@agent-native/core 0.86.1 → 0.87.0

package/dist/secrets/crypto.js

@@ -15,16 +15,47 @@
  * Encrypted values are tagged `v1:<iv-hex>:<ct-hex>:<tag-hex>`. The `v1:` prefix
  * lets readers distinguish ciphertext from legacy plaintext during migration.
  */
-import { randomBytes, createCipheriv, createDecipheriv, createHash, } from "node:crypto";
+function getNodeCrypto() {
+    if (typeof window !== "undefined" ||
+        typeof process === "undefined" ||
+        !process.versions?.node ||
+        typeof process.getBuiltinModule !== "function") {
+        return undefined;
+    }
+    return process.getBuiltinModule("node:crypto");
+}
+const nodeCrypto = getNodeCrypto();
 let _warnedFallback = false;
+function requireNodeCrypto() {
+    if (!nodeCrypto) {
+        throw new Error("[agent-native/secrets] Secret encryption is only available in server/runtime code.");
+    }
+    return nodeCrypto;
+}
+function processNodeEnv() {
+    if (typeof process === "undefined")
+        return undefined;
+    return process.env.NODE_ENV;
+}
+function processCwd() {
+    if (typeof process === "undefined")
+        return ".";
+    return process.cwd();
+}
 /**
  * Derive a 32-byte AES key from the configured secret material via SHA-256.
  * Re-derived per call (cheap, stateless, and makes rotation easy).
  */
 export function getSecretEncryptionKey() {
-    const explicit = process.env.SECRETS_ENCRYPTION_KEY || process.env.BETTER_AUTH_SECRET;
+    const { createHash } = requireNodeCrypto();
+    const explicit = (typeof process === "undefined"
+        ? undefined
+        : process.env.SECRETS_ENCRYPTION_KEY) ||
+        (typeof process === "undefined"
+            ? undefined
+            : process.env.BETTER_AUTH_SECRET);
     if (!explicit) {
-        if (process.env.NODE_ENV === "production") {
+        if (processNodeEnv() === "production") {
             throw new Error("[agent-native/secrets] Refusing to start in production without an encryption key. " +
                 "Set SECRETS_ENCRYPTION_KEY (preferred) or BETTER_AUTH_SECRET in the deploy environment. " +
                 "The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), " +
@@ -38,11 +69,12 @@ export function getSecretEncryptionKey() {
                 "Production deploys without one of these env vars now hard-fail.");
         }
     }
-    const material = explicit || `agent-native-secrets:${process.cwd()}`;
+    const material = explicit || `agent-native-secrets:${processCwd()}`;
     return createHash("sha256").update(material).digest();
 }
 /** Encrypt a plain-text value. Returns `v1:<iv-hex>:<ct-hex>:<tag-hex>`. */
 export function encryptSecretValue(plaintext) {
+    const { createCipheriv, randomBytes } = requireNodeCrypto();
     const key = getSecretEncryptionKey();
     const iv = randomBytes(12);
     const cipher = createCipheriv("aes-256-gcm", key, iv);
@@ -52,6 +84,7 @@ export function encryptSecretValue(plaintext) {
 }
 /** Decrypt a value produced by `encryptSecretValue`. Throws on tampering. */
 export function decryptSecretValue(encrypted) {
+    const { createDecipheriv } = requireNodeCrypto();
     if (!encrypted.startsWith("v1:")) {
         throw new Error("Unrecognised secret encoding");
     }

package/dist/secrets/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/secrets/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,QAAQ,GACZ,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAEvE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,oFAAoF;gBAClF,0FAA0F;gBAC1F,yFAAyF;gBACzF,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,IAAI,CAAC;YACvB,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,0FAA0F;gBACxF,qEAAqE;gBACrE,iEAAiE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,wBAAwB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;IACrE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAC1B,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AAEhE,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC","sourcesContent":["/**\n * Shared AES-256-GCM encryption for secret values at rest.\n *\n * Used by both the framework secrets vault (`app_secrets`) and per-user/per-org\n * credentials (`resolveCredential` / `saveCredential`, stored in `settings`) so\n * there is a single crypto implementation and a single key story.\n *\n * The encryption key is derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the\n * existing `BETTER_AUTH_SECRET` env var (fallback so templates don't need a\n * second secret during development). In production we refuse to start without\n * one of them — a CWD-derived fallback would be effectively static (e.g.\n * `/var/task` on Lambda), so anyone with read access to the DB could decrypt\n * every secret.\n *\n * Encrypted values are tagged `v1:<iv-hex>:<ct-hex>:<tag-hex>`. The `v1:` prefix\n * lets readers distinguish ciphertext from legacy plaintext during migration.\n */\n\nimport {\n  randomBytes,\n  createCipheriv,\n  createDecipheriv,\n  createHash,\n} from \"node:crypto\";\n\nlet _warnedFallback = false;\n\n/**\n * Derive a 32-byte AES key from the configured secret material via SHA-256.\n * Re-derived per call (cheap, stateless, and makes rotation easy).\n */\nexport function getSecretEncryptionKey(): Buffer {\n  const explicit =\n    process.env.SECRETS_ENCRYPTION_KEY || process.env.BETTER_AUTH_SECRET;\n\n  if (!explicit) {\n    if (process.env.NODE_ENV === \"production\") {\n      throw new Error(\n        \"[agent-native/secrets] Refusing to start in production without an encryption key. \" +\n          \"Set SECRETS_ENCRYPTION_KEY (preferred) or BETTER_AUTH_SECRET in the deploy environment. \" +\n          \"The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), \" +\n          \"which means anyone with read access to the secrets table could decrypt every user's secrets.\",\n      );\n    }\n    if (!_warnedFallback) {\n      _warnedFallback = true;\n      // eslint-disable-next-line no-console\n      console.warn(\n        \"[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. \" +\n          \"Set SECRETS_ENCRYPTION_KEY (or BETTER_AUTH_SECRET) for production. \" +\n          \"Production deploys without one of these env vars now hard-fail.\",\n      );\n    }\n  }\n\n  const material = explicit || `agent-native-secrets:${process.cwd()}`;\n  return createHash(\"sha256\").update(material).digest();\n}\n\n/** Encrypt a plain-text value. Returns `v1:<iv-hex>:<ct-hex>:<tag-hex>`. */\nexport function encryptSecretValue(plaintext: string): string {\n  const key = getSecretEncryptionKey();\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n  const ct = Buffer.concat([cipher.update(plaintext, \"utf8\"), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return `v1:${iv.toString(\"hex\")}:${ct.toString(\"hex\")}:${tag.toString(\"hex\")}`;\n}\n\n/** Decrypt a value produced by `encryptSecretValue`. Throws on tampering. */\nexport function decryptSecretValue(encrypted: string): string {\n  if (!encrypted.startsWith(\"v1:\")) {\n    throw new Error(\"Unrecognised secret encoding\");\n  }\n  const [, ivHex, ctHex, tagHex] = encrypted.split(\":\");\n  if (!ivHex || !ctHex || !tagHex) {\n    throw new Error(\"Corrupt secret payload\");\n  }\n  const key = getSecretEncryptionKey();\n  const decipher = createDecipheriv(\n    \"aes-256-gcm\",\n    key,\n    Buffer.from(ivHex, \"hex\"),\n  );\n  decipher.setAuthTag(Buffer.from(tagHex, \"hex\"));\n  const pt = Buffer.concat([\n    decipher.update(Buffer.from(ctHex, \"hex\")),\n    decipher.final(),\n  ]);\n  return pt.toString(\"utf8\");\n}\n\n/**\n * Strict check for a value produced by `encryptSecretValue`: `v1:` followed by\n * three hex segments. Intentionally strict so a legacy plaintext credential\n * that merely happens to start with `v1:` is treated as plaintext (and read via\n * the legacy fallback) rather than mis-decrypted.\n */\nconst ENCRYPTED_VALUE_RE = /^v1:[0-9a-f]+:[0-9a-f]+:[0-9a-f]+$/;\n\nexport function isEncryptedSecretValue(value: unknown): value is string {\n  return typeof value === \"string\" && ENCRYPTED_VALUE_RE.test(value);\n}\n"]}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/secrets/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,SAAS,aAAa;IACpB,IACE,OAAO,MAAM,KAAK,WAAW;QAC7B,OAAO,OAAO,KAAK,WAAW;QAC9B,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI;QACvB,OAAO,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAEhC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;AAEnC,IAAI,eAAe,GAAG,KAAK,CAAC;AAE5B,SAAS,iBAAiB;IACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,oFAAoF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,GAAG,CAAC;IAC/C,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAC3C,MAAM,QAAQ,GACZ,CAAC,OAAO,OAAO,KAAK,WAAW;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;QACvC,CAAC,OAAO,OAAO,KAAK,WAAW;YAC7B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAEtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,cAAc,EAAE,KAAK,YAAY,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,oFAAoF;gBAClF,0FAA0F;gBAC1F,yFAAyF;gBACzF,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,eAAe,GAAG,IAAI,CAAC;YACvB,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,0FAA0F;gBACxF,qEAAqE;gBACrE,iEAAiE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,wBAAwB,UAAU,EAAE,EAAE,CAAC;IACpE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;IACrC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,EAAE,gBAAgB,EAAE,GAAG,iBAAiB,EAAE,CAAC;IACjD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAC1B,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AAEhE,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC","sourcesContent":["/**\n * Shared AES-256-GCM encryption for secret values at rest.\n *\n * Used by both the framework secrets vault (`app_secrets`) and per-user/per-org\n * credentials (`resolveCredential` / `saveCredential`, stored in `settings`) so\n * there is a single crypto implementation and a single key story.\n *\n * The encryption key is derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the\n * existing `BETTER_AUTH_SECRET` env var (fallback so templates don't need a\n * second secret during development). In production we refuse to start without\n * one of them — a CWD-derived fallback would be effectively static (e.g.\n * `/var/task` on Lambda), so anyone with read access to the DB could decrypt\n * every secret.\n *\n * Encrypted values are tagged `v1:<iv-hex>:<ct-hex>:<tag-hex>`. The `v1:` prefix\n * lets readers distinguish ciphertext from legacy plaintext during migration.\n */\n\ntype NodeCryptoModule = typeof import(\"node:crypto\");\n\nfunction getNodeCrypto(): NodeCryptoModule | undefined {\n  if (\n    typeof window !== \"undefined\" ||\n    typeof process === \"undefined\" ||\n    !process.versions?.node ||\n    typeof process.getBuiltinModule !== \"function\"\n  ) {\n    return undefined;\n  }\n  return process.getBuiltinModule(\"node:crypto\") as\n    | NodeCryptoModule\n    | undefined;\n}\n\nconst nodeCrypto = getNodeCrypto();\n\nlet _warnedFallback = false;\n\nfunction requireNodeCrypto(): NonNullable<typeof nodeCrypto> {\n  if (!nodeCrypto) {\n    throw new Error(\n      \"[agent-native/secrets] Secret encryption is only available in server/runtime code.\",\n    );\n  }\n  return nodeCrypto;\n}\n\nfunction processNodeEnv(): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  return process.env.NODE_ENV;\n}\n\nfunction processCwd(): string {\n  if (typeof process === \"undefined\") return \".\";\n  return process.cwd();\n}\n\n/**\n * Derive a 32-byte AES key from the configured secret material via SHA-256.\n * Re-derived per call (cheap, stateless, and makes rotation easy).\n */\nexport function getSecretEncryptionKey(): Buffer {\n  const { createHash } = requireNodeCrypto();\n  const explicit =\n    (typeof process === \"undefined\"\n      ? undefined\n      : process.env.SECRETS_ENCRYPTION_KEY) ||\n    (typeof process === \"undefined\"\n      ? undefined\n      : process.env.BETTER_AUTH_SECRET);\n\n  if (!explicit) {\n    if (processNodeEnv() === \"production\") {\n      throw new Error(\n        \"[agent-native/secrets] Refusing to start in production without an encryption key. \" +\n          \"Set SECRETS_ENCRYPTION_KEY (preferred) or BETTER_AUTH_SECRET in the deploy environment. \" +\n          \"The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), \" +\n          \"which means anyone with read access to the secrets table could decrypt every user's secrets.\",\n      );\n    }\n    if (!_warnedFallback) {\n      _warnedFallback = true;\n      // eslint-disable-next-line no-console\n      console.warn(\n        \"[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. \" +\n          \"Set SECRETS_ENCRYPTION_KEY (or BETTER_AUTH_SECRET) for production. \" +\n          \"Production deploys without one of these env vars now hard-fail.\",\n      );\n    }\n  }\n\n  const material = explicit || `agent-native-secrets:${processCwd()}`;\n  return createHash(\"sha256\").update(material).digest();\n}\n\n/** Encrypt a plain-text value. Returns `v1:<iv-hex>:<ct-hex>:<tag-hex>`. */\nexport function encryptSecretValue(plaintext: string): string {\n  const { createCipheriv, randomBytes } = requireNodeCrypto();\n  const key = getSecretEncryptionKey();\n  const iv = randomBytes(12);\n  const cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n  const ct = Buffer.concat([cipher.update(plaintext, \"utf8\"), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return `v1:${iv.toString(\"hex\")}:${ct.toString(\"hex\")}:${tag.toString(\"hex\")}`;\n}\n\n/** Decrypt a value produced by `encryptSecretValue`. Throws on tampering. */\nexport function decryptSecretValue(encrypted: string): string {\n  const { createDecipheriv } = requireNodeCrypto();\n  if (!encrypted.startsWith(\"v1:\")) {\n    throw new Error(\"Unrecognised secret encoding\");\n  }\n  const [, ivHex, ctHex, tagHex] = encrypted.split(\":\");\n  if (!ivHex || !ctHex || !tagHex) {\n    throw new Error(\"Corrupt secret payload\");\n  }\n  const key = getSecretEncryptionKey();\n  const decipher = createDecipheriv(\n    \"aes-256-gcm\",\n    key,\n    Buffer.from(ivHex, \"hex\"),\n  );\n  decipher.setAuthTag(Buffer.from(tagHex, \"hex\"));\n  const pt = Buffer.concat([\n    decipher.update(Buffer.from(ctHex, \"hex\")),\n    decipher.final(),\n  ]);\n  return pt.toString(\"utf8\");\n}\n\n/**\n * Strict check for a value produced by `encryptSecretValue`: `v1:` followed by\n * three hex segments. Intentionally strict so a legacy plaintext credential\n * that merely happens to start with `v1:` is treated as plaintext (and read via\n * the legacy fallback) rather than mis-decrypted.\n */\nconst ENCRYPTED_VALUE_RE = /^v1:[0-9a-f]+:[0-9a-f]+:[0-9a-f]+$/;\n\nexport function isEncryptedSecretValue(value: unknown): value is string {\n  return typeof value === \"string\" && ENCRYPTED_VALUE_RE.test(value);\n}\n"]}

package/dist/server/agent-access.d.ts

@@ -0,0 +1,16 @@
+import { type AgentAccessResourceScope } from "../shared/agent-access.js";
+import { type VerifyResult } from "./short-lived-token.js";
+export { AGENT_ACCESS_PARAM, DEFAULT_AGENT_ACCESS_TTL_SECONDS, appendAgentAccessParam, buildAgentAccessApiUrl, buildAgentAccessUrl, normalizeAgentAccessBasePath, normalizeAgentAccessOrigin, scopedAgentAccessResourceId, toAgentAccessUrl, type AgentAccessApiUrlOptions, type AgentAccessResourceScope, type AgentAccessUrlOptions, } from "../shared/agent-access.js";
+export interface ScopedAgentAccessTokenOptions extends AgentAccessResourceScope {
+    viewerEmail?: string;
+    ttlSeconds?: number;
+}
+export interface ScopedAgentAccessGrant {
+    token: string;
+    expiresAt: string;
+    ttlSeconds: number;
+}
+export declare function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEmail, ttlSeconds, }: ScopedAgentAccessTokenOptions): string;
+export declare function verifyScopedAgentAccessToken(token: string, scope: AgentAccessResourceScope): VerifyResult;
+export declare function createScopedAgentAccessGrant(options: ScopedAgentAccessTokenOptions): ScopedAgentAccessGrant;
+//# sourceMappingURL=agent-access.d.ts.map

package/dist/server/agent-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access.d.ts","sourceRoot":"","sources":["../../src/server/agent-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,EAChB,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,6BAA8B,SAAQ,wBAAwB;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,0BAA0B,CAAC,EACzC,YAAY,EACZ,UAAU,EACV,WAAW,EACX,UAA6C,GAC9C,EAAE,6BAA6B,GAAG,MAAM,CAMxC;AAED,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,wBAAwB,GAC9B,YAAY,CAMd;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,6BAA6B,GACrC,sBAAsB,CAQxB"}

package/dist/server/agent-access.js

@@ -0,0 +1,25 @@
+import { DEFAULT_AGENT_ACCESS_TTL_SECONDS, scopedAgentAccessResourceId, } from "../shared/agent-access.js";
+import { signShortLivedToken, verifyShortLivedToken, } from "./short-lived-token.js";
+export { AGENT_ACCESS_PARAM, DEFAULT_AGENT_ACCESS_TTL_SECONDS, appendAgentAccessParam, buildAgentAccessApiUrl, buildAgentAccessUrl, normalizeAgentAccessBasePath, normalizeAgentAccessOrigin, scopedAgentAccessResourceId, toAgentAccessUrl, } from "../shared/agent-access.js";
+export function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEmail, ttlSeconds = DEFAULT_AGENT_ACCESS_TTL_SECONDS, }) {
+    return signShortLivedToken({
+        resourceId: scopedAgentAccessResourceId(resourceKind, resourceId),
+        viewerEmail,
+        ttlSeconds,
+    });
+}
+export function verifyScopedAgentAccessToken(token, scope) {
+    if (!token)
+        return { ok: false, reason: "missing" };
+    return verifyShortLivedToken(token, scopedAgentAccessResourceId(scope.resourceKind, scope.resourceId));
+}
+export function createScopedAgentAccessGrant(options) {
+    const ttlSeconds = options.ttlSeconds ?? DEFAULT_AGENT_ACCESS_TTL_SECONDS;
+    const token = signScopedAgentAccessToken({ ...options, ttlSeconds });
+    return {
+        token,
+        expiresAt: new Date(Date.now() + ttlSeconds * 1000).toISOString(),
+        ttlSeconds,
+    };
+}
+//# sourceMappingURL=agent-access.js.map

package/dist/server/agent-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access.js","sourceRoot":"","sources":["../../src/server/agent-access.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gCAAgC,EAChC,2BAA2B,GAE5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,gBAAgB,GAIjB,MAAM,2BAA2B,CAAC;AAanC,MAAM,UAAU,0BAA0B,CAAC,EACzC,YAAY,EACZ,UAAU,EACV,WAAW,EACX,UAAU,GAAG,gCAAgC,GACf;IAC9B,OAAO,mBAAmB,CAAC;QACzB,UAAU,EAAE,2BAA2B,CAAC,YAAY,EAAE,UAAU,CAAC;QACjE,WAAW;QACX,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,KAAa,EACb,KAA+B;IAE/B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpD,OAAO,qBAAqB,CAC1B,KAAK,EACL,2BAA2B,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAAsC;IAEtC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,gCAAgC,CAAC;IAC1E,MAAM,KAAK,GAAG,0BAA0B,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,OAAO;QACL,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QACjE,UAAU;KACX,CAAC;AACJ,CAAC","sourcesContent":["import {\n  DEFAULT_AGENT_ACCESS_TTL_SECONDS,\n  scopedAgentAccessResourceId,\n  type AgentAccessResourceScope,\n} from \"../shared/agent-access.js\";\nimport {\n  signShortLivedToken,\n  verifyShortLivedToken,\n  type VerifyResult,\n} from \"./short-lived-token.js\";\n\nexport {\n  AGENT_ACCESS_PARAM,\n  DEFAULT_AGENT_ACCESS_TTL_SECONDS,\n  appendAgentAccessParam,\n  buildAgentAccessApiUrl,\n  buildAgentAccessUrl,\n  normalizeAgentAccessBasePath,\n  normalizeAgentAccessOrigin,\n  scopedAgentAccessResourceId,\n  toAgentAccessUrl,\n  type AgentAccessApiUrlOptions,\n  type AgentAccessResourceScope,\n  type AgentAccessUrlOptions,\n} from \"../shared/agent-access.js\";\n\nexport interface ScopedAgentAccessTokenOptions extends AgentAccessResourceScope {\n  viewerEmail?: string;\n  ttlSeconds?: number;\n}\n\nexport interface ScopedAgentAccessGrant {\n  token: string;\n  expiresAt: string;\n  ttlSeconds: number;\n}\n\nexport function signScopedAgentAccessToken({\n  resourceKind,\n  resourceId,\n  viewerEmail,\n  ttlSeconds = DEFAULT_AGENT_ACCESS_TTL_SECONDS,\n}: ScopedAgentAccessTokenOptions): string {\n  return signShortLivedToken({\n    resourceId: scopedAgentAccessResourceId(resourceKind, resourceId),\n    viewerEmail,\n    ttlSeconds,\n  });\n}\n\nexport function verifyScopedAgentAccessToken(\n  token: string,\n  scope: AgentAccessResourceScope,\n): VerifyResult {\n  if (!token) return { ok: false, reason: \"missing\" };\n  return verifyShortLivedToken(\n    token,\n    scopedAgentAccessResourceId(scope.resourceKind, scope.resourceId),\n  );\n}\n\nexport function createScopedAgentAccessGrant(\n  options: ScopedAgentAccessTokenOptions,\n): ScopedAgentAccessGrant {\n  const ttlSeconds = options.ttlSeconds ?? DEFAULT_AGENT_ACCESS_TTL_SECONDS;\n  const token = signScopedAgentAccessToken({ ...options, ttlSeconds });\n  return {\n    token,\n    expiresAt: new Date(Date.now() + ttlSeconds * 1000).toISOString(),\n    ttlSeconds,\n  };\n}\n"]}

package/dist/server/h3-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"h3-helpers.d.ts","sourceRoot":"","sources":["../../src/server/h3-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAmB1C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAElC;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,QAAmB,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,UAaxC,CAAC;AAWF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAElE;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,GAAG,EACjD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAoC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAwCZ;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc,CAE7D"}
+{"version":3,"file":"h3-helpers.d.ts","sourceRoot":"","sources":["../../src/server/h3-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAkB1C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAElC;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,QAAmB,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,UAaxC,CAAC;AAWF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAElE;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,GAAG,EACjD,KAAK,EAAE,OAAO,EACd,QAAQ,GAAE,MAAoC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAwCZ;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc,CAe7D"}

package/dist/server/h3-helpers.js

@@ -1,4 +1,3 @@
-import { Readable } from "node:stream";
 /**
  * Small helpers around h3 v2 that polish ergonomics for templates.
  *
@@ -135,6 +134,17 @@ export async function readBodyWithSizeLimit(event, maxBytes = DEFAULT_CHAT_MAX_B
  *   return streamFile(fs.createReadStream(filePath));
  */
 export function streamFile(stream) {
-    return Readable.toWeb(stream);
+    return new ReadableStream({
+        start(controller) {
+            stream.on("data", (chunk) => {
+                controller.enqueue(typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk);
+            });
+            stream.on("end", () => controller.close());
+            stream.on("error", (error) => controller.error(error));
+        },
+        cancel() {
+            stream.destroy();
+        },
+    });
 }
 //# sourceMappingURL=h3-helpers.js.map

package/dist/server/h3-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"h3-helpers.js","sourceRoot":"","sources":["../../src/server/h3-helpers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,IAAI,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAGzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,0BAA0B;IAC1B,+CAA+C;IAC/C,oBAAoB;CACrB,CAAC;AAEF,oEAAoE;AACpE,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,0BAA0B;IAC1B,0BAA0B;IAC1B,kBAAkB;IAClB,mBAAmB;IACnB,6BAA6B;CAC9B,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAClD,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAU,KAAc;IACpD,OAAO,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAM,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAc,EACd,QAAQ,GAAW,2BAA2B;IAE9C,6DAA6D;IAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,+BAA+B,QAAQ,SAAS,CAAC,EAC3D;gBACE,UAAU,EAAE,GAAG;aAChB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpC,4EAA4E;IAC5E,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,WAAmB,CAAC;QACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW,GAAG,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,WAAW,GAAG,QAAQ,EAAE,CAAC;YAC3B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,+BAA+B,QAAQ,SAAS,CAAC,EAC3D,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,IAAI,EAAE,CAAM,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAmB,CAAC;AAClD,CAAC","sourcesContent":["import type { ReadStream } from \"node:fs\";\nimport { Readable } from \"node:stream\";\n\n/**\n * Small helpers around h3 v2 that polish ergonomics for templates.\n *\n * `readBody` — wraps h3's `readBody` so the result is typed `any` by default\n * (h3 v2 infers `unknown`, which forces `as` casts at every call site).\n *\n * `readBodyWithSizeLimit` — like `readBody` but rejects with a 413 response\n * when the `content-length` header (or the buffered body size) exceeds the\n * given threshold. Use this on any route whose payload can include inline\n * base64 attachments (chat POST, upload routes).\n *\n * `streamFile` — converts a Node `ReadStream` to a web `ReadableStream` so\n * route handlers can return file content without importing `node:stream`\n * inline. h3 v2 expects web streams everywhere.\n */\nimport { readBody as _readBody, getHeader, setResponseStatus } from \"h3\";\nimport type { H3Event } from \"h3\";\n\n/**\n * Default maximum chat-POST body size (25 MB uncompressed). The agent chat\n * body carries base64-encoded attachments so a 25 MB cap is generous while\n * still protecting against runaway payloads. Override per-route by passing a\n * different `maxBytes` value to `readBodyWithSizeLimit`.\n */\nexport const DEFAULT_CHAT_MAX_BODY_BYTES = 25 * 1024 * 1024;\n\n/**\n * Maximum file size for upload routes (25 MB). Mirrors Whisper's hard limit\n * so audio, image, and document uploads share a consistent ceiling.\n */\nexport const DEFAULT_UPLOAD_MAX_FILE_BYTES = 25 * 1024 * 1024;\n\n/**\n * Maximum number of attachments per chat message. Guards against pathological\n * requests that would fan out into hundreds of parallel model content-parts.\n */\nexport const MAX_CHAT_ATTACHMENTS_PER_MESSAGE = 20;\n\n/**\n * MIME types allowed on the file-upload routes. Executables and scripts are\n * explicitly excluded; everything else is allowed at the default tier.\n * Pass `allowedMimeTypes` to `assertAllowedMimeType` to enforce on a route.\n */\nexport const UPLOAD_ALLOWED_MIME_PREFIXES = [\n  \"image/\",\n  \"video/\",\n  \"audio/\",\n  \"text/\",\n  \"application/pdf\",\n  \"application/json\",\n  \"application/zip\",\n  \"application/gzip\",\n  \"application/x-tar\",\n  \"application/vnd.ms-excel\",\n  \"application/vnd.openxmlformats-officedocument\",\n  \"application/msword\",\n];\n\n/** Mime types that are always rejected even if a prefix matches. */\nconst UPLOAD_BLOCKED_MIME_TYPES = new Set([\n  \"application/x-msdownload\",\n  \"application/x-executable\",\n  \"application/x-sh\",\n  \"application/x-bat\",\n  \"application/x-msdos-program\",\n]);\n\n/**\n * Returns true when the given MIME type is acceptable for uploads.\n * Blocks executables and scripts; allows everything else in the allow-prefix list.\n */\nexport function isAllowedUploadMimeType(mimeType: string): boolean {\n  const lower = (mimeType || \"\").toLowerCase().split(\";\")[0].trim();\n  if (UPLOAD_BLOCKED_MIME_TYPES.has(lower)) return false;\n  return UPLOAD_ALLOWED_MIME_PREFIXES.some((prefix) =>\n    lower.startsWith(prefix),\n  );\n}\n\n/**\n * Parse a JSON request body. Returns `{}` if the body is empty or absent\n * so callers don't have to null-check before destructuring.\n *\n * Defaults T to `any` for ergonomic field access. Pass an explicit type\n * argument when you want a typed result:\n *\n *   const { email, password } = await readBody<LoginRequest>(event);\n */\nexport async function readBody<T = any>(event: H3Event): Promise<T> {\n  return ((await _readBody(event)) ?? {}) as T;\n}\n\n/**\n * Like `readBody` but rejects with a 413 response when the declared\n * `content-length` (or the actual buffered body) exceeds `maxBytes`.\n *\n * @param event - H3 event\n * @param maxBytes - Maximum allowed body size in bytes (default: 25 MB)\n * @returns Parsed body or `{}` when absent\n * @throws Never — on over-size it sets status 413 and throws an object with\n *   `{ statusCode: 413, message }` so the h3 handler can propagate it.\n */\nexport async function readBodyWithSizeLimit<T = any>(\n  event: H3Event,\n  maxBytes: number = DEFAULT_CHAT_MAX_BODY_BYTES,\n): Promise<T> {\n  // Fast-path: check Content-Length before buffering the body.\n  const clRaw = getHeader(event, \"content-length\");\n  if (clRaw) {\n    const declared = parseInt(clRaw, 10);\n    if (!Number.isNaN(declared) && declared > maxBytes) {\n      setResponseStatus(event, 413);\n      throw Object.assign(\n        new Error(`Request body too large (max ${maxBytes} bytes)`),\n        {\n          statusCode: 413,\n        },\n      );\n    }\n  }\n\n  const body = await _readBody(event);\n\n  // Also check the actual serialised size for chunked requests that omit C-L.\n  if (body !== null && body !== undefined) {\n    let actualBytes: number;\n    if (typeof body === \"string\") {\n      actualBytes = Buffer.byteLength(body, \"utf8\");\n    } else {\n      try {\n        actualBytes = Buffer.byteLength(JSON.stringify(body), \"utf8\");\n      } catch {\n        actualBytes = 0;\n      }\n    }\n    if (actualBytes > maxBytes) {\n      setResponseStatus(event, 413);\n      throw Object.assign(\n        new Error(`Request body too large (max ${maxBytes} bytes)`),\n        { statusCode: 413 },\n      );\n    }\n  }\n\n  return (body ?? {}) as T;\n}\n\n/**\n * Convert a Node `ReadStream` (e.g. from `fs.createReadStream`) into a web\n * `ReadableStream`, suitable for returning directly from an h3 v2 handler.\n *\n *   import { streamFile } from \"@agent-native/core/server\";\n *   import fs from \"node:fs\";\n *\n *   return streamFile(fs.createReadStream(filePath));\n */\nexport function streamFile(stream: ReadStream): ReadableStream {\n  return Readable.toWeb(stream) as ReadableStream;\n}\n"]}
+{"version":3,"file":"h3-helpers.js","sourceRoot":"","sources":["../../src/server/h3-helpers.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,IAAI,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAGzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9D;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,EAAE,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,kBAAkB;IAClB,mBAAmB;IACnB,0BAA0B;IAC1B,+CAA+C;IAC/C,oBAAoB;CACrB,CAAC;AAEF,oEAAoE;AACpE,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,0BAA0B;IAC1B,0BAA0B;IAC1B,kBAAkB;IAClB,mBAAmB;IACnB,6BAA6B;CAC9B,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAClD,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAU,KAAc;IACpD,OAAO,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAM,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAc,EACd,QAAQ,GAAW,2BAA2B;IAE9C,6DAA6D;IAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACnD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,+BAA+B,QAAQ,SAAS,CAAC,EAC3D;gBACE,UAAU,EAAE,GAAG;aAChB,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAEpC,4EAA4E;IAC5E,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,WAAmB,CAAC;QACxB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,WAAW,GAAG,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,IAAI,WAAW,GAAG,QAAQ,EAAE,CAAC;YAC3B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,KAAK,CAAC,+BAA+B,QAAQ,SAAS,CAAC,EAC3D,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,IAAI,EAAE,CAAM,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,UAAU;YACd,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAA0B,EAAE,EAAE;gBAC/C,UAAU,CAAC,OAAO,CAChB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CACpE,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAC3C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM;YACJ,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ReadStream } from \"node:fs\";\n\n/**\n * Small helpers around h3 v2 that polish ergonomics for templates.\n *\n * `readBody` — wraps h3's `readBody` so the result is typed `any` by default\n * (h3 v2 infers `unknown`, which forces `as` casts at every call site).\n *\n * `readBodyWithSizeLimit` — like `readBody` but rejects with a 413 response\n * when the `content-length` header (or the buffered body size) exceeds the\n * given threshold. Use this on any route whose payload can include inline\n * base64 attachments (chat POST, upload routes).\n *\n * `streamFile` — converts a Node `ReadStream` to a web `ReadableStream` so\n * route handlers can return file content without importing `node:stream`\n * inline. h3 v2 expects web streams everywhere.\n */\nimport { readBody as _readBody, getHeader, setResponseStatus } from \"h3\";\nimport type { H3Event } from \"h3\";\n\n/**\n * Default maximum chat-POST body size (25 MB uncompressed). The agent chat\n * body carries base64-encoded attachments so a 25 MB cap is generous while\n * still protecting against runaway payloads. Override per-route by passing a\n * different `maxBytes` value to `readBodyWithSizeLimit`.\n */\nexport const DEFAULT_CHAT_MAX_BODY_BYTES = 25 * 1024 * 1024;\n\n/**\n * Maximum file size for upload routes (25 MB). Mirrors Whisper's hard limit\n * so audio, image, and document uploads share a consistent ceiling.\n */\nexport const DEFAULT_UPLOAD_MAX_FILE_BYTES = 25 * 1024 * 1024;\n\n/**\n * Maximum number of attachments per chat message. Guards against pathological\n * requests that would fan out into hundreds of parallel model content-parts.\n */\nexport const MAX_CHAT_ATTACHMENTS_PER_MESSAGE = 20;\n\n/**\n * MIME types allowed on the file-upload routes. Executables and scripts are\n * explicitly excluded; everything else is allowed at the default tier.\n * Pass `allowedMimeTypes` to `assertAllowedMimeType` to enforce on a route.\n */\nexport const UPLOAD_ALLOWED_MIME_PREFIXES = [\n  \"image/\",\n  \"video/\",\n  \"audio/\",\n  \"text/\",\n  \"application/pdf\",\n  \"application/json\",\n  \"application/zip\",\n  \"application/gzip\",\n  \"application/x-tar\",\n  \"application/vnd.ms-excel\",\n  \"application/vnd.openxmlformats-officedocument\",\n  \"application/msword\",\n];\n\n/** Mime types that are always rejected even if a prefix matches. */\nconst UPLOAD_BLOCKED_MIME_TYPES = new Set([\n  \"application/x-msdownload\",\n  \"application/x-executable\",\n  \"application/x-sh\",\n  \"application/x-bat\",\n  \"application/x-msdos-program\",\n]);\n\n/**\n * Returns true when the given MIME type is acceptable for uploads.\n * Blocks executables and scripts; allows everything else in the allow-prefix list.\n */\nexport function isAllowedUploadMimeType(mimeType: string): boolean {\n  const lower = (mimeType || \"\").toLowerCase().split(\";\")[0].trim();\n  if (UPLOAD_BLOCKED_MIME_TYPES.has(lower)) return false;\n  return UPLOAD_ALLOWED_MIME_PREFIXES.some((prefix) =>\n    lower.startsWith(prefix),\n  );\n}\n\n/**\n * Parse a JSON request body. Returns `{}` if the body is empty or absent\n * so callers don't have to null-check before destructuring.\n *\n * Defaults T to `any` for ergonomic field access. Pass an explicit type\n * argument when you want a typed result:\n *\n *   const { email, password } = await readBody<LoginRequest>(event);\n */\nexport async function readBody<T = any>(event: H3Event): Promise<T> {\n  return ((await _readBody(event)) ?? {}) as T;\n}\n\n/**\n * Like `readBody` but rejects with a 413 response when the declared\n * `content-length` (or the actual buffered body) exceeds `maxBytes`.\n *\n * @param event - H3 event\n * @param maxBytes - Maximum allowed body size in bytes (default: 25 MB)\n * @returns Parsed body or `{}` when absent\n * @throws Never — on over-size it sets status 413 and throws an object with\n *   `{ statusCode: 413, message }` so the h3 handler can propagate it.\n */\nexport async function readBodyWithSizeLimit<T = any>(\n  event: H3Event,\n  maxBytes: number = DEFAULT_CHAT_MAX_BODY_BYTES,\n): Promise<T> {\n  // Fast-path: check Content-Length before buffering the body.\n  const clRaw = getHeader(event, \"content-length\");\n  if (clRaw) {\n    const declared = parseInt(clRaw, 10);\n    if (!Number.isNaN(declared) && declared > maxBytes) {\n      setResponseStatus(event, 413);\n      throw Object.assign(\n        new Error(`Request body too large (max ${maxBytes} bytes)`),\n        {\n          statusCode: 413,\n        },\n      );\n    }\n  }\n\n  const body = await _readBody(event);\n\n  // Also check the actual serialised size for chunked requests that omit C-L.\n  if (body !== null && body !== undefined) {\n    let actualBytes: number;\n    if (typeof body === \"string\") {\n      actualBytes = Buffer.byteLength(body, \"utf8\");\n    } else {\n      try {\n        actualBytes = Buffer.byteLength(JSON.stringify(body), \"utf8\");\n      } catch {\n        actualBytes = 0;\n      }\n    }\n    if (actualBytes > maxBytes) {\n      setResponseStatus(event, 413);\n      throw Object.assign(\n        new Error(`Request body too large (max ${maxBytes} bytes)`),\n        { statusCode: 413 },\n      );\n    }\n  }\n\n  return (body ?? {}) as T;\n}\n\n/**\n * Convert a Node `ReadStream` (e.g. from `fs.createReadStream`) into a web\n * `ReadableStream`, suitable for returning directly from an h3 v2 handler.\n *\n *   import { streamFile } from \"@agent-native/core/server\";\n *   import fs from \"node:fs\";\n *\n *   return streamFile(fs.createReadStream(filePath));\n */\nexport function streamFile(stream: ReadStream): ReadableStream {\n  return new ReadableStream<Uint8Array>({\n    start(controller) {\n      stream.on(\"data\", (chunk: string | Uint8Array) => {\n        controller.enqueue(\n          typeof chunk === \"string\" ? new TextEncoder().encode(chunk) : chunk,\n        );\n      });\n      stream.on(\"end\", () => controller.close());\n      stream.on(\"error\", (error) => controller.error(error));\n    },\n    cancel() {\n      stream.destroy();\n    },\n  });\n}\n"]}

package/dist/server/index.d.ts

@@ -60,6 +60,7 @@ export { renderEmail, emailStrong, emailLink, type RenderEmailArgs, type Rendere
 export { getAppProductionUrl, getFirstPartyProdUrl } from "./app-url.js";
 export { getConfiguredAppBasePath, normalizeAppBasePath, withConfiguredAppBasePath, } from "./app-base-path.js";
 export { signShortLivedToken, verifyShortLivedToken, type ShortLivedTokenClaims, type VerifyResult as ShortLivedTokenVerifyResult, } from "./short-lived-token.js";
+export { AGENT_ACCESS_PARAM, DEFAULT_AGENT_ACCESS_TTL_SECONDS, appendAgentAccessParam, buildAgentAccessApiUrl, buildAgentAccessUrl, createScopedAgentAccessGrant, normalizeAgentAccessBasePath, normalizeAgentAccessOrigin, scopedAgentAccessResourceId, signScopedAgentAccessToken, toAgentAccessUrl, verifyScopedAgentAccessToken, type AgentAccessApiUrlOptions, type AgentAccessResourceScope, type AgentAccessUrlOptions, type ScopedAgentAccessGrant, type ScopedAgentAccessTokenOptions, } from "./agent-access.js";
 export type NitroPluginDef = (nitroApp: any) => void | Promise<void>;
 export declare function defineNitroPlugin(def: NitroPluginDef): NitroPluginDef;
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,UAAU,EACV,2BAA2B,EAC3B,6BAA6B,EAC7B,gCAAgC,EAChC,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,EACrC,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,6BAA6B,GACnC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,+BAA+B,EACpC,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,4BAA4B,EAC5B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EACtC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACb,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,EAC5B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI7E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uCAAuC,EACvC,oCAAoC,EACpC,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,EACnC,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,gCAAgC,GACtC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,2CAA2C,EAC3C,2BAA2B,EAC3B,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iCAAiC,EACjC,KAAK,wCAAwC,GAC9C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uCAAuC,EACvC,0CAA0C,EAC1C,8BAA8B,EAC9B,kBAAkB,EAClB,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,KAAK,gCAAgC,GACtC,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,gCAAgC,EAChC,sCAAsC,EACtC,oCAAoC,EACpC,2CAA2C,EAC3C,sCAAsC,GACvC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,SAAS,EACT,OAAO,EACP,eAAe,EACf,SAAS,EACT,UAAU,EACV,eAAe,EACf,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,yCAAyC,EACzC,gCAAgC,EAChC,8BAA8B,EAC9B,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,QAAQ,EACR,cAAc,EACd,yBAAyB,EACzB,KAAK,SAAS,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,qCAAqC,EACrC,UAAU,EACV,yBAAyB,EACzB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,SAAS,EACT,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,mCAAmC,EACnC,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,sCAAsC,EACtC,sCAAsC,EACtC,6BAA6B,EAC7B,KAAK,yCAAyC,EAC9C,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,oCAAoC,EACzC,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,8BAA8B,EACnC,KAAK,qCAAqC,EAC1C,KAAK,iCAAiC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,eAAe,EACf,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,WAAW,EACX,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,QAAQ,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,IAAI,2BAA2B,GACjD,MAAM,wBAAwB,CAAC;AAUhC,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACrE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,CAErE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,UAAU,EACV,2BAA2B,EAC3B,6BAA6B,EAC7B,gCAAgC,EAChC,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,EACrC,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,6BAA6B,GACnC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,KAAK,2BAA2B,EAChC,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,+BAA+B,EACpC,KAAK,qBAAqB,GAC3B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,4BAA4B,EAC5B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EACtC,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,GAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACb,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,YAAY,EACZ,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,EAC5B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAI7E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uCAAuC,EACvC,oCAAoC,EACpC,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,EACnC,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,gCAAgC,GACtC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,2CAA2C,EAC3C,2BAA2B,EAC3B,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iCAAiC,EACjC,KAAK,wCAAwC,GAC9C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uCAAuC,EACvC,0CAA0C,EAC1C,8BAA8B,EAC9B,kBAAkB,EAClB,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,yBAAyB,EACzB,KAAK,gCAAgC,GACtC,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,yBAAyB,EACzB,+BAA+B,EAC/B,+BAA+B,EAC/B,gCAAgC,EAChC,sCAAsC,EACtC,oCAAoC,EACpC,2CAA2C,EAC3C,sCAAsC,GACvC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,SAAS,EACT,OAAO,EACP,eAAe,EACf,SAAS,EACT,UAAU,EACV,eAAe,EACf,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,yCAAyC,EACzC,gCAAgC,EAChC,8BAA8B,EAC9B,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,QAAQ,EACR,cAAc,EACd,yBAAyB,EACzB,KAAK,SAAS,GACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,wBAAwB,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,cAAc,EACnB,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,qCAAqC,EACrC,UAAU,EACV,yBAAyB,EACzB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,YAAY,EACZ,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,SAAS,EACT,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,mCAAmC,EACnC,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,sCAAsC,EACtC,sCAAsC,EACtC,6BAA6B,EAC7B,KAAK,yCAAyC,EAC9C,KAAK,gCAAgC,EACrC,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EAChC,KAAK,oCAAoC,EACzC,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,8BAA8B,EACnC,KAAK,qCAAqC,EAC1C,KAAK,iCAAiC,GACvC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,eAAe,EACf,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,GAC7B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,WAAW,EACX,SAAS,EACT,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,QAAQ,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,IAAI,2BAA2B,GACjD,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,gBAAgB,EAChB,4BAA4B,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,mBAAmB,CAAC;AAU3B,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACrE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,cAAc,CAErE"}

package/dist/server/index.js

@@ -61,6 +61,7 @@ export { renderEmail, emailStrong, emailLink, } from "./email-template.js";
 export { getAppProductionUrl, getFirstPartyProdUrl } from "./app-url.js";
 export { getConfiguredAppBasePath, normalizeAppBasePath, withConfiguredAppBasePath, } from "./app-base-path.js";
 export { signShortLivedToken, verifyShortLivedToken, } from "./short-lived-token.js";
+export { AGENT_ACCESS_PARAM, DEFAULT_AGENT_ACCESS_TTL_SECONDS, appendAgentAccessParam, buildAgentAccessApiUrl, buildAgentAccessUrl, createScopedAgentAccessGrant, normalizeAgentAccessBasePath, normalizeAgentAccessOrigin, scopedAgentAccessResourceId, signScopedAgentAccessToken, toAgentAccessUrl, verifyScopedAgentAccessToken, } from "./agent-access.js";
 export function defineNitroPlugin(def) {
     return def;
 }

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,UAAU,EACV,2BAA2B,EAC3B,6BAA6B,EAC7B,gCAAgC,EAChC,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAEhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAyB,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,GAQxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAA0B,MAAM,UAAU,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,GAIf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAA2B,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAA4B,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,GAIzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,4BAA4B,GAkB7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACb,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,YAAY,GAKb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,GAG7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uCAAuC,EACvC,oCAAoC,EACpC,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,GAKpC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,GAKf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,2CAA2C,EAC3C,2BAA2B,EAC3B,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uCAAuC,EACvC,0CAA0C,EAC1C,8BAA8B,EAC9B,kBAAkB,EAClB,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,yBAAyB,GAE1B,MAAM,+BAA+B,CAAC;AAWvC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,SAAS,EACT,OAAO,EACP,eAAe,EACf,SAAS,EACT,UAAU,EACV,eAAe,GAGhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,yCAAyC,EACzC,gCAAgC,EAChC,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,QAAQ,EACR,cAAc,EACd,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,GAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,qCAAqC,EACrC,UAAU,EACV,yBAAyB,GAI1B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,YAAY,GAMb,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,SAAS,EACT,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,wBAAwB,GAIzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,mCAAmC,EACnC,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,sCAAsC,EACtC,sCAAsC,EACtC,6BAA6B,GAY9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,GAIpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,gBAAgB,GAIjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,WAAW,EACX,SAAS,GAIV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAGtB,MAAM,wBAAwB,CAAC;AAWhC,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["export {\n  createServer,\n  type CreateServerOptions,\n  type EnvKeyConfig,\n} from \"./create-server.js\";\n\nexport {\n  readBody,\n  readBodyWithSizeLimit,\n  streamFile,\n  DEFAULT_CHAT_MAX_BODY_BYTES,\n  DEFAULT_UPLOAD_MAX_FILE_BYTES,\n  MAX_CHAT_ATTACHMENTS_PER_MESSAGE,\n  isAllowedUploadMimeType,\n} from \"./h3-helpers.js\";\nexport {\n  buildDeepLink,\n  toAbsoluteOpenUrl,\n  toDesktopOpenUrl,\n  toVsCodeOpenUrl,\n  OPEN_ROUTE_SUBPATH,\n  DESKTOP_OPEN_URL,\n  VSCODE_OPEN_URL,\n  type DeepLinkInput,\n} from \"./deep-link.js\";\nexport { createOpenRouteHandler, type OpenRouteOptions } from \"./open-route.js\";\nexport {\n  createEmbedStartRouteHandler,\n  buildEmbedStartPath,\n  type EmbedStartRouteOptions,\n} from \"./embed-route.js\";\nexport {\n  createEmbedSessionTicket,\n  consumeEmbedSessionTicket,\n  normalizeEmbedTargetPath,\n  requestHasEmbedAuthMarker,\n  resolveEmbedSessionFromRequest,\n  setEmbedSessionCookie,\n  signEmbedSessionToken,\n  verifyEmbedSessionToken,\n  type ConsumedEmbedSessionTicket,\n  type ConsumeEmbedSessionTicketOptions,\n  type EmbedSessionTicket,\n  type EmbedSessionTicketInput,\n  type EmbedSessionTokenClaims,\n  type ResolvedEmbedSession,\n  type VerifyEmbedSessionTokenResult,\n} from \"./embed-session.js\";\nexport { createSSEHandler, type SSEHandlerOptions } from \"./sse.js\";\nexport {\n  mountAuthMiddleware,\n  autoMountAuth,\n  getSession,\n  COOKIE_NAME,\n  addSession,\n  removeSession,\n  getSessionEmail,\n  getFrameworkSessionCookieValues,\n  setFrameworkSessionCookie,\n  clearFrameworkSessionCookies,\n  runAuthGuard,\n  setDesktopExchange,\n  setDesktopExchangeError,\n  safeReturnPath,\n  type DesktopExchangeErrorPayload,\n  type AuthSession,\n  type AuthOptions,\n} from \"./auth.js\";\nexport {\n  handleIdentitySso,\n  getIdentityHubUrl,\n  isIdentitySsoEnabled,\n  isIdentitySsoBypassPath,\n  identitySsoLoginButtonHtml,\n  IDENTITY_SSO_PROVIDER_ID,\n  IDENTITY_SSO_SCOPE,\n} from \"./identity-sso.js\";\nexport { requireEnvKey, type MissingKeyResponse } from \"./missing-key.js\";\nexport { verifyCaptcha, type CaptchaVerifyResult } from \"./captcha.js\";\nexport {\n  getLocaleInitScript,\n  parseAcceptLanguage,\n  resolveLocaleFromRequest,\n  type LocaleInitScriptOptions,\n  type ResolveLocaleFromRequestOptions,\n  type ResolvedRequestLocale,\n} from \"../localization/server.js\";\nexport {\n  createProductionAgentHandler,\n  type ActionEntry,\n  type ScriptEntry,\n  type ProductionAgentOptions,\n  type ActionTool,\n  type ScriptTool,\n  type AgentMessage,\n  type AgentChatRequest,\n  type AgentChatEvent,\n  type AgentChatAttachment,\n  type AgentChatReference,\n  type MentionProvider,\n  type MentionProviderItem,\n  type AgentLoopFinalResponseGuard,\n  type AgentLoopFinalResponseGuardContext,\n  type AgentLoopFinalResponseGuardResult,\n  type AgentLoopToolCallSummary,\n  type AgentLoopToolResultSummary,\n} from \"../agent/index.js\";\nexport {\n  actionsToEngineTools,\n  getOwnerActiveApiKey,\n  runAgentLoop,\n} from \"../agent/production-agent.js\";\nexport {\n  getStoredModelForEngine,\n  resolveEngine,\n} from \"../agent/engine/index.js\";\nexport {\n  completeText,\n  type CompleteTextMessage,\n  type CompleteTextOptions,\n  type CompleteTextResult,\n  type CompleteTextUsage,\n} from \"./complete-text.js\";\nexport { createDevScriptRegistry } from \"../scripts/dev/index.js\";\n\nexport {\n  createPollHandler,\n  recordChange,\n  getVersion,\n  getChangesSince,\n  getPollEmitter,\n  canSeeChangeForUser,\n  POLL_CHANGE_EVENT,\n} from \"./poll.js\";\nexport { createPollEventsHandler } from \"./poll-events.js\";\nexport { createAuthPlugin, defaultAuthPlugin } from \"./auth-plugin.js\";\nexport {\n  initServerSentry,\n  isServerSentryEnabled,\n  setSentryUserForRequest,\n  captureRouteError,\n  type RouteErrorContext,\n} from \"./sentry.js\";\nexport {\n  captureError,\n  captureServerError,\n  registerErrorCaptureProvider,\n  type CaptureErrorContext,\n  type CaptureErrorProvider,\n} from \"./capture-error.js\";\nexport { createSentryPlugin, defaultSentryPlugin } from \"./sentry-plugin.js\";\n// Re-export the org plugin so the auto-discovery's DEFAULT_PLUGIN_REGISTRY\n// (which references \"defaultOrgPlugin\" from @agent-native/core/server) can\n// resolve it during the deploy build worker-entry generation.\nexport { createOrgPlugin, defaultOrgPlugin } from \"../org/plugin.js\";\nexport {\n  createContextXrayPlugin,\n  defaultContextXrayPlugin,\n} from \"../agent/context-xray/plugin.js\";\nexport {\n  createObservationalMemoryPlugin,\n  defaultObservationalMemoryPlugin,\n} from \"../agent/observational-memory/plugin.js\";\nexport {\n  createGoogleAuthPlugin,\n  type GoogleAuthPluginOptions,\n} from \"./google-auth-plugin.js\";\nexport type { GoogleAuthMode } from \"./google-auth-mode.js\";\nexport {\n  createAgentChatPlugin,\n  defaultAgentChatPlugin,\n  refreshGlobalMcpManager,\n  type AgentChatPluginOptions,\n} from \"./agent-chat-plugin.js\";\nexport {\n  configureAgentNativeEmbeddedEnvironment,\n  createAgentNativeEmbeddedAuthOptions,\n  createAgentNativeEmbeddedPlugin,\n  mountAgentNativeEmbedded,\n  normalizeAgentNativeEmbeddedSession,\n  type AgentNativeEmbeddedAuthOptions,\n  type AgentNativeEmbeddedGetSession,\n  type AgentNativeEmbeddedHostSession,\n  type AgentNativeEmbeddedPluginOptions,\n} from \"./embedded.js\";\nexport {\n  createThread,\n  getThread,\n  listThreads,\n  updateThreadData,\n  deleteThread,\n  setThreadArchived,\n  setThreadPinned,\n  setThreadScope,\n  type ChatThread,\n  type ChatThreadScope,\n  type ChatThreadSummary,\n  type ListThreadsOptions,\n} from \"../chat-threads/store.js\";\nexport {\n  createResourcesPlugin,\n  defaultResourcesPlugin,\n} from \"./resources-plugin.js\";\nexport {\n  createCoreRoutesPlugin,\n  defaultCoreRoutesPlugin,\n  FRAMEWORK_ROUTE_PREFIX,\n  type CoreRoutesPluginOptions,\n} from \"./core-routes-plugin.js\";\nexport {\n  AGENT_NATIVE_OG_IMAGE_CACHE_CONTROL,\n  AGENT_NATIVE_OG_IMAGE_HEIGHT,\n  AGENT_NATIVE_OG_IMAGE_NETLIFY_CACHE_CONTROL,\n  AGENT_NATIVE_OG_IMAGE_WIDTH,\n  agentNativeOgImageResponseHeaders,\n  createAgentNativeOgImageHandler,\n  renderAgentNativeOgImagePng,\n  renderAgentNativeOgImageSvg,\n  type AgentNativeOgImageInput,\n} from \"./social-og-image.js\";\nexport {\n  createBrowserSessionActionEntries,\n  type CreateBrowserSessionActionEntriesOptions,\n} from \"../browser-sessions/actions.js\";\nexport {\n  DEFAULT_BROWSER_SESSION_REQUEST_POLL_MS,\n  DEFAULT_BROWSER_SESSION_REQUEST_TIMEOUT_MS,\n  DEFAULT_BROWSER_SESSION_TTL_MS,\n  callBrowserSession,\n  claimBrowserSessionRequest,\n  completeBrowserSessionRequest,\n  createBrowserSessionRequest,\n  disconnectBrowserSession,\n  getBrowserSession,\n  getBrowserSessionRequest,\n  listBrowserSessions,\n  registerBrowserSession,\n  waitForBrowserSessionRequest,\n} from \"../browser-sessions/store.js\";\nexport {\n  mountBrowserSessionRoutes,\n  type MountBrowserSessionRoutesOptions,\n} from \"../browser-sessions/routes.js\";\nexport type {\n  AgentNativeBrowserSession,\n  AgentNativeBrowserSessionAction,\n  AgentNativeBrowserSessionRecord,\n  AgentNativeBrowserSessionRequest,\n  AgentNativeBrowserSessionRequestStatus,\n  AgentNativeBrowserSessionRequestType,\n  CreateAgentNativeBrowserSessionRequestInput,\n  RegisterAgentNativeBrowserSessionInput,\n} from \"../browser-sessions/types.js\";\nexport {\n  createTerminalPlugin,\n  defaultTerminalPlugin,\n  type TerminalPluginOptions,\n} from \"../terminal/terminal-plugin.js\";\nexport {\n  createCollabPlugin,\n  type CollabPluginOptions,\n} from \"./collab-plugin.js\";\n\nexport {\n  spawnTask,\n  getTask,\n  getTaskByThread,\n  listTasks,\n  sendToTask,\n  markTaskErrored,\n  type AgentTask,\n  type SpawnTaskOptions,\n} from \"./agent-teams.js\";\nexport { isOAuthConnected, getOAuthAccounts } from \"./oauth-helpers.js\";\nexport {\n  hasGoogleSignInCredentials,\n  resolveGoogleLegacyProviderCredentials,\n  resolveGoogleProviderCredentialCandidates,\n  resolveGoogleProviderCredentials,\n  resolveGoogleSignInCredentials,\n  type GoogleOAuthCredentials,\n} from \"./google-oauth-credentials.js\";\nexport { wrapWithAnalytics } from \"./analytics.js\";\nexport {\n  getH3App,\n  awaitBootstrap,\n  markDefaultPluginProvided,\n  type H3AppShim,\n} from \"./framework-request-handler.js\";\nexport {\n  autoDiscoverActions,\n  autoDiscoverScripts,\n  loadActionsFromStaticRegistry,\n  mergeCoreSharingActions,\n  registerPackageActions,\n} from \"./action-discovery.js\";\nexport {\n  mountActionRoutes,\n  type MountActionRoutesOptions,\n} from \"./action-routes.js\";\nexport {\n  runWithRequestContext,\n  hasRequestContext,\n  getRequestContext,\n  getRequestUserEmail,\n  getRequestUserName,\n  getRequestOrgId,\n  getRequestTimezone,\n  getRequestRunContext,\n  getCredentialContext,\n  isIntegrationCallerRequest,\n  type RequestContext,\n  type RequestRunContext,\n} from \"./request-context.js\";\nexport { formatDateInTimezone, todayInTimezone } from \"./date-utils.js\";\n\nexport {\n  createOnboardingPlugin,\n  defaultOnboardingPlugin,\n} from \"../onboarding/plugin.js\";\n\nexport {\n  registerFileUploadProvider,\n  unregisterFileUploadProvider,\n  listFileUploadProviders,\n  getActiveFileUploadProvider,\n  getActiveFileUploadProviderForRequest,\n  uploadFile,\n  builderFileUploadProvider,\n  type FileUploadInput,\n  type FileUploadProvider,\n  type FileUploadResult,\n} from \"../file-upload/index.js\";\n\nexport {\n  createIntegrationsPlugin,\n  defaultIntegrationsPlugin,\n  enqueueRemoteCommand,\n  slackAdapter,\n  telegramAdapter,\n  whatsappAdapter,\n  emailAdapter,\n  type PlatformAdapter,\n  type IncomingMessage,\n  type OutgoingMessage,\n  type IntegrationStatus,\n  type IntegrationsPluginOptions,\n} from \"../integrations/index.js\";\n\nexport {\n  isElectron,\n  isMobile,\n  getOrigin,\n  getAppBasePath,\n  getAppUrl,\n  resolveOAuthRedirectUri,\n  isAllowedOAuthRedirectUri,\n  encodeOAuthState,\n  decodeOAuthState,\n  resolveOAuthOwner,\n  createOAuthSession,\n  oauthCallbackResponse,\n  oauthErrorPage,\n  oauthDesktopExchangePage,\n  type OAuthStatePayload,\n  type OAuthOwnerResult,\n  type OAuthSessionResult,\n} from \"./google-oauth.js\";\n\nexport {\n  FeatureNotConfiguredError,\n  hasBuilderPrivateKey,\n  isBuilderEnvManaged,\n  getBuilderProxyOrigin,\n  getBuilderImageGenerationBaseUrl,\n  getBuilderWebSearchBaseUrl,\n  getBuilderAuthHeader,\n  resolveBuilderPrivateKey,\n  resolveBuilderAuthHeader,\n  resolveHasBuilderPrivateKey,\n  resolveHasCompleteBuilderConnection,\n  resolveBuilderCredentials,\n  resolveBuilderCredential,\n  readDeployCredentialEnv,\n  writeBuilderCredentials,\n  deleteBuilderCredentials,\n  resolveSecret,\n} from \"./credential-provider.js\";\nexport {\n  builderDesignSystemUrl,\n  buildBuilderDesignSystemIndexFiles,\n  createBuilderDesignSystemProxyFields,\n  fetchBuilderDesignSystemDocs,\n  getBuilderDesignSystemsBaseUrl,\n  hydrateBuilderDesignSystemReference,\n  localBuilderDesignSystemId,\n  mimeTypeForBuilderDesignSystemFilename,\n  parseBuilderDesignSystemProxyReference,\n  startBuilderDesignSystemIndex,\n  type BuildBuilderDesignSystemIndexFilesOptions,\n  type BuilderDesignSystemCodeFileInput,\n  type BuilderDesignSystemDocsOptions,\n  type BuilderDesignSystemDocument,\n  type BuilderDesignSystemHydratedReference,\n  type BuilderDesignSystemIndexFile,\n  type BuilderDesignSystemIndexOptions,\n  type BuilderDesignSystemIndexResult,\n  type BuilderDesignSystemProxyFields,\n  type BuilderDesignSystemProxyFieldsOptions,\n  type BuilderDesignSystemProxyReference,\n} from \"./builder-design-systems.js\";\nexport {\n  getBuilderBranchProjectId,\n  isBuilderBranchingEnabled,\n  resolveBuilderBranchProjectId,\n  resolveIsBuilderBranchingEnabled,\n  runBuilderAgent,\n  type RunBuilderAgentResult,\n} from \"./builder-browser.js\";\nexport {\n  ensureFusionContainer,\n  sendFusionBranchMessage,\n  pushFusionBranch,\n  reserveFusionHostingSlug,\n  deployFusionProject,\n  getFusionDeploys,\n  getFusionBranchEditorUrl,\n  getFusionHostingUrl,\n  type FusionBranchRef,\n  type EnsureFusionContainerResult,\n  type SendFusionMessageResult,\n} from \"./fusion-app.js\";\n\nexport {\n  sendEmail,\n  isEmailConfigured,\n  getEmailProvider,\n  type EmailAttachment,\n  type EmailProvider,\n  type SendEmailArgs,\n} from \"./email.js\";\nexport {\n  renderEmail,\n  emailStrong,\n  emailLink,\n  type RenderEmailArgs,\n  type RenderedEmail,\n  type EmailCta,\n} from \"./email-template.js\";\nexport { getAppProductionUrl, getFirstPartyProdUrl } from \"./app-url.js\";\nexport {\n  getConfiguredAppBasePath,\n  normalizeAppBasePath,\n  withConfiguredAppBasePath,\n} from \"./app-base-path.js\";\nexport {\n  signShortLivedToken,\n  verifyShortLivedToken,\n  type ShortLivedTokenClaims,\n  type VerifyResult as ShortLivedTokenVerifyResult,\n} from \"./short-lived-token.js\";\n\n// SSR handler is NOT re-exported here — it uses a virtual module\n// (virtual:react-router/server-build) that only exists at Vite dev/build time.\n// Including it in this barrel would break the esbuild CF Pages bundler.\n// Templates import directly: import { ssrHandler } from \"@agent-native/core/server/ssr-handler\"\n\n// Nitro plugin helper — re-exported so templates don't need nitro as a direct dependency.\n// defineNitroPlugin is an identity function; this typed wrapper lets templates use it\n// without resolving `nitro/runtime` (which requires Nitro's virtual modules at runtime).\nexport type NitroPluginDef = (nitroApp: any) => void | Promise<void>;\nexport function defineNitroPlugin(def: NitroPluginDef): NitroPluginDef {\n  return def;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAGb,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,QAAQ,EACR,qBAAqB,EACrB,UAAU,EACV,2BAA2B,EAC3B,6BAA6B,EAC7B,gCAAgC,EAChC,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,GAEhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAyB,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,GAQxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAA0B,MAAM,UAAU,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,WAAW,EACX,UAAU,EACV,aAAa,EACb,eAAe,EACf,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,GAIf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAA2B,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAA4B,MAAM,cAAc,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,wBAAwB,GAIzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,4BAA4B,GAkB7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,GACb,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,uBAAuB,EACvB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,YAAY,GAKb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,4BAA4B,GAG7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,+BAA+B,EAC/B,gCAAgC,GACjC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,uCAAuC,EACvC,oCAAoC,EACpC,+BAA+B,EAC/B,wBAAwB,EACxB,mCAAmC,GAKpC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,cAAc,GAKf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,2CAA2C,EAC3C,2BAA2B,EAC3B,iCAAiC,EACjC,+BAA+B,EAC/B,2BAA2B,EAC3B,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iCAAiC,GAElC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uCAAuC,EACvC,0CAA0C,EAC1C,8BAA8B,EAC9B,kBAAkB,EAClB,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,wBAAwB,EACxB,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,yBAAyB,GAE1B,MAAM,+BAA+B,CAAC;AAWvC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,GAEnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,SAAS,EACT,OAAO,EACP,eAAe,EACf,SAAS,EACT,UAAU,EACV,eAAe,GAGhB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,sCAAsC,EACtC,yCAAyC,EACzC,gCAAgC,EAChC,8BAA8B,GAE/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,QAAQ,EACR,cAAc,EACd,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,GAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAG3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAExE,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,qCAAqC,EACrC,UAAU,EACV,yBAAyB,GAI1B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,YAAY,GAMb,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,UAAU,EACV,QAAQ,EACR,SAAS,EACT,cAAc,EACd,SAAS,EACT,uBAAuB,EACvB,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,wBAAwB,GAIzB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,0BAA0B,EAC1B,oBAAoB,EACpB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,mCAAmC,EACnC,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,oCAAoC,EACpC,4BAA4B,EAC5B,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,sCAAsC,EACtC,sCAAsC,EACtC,6BAA6B,GAY9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,gCAAgC,EAChC,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,GAIpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,gBAAgB,GAIjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,WAAW,EACX,WAAW,EACX,SAAS,GAIV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAGtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,gBAAgB,EAChB,4BAA4B,GAM7B,MAAM,mBAAmB,CAAC;AAW3B,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["export {\n  createServer,\n  type CreateServerOptions,\n  type EnvKeyConfig,\n} from \"./create-server.js\";\n\nexport {\n  readBody,\n  readBodyWithSizeLimit,\n  streamFile,\n  DEFAULT_CHAT_MAX_BODY_BYTES,\n  DEFAULT_UPLOAD_MAX_FILE_BYTES,\n  MAX_CHAT_ATTACHMENTS_PER_MESSAGE,\n  isAllowedUploadMimeType,\n} from \"./h3-helpers.js\";\nexport {\n  buildDeepLink,\n  toAbsoluteOpenUrl,\n  toDesktopOpenUrl,\n  toVsCodeOpenUrl,\n  OPEN_ROUTE_SUBPATH,\n  DESKTOP_OPEN_URL,\n  VSCODE_OPEN_URL,\n  type DeepLinkInput,\n} from \"./deep-link.js\";\nexport { createOpenRouteHandler, type OpenRouteOptions } from \"./open-route.js\";\nexport {\n  createEmbedStartRouteHandler,\n  buildEmbedStartPath,\n  type EmbedStartRouteOptions,\n} from \"./embed-route.js\";\nexport {\n  createEmbedSessionTicket,\n  consumeEmbedSessionTicket,\n  normalizeEmbedTargetPath,\n  requestHasEmbedAuthMarker,\n  resolveEmbedSessionFromRequest,\n  setEmbedSessionCookie,\n  signEmbedSessionToken,\n  verifyEmbedSessionToken,\n  type ConsumedEmbedSessionTicket,\n  type ConsumeEmbedSessionTicketOptions,\n  type EmbedSessionTicket,\n  type EmbedSessionTicketInput,\n  type EmbedSessionTokenClaims,\n  type ResolvedEmbedSession,\n  type VerifyEmbedSessionTokenResult,\n} from \"./embed-session.js\";\nexport { createSSEHandler, type SSEHandlerOptions } from \"./sse.js\";\nexport {\n  mountAuthMiddleware,\n  autoMountAuth,\n  getSession,\n  COOKIE_NAME,\n  addSession,\n  removeSession,\n  getSessionEmail,\n  getFrameworkSessionCookieValues,\n  setFrameworkSessionCookie,\n  clearFrameworkSessionCookies,\n  runAuthGuard,\n  setDesktopExchange,\n  setDesktopExchangeError,\n  safeReturnPath,\n  type DesktopExchangeErrorPayload,\n  type AuthSession,\n  type AuthOptions,\n} from \"./auth.js\";\nexport {\n  handleIdentitySso,\n  getIdentityHubUrl,\n  isIdentitySsoEnabled,\n  isIdentitySsoBypassPath,\n  identitySsoLoginButtonHtml,\n  IDENTITY_SSO_PROVIDER_ID,\n  IDENTITY_SSO_SCOPE,\n} from \"./identity-sso.js\";\nexport { requireEnvKey, type MissingKeyResponse } from \"./missing-key.js\";\nexport { verifyCaptcha, type CaptchaVerifyResult } from \"./captcha.js\";\nexport {\n  getLocaleInitScript,\n  parseAcceptLanguage,\n  resolveLocaleFromRequest,\n  type LocaleInitScriptOptions,\n  type ResolveLocaleFromRequestOptions,\n  type ResolvedRequestLocale,\n} from \"../localization/server.js\";\nexport {\n  createProductionAgentHandler,\n  type ActionEntry,\n  type ScriptEntry,\n  type ProductionAgentOptions,\n  type ActionTool,\n  type ScriptTool,\n  type AgentMessage,\n  type AgentChatRequest,\n  type AgentChatEvent,\n  type AgentChatAttachment,\n  type AgentChatReference,\n  type MentionProvider,\n  type MentionProviderItem,\n  type AgentLoopFinalResponseGuard,\n  type AgentLoopFinalResponseGuardContext,\n  type AgentLoopFinalResponseGuardResult,\n  type AgentLoopToolCallSummary,\n  type AgentLoopToolResultSummary,\n} from \"../agent/index.js\";\nexport {\n  actionsToEngineTools,\n  getOwnerActiveApiKey,\n  runAgentLoop,\n} from \"../agent/production-agent.js\";\nexport {\n  getStoredModelForEngine,\n  resolveEngine,\n} from \"../agent/engine/index.js\";\nexport {\n  completeText,\n  type CompleteTextMessage,\n  type CompleteTextOptions,\n  type CompleteTextResult,\n  type CompleteTextUsage,\n} from \"./complete-text.js\";\nexport { createDevScriptRegistry } from \"../scripts/dev/index.js\";\n\nexport {\n  createPollHandler,\n  recordChange,\n  getVersion,\n  getChangesSince,\n  getPollEmitter,\n  canSeeChangeForUser,\n  POLL_CHANGE_EVENT,\n} from \"./poll.js\";\nexport { createPollEventsHandler } from \"./poll-events.js\";\nexport { createAuthPlugin, defaultAuthPlugin } from \"./auth-plugin.js\";\nexport {\n  initServerSentry,\n  isServerSentryEnabled,\n  setSentryUserForRequest,\n  captureRouteError,\n  type RouteErrorContext,\n} from \"./sentry.js\";\nexport {\n  captureError,\n  captureServerError,\n  registerErrorCaptureProvider,\n  type CaptureErrorContext,\n  type CaptureErrorProvider,\n} from \"./capture-error.js\";\nexport { createSentryPlugin, defaultSentryPlugin } from \"./sentry-plugin.js\";\n// Re-export the org plugin so the auto-discovery's DEFAULT_PLUGIN_REGISTRY\n// (which references \"defaultOrgPlugin\" from @agent-native/core/server) can\n// resolve it during the deploy build worker-entry generation.\nexport { createOrgPlugin, defaultOrgPlugin } from \"../org/plugin.js\";\nexport {\n  createContextXrayPlugin,\n  defaultContextXrayPlugin,\n} from \"../agent/context-xray/plugin.js\";\nexport {\n  createObservationalMemoryPlugin,\n  defaultObservationalMemoryPlugin,\n} from \"../agent/observational-memory/plugin.js\";\nexport {\n  createGoogleAuthPlugin,\n  type GoogleAuthPluginOptions,\n} from \"./google-auth-plugin.js\";\nexport type { GoogleAuthMode } from \"./google-auth-mode.js\";\nexport {\n  createAgentChatPlugin,\n  defaultAgentChatPlugin,\n  refreshGlobalMcpManager,\n  type AgentChatPluginOptions,\n} from \"./agent-chat-plugin.js\";\nexport {\n  configureAgentNativeEmbeddedEnvironment,\n  createAgentNativeEmbeddedAuthOptions,\n  createAgentNativeEmbeddedPlugin,\n  mountAgentNativeEmbedded,\n  normalizeAgentNativeEmbeddedSession,\n  type AgentNativeEmbeddedAuthOptions,\n  type AgentNativeEmbeddedGetSession,\n  type AgentNativeEmbeddedHostSession,\n  type AgentNativeEmbeddedPluginOptions,\n} from \"./embedded.js\";\nexport {\n  createThread,\n  getThread,\n  listThreads,\n  updateThreadData,\n  deleteThread,\n  setThreadArchived,\n  setThreadPinned,\n  setThreadScope,\n  type ChatThread,\n  type ChatThreadScope,\n  type ChatThreadSummary,\n  type ListThreadsOptions,\n} from \"../chat-threads/store.js\";\nexport {\n  createResourcesPlugin,\n  defaultResourcesPlugin,\n} from \"./resources-plugin.js\";\nexport {\n  createCoreRoutesPlugin,\n  defaultCoreRoutesPlugin,\n  FRAMEWORK_ROUTE_PREFIX,\n  type CoreRoutesPluginOptions,\n} from \"./core-routes-plugin.js\";\nexport {\n  AGENT_NATIVE_OG_IMAGE_CACHE_CONTROL,\n  AGENT_NATIVE_OG_IMAGE_HEIGHT,\n  AGENT_NATIVE_OG_IMAGE_NETLIFY_CACHE_CONTROL,\n  AGENT_NATIVE_OG_IMAGE_WIDTH,\n  agentNativeOgImageResponseHeaders,\n  createAgentNativeOgImageHandler,\n  renderAgentNativeOgImagePng,\n  renderAgentNativeOgImageSvg,\n  type AgentNativeOgImageInput,\n} from \"./social-og-image.js\";\nexport {\n  createBrowserSessionActionEntries,\n  type CreateBrowserSessionActionEntriesOptions,\n} from \"../browser-sessions/actions.js\";\nexport {\n  DEFAULT_BROWSER_SESSION_REQUEST_POLL_MS,\n  DEFAULT_BROWSER_SESSION_REQUEST_TIMEOUT_MS,\n  DEFAULT_BROWSER_SESSION_TTL_MS,\n  callBrowserSession,\n  claimBrowserSessionRequest,\n  completeBrowserSessionRequest,\n  createBrowserSessionRequest,\n  disconnectBrowserSession,\n  getBrowserSession,\n  getBrowserSessionRequest,\n  listBrowserSessions,\n  registerBrowserSession,\n  waitForBrowserSessionRequest,\n} from \"../browser-sessions/store.js\";\nexport {\n  mountBrowserSessionRoutes,\n  type MountBrowserSessionRoutesOptions,\n} from \"../browser-sessions/routes.js\";\nexport type {\n  AgentNativeBrowserSession,\n  AgentNativeBrowserSessionAction,\n  AgentNativeBrowserSessionRecord,\n  AgentNativeBrowserSessionRequest,\n  AgentNativeBrowserSessionRequestStatus,\n  AgentNativeBrowserSessionRequestType,\n  CreateAgentNativeBrowserSessionRequestInput,\n  RegisterAgentNativeBrowserSessionInput,\n} from \"../browser-sessions/types.js\";\nexport {\n  createTerminalPlugin,\n  defaultTerminalPlugin,\n  type TerminalPluginOptions,\n} from \"../terminal/terminal-plugin.js\";\nexport {\n  createCollabPlugin,\n  type CollabPluginOptions,\n} from \"./collab-plugin.js\";\n\nexport {\n  spawnTask,\n  getTask,\n  getTaskByThread,\n  listTasks,\n  sendToTask,\n  markTaskErrored,\n  type AgentTask,\n  type SpawnTaskOptions,\n} from \"./agent-teams.js\";\nexport { isOAuthConnected, getOAuthAccounts } from \"./oauth-helpers.js\";\nexport {\n  hasGoogleSignInCredentials,\n  resolveGoogleLegacyProviderCredentials,\n  resolveGoogleProviderCredentialCandidates,\n  resolveGoogleProviderCredentials,\n  resolveGoogleSignInCredentials,\n  type GoogleOAuthCredentials,\n} from \"./google-oauth-credentials.js\";\nexport { wrapWithAnalytics } from \"./analytics.js\";\nexport {\n  getH3App,\n  awaitBootstrap,\n  markDefaultPluginProvided,\n  type H3AppShim,\n} from \"./framework-request-handler.js\";\nexport {\n  autoDiscoverActions,\n  autoDiscoverScripts,\n  loadActionsFromStaticRegistry,\n  mergeCoreSharingActions,\n  registerPackageActions,\n} from \"./action-discovery.js\";\nexport {\n  mountActionRoutes,\n  type MountActionRoutesOptions,\n} from \"./action-routes.js\";\nexport {\n  runWithRequestContext,\n  hasRequestContext,\n  getRequestContext,\n  getRequestUserEmail,\n  getRequestUserName,\n  getRequestOrgId,\n  getRequestTimezone,\n  getRequestRunContext,\n  getCredentialContext,\n  isIntegrationCallerRequest,\n  type RequestContext,\n  type RequestRunContext,\n} from \"./request-context.js\";\nexport { formatDateInTimezone, todayInTimezone } from \"./date-utils.js\";\n\nexport {\n  createOnboardingPlugin,\n  defaultOnboardingPlugin,\n} from \"../onboarding/plugin.js\";\n\nexport {\n  registerFileUploadProvider,\n  unregisterFileUploadProvider,\n  listFileUploadProviders,\n  getActiveFileUploadProvider,\n  getActiveFileUploadProviderForRequest,\n  uploadFile,\n  builderFileUploadProvider,\n  type FileUploadInput,\n  type FileUploadProvider,\n  type FileUploadResult,\n} from \"../file-upload/index.js\";\n\nexport {\n  createIntegrationsPlugin,\n  defaultIntegrationsPlugin,\n  enqueueRemoteCommand,\n  slackAdapter,\n  telegramAdapter,\n  whatsappAdapter,\n  emailAdapter,\n  type PlatformAdapter,\n  type IncomingMessage,\n  type OutgoingMessage,\n  type IntegrationStatus,\n  type IntegrationsPluginOptions,\n} from \"../integrations/index.js\";\n\nexport {\n  isElectron,\n  isMobile,\n  getOrigin,\n  getAppBasePath,\n  getAppUrl,\n  resolveOAuthRedirectUri,\n  isAllowedOAuthRedirectUri,\n  encodeOAuthState,\n  decodeOAuthState,\n  resolveOAuthOwner,\n  createOAuthSession,\n  oauthCallbackResponse,\n  oauthErrorPage,\n  oauthDesktopExchangePage,\n  type OAuthStatePayload,\n  type OAuthOwnerResult,\n  type OAuthSessionResult,\n} from \"./google-oauth.js\";\n\nexport {\n  FeatureNotConfiguredError,\n  hasBuilderPrivateKey,\n  isBuilderEnvManaged,\n  getBuilderProxyOrigin,\n  getBuilderImageGenerationBaseUrl,\n  getBuilderWebSearchBaseUrl,\n  getBuilderAuthHeader,\n  resolveBuilderPrivateKey,\n  resolveBuilderAuthHeader,\n  resolveHasBuilderPrivateKey,\n  resolveHasCompleteBuilderConnection,\n  resolveBuilderCredentials,\n  resolveBuilderCredential,\n  readDeployCredentialEnv,\n  writeBuilderCredentials,\n  deleteBuilderCredentials,\n  resolveSecret,\n} from \"./credential-provider.js\";\nexport {\n  builderDesignSystemUrl,\n  buildBuilderDesignSystemIndexFiles,\n  createBuilderDesignSystemProxyFields,\n  fetchBuilderDesignSystemDocs,\n  getBuilderDesignSystemsBaseUrl,\n  hydrateBuilderDesignSystemReference,\n  localBuilderDesignSystemId,\n  mimeTypeForBuilderDesignSystemFilename,\n  parseBuilderDesignSystemProxyReference,\n  startBuilderDesignSystemIndex,\n  type BuildBuilderDesignSystemIndexFilesOptions,\n  type BuilderDesignSystemCodeFileInput,\n  type BuilderDesignSystemDocsOptions,\n  type BuilderDesignSystemDocument,\n  type BuilderDesignSystemHydratedReference,\n  type BuilderDesignSystemIndexFile,\n  type BuilderDesignSystemIndexOptions,\n  type BuilderDesignSystemIndexResult,\n  type BuilderDesignSystemProxyFields,\n  type BuilderDesignSystemProxyFieldsOptions,\n  type BuilderDesignSystemProxyReference,\n} from \"./builder-design-systems.js\";\nexport {\n  getBuilderBranchProjectId,\n  isBuilderBranchingEnabled,\n  resolveBuilderBranchProjectId,\n  resolveIsBuilderBranchingEnabled,\n  runBuilderAgent,\n  type RunBuilderAgentResult,\n} from \"./builder-browser.js\";\nexport {\n  ensureFusionContainer,\n  sendFusionBranchMessage,\n  pushFusionBranch,\n  reserveFusionHostingSlug,\n  deployFusionProject,\n  getFusionDeploys,\n  getFusionBranchEditorUrl,\n  getFusionHostingUrl,\n  type FusionBranchRef,\n  type EnsureFusionContainerResult,\n  type SendFusionMessageResult,\n} from \"./fusion-app.js\";\n\nexport {\n  sendEmail,\n  isEmailConfigured,\n  getEmailProvider,\n  type EmailAttachment,\n  type EmailProvider,\n  type SendEmailArgs,\n} from \"./email.js\";\nexport {\n  renderEmail,\n  emailStrong,\n  emailLink,\n  type RenderEmailArgs,\n  type RenderedEmail,\n  type EmailCta,\n} from \"./email-template.js\";\nexport { getAppProductionUrl, getFirstPartyProdUrl } from \"./app-url.js\";\nexport {\n  getConfiguredAppBasePath,\n  normalizeAppBasePath,\n  withConfiguredAppBasePath,\n} from \"./app-base-path.js\";\nexport {\n  signShortLivedToken,\n  verifyShortLivedToken,\n  type ShortLivedTokenClaims,\n  type VerifyResult as ShortLivedTokenVerifyResult,\n} from \"./short-lived-token.js\";\nexport {\n  AGENT_ACCESS_PARAM,\n  DEFAULT_AGENT_ACCESS_TTL_SECONDS,\n  appendAgentAccessParam,\n  buildAgentAccessApiUrl,\n  buildAgentAccessUrl,\n  createScopedAgentAccessGrant,\n  normalizeAgentAccessBasePath,\n  normalizeAgentAccessOrigin,\n  scopedAgentAccessResourceId,\n  signScopedAgentAccessToken,\n  toAgentAccessUrl,\n  verifyScopedAgentAccessToken,\n  type AgentAccessApiUrlOptions,\n  type AgentAccessResourceScope,\n  type AgentAccessUrlOptions,\n  type ScopedAgentAccessGrant,\n  type ScopedAgentAccessTokenOptions,\n} from \"./agent-access.js\";\n\n// SSR handler is NOT re-exported here — it uses a virtual module\n// (virtual:react-router/server-build) that only exists at Vite dev/build time.\n// Including it in this barrel would break the esbuild CF Pages bundler.\n// Templates import directly: import { ssrHandler } from \"@agent-native/core/server/ssr-handler\"\n\n// Nitro plugin helper — re-exported so templates don't need nitro as a direct dependency.\n// defineNitroPlugin is an identity function; this typed wrapper lets templates use it\n// without resolving `nitro/runtime` (which requires Nitro's virtual modules at runtime).\nexport type NitroPluginDef = (nitroApp: any) => void | Promise<void>;\nexport function defineNitroPlugin(def: NitroPluginDef): NitroPluginDef {\n  return def;\n}\n"]}

package/dist/server/request-context.d.ts

@@ -1,3 +1,20 @@
+/**
+ * Per-request context using AsyncLocalStorage.
+ *
+ * Replaces the unsafe pattern of mutating `process.env.AGENT_USER_EMAIL` /
+ * `process.env.AGENT_ORG_ID` on every request. On Node.js (Netlify, self-hosted)
+ * concurrent requests would overwrite each other's env vars. AsyncLocalStorage
+ * gives each async call-chain its own isolated context.
+ *
+ * Supported on all deployment targets:
+ * - Node.js (native)
+ * - Cloudflare Workers (via nodejs_compat flag)
+ * - Deno Deploy (via node:async_hooks compat)
+ *
+ * For CLI scripts that run outside a request context, the getters fall back to
+ * process.env so existing `AGENT_USER_EMAIL=x pnpm action foo` invocations
+ * continue to work.
+ */
 /**
  * Per-request agent-run state. Lives on `RequestContext.run` so the
  * agent-chat plugin can populate fields as the run progresses (owner,

package/dist/server/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC;IACT,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,0BAA0B,EAAE,WAAW,CAAC;IACxD,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wDAAwD;IACxD,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpD,8DAA8D;IAC9D,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,OAAO,0BAA0B,EAAE,eAAe,CAAC;QAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;OAGG;IACH,GAAG,CAAC,EAAE,iBAAiB,CAAC;CACzB;AAID,KAAK,sBAAsB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;AAe5D;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,sBAAsB,GAC/B,MAAM,IAAI,CAMZ;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACvB,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAahB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAI9D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAOxD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAOvD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAOpD;AASD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,wBAAgB,4BAA4B,IACxC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,GAC1C,SAAS,CAEZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,IAAI,CAIP;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,SAAS,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,GAAG,SAAS,CAKvE"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA0DH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC;IACT,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,0BAA0B,EAAE,WAAW,CAAC;IACxD,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wDAAwD;IACxD,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpD,8DAA8D;IAC9D,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,OAAO,0BAA0B,EAAE,eAAe,CAAC;QAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;OAGG;IACH,GAAG,CAAC,EAAE,iBAAiB,CAAC;CACzB;AAID,KAAK,sBAAsB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;AAiB5D;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,sBAAsB,GAC/B,MAAM,IAAI,CAMZ;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACvB,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAahB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAI9D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAOxD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAOvD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAOpD;AASD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,wBAAgB,4BAA4B,IACxC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,GAC1C,SAAS,CAEZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,IAAI,CAIP;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,SAAS,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,GAAG,SAAS,CAKvE"}

package/dist/server/request-context.js

@@ -15,12 +15,52 @@
  * process.env so existing `AGENT_USER_EMAIL=x pnpm action foo` invocations
  * continue to work.
  */
-import { AsyncLocalStorage } from "node:async_hooks";
+class StackAsyncLocalStorage {
+    stack = [];
+    getStore() {
+        return this.stack.at(-1);
+    }
+    run(store, callback) {
+        this.stack.push(store);
+        try {
+            const result = callback();
+            const maybePromise = result;
+            if (maybePromise && typeof maybePromise.finally === "function") {
+                return maybePromise.finally(() => {
+                    this.stack.pop();
+                });
+            }
+            this.stack.pop();
+            return result;
+        }
+        catch (error) {
+            this.stack.pop();
+            throw error;
+        }
+    }
+}
+function getAsyncLocalStorageCtor() {
+    if (typeof window !== "undefined" ||
+        typeof process === "undefined" ||
+        !process.versions?.node ||
+        typeof process.getBuiltinModule !== "function") {
+        return undefined;
+    }
+    return process.getBuiltinModule("node:async_hooks")?.AsyncLocalStorage;
+}
+const AsyncLocalStorageCtor = getAsyncLocalStorageCtor();
+function processEnv(name) {
+    if (typeof process === "undefined")
+        return undefined;
+    return process.env?.[name];
+}
 const GLOBAL_KEY = "__agentNativeRequestContextAls";
 const OBSERVERS_KEY = "__agentNativeRequestContextObservers";
 const globalRef = globalThis;
 if (!globalRef[GLOBAL_KEY]) {
-    globalRef[GLOBAL_KEY] = new AsyncLocalStorage();
+    globalRef[GLOBAL_KEY] = AsyncLocalStorageCtor
+        ? new AsyncLocalStorageCtor()
+        : new StackAsyncLocalStorage();
 }
 if (!globalRef[OBSERVERS_KEY]) {
     globalRef[OBSERVERS_KEY] = [];
@@ -105,7 +145,7 @@ export function getRequestUserEmail() {
             markAuthContextAccess(store);
         return store.userEmail;
     }
-    return process.env.AGENT_USER_EMAIL;
+    return processEnv("AGENT_USER_EMAIL");
 }
 /**
  * Get the current request's display name, when the auth provider supplied one.
@@ -121,7 +161,7 @@ export function getRequestUserName() {
             markAuthContextAccess(store);
         return store.userName;
     }
-    return process.env.AGENT_USER_NAME;
+    return processEnv("AGENT_USER_NAME");
 }
 /**
  * Get the current request's org ID.
@@ -137,7 +177,7 @@ export function getRequestOrgId() {
             markAuthContextAccess(store);
         return store.orgId;
     }
-    return process.env.AGENT_ORG_ID;
+    return processEnv("AGENT_ORG_ID");
 }
 function markAuthContextAccess(ctx) {
     if (!ctx)
@@ -160,7 +200,7 @@ export function getRequestTimezone() {
     const store = als.getStore();
     if (store !== undefined)
         return store.timezone;
-    return process.env.AGENT_USER_TIMEZONE;
+    return processEnv("AGENT_USER_TIMEZONE");
 }
 /**
  * Returns true when this request is on an integration-platform path (Slack,