuplicateEventError(err: unknown): boolean {\n  const e = err as { code?: string; message?: string } | null;\n  if (!e) return false;\n  if (e.code === \"23505\") return true; // Postgres unique-violation\n  const msg = String(e.message ?? \"\").toLowerCase();\n  return (\n    msg.includes(\"unique\") ||\n    msg.includes(\"duplicate entry\") ||\n    msg.includes(\"duplicate key\")\n  );\n}\n\n/** Fetch a pending task by id. */\nexport async function getPendingTask(id: string): Promise<PendingTask | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT id, platform, external_thread_id, payload, owner_email, org_id, status, attempts, error_message, created_at, updated_at, completed_at\n          FROM integration_pending_tasks WHERE id = ? LIMIT 1`,\n    args: [id],\n  });\n  if (rows.length === 0) return null;\n  return rowToTask(rows[0] as Record<string, unknown>);\n}\n\n/**\n * Atomically claim a task: transition pending → processing and increment\n * attempts. Returns the updated task if the transition succeeded, otherwise\n * null (e.g. the task was already claimed by a concurrent worker).\n */\nexport async function claimPendingTask(\n  id: string,\n): Promise<PendingTask | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n\n  // Conditional update: only flip if currently pending. Failed tasks are\n  // terminal unless an explicit retry path resets them to pending first.\n  const result = await client.execute({\n    sql: isPostgres()\n      ? `UPDATE integration_pending_tasks\n         SET status = ?, attempts = attempts + 1, updated_at = ?\n         WHERE id = ? AND status = 'pending'\n         RETURNING id, platform, external_thread_id, payload, owner_email, org_id, status, attempts, error_message, created_at, updated_at, completed_at`\n      : `UPDATE integration_pending_tasks\n         SET status = ?, attempts = attempts + 1, updated_at = ?\n         WHERE id = ? AND status = 'pending'`,\n    args: [\"processing\", now, id],\n  });\n  const rows = result.rows ?? [];\n\n  if (isPostgres()) {\n    if (rows.length === 0) return null;\n    return rowToTask(rows[0] as Record<string, unknown>);\n  }\n\n  // SQLite: no RETURNING, so re-read after the update. Confirm we actually\n  // moved it into 'processing' (vs. lost the race).\n  const affected =\n    (result as { rowsAffected?: number; rowCount?: number }).rowsAffected ??\n    (result as { rowsAffected?: number; rowCount?: number }).rowCount;\n  if (affected === 0) return null;\n  const fetched = await getPendingTask(id);\n  if (!fetched || fetched.status !== \"processing\") return null;\n  return fetched;\n}\n\n/** Mark a task as completed. */\nexport async function markTaskCompleted(id: string): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  await client.execute({\n    sql: `UPDATE integration_pending_tasks\n          SET status = ?, updated_at = ?, completed_at = ?\n          WHERE id = ?`,\n    args: [\"completed\", now, now, id],\n  });\n}\n\n/** Mark a task as failed and stash an error message. */\nexport async function markTaskFailed(\n  id: string,\n  errorMessage: string,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n  await client.execute({\n    sql: `UPDATE integration_pending_tasks\n          SET status = ?, updated_at = ?, error_message = ?\n          WHERE id = ?`,\n    args: [\"failed\", now, errorMessage.slice(0, 2000), id],\n  });\n}\n"]}

package/dist/server/builder-browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builder-browser.d.ts","sourceRoot":"","sources":["../../src/server/builder-browser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AASlC,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAI/C,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,yBAAyB,EAAE,OAAO,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,YAAY,EAAE,MAAM,GACnB,OAAO,CA0BT;AA6BD,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAO1C;AAUD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,GAAG,IAAW,GAC1B,MAAM,CAkBR;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,CAoB5E;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,oBAAoB,CAEtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,mHAMnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;;;IASA;AAED,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,KAAK,EAAE,OAAO,GACb,MAAM,CAKR;AAED,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAwD3E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qCAAqC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiF7E;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CA4DhC;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgDlC"}
+{"version":3,"file":"builder-browser.d.ts","sourceRoot":"","sources":["../../src/server/builder-browser.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AASlC,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAI/C,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,yBAAyB,EAAE,OAAO,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,YAAY,EAAE,MAAM,GACnB,OAAO,CA0BT;AA6BD,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAO1C;AAUD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,GAAG,IAAW,GAC1B,MAAM,CAkBR;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,CAoB5E;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,oBAAoB,CAEtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,mHAMnB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;;;IASA;AAED,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,KAAK,EAAE,OAAO,GACb,MAAM,CAKR;AAED,wBAAgB,gCAAgC,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAwD3E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qCAAqC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiF7E;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAiCD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAkEhC;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgDlC"}

package/dist/server/builder-browser.js

@@ -363,6 +363,34 @@ export function createBuilderBrowserCallbackErrorPage(message) {
   </body>
 </html>`;
 }
+function normalizeBuilderApiString(value, fieldName) {
+    if (typeof value !== "string" || !value.trim()) {
+        throw new Error(`Builder agent run returned a blank ${fieldName}`);
+    }
+    const trimmed = value.trim();
+    if (/[\u0000-\u001f\u007f]/.test(trimmed)) {
+        throw new Error(`Builder agent run returned a malformed ${fieldName}`);
+    }
+    return trimmed;
+}
+function normalizeBuilderBranchUrl(value) {
+    const urlString = normalizeBuilderApiString(value, "url");
+    let parsed;
+    try {
+        parsed = new URL(urlString);
+    }
+    catch {
+        throw new Error("Builder agent run returned a malformed url");
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw new Error("Builder agent run returned a malformed url");
+    }
+    if (parsed.hostname !== "builder.io" &&
+        !parsed.hostname.endsWith(".builder.io")) {
+        throw new Error("Builder agent run returned a non-Builder url");
+    }
+    return parsed.toString();
+}
 /**
  * POST a prompt to the Builder agents-run API. The Builder agent runs in a
  * cloud sandbox and writes code to a branch; the returned URL opens that
@@ -416,10 +444,14 @@ export async function runBuilderAgent(args) {
         throw new Error(msg);
     }
     return {
-        branchName: String(parsed.branchName ?? ""),
-        projectId: String(parsed.projectId ?? ""),
-        url: String(parsed.url ?? ""),
-        status: String(parsed.status ?? "processing"),
+        branchName: normalizeBuilderApiString(parsed.branchName, "branchName"),
+        projectId: typeof parsed.projectId === "string" && parsed.projectId.trim()
+            ? parsed.projectId.trim()
+            : projectId,
+        url: normalizeBuilderBranchUrl(parsed.url),
+        status: typeof parsed.status === "string" && parsed.status.trim()
+            ? parsed.status.trim()
+            : "processing",
     };
 }
 export async function requestBuilderBrowserConnection(args) {

package/dist/server/builder-browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"builder-browser.js","sourceRoot":"","sources":["../../src/server/builder-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AACtD,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AAC1D,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AACpD,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAEzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,iCAAiC,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAE/C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAiC5C,SAAS,WAAW,CAAC,KAAa,EAAE,YAAoB,EAAE,EAAU;IAClE,OAAO,UAAU,CAAC,QAAQ,EAAE,gBAAgB,aAAa,EAAE,EAAE,CAAC;SAC3D,MAAM,CAAC,GAAG,KAAK,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;SACxC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB;IAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,KAAK,IAAI,YAAY,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAgC,EAChC,YAAoB;IAEpB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAE5D,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,UAAU,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAE9C,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,mEAAmE;IACnE,qEAAqE;IACrE,mCAAmC;IACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,oBAAoB;QAAE,OAAO,KAAK,CAAC;IAEnE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAiB;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,iBAAiB,GACrB,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC9D,MAAM,WAAW,GACf,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,OAAO,CAAC;QACvB,MAAM,eAAe,GACnB,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChE,MAAM,mBAAmB,GACvB,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC5E,OAAO,CACL,iBAAiB;YACjB,CAAC,WAAW,IAAI,eAAe,IAAI,mBAAmB,CAAC,CACxD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,OAAO,CAAC,GAAG,CAAC,uBAAuB;QACnC,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,OAAO,CAAC,GAAG,CAAC,YAAY;QACxB,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC;IAC1C,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACvC,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACrC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACjC,OAAO,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,mCAAmC,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,CAAC,CAAC,mCAAmC,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,QAAuB,IAAI;IAE3B,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,GAAG,WAAW,GAAG,qBAAqB,EAAE,EACxC,gBAAgB,CACjB,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,gBAAgB,GAAG,WAAW,EAAE,CAAC,CAAC;IACzE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,cAAc,EAAE,gCAAgC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,MAAM,eAAe,GAAG,mCAAmC,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACrD,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,CACZ,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAClE;QACD,cAAc,EAAE,yBAAyB,EAAE;QAC3C,yBAAyB,EAAE,CAAC,CAAC,eAAe;QAC5C,eAAe,EAAE,eAAe,IAAI,SAAS;QAC7C,UAAU;QACV,OAAO,EAAE,iBAAiB,EAAE;QAC5B,OAAO,EAAE,iBAAiB,EAAE;QAC5B,UAAU,EAAE,2BAA2B,CAAC,MAAM,CAAC;QAC/C,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB;QACrD,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB;QACvD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS;QAChD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;QAClD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,OAAO,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;CACV,CAAC;AAIX,MAAM,UAAU,yBAAyB,CAAC,MAMzC;IACC,MAAM,MAAM,GAAkC;QAC5C,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;QACpD,kBAAkB,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;QAClD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5C,gBAAgB,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;QAC9C,gBAAgB,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;KAC/C,CAAC;IACF,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,UAAqC,EACrC,KAAc;IAEd,IAAI,UAAU,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,UAAkB;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAoCU,UAAU;;;;;;;;;;;sCAWS,UAAU;;;;;;QAMxC,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qCAAqC,CAAC,OAAe;IACnE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAmDW,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2B1B,CAAC;AACT,CAAC;AAiBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAyB;IAEzB,MAAM,EAAE,yBAAyB,EAAE,GACjC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;IAC/D,MAAM,gBAAgB,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACpE,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAEhD,MAAM,IAAI,GAA4B;QACpC,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE;QACxC,SAAS;KACV,CAAC;IACF,IAAI,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACvD,IAAI,gBAAgB;QAAE,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC;IACxD,IAAI,aAAa;QAAE,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC;IAE/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,CAAC,UAAU,EAAE;YAC3C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGtD,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,GAAG,GACP,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAC9B,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,6BAA6B,QAAQ,CAAC,MAAM,GAAG,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QACzC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,IAA2B;IAE3B,MAAM,EAAE,yBAAyB,EAAE,GACjC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,iCAAiC,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC5E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,CAAC,UAAU,EAAE;YAC3C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;YACtC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;YACxC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,SAAS;YAC1C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,SAAS;YACxD,QAAQ,EAAE,IAAI,CAAC,gBAAgB,IAAI,SAAS;SAC7C,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GACT,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAC5B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,mCAAmC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport type { H3Event } from \"h3\";\nimport { getAuthSecret } from \"./better-auth-instance.js\";\nimport { getAppBasePath, getOrigin } from \"./google-oauth.js\";\n\nconst DEFAULT_BUILDER_APP_HOST = \"https://builder.io\";\nconst DEFAULT_BUILDER_API_HOST = \"https://api.builder.io\";\nconst BUILDER_BROWSER_HOST = \"agent-native-browser\";\nconst BUILDER_BROWSER_CLIENT_ID = \"Agent Native Browser\";\n\nexport const BUILDER_CALLBACK_PATH = \"/_agent-native/builder/callback\";\n\n/**\n * Query-param name carrying the signed CSRF state on the connect→callback\n * round-trip. Prefixed with `_an_` to avoid collisions if Builder ever\n * adds standard OAuth `state` support to cli-auth. Builder preserves\n * the path/query of `redirect_url` verbatim when redirecting back, so\n * we embed `_an_state=…` inside the redirect_url query string at\n * connect time and read it back on the callback.\n */\nexport const BUILDER_STATE_PARAM = \"_an_state\";\n\nconst BUILDER_STATE_TTL_MS = 10 * 60 * 1000;\n\nexport interface BuilderBrowserStatus {\n  configured: boolean;\n  builderEnabled: boolean;\n  branchProjectIdConfigured: boolean;\n  branchProjectId?: string;\n  /**\n   * True when `BUILDER_PRIVATE_KEY` is set at the deployment level. Every\n   * user of this deploy shares the operator's Builder identity; the UI\n   * must hide the per-user connect/disconnect flow and show a read-only\n   * \"managed by deployment\" state instead.\n   */\n  envManaged: boolean;\n  appHost: string;\n  apiHost: string;\n  connectUrl: string;\n  publicKeyConfigured: boolean;\n  privateKeyConfigured: boolean;\n  userId?: string;\n  orgName?: string;\n  orgKind?: string;\n}\n\nexport interface BrowserConnectionArgs {\n  sessionId?: string;\n  projectId?: string;\n  branchName?: string;\n  proxyOrigin?: string;\n  proxyDefaultOrigin?: string;\n  proxyDestination?: string;\n}\n\nfunction macForParts(nonce: string, emailEncoded: string, ts: number): string {\n  return createHmac(\"sha256\", `builder-csrf:${getAuthSecret()}`)\n    .update(`${nonce}.${emailEncoded}.${ts}`)\n    .digest(\"base64url\");\n}\n\n/**\n * Mint a signed CSRF state token bound to the current session's email\n * and a fresh nonce. Round-trips through Builder's cli-auth flow inside\n * the redirect_url query string and is verified on the callback before\n * any keys are written.\n *\n * Why bind to email: it's the only stable, universally-available\n * identity field across all auth modes (Better Auth, BYOA, AUTH_MODE=local).\n * Binding to the session token instead would put the cookie value in a\n * URL that may end up in server logs / browser history.\n */\nexport function signBuilderCallbackState(sessionEmail: string): string {\n  const nonce = randomBytes(16).toString(\"base64url\");\n  const ts = Date.now();\n  const emailEncoded = Buffer.from(sessionEmail, \"utf8\").toString(\"base64url\");\n  const mac = macForParts(nonce, emailEncoded, ts);\n  return `${nonce}.${emailEncoded}.${ts}.${mac}`;\n}\n\n/**\n * Verify a state token produced by `signBuilderCallbackState`. Returns\n * false on any malformed, forged, expired, or cross-session token.\n */\nexport function verifyBuilderCallbackState(\n  token: string | null | undefined,\n  sessionEmail: string,\n): boolean {\n  if (typeof token !== \"string\" || token.length === 0) return false;\n  const parts = token.split(\".\");\n  if (parts.length !== 4) return false;\n  const [nonce, emailEncoded, tsStr, mac] = parts;\n  if (!nonce || !emailEncoded || !tsStr || !mac) return false;\n\n  let boundEmail: string;\n  try {\n    boundEmail = Buffer.from(emailEncoded, \"base64url\").toString(\"utf8\");\n  } catch {\n    return false;\n  }\n  if (boundEmail !== sessionEmail) return false;\n\n  const ts = Number(tsStr);\n  if (!Number.isFinite(ts)) return false;\n  // Reject expired AND far-future timestamps — a clock-skew attacker\n  // (or a bug that mints states with `ts` in the future) shouldn't get\n  // an arbitrarily-long-lived token.\n  if (Math.abs(Date.now() - ts) > BUILDER_STATE_TTL_MS) return false;\n\n  const expected = Buffer.from(macForParts(nonce, emailEncoded, ts));\n  const candidate = Buffer.from(mac);\n  if (expected.length !== candidate.length) return false;\n  return timingSafeEqual(expected, candidate);\n}\n\nfunction isAllowedBrowserReturnUrl(urlString: string): boolean {\n  try {\n    const parsed = new URL(urlString);\n    const hostname = parsed.hostname.toLowerCase();\n    const isAllowedProtocol =\n      parsed.protocol === \"http:\" || parsed.protocol === \"https:\";\n    const isLocalhost =\n      hostname === \"localhost\" ||\n      hostname === \"127.0.0.1\" ||\n      hostname === \"[::1]\";\n    const isBuilderDomain =\n      hostname === \"builder.io\" || hostname.endsWith(\".builder.io\");\n    const isAgentNativeDomain =\n      hostname === \"agent-native.com\" || hostname.endsWith(\".agent-native.com\");\n    return (\n      isAllowedProtocol &&\n      (isLocalhost || isBuilderDomain || isAgentNativeDomain)\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction normalizeOrigin(origin: string): string {\n  return origin.replace(/\\/+$/, \"\");\n}\n\nexport function getBuilderAppHost(): string {\n  return (\n    process.env.BUILDER_APP_HOST ||\n    process.env.BUILDER_PUBLIC_APP_HOST ||\n    DEFAULT_BUILDER_APP_HOST\n  );\n}\n\nexport function getBuilderApiHost(): string {\n  return (\n    process.env.AIR_HOST ||\n    process.env.BUILDER_HOST ||\n    process.env.BUILDER_API_HOST ||\n    DEFAULT_BUILDER_API_HOST\n  );\n}\n\nfunction getConfiguredBuilderBranchProjectId(): string | undefined {\n  const projectId =\n    process.env.DISPATCH_BUILDER_PROJECT_ID ||\n    process.env.BUILDER_BRANCH_PROJECT_ID ||\n    process.env.BUILDER_PROJECT_ID;\n  return projectId?.trim() || undefined;\n}\n\nexport function getBuilderBranchProjectId(): string {\n  return getConfiguredBuilderBranchProjectId() || \"\";\n}\n\nexport function isBuilderBranchingEnabled(): boolean {\n  return !!getConfiguredBuilderBranchProjectId();\n}\n\n/**\n * Build the Builder cli-auth URL for the connect popup. When a signed\n * `state` token is supplied it is embedded inside the `redirect_url`\n * query string so it survives Builder's redirect verbatim — Builder\n * preserves the redirect_url's existing query when appending p-key /\n * api-key / etc., so we don't depend on Builder echoing a top-level\n * `state` parameter (it doesn't).\n *\n * The user-facing connect entry point is `/_agent-native/builder/connect`\n * (a server-side 302). Status / chat-card responses surface that path\n * rather than the cli-auth URL directly, so the 302 handler can mint a\n * fresh state bound to the current session on every click.\n */\nexport function buildBuilderCliAuthUrl(\n  origin: string,\n  state: string | null = null,\n): string {\n  const normalizedOrigin = normalizeOrigin(origin);\n  const appBasePath = getAppBasePath();\n  const callbackUrl = new URL(\n    `${appBasePath}${BUILDER_CALLBACK_PATH}`,\n    normalizedOrigin,\n  );\n  if (state) {\n    callbackUrl.searchParams.set(BUILDER_STATE_PARAM, state);\n  }\n  const url = new URL(\"/cli-auth\", getBuilderAppHost());\n  url.searchParams.set(\"response_type\", \"code\");\n  url.searchParams.set(\"host\", BUILDER_BROWSER_HOST);\n  url.searchParams.set(\"client_id\", BUILDER_BROWSER_CLIENT_ID);\n  url.searchParams.set(\"redirect_url\", callbackUrl.toString());\n  url.searchParams.set(\"preview_url\", `${normalizedOrigin}${appBasePath}`);\n  url.searchParams.set(\"framework\", \"agent-native\");\n  return url.toString();\n}\n\n/**\n * The URL surfaced to clients (chat card, settings panels, status\n * endpoint) as `connectUrl`. Pointing every entry point at our local 302\n * means the cli-auth URL — and the CSRF state token bound to the current\n * session — are minted server-side at click time, instead of being baked\n * into a status response that may be cached or rendered for a different\n * session.\n */\nexport function getBuilderBrowserConnectUrl(origin: string): string {\n  return `${normalizeOrigin(origin)}${getAppBasePath()}/_agent-native/builder/connect`;\n}\n\nexport function getBuilderBrowserStatus(origin: string): BuilderBrowserStatus {\n  const branchProjectId = getConfiguredBuilderBranchProjectId();\n  const envManaged = !!process.env.BUILDER_PRIVATE_KEY;\n  return {\n    configured: !!(\n      process.env.BUILDER_PRIVATE_KEY && process.env.BUILDER_PUBLIC_KEY\n    ),\n    builderEnabled: isBuilderBranchingEnabled(),\n    branchProjectIdConfigured: !!branchProjectId,\n    branchProjectId: branchProjectId || undefined,\n    envManaged,\n    appHost: getBuilderAppHost(),\n    apiHost: getBuilderApiHost(),\n    connectUrl: getBuilderBrowserConnectUrl(origin),\n    publicKeyConfigured: !!process.env.BUILDER_PUBLIC_KEY,\n    privateKeyConfigured: !!process.env.BUILDER_PRIVATE_KEY,\n    userId: process.env.BUILDER_USER_ID || undefined,\n    orgName: process.env.BUILDER_ORG_NAME || undefined,\n    orgKind: process.env.BUILDER_ORG_KIND || undefined,\n  };\n}\n\nexport function getBuilderBrowserStatusForEvent(\n  event: H3Event,\n): BuilderBrowserStatus {\n  return getBuilderBrowserStatus(getOrigin(event));\n}\n\n/**\n * Env vars written by the Builder CLI-auth callback. Single source of truth\n * for the connect/disconnect key set — `getBuilderCallbackEnvVars` and the\n * disconnect handler's scrub loop both derive from this list, so drift\n * (e.g. disconnect silently leaving `BUILDER_USER_ID` behind because\n * someone added a key to one site but not the other) is impossible.\n */\nexport const BUILDER_ENV_KEYS = [\n  \"BUILDER_PRIVATE_KEY\",\n  \"BUILDER_PUBLIC_KEY\",\n  \"BUILDER_USER_ID\",\n  \"BUILDER_ORG_NAME\",\n  \"BUILDER_ORG_KIND\",\n] as const;\n\nexport type BuilderEnvKey = (typeof BUILDER_ENV_KEYS)[number];\n\nexport function getBuilderCallbackEnvVars(params: {\n  privateKey?: string | null;\n  publicKey?: string | null;\n  userId?: string | null;\n  orgName?: string | null;\n  orgKind?: string | null;\n}) {\n  const values: Record<BuilderEnvKey, string> = {\n    BUILDER_PRIVATE_KEY: params.privateKey?.trim() || \"\",\n    BUILDER_PUBLIC_KEY: params.publicKey?.trim() || \"\",\n    BUILDER_USER_ID: params.userId?.trim() || \"\",\n    BUILDER_ORG_NAME: params.orgName?.trim() || \"\",\n    BUILDER_ORG_KIND: params.orgKind?.trim() || \"\",\n  };\n  return BUILDER_ENV_KEYS.map((key) => ({ key, value: values[key] }));\n}\n\nexport function resolveSafePreviewUrl(\n  previewUrl: string | null | undefined,\n  event: H3Event,\n): string {\n  if (previewUrl && isAllowedBrowserReturnUrl(previewUrl)) {\n    return previewUrl;\n  }\n  return getOrigin(event);\n}\n\nexport function createBuilderBrowserCallbackPage(previewUrl: string): string {\n  const escapedUrl = JSON.stringify(previewUrl);\n  return `<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\" />\n    <title>Builder Connected</title>\n    <style>\n      body {\n        margin: 0;\n        min-height: 100vh;\n        display: grid;\n        place-items: center;\n        background:\n          radial-gradient(circle at top, rgba(20, 184, 166, 0.18), transparent 38%),\n          linear-gradient(180deg, #f7fafc 0%, #eef2f7 100%);\n        color: #0f172a;\n        font: 14px/1.5 ui-sans-serif, system-ui, sans-serif;\n      }\n      .card {\n        width: min(460px, calc(100vw - 32px));\n        border: 1px solid rgba(15, 23, 42, 0.08);\n        border-radius: 18px;\n        padding: 28px;\n        background: rgba(255, 255, 255, 0.92);\n        box-shadow: 0 24px 80px rgba(15, 23, 42, 0.12);\n      }\n      h1 { margin: 0 0 8px; font-size: 22px; }\n      p { margin: 0 0 12px; color: #475569; }\n      a { color: #0f766e; font-weight: 600; }\n    </style>\n  </head>\n  <body>\n    <main class=\"card\">\n      <h1>Builder connected</h1>\n      <p>Browser access is now available to your agent-native app.</p>\n      <p>You can close this tab and return to the workspace.</p>\n      <p><a href=${escapedUrl} target=\"_blank\" rel=\"noopener noreferrer\">Open the workspace</a></p>\n    </main>\n    <script>\n      // If we're a popup opened by the app, close ourselves and let the\n      // parent tab keep polling for connection status. If close() is\n      // blocked (e.g. we're the top-level tab because popups were\n      // downgraded), fall back to navigating back to the workspace.\n      window.setTimeout(function () {\n        try { window.close(); } catch (e) {}\n        window.setTimeout(function () {\n          if (!window.closed) {\n            window.location.replace(${escapedUrl});\n          }\n        }, 200);\n      }, 700);\n    </script>\n  </body>\n</html>`;\n}\n\n/**\n * HTML page rendered inside the OAuth popup when the callback handler caught\n * an error persisting the per-user Builder credentials. Without this, the\n * popup would show the success page even though the write failed — leaving\n * the parent window stuck on \"Waiting for Builder…\" until the 5-minute poll\n * timeout fires (Midhun reported this on 2026-04-28).\n *\n * The page does two things:\n * 1. Shows the user a clear \"couldn't save credentials\" message with the\n *    underlying error so they can retry or report.\n * 2. `postMessage`s the parent (same-origin opener) so the connect-flow\n *    polling stops immediately rather than waiting for the next /status\n *    poll to surface the SQL `builder-connect-error:<email>` row.\n */\nexport function createBuilderBrowserCallbackErrorPage(message: string): string {\n  const escapedMessage = JSON.stringify(message);\n  return `<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\" />\n    <title>Builder connect failed</title>\n    <style>\n      body {\n        margin: 0;\n        min-height: 100vh;\n        display: grid;\n        place-items: center;\n        background:\n          radial-gradient(circle at top, rgba(244, 63, 94, 0.14), transparent 38%),\n          linear-gradient(180deg, #f7fafc 0%, #eef2f7 100%);\n        color: #0f172a;\n        font: 14px/1.5 ui-sans-serif, system-ui, sans-serif;\n      }\n      .card {\n        width: min(460px, calc(100vw - 32px));\n        border: 1px solid rgba(15, 23, 42, 0.08);\n        border-radius: 18px;\n        padding: 28px;\n        background: rgba(255, 255, 255, 0.92);\n        box-shadow: 0 24px 80px rgba(15, 23, 42, 0.12);\n      }\n      h1 { margin: 0 0 8px; font-size: 22px; color: #b91c1c; }\n      p { margin: 0 0 12px; color: #475569; }\n      pre {\n        margin: 0 0 12px;\n        padding: 10px 12px;\n        background: #fef2f2;\n        border: 1px solid #fecaca;\n        border-radius: 8px;\n        color: #991b1b;\n        font-family: ui-monospace, SFMono-Regular, Menlo, monospace;\n        font-size: 12px;\n        white-space: pre-wrap;\n        word-break: break-word;\n      }\n    </style>\n  </head>\n  <body>\n    <main class=\"card\">\n      <h1>Couldn't save Builder connection</h1>\n      <p>Builder authorized your account but the server couldn't persist the credentials.</p>\n      <pre id=\"msg\"></pre>\n      <p>You can close this tab and try again from settings. The connect dialog has the same error so you can copy it.</p>\n    </main>\n    <script>\n      try {\n        var msg = ${escapedMessage};\n        document.getElementById(\"msg\").textContent = msg;\n        // Notify the parent tab immediately so its polling loop stops\n        // without waiting for the next /builder/status tick.\n        //\n        // BroadcastChannel works across same-origin windows regardless of\n        // opener access — it is the only reliable channel here because\n        // popups opened with window.open(..., \"noopener\") or links with\n        // rel=\"noopener\" have window.opener === null. The legacy\n        // window.opener.postMessage path is kept as a belt-and-suspenders\n        // fallback for non-BroadcastChannel environments.\n        try {\n          var bc = new BroadcastChannel(\"builder-connect:\" + window.location.host);\n          bc.postMessage({ type: \"builder-connect-error\", message: msg });\n          bc.close();\n        } catch (e) {}\n        if (window.opener && !window.opener.closed) {\n          try {\n            window.opener.postMessage(\n              { type: \"builder-connect-error\", message: msg },\n              window.location.origin,\n            );\n          } catch (e) {}\n        }\n      } catch (e) {}\n    </script>\n  </body>\n</html>`;\n}\n\nexport interface RunBuilderAgentArgs {\n  prompt: string;\n  projectId?: string;\n  branchName?: string;\n  userEmail?: string;\n  userId?: string;\n}\n\nexport interface RunBuilderAgentResult {\n  branchName: string;\n  projectId: string;\n  url: string;\n  status: string;\n}\n\n/**\n * POST a prompt to the Builder agents-run API. The Builder agent runs in a\n * cloud sandbox and writes code to a branch; the returned URL opens that\n * branch in the Visual Editor so the user can watch progress.\n *\n * Spec: https://www.builder.io/c/docs/agents-run-api\n */\nexport async function runBuilderAgent(\n  args: RunBuilderAgentArgs,\n): Promise<RunBuilderAgentResult> {\n  const { resolveBuilderCredentials } =\n    await import(\"./credential-provider.js\");\n  const creds = await resolveBuilderCredentials();\n  if (!creds.privateKey || !creds.publicKey) {\n    throw new Error(\"Builder keys are not configured\");\n  }\n  if (!args.prompt || !args.prompt.trim()) {\n    throw new Error(\"prompt is required\");\n  }\n  const projectId = args.projectId?.trim();\n  if (!projectId) {\n    throw new Error(\n      \"Builder project ID is not configured. Set DISPATCH_BUILDER_PROJECT_ID, BUILDER_BRANCH_PROJECT_ID, or BUILDER_PROJECT_ID.\",\n    );\n  }\n  const builderUserId = args.userId || creds.userId || undefined;\n  const builderUserEmail = builderUserId ? undefined : args.userEmail;\n  if (!builderUserEmail && !builderUserId) {\n    throw new Error(\"userEmail or userId is required\");\n  }\n\n  const url = new URL(\"/agents/run\", getBuilderApiHost());\n  url.searchParams.set(\"apiKey\", creds.publicKey);\n\n  const body: Record<string, unknown> = {\n    userMessage: { userPrompt: args.prompt },\n    projectId,\n  };\n  if (args.branchName) body.branchName = args.branchName;\n  if (builderUserEmail) body.userEmail = builderUserEmail;\n  if (builderUserId) body.userId = builderUserId;\n\n  const response = await fetch(url, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${creds.privateKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify(body),\n  });\n\n  const parsed = (await response.json().catch(() => ({}))) as Record<\n    string,\n    unknown\n  >;\n  if (!response.ok) {\n    const msg =\n      typeof parsed.error === \"string\"\n        ? parsed.error\n        : `Builder agent run failed (${response.status})`;\n    throw new Error(msg);\n  }\n\n  return {\n    branchName: String(parsed.branchName ?? \"\"),\n    projectId: String(parsed.projectId ?? \"\"),\n    url: String(parsed.url ?? \"\"),\n    status: String(parsed.status ?? \"processing\"),\n  };\n}\n\nexport async function requestBuilderBrowserConnection(\n  args: BrowserConnectionArgs,\n): Promise<Record<string, unknown>> {\n  const { resolveBuilderCredentials } =\n    await import(\"./credential-provider.js\");\n  const creds = await resolveBuilderCredentials();\n  if (!creds.privateKey || !creds.publicKey) {\n    throw new Error(\"Builder browser access is not configured\");\n  }\n\n  const sessionId = args.sessionId?.trim();\n  if (!sessionId) {\n    throw new Error(\"sessionId is required\");\n  }\n\n  const url = new URL(\"/codegen/get-browser-connection\", getBuilderApiHost());\n  url.searchParams.set(\"apiKey\", creds.publicKey);\n  if (creds.userId) {\n    url.searchParams.set(\"userId\", creds.userId);\n  }\n\n  const response = await fetch(url, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${creds.privateKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      sessionId,\n      projectId: args.projectId || undefined,\n      branchName: args.branchName || undefined,\n      proxyOrigin: args.proxyOrigin || undefined,\n      proxyDefaultOrigin: args.proxyDefaultOrigin || undefined,\n      proxyDst: args.proxyDestination || undefined,\n    }),\n  });\n\n  const body = (await response.json().catch(() => ({}))) as Record<\n    string,\n    unknown\n  >;\n  if (!response.ok) {\n    const error =\n      typeof body.error === \"string\"\n        ? body.error\n        : `Builder browser request failed (${response.status})`;\n    throw new Error(error);\n  }\n\n  return body;\n}\n"]}
+{"version":3,"file":"builder-browser.js","sourceRoot":"","sources":["../../src/server/builder-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9D,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AACtD,MAAM,wBAAwB,GAAG,wBAAwB,CAAC;AAC1D,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AACpD,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAEzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,iCAAiC,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAE/C,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAiC5C,SAAS,WAAW,CAAC,KAAa,EAAE,YAAoB,EAAE,EAAU;IAClE,OAAO,UAAU,CAAC,QAAQ,EAAE,gBAAgB,aAAa,EAAE,EAAE,CAAC;SAC3D,MAAM,CAAC,GAAG,KAAK,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;SACxC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAAoB;IAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,GAAG,KAAK,IAAI,YAAY,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAgC,EAChC,YAAoB;IAEpB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAE5D,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,UAAU,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAE9C,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,mEAAmE;IACnE,qEAAqE;IACrE,mCAAmC;IACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,oBAAoB;QAAE,OAAO,KAAK,CAAC;IAEnE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,yBAAyB,CAAC,SAAiB;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,MAAM,iBAAiB,GACrB,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC9D,MAAM,WAAW,GACf,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,OAAO,CAAC;QACvB,MAAM,eAAe,GACnB,QAAQ,KAAK,YAAY,IAAI,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAChE,MAAM,mBAAmB,GACvB,QAAQ,KAAK,kBAAkB,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC5E,OAAO,CACL,iBAAiB;YACjB,CAAC,WAAW,IAAI,eAAe,IAAI,mBAAmB,CAAC,CACxD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,OAAO,CAAC,GAAG,CAAC,uBAAuB;QACnC,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,OAAO,CAAC,GAAG,CAAC,YAAY;QACxB,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,mCAAmC;IAC1C,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,2BAA2B;QACvC,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACrC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACjC,OAAO,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,mCAAmC,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,yBAAyB;IACvC,OAAO,CAAC,CAAC,mCAAmC,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,QAAuB,IAAI;IAE3B,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,GAAG,WAAW,GAAG,qBAAqB,EAAE,EACxC,gBAAgB,CACjB,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,gBAAgB,GAAG,WAAW,EAAE,CAAC,CAAC;IACzE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,cAAc,EAAE,gCAAgC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,MAAM,eAAe,GAAG,mCAAmC,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACrD,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,CACZ,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAClE;QACD,cAAc,EAAE,yBAAyB,EAAE;QAC3C,yBAAyB,EAAE,CAAC,CAAC,eAAe;QAC5C,eAAe,EAAE,eAAe,IAAI,SAAS;QAC7C,UAAU;QACV,OAAO,EAAE,iBAAiB,EAAE;QAC5B,OAAO,EAAE,iBAAiB,EAAE;QAC5B,UAAU,EAAE,2BAA2B,CAAC,MAAM,CAAC;QAC/C,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB;QACrD,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB;QACvD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS;QAChD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;QAClD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,OAAO,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;CACV,CAAC;AAIX,MAAM,UAAU,yBAAyB,CAAC,MAMzC;IACC,MAAM,MAAM,GAAkC;QAC5C,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE;QACpD,kBAAkB,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE;QAClD,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;QAC5C,gBAAgB,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;QAC9C,gBAAgB,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE;KAC/C,CAAC;IACF,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,UAAqC,EACrC,KAAc;IAEd,IAAI,UAAU,IAAI,yBAAyB,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,UAAkB;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mBAoCU,UAAU;;;;;;;;;;;sCAWS,UAAU;;;;;;QAMxC,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qCAAqC,CAAC,OAAe;IACnE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAmDW,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2B1B,CAAC;AACT,CAAC;AAiBD,SAAS,yBAAyB,CAAC,KAAc,EAAE,SAAiB;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,sCAAsC,SAAS,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,SAAS,GAAG,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IACE,MAAM,CAAC,QAAQ,KAAK,YAAY;QAChC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,EACxC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAyB;IAEzB,MAAM,EAAE,yBAAyB,EAAE,GACjC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;IAC/D,MAAM,gBAAgB,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACpE,IAAI,CAAC,gBAAgB,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACxD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAEhD,MAAM,IAAI,GAA4B;QACpC,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE;QACxC,SAAS;KACV,CAAC;IACF,IAAI,IAAI,CAAC,UAAU;QAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACvD,IAAI,gBAAgB;QAAE,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC;IACxD,IAAI,aAAa;QAAE,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC;IAE/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,CAAC,UAAU,EAAE;YAC3C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGtD,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,GAAG,GACP,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAC9B,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,6BAA6B,QAAQ,CAAC,MAAM,GAAG,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO;QACL,UAAU,EAAE,yBAAyB,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC;QACtE,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE;YAC7D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE;YACzB,CAAC,CAAC,SAAS;QACf,GAAG,EAAE,yBAAyB,CAAC,MAAM,CAAC,GAAG,CAAC;QAC1C,MAAM,EACJ,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACvD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACtB,CAAC,CAAC,YAAY;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,IAA2B;IAE3B,MAAM,EAAE,yBAAyB,EAAE,GACjC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,yBAAyB,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,iCAAiC,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC5E,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,CAAC,UAAU,EAAE;YAC3C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;YACtC,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,SAAS;YACxC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,SAAS;YAC1C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,SAAS;YACxD,QAAQ,EAAE,IAAI,CAAC,gBAAgB,IAAI,SAAS;SAC7C,CAAC;KACH,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGpD,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,KAAK,GACT,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAC5B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,mCAAmC,QAAQ,CAAC,MAAM,GAAG,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport type { H3Event } from \"h3\";\nimport { getAuthSecret } from \"./better-auth-instance.js\";\nimport { getAppBasePath, getOrigin } from \"./google-oauth.js\";\n\nconst DEFAULT_BUILDER_APP_HOST = \"https://builder.io\";\nconst DEFAULT_BUILDER_API_HOST = \"https://api.builder.io\";\nconst BUILDER_BROWSER_HOST = \"agent-native-browser\";\nconst BUILDER_BROWSER_CLIENT_ID = \"Agent Native Browser\";\n\nexport const BUILDER_CALLBACK_PATH = \"/_agent-native/builder/callback\";\n\n/**\n * Query-param name carrying the signed CSRF state on the connect→callback\n * round-trip. Prefixed with `_an_` to avoid collisions if Builder ever\n * adds standard OAuth `state` support to cli-auth. Builder preserves\n * the path/query of `redirect_url` verbatim when redirecting back, so\n * we embed `_an_state=…` inside the redirect_url query string at\n * connect time and read it back on the callback.\n */\nexport const BUILDER_STATE_PARAM = \"_an_state\";\n\nconst BUILDER_STATE_TTL_MS = 10 * 60 * 1000;\n\nexport interface BuilderBrowserStatus {\n  configured: boolean;\n  builderEnabled: boolean;\n  branchProjectIdConfigured: boolean;\n  branchProjectId?: string;\n  /**\n   * True when `BUILDER_PRIVATE_KEY` is set at the deployment level. Every\n   * user of this deploy shares the operator's Builder identity; the UI\n   * must hide the per-user connect/disconnect flow and show a read-only\n   * \"managed by deployment\" state instead.\n   */\n  envManaged: boolean;\n  appHost: string;\n  apiHost: string;\n  connectUrl: string;\n  publicKeyConfigured: boolean;\n  privateKeyConfigured: boolean;\n  userId?: string;\n  orgName?: string;\n  orgKind?: string;\n}\n\nexport interface BrowserConnectionArgs {\n  sessionId?: string;\n  projectId?: string;\n  branchName?: string;\n  proxyOrigin?: string;\n  proxyDefaultOrigin?: string;\n  proxyDestination?: string;\n}\n\nfunction macForParts(nonce: string, emailEncoded: string, ts: number): string {\n  return createHmac(\"sha256\", `builder-csrf:${getAuthSecret()}`)\n    .update(`${nonce}.${emailEncoded}.${ts}`)\n    .digest(\"base64url\");\n}\n\n/**\n * Mint a signed CSRF state token bound to the current session's email\n * and a fresh nonce. Round-trips through Builder's cli-auth flow inside\n * the redirect_url query string and is verified on the callback before\n * any keys are written.\n *\n * Why bind to email: it's the only stable, universally-available\n * identity field across all auth modes (Better Auth, BYOA, AUTH_MODE=local).\n * Binding to the session token instead would put the cookie value in a\n * URL that may end up in server logs / browser history.\n */\nexport function signBuilderCallbackState(sessionEmail: string): string {\n  const nonce = randomBytes(16).toString(\"base64url\");\n  const ts = Date.now();\n  const emailEncoded = Buffer.from(sessionEmail, \"utf8\").toString(\"base64url\");\n  const mac = macForParts(nonce, emailEncoded, ts);\n  return `${nonce}.${emailEncoded}.${ts}.${mac}`;\n}\n\n/**\n * Verify a state token produced by `signBuilderCallbackState`. Returns\n * false on any malformed, forged, expired, or cross-session token.\n */\nexport function verifyBuilderCallbackState(\n  token: string | null | undefined,\n  sessionEmail: string,\n): boolean {\n  if (typeof token !== \"string\" || token.length === 0) return false;\n  const parts = token.split(\".\");\n  if (parts.length !== 4) return false;\n  const [nonce, emailEncoded, tsStr, mac] = parts;\n  if (!nonce || !emailEncoded || !tsStr || !mac) return false;\n\n  let boundEmail: string;\n  try {\n    boundEmail = Buffer.from(emailEncoded, \"base64url\").toString(\"utf8\");\n  } catch {\n    return false;\n  }\n  if (boundEmail !== sessionEmail) return false;\n\n  const ts = Number(tsStr);\n  if (!Number.isFinite(ts)) return false;\n  // Reject expired AND far-future timestamps — a clock-skew attacker\n  // (or a bug that mints states with `ts` in the future) shouldn't get\n  // an arbitrarily-long-lived token.\n  if (Math.abs(Date.now() - ts) > BUILDER_STATE_TTL_MS) return false;\n\n  const expected = Buffer.from(macForParts(nonce, emailEncoded, ts));\n  const candidate = Buffer.from(mac);\n  if (expected.length !== candidate.length) return false;\n  return timingSafeEqual(expected, candidate);\n}\n\nfunction isAllowedBrowserReturnUrl(urlString: string): boolean {\n  try {\n    const parsed = new URL(urlString);\n    const hostname = parsed.hostname.toLowerCase();\n    const isAllowedProtocol =\n      parsed.protocol === \"http:\" || parsed.protocol === \"https:\";\n    const isLocalhost =\n      hostname === \"localhost\" ||\n      hostname === \"127.0.0.1\" ||\n      hostname === \"[::1]\";\n    const isBuilderDomain =\n      hostname === \"builder.io\" || hostname.endsWith(\".builder.io\");\n    const isAgentNativeDomain =\n      hostname === \"agent-native.com\" || hostname.endsWith(\".agent-native.com\");\n    return (\n      isAllowedProtocol &&\n      (isLocalhost || isBuilderDomain || isAgentNativeDomain)\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction normalizeOrigin(origin: string): string {\n  return origin.replace(/\\/+$/, \"\");\n}\n\nexport function getBuilderAppHost(): string {\n  return (\n    process.env.BUILDER_APP_HOST ||\n    process.env.BUILDER_PUBLIC_APP_HOST ||\n    DEFAULT_BUILDER_APP_HOST\n  );\n}\n\nexport function getBuilderApiHost(): string {\n  return (\n    process.env.AIR_HOST ||\n    process.env.BUILDER_HOST ||\n    process.env.BUILDER_API_HOST ||\n    DEFAULT_BUILDER_API_HOST\n  );\n}\n\nfunction getConfiguredBuilderBranchProjectId(): string | undefined {\n  const projectId =\n    process.env.DISPATCH_BUILDER_PROJECT_ID ||\n    process.env.BUILDER_BRANCH_PROJECT_ID ||\n    process.env.BUILDER_PROJECT_ID;\n  return projectId?.trim() || undefined;\n}\n\nexport function getBuilderBranchProjectId(): string {\n  return getConfiguredBuilderBranchProjectId() || \"\";\n}\n\nexport function isBuilderBranchingEnabled(): boolean {\n  return !!getConfiguredBuilderBranchProjectId();\n}\n\n/**\n * Build the Builder cli-auth URL for the connect popup. When a signed\n * `state` token is supplied it is embedded inside the `redirect_url`\n * query string so it survives Builder's redirect verbatim — Builder\n * preserves the redirect_url's existing query when appending p-key /\n * api-key / etc., so we don't depend on Builder echoing a top-level\n * `state` parameter (it doesn't).\n *\n * The user-facing connect entry point is `/_agent-native/builder/connect`\n * (a server-side 302). Status / chat-card responses surface that path\n * rather than the cli-auth URL directly, so the 302 handler can mint a\n * fresh state bound to the current session on every click.\n */\nexport function buildBuilderCliAuthUrl(\n  origin: string,\n  state: string | null = null,\n): string {\n  const normalizedOrigin = normalizeOrigin(origin);\n  const appBasePath = getAppBasePath();\n  const callbackUrl = new URL(\n    `${appBasePath}${BUILDER_CALLBACK_PATH}`,\n    normalizedOrigin,\n  );\n  if (state) {\n    callbackUrl.searchParams.set(BUILDER_STATE_PARAM, state);\n  }\n  const url = new URL(\"/cli-auth\", getBuilderAppHost());\n  url.searchParams.set(\"response_type\", \"code\");\n  url.searchParams.set(\"host\", BUILDER_BROWSER_HOST);\n  url.searchParams.set(\"client_id\", BUILDER_BROWSER_CLIENT_ID);\n  url.searchParams.set(\"redirect_url\", callbackUrl.toString());\n  url.searchParams.set(\"preview_url\", `${normalizedOrigin}${appBasePath}`);\n  url.searchParams.set(\"framework\", \"agent-native\");\n  return url.toString();\n}\n\n/**\n * The URL surfaced to clients (chat card, settings panels, status\n * endpoint) as `connectUrl`. Pointing every entry point at our local 302\n * means the cli-auth URL — and the CSRF state token bound to the current\n * session — are minted server-side at click time, instead of being baked\n * into a status response that may be cached or rendered for a different\n * session.\n */\nexport function getBuilderBrowserConnectUrl(origin: string): string {\n  return `${normalizeOrigin(origin)}${getAppBasePath()}/_agent-native/builder/connect`;\n}\n\nexport function getBuilderBrowserStatus(origin: string): BuilderBrowserStatus {\n  const branchProjectId = getConfiguredBuilderBranchProjectId();\n  const envManaged = !!process.env.BUILDER_PRIVATE_KEY;\n  return {\n    configured: !!(\n      process.env.BUILDER_PRIVATE_KEY && process.env.BUILDER_PUBLIC_KEY\n    ),\n    builderEnabled: isBuilderBranchingEnabled(),\n    branchProjectIdConfigured: !!branchProjectId,\n    branchProjectId: branchProjectId || undefined,\n    envManaged,\n    appHost: getBuilderAppHost(),\n    apiHost: getBuilderApiHost(),\n    connectUrl: getBuilderBrowserConnectUrl(origin),\n    publicKeyConfigured: !!process.env.BUILDER_PUBLIC_KEY,\n    privateKeyConfigured: !!process.env.BUILDER_PRIVATE_KEY,\n    userId: process.env.BUILDER_USER_ID || undefined,\n    orgName: process.env.BUILDER_ORG_NAME || undefined,\n    orgKind: process.env.BUILDER_ORG_KIND || undefined,\n  };\n}\n\nexport function getBuilderBrowserStatusForEvent(\n  event: H3Event,\n): BuilderBrowserStatus {\n  return getBuilderBrowserStatus(getOrigin(event));\n}\n\n/**\n * Env vars written by the Builder CLI-auth callback. Single source of truth\n * for the connect/disconnect key set — `getBuilderCallbackEnvVars` and the\n * disconnect handler's scrub loop both derive from this list, so drift\n * (e.g. disconnect silently leaving `BUILDER_USER_ID` behind because\n * someone added a key to one site but not the other) is impossible.\n */\nexport const BUILDER_ENV_KEYS = [\n  \"BUILDER_PRIVATE_KEY\",\n  \"BUILDER_PUBLIC_KEY\",\n  \"BUILDER_USER_ID\",\n  \"BUILDER_ORG_NAME\",\n  \"BUILDER_ORG_KIND\",\n] as const;\n\nexport type BuilderEnvKey = (typeof BUILDER_ENV_KEYS)[number];\n\nexport function getBuilderCallbackEnvVars(params: {\n  privateKey?: string | null;\n  publicKey?: string | null;\n  userId?: string | null;\n  orgName?: string | null;\n  orgKind?: string | null;\n}) {\n  const values: Record<BuilderEnvKey, string> = {\n    BUILDER_PRIVATE_KEY: params.privateKey?.trim() || \"\",\n    BUILDER_PUBLIC_KEY: params.publicKey?.trim() || \"\",\n    BUILDER_USER_ID: params.userId?.trim() || \"\",\n    BUILDER_ORG_NAME: params.orgName?.trim() || \"\",\n    BUILDER_ORG_KIND: params.orgKind?.trim() || \"\",\n  };\n  return BUILDER_ENV_KEYS.map((key) => ({ key, value: values[key] }));\n}\n\nexport function resolveSafePreviewUrl(\n  previewUrl: string | null | undefined,\n  event: H3Event,\n): string {\n  if (previewUrl && isAllowedBrowserReturnUrl(previewUrl)) {\n    return previewUrl;\n  }\n  return getOrigin(event);\n}\n\nexport function createBuilderBrowserCallbackPage(previewUrl: string): string {\n  const escapedUrl = JSON.stringify(previewUrl);\n  return `<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\" />\n    <title>Builder Connected</title>\n    <style>\n      body {\n        margin: 0;\n        min-height: 100vh;\n        display: grid;\n        place-items: center;\n        background:\n          radial-gradient(circle at top, rgba(20, 184, 166, 0.18), transparent 38%),\n          linear-gradient(180deg, #f7fafc 0%, #eef2f7 100%);\n        color: #0f172a;\n        font: 14px/1.5 ui-sans-serif, system-ui, sans-serif;\n      }\n      .card {\n        width: min(460px, calc(100vw - 32px));\n        border: 1px solid rgba(15, 23, 42, 0.08);\n        border-radius: 18px;\n        padding: 28px;\n        background: rgba(255, 255, 255, 0.92);\n        box-shadow: 0 24px 80px rgba(15, 23, 42, 0.12);\n      }\n      h1 { margin: 0 0 8px; font-size: 22px; }\n      p { margin: 0 0 12px; color: #475569; }\n      a { color: #0f766e; font-weight: 600; }\n    </style>\n  </head>\n  <body>\n    <main class=\"card\">\n      <h1>Builder connected</h1>\n      <p>Browser access is now available to your agent-native app.</p>\n      <p>You can close this tab and return to the workspace.</p>\n      <p><a href=${escapedUrl} target=\"_blank\" rel=\"noopener noreferrer\">Open the workspace</a></p>\n    </main>\n    <script>\n      // If we're a popup opened by the app, close ourselves and let the\n      // parent tab keep polling for connection status. If close() is\n      // blocked (e.g. we're the top-level tab because popups were\n      // downgraded), fall back to navigating back to the workspace.\n      window.setTimeout(function () {\n        try { window.close(); } catch (e) {}\n        window.setTimeout(function () {\n          if (!window.closed) {\n            window.location.replace(${escapedUrl});\n          }\n        }, 200);\n      }, 700);\n    </script>\n  </body>\n</html>`;\n}\n\n/**\n * HTML page rendered inside the OAuth popup when the callback handler caught\n * an error persisting the per-user Builder credentials. Without this, the\n * popup would show the success page even though the write failed — leaving\n * the parent window stuck on \"Waiting for Builder…\" until the 5-minute poll\n * timeout fires (Midhun reported this on 2026-04-28).\n *\n * The page does two things:\n * 1. Shows the user a clear \"couldn't save credentials\" message with the\n *    underlying error so they can retry or report.\n * 2. `postMessage`s the parent (same-origin opener) so the connect-flow\n *    polling stops immediately rather than waiting for the next /status\n *    poll to surface the SQL `builder-connect-error:<email>` row.\n */\nexport function createBuilderBrowserCallbackErrorPage(message: string): string {\n  const escapedMessage = JSON.stringify(message);\n  return `<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\" />\n    <title>Builder connect failed</title>\n    <style>\n      body {\n        margin: 0;\n        min-height: 100vh;\n        display: grid;\n        place-items: center;\n        background:\n          radial-gradient(circle at top, rgba(244, 63, 94, 0.14), transparent 38%),\n          linear-gradient(180deg, #f7fafc 0%, #eef2f7 100%);\n        color: #0f172a;\n        font: 14px/1.5 ui-sans-serif, system-ui, sans-serif;\n      }\n      .card {\n        width: min(460px, calc(100vw - 32px));\n        border: 1px solid rgba(15, 23, 42, 0.08);\n        border-radius: 18px;\n        padding: 28px;\n        background: rgba(255, 255, 255, 0.92);\n        box-shadow: 0 24px 80px rgba(15, 23, 42, 0.12);\n      }\n      h1 { margin: 0 0 8px; font-size: 22px; color: #b91c1c; }\n      p { margin: 0 0 12px; color: #475569; }\n      pre {\n        margin: 0 0 12px;\n        padding: 10px 12px;\n        background: #fef2f2;\n        border: 1px solid #fecaca;\n        border-radius: 8px;\n        color: #991b1b;\n        font-family: ui-monospace, SFMono-Regular, Menlo, monospace;\n        font-size: 12px;\n        white-space: pre-wrap;\n        word-break: break-word;\n      }\n    </style>\n  </head>\n  <body>\n    <main class=\"card\">\n      <h1>Couldn't save Builder connection</h1>\n      <p>Builder authorized your account but the server couldn't persist the credentials.</p>\n      <pre id=\"msg\"></pre>\n      <p>You can close this tab and try again from settings. The connect dialog has the same error so you can copy it.</p>\n    </main>\n    <script>\n      try {\n        var msg = ${escapedMessage};\n        document.getElementById(\"msg\").textContent = msg;\n        // Notify the parent tab immediately so its polling loop stops\n        // without waiting for the next /builder/status tick.\n        //\n        // BroadcastChannel works across same-origin windows regardless of\n        // opener access — it is the only reliable channel here because\n        // popups opened with window.open(..., \"noopener\") or links with\n        // rel=\"noopener\" have window.opener === null. The legacy\n        // window.opener.postMessage path is kept as a belt-and-suspenders\n        // fallback for non-BroadcastChannel environments.\n        try {\n          var bc = new BroadcastChannel(\"builder-connect:\" + window.location.host);\n          bc.postMessage({ type: \"builder-connect-error\", message: msg });\n          bc.close();\n        } catch (e) {}\n        if (window.opener && !window.opener.closed) {\n          try {\n            window.opener.postMessage(\n              { type: \"builder-connect-error\", message: msg },\n              window.location.origin,\n            );\n          } catch (e) {}\n        }\n      } catch (e) {}\n    </script>\n  </body>\n</html>`;\n}\n\nexport interface RunBuilderAgentArgs {\n  prompt: string;\n  projectId?: string;\n  branchName?: string;\n  userEmail?: string;\n  userId?: string;\n}\n\nexport interface RunBuilderAgentResult {\n  branchName: string;\n  projectId: string;\n  url: string;\n  status: string;\n}\n\nfunction normalizeBuilderApiString(value: unknown, fieldName: string): string {\n  if (typeof value !== \"string\" || !value.trim()) {\n    throw new Error(`Builder agent run returned a blank ${fieldName}`);\n  }\n  const trimmed = value.trim();\n  if (/[\\u0000-\\u001f\\u007f]/.test(trimmed)) {\n    throw new Error(`Builder agent run returned a malformed ${fieldName}`);\n  }\n  return trimmed;\n}\n\nfunction normalizeBuilderBranchUrl(value: unknown): string {\n  const urlString = normalizeBuilderApiString(value, \"url\");\n  let parsed: URL;\n  try {\n    parsed = new URL(urlString);\n  } catch {\n    throw new Error(\"Builder agent run returned a malformed url\");\n  }\n  if (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") {\n    throw new Error(\"Builder agent run returned a malformed url\");\n  }\n  if (\n    parsed.hostname !== \"builder.io\" &&\n    !parsed.hostname.endsWith(\".builder.io\")\n  ) {\n    throw new Error(\"Builder agent run returned a non-Builder url\");\n  }\n  return parsed.toString();\n}\n\n/**\n * POST a prompt to the Builder agents-run API. The Builder agent runs in a\n * cloud sandbox and writes code to a branch; the returned URL opens that\n * branch in the Visual Editor so the user can watch progress.\n *\n * Spec: https://www.builder.io/c/docs/agents-run-api\n */\nexport async function runBuilderAgent(\n  args: RunBuilderAgentArgs,\n): Promise<RunBuilderAgentResult> {\n  const { resolveBuilderCredentials } =\n    await import(\"./credential-provider.js\");\n  const creds = await resolveBuilderCredentials();\n  if (!creds.privateKey || !creds.publicKey) {\n    throw new Error(\"Builder keys are not configured\");\n  }\n  if (!args.prompt || !args.prompt.trim()) {\n    throw new Error(\"prompt is required\");\n  }\n  const projectId = args.projectId?.trim();\n  if (!projectId) {\n    throw new Error(\n      \"Builder project ID is not configured. Set DISPATCH_BUILDER_PROJECT_ID, BUILDER_BRANCH_PROJECT_ID, or BUILDER_PROJECT_ID.\",\n    );\n  }\n  const builderUserId = args.userId || creds.userId || undefined;\n  const builderUserEmail = builderUserId ? undefined : args.userEmail;\n  if (!builderUserEmail && !builderUserId) {\n    throw new Error(\"userEmail or userId is required\");\n  }\n\n  const url = new URL(\"/agents/run\", getBuilderApiHost());\n  url.searchParams.set(\"apiKey\", creds.publicKey);\n\n  const body: Record<string, unknown> = {\n    userMessage: { userPrompt: args.prompt },\n    projectId,\n  };\n  if (args.branchName) body.branchName = args.branchName;\n  if (builderUserEmail) body.userEmail = builderUserEmail;\n  if (builderUserId) body.userId = builderUserId;\n\n  const response = await fetch(url, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${creds.privateKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify(body),\n  });\n\n  const parsed = (await response.json().catch(() => ({}))) as Record<\n    string,\n    unknown\n  >;\n  if (!response.ok) {\n    const msg =\n      typeof parsed.error === \"string\"\n        ? parsed.error\n        : `Builder agent run failed (${response.status})`;\n    throw new Error(msg);\n  }\n\n  return {\n    branchName: normalizeBuilderApiString(parsed.branchName, \"branchName\"),\n    projectId:\n      typeof parsed.projectId === \"string\" && parsed.projectId.trim()\n        ? parsed.projectId.trim()\n        : projectId,\n    url: normalizeBuilderBranchUrl(parsed.url),\n    status:\n      typeof parsed.status === \"string\" && parsed.status.trim()\n        ? parsed.status.trim()\n        : \"processing\",\n  };\n}\n\nexport async function requestBuilderBrowserConnection(\n  args: BrowserConnectionArgs,\n): Promise<Record<string, unknown>> {\n  const { resolveBuilderCredentials } =\n    await import(\"./credential-provider.js\");\n  const creds = await resolveBuilderCredentials();\n  if (!creds.privateKey || !creds.publicKey) {\n    throw new Error(\"Builder browser access is not configured\");\n  }\n\n  const sessionId = args.sessionId?.trim();\n  if (!sessionId) {\n    throw new Error(\"sessionId is required\");\n  }\n\n  const url = new URL(\"/codegen/get-browser-connection\", getBuilderApiHost());\n  url.searchParams.set(\"apiKey\", creds.publicKey);\n  if (creds.userId) {\n    url.searchParams.set(\"userId\", creds.userId);\n  }\n\n  const response = await fetch(url, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Bearer ${creds.privateKey}`,\n      \"Content-Type\": \"application/json\",\n    },\n    body: JSON.stringify({\n      sessionId,\n      projectId: args.projectId || undefined,\n      branchName: args.branchName || undefined,\n      proxyOrigin: args.proxyOrigin || undefined,\n      proxyDefaultOrigin: args.proxyDefaultOrigin || undefined,\n      proxyDst: args.proxyDestination || undefined,\n    }),\n  });\n\n  const body = (await response.json().catch(() => ({}))) as Record<\n    string,\n    unknown\n  >;\n  if (!response.ok) {\n    const error =\n      typeof body.error === \"string\"\n        ? body.error\n        : `Builder browser request failed (${response.status})`;\n    throw new Error(error);\n  }\n\n  return body;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.7.69",
+  "version": "0.7.71",
   "type": "module",
   "description": "Framework for agent-native application development — where AI agents and UI share state via files",
   "license": "MIT",