@agent-native/core 0.84.20 → 0.84.22

package/dist/notifications/channels.js

@@ -10,9 +10,20 @@
  *                              value never enters the agent context.
  * NOTIFICATIONS_WEBHOOK_AUTH → optional `Authorization` header value (also
  *                              supports `${keys.NAME}`).
+ * NOTIFICATIONS_SLACK_WEBHOOK_URL
+ *                            → POST notifications to a Slack incoming webhook.
+ *                              Supports `${keys.NAME}` substitution.
+ * NOTIFICATIONS_EMAIL_CHANNEL=1
+ *                            → enable the built-in email channel for
+ *                              per-notification recipients.
+ * NOTIFICATIONS_EMAIL_RECIPIENTS
+ *                            → comma-separated fallback recipients for email
+ *                              notifications that do not pass
+ *                              `metadata.emailRecipients`.
  */
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import { resolveKeyReferences, validateUrlAllowlist, getKeyAllowlist, } from "../secrets/substitution.js";
+import { sendEmail } from "../server/email.js";
 import { registerNotificationChannel } from "./registry.js";
 let _registered = false;
 export function registerBuiltinNotificationChannels() {
@@ -23,32 +34,21 @@ export function registerBuiltinNotificationChannels() {
     if (url) {
         registerNotificationChannel(createWebhookChannel(url));
     }
+    const slackUrl = process.env.NOTIFICATIONS_SLACK_WEBHOOK_URL;
+    if (slackUrl) {
+        registerNotificationChannel(createSlackWebhookChannel(slackUrl));
+    }
+    const emailRecipients = process.env.NOTIFICATIONS_EMAIL_RECIPIENTS?.trim();
+    if (process.env.NOTIFICATIONS_EMAIL_CHANNEL === "1" || emailRecipients) {
+        registerNotificationChannel(createEmailChannel());
+    }
 }
 function createWebhookChannel(urlTemplate) {
     const authTemplate = process.env.NOTIFICATIONS_WEBHOOK_AUTH;
     return {
         name: "webhook",
         async deliver(input, meta) {
-            // Resolve `${keys.NAME}` references against the owner's user-scope
-            // secrets. Missing keys throw — the error surfaces in logs and the
-            // channel is marked un-delivered, but other channels still run.
-            const { resolved: url } = await resolveKeyReferences(urlTemplate, "user", meta.owner);
-            const headers = {
-                "Content-Type": "application/json",
-            };
-            if (authTemplate) {
-                const { resolved: auth } = await resolveKeyReferences(authTemplate, "user", meta.owner);
-                headers.Authorization = auth;
-            }
-            // If the user set an allowlist on a referenced key, enforce it here —
-            // origin-level check, same rule the automations fetch-tool applies.
-            const keyNames = Array.from(new Set(Array.from(urlTemplate.matchAll(/\$\{keys\.([A-Za-z0-9_-]+)\}/g), (m) => m[1])));
-            const allowlists = await Promise.all(keyNames.map((name) => getKeyAllowlist(name, "user", meta.owner)));
-            keyNames.forEach((name, i) => {
-                if (!validateUrlAllowlist(url, allowlists[i])) {
-                    throw new Error(`[notifications] webhook URL ${new URL(url).origin} is not in the allowlist for key "${name}"`);
-                }
-            });
+            const { url, headers } = await resolveWebhookRequest(urlTemplate, authTemplate, meta.owner, "webhook");
             const res = await ssrfSafeFetch(url, {
                 method: "POST",
                 headers,
@@ -67,6 +67,158 @@ function createWebhookChannel(urlTemplate) {
         },
     };
 }
+function createSlackWebhookChannel(urlTemplate) {
+    const authTemplate = process.env.NOTIFICATIONS_SLACK_WEBHOOK_AUTH;
+    return {
+        name: "slack",
+        async deliver(input, meta) {
+            const { url, headers } = await resolveWebhookRequest(urlTemplate, authTemplate, meta.owner, "Slack webhook");
+            const res = await ssrfSafeFetch(url, {
+                method: "POST",
+                headers,
+                body: JSON.stringify({
+                    text: slackText(input.severity, input.title, input.body),
+                    blocks: [
+                        {
+                            type: "section",
+                            text: {
+                                type: "mrkdwn",
+                                text: `*${escapeSlack(input.title)}*`,
+                            },
+                        },
+                        ...(input.body
+                            ? [
+                                {
+                                    type: "section",
+                                    text: {
+                                        type: "mrkdwn",
+                                        text: escapeSlack(input.body),
+                                    },
+                                },
+                            ]
+                            : []),
+                        {
+                            type: "context",
+                            elements: [
+                                {
+                                    type: "mrkdwn",
+                                    text: `Severity: \`${input.severity}\`  Owner: ${escapeSlack(meta.owner)}`,
+                                },
+                            ],
+                        },
+                    ],
+                }),
+            }, { maxRedirects: 3 });
+            if (!res.ok) {
+                throw new Error(`[notifications] Slack webhook ${new URL(url).origin} returned ${res.status}${(await readErrorSnippet(res)) || ""}`);
+            }
+        },
+    };
+}
+function createEmailChannel() {
+    return {
+        name: "email",
+        async deliver(input) {
+            const recipients = notificationEmailRecipients(input.metadata);
+            if (recipients.length === 0)
+                return;
+            const subject = typeof input.metadata?.emailSubject === "string" &&
+                input.metadata.emailSubject.trim()
+                ? input.metadata.emailSubject.trim()
+                : `[${input.severity}] ${input.title}`;
+            const metadata = scrubEmailMetadata(input.metadata);
+            const metadataText = metadata
+                ? `\n\nMetadata:\n${JSON.stringify(metadata, null, 2)}`
+                : "";
+            const text = `${input.title}\n\n${input.body ?? ""}${metadataText}`;
+            const html = [
+                `<p><strong>${escapeHtml(input.title)}</strong></p>`,
+                input.body ? `<p>${escapeHtml(input.body)}</p>` : "",
+                metadata
+                    ? `<pre>${escapeHtml(JSON.stringify(metadata, null, 2))}</pre>`
+                    : "",
+            ].join("");
+            await Promise.all(recipients.map((to) => sendEmail({
+                to,
+                subject,
+                text,
+                html,
+            })));
+        },
+    };
+}
+async function resolveWebhookRequest(urlTemplate, authTemplate, owner, label) {
+    // Resolve `${keys.NAME}` references against the owner's user-scope secrets.
+    // Missing keys throw — the error surfaces in logs and the channel is marked
+    // un-delivered, but other channels still run.
+    const { resolved: url } = await resolveKeyReferences(urlTemplate, "user", owner);
+    const headers = {
+        "Content-Type": "application/json",
+    };
+    if (authTemplate) {
+        const { resolved: auth } = await resolveKeyReferences(authTemplate, "user", owner);
+        headers.Authorization = auth;
+    }
+    // If the user set an allowlist on a referenced key, enforce it here —
+    // origin-level check, same rule the automations fetch-tool applies.
+    const keyNames = Array.from(new Set(Array.from(urlTemplate.matchAll(/\$\{keys\.([A-Za-z0-9_-]+)\}/g), (m) => String(m[1]))));
+    const allowlists = await Promise.all(keyNames.map((name) => getKeyAllowlist(name, "user", owner)));
+    keyNames.forEach((name, i) => {
+        if (!validateUrlAllowlist(url, allowlists[i])) {
+            throw new Error(`[notifications] ${label} URL ${new URL(url).origin} is not in the allowlist for key "${name}"`);
+        }
+    });
+    return { url, headers };
+}
+function notificationEmailRecipients(metadata) {
+    const fromMetadata = stringArray(metadata?.emailRecipients);
+    const fromEnv = commaList(process.env.NOTIFICATIONS_EMAIL_RECIPIENTS);
+    const seen = new Set();
+    const recipients = [];
+    for (const raw of [...fromMetadata, ...fromEnv]) {
+        const email = raw.trim().toLowerCase();
+        if (!email || seen.has(email))
+            continue;
+        seen.add(email);
+        recipients.push(email);
+    }
+    return recipients;
+}
+function stringArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((item) => typeof item === "string");
+}
+function commaList(value) {
+    return value
+        ? value
+            .split(",")
+            .map((item) => item.trim())
+            .filter(Boolean)
+        : [];
+}
+function scrubEmailMetadata(metadata) {
+    if (!metadata)
+        return null;
+    const entries = Object.entries(metadata).filter(([key]) => key !== "emailRecipients" && key !== "emailSubject");
+    return entries.length ? Object.fromEntries(entries) : null;
+}
+function slackText(severity, title, body) {
+    return `[${severity}] ${title}${body ? `\n${body}` : ""}`;
+}
+function escapeSlack(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
 /**
  * Read up to ~1 KB from the body for error context. Streams chunks so a
  * misbehaving endpoint returning a large error page doesn't pin that whole

package/dist/notifications/channels.js.map

@@ -1 +1 @@
-{"version":3,"file":"channels.js","sourceRoot":"","sources":["../../src/notifications/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAG5D,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,MAAM,UAAU,mCAAmC;IACjD,IAAI,WAAW;QAAE,OAAO;IACxB,WAAW,GAAG,IAAI,CAAC;IAEnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAClD,IAAI,GAAG,EAAE,CAAC;QACR,2BAA2B,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAmB;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC5D,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;YACvB,mEAAmE;YACnE,mEAAmE;YACnE,gEAAgE;YAChE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,CAClD,WAAW,EACX,MAAM,EACN,IAAI,CAAC,KAAK,CACX,CAAC;YACF,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,kBAAkB;aACnC,CAAC;YACF,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,oBAAoB,CACnD,YAAY,EACZ,MAAM,EACN,IAAI,CAAC,KAAK,CACX,CAAC;gBACF,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;YAC/B,CAAC;YAED,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CACzB,IAAI,GAAG,CACL,KAAK,CAAC,IAAI,CACR,WAAW,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EACrD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACZ,CACF,CACF,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAClE,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBAC3B,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,qCAAqC,IAAI,GAAG,CAC/F,CAAC;gBACJ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;aACH,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,GACnE,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EACnC,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAa;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC;IACjB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC","sourcesContent":["/**\n * Built-in notification channels.\n *\n * Set environment variables to auto-register the webhook channel at startup.\n * Extra channels can be registered at any time via\n * `registerNotificationChannel()` from a server plugin.\n *\n * NOTIFICATIONS_WEBHOOK_URL  → POST notifications as JSON to this URL.\n *                              Supports `${keys.NAME}` substitution — the raw\n *                              value never enters the agent context.\n * NOTIFICATIONS_WEBHOOK_AUTH → optional `Authorization` header value (also\n *                              supports `${keys.NAME}`).\n */\n\nimport { ssrfSafeFetch } from \"../extensions/url-safety.js\";\nimport {\n  resolveKeyReferences,\n  validateUrlAllowlist,\n  getKeyAllowlist,\n} from \"../secrets/substitution.js\";\nimport { registerNotificationChannel } from \"./registry.js\";\nimport type { NotificationChannel } from \"./types.js\";\n\nlet _registered = false;\n\nexport function registerBuiltinNotificationChannels(): void {\n  if (_registered) return;\n  _registered = true;\n\n  const url = process.env.NOTIFICATIONS_WEBHOOK_URL;\n  if (url) {\n    registerNotificationChannel(createWebhookChannel(url));\n  }\n}\n\nfunction createWebhookChannel(urlTemplate: string): NotificationChannel {\n  const authTemplate = process.env.NOTIFICATIONS_WEBHOOK_AUTH;\n  return {\n    name: \"webhook\",\n    async deliver(input, meta) {\n      // Resolve `${keys.NAME}` references against the owner's user-scope\n      // secrets. Missing keys throw — the error surfaces in logs and the\n      // channel is marked un-delivered, but other channels still run.\n      const { resolved: url } = await resolveKeyReferences(\n        urlTemplate,\n        \"user\",\n        meta.owner,\n      );\n      const headers: Record<string, string> = {\n        \"Content-Type\": \"application/json\",\n      };\n      if (authTemplate) {\n        const { resolved: auth } = await resolveKeyReferences(\n          authTemplate,\n          \"user\",\n          meta.owner,\n        );\n        headers.Authorization = auth;\n      }\n\n      // If the user set an allowlist on a referenced key, enforce it here —\n      // origin-level check, same rule the automations fetch-tool applies.\n      const keyNames = Array.from(\n        new Set(\n          Array.from(\n            urlTemplate.matchAll(/\\$\\{keys\\.([A-Za-z0-9_-]+)\\}/g),\n            (m) => m[1],\n          ),\n        ),\n      );\n      const allowlists = await Promise.all(\n        keyNames.map((name) => getKeyAllowlist(name, \"user\", meta.owner)),\n      );\n      keyNames.forEach((name, i) => {\n        if (!validateUrlAllowlist(url, allowlists[i])) {\n          throw new Error(\n            `[notifications] webhook URL ${new URL(url).origin} is not in the allowlist for key \"${name}\"`,\n          );\n        }\n      });\n\n      const res = await ssrfSafeFetch(\n        url,\n        {\n          method: \"POST\",\n          headers,\n          body: JSON.stringify({\n            severity: input.severity,\n            title: input.title,\n            body: input.body,\n            metadata: input.metadata,\n            owner: meta.owner,\n            emittedAt: new Date().toISOString(),\n          }),\n        },\n        { maxRedirects: 3 },\n      );\n      if (!res.ok) {\n        throw new Error(\n          `[notifications] webhook ${new URL(url).origin} returned ${res.status}${\n            (await readErrorSnippet(res)) || \"\"\n          }`,\n        );\n      }\n    },\n  };\n}\n\n/**\n * Read up to ~1 KB from the body for error context. Streams chunks so a\n * misbehaving endpoint returning a large error page doesn't pin that whole\n * payload in memory per failed webhook.\n */\nasync function readErrorSnippet(res: Response): Promise<string> {\n  const reader = res.body?.getReader();\n  if (!reader) return \"\";\n  const decoder = new TextDecoder();\n  const MAX = 1024;\n  let buf = \"\";\n  try {\n    while (buf.length < MAX) {\n      const { value, done } = await reader.read();\n      if (done) break;\n      buf += decoder.decode(value, { stream: true });\n    }\n    reader.cancel().catch(() => {});\n  } catch {\n    return \"\";\n  }\n  if (!buf) return \"\";\n  return `: ${buf.slice(0, 200)}`;\n}\n"]}
+{"version":3,"file":"channels.js","sourceRoot":"","sources":["../../src/notifications/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAG5D,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,MAAM,UAAU,mCAAmC;IACjD,IAAI,WAAW;QAAE,OAAO;IACxB,WAAW,GAAG,IAAI,CAAC;IAEnB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAClD,IAAI,GAAG,EAAE,CAAC;QACR,2BAA2B,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IAC7D,IAAI,QAAQ,EAAE,CAAC;QACb,2BAA2B,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,CAAC;IAC3E,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACvE,2BAA2B,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAmB;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC5D,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;YACvB,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAClD,WAAW,EACX,YAAY,EACZ,IAAI,CAAC,KAAK,EACV,SAAS,CACV,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;aACH,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,GACnE,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EACnC,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,WAAmB;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IAClE,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;YACvB,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,MAAM,qBAAqB,CAClD,WAAW,EACX,YAAY,EACZ,IAAI,CAAC,KAAK,EACV,eAAe,CAChB,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC;oBACxD,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE;gCACJ,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;6BACtC;yBACF;wBACD,GAAG,CAAC,KAAK,CAAC,IAAI;4BACZ,CAAC,CAAC;gCACE;oCACE,IAAI,EAAE,SAAS;oCACf,IAAI,EAAE;wCACJ,IAAI,EAAE,QAAQ;wCACd,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;qCAC9B;iCACF;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;wBACP;4BACE,IAAI,EAAE,SAAS;4BACf,QAAQ,EAAE;gCACR;oCACE,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,eAAe,KAAK,CAAC,QAAQ,cAAc,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;iCAC3E;6BACF;yBACF;qBACF;iBACF,CAAC;aACH,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,CACpB,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,GACzE,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EACnC,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACpC,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,QAAQ,EAAE,YAAY,KAAK,QAAQ;gBAChD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE;gBAChC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE;gBACpC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,YAAY,GAAG,QAAQ;gBAC3B,CAAC,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;gBACvD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,IAAI,IAAI,EAAE,GAAG,YAAY,EAAE,CAAC;YACpE,MAAM,IAAI,GAAG;gBACX,cAAc,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe;gBACpD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBACpD,QAAQ;oBACN,CAAC,CAAC,QAAQ,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ;oBAC/D,CAAC,CAAC,EAAE;aACP,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEX,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,SAAS,CAAC;gBACR,EAAE;gBACF,OAAO;gBACP,IAAI;gBACJ,IAAI;aACL,CAAC,CACH,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,WAAmB,EACnB,YAAgC,EAChC,KAAa,EACb,KAAa;IAEb,4EAA4E;IAC5E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,MAAM,oBAAoB,CAClD,WAAW,EACX,MAAM,EACN,KAAK,CACN,CAAC;IACF,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,oBAAoB,CACnD,YAAY,EACZ,MAAM,EACN,KAAK,CACN,CAAC;QACF,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAC/B,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CACzB,IAAI,GAAG,CACL,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CACtE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACb,CACF,CACF,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAC7D,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,qCAAqC,IAAI,GAAG,CAChG,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,2BAA2B,CAClC,QAA6C;IAE7C,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB;IAC1C,OAAO,KAAK;QACV,CAAC,CAAC,KAAK;aACF,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,kBAAkB,CACzB,QAA6C;IAE7C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC7C,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,iBAAiB,IAAI,GAAG,KAAK,cAAc,CAC/D,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,KAAa,EACb,IAAwB;IAExB,OAAO,IAAI,QAAQ,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAa;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC;IACjB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC","sourcesContent":["/**\n * Built-in notification channels.\n *\n * Set environment variables to auto-register the webhook channel at startup.\n * Extra channels can be registered at any time via\n * `registerNotificationChannel()` from a server plugin.\n *\n * NOTIFICATIONS_WEBHOOK_URL  → POST notifications as JSON to this URL.\n *                              Supports `${keys.NAME}` substitution — the raw\n *                              value never enters the agent context.\n * NOTIFICATIONS_WEBHOOK_AUTH → optional `Authorization` header value (also\n *                              supports `${keys.NAME}`).\n * NOTIFICATIONS_SLACK_WEBHOOK_URL\n *                            → POST notifications to a Slack incoming webhook.\n *                              Supports `${keys.NAME}` substitution.\n * NOTIFICATIONS_EMAIL_CHANNEL=1\n *                            → enable the built-in email channel for\n *                              per-notification recipients.\n * NOTIFICATIONS_EMAIL_RECIPIENTS\n *                            → comma-separated fallback recipients for email\n *                              notifications that do not pass\n *                              `metadata.emailRecipients`.\n */\n\nimport { ssrfSafeFetch } from \"../extensions/url-safety.js\";\nimport {\n  resolveKeyReferences,\n  validateUrlAllowlist,\n  getKeyAllowlist,\n} from \"../secrets/substitution.js\";\nimport { sendEmail } from \"../server/email.js\";\nimport { registerNotificationChannel } from \"./registry.js\";\nimport type { NotificationChannel } from \"./types.js\";\n\nlet _registered = false;\n\nexport function registerBuiltinNotificationChannels(): void {\n  if (_registered) return;\n  _registered = true;\n\n  const url = process.env.NOTIFICATIONS_WEBHOOK_URL;\n  if (url) {\n    registerNotificationChannel(createWebhookChannel(url));\n  }\n\n  const slackUrl = process.env.NOTIFICATIONS_SLACK_WEBHOOK_URL;\n  if (slackUrl) {\n    registerNotificationChannel(createSlackWebhookChannel(slackUrl));\n  }\n\n  const emailRecipients = process.env.NOTIFICATIONS_EMAIL_RECIPIENTS?.trim();\n  if (process.env.NOTIFICATIONS_EMAIL_CHANNEL === \"1\" || emailRecipients) {\n    registerNotificationChannel(createEmailChannel());\n  }\n}\n\nfunction createWebhookChannel(urlTemplate: string): NotificationChannel {\n  const authTemplate = process.env.NOTIFICATIONS_WEBHOOK_AUTH;\n  return {\n    name: \"webhook\",\n    async deliver(input, meta) {\n      const { url, headers } = await resolveWebhookRequest(\n        urlTemplate,\n        authTemplate,\n        meta.owner,\n        \"webhook\",\n      );\n      const res = await ssrfSafeFetch(\n        url,\n        {\n          method: \"POST\",\n          headers,\n          body: JSON.stringify({\n            severity: input.severity,\n            title: input.title,\n            body: input.body,\n            metadata: input.metadata,\n            owner: meta.owner,\n            emittedAt: new Date().toISOString(),\n          }),\n        },\n        { maxRedirects: 3 },\n      );\n      if (!res.ok) {\n        throw new Error(\n          `[notifications] webhook ${new URL(url).origin} returned ${res.status}${\n            (await readErrorSnippet(res)) || \"\"\n          }`,\n        );\n      }\n    },\n  };\n}\n\nfunction createSlackWebhookChannel(urlTemplate: string): NotificationChannel {\n  const authTemplate = process.env.NOTIFICATIONS_SLACK_WEBHOOK_AUTH;\n  return {\n    name: \"slack\",\n    async deliver(input, meta) {\n      const { url, headers } = await resolveWebhookRequest(\n        urlTemplate,\n        authTemplate,\n        meta.owner,\n        \"Slack webhook\",\n      );\n      const res = await ssrfSafeFetch(\n        url,\n        {\n          method: \"POST\",\n          headers,\n          body: JSON.stringify({\n            text: slackText(input.severity, input.title, input.body),\n            blocks: [\n              {\n                type: \"section\",\n                text: {\n                  type: \"mrkdwn\",\n                  text: `*${escapeSlack(input.title)}*`,\n                },\n              },\n              ...(input.body\n                ? [\n                    {\n                      type: \"section\",\n                      text: {\n                        type: \"mrkdwn\",\n                        text: escapeSlack(input.body),\n                      },\n                    },\n                  ]\n                : []),\n              {\n                type: \"context\",\n                elements: [\n                  {\n                    type: \"mrkdwn\",\n                    text: `Severity: \\`${input.severity}\\`  Owner: ${escapeSlack(meta.owner)}`,\n                  },\n                ],\n              },\n            ],\n          }),\n        },\n        { maxRedirects: 3 },\n      );\n      if (!res.ok) {\n        throw new Error(\n          `[notifications] Slack webhook ${new URL(url).origin} returned ${res.status}${\n            (await readErrorSnippet(res)) || \"\"\n          }`,\n        );\n      }\n    },\n  };\n}\n\nfunction createEmailChannel(): NotificationChannel {\n  return {\n    name: \"email\",\n    async deliver(input) {\n      const recipients = notificationEmailRecipients(input.metadata);\n      if (recipients.length === 0) return;\n      const subject =\n        typeof input.metadata?.emailSubject === \"string\" &&\n        input.metadata.emailSubject.trim()\n          ? input.metadata.emailSubject.trim()\n          : `[${input.severity}] ${input.title}`;\n      const metadata = scrubEmailMetadata(input.metadata);\n      const metadataText = metadata\n        ? `\\n\\nMetadata:\\n${JSON.stringify(metadata, null, 2)}`\n        : \"\";\n      const text = `${input.title}\\n\\n${input.body ?? \"\"}${metadataText}`;\n      const html = [\n        `<p><strong>${escapeHtml(input.title)}</strong></p>`,\n        input.body ? `<p>${escapeHtml(input.body)}</p>` : \"\",\n        metadata\n          ? `<pre>${escapeHtml(JSON.stringify(metadata, null, 2))}</pre>`\n          : \"\",\n      ].join(\"\");\n\n      await Promise.all(\n        recipients.map((to) =>\n          sendEmail({\n            to,\n            subject,\n            text,\n            html,\n          }),\n        ),\n      );\n    },\n  };\n}\n\nasync function resolveWebhookRequest(\n  urlTemplate: string,\n  authTemplate: string | undefined,\n  owner: string,\n  label: string,\n): Promise<{ url: string; headers: Record<string, string> }> {\n  // Resolve `${keys.NAME}` references against the owner's user-scope secrets.\n  // Missing keys throw — the error surfaces in logs and the channel is marked\n  // un-delivered, but other channels still run.\n  const { resolved: url } = await resolveKeyReferences(\n    urlTemplate,\n    \"user\",\n    owner,\n  );\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n  };\n  if (authTemplate) {\n    const { resolved: auth } = await resolveKeyReferences(\n      authTemplate,\n      \"user\",\n      owner,\n    );\n    headers.Authorization = auth;\n  }\n\n  // If the user set an allowlist on a referenced key, enforce it here —\n  // origin-level check, same rule the automations fetch-tool applies.\n  const keyNames = Array.from(\n    new Set(\n      Array.from(urlTemplate.matchAll(/\\$\\{keys\\.([A-Za-z0-9_-]+)\\}/g), (m) =>\n        String(m[1]),\n      ),\n    ),\n  );\n  const allowlists = await Promise.all(\n    keyNames.map((name) => getKeyAllowlist(name, \"user\", owner)),\n  );\n  keyNames.forEach((name, i) => {\n    if (!validateUrlAllowlist(url, allowlists[i])) {\n      throw new Error(\n        `[notifications] ${label} URL ${new URL(url).origin} is not in the allowlist for key \"${name}\"`,\n      );\n    }\n  });\n  return { url, headers };\n}\n\nfunction notificationEmailRecipients(\n  metadata: Record<string, unknown> | undefined,\n): string[] {\n  const fromMetadata = stringArray(metadata?.emailRecipients);\n  const fromEnv = commaList(process.env.NOTIFICATIONS_EMAIL_RECIPIENTS);\n  const seen = new Set<string>();\n  const recipients: string[] = [];\n  for (const raw of [...fromMetadata, ...fromEnv]) {\n    const email = raw.trim().toLowerCase();\n    if (!email || seen.has(email)) continue;\n    seen.add(email);\n    recipients.push(email);\n  }\n  return recipients;\n}\n\nfunction stringArray(value: unknown): string[] {\n  if (!Array.isArray(value)) return [];\n  return value.filter((item): item is string => typeof item === \"string\");\n}\n\nfunction commaList(value: string | undefined): string[] {\n  return value\n    ? value\n        .split(\",\")\n        .map((item) => item.trim())\n        .filter(Boolean)\n    : [];\n}\n\nfunction scrubEmailMetadata(\n  metadata: Record<string, unknown> | undefined,\n): Record<string, unknown> | null {\n  if (!metadata) return null;\n  const entries = Object.entries(metadata).filter(\n    ([key]) => key !== \"emailRecipients\" && key !== \"emailSubject\",\n  );\n  return entries.length ? Object.fromEntries(entries) : null;\n}\n\nfunction slackText(\n  severity: string,\n  title: string,\n  body: string | undefined,\n): string {\n  return `[${severity}] ${title}${body ? `\\n${body}` : \"\"}`;\n}\n\nfunction escapeSlack(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\");\n}\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\");\n}\n\n/**\n * Read up to ~1 KB from the body for error context. Streams chunks so a\n * misbehaving endpoint returning a large error page doesn't pin that whole\n * payload in memory per failed webhook.\n */\nasync function readErrorSnippet(res: Response): Promise<string> {\n  const reader = res.body?.getReader();\n  if (!reader) return \"\";\n  const decoder = new TextDecoder();\n  const MAX = 1024;\n  let buf = \"\";\n  try {\n    while (buf.length < MAX) {\n      const { value, done } = await reader.read();\n      if (done) break;\n      buf += decoder.decode(value, { stream: true });\n    }\n    reader.cancel().catch(() => {});\n  } catch {\n    return \"\";\n  }\n  if (!buf) return \"\";\n  return `: ${buf.slice(0, 200)}`;\n}\n"]}

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
+    error?: undefined;
     count: number;
     updated?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated: number;
-    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,9 +26,9 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated?: undefined;
     ok: boolean;
-    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/observability/routes.d.ts

@@ -41,28 +41,28 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/resources/handlers.d.ts

@@ -49,8 +49,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/scripts/call-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call-agent.d.ts","sourceRoot":"","sources":["../../src/scripts/call-agent.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AA4DpD,eAAO,MAAM,IAAI,EAAE,UAuBlB,CAAC;AAEF,wBAAsB,GAAG,CACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,CAAC,EAAE,gBAAgB,EAC1B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA0NjB;AAmHD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CASzE"}
+{"version":3,"file":"call-agent.d.ts","sourceRoot":"","sources":["../../src/scripts/call-agent.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AA4DpD,eAAO,MAAM,IAAI,EAAE,UAuBlB,CAAC;AAEF,wBAAsB,GAAG,CACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,CAAC,EAAE,gBAAgB,EAC1B,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CA0NjB;AAmHD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CASzE"}

package/dist/scripts/call-agent.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { A2ATaskTimeoutError, callAgent, signA2AToken } from "../a2a/client.js";
+import { A2ATaskTimeoutError, callAgent, shouldPreferGlobalA2ASecret, signA2AToken, } from "../a2a/client.js";
 import { formatLlmCredentialErrorMessage, isLlmCredentialError, } from "../agent/engine/credential-errors.js";
 import { A2A_CONTINUATION_QUEUED_MARKER } from "../integrations/a2a-continuation-marker.js";
 import { getOrgDomain, getOrgA2ASecret } from "../org/context.js";
@@ -126,7 +126,7 @@ export async function run(args, context, selfAppId) {
                 try {
                     apiKey = await signA2AToken(callerEmail, callerOrgDomain, callerOrgSecret, {
                         expiresIn: INTEGRATION_A2A_TOKEN_TTL,
-                        preferGlobalSecret: !callerOrgSecret,
+                        preferGlobalSecret: shouldPreferGlobalA2ASecret(callerOrgSecret),
                     });
                 }
                 catch { }

package/dist/scripts/call-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"call-agent.js","sourceRoot":"","sources":["../../src/scripts/call-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,6CAA6C,GAAG,MAAM,CAAC;AAC7D,MAAM,kCAAkC,GAAG,KAAK,CAAC;AACjD,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAExC,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB;IACvB,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,OAAO,CACL,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO;QACrB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACtC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM;QACpB,UAAU,IAAI,UAAU,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,0BAA0B,EAAE;QAAE,OAAO,SAAS,CAAC;IAE3E,MAAM,UAAU,GAAG,cAAc,CAC/B,OAAO,CAAC,GAAG,CAAC,uCAAuC,CACpD,CAAC;IACF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAEhD,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,kCAAkC,CAAC;IAEnE,OAAO,6CAA6C,CAAC;AACvD,CAAC;AAED,SAAS,oCAAoC,CAC3C,SAAiB,EACjB,KAAc;IAEd,OAAO,oBAAoB,CAAC,KAAK,CAAC;QAChC,CAAC,CAAC,+BAA+B,CAAC,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAe;IAC9B,WAAW,EACT,+WAA+W;QAC/W,wSAAwS;QACxS,qCAAqC;QACrC,qMAAqM;QACrM,+QAA+Q;QAC/Q,qPAAqP;IACvP,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,+HAA+H;aAClI;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,iDAAiD;aAC/D;SACF;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;KAC/B;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAA4B,EAC5B,OAA0B,EAC1B,SAAkB;IAElB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE/C,IAAI,CAAC,aAAa;QAAE,OAAO,4BAA4B,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,8BAA8B,CAAC;IAEpD,2EAA2E;IAC3E,IAAI,SAAS,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,OAAO,sDAAsD,SAAS,6HAA6H,CAAC;IACtM,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,iBAAiB,aAAa,kCAAkC,SAAS,IAAI,QAAQ,EAAE,CAAC;IACjG,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,eAAe,GACnB,GAAG,OAAO,MAAM;QAChB,mKAAmK;QACnK,sGAAsG,KAAK,CAAC,GAAG,kDAAkD;QACjK,0GAA0G,CAAC;IAE7G,IAAI,CAAC;QACH,4EAA4E;QAC5E,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;YAE1C,+BAA+B;YAC/B,MAAM,WAAW,GAA4B,EAAE,CAAC;YAChD,IAAI,WAAW;gBAAE,WAAW,CAAC,SAAS,GAAG,WAAW,CAAC;YAErD,kDAAkD;YAClD,IAAI,eAAmC,CAAC;YACxC,IAAI,eAAmC,CAAC;YACxC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;oBACzC,IAAI,MAAM,EAAE,CAAC;wBACX,eAAe,GAAG,MAAM,CAAC;wBACzB,WAAW,CAAC,SAAS,GAAG,MAAM,CAAC;oBACjC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;oBAC5C,IAAI,MAAM;wBAAE,eAAe,GAAG,MAAM,CAAC;gBACvC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,+DAA+D;YAC/D,IAAI,MAA0B,CAAC;YAC/B,IAAI,WAAW,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,YAAY,CACzB,WAAW,EACX,eAAe,EACf,eAAe,EACf;wBACE,SAAS,EAAE,yBAAyB;wBACpC,kBAAkB,EAAE,CAAC,eAAe;qBACrC,CACF,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,EAAE,CAAC;gBACzD,IAAI,CAAC;oBACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;oBAC3C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,QAAQ,EACR,WAAW,CACZ,CAAC;oBACF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;oBACnC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;wBACzB,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;oBAChD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,IAAI,YAAY,GAAG,EAAE,CAAC;YACtB,IAAI,cAAc,GAAG,CAAC,CAAC;YACvB,MAAM,wBAAwB,GAC5B,MAAM,4CAA4C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrE,IAAI,wBAAwB;gBAAE,OAAO,wBAAwB,CAAC;YAE9D,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE;gBACtC,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;oBACpC,OAAO,CAAC,IAAK,CAAC;wBACZ,IAAI,EAAE,iBAAiB;wBACvB,KAAK,EAAE,KAAK,CAAC,IAAI;wBACjB,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;qBACpC,CAAC,CAAC;oBACH,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;gBAClC,CAAC;gBACD,YAAY,GAAG,OAAO,CAAC;YACzB,CAAC,CAAC;YAEF,kEAAkE;YAClE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,iEAAiE;YACjE,sEAAsE;YACtE,wEAAwE;YACxE,+BAA+B;YAC/B,IAAI,CAAC;gBACH,+DAA+D;gBAC/D,mEAAmE;gBACnE,qEAAqE;gBACrE,qEAAqE;gBACrE,MAAM,aAAa,GAAG,2BAA2B,EAAE,CAAC;gBACpD,YAAY,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE;oBACzD,MAAM;oBACN,SAAS,EAAE,WAAW;oBACtB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,eAAe;oBAC1B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;gBACH,YAAY;oBACV,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC;wBAC9D,YAAY,CAAC;gBACf,2DAA2D;gBAC3D,iEAAiE;gBACjE,uEAAuE;gBACvE,uEAAuE;gBACvE,YAAY,GAAG,kBAAkB,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3D,iEAAiE;gBACjE,IAAI,YAAY;oBAAE,WAAW,CAAC,YAAY,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,OAAY,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACvD,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAG,MAAM,wCAAwC,CAC3D,aAAa,EACb,KAAK,EACL,OAAO,EACP,WAAW,CACZ,CAAC;oBACF,IAAI,MAAM,EAAE,CAAC;wBACX,YAAY;4BACV,GAAG,8BAA8B,IAAI;gCACrC,OAAO,KAAK,CAAC,IAAI,iIAAiI;gCAClJ,eAAe,KAAK,CAAC,IAAI,6IAA6I,KAAK,CAAC,IAAI,oCAAoC,CAAC;oBACzN,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;wBACnD,YAAY,GAAG,OAAO,KAAK,CAAC,IAAI,oEAAoE,MAAM,GAAG,CAAC;oBAChH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;oBACnD,YAAY;wBACV,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;4BACzD,OAAO,KAAK,CAAC,IAAI,oEAAoE,MAAM,GAAG,CAAC;gBACnG,CAAC;YACH,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,OAAO,YAAY,IAAI,kBAAkB,CAAC;QAC5C,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,IAAI,MAA0B,CAAC;QAC/B,IAAI,SAA6B,CAAC;QAClC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;QACvC,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE;YAC3D,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,MAAM;YACjB,SAAS;SACV,CAAC,CAAC;QACH,MAAM,SAAS,GACb,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC;QACzE,OAAO,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC;IACxE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,iBAAiB,GAAG,oCAAoC,CAC5D,KAAK,CAAC,IAAI,EACV,GAAG,CACJ,CAAC;QACF,IAAI,iBAAiB;YAAE,OAAO,iBAAiB,CAAC;QAChD,0EAA0E;QAC1E,sCAAsC;QACtC,IAAI,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,OAAO,KAAK,CAAC,IAAI,gGAAgG,KAAK,CAAC,IAAI,gBAAgB,CAAC;QACrJ,CAAC;QACD,OAAO,iBAAiB,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wCAAwC,CACrD,MAAc,EACd,KAAoC,EACpC,OAAe,EACf,UAA8B;IAE9B,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,qBAAqB,EAAE,EAAE,EAAE,uBAAuB,EAAE,CAAC,GAC5D,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,MAAM,CAAC,4CAA4C,CAAC;YACpD,MAAM,CAAC,+CAA+C,CAAC;SACxD,CAAC,CAAC;QACL,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC;YAC/C,iBAAiB,EAAE,WAAW,CAAC,MAAM;YACrC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ;YACvC,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,gBAAgB;YACvD,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,UAAU;YACV,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;YAChC,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,SAAS,EAAE,mCAAmC,CAAC,OAAO,CAAC;YACvD,SAAS,EAAE,MAAM;YACjB,oEAAoE;YACpE,+DAA+D;YAC/D,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,MAAM,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3D,OAAO,CAAC,KAAK,CACX,oDAAoD,YAAY,CAAC,EAAE,GAAG,EACtE,GAAG,CACJ,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,mBAAmB;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IAE1D,MAAM,SAAS,GAAG,GAGL,CAAC;IACd,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACjD,IACE,SAAS,EAAE,IAAI,KAAK,qBAAqB;QACzC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACrE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,4CAA4C,CACzD,KAGC,EACD,OAAe;IAEf,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,EAAE,0CAA0C,EAAE,GAClD,MAAM,MAAM,CAAC,4CAA4C,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,MAAM,0CAA0C,CACpE,WAAW,CAAC,MAAM,EAClB,KAAK,CAAC,GAAG,EACT,mCAAmC,CAAC,OAAO,CAAC,CAC7C,CAAC;QACF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CACjD,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAC3D,YAAY,CAAC,MAAM,CACpB,CACF,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,KAAK,WAAW;YAC3B,CAAC,CAAC,sGAAsG;YACxG,CAAC,CAAC,2GAA2G,CAAC;QAClH,OAAO,CACL,GAAG,8BAA8B,IAAI;YACrC,OAAO,KAAK,CAAC,IAAI,UAAU,KAAK,iBAAiB,KAAK,CAAC,IAAI,6IAA6I,KAAK,CAAC,IAAI,kDAAkD,CACrQ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAAC,OAAe;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,4CAA4C;AAC5C,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IAC/D,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzC,4EAA4E;IAC5E,8EAA8E;IAC9E,OAAO,IAAI,CAAC,OAAO,CACjB,oDAAoD,EACpD,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAChD,CAAC;AACJ,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport { A2ATaskTimeoutError, callAgent, signA2AToken } from \"../a2a/client.js\";\nimport {\n  formatLlmCredentialErrorMessage,\n  isLlmCredentialError,\n} from \"../agent/engine/credential-errors.js\";\nimport type { ActionRunContext } from \"../agent/production-agent.js\";\nimport type { ActionTool } from \"../agent/types.js\";\nimport { A2A_CONTINUATION_QUEUED_MARKER } from \"../integrations/a2a-continuation-marker.js\";\nimport { getOrgDomain, getOrgA2ASecret } from \"../org/context.js\";\nimport { findAgent, discoverAgents } from \"../server/agent-discovery.js\";\nimport {\n  getRequestUserEmail,\n  getRequestOrgId,\n  isIntegrationCallerRequest,\n  getIntegrationRequestContext,\n} from \"../server/request-context.js\";\n\nconst DEFAULT_SERVERLESS_INTEGRATION_A2A_TIMEOUT_MS = 18_000;\nconst NETLIFY_INTEGRATION_A2A_TIMEOUT_MS = 2_000;\nconst INTEGRATION_A2A_TOKEN_TTL = \"30m\";\n\nfunction parseTimeoutMs(value: string | undefined): number | undefined {\n  if (!value) return undefined;\n  const parsed = Number(value);\n  if (!Number.isFinite(parsed) || parsed <= 0) return undefined;\n  return Math.floor(parsed);\n}\n\nfunction isServerlessHost(): boolean {\n  // Detection mirrors db/migrations.ts:297-301. On Cloudflare Workers/Pages,\n  // `process.env` is shimmed and CF_PAGES isn't reliably populated at runtime —\n  // the canonical signal is the `__cf_env` global injected by workerd.\n  return (\n    !!process.env.NETLIFY ||\n    !!process.env.AWS_LAMBDA_FUNCTION_NAME ||\n    !!process.env.VERCEL ||\n    \"__cf_env\" in globalThis\n  );\n}\n\nfunction getIntegrationCallTimeoutMs(): number | undefined {\n  if (!isServerlessHost() || !isIntegrationCallerRequest()) return undefined;\n\n  const configured = parseTimeoutMs(\n    process.env.AGENT_NATIVE_INTEGRATION_A2A_TIMEOUT_MS,\n  );\n  if (configured !== undefined) return configured;\n\n  // Netlify's current synchronous function budget is 60s. Keep delegated\n  // calls very short so multi-agent integration requests queue downstream\n  // continuations quickly instead of spending the parent Slack/email processor\n  // budget waiting on separately deployed apps one-by-one.\n  if (process.env.NETLIFY) return NETLIFY_INTEGRATION_A2A_TIMEOUT_MS;\n\n  return DEFAULT_SERVERLESS_INTEGRATION_A2A_TIMEOUT_MS;\n}\n\nfunction formatDownstreamLlmCredentialFailure(\n  agentName: string,\n  value: unknown,\n): string | null {\n  return isLlmCredentialError(value)\n    ? formatLlmCredentialErrorMessage({ agentName })\n    : null;\n}\n\nexport const tool: ActionTool = {\n  description:\n    \"Call a DIFFERENT, separately-deployed agent app to ask a question or delegate a task. This is strictly for cross-app A2A communication — for example, asking the mail agent to send an email while you are the calendar agent. NEVER use this to call your own app or perform actions you can do with your own tools. Using call-agent on yourself will fail and waste time. \" +\n    'For brand-consistent generated media, the first-party Assets agent is available as agent=\"assets\"; use it when another app needs generated heroes, diagrams, product shots, thumbnails, videos, or design imagery, unless the current app has its own generation action that already delegates there. ' +\n    \"IMPORTANT — handling the response: \" +\n    \"(a) If it contains a URL or ID, copy it VERBATIM into your reply. Do not 'correct' or pluralize the path (e.g. /deck/ → /decks/), normalize casing, or change the slug — any edit breaks the link. \" +\n    '(b) If it does NOT contain a URL/ID and the user asked for one, say so explicitly (e.g. \"the agent created the deck/image but didn\\'t return a link — open the app directly to view it\"). NEVER invent a URL, slug, or path — guessing produces broken links that look real. ' +\n    \"(c) If the downstream response reports missing credentials, never repeat raw env var names, Vault key names, token names, secret names, or other credential identifiers. Tell the user the target app needs its LLM/provider connection configured.\",\n  parameters: {\n    type: \"object\",\n    properties: {\n      agent: {\n        type: \"string\",\n        description:\n          \"Name or URL of a DIFFERENT deployed agent app (e.g. 'mail', 'calendar', 'analytics'). Must not be the current app's own name.\",\n      },\n      message: {\n        type: \"string\",\n        description: \"The message/question to send to the other agent\",\n      },\n    },\n    required: [\"agent\", \"message\"],\n  },\n};\n\nexport async function run(\n  args: Record<string, string>,\n  context?: ActionRunContext,\n  selfAppId?: string,\n): Promise<string> {\n  const { agent: agentIdOrName, message } = args;\n\n  if (!agentIdOrName) return \"Error: --agent is required\";\n  if (!message) return \"Error: --message is required\";\n\n  // Prevent self-calls — the agent must use its own registered tools instead\n  if (selfAppId && agentIdOrName.toLowerCase() === selfAppId.toLowerCase()) {\n    return `Error: You cannot use call-agent to call yourself (${selfAppId}). Use your own registered actions/tools instead. call-agent is only for communicating with OTHER separately-deployed apps.`;\n  }\n\n  const agent = await findAgent(agentIdOrName, selfAppId);\n  if (!agent) {\n    const available = (await discoverAgents(selfAppId))\n      .map((a) => a.name)\n      .join(\", \");\n    return `Error: Agent \"${agentIdOrName}\" not found. Available agents: ${available || \"(none)\"}`;\n  }\n\n  // Append a small cross-app hint to the outgoing message so the receiving\n  // agent (which may be on an older deploy without the receiver-side hint\n  // in handlers.ts) still emits fully-qualified URLs. This is belt-and-\n  // suspenders with the receiver hint — but it works against any current\n  // deployment, no redeploy required.\n  const messageWithHint =\n    `${message}\\n\\n` +\n    `[Note: this request comes from another app via A2A. The caller cannot see your local UI, deck list, or navigation — only the literal text you put in your reply. ` +\n    `If you create or reference a deck/document/design/dashboard, include its FULLY-QUALIFIED URL (e.g. ${agent.url}/deck/<id>) in your reply, not a relative path. ` +\n    `Use only artifact IDs and URL paths returned by successful actions — never invent slugs, IDs, or hosts.]`;\n\n  try {\n    // If we have a send context, use streaming so the UI shows progressive text\n    if (context?.send) {\n      const callerEmail = getRequestUserEmail();\n\n      // Build metadata with identity\n      const a2aMetadata: Record<string, unknown> = {};\n      if (callerEmail) a2aMetadata.userEmail = callerEmail;\n\n      // Include org domain for cross-app org resolution\n      let callerOrgDomain: string | undefined;\n      let callerOrgSecret: string | undefined;\n      const orgId = getRequestOrgId();\n      if (orgId) {\n        try {\n          const domain = await getOrgDomain(orgId);\n          if (domain) {\n            callerOrgDomain = domain;\n            a2aMetadata.orgDomain = domain;\n          }\n        } catch {}\n        try {\n          const secret = await getOrgA2ASecret(orgId);\n          if (secret) callerOrgSecret = secret;\n        } catch {}\n      }\n\n      // Sign JWT with identity + org domain for the streaming client\n      let apiKey: string | undefined;\n      if (callerEmail && (callerOrgSecret || process.env.A2A_SECRET)) {\n        try {\n          apiKey = await signA2AToken(\n            callerEmail,\n            callerOrgDomain,\n            callerOrgSecret,\n            {\n              expiresIn: INTEGRATION_A2A_TOKEN_TTL,\n              preferGlobalSecret: !callerOrgSecret,\n            },\n          );\n        } catch {}\n      }\n\n      if (process.env.NODE_ENV === \"production\" && callerEmail) {\n        try {\n          const { listOAuthAccountsByOwner } =\n            await import(\"../oauth-tokens/store.js\");\n          const accounts = await listOAuthAccountsByOwner(\n            \"google\",\n            callerEmail,\n          );\n          const tokens = accounts[0]?.tokens;\n          if (tokens?.access_token) {\n            a2aMetadata.googleToken = tokens.access_token;\n          }\n        } catch {}\n      }\n\n      let responseText = \"\";\n      let lastSentLength = 0;\n      const existingContinuationText =\n        await formatExistingIntegrationContinuationIfRetry(agent, message);\n      if (existingContinuationText) return existingContinuationText;\n\n      context.send({\n        type: \"agent_call\",\n        agent: agent.name,\n        status: \"start\",\n      });\n\n      const emitNewText = (newText: string) => {\n        if (newText.length > lastSentLength) {\n          context.send!({\n            type: \"agent_call_text\",\n            agent: agent.name,\n            text: newText.slice(lastSentLength),\n          });\n          lastSentLength = newText.length;\n        }\n        responseText = newText;\n      };\n\n      // Skip the SSE streaming attempt and go straight to async + poll.\n      // Why: on Netlify (Lambda), the receiving server has no streaming\n      // response support, so message/stream returns a single JSON-RPC error\n      // body in a 200 response that our SSE parser silently consumes — the\n      // `for await` loop yields nothing AND keeps the connection open until\n      // the function timeout, eating the current serverless budget. By the\n      // time we get to the sync fallback, Lambda is dead and the second fetch\n      // errors out as \"fetch failed\". Async+poll has its own short fetches\n      // with their own budgets, so it works reliably across hosts. The\n      // trade-off is we lose progressive in-UI text streaming for cross-app\n      // A2A calls, but the receiving agent's full response still surfaces via\n      // the tool_result event below.\n      try {\n        // Apply a polling cap ONLY for integration-platform callers on\n        // serverless hosts. Normal chat, local Node, self-hosted Node, and\n        // Docker can wait for slow-but-valid answers; integration processors\n        // still need to finish before their current function execution dies.\n        const callTimeoutMs = getIntegrationCallTimeoutMs();\n        responseText = await callAgent(agent.url, messageWithHint, {\n          apiKey,\n          userEmail: callerEmail,\n          orgDomain: callerOrgDomain,\n          orgSecret: callerOrgSecret,\n          ...(callTimeoutMs ? { timeoutMs: callTimeoutMs } : {}),\n        });\n        responseText =\n          formatDownstreamLlmCredentialFailure(agent.name, responseText) ??\n          responseText;\n        // Some agents reply with relative paths (e.g. slides emits\n        // \"/deck/abc\"). Those resolve against the caller's host, not the\n        // receiver's, so they're broken for the user. Expand any leading-slash\n        // URL into a fully-qualified one rooted at the receiving agent's host.\n        responseText = expandRelativeUrls(responseText, agent.url);\n        // Mirror the response into the streaming UI so the user sees it.\n        if (responseText) emitNewText(responseText);\n      } catch (pollErr: any) {\n        const timeoutTaskId = getA2ATaskTimeoutTaskId(pollErr);\n        if (timeoutTaskId) {\n          const queued = await enqueueIntegrationContinuationIfPossible(\n            timeoutTaskId,\n            agent,\n            message,\n            callerEmail,\n          );\n          if (queued) {\n            responseText =\n              `${A2A_CONTINUATION_QUEUED_MARKER}\\n` +\n              `The ${agent.name} agent accepted this delegated subtask and will post its own final result to the originating integration thread automatically. ` +\n              `Do not call ${agent.name} again for this same subtask. Continue any other requested work, then answer with the completed results you have; if needed, mention that ${agent.name} is posting its result separately.`;\n          } else {\n            const reason = pollErr?.message ?? \"unknown error\";\n            responseText = `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;\n          }\n        } else {\n          const reason = pollErr?.message ?? \"unknown error\";\n          responseText =\n            formatDownstreamLlmCredentialFailure(agent.name, pollErr) ??\n            `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;\n        }\n      }\n\n      context.send({\n        type: \"agent_call\",\n        agent: agent.name,\n        status: \"done\",\n      });\n\n      return responseText || \"(empty response)\";\n    }\n\n    // No context — use the async + poll call so we don't get cut off at the\n    // serverless gateway's ~30s timeout. callAgent defaults to async:true.\n    const email = getRequestUserEmail();\n    let domain: string | undefined;\n    let orgSecret: string | undefined;\n    const currentOrgId = getRequestOrgId();\n    if (currentOrgId) {\n      try {\n        domain = (await getOrgDomain(currentOrgId)) ?? undefined;\n      } catch {}\n      try {\n        orgSecret = (await getOrgA2ASecret(currentOrgId)) ?? undefined;\n      } catch {}\n    }\n    const response = await callAgent(agent.url, messageWithHint, {\n      userEmail: email,\n      orgDomain: domain,\n      orgSecret,\n    });\n    const sanitized =\n      formatDownstreamLlmCredentialFailure(agent.name, response) ?? response;\n    return expandRelativeUrls(sanitized, agent.url) || \"(empty response)\";\n  } catch (err: any) {\n    const msg = err?.message ?? String(err);\n    const credentialMessage = formatDownstreamLlmCredentialFailure(\n      agent.name,\n      err,\n    );\n    if (credentialMessage) return credentialMessage;\n    // Friendlier message for the common timeout case so the calling agent can\n    // decide whether to give up or retry.\n    if (/timeout|did not complete|Inactivity|504/i.test(msg)) {\n      return `The ${agent.name} agent is taking longer than expected. Please try again, ask a simpler question, or open the ${agent.name} app directly.`;\n    }\n    return `Error calling ${agent.name}: ${msg}`;\n  }\n}\n\nasync function enqueueIntegrationContinuationIfPossible(\n  taskId: string,\n  agent: { name: string; url: string },\n  message: string,\n  ownerEmail: string | undefined,\n): Promise<boolean> {\n  const integration = getIntegrationRequestContext();\n  if (!integration || !ownerEmail) return false;\n\n  try {\n    const [{ insertA2AContinuation }, { dispatchA2AContinuation }] =\n      await Promise.all([\n        import(\"../integrations/a2a-continuations-store.js\"),\n        import(\"../integrations/a2a-continuation-processor.js\"),\n      ]);\n    const continuation = await insertA2AContinuation({\n      integrationTaskId: integration.taskId,\n      platform: integration.incoming.platform,\n      externalThreadId: integration.incoming.externalThreadId,\n      incoming: integration.incoming,\n      placeholderRef: integration.placeholderRef,\n      ownerEmail,\n      orgId: getRequestOrgId() ?? null,\n      agentName: agent.name,\n      agentUrl: agent.url,\n      dedupeKey: getIntegrationContinuationDedupeKey(message),\n      a2aTaskId: taskId,\n      // Do not persist the short-lived JWT used for the initial send. The\n      // continuation processor can mint a fresh token for each poll.\n      a2aAuthToken: null,\n    });\n    await dispatchA2AContinuation(continuation.id).catch((err) => {\n      console.error(\n        `[call-agent] Failed to dispatch A2A continuation ${continuation.id}:`,\n        err,\n      );\n    });\n    return true;\n  } catch (err) {\n    console.error(\"[call-agent] Failed to enqueue A2A continuation:\", err);\n    return false;\n  }\n}\n\nfunction getA2ATaskTimeoutTaskId(err: unknown): string | null {\n  if (err instanceof A2ATaskTimeoutError) return err.taskId;\n\n  const candidate = err as\n    | { name?: unknown; taskId?: unknown; message?: unknown }\n    | null\n    | undefined;\n  const message = String(candidate?.message ?? \"\");\n  if (\n    candidate?.name === \"A2ATaskTimeoutError\" &&\n    typeof candidate.taskId === \"string\"\n  ) {\n    return candidate.taskId;\n  }\n\n  const match = message.match(/^A2A task ([^\\s]+) did not complete\\b/);\n  return match?.[1] ?? null;\n}\n\nasync function formatExistingIntegrationContinuationIfRetry(\n  agent: {\n    name: string;\n    url: string;\n  },\n  message: string,\n): Promise<string | null> {\n  const integration = getIntegrationRequestContext();\n  if (!integration || (integration.attempts ?? 1) <= 1) return null;\n\n  try {\n    const { getA2AContinuationsForIntegrationTaskAgent } =\n      await import(\"../integrations/a2a-continuations-store.js\");\n    const continuations = await getA2AContinuationsForIntegrationTaskAgent(\n      integration.taskId,\n      agent.url,\n      getIntegrationContinuationDedupeKey(message),\n    );\n    const active = continuations.find((continuation) =>\n      [\"pending\", \"processing\", \"delivering\", \"completed\"].includes(\n        continuation.status,\n      ),\n    );\n    if (!active) return null;\n\n    const state =\n      active.status === \"completed\"\n        ? \"already completed this delegated subtask and posted its result to the originating integration thread\"\n        : \"already accepted this delegated subtask and is still working on it for the originating integration thread\";\n    return (\n      `${A2A_CONTINUATION_QUEUED_MARKER}\\n` +\n      `The ${agent.name} agent ${state}. Do not call ${agent.name} again for this same subtask. Continue any other requested work, then answer with the completed results you have; if needed, mention that ${agent.name} is posting or has posted its result separately.`\n    );\n  } catch (err) {\n    console.error(\"[call-agent] Failed to inspect existing continuation:\", err);\n    return null;\n  }\n}\n\nfunction getIntegrationContinuationDedupeKey(message: string): string {\n  const normalized = message.trim().replace(/\\s+/g, \" \");\n  return createHash(\"sha256\").update(normalized).digest(\"hex\");\n}\n\n// Expand bare leading-slash paths (e.g. \"/deck/abc\") into fully-qualified URLs\n// rooted at the receiving agent's host. The receiver doesn't always know it's\n// being called cross-app, so it may emit relative paths that resolve against\n// the caller's host (broken). Match a path that starts at a word boundary,\n// begins with `/`, and has at least one path segment after that. Skip if it\n// already looks like a fully-qualified URL.\nexport function expandRelativeUrls(text: string, agentUrl: string): string {\n  if (!text || !agentUrl) return text;\n  const base = agentUrl.replace(/\\/$/, \"\");\n  // Path must start at boundary (start, whitespace, or punctuation that isn't\n  // ':' — to avoid mangling `https://example.com/foo` or markdown link bodies).\n  return text.replace(\n    /(^|[\\s([<\"'`])(\\/[a-z0-9_-][a-z0-9_/?&=%#.,:-]*)/gi,\n    (_match, lead, path) => `${lead}${base}${path}`,\n  );\n}\n"]}
+{"version":3,"file":"call-agent.js","sourceRoot":"","sources":["../../src/scripts/call-agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,2BAA2B,EAC3B,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AAEtC,MAAM,6CAA6C,GAAG,MAAM,CAAC;AAC7D,MAAM,kCAAkC,GAAG,KAAK,CAAC;AACjD,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAExC,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB;IACvB,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,OAAO,CACL,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO;QACrB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB;QACtC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM;QACpB,UAAU,IAAI,UAAU,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IAClC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,0BAA0B,EAAE;QAAE,OAAO,SAAS,CAAC;IAE3E,MAAM,UAAU,GAAG,cAAc,CAC/B,OAAO,CAAC,GAAG,CAAC,uCAAuC,CACpD,CAAC;IACF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAEhD,uEAAuE;IACvE,wEAAwE;IACxE,6EAA6E;IAC7E,yDAAyD;IACzD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO;QAAE,OAAO,kCAAkC,CAAC;IAEnE,OAAO,6CAA6C,CAAC;AACvD,CAAC;AAED,SAAS,oCAAoC,CAC3C,SAAiB,EACjB,KAAc;IAEd,OAAO,oBAAoB,CAAC,KAAK,CAAC;QAChC,CAAC,CAAC,+BAA+B,CAAC,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAe;IAC9B,WAAW,EACT,+WAA+W;QAC/W,wSAAwS;QACxS,qCAAqC;QACrC,qMAAqM;QACrM,+QAA+Q;QAC/Q,qPAAqP;IACvP,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,WAAW,EACT,+HAA+H;aAClI;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,iDAAiD;aAC/D;SACF;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;KAC/B;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,IAA4B,EAC5B,OAA0B,EAC1B,SAAkB;IAElB,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAE/C,IAAI,CAAC,aAAa;QAAE,OAAO,4BAA4B,CAAC;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,8BAA8B,CAAC;IAEpD,2EAA2E;IAC3E,IAAI,SAAS,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACzE,OAAO,sDAAsD,SAAS,6HAA6H,CAAC;IACtM,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,CAAC,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAClB,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,iBAAiB,aAAa,kCAAkC,SAAS,IAAI,QAAQ,EAAE,CAAC;IACjG,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,eAAe,GACnB,GAAG,OAAO,MAAM;QAChB,mKAAmK;QACnK,sGAAsG,KAAK,CAAC,GAAG,kDAAkD;QACjK,0GAA0G,CAAC;IAE7G,IAAI,CAAC;QACH,4EAA4E;QAC5E,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;YAClB,MAAM,WAAW,GAAG,mBAAmB,EAAE,CAAC;YAE1C,+BAA+B;YAC/B,MAAM,WAAW,GAA4B,EAAE,CAAC;YAChD,IAAI,WAAW;gBAAE,WAAW,CAAC,SAAS,GAAG,WAAW,CAAC;YAErD,kDAAkD;YAClD,IAAI,eAAmC,CAAC;YACxC,IAAI,eAAmC,CAAC;YACxC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;YAChC,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;oBACzC,IAAI,MAAM,EAAE,CAAC;wBACX,eAAe,GAAG,MAAM,CAAC;wBACzB,WAAW,CAAC,SAAS,GAAG,MAAM,CAAC;oBACjC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;oBAC5C,IAAI,MAAM;wBAAE,eAAe,GAAG,MAAM,CAAC;gBACvC,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,+DAA+D;YAC/D,IAAI,MAA0B,CAAC;YAC/B,IAAI,WAAW,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/D,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,YAAY,CACzB,WAAW,EACX,eAAe,EACf,eAAe,EACf;wBACE,SAAS,EAAE,yBAAyB;wBACpC,kBAAkB,EAAE,2BAA2B,CAAC,eAAe,CAAC;qBACjE,CACF,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,WAAW,EAAE,CAAC;gBACzD,IAAI,CAAC;oBACH,MAAM,EAAE,wBAAwB,EAAE,GAChC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;oBAC3C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,QAAQ,EACR,WAAW,CACZ,CAAC;oBACF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;oBACnC,IAAI,MAAM,EAAE,YAAY,EAAE,CAAC;wBACzB,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;oBAChD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,IAAI,YAAY,GAAG,EAAE,CAAC;YACtB,IAAI,cAAc,GAAG,CAAC,CAAC;YACvB,MAAM,wBAAwB,GAC5B,MAAM,4CAA4C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACrE,IAAI,wBAAwB;gBAAE,OAAO,wBAAwB,CAAC;YAE9D,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EAAE,OAAO;aAChB,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE;gBACtC,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;oBACpC,OAAO,CAAC,IAAK,CAAC;wBACZ,IAAI,EAAE,iBAAiB;wBACvB,KAAK,EAAE,KAAK,CAAC,IAAI;wBACjB,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;qBACpC,CAAC,CAAC;oBACH,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;gBAClC,CAAC;gBACD,YAAY,GAAG,OAAO,CAAC;YACzB,CAAC,CAAC;YAEF,kEAAkE;YAClE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,sEAAsE;YACtE,qEAAqE;YACrE,wEAAwE;YACxE,qEAAqE;YACrE,iEAAiE;YACjE,sEAAsE;YACtE,wEAAwE;YACxE,+BAA+B;YAC/B,IAAI,CAAC;gBACH,+DAA+D;gBAC/D,mEAAmE;gBACnE,qEAAqE;gBACrE,qEAAqE;gBACrE,MAAM,aAAa,GAAG,2BAA2B,EAAE,CAAC;gBACpD,YAAY,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE;oBACzD,MAAM;oBACN,SAAS,EAAE,WAAW;oBACtB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,eAAe;oBAC1B,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;gBACH,YAAY;oBACV,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC;wBAC9D,YAAY,CAAC;gBACf,2DAA2D;gBAC3D,iEAAiE;gBACjE,uEAAuE;gBACvE,uEAAuE;gBACvE,YAAY,GAAG,kBAAkB,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC3D,iEAAiE;gBACjE,IAAI,YAAY;oBAAE,WAAW,CAAC,YAAY,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,OAAY,EAAE,CAAC;gBACtB,MAAM,aAAa,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACvD,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,MAAM,GAAG,MAAM,wCAAwC,CAC3D,aAAa,EACb,KAAK,EACL,OAAO,EACP,WAAW,CACZ,CAAC;oBACF,IAAI,MAAM,EAAE,CAAC;wBACX,YAAY;4BACV,GAAG,8BAA8B,IAAI;gCACrC,OAAO,KAAK,CAAC,IAAI,iIAAiI;gCAClJ,eAAe,KAAK,CAAC,IAAI,6IAA6I,KAAK,CAAC,IAAI,oCAAoC,CAAC;oBACzN,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;wBACnD,YAAY,GAAG,OAAO,KAAK,CAAC,IAAI,oEAAoE,MAAM,GAAG,CAAC;oBAChH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;oBACnD,YAAY;wBACV,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;4BACzD,OAAO,KAAK,CAAC,IAAI,oEAAoE,MAAM,GAAG,CAAC;gBACnG,CAAC;YACH,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,MAAM,EAAE,MAAM;aACf,CAAC,CAAC;YAEH,OAAO,YAAY,IAAI,kBAAkB,CAAC;QAC5C,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,IAAI,MAA0B,CAAC;QAC/B,IAAI,SAA6B,CAAC;QAClC,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;QACvC,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,IAAI,CAAC;gBACH,SAAS,GAAG,CAAC,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC,IAAI,SAAS,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE;YAC3D,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,MAAM;YACjB,SAAS;SACV,CAAC,CAAC;QACH,MAAM,SAAS,GACb,oCAAoC,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC;QACzE,OAAO,kBAAkB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC;IACxE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,iBAAiB,GAAG,oCAAoC,CAC5D,KAAK,CAAC,IAAI,EACV,GAAG,CACJ,CAAC;QACF,IAAI,iBAAiB;YAAE,OAAO,iBAAiB,CAAC;QAChD,0EAA0E;QAC1E,sCAAsC;QACtC,IAAI,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,OAAO,KAAK,CAAC,IAAI,gGAAgG,KAAK,CAAC,IAAI,gBAAgB,CAAC;QACrJ,CAAC;QACD,OAAO,iBAAiB,KAAK,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wCAAwC,CACrD,MAAc,EACd,KAAoC,EACpC,OAAe,EACf,UAA8B;IAE9B,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9C,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,qBAAqB,EAAE,EAAE,EAAE,uBAAuB,EAAE,CAAC,GAC5D,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,MAAM,CAAC,4CAA4C,CAAC;YACpD,MAAM,CAAC,+CAA+C,CAAC;SACxD,CAAC,CAAC;QACL,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC;YAC/C,iBAAiB,EAAE,WAAW,CAAC,MAAM;YACrC,QAAQ,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ;YACvC,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,gBAAgB;YACvD,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,UAAU;YACV,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;YAChC,SAAS,EAAE,KAAK,CAAC,IAAI;YACrB,QAAQ,EAAE,KAAK,CAAC,GAAG;YACnB,SAAS,EAAE,mCAAmC,CAAC,OAAO,CAAC;YACvD,SAAS,EAAE,MAAM;YACjB,oEAAoE;YACpE,+DAA+D;YAC/D,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,MAAM,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3D,OAAO,CAAC,KAAK,CACX,oDAAoD,YAAY,CAAC,EAAE,GAAG,EACtE,GAAG,CACJ,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,mBAAmB;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC;IAE1D,MAAM,SAAS,GAAG,GAGL,CAAC;IACd,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACjD,IACE,SAAS,EAAE,IAAI,KAAK,qBAAqB;QACzC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,EACpC,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACrE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,4CAA4C,CACzD,KAGC,EACD,OAAe;IAEf,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAC;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,EAAE,0CAA0C,EAAE,GAClD,MAAM,MAAM,CAAC,4CAA4C,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,MAAM,0CAA0C,CACpE,WAAW,CAAC,MAAM,EAClB,KAAK,CAAC,GAAG,EACT,mCAAmC,CAAC,OAAO,CAAC,CAC7C,CAAC;QACF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CACjD,CAAC,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAC3D,YAAY,CAAC,MAAM,CACpB,CACF,CAAC;QACF,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,KAAK,GACT,MAAM,CAAC,MAAM,KAAK,WAAW;YAC3B,CAAC,CAAC,sGAAsG;YACxG,CAAC,CAAC,2GAA2G,CAAC;QAClH,OAAO,CACL,GAAG,8BAA8B,IAAI;YACrC,OAAO,KAAK,CAAC,IAAI,UAAU,KAAK,iBAAiB,KAAK,CAAC,IAAI,6IAA6I,KAAK,CAAC,IAAI,kDAAkD,CACrQ,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mCAAmC,CAAC,OAAe;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,4CAA4C;AAC5C,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAgB;IAC/D,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzC,4EAA4E;IAC5E,8EAA8E;IAC9E,OAAO,IAAI,CAAC,OAAO,CACjB,oDAAoD,EACpD,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAChD,CAAC;AACJ,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport {\n  A2ATaskTimeoutError,\n  callAgent,\n  shouldPreferGlobalA2ASecret,\n  signA2AToken,\n} from \"../a2a/client.js\";\nimport {\n  formatLlmCredentialErrorMessage,\n  isLlmCredentialError,\n} from \"../agent/engine/credential-errors.js\";\nimport type { ActionRunContext } from \"../agent/production-agent.js\";\nimport type { ActionTool } from \"../agent/types.js\";\nimport { A2A_CONTINUATION_QUEUED_MARKER } from \"../integrations/a2a-continuation-marker.js\";\nimport { getOrgDomain, getOrgA2ASecret } from \"../org/context.js\";\nimport { findAgent, discoverAgents } from \"../server/agent-discovery.js\";\nimport {\n  getRequestUserEmail,\n  getRequestOrgId,\n  isIntegrationCallerRequest,\n  getIntegrationRequestContext,\n} from \"../server/request-context.js\";\n\nconst DEFAULT_SERVERLESS_INTEGRATION_A2A_TIMEOUT_MS = 18_000;\nconst NETLIFY_INTEGRATION_A2A_TIMEOUT_MS = 2_000;\nconst INTEGRATION_A2A_TOKEN_TTL = \"30m\";\n\nfunction parseTimeoutMs(value: string | undefined): number | undefined {\n  if (!value) return undefined;\n  const parsed = Number(value);\n  if (!Number.isFinite(parsed) || parsed <= 0) return undefined;\n  return Math.floor(parsed);\n}\n\nfunction isServerlessHost(): boolean {\n  // Detection mirrors db/migrations.ts:297-301. On Cloudflare Workers/Pages,\n  // `process.env` is shimmed and CF_PAGES isn't reliably populated at runtime —\n  // the canonical signal is the `__cf_env` global injected by workerd.\n  return (\n    !!process.env.NETLIFY ||\n    !!process.env.AWS_LAMBDA_FUNCTION_NAME ||\n    !!process.env.VERCEL ||\n    \"__cf_env\" in globalThis\n  );\n}\n\nfunction getIntegrationCallTimeoutMs(): number | undefined {\n  if (!isServerlessHost() || !isIntegrationCallerRequest()) return undefined;\n\n  const configured = parseTimeoutMs(\n    process.env.AGENT_NATIVE_INTEGRATION_A2A_TIMEOUT_MS,\n  );\n  if (configured !== undefined) return configured;\n\n  // Netlify's current synchronous function budget is 60s. Keep delegated\n  // calls very short so multi-agent integration requests queue downstream\n  // continuations quickly instead of spending the parent Slack/email processor\n  // budget waiting on separately deployed apps one-by-one.\n  if (process.env.NETLIFY) return NETLIFY_INTEGRATION_A2A_TIMEOUT_MS;\n\n  return DEFAULT_SERVERLESS_INTEGRATION_A2A_TIMEOUT_MS;\n}\n\nfunction formatDownstreamLlmCredentialFailure(\n  agentName: string,\n  value: unknown,\n): string | null {\n  return isLlmCredentialError(value)\n    ? formatLlmCredentialErrorMessage({ agentName })\n    : null;\n}\n\nexport const tool: ActionTool = {\n  description:\n    \"Call a DIFFERENT, separately-deployed agent app to ask a question or delegate a task. This is strictly for cross-app A2A communication — for example, asking the mail agent to send an email while you are the calendar agent. NEVER use this to call your own app or perform actions you can do with your own tools. Using call-agent on yourself will fail and waste time. \" +\n    'For brand-consistent generated media, the first-party Assets agent is available as agent=\"assets\"; use it when another app needs generated heroes, diagrams, product shots, thumbnails, videos, or design imagery, unless the current app has its own generation action that already delegates there. ' +\n    \"IMPORTANT — handling the response: \" +\n    \"(a) If it contains a URL or ID, copy it VERBATIM into your reply. Do not 'correct' or pluralize the path (e.g. /deck/ → /decks/), normalize casing, or change the slug — any edit breaks the link. \" +\n    '(b) If it does NOT contain a URL/ID and the user asked for one, say so explicitly (e.g. \"the agent created the deck/image but didn\\'t return a link — open the app directly to view it\"). NEVER invent a URL, slug, or path — guessing produces broken links that look real. ' +\n    \"(c) If the downstream response reports missing credentials, never repeat raw env var names, Vault key names, token names, secret names, or other credential identifiers. Tell the user the target app needs its LLM/provider connection configured.\",\n  parameters: {\n    type: \"object\",\n    properties: {\n      agent: {\n        type: \"string\",\n        description:\n          \"Name or URL of a DIFFERENT deployed agent app (e.g. 'mail', 'calendar', 'analytics'). Must not be the current app's own name.\",\n      },\n      message: {\n        type: \"string\",\n        description: \"The message/question to send to the other agent\",\n      },\n    },\n    required: [\"agent\", \"message\"],\n  },\n};\n\nexport async function run(\n  args: Record<string, string>,\n  context?: ActionRunContext,\n  selfAppId?: string,\n): Promise<string> {\n  const { agent: agentIdOrName, message } = args;\n\n  if (!agentIdOrName) return \"Error: --agent is required\";\n  if (!message) return \"Error: --message is required\";\n\n  // Prevent self-calls — the agent must use its own registered tools instead\n  if (selfAppId && agentIdOrName.toLowerCase() === selfAppId.toLowerCase()) {\n    return `Error: You cannot use call-agent to call yourself (${selfAppId}). Use your own registered actions/tools instead. call-agent is only for communicating with OTHER separately-deployed apps.`;\n  }\n\n  const agent = await findAgent(agentIdOrName, selfAppId);\n  if (!agent) {\n    const available = (await discoverAgents(selfAppId))\n      .map((a) => a.name)\n      .join(\", \");\n    return `Error: Agent \"${agentIdOrName}\" not found. Available agents: ${available || \"(none)\"}`;\n  }\n\n  // Append a small cross-app hint to the outgoing message so the receiving\n  // agent (which may be on an older deploy without the receiver-side hint\n  // in handlers.ts) still emits fully-qualified URLs. This is belt-and-\n  // suspenders with the receiver hint — but it works against any current\n  // deployment, no redeploy required.\n  const messageWithHint =\n    `${message}\\n\\n` +\n    `[Note: this request comes from another app via A2A. The caller cannot see your local UI, deck list, or navigation — only the literal text you put in your reply. ` +\n    `If you create or reference a deck/document/design/dashboard, include its FULLY-QUALIFIED URL (e.g. ${agent.url}/deck/<id>) in your reply, not a relative path. ` +\n    `Use only artifact IDs and URL paths returned by successful actions — never invent slugs, IDs, or hosts.]`;\n\n  try {\n    // If we have a send context, use streaming so the UI shows progressive text\n    if (context?.send) {\n      const callerEmail = getRequestUserEmail();\n\n      // Build metadata with identity\n      const a2aMetadata: Record<string, unknown> = {};\n      if (callerEmail) a2aMetadata.userEmail = callerEmail;\n\n      // Include org domain for cross-app org resolution\n      let callerOrgDomain: string | undefined;\n      let callerOrgSecret: string | undefined;\n      const orgId = getRequestOrgId();\n      if (orgId) {\n        try {\n          const domain = await getOrgDomain(orgId);\n          if (domain) {\n            callerOrgDomain = domain;\n            a2aMetadata.orgDomain = domain;\n          }\n        } catch {}\n        try {\n          const secret = await getOrgA2ASecret(orgId);\n          if (secret) callerOrgSecret = secret;\n        } catch {}\n      }\n\n      // Sign JWT with identity + org domain for the streaming client\n      let apiKey: string | undefined;\n      if (callerEmail && (callerOrgSecret || process.env.A2A_SECRET)) {\n        try {\n          apiKey = await signA2AToken(\n            callerEmail,\n            callerOrgDomain,\n            callerOrgSecret,\n            {\n              expiresIn: INTEGRATION_A2A_TOKEN_TTL,\n              preferGlobalSecret: shouldPreferGlobalA2ASecret(callerOrgSecret),\n            },\n          );\n        } catch {}\n      }\n\n      if (process.env.NODE_ENV === \"production\" && callerEmail) {\n        try {\n          const { listOAuthAccountsByOwner } =\n            await import(\"../oauth-tokens/store.js\");\n          const accounts = await listOAuthAccountsByOwner(\n            \"google\",\n            callerEmail,\n          );\n          const tokens = accounts[0]?.tokens;\n          if (tokens?.access_token) {\n            a2aMetadata.googleToken = tokens.access_token;\n          }\n        } catch {}\n      }\n\n      let responseText = \"\";\n      let lastSentLength = 0;\n      const existingContinuationText =\n        await formatExistingIntegrationContinuationIfRetry(agent, message);\n      if (existingContinuationText) return existingContinuationText;\n\n      context.send({\n        type: \"agent_call\",\n        agent: agent.name,\n        status: \"start\",\n      });\n\n      const emitNewText = (newText: string) => {\n        if (newText.length > lastSentLength) {\n          context.send!({\n            type: \"agent_call_text\",\n            agent: agent.name,\n            text: newText.slice(lastSentLength),\n          });\n          lastSentLength = newText.length;\n        }\n        responseText = newText;\n      };\n\n      // Skip the SSE streaming attempt and go straight to async + poll.\n      // Why: on Netlify (Lambda), the receiving server has no streaming\n      // response support, so message/stream returns a single JSON-RPC error\n      // body in a 200 response that our SSE parser silently consumes — the\n      // `for await` loop yields nothing AND keeps the connection open until\n      // the function timeout, eating the current serverless budget. By the\n      // time we get to the sync fallback, Lambda is dead and the second fetch\n      // errors out as \"fetch failed\". Async+poll has its own short fetches\n      // with their own budgets, so it works reliably across hosts. The\n      // trade-off is we lose progressive in-UI text streaming for cross-app\n      // A2A calls, but the receiving agent's full response still surfaces via\n      // the tool_result event below.\n      try {\n        // Apply a polling cap ONLY for integration-platform callers on\n        // serverless hosts. Normal chat, local Node, self-hosted Node, and\n        // Docker can wait for slow-but-valid answers; integration processors\n        // still need to finish before their current function execution dies.\n        const callTimeoutMs = getIntegrationCallTimeoutMs();\n        responseText = await callAgent(agent.url, messageWithHint, {\n          apiKey,\n          userEmail: callerEmail,\n          orgDomain: callerOrgDomain,\n          orgSecret: callerOrgSecret,\n          ...(callTimeoutMs ? { timeoutMs: callTimeoutMs } : {}),\n        });\n        responseText =\n          formatDownstreamLlmCredentialFailure(agent.name, responseText) ??\n          responseText;\n        // Some agents reply with relative paths (e.g. slides emits\n        // \"/deck/abc\"). Those resolve against the caller's host, not the\n        // receiver's, so they're broken for the user. Expand any leading-slash\n        // URL into a fully-qualified one rooted at the receiving agent's host.\n        responseText = expandRelativeUrls(responseText, agent.url);\n        // Mirror the response into the streaming UI so the user sees it.\n        if (responseText) emitNewText(responseText);\n      } catch (pollErr: any) {\n        const timeoutTaskId = getA2ATaskTimeoutTaskId(pollErr);\n        if (timeoutTaskId) {\n          const queued = await enqueueIntegrationContinuationIfPossible(\n            timeoutTaskId,\n            agent,\n            message,\n            callerEmail,\n          );\n          if (queued) {\n            responseText =\n              `${A2A_CONTINUATION_QUEUED_MARKER}\\n` +\n              `The ${agent.name} agent accepted this delegated subtask and will post its own final result to the originating integration thread automatically. ` +\n              `Do not call ${agent.name} again for this same subtask. Continue any other requested work, then answer with the completed results you have; if needed, mention that ${agent.name} is posting its result separately.`;\n          } else {\n            const reason = pollErr?.message ?? \"unknown error\";\n            responseText = `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;\n          }\n        } else {\n          const reason = pollErr?.message ?? \"unknown error\";\n          responseText =\n            formatDownstreamLlmCredentialFailure(agent.name, pollErr) ??\n            `The ${agent.name} agent is taking longer than expected and didn't reply in time. (${reason})`;\n        }\n      }\n\n      context.send({\n        type: \"agent_call\",\n        agent: agent.name,\n        status: \"done\",\n      });\n\n      return responseText || \"(empty response)\";\n    }\n\n    // No context — use the async + poll call so we don't get cut off at the\n    // serverless gateway's ~30s timeout. callAgent defaults to async:true.\n    const email = getRequestUserEmail();\n    let domain: string | undefined;\n    let orgSecret: string | undefined;\n    const currentOrgId = getRequestOrgId();\n    if (currentOrgId) {\n      try {\n        domain = (await getOrgDomain(currentOrgId)) ?? undefined;\n      } catch {}\n      try {\n        orgSecret = (await getOrgA2ASecret(currentOrgId)) ?? undefined;\n      } catch {}\n    }\n    const response = await callAgent(agent.url, messageWithHint, {\n      userEmail: email,\n      orgDomain: domain,\n      orgSecret,\n    });\n    const sanitized =\n      formatDownstreamLlmCredentialFailure(agent.name, response) ?? response;\n    return expandRelativeUrls(sanitized, agent.url) || \"(empty response)\";\n  } catch (err: any) {\n    const msg = err?.message ?? String(err);\n    const credentialMessage = formatDownstreamLlmCredentialFailure(\n      agent.name,\n      err,\n    );\n    if (credentialMessage) return credentialMessage;\n    // Friendlier message for the common timeout case so the calling agent can\n    // decide whether to give up or retry.\n    if (/timeout|did not complete|Inactivity|504/i.test(msg)) {\n      return `The ${agent.name} agent is taking longer than expected. Please try again, ask a simpler question, or open the ${agent.name} app directly.`;\n    }\n    return `Error calling ${agent.name}: ${msg}`;\n  }\n}\n\nasync function enqueueIntegrationContinuationIfPossible(\n  taskId: string,\n  agent: { name: string; url: string },\n  message: string,\n  ownerEmail: string | undefined,\n): Promise<boolean> {\n  const integration = getIntegrationRequestContext();\n  if (!integration || !ownerEmail) return false;\n\n  try {\n    const [{ insertA2AContinuation }, { dispatchA2AContinuation }] =\n      await Promise.all([\n        import(\"../integrations/a2a-continuations-store.js\"),\n        import(\"../integrations/a2a-continuation-processor.js\"),\n      ]);\n    const continuation = await insertA2AContinuation({\n      integrationTaskId: integration.taskId,\n      platform: integration.incoming.platform,\n      externalThreadId: integration.incoming.externalThreadId,\n      incoming: integration.incoming,\n      placeholderRef: integration.placeholderRef,\n      ownerEmail,\n      orgId: getRequestOrgId() ?? null,\n      agentName: agent.name,\n      agentUrl: agent.url,\n      dedupeKey: getIntegrationContinuationDedupeKey(message),\n      a2aTaskId: taskId,\n      // Do not persist the short-lived JWT used for the initial send. The\n      // continuation processor can mint a fresh token for each poll.\n      a2aAuthToken: null,\n    });\n    await dispatchA2AContinuation(continuation.id).catch((err) => {\n      console.error(\n        `[call-agent] Failed to dispatch A2A continuation ${continuation.id}:`,\n        err,\n      );\n    });\n    return true;\n  } catch (err) {\n    console.error(\"[call-agent] Failed to enqueue A2A continuation:\", err);\n    return false;\n  }\n}\n\nfunction getA2ATaskTimeoutTaskId(err: unknown): string | null {\n  if (err instanceof A2ATaskTimeoutError) return err.taskId;\n\n  const candidate = err as\n    | { name?: unknown; taskId?: unknown; message?: unknown }\n    | null\n    | undefined;\n  const message = String(candidate?.message ?? \"\");\n  if (\n    candidate?.name === \"A2ATaskTimeoutError\" &&\n    typeof candidate.taskId === \"string\"\n  ) {\n    return candidate.taskId;\n  }\n\n  const match = message.match(/^A2A task ([^\\s]+) did not complete\\b/);\n  return match?.[1] ?? null;\n}\n\nasync function formatExistingIntegrationContinuationIfRetry(\n  agent: {\n    name: string;\n    url: string;\n  },\n  message: string,\n): Promise<string | null> {\n  const integration = getIntegrationRequestContext();\n  if (!integration || (integration.attempts ?? 1) <= 1) return null;\n\n  try {\n    const { getA2AContinuationsForIntegrationTaskAgent } =\n      await import(\"../integrations/a2a-continuations-store.js\");\n    const continuations = await getA2AContinuationsForIntegrationTaskAgent(\n      integration.taskId,\n      agent.url,\n      getIntegrationContinuationDedupeKey(message),\n    );\n    const active = continuations.find((continuation) =>\n      [\"pending\", \"processing\", \"delivering\", \"completed\"].includes(\n        continuation.status,\n      ),\n    );\n    if (!active) return null;\n\n    const state =\n      active.status === \"completed\"\n        ? \"already completed this delegated subtask and posted its result to the originating integration thread\"\n        : \"already accepted this delegated subtask and is still working on it for the originating integration thread\";\n    return (\n      `${A2A_CONTINUATION_QUEUED_MARKER}\\n` +\n      `The ${agent.name} agent ${state}. Do not call ${agent.name} again for this same subtask. Continue any other requested work, then answer with the completed results you have; if needed, mention that ${agent.name} is posting or has posted its result separately.`\n    );\n  } catch (err) {\n    console.error(\"[call-agent] Failed to inspect existing continuation:\", err);\n    return null;\n  }\n}\n\nfunction getIntegrationContinuationDedupeKey(message: string): string {\n  const normalized = message.trim().replace(/\\s+/g, \" \");\n  return createHash(\"sha256\").update(normalized).digest(\"hex\");\n}\n\n// Expand bare leading-slash paths (e.g. \"/deck/abc\") into fully-qualified URLs\n// rooted at the receiving agent's host. The receiver doesn't always know it's\n// being called cross-app, so it may emit relative paths that resolve against\n// the caller's host (broken). Match a path that starts at a word boundary,\n// begins with `/`, and has at least one path segment after that. Skip if it\n// already looks like a fully-qualified URL.\nexport function expandRelativeUrls(text: string, agentUrl: string): string {\n  if (!text || !agentUrl) return text;\n  const base = agentUrl.replace(/\\/$/, \"\");\n  // Path must start at boundary (start, whitespace, or punctuation that isn't\n  // ':' — to avoid mangling `https://example.com/foo` or markdown link bodies).\n  return text.replace(\n    /(^|[\\s([<\"'`])(\\/[a-z0-9_-][a-z0-9_/?&=%#.,:-]*)/gi,\n    (_match, lead, path) => `${lead}${base}${path}`,\n  );\n}\n"]}

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,11 +27,11 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};
 //# sourceMappingURL=agent-engine-api-key-route.d.ts.map

package/dist/server/analytics.d.ts

@@ -20,5 +20,21 @@
  * return new Response(wrapWithAnalytics(body), { ... });
  * ```
  */
+/**
+ * Script hosts the injected GA loader pulls executable code from. Google Tag
+ * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from
+ * `www.google-analytics.com`. These must be listed in the document `script-src`
+ * so the CSP reflects the code the framework itself injects (see
+ * `applyDocumentCsp` in `ssr-handler.ts`).
+ */
+export declare const GA_CSP_SCRIPT_HOSTS: readonly ["https://www.googletagmanager.com", "https://www.google-analytics.com"];
+/**
+ * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
+ * block injected next to the gtag.js loader. Returned so the SSR handler can
+ * hash it for the `script-src` CSP directive — the hash must be computed from
+ * the identical string that `getGaScript()` embeds, so both call this helper.
+ * Returns `null` when GA is not configured.
+ */
+export declare function getGaInlineConfigScriptBody(): string | null;
 export declare function wrapWithAnalytics(body: ReadableStream): ReadableStream;
 //# sourceMappingURL=analytics.d.ts.map

package/dist/server/analytics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAwCH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CA4BtE"}
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAoBH;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,YAC9B,kCAAkC,EAClC,kCAAkC,CAC1B,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CAc3D;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CA4BtE"}

package/dist/server/analytics.js

@@ -30,23 +30,46 @@ function getGaMeasurementId() {
             ? __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__
             : undefined));
 }
-function getGaScript() {
+/**
+ * Script hosts the injected GA loader pulls executable code from. Google Tag
+ * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from
+ * `www.google-analytics.com`. These must be listed in the document `script-src`
+ * so the CSP reflects the code the framework itself injects (see
+ * `applyDocumentCsp` in `ssr-handler.ts`).
+ */
+export const GA_CSP_SCRIPT_HOSTS = [
+    "https://www.googletagmanager.com",
+    "https://www.google-analytics.com",
+];
+/**
+ * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
+ * block injected next to the gtag.js loader. Returned so the SSR handler can
+ * hash it for the `script-src` CSP directive — the hash must be computed from
+ * the identical string that `getGaScript()` embeds, so both call this helper.
+ * Returns `null` when GA is not configured.
+ */
+export function getGaInlineConfigScriptBody() {
     const id = getGaMeasurementId();
     if (!id)
         return null;
-    const srcId = encodeURIComponent(id);
     const jsId = JSON.stringify(id);
-    return (`<script async src="https://www.googletagmanager.com/gtag/js?id=${srcId}"></script>` +
-        `<script>` +
-        `window.dataLayer=window.dataLayer||[];` +
+    return (`window.dataLayer=window.dataLayer||[];` +
         `function gtag(){dataLayer.push(arguments);}` +
         `gtag('js',new Date());` +
         `gtag('config',${jsId});` +
         `if(typeof sessionStorage!=='undefined'&&sessionStorage.getItem('__an_signin')){` +
         `sessionStorage.removeItem('__an_signin');` +
         `gtag('event','sign_in');` +
-        `}` +
-        `</script>`);
+        `}`);
+}
+function getGaScript() {
+    const id = getGaMeasurementId();
+    if (!id)
+        return null;
+    const srcId = encodeURIComponent(id);
+    const inlineBody = getGaInlineConfigScriptBody();
+    return (`<script async src="https://www.googletagmanager.com/gtag/js?id=${srcId}"></script>` +
+        `<script>${inlineBody}</script>`);
 }
 export function wrapWithAnalytics(body) {
     const scripts = [getGaScript()].filter(Boolean).join("");