@agent-native/core 0.92.12 → 0.94.0

package/dist/server/realtime-voice.js

@@ -0,0 +1,404 @@
+import { defineEventHandler, getHeader, getMethod, readRawBody, setResponseHeader, setResponseStatus, } from "h3";
+import { actionsToEngineTools, } from "../agent/production-agent.js";
+import { redactSensitiveFields, sanitizeToolErrorText, sanitizeToolErrorValue, } from "../agent/tool-error-redaction.js";
+import { getSession } from "./auth.js";
+import { resolveSecret } from "./credential-provider.js";
+import { getH3App } from "./framework-request-handler.js";
+import { runWithRequestContext } from "./request-context.js";
+export const REALTIME_VOICE_SESSION_PATH = "/_agent-native/realtime-voice/session";
+export const REALTIME_VOICE_TOOL_PATH = "/_agent-native/realtime-voice/tool";
+export const REALTIME_VOICE_MAX_SDP_BYTES = 64 * 1024;
+export const REALTIME_VOICE_MAX_TOOL_BODY_BYTES = 64 * 1024;
+export const REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS = 16_000;
+const OPENAI_REALTIME_CALLS_URL = "https://api.openai.com/v1/realtime/calls";
+const DEFAULT_MODEL = "gpt-realtime-2.1";
+const DEFAULT_VOICE = "marin";
+const DEFAULT_INSTRUCTIONS = "You are the live voice interface for this Agent Native app. Speak naturally, briefly, and conversationally. Use the available function tools when the user asks you to navigate or take an action. Never claim an action succeeded until its tool result confirms success. If a tool requires approval, explain that the user must approve it in chat.";
+const MAX_INSTRUCTIONS_CHARS = 16_000;
+const MAX_TOOL_DESCRIPTION_CHARS = 2_000;
+const MAX_TOOL_SCHEMA_CHARS = 64 * 1024;
+const MAX_APPROVAL_KEY_CHARS = 1_024;
+const REALTIME_TOOL_NAME = /^[A-Za-z0-9_-]{1,64}$/;
+const CALL_ID = /^[A-Za-z0-9_-]{1,256}$/;
+const SESSION_ID = /^[A-Za-z0-9_.:-]{1,256}$/;
+const BROWSER_TAB_ID = /^[A-Za-z0-9_-]{1,96}$/;
+function readSafeHeader(event, name) {
+    const value = getHeader(event, name);
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed || undefined;
+}
+function configuredIdentifier(value, fallback) {
+    const trimmed = value?.trim();
+    return trimmed && /^[A-Za-z0-9_.:-]{1,128}$/.test(trimmed)
+        ? trimmed
+        : fallback;
+}
+function truncate(value, maxChars) {
+    if (value.length <= maxChars)
+        return value;
+    return `${value.slice(0, maxChars)}\n\n...[truncated]`;
+}
+function sanitizeOutput(value, maxChars) {
+    let serialized;
+    try {
+        const redacted = redactSensitiveFields(value);
+        serialized =
+            typeof redacted === "string"
+                ? redacted
+                : (JSON.stringify(redacted, (_key, entry) => typeof entry === "bigint" ? entry.toString() : entry) ?? "null");
+    }
+    catch {
+        serialized = "[Unserializable tool result]";
+    }
+    return truncate(sanitizeToolErrorText(serialized), maxChars);
+}
+async function safeOpenAiErrorDetail(response, apiKey) {
+    const raw = await response.text().catch(() => "");
+    if (!raw)
+        return null;
+    let detail = raw;
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed.error && typeof parsed.error === "object") {
+            const error = parsed.error;
+            detail = [error.message, error.code, error.type]
+                .filter((value) => typeof value === "string" && value.trim())
+                .join(" · ");
+        }
+    }
+    catch {
+        // Plain-text upstream errors are sanitized below.
+    }
+    const redacted = sanitizeToolErrorText(detail).replaceAll(apiKey, "[REDACTED]");
+    return truncate(redacted, 500) || null;
+}
+function normalizeToolSchema(inputSchema) {
+    try {
+        const serialized = JSON.stringify(inputSchema);
+        if (!serialized || serialized.length > MAX_TOOL_SCHEMA_CHARS)
+            return null;
+        const parsed = JSON.parse(serialized);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function buildRealtimeTools(actions) {
+    const tools = [];
+    for (const tool of actionsToEngineTools(actions)) {
+        if (!REALTIME_TOOL_NAME.test(tool.name))
+            continue;
+        const parameters = normalizeToolSchema(tool.inputSchema);
+        if (!parameters)
+            continue;
+        tools.push({
+            type: "function",
+            name: tool.name,
+            description: truncate(sanitizeToolErrorText(tool.description || ""), MAX_TOOL_DESCRIPTION_CHARS),
+            parameters,
+        });
+    }
+    return tools;
+}
+function declaredBodyBytes(event) {
+    const raw = readSafeHeader(event, "content-length");
+    if (!raw)
+        return undefined;
+    const parsed = Number.parseInt(raw, 10);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;
+}
+async function readLimitedRawBody(event, maxBytes) {
+    const declared = declaredBodyBytes(event);
+    if (declared !== undefined && declared > maxBytes)
+        return "oversize";
+    const raw = await readRawBody(event, "utf8").catch(() => undefined);
+    if (raw == null)
+        return null;
+    const text = typeof raw === "string" ? raw : new TextDecoder().decode(raw);
+    return new TextEncoder().encode(text).byteLength > maxBytes
+        ? "oversize"
+        : text;
+}
+async function authenticateVoiceRequest(event, options) {
+    const session = await getSession(event).catch(() => null);
+    if (!session?.email)
+        return null;
+    const resolvedOrgId = options.resolveOrgId
+        ? await options.resolveOrgId(event)
+        : session.orgId;
+    const timezone = readSafeHeader(event, "x-user-timezone");
+    const rawBrowserTabId = readSafeHeader(event, "x-agent-native-browser-tab");
+    const browserTabId = rawBrowserTabId && BROWSER_TAB_ID.test(rawBrowserTabId)
+        ? rawBrowserTabId
+        : undefined;
+    return {
+        event,
+        userEmail: session.email,
+        ...(resolvedOrgId ? { orgId: resolvedOrgId } : {}),
+        ...(timezone && timezone.length < 64 ? { timezone } : {}),
+        ...(browserTabId ? { browserTabId } : {}),
+    };
+}
+async function buildInstructions(context, options) {
+    const dynamic = await options.getInstructions?.(context);
+    const appInstructions = dynamic ?? options.instructions;
+    if (!appInstructions?.trim())
+        return DEFAULT_INSTRUCTIONS;
+    return truncate(sanitizeToolErrorText(`${DEFAULT_INSTRUCTIONS}\n\n${appInstructions.trim()}`), MAX_INSTRUCTIONS_CHARS);
+}
+/**
+ * Hash the authenticated identity before sending it to OpenAI. The stable
+ * digest is useful for abuse detection without disclosing the user's email.
+ */
+export async function realtimeVoiceSafetyIdentifier(userEmail) {
+    const input = new TextEncoder().encode(`agent-native:${userEmail.trim().toLowerCase()}`);
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", input);
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function invalidMethod(event) {
+    setResponseStatus(event, 405);
+    return { error: "Method not allowed" };
+}
+function createSessionHandler(tools, options) {
+    return defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST")
+            return invalidMethod(event);
+        setResponseHeader(event, "Cache-Control", "no-store");
+        const auth = await authenticateVoiceRequest(event, options);
+        if (!auth) {
+            setResponseStatus(event, 401);
+            return { error: "Authentication required" };
+        }
+        const contentType = readSafeHeader(event, "content-type")?.toLowerCase();
+        if (!contentType?.includes("application/sdp")) {
+            setResponseStatus(event, 415);
+            return { error: "Expected Content-Type: application/sdp" };
+        }
+        const rawSdp = await readLimitedRawBody(event, REALTIME_VOICE_MAX_SDP_BYTES);
+        if (rawSdp === "oversize") {
+            setResponseStatus(event, 413);
+            return {
+                error: `SDP offer is too large (max ${REALTIME_VOICE_MAX_SDP_BYTES} bytes)`,
+            };
+        }
+        const sdp = rawSdp ?? "";
+        if (!sdp.trim()) {
+            setResponseStatus(event, 400);
+            return { error: "SDP offer is required" };
+        }
+        return runWithRequestContext({
+            userEmail: auth.userEmail,
+            orgId: auth.orgId,
+            timezone: auth.timezone,
+            run: auth.browserTabId
+                ? { browserTabId: auth.browserTabId }
+                : undefined,
+        }, async () => {
+            const apiKey = (await resolveSecret("OPENAI_API_KEY"))?.trim();
+            if (!apiKey) {
+                setResponseStatus(event, 400);
+                return {
+                    error: "Configure OPENAI_API_KEY in Settings to use realtime voice.",
+                };
+            }
+            const instructions = await buildInstructions(auth, options);
+            const session = {
+                type: "realtime",
+                model: configuredIdentifier(options.model, DEFAULT_MODEL),
+                instructions,
+                output_modalities: ["audio"],
+                audio: {
+                    input: {
+                        transcription: { model: "gpt-4o-mini-transcribe" },
+                        turn_detection: {
+                            type: "semantic_vad",
+                            create_response: true,
+                            interrupt_response: true,
+                            eagerness: "auto",
+                        },
+                    },
+                    output: {
+                        voice: configuredIdentifier(options.voice, DEFAULT_VOICE),
+                    },
+                },
+                tools,
+                tool_choice: "auto",
+            };
+            const form = new FormData();
+            form.set("sdp", sdp);
+            form.set("session", JSON.stringify(session));
+            let upstream;
+            try {
+                upstream = await fetch(OPENAI_REALTIME_CALLS_URL, {
+                    method: "POST",
+                    headers: {
+                        Authorization: `Bearer ${apiKey}`,
+                        "OpenAI-Safety-Identifier": await realtimeVoiceSafetyIdentifier(auth.userEmail),
+                    },
+                    body: form,
+                });
+            }
+            catch {
+                setResponseStatus(event, 502);
+                return { error: "Could not reach the OpenAI Realtime API" };
+            }
+            if (!upstream.ok) {
+                const detail = await safeOpenAiErrorDetail(upstream, apiKey);
+                setResponseStatus(event, 502);
+                return {
+                    error: `OpenAI rejected the realtime session (${upstream.status})${detail ? `: ${detail}` : ""}`,
+                };
+            }
+            const answerSdp = await upstream.text().catch(() => "");
+            if (!answerSdp.trim()) {
+                setResponseStatus(event, 502);
+                return { error: "OpenAI returned an empty realtime session answer" };
+            }
+            setResponseStatus(event, upstream.status);
+            setResponseHeader(event, "Content-Type", "application/sdp");
+            return answerSdp;
+        });
+    });
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function parseToolRequest(value) {
+    if (!isRecord(value))
+        return null;
+    const { name, args, callId, sessionId, browserTabId } = value;
+    if (typeof name !== "string" || !REALTIME_TOOL_NAME.test(name))
+        return null;
+    if (typeof callId !== "string" || !CALL_ID.test(callId))
+        return null;
+    if (!isRecord(args))
+        return null;
+    if (sessionId !== undefined &&
+        (typeof sessionId !== "string" || !SESSION_ID.test(sessionId))) {
+        return null;
+    }
+    if (browserTabId !== undefined &&
+        (typeof browserTabId !== "string" || !BROWSER_TAB_ID.test(browserTabId))) {
+        return null;
+    }
+    return {
+        name,
+        args,
+        callId,
+        ...(sessionId ? { sessionId } : {}),
+        ...(browserTabId ? { browserTabId } : {}),
+    };
+}
+function normalizeExecutionResult(result) {
+    const status = result?.status;
+    if (status !== "completed" &&
+        status !== "failed" &&
+        status !== "approval_required") {
+        throw new Error("Invalid realtime tool execution status");
+    }
+    const output = sanitizeOutput(result.output, REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS);
+    return {
+        status,
+        output,
+        ...(status === "approval_required" &&
+            typeof result.approvalKey === "string" &&
+            result.approvalKey.length > 0 &&
+            result.approvalKey.length <= MAX_APPROVAL_KEY_CHARS
+            ? { approvalKey: result.approvalKey }
+            : {}),
+    };
+}
+function createToolHandler(allowedToolNames, options) {
+    return defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST")
+            return invalidMethod(event);
+        setResponseHeader(event, "Cache-Control", "no-store");
+        const auth = await authenticateVoiceRequest(event, options);
+        if (!auth) {
+            setResponseStatus(event, 401);
+            return { error: "Authentication required" };
+        }
+        const contentType = readSafeHeader(event, "content-type")?.toLowerCase();
+        if (!contentType?.includes("application/json")) {
+            setResponseStatus(event, 415);
+            return { error: "Expected Content-Type: application/json" };
+        }
+        const raw = await readLimitedRawBody(event, REALTIME_VOICE_MAX_TOOL_BODY_BYTES);
+        if (raw === "oversize") {
+            setResponseStatus(event, 413);
+            return {
+                error: `Tool request is too large (max ${REALTIME_VOICE_MAX_TOOL_BODY_BYTES} bytes)`,
+            };
+        }
+        let parsedBody;
+        try {
+            parsedBody = JSON.parse(raw ?? "");
+        }
+        catch {
+            setResponseStatus(event, 400);
+            return { error: "Invalid realtime tool request" };
+        }
+        const request = parseToolRequest(parsedBody);
+        if (!request) {
+            setResponseStatus(event, 400);
+            return { error: "Invalid realtime tool request" };
+        }
+        if (!allowedToolNames.has(request.name)) {
+            setResponseStatus(event, 404);
+            return { error: "Unknown realtime voice tool" };
+        }
+        const browserTabId = request.browserTabId ?? auth.browserTabId;
+        const threadId = request.sessionId
+            ? `realtime:${request.sessionId}`
+            : `realtime:${request.callId}`;
+        return runWithRequestContext({
+            userEmail: auth.userEmail,
+            orgId: auth.orgId,
+            timezone: auth.timezone,
+            run: {
+                threadId,
+                ...(browserTabId ? { browserTabId } : {}),
+            },
+        }, async () => {
+            try {
+                const result = normalizeExecutionResult(await options.executeTool({
+                    event,
+                    userEmail: auth.userEmail,
+                    orgId: auth.orgId,
+                    ...request,
+                }));
+                return { callId: request.callId, ...result };
+            }
+            catch (error) {
+                setResponseStatus(event, 500);
+                return {
+                    callId: request.callId,
+                    status: "failed",
+                    output: truncate(sanitizeToolErrorValue(error) || "Tool execution failed", REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS),
+                };
+            }
+        });
+    });
+}
+/** Mount the authenticated OpenAI Realtime WebRTC and tool bridge routes. */
+export function mountRealtimeVoiceRoutes(nitroApp, actions, options) {
+    if (typeof options?.executeTool !== "function") {
+        throw new Error("mountRealtimeVoiceRoutes requires executeTool");
+    }
+    const tools = buildRealtimeTools(actions);
+    const allowedToolNames = new Set(tools.map((tool) => tool.name));
+    const app = getH3App(nitroApp);
+    app.use(REALTIME_VOICE_SESSION_PATH, createSessionHandler(tools, options));
+    app.use(REALTIME_VOICE_TOOL_PATH, createToolHandler(allowedToolNames, options));
+    return {
+        sessionPath: REALTIME_VOICE_SESSION_PATH,
+        toolPath: REALTIME_VOICE_TOOL_PATH,
+    };
+}
+//# sourceMappingURL=realtime-voice.js.map

package/dist/server/realtime-voice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"realtime-voice.js","sourceRoot":"","sources":["../../src/server/realtime-voice.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,CAAC,MAAM,2BAA2B,GACtC,uCAAuC,CAAC;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,oCAAoC,CAAC;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5D,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAC;AAE3D,MAAM,yBAAyB,GAAG,0CAA0C,CAAC;AAC7E,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,oBAAoB,GACxB,wVAAwV,CAAC;AAC3V,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,MAAM,OAAO,GAAG,wBAAwB,CAAC;AACzC,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAC9C,MAAM,cAAc,GAAG,uBAAuB,CAAC;AA4D/C,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAyB,EACzB,QAAgB;IAEhB,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QACxD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,QAAgB;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,oBAAoB,CAAC;AACzD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,QAAgB;IACtD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,UAAU;YACR,OAAO,QAAQ,KAAK,QAAQ;gBAC1B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CACrD,IAAI,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,8BAA8B,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAkB,EAClB,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE5B,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAIpB,CAAC;YACF,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;iBAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC5D,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,UAAU,CACvD,MAAM,EACN,YAAY,CACb,CAAC;IACF,OAAO,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAC1B,WAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAoC;IAEpC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,QAAQ,CACnB,qBAAqB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAC7C,0BAA0B,CAC3B;YACD,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,QAAgB;IAEhB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,QAAQ;QAAE,OAAO,UAAU,CAAC;IAErE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GACR,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAiB,CAAC,CAAC;IAC9E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ;QACzD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,OAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY;QACxC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAClB,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAC5E,MAAM,YAAY,GAChB,eAAe,IAAI,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC;QACrD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,KAAK;QACxB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAoC,EACpC,OAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;IACxD,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE;QAAE,OAAO,oBAAoB,CAAC;IAC1D,OAAO,QAAQ,CACb,qBAAqB,CACnB,GAAG,oBAAoB,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CACvD,EACD,sBAAsB,CACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,SAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,gBAAgB,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACjD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CACnC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA6B,EAC7B,OAAwC;IAExC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7D,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,EACL,4BAA4B,CAC7B,CAAC;QACF,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+BAA+B,4BAA4B,SAAS;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO,qBAAqB,CAC1B;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,YAAY;gBACpB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;gBACrC,CAAC,CAAC,SAAS;SACd,EACD,KAAK,IAAI,EAAE;YACT,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YAC/D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,6DAA6D;iBAChE,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC;gBACzD,YAAY;gBACZ,iBAAiB,EAAE,CAAC,OAAO,CAAC;gBAC5B,KAAK,EAAE;oBACL,KAAK,EAAE;wBACL,aAAa,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE;wBAClD,cAAc,EAAE;4BACd,IAAI,EAAE,cAAc;4BACpB,eAAe,EAAE,IAAI;4BACrB,kBAAkB,EAAE,IAAI;4BACxB,SAAS,EAAE,MAAM;yBAClB;qBACF;oBACD,MAAM,EAAE;wBACN,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC;qBAC1D;iBACF;gBACD,KAAK;gBACL,WAAW,EAAE,MAAM;aACpB,CAAC;YAEF,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAE7C,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,MAAM,EAAE;wBACjC,0BAA0B,EAAE,MAAM,6BAA6B,CAC7D,IAAI,CAAC,SAAS,CACf;qBACF;oBACD,IAAI,EAAE,IAAI;iBACX,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;YAC9D,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,yCAAyC,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;iBACjG,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC;YACvE,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1C,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;YAC5D,OAAO,SAAS,CAAC;QACnB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IAOtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC9D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IACE,SAAS,KAAK,SAAS;QACvB,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAwC;IAExC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAC9B,IACE,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,mBAAmB,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAC3B,MAAM,CAAC,MAAM,EACb,oCAAoC,CACrC,CAAC;IACF,OAAO;QACL,MAAM;QACN,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,mBAAmB;YAClC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAC7B,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,sBAAsB;YACjD,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;YACrC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,gBAAqC,EACrC,OAAwC;IAExC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7D,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAClC,KAAK,EACL,kCAAkC,CACnC,CAAC;QACF,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,kCAAkC,kCAAkC,SAAS;aACrF,CAAC;QACJ,CAAC;QAED,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;QAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS;YAChC,CAAC,CAAC,YAAY,OAAO,CAAC,SAAS,EAAE;YACjC,CAAC,CAAC,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,qBAAqB,CAC1B;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE;gBACH,QAAQ;gBACR,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C;SACF,EACD,KAAK,IAAI,EAAE;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,wBAAwB,CACrC,MAAM,OAAO,CAAC,WAAW,CAAC;oBACxB,KAAK;oBACL,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,GAAG,OAAO;iBACX,CAAC,CACH,CAAC;gBACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,QAAiB;oBACzB,MAAM,EAAE,QAAQ,CACd,sBAAsB,CAAC,KAAK,CAAC,IAAI,uBAAuB,EACxD,oCAAoC,CACrC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CACtC,QAAa,EACb,OAAoC,EACpC,OAAwC;IAExC,IAAI,OAAO,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,GAAG,CACL,wBAAwB,EACxB,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAC7C,CAAC;IACF,OAAO;QACL,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,wBAAwB;KACnC,CAAC;AACJ,CAAC","sourcesContent":["import {\n  defineEventHandler,\n  getHeader,\n  getMethod,\n  readRawBody,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport {\n  actionsToEngineTools,\n  type ActionEntry,\n} from \"../agent/production-agent.js\";\nimport {\n  redactSensitiveFields,\n  sanitizeToolErrorText,\n  sanitizeToolErrorValue,\n} from \"../agent/tool-error-redaction.js\";\nimport { getSession } from \"./auth.js\";\nimport { resolveSecret } from \"./credential-provider.js\";\nimport { getH3App } from \"./framework-request-handler.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nexport const REALTIME_VOICE_SESSION_PATH =\n  \"/_agent-native/realtime-voice/session\";\nexport const REALTIME_VOICE_TOOL_PATH = \"/_agent-native/realtime-voice/tool\";\nexport const REALTIME_VOICE_MAX_SDP_BYTES = 64 * 1024;\nexport const REALTIME_VOICE_MAX_TOOL_BODY_BYTES = 64 * 1024;\nexport const REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS = 16_000;\n\nconst OPENAI_REALTIME_CALLS_URL = \"https://api.openai.com/v1/realtime/calls\";\nconst DEFAULT_MODEL = \"gpt-realtime-2.1\";\nconst DEFAULT_VOICE = \"marin\";\nconst DEFAULT_INSTRUCTIONS =\n  \"You are the live voice interface for this Agent Native app. Speak naturally, briefly, and conversationally. Use the available function tools when the user asks you to navigate or take an action. Never claim an action succeeded until its tool result confirms success. If a tool requires approval, explain that the user must approve it in chat.\";\nconst MAX_INSTRUCTIONS_CHARS = 16_000;\nconst MAX_TOOL_DESCRIPTION_CHARS = 2_000;\nconst MAX_TOOL_SCHEMA_CHARS = 64 * 1024;\nconst MAX_APPROVAL_KEY_CHARS = 1_024;\nconst REALTIME_TOOL_NAME = /^[A-Za-z0-9_-]{1,64}$/;\nconst CALL_ID = /^[A-Za-z0-9_-]{1,256}$/;\nconst SESSION_ID = /^[A-Za-z0-9_.:-]{1,256}$/;\nconst BROWSER_TAB_ID = /^[A-Za-z0-9_-]{1,96}$/;\n\nexport interface RealtimeVoiceRequestContext {\n  event: H3Event;\n  userEmail: string;\n  orgId?: string;\n  browserTabId?: string;\n}\n\nexport interface RealtimeVoiceToolExecutionRequest extends RealtimeVoiceRequestContext {\n  name: string;\n  args: Record<string, unknown>;\n  callId: string;\n  sessionId?: string;\n}\n\nexport interface RealtimeVoiceToolExecutionResult {\n  status: \"completed\" | \"failed\" | \"approval_required\";\n  output: string;\n  approvalKey?: string;\n}\n\nexport interface MountRealtimeVoiceRoutesOptions {\n  /** Server-controlled model. Defaults to gpt-realtime-2.1. */\n  model?: string;\n  /** Server-controlled output voice. Defaults to marin. */\n  voice?: string;\n  /** Static app guidance appended to the safe default voice instructions. */\n  instructions?: string;\n  /** Per-request app/navigation guidance. It is sent only to OpenAI. */\n  getInstructions?: (\n    context: RealtimeVoiceRequestContext,\n  ) => string | null | undefined | Promise<string | null | undefined>;\n  /** Optional app-specific active-organization resolver. */\n  resolveOrgId?: (\n    event: H3Event,\n  ) => string | null | undefined | Promise<string | null | undefined>;\n  /**\n   * Central agent tool executor supplied by the agent-chat plugin. The executor\n   * owns validation, approval, journaling, timeout, mutation notification, and\n   * action-result normalization; this transport must not call ActionEntry.run.\n   */\n  executeTool: (\n    request: RealtimeVoiceToolExecutionRequest,\n  ) =>\n    | RealtimeVoiceToolExecutionResult\n    | Promise<RealtimeVoiceToolExecutionResult>;\n}\n\ninterface RealtimeFunctionTool {\n  type: \"function\";\n  name: string;\n  description: string;\n  parameters: Record<string, unknown>;\n}\n\ninterface AuthenticatedVoiceContext extends RealtimeVoiceRequestContext {\n  timezone?: string;\n}\n\nfunction readSafeHeader(event: H3Event, name: string): string | undefined {\n  const value = getHeader(event, name);\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed || undefined;\n}\n\nfunction configuredIdentifier(\n  value: string | undefined,\n  fallback: string,\n): string {\n  const trimmed = value?.trim();\n  return trimmed && /^[A-Za-z0-9_.:-]{1,128}$/.test(trimmed)\n    ? trimmed\n    : fallback;\n}\n\nfunction truncate(value: string, maxChars: number): string {\n  if (value.length <= maxChars) return value;\n  return `${value.slice(0, maxChars)}\\n\\n...[truncated]`;\n}\n\nfunction sanitizeOutput(value: unknown, maxChars: number): string {\n  let serialized: string;\n  try {\n    const redacted = redactSensitiveFields(value);\n    serialized =\n      typeof redacted === \"string\"\n        ? redacted\n        : (JSON.stringify(redacted, (_key, entry) =>\n            typeof entry === \"bigint\" ? entry.toString() : entry,\n          ) ?? \"null\");\n  } catch {\n    serialized = \"[Unserializable tool result]\";\n  }\n  return truncate(sanitizeToolErrorText(serialized), maxChars);\n}\n\nasync function safeOpenAiErrorDetail(\n  response: Response,\n  apiKey: string,\n): Promise<string | null> {\n  const raw = await response.text().catch(() => \"\");\n  if (!raw) return null;\n  let detail = raw;\n  try {\n    const parsed = JSON.parse(raw) as {\n      error?: { message?: unknown; code?: unknown; type?: unknown } | unknown;\n    };\n    if (parsed.error && typeof parsed.error === \"object\") {\n      const error = parsed.error as {\n        message?: unknown;\n        code?: unknown;\n        type?: unknown;\n      };\n      detail = [error.message, error.code, error.type]\n        .filter((value) => typeof value === \"string\" && value.trim())\n        .join(\" · \");\n    }\n  } catch {\n    // Plain-text upstream errors are sanitized below.\n  }\n  const redacted = sanitizeToolErrorText(detail).replaceAll(\n    apiKey,\n    \"[REDACTED]\",\n  );\n  return truncate(redacted, 500) || null;\n}\n\nfunction normalizeToolSchema(\n  inputSchema: unknown,\n): Record<string, unknown> | null {\n  try {\n    const serialized = JSON.stringify(inputSchema);\n    if (!serialized || serialized.length > MAX_TOOL_SCHEMA_CHARS) return null;\n    const parsed = JSON.parse(serialized) as unknown;\n    if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n      return null;\n    }\n    return parsed as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction buildRealtimeTools(\n  actions: Record<string, ActionEntry>,\n): RealtimeFunctionTool[] {\n  const tools: RealtimeFunctionTool[] = [];\n  for (const tool of actionsToEngineTools(actions)) {\n    if (!REALTIME_TOOL_NAME.test(tool.name)) continue;\n    const parameters = normalizeToolSchema(tool.inputSchema);\n    if (!parameters) continue;\n    tools.push({\n      type: \"function\",\n      name: tool.name,\n      description: truncate(\n        sanitizeToolErrorText(tool.description || \"\"),\n        MAX_TOOL_DESCRIPTION_CHARS,\n      ),\n      parameters,\n    });\n  }\n  return tools;\n}\n\nfunction declaredBodyBytes(event: H3Event): number | undefined {\n  const raw = readSafeHeader(event, \"content-length\");\n  if (!raw) return undefined;\n  const parsed = Number.parseInt(raw, 10);\n  return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;\n}\n\nasync function readLimitedRawBody(\n  event: H3Event,\n  maxBytes: number,\n): Promise<string | null | \"oversize\"> {\n  const declared = declaredBodyBytes(event);\n  if (declared !== undefined && declared > maxBytes) return \"oversize\";\n\n  const raw = await readRawBody(event, \"utf8\").catch(() => undefined);\n  if (raw == null) return null;\n  const text =\n    typeof raw === \"string\" ? raw : new TextDecoder().decode(raw as Uint8Array);\n  return new TextEncoder().encode(text).byteLength > maxBytes\n    ? \"oversize\"\n    : text;\n}\n\nasync function authenticateVoiceRequest(\n  event: H3Event,\n  options: MountRealtimeVoiceRoutesOptions,\n): Promise<AuthenticatedVoiceContext | null> {\n  const session = await getSession(event).catch(() => null);\n  if (!session?.email) return null;\n  const resolvedOrgId = options.resolveOrgId\n    ? await options.resolveOrgId(event)\n    : session.orgId;\n  const timezone = readSafeHeader(event, \"x-user-timezone\");\n  const rawBrowserTabId = readSafeHeader(event, \"x-agent-native-browser-tab\");\n  const browserTabId =\n    rawBrowserTabId && BROWSER_TAB_ID.test(rawBrowserTabId)\n      ? rawBrowserTabId\n      : undefined;\n  return {\n    event,\n    userEmail: session.email,\n    ...(resolvedOrgId ? { orgId: resolvedOrgId } : {}),\n    ...(timezone && timezone.length < 64 ? { timezone } : {}),\n    ...(browserTabId ? { browserTabId } : {}),\n  };\n}\n\nasync function buildInstructions(\n  context: RealtimeVoiceRequestContext,\n  options: MountRealtimeVoiceRoutesOptions,\n): Promise<string> {\n  const dynamic = await options.getInstructions?.(context);\n  const appInstructions = dynamic ?? options.instructions;\n  if (!appInstructions?.trim()) return DEFAULT_INSTRUCTIONS;\n  return truncate(\n    sanitizeToolErrorText(\n      `${DEFAULT_INSTRUCTIONS}\\n\\n${appInstructions.trim()}`,\n    ),\n    MAX_INSTRUCTIONS_CHARS,\n  );\n}\n\n/**\n * Hash the authenticated identity before sending it to OpenAI. The stable\n * digest is useful for abuse detection without disclosing the user's email.\n */\nexport async function realtimeVoiceSafetyIdentifier(\n  userEmail: string,\n): Promise<string> {\n  const input = new TextEncoder().encode(\n    `agent-native:${userEmail.trim().toLowerCase()}`,\n  );\n  const digest = await globalThis.crypto.subtle.digest(\"SHA-256\", input);\n  return Array.from(new Uint8Array(digest), (byte) =>\n    byte.toString(16).padStart(2, \"0\"),\n  ).join(\"\");\n}\n\nfunction invalidMethod(event: H3Event): { error: string } {\n  setResponseStatus(event, 405);\n  return { error: \"Method not allowed\" };\n}\n\nfunction createSessionHandler(\n  tools: RealtimeFunctionTool[],\n  options: MountRealtimeVoiceRoutesOptions,\n) {\n  return defineEventHandler(async (event: H3Event) => {\n    if (getMethod(event) !== \"POST\") return invalidMethod(event);\n    setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n    const auth = await authenticateVoiceRequest(event, options);\n    if (!auth) {\n      setResponseStatus(event, 401);\n      return { error: \"Authentication required\" };\n    }\n\n    const contentType = readSafeHeader(event, \"content-type\")?.toLowerCase();\n    if (!contentType?.includes(\"application/sdp\")) {\n      setResponseStatus(event, 415);\n      return { error: \"Expected Content-Type: application/sdp\" };\n    }\n\n    const rawSdp = await readLimitedRawBody(\n      event,\n      REALTIME_VOICE_MAX_SDP_BYTES,\n    );\n    if (rawSdp === \"oversize\") {\n      setResponseStatus(event, 413);\n      return {\n        error: `SDP offer is too large (max ${REALTIME_VOICE_MAX_SDP_BYTES} bytes)`,\n      };\n    }\n    const sdp = rawSdp ?? \"\";\n    if (!sdp.trim()) {\n      setResponseStatus(event, 400);\n      return { error: \"SDP offer is required\" };\n    }\n\n    return runWithRequestContext(\n      {\n        userEmail: auth.userEmail,\n        orgId: auth.orgId,\n        timezone: auth.timezone,\n        run: auth.browserTabId\n          ? { browserTabId: auth.browserTabId }\n          : undefined,\n      },\n      async () => {\n        const apiKey = (await resolveSecret(\"OPENAI_API_KEY\"))?.trim();\n        if (!apiKey) {\n          setResponseStatus(event, 400);\n          return {\n            error:\n              \"Configure OPENAI_API_KEY in Settings to use realtime voice.\",\n          };\n        }\n\n        const instructions = await buildInstructions(auth, options);\n        const session = {\n          type: \"realtime\",\n          model: configuredIdentifier(options.model, DEFAULT_MODEL),\n          instructions,\n          output_modalities: [\"audio\"],\n          audio: {\n            input: {\n              transcription: { model: \"gpt-4o-mini-transcribe\" },\n              turn_detection: {\n                type: \"semantic_vad\",\n                create_response: true,\n                interrupt_response: true,\n                eagerness: \"auto\",\n              },\n            },\n            output: {\n              voice: configuredIdentifier(options.voice, DEFAULT_VOICE),\n            },\n          },\n          tools,\n          tool_choice: \"auto\",\n        };\n\n        const form = new FormData();\n        form.set(\"sdp\", sdp);\n        form.set(\"session\", JSON.stringify(session));\n\n        let upstream: Response;\n        try {\n          upstream = await fetch(OPENAI_REALTIME_CALLS_URL, {\n            method: \"POST\",\n            headers: {\n              Authorization: `Bearer ${apiKey}`,\n              \"OpenAI-Safety-Identifier\": await realtimeVoiceSafetyIdentifier(\n                auth.userEmail,\n              ),\n            },\n            body: form,\n          });\n        } catch {\n          setResponseStatus(event, 502);\n          return { error: \"Could not reach the OpenAI Realtime API\" };\n        }\n\n        if (!upstream.ok) {\n          const detail = await safeOpenAiErrorDetail(upstream, apiKey);\n          setResponseStatus(event, 502);\n          return {\n            error: `OpenAI rejected the realtime session (${upstream.status})${detail ? `: ${detail}` : \"\"}`,\n          };\n        }\n\n        const answerSdp = await upstream.text().catch(() => \"\");\n        if (!answerSdp.trim()) {\n          setResponseStatus(event, 502);\n          return { error: \"OpenAI returned an empty realtime session answer\" };\n        }\n\n        setResponseStatus(event, upstream.status);\n        setResponseHeader(event, \"Content-Type\", \"application/sdp\");\n        return answerSdp;\n      },\n    );\n  });\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction parseToolRequest(value: unknown): {\n  name: string;\n  args: Record<string, unknown>;\n  callId: string;\n  sessionId?: string;\n  browserTabId?: string;\n} | null {\n  if (!isRecord(value)) return null;\n  const { name, args, callId, sessionId, browserTabId } = value;\n  if (typeof name !== \"string\" || !REALTIME_TOOL_NAME.test(name)) return null;\n  if (typeof callId !== \"string\" || !CALL_ID.test(callId)) return null;\n  if (!isRecord(args)) return null;\n  if (\n    sessionId !== undefined &&\n    (typeof sessionId !== \"string\" || !SESSION_ID.test(sessionId))\n  ) {\n    return null;\n  }\n  if (\n    browserTabId !== undefined &&\n    (typeof browserTabId !== \"string\" || !BROWSER_TAB_ID.test(browserTabId))\n  ) {\n    return null;\n  }\n  return {\n    name,\n    args,\n    callId,\n    ...(sessionId ? { sessionId } : {}),\n    ...(browserTabId ? { browserTabId } : {}),\n  };\n}\n\nfunction normalizeExecutionResult(\n  result: RealtimeVoiceToolExecutionResult,\n): RealtimeVoiceToolExecutionResult {\n  const status = result?.status;\n  if (\n    status !== \"completed\" &&\n    status !== \"failed\" &&\n    status !== \"approval_required\"\n  ) {\n    throw new Error(\"Invalid realtime tool execution status\");\n  }\n  const output = sanitizeOutput(\n    result.output,\n    REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS,\n  );\n  return {\n    status,\n    output,\n    ...(status === \"approval_required\" &&\n    typeof result.approvalKey === \"string\" &&\n    result.approvalKey.length > 0 &&\n    result.approvalKey.length <= MAX_APPROVAL_KEY_CHARS\n      ? { approvalKey: result.approvalKey }\n      : {}),\n  };\n}\n\nfunction createToolHandler(\n  allowedToolNames: ReadonlySet<string>,\n  options: MountRealtimeVoiceRoutesOptions,\n) {\n  return defineEventHandler(async (event: H3Event) => {\n    if (getMethod(event) !== \"POST\") return invalidMethod(event);\n    setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n    const auth = await authenticateVoiceRequest(event, options);\n    if (!auth) {\n      setResponseStatus(event, 401);\n      return { error: \"Authentication required\" };\n    }\n\n    const contentType = readSafeHeader(event, \"content-type\")?.toLowerCase();\n    if (!contentType?.includes(\"application/json\")) {\n      setResponseStatus(event, 415);\n      return { error: \"Expected Content-Type: application/json\" };\n    }\n\n    const raw = await readLimitedRawBody(\n      event,\n      REALTIME_VOICE_MAX_TOOL_BODY_BYTES,\n    );\n    if (raw === \"oversize\") {\n      setResponseStatus(event, 413);\n      return {\n        error: `Tool request is too large (max ${REALTIME_VOICE_MAX_TOOL_BODY_BYTES} bytes)`,\n      };\n    }\n\n    let parsedBody: unknown;\n    try {\n      parsedBody = JSON.parse(raw ?? \"\");\n    } catch {\n      setResponseStatus(event, 400);\n      return { error: \"Invalid realtime tool request\" };\n    }\n    const request = parseToolRequest(parsedBody);\n    if (!request) {\n      setResponseStatus(event, 400);\n      return { error: \"Invalid realtime tool request\" };\n    }\n    if (!allowedToolNames.has(request.name)) {\n      setResponseStatus(event, 404);\n      return { error: \"Unknown realtime voice tool\" };\n    }\n\n    const browserTabId = request.browserTabId ?? auth.browserTabId;\n    const threadId = request.sessionId\n      ? `realtime:${request.sessionId}`\n      : `realtime:${request.callId}`;\n    return runWithRequestContext(\n      {\n        userEmail: auth.userEmail,\n        orgId: auth.orgId,\n        timezone: auth.timezone,\n        run: {\n          threadId,\n          ...(browserTabId ? { browserTabId } : {}),\n        },\n      },\n      async () => {\n        try {\n          const result = normalizeExecutionResult(\n            await options.executeTool({\n              event,\n              userEmail: auth.userEmail,\n              orgId: auth.orgId,\n              ...request,\n            }),\n          );\n          return { callId: request.callId, ...result };\n        } catch (error) {\n          setResponseStatus(event, 500);\n          return {\n            callId: request.callId,\n            status: \"failed\" as const,\n            output: truncate(\n              sanitizeToolErrorValue(error) || \"Tool execution failed\",\n              REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS,\n            ),\n          };\n        }\n      },\n    );\n  });\n}\n\n/** Mount the authenticated OpenAI Realtime WebRTC and tool bridge routes. */\nexport function mountRealtimeVoiceRoutes(\n  nitroApp: any,\n  actions: Record<string, ActionEntry>,\n  options: MountRealtimeVoiceRoutesOptions,\n): { sessionPath: string; toolPath: string } {\n  if (typeof options?.executeTool !== \"function\") {\n    throw new Error(\"mountRealtimeVoiceRoutes requires executeTool\");\n  }\n\n  const tools = buildRealtimeTools(actions);\n  const allowedToolNames = new Set(tools.map((tool) => tool.name));\n  const app = getH3App(nitroApp);\n  app.use(REALTIME_VOICE_SESSION_PATH, createSessionHandler(tools, options));\n  app.use(\n    REALTIME_VOICE_TOOL_PATH,\n    createToolHandler(allowedToolNames, options),\n  );\n  return {\n    sessionPath: REALTIME_VOICE_SESSION_PATH,\n    toolPath: REALTIME_VOICE_TOOL_PATH,\n  };\n}\n"]}

package/dist/server/request-context.d.ts

@@ -113,6 +113,24 @@ export interface RequestContext {
         attempts?: number;
         incoming: import("../integrations/types.js").IncomingMessage;
         placeholderRef?: string;
+        installationId?: string;
+        scopeId?: string;
+        principalType?: "user" | "service";
+        lineage?: {
+            runId?: string;
+            parentTaskId?: string;
+            source?: {
+                kind: string;
+                platform?: string;
+                id: string;
+                url?: string;
+            };
+            network?: {
+                protocol: "a2a" | "mcp" | "provider-api";
+                id: string;
+                peer?: string;
+            };
+        };
     };
     /**
      * Mutable per-request agent-run state. Populated by the agent-chat plugin

package/dist/server/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA0DH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC;IACT,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,0BAA0B,EAAE,WAAW,CAAC;IACxD,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wDAAwD;IACxD,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpD,8DAA8D;IAC9D,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACzE,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CACtB,MAAM,EACN;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAC9C,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,OAAO,0BAA0B,EAAE,eAAe,CAAC;QAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF;;;OAGG;IACH,GAAG,CAAC,EAAE,iBAAiB,CAAC;CACzB;AAID,KAAK,sBAAsB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;AAiB5D;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,sBAAsB,GAC/B,MAAM,IAAI,CAMZ;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACvB,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAahB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAI9D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAOxD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAOvD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAOpD;AASD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,wBAAgB,4BAA4B,IACxC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,GAC1C,SAAS,CAEZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,IAAI,CAIP;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,SAAS,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,GAAG,SAAS,CAKvE"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA0DH;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,SAAS,CAAC,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC;IACT,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,OAAO,0BAA0B,EAAE,WAAW,CAAC;IACxD,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wDAAwD;IACxD,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACpD,8DAA8D;IAC9D,WAAW,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACzE,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CACtB,MAAM,EACN;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAC9C,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,OAAO,0BAA0B,EAAE,eAAe,CAAC;QAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACnC,OAAO,CAAC,EAAE;YACR,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,MAAM,CAAC,EAAE;gBACP,IAAI,EAAE,MAAM,CAAC;gBACb,QAAQ,CAAC,EAAE,MAAM,CAAC;gBAClB,EAAE,EAAE,MAAM,CAAC;gBACX,GAAG,CAAC,EAAE,MAAM,CAAC;aACd,CAAC;YACF,OAAO,CAAC,EAAE;gBACR,QAAQ,EAAE,KAAK,GAAG,KAAK,GAAG,cAAc,CAAC;gBACzC,EAAE,EAAE,MAAM,CAAC;gBACX,IAAI,CAAC,EAAE,MAAM,CAAC;aACf,CAAC;SACH,CAAC;KACH,CAAC;IACF;;;OAGG;IACH,GAAG,CAAC,EAAE,iBAAiB,CAAC;CACzB;AAID,KAAK,sBAAsB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,CAAC;AAiB5D;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,sBAAsB,GAC/B,MAAM,IAAI,CAMZ;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,GAAG,EAAE,cAAc,EACnB,EAAE,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GACvB,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAahB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAI9D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CAOxD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAOvD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAOpD;AASD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAEpD;AAED,wBAAgB,4BAA4B,IACxC,WAAW,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,GAC1C,SAAS,CAEZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,IAAI;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,IAAI,CAIP;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,iBAAiB,GAAG,SAAS,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,iBAAiB,GAAG,SAAS,CAKvE"}

package/dist/server/request-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,MAAM,sBAAsB;IACT,KAAK,GAAQ,EAAE,CAAC;IAEjC,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,GAAG,CAAI,KAAQ,EAAE,QAAiB;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,MAER,CAAC;YACd,IAAI,YAAY,IAAI,OAAO,YAAY,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC/D,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBACnB,CAAC,CAAM,CAAC;YACV,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB;IAC/B,IACE,OAAO,MAAM,KAAK,WAAW;QAC7B,OAAO,OAAO,KAAK,WAAW;QAC9B,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI;QACvB,OAAO,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,iBAExC,CAAC;AAChB,CAAC;AAED,MAAM,qBAAqB,GAAG,wBAAwB,EAAE,CAAC;AAEzD,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAsGD,MAAM,UAAU,GAAG,gCAAyC,CAAC;AAC7D,MAAM,aAAa,GAAG,sCAA+C,CAAC;AAMtE,MAAM,SAAS,GAAG,UAAsC,CAAC;AACzD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;IAC3B,SAAS,CAAC,UAAU,CAAC,GAAG,qBAAqB;QAC3C,CAAC,CAAC,IAAI,qBAAqB,EAAkB;QAC7C,CAAC,CAAC,IAAI,sBAAsB,EAAkB,CAAC;AACnD,CAAC;AACD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9B,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;AAChC,CAAC;AACD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAE,CAAC;AACnC,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAE,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgC;IAEhC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,GAAG,EAAE;QACV,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAmB,EACnB,EAAwB;IAExB,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;QACvB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,GAAG,CAAC,GAAG,CAAC,CAAC;gBACX,CAAC;gBAAC,MAAM,CAAC;oBACP,+CAA+C;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,UAAU,CAAC,kBAAkB,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,QAAQ;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,OAAO,UAAU,CAAC,iBAAiB,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,KAAK;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA+B;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC/C,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAA+B;IAClE,OAAO,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IAC/C,OAAO,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,mBAAmB,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,4BAA4B;IAG1C,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB;IAIlC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;IAC/B,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC","sourcesContent":["/**\n * Per-request context using AsyncLocalStorage.\n *\n * Replaces the unsafe pattern of mutating `process.env.AGENT_USER_EMAIL` /\n * `process.env.AGENT_ORG_ID` on every request. On Node.js (Netlify, self-hosted)\n * concurrent requests would overwrite each other's env vars. AsyncLocalStorage\n * gives each async call-chain its own isolated context.\n *\n * Supported on all deployment targets:\n * - Node.js (native)\n * - Cloudflare Workers (via nodejs_compat flag)\n * - Deno Deploy (via node:async_hooks compat)\n *\n * For CLI scripts that run outside a request context, the getters fall back to\n * process.env so existing `AGENT_USER_EMAIL=x pnpm action foo` invocations\n * continue to work.\n */\n\ntype AsyncLocalStorageLike<T> = {\n  getStore(): T | undefined;\n  run<R>(store: T, callback: () => R): R;\n};\n\ntype AsyncLocalStorageCtor = new <T>() => AsyncLocalStorageLike<T>;\n\nclass StackAsyncLocalStorage<T> implements AsyncLocalStorageLike<T> {\n  private readonly stack: T[] = [];\n\n  getStore(): T | undefined {\n    return this.stack.at(-1);\n  }\n\n  run<R>(store: T, callback: () => R): R {\n    this.stack.push(store);\n    try {\n      const result = callback();\n      const maybePromise = result as unknown as\n        | { finally?: (callback: () => void) => unknown }\n        | undefined;\n      if (maybePromise && typeof maybePromise.finally === \"function\") {\n        return maybePromise.finally(() => {\n          this.stack.pop();\n        }) as R;\n      }\n      this.stack.pop();\n      return result;\n    } catch (error) {\n      this.stack.pop();\n      throw error;\n    }\n  }\n}\n\nfunction getAsyncLocalStorageCtor(): AsyncLocalStorageCtor | undefined {\n  if (\n    typeof window !== \"undefined\" ||\n    typeof process === \"undefined\" ||\n    !process.versions?.node ||\n    typeof process.getBuiltinModule !== \"function\"\n  ) {\n    return undefined;\n  }\n  return process.getBuiltinModule(\"node:async_hooks\")?.AsyncLocalStorage as\n    | AsyncLocalStorageCtor\n    | undefined;\n}\n\nconst AsyncLocalStorageCtor = getAsyncLocalStorageCtor();\n\nfunction processEnv(name: string): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  return process.env?.[name];\n}\n\n/**\n * Per-request agent-run state. Lives on `RequestContext.run` so the\n * agent-chat plugin can populate fields as the run progresses (owner,\n * resolved API key, system prompt, engine, model, threadId) without\n * mutating module-scope `let` bindings — those leak across concurrent\n * requests on a single Node.js process.\n *\n * Mutated in-place by `prepareRun`, `onEngineResolved`, `onRunStart` so\n * tool factory closures (automation, fetch, team, builder-browser) read\n * the live per-request value via `getRequestRunContext()`.\n */\nexport interface RequestRunContext {\n  /** Origin of the current request (used by the builder-browser tool). */\n  requestOrigin?: string;\n  /** Stable browser tab id for tab-scoped app-state reads/writes. */\n  browserTabId?: string;\n  /** Resource scope for the current chat thread, e.g. the active deck. */\n  chatScope?: {\n    type: string;\n    id: string;\n    label?: string;\n  } | null;\n  /** Resolved owner email (set by prepareRun). */\n  owner?: string;\n  /** Owner's active Anthropic API key (set by prepareRun). */\n  userApiKey?: string;\n  /** Thread ID for the current run (set by onRunStart). */\n  threadId?: string;\n  /** System prompt actually sent to the model for this run. */\n  systemPrompt?: string;\n  /** Engine instance for this run (set by onEngineResolved). */\n  engine?: import(\"../agent/engine/types.js\").AgentEngine;\n  /** Model name for this run (set by onEngineResolved). */\n  model?: string;\n  /**\n   * True when this run is executing inside the durable background-function\n   * worker (the `_process-run` self-dispatch), not the synchronous foreground\n   * request. Template `extraContext` / system-prompt builders can read this to\n   * skip heavy, hang-prone enrichment (large data-dictionary DB reads, etc.)\n   * in the worker so it reliably claims its run within the setup budget.\n   */\n  isBackgroundWorker?: boolean;\n  /** Tool calls made so far in the current agent loop. */\n  toolCalls?: Array<{ name: string; input: unknown }>;\n  /** Tool results returned so far in the current agent loop. */\n  toolResults?: Array<{ name: string; content: string; isError: boolean }>;\n  /** Per-run fingerprints for large extension bodies already sent to the LLM. */\n  extensionContentReads?: Record<string, string>;\n  /** Per-run fingerprints for repeated tool-search calls already sent to the LLM. */\n  toolSearchReads?: Record<\n    string,\n    { totalTools: number; resultNames: string[] }\n  >;\n}\n\nexport interface RequestContext {\n  userEmail?: string;\n  userName?: string;\n  orgId?: string;\n  timezone?: string;\n  /**\n   * Set when code reads authenticated request context. Public SSR shell/data\n   * should not depend on this value; user/org-specific reads belong behind\n   * client-side actions/API after hydration.\n   */\n  authContextAccessed?: boolean;\n  /**\n   * Origin of the inbound request (e.g. `http://127.0.0.1:8100`). Set by the\n   * MCP mount from the request headers so actions that build externally\n   * fetchable URLs (e.g. design `export-coding-handoff`'s signed raw-code URL)\n   * resolve the real local-workspace origin instead of a prod/localhost\n   * fallback. Optional — absent on paths that don't populate it.\n   */\n  requestOrigin?: string;\n  /**\n   * True when this request is being processed by an integration-platform\n   * webhook (Slack, Telegram, etc.) where the function timeout is the\n   * binding constraint. Code that calls slow remote APIs can use this to apply\n   * tighter budgets on this path while leaving normal agent-chat callers\n   * (5+ min budget) unaffected.\n   */\n  isIntegrationCaller?: boolean;\n  /**\n   * Metadata for the currently-processing integration task. This lets tools\n   * that start long-running remote work persist a continuation that can update\n   * the originating platform thread after the current function budget ends.\n   */\n  integration?: {\n    taskId: string;\n    attempts?: number;\n    incoming: import(\"../integrations/types.js\").IncomingMessage;\n    placeholderRef?: string;\n  };\n  /**\n   * Mutable per-request agent-run state. Populated by the agent-chat plugin\n   * during a run; tool closures dereference it on each invocation.\n   */\n  run?: RequestRunContext;\n}\n\nconst GLOBAL_KEY = \"__agentNativeRequestContextAls\" as const;\nconst OBSERVERS_KEY = \"__agentNativeRequestContextObservers\" as const;\ntype RequestContextObserver = (ctx: RequestContext) => void;\ntype GlobalWithRequestContext = typeof globalThis & {\n  [GLOBAL_KEY]?: AsyncLocalStorageLike<RequestContext>;\n  [OBSERVERS_KEY]?: RequestContextObserver[];\n};\nconst globalRef = globalThis as GlobalWithRequestContext;\nif (!globalRef[GLOBAL_KEY]) {\n  globalRef[GLOBAL_KEY] = AsyncLocalStorageCtor\n    ? new AsyncLocalStorageCtor<RequestContext>()\n    : new StackAsyncLocalStorage<RequestContext>();\n}\nif (!globalRef[OBSERVERS_KEY]) {\n  globalRef[OBSERVERS_KEY] = [];\n}\nconst als = globalRef[GLOBAL_KEY]!;\nconst observers = globalRef[OBSERVERS_KEY]!;\n\n/**\n * Register a callback fired every time `runWithRequestContext` enters a new\n * scope. The hook runs INSIDE the AsyncLocalStorage scope, so observability\n * helpers that read the current isolation scope (e.g. Sentry) attach to the\n * right per-request context.\n *\n * Returned function unregisters the observer. Observers must never throw —\n * any error is swallowed so a misbehaving observer can't break the request\n * path.\n */\nexport function addRequestContextObserver(\n  observer: RequestContextObserver,\n): () => void {\n  observers.push(observer);\n  return () => {\n    const i = observers.indexOf(observer);\n    if (i !== -1) observers.splice(i, 1);\n  };\n}\n\n/**\n * Run a callback within a per-request context. The context is available to all\n * async operations spawned from `fn` via `getRequestUserEmail()` / `getRequestOrgId()`.\n *\n * Any registered `addRequestContextObserver` callbacks fire inside the new\n * scope before `fn` runs, so observability code can pin user/org info onto\n * isolation-scoped backends (Sentry, OpenTelemetry, etc.).\n */\nexport function runWithRequestContext<T>(\n  ctx: RequestContext,\n  fn: () => T | Promise<T>,\n): T | Promise<T> {\n  return als.run(ctx, () => {\n    if (observers.length > 0) {\n      for (const obs of observers) {\n        try {\n          obs(ctx);\n        } catch {\n          // Observers must never break the request path.\n        }\n      }\n    }\n    return fn();\n  });\n}\n\n/**\n * Return the active request context, if this call chain is running under one.\n *\n * This is intentionally distinct from `getRequestUserEmail()`: callers that\n * have an active context with no authenticated user must not fall through to\n * process-wide CLI fallbacks such as `AGENT_USER_EMAIL` or \"latest session\".\n */\nexport function getRequestContext(): RequestContext | undefined {\n  const store = als.getStore();\n  markAuthContextAccess(store);\n  return store;\n}\n\n/**\n * True when AsyncLocalStorage has an active context for this call chain.\n * Useful for helpers that support both HTTP requests and standalone CLI runs.\n */\nexport function hasRequestContext(): boolean {\n  return als.getStore() !== undefined;\n}\n\n/**\n * Get the current request's user email.\n *\n * - If a request context exists (HTTP/A2A path), returns its `userEmail` —\n *   even when that value is `undefined`. The env fallback MUST NOT fire here:\n *   a stale process-wide `AGENT_USER_EMAIL` from a CLI run or previous bug\n *   would leak into an unauthenticated A2A/API call (e.g. unsigned or API-key\n *   modes where `runWithRequestContext({ userEmail: undefined })` is used).\n * - Only when there is NO request context (CLI scripts) do we fall back to\n *   `process.env.AGENT_USER_EMAIL`.\n */\nexport function getRequestUserEmail(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.userEmail) markAuthContextAccess(store);\n    return store.userEmail;\n  }\n  return processEnv(\"AGENT_USER_EMAIL\");\n}\n\n/**\n * Get the current request's display name, when the auth provider supplied one.\n *\n * The same request-context fallback rules as `getRequestUserEmail()` apply:\n * HTTP/A2A calls only read AsyncLocalStorage, while CLI scripts may opt in via\n * `AGENT_USER_NAME`.\n */\nexport function getRequestUserName(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.userName) markAuthContextAccess(store);\n    return store.userName;\n  }\n  return processEnv(\"AGENT_USER_NAME\");\n}\n\n/**\n * Get the current request's org ID.\n *\n * Same store-aware semantics as `getRequestUserEmail()` — env fallback is\n * CLI-only, so a request that explicitly has no org doesn't inherit a stale\n * `process.env.AGENT_ORG_ID` from a prior request on the same Lambda instance.\n */\nexport function getRequestOrgId(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.orgId) markAuthContextAccess(store);\n    return store.orgId;\n  }\n  return processEnv(\"AGENT_ORG_ID\");\n}\n\nfunction markAuthContextAccess(ctx: RequestContext | undefined) {\n  if (!ctx) return;\n  if (ctx.userEmail || ctx.userName || ctx.orgId) {\n    ctx.authContextAccessed = true;\n  }\n}\n\nexport function hasAuthContextAccess(ctx: RequestContext | undefined): boolean {\n  return Boolean(ctx?.authContextAccessed);\n}\n\n/**\n * Get the current request's IANA timezone (e.g. \"America/Los_Angeles\").\n * The UI sends this via the `x-user-timezone` header on every action call, and\n * the agent chat plugin propagates it into the request context so that\n * agent-initiated tool calls also see the user's timezone. Falls back to\n * `process.env.AGENT_USER_TIMEZONE` only for CLI scripts (no request context).\n */\nexport function getRequestTimezone(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) return store.timezone;\n  return processEnv(\"AGENT_USER_TIMEZONE\");\n}\n\n/**\n * Returns true when this request is on an integration-platform path (Slack,\n * Telegram, etc.) — i.e. we're inside the integration plugin's processor\n * function and the platform's deliver-by deadline plus the host's function\n * timeout are the binding budget. Non-integration callers (CLI, normal\n * agent chat) should treat this as `false`.\n */\nexport function isIntegrationCallerRequest(): boolean {\n  return als.getStore()?.isIntegrationCaller === true;\n}\n\nexport function getIntegrationRequestContext():\n  | NonNullable<RequestContext[\"integration\"]>\n  | undefined {\n  return als.getStore()?.integration;\n}\n\n/**\n * Convenience: returns `{ userEmail, orgId }` from the active request context,\n * suitable for passing to `resolveCredential(key, ctx)`. Returns `null` when\n * no user is associated with the call (e.g. an unauthenticated public route).\n *\n * For framework actions auto-mounted at `/_agent-native/actions/...` this is\n * always populated because action-routes wraps every invocation in\n * `runWithRequestContext`. For hand-written `/api/*` routes the calling code\n * is responsible for setting up the context (see `runWithRequestContext`).\n */\nexport function getCredentialContext(): {\n  userEmail: string;\n  orgId: string | null;\n} | null {\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) return null;\n  return { userEmail, orgId: getRequestOrgId() ?? null };\n}\n\n/**\n * Get the active request's mutable agent-run state. Returns `undefined` when\n * called outside an agent run (e.g. before `prepareRun` or in a non-agent\n * code path). Callers must tolerate the field absence; use the helper\n * `requireRequestRunContext()` if missing context is a programming error.\n */\nexport function getRequestRunContext(): RequestRunContext | undefined {\n  const store = als.getStore();\n  if (!store) return undefined;\n  return store.run;\n}\n\n/**\n * Ensure a `RequestRunContext` exists on the active request store and\n * return it. Used by the agent-chat handler to attach run state once it\n * starts processing a chat request. Returns `undefined` if there is no\n * active request store (caller should not be invoking this outside ALS).\n */\nexport function ensureRequestRunContext(): RequestRunContext | undefined {\n  const store = als.getStore();\n  if (!store) return undefined;\n  if (!store.run) store.run = {};\n  return store.run;\n}\n"]}
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,MAAM,sBAAsB;IACT,KAAK,GAAQ,EAAE,CAAC;IAEjC,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAED,GAAG,CAAI,KAAQ,EAAE,QAAiB;QAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,MAER,CAAC;YACd,IAAI,YAAY,IAAI,OAAO,YAAY,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC/D,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBACnB,CAAC,CAAM,CAAC;YACV,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,SAAS,wBAAwB;IAC/B,IACE,OAAO,MAAM,KAAK,WAAW;QAC7B,OAAO,OAAO,KAAK,WAAW;QAC9B,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI;QACvB,OAAO,OAAO,CAAC,gBAAgB,KAAK,UAAU,EAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,EAAE,iBAExC,CAAC;AAChB,CAAC;AAED,MAAM,qBAAqB,GAAG,wBAAwB,EAAE,CAAC;AAEzD,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAwHD,MAAM,UAAU,GAAG,gCAAyC,CAAC;AAC7D,MAAM,aAAa,GAAG,sCAA+C,CAAC;AAMtE,MAAM,SAAS,GAAG,UAAsC,CAAC;AACzD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;IAC3B,SAAS,CAAC,UAAU,CAAC,GAAG,qBAAqB;QAC3C,CAAC,CAAC,IAAI,qBAAqB,EAAkB;QAC7C,CAAC,CAAC,IAAI,sBAAsB,EAAkB,CAAC;AACnD,CAAC;AACD,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9B,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;AAChC,CAAC;AACD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAE,CAAC;AACnC,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAE,CAAC;AAE5C;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgC;IAEhC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,GAAG,EAAE;QACV,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAmB,EACnB,EAAwB;IAExB,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;QACvB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,GAAG,CAAC,GAAG,CAAC,CAAC;gBACX,CAAC;gBAAC,MAAM,CAAC;oBACP,+CAA+C;gBACjD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,SAAS;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,SAAS,CAAC;IACzB,CAAC;IACD,OAAO,UAAU,CAAC,kBAAkB,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,QAAQ;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC;IACD,OAAO,UAAU,CAAC,iBAAiB,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,KAAK;YAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,UAAU,CAAC,cAAc,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,qBAAqB,CAAC,GAA+B;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC/C,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAA+B;IAClE,OAAO,OAAO,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IAC/C,OAAO,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,mBAAmB,KAAK,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,4BAA4B;IAG1C,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB;IAIlC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;IAC/B,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC","sourcesContent":["/**\n * Per-request context using AsyncLocalStorage.\n *\n * Replaces the unsafe pattern of mutating `process.env.AGENT_USER_EMAIL` /\n * `process.env.AGENT_ORG_ID` on every request. On Node.js (Netlify, self-hosted)\n * concurrent requests would overwrite each other's env vars. AsyncLocalStorage\n * gives each async call-chain its own isolated context.\n *\n * Supported on all deployment targets:\n * - Node.js (native)\n * - Cloudflare Workers (via nodejs_compat flag)\n * - Deno Deploy (via node:async_hooks compat)\n *\n * For CLI scripts that run outside a request context, the getters fall back to\n * process.env so existing `AGENT_USER_EMAIL=x pnpm action foo` invocations\n * continue to work.\n */\n\ntype AsyncLocalStorageLike<T> = {\n  getStore(): T | undefined;\n  run<R>(store: T, callback: () => R): R;\n};\n\ntype AsyncLocalStorageCtor = new <T>() => AsyncLocalStorageLike<T>;\n\nclass StackAsyncLocalStorage<T> implements AsyncLocalStorageLike<T> {\n  private readonly stack: T[] = [];\n\n  getStore(): T | undefined {\n    return this.stack.at(-1);\n  }\n\n  run<R>(store: T, callback: () => R): R {\n    this.stack.push(store);\n    try {\n      const result = callback();\n      const maybePromise = result as unknown as\n        | { finally?: (callback: () => void) => unknown }\n        | undefined;\n      if (maybePromise && typeof maybePromise.finally === \"function\") {\n        return maybePromise.finally(() => {\n          this.stack.pop();\n        }) as R;\n      }\n      this.stack.pop();\n      return result;\n    } catch (error) {\n      this.stack.pop();\n      throw error;\n    }\n  }\n}\n\nfunction getAsyncLocalStorageCtor(): AsyncLocalStorageCtor | undefined {\n  if (\n    typeof window !== \"undefined\" ||\n    typeof process === \"undefined\" ||\n    !process.versions?.node ||\n    typeof process.getBuiltinModule !== \"function\"\n  ) {\n    return undefined;\n  }\n  return process.getBuiltinModule(\"node:async_hooks\")?.AsyncLocalStorage as\n    | AsyncLocalStorageCtor\n    | undefined;\n}\n\nconst AsyncLocalStorageCtor = getAsyncLocalStorageCtor();\n\nfunction processEnv(name: string): string | undefined {\n  if (typeof process === \"undefined\") return undefined;\n  return process.env?.[name];\n}\n\n/**\n * Per-request agent-run state. Lives on `RequestContext.run` so the\n * agent-chat plugin can populate fields as the run progresses (owner,\n * resolved API key, system prompt, engine, model, threadId) without\n * mutating module-scope `let` bindings — those leak across concurrent\n * requests on a single Node.js process.\n *\n * Mutated in-place by `prepareRun`, `onEngineResolved`, `onRunStart` so\n * tool factory closures (automation, fetch, team, builder-browser) read\n * the live per-request value via `getRequestRunContext()`.\n */\nexport interface RequestRunContext {\n  /** Origin of the current request (used by the builder-browser tool). */\n  requestOrigin?: string;\n  /** Stable browser tab id for tab-scoped app-state reads/writes. */\n  browserTabId?: string;\n  /** Resource scope for the current chat thread, e.g. the active deck. */\n  chatScope?: {\n    type: string;\n    id: string;\n    label?: string;\n  } | null;\n  /** Resolved owner email (set by prepareRun). */\n  owner?: string;\n  /** Owner's active Anthropic API key (set by prepareRun). */\n  userApiKey?: string;\n  /** Thread ID for the current run (set by onRunStart). */\n  threadId?: string;\n  /** System prompt actually sent to the model for this run. */\n  systemPrompt?: string;\n  /** Engine instance for this run (set by onEngineResolved). */\n  engine?: import(\"../agent/engine/types.js\").AgentEngine;\n  /** Model name for this run (set by onEngineResolved). */\n  model?: string;\n  /**\n   * True when this run is executing inside the durable background-function\n   * worker (the `_process-run` self-dispatch), not the synchronous foreground\n   * request. Template `extraContext` / system-prompt builders can read this to\n   * skip heavy, hang-prone enrichment (large data-dictionary DB reads, etc.)\n   * in the worker so it reliably claims its run within the setup budget.\n   */\n  isBackgroundWorker?: boolean;\n  /** Tool calls made so far in the current agent loop. */\n  toolCalls?: Array<{ name: string; input: unknown }>;\n  /** Tool results returned so far in the current agent loop. */\n  toolResults?: Array<{ name: string; content: string; isError: boolean }>;\n  /** Per-run fingerprints for large extension bodies already sent to the LLM. */\n  extensionContentReads?: Record<string, string>;\n  /** Per-run fingerprints for repeated tool-search calls already sent to the LLM. */\n  toolSearchReads?: Record<\n    string,\n    { totalTools: number; resultNames: string[] }\n  >;\n}\n\nexport interface RequestContext {\n  userEmail?: string;\n  userName?: string;\n  orgId?: string;\n  timezone?: string;\n  /**\n   * Set when code reads authenticated request context. Public SSR shell/data\n   * should not depend on this value; user/org-specific reads belong behind\n   * client-side actions/API after hydration.\n   */\n  authContextAccessed?: boolean;\n  /**\n   * Origin of the inbound request (e.g. `http://127.0.0.1:8100`). Set by the\n   * MCP mount from the request headers so actions that build externally\n   * fetchable URLs (e.g. design `export-coding-handoff`'s signed raw-code URL)\n   * resolve the real local-workspace origin instead of a prod/localhost\n   * fallback. Optional — absent on paths that don't populate it.\n   */\n  requestOrigin?: string;\n  /**\n   * True when this request is being processed by an integration-platform\n   * webhook (Slack, Telegram, etc.) where the function timeout is the\n   * binding constraint. Code that calls slow remote APIs can use this to apply\n   * tighter budgets on this path while leaving normal agent-chat callers\n   * (5+ min budget) unaffected.\n   */\n  isIntegrationCaller?: boolean;\n  /**\n   * Metadata for the currently-processing integration task. This lets tools\n   * that start long-running remote work persist a continuation that can update\n   * the originating platform thread after the current function budget ends.\n   */\n  integration?: {\n    taskId: string;\n    attempts?: number;\n    incoming: import(\"../integrations/types.js\").IncomingMessage;\n    placeholderRef?: string;\n    installationId?: string;\n    scopeId?: string;\n    principalType?: \"user\" | \"service\";\n    lineage?: {\n      runId?: string;\n      parentTaskId?: string;\n      source?: {\n        kind: string;\n        platform?: string;\n        id: string;\n        url?: string;\n      };\n      network?: {\n        protocol: \"a2a\" | \"mcp\" | \"provider-api\";\n        id: string;\n        peer?: string;\n      };\n    };\n  };\n  /**\n   * Mutable per-request agent-run state. Populated by the agent-chat plugin\n   * during a run; tool closures dereference it on each invocation.\n   */\n  run?: RequestRunContext;\n}\n\nconst GLOBAL_KEY = \"__agentNativeRequestContextAls\" as const;\nconst OBSERVERS_KEY = \"__agentNativeRequestContextObservers\" as const;\ntype RequestContextObserver = (ctx: RequestContext) => void;\ntype GlobalWithRequestContext = typeof globalThis & {\n  [GLOBAL_KEY]?: AsyncLocalStorageLike<RequestContext>;\n  [OBSERVERS_KEY]?: RequestContextObserver[];\n};\nconst globalRef = globalThis as GlobalWithRequestContext;\nif (!globalRef[GLOBAL_KEY]) {\n  globalRef[GLOBAL_KEY] = AsyncLocalStorageCtor\n    ? new AsyncLocalStorageCtor<RequestContext>()\n    : new StackAsyncLocalStorage<RequestContext>();\n}\nif (!globalRef[OBSERVERS_KEY]) {\n  globalRef[OBSERVERS_KEY] = [];\n}\nconst als = globalRef[GLOBAL_KEY]!;\nconst observers = globalRef[OBSERVERS_KEY]!;\n\n/**\n * Register a callback fired every time `runWithRequestContext` enters a new\n * scope. The hook runs INSIDE the AsyncLocalStorage scope, so observability\n * helpers that read the current isolation scope (e.g. Sentry) attach to the\n * right per-request context.\n *\n * Returned function unregisters the observer. Observers must never throw —\n * any error is swallowed so a misbehaving observer can't break the request\n * path.\n */\nexport function addRequestContextObserver(\n  observer: RequestContextObserver,\n): () => void {\n  observers.push(observer);\n  return () => {\n    const i = observers.indexOf(observer);\n    if (i !== -1) observers.splice(i, 1);\n  };\n}\n\n/**\n * Run a callback within a per-request context. The context is available to all\n * async operations spawned from `fn` via `getRequestUserEmail()` / `getRequestOrgId()`.\n *\n * Any registered `addRequestContextObserver` callbacks fire inside the new\n * scope before `fn` runs, so observability code can pin user/org info onto\n * isolation-scoped backends (Sentry, OpenTelemetry, etc.).\n */\nexport function runWithRequestContext<T>(\n  ctx: RequestContext,\n  fn: () => T | Promise<T>,\n): T | Promise<T> {\n  return als.run(ctx, () => {\n    if (observers.length > 0) {\n      for (const obs of observers) {\n        try {\n          obs(ctx);\n        } catch {\n          // Observers must never break the request path.\n        }\n      }\n    }\n    return fn();\n  });\n}\n\n/**\n * Return the active request context, if this call chain is running under one.\n *\n * This is intentionally distinct from `getRequestUserEmail()`: callers that\n * have an active context with no authenticated user must not fall through to\n * process-wide CLI fallbacks such as `AGENT_USER_EMAIL` or \"latest session\".\n */\nexport function getRequestContext(): RequestContext | undefined {\n  const store = als.getStore();\n  markAuthContextAccess(store);\n  return store;\n}\n\n/**\n * True when AsyncLocalStorage has an active context for this call chain.\n * Useful for helpers that support both HTTP requests and standalone CLI runs.\n */\nexport function hasRequestContext(): boolean {\n  return als.getStore() !== undefined;\n}\n\n/**\n * Get the current request's user email.\n *\n * - If a request context exists (HTTP/A2A path), returns its `userEmail` —\n *   even when that value is `undefined`. The env fallback MUST NOT fire here:\n *   a stale process-wide `AGENT_USER_EMAIL` from a CLI run or previous bug\n *   would leak into an unauthenticated A2A/API call (e.g. unsigned or API-key\n *   modes where `runWithRequestContext({ userEmail: undefined })` is used).\n * - Only when there is NO request context (CLI scripts) do we fall back to\n *   `process.env.AGENT_USER_EMAIL`.\n */\nexport function getRequestUserEmail(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.userEmail) markAuthContextAccess(store);\n    return store.userEmail;\n  }\n  return processEnv(\"AGENT_USER_EMAIL\");\n}\n\n/**\n * Get the current request's display name, when the auth provider supplied one.\n *\n * The same request-context fallback rules as `getRequestUserEmail()` apply:\n * HTTP/A2A calls only read AsyncLocalStorage, while CLI scripts may opt in via\n * `AGENT_USER_NAME`.\n */\nexport function getRequestUserName(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.userName) markAuthContextAccess(store);\n    return store.userName;\n  }\n  return processEnv(\"AGENT_USER_NAME\");\n}\n\n/**\n * Get the current request's org ID.\n *\n * Same store-aware semantics as `getRequestUserEmail()` — env fallback is\n * CLI-only, so a request that explicitly has no org doesn't inherit a stale\n * `process.env.AGENT_ORG_ID` from a prior request on the same Lambda instance.\n */\nexport function getRequestOrgId(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) {\n    if (store.orgId) markAuthContextAccess(store);\n    return store.orgId;\n  }\n  return processEnv(\"AGENT_ORG_ID\");\n}\n\nfunction markAuthContextAccess(ctx: RequestContext | undefined) {\n  if (!ctx) return;\n  if (ctx.userEmail || ctx.userName || ctx.orgId) {\n    ctx.authContextAccessed = true;\n  }\n}\n\nexport function hasAuthContextAccess(ctx: RequestContext | undefined): boolean {\n  return Boolean(ctx?.authContextAccessed);\n}\n\n/**\n * Get the current request's IANA timezone (e.g. \"America/Los_Angeles\").\n * The UI sends this via the `x-user-timezone` header on every action call, and\n * the agent chat plugin propagates it into the request context so that\n * agent-initiated tool calls also see the user's timezone. Falls back to\n * `process.env.AGENT_USER_TIMEZONE` only for CLI scripts (no request context).\n */\nexport function getRequestTimezone(): string | undefined {\n  const store = als.getStore();\n  if (store !== undefined) return store.timezone;\n  return processEnv(\"AGENT_USER_TIMEZONE\");\n}\n\n/**\n * Returns true when this request is on an integration-platform path (Slack,\n * Telegram, etc.) — i.e. we're inside the integration plugin's processor\n * function and the platform's deliver-by deadline plus the host's function\n * timeout are the binding budget. Non-integration callers (CLI, normal\n * agent chat) should treat this as `false`.\n */\nexport function isIntegrationCallerRequest(): boolean {\n  return als.getStore()?.isIntegrationCaller === true;\n}\n\nexport function getIntegrationRequestContext():\n  | NonNullable<RequestContext[\"integration\"]>\n  | undefined {\n  return als.getStore()?.integration;\n}\n\n/**\n * Convenience: returns `{ userEmail, orgId }` from the active request context,\n * suitable for passing to `resolveCredential(key, ctx)`. Returns `null` when\n * no user is associated with the call (e.g. an unauthenticated public route).\n *\n * For framework actions auto-mounted at `/_agent-native/actions/...` this is\n * always populated because action-routes wraps every invocation in\n * `runWithRequestContext`. For hand-written `/api/*` routes the calling code\n * is responsible for setting up the context (see `runWithRequestContext`).\n */\nexport function getCredentialContext(): {\n  userEmail: string;\n  orgId: string | null;\n} | null {\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) return null;\n  return { userEmail, orgId: getRequestOrgId() ?? null };\n}\n\n/**\n * Get the active request's mutable agent-run state. Returns `undefined` when\n * called outside an agent run (e.g. before `prepareRun` or in a non-agent\n * code path). Callers must tolerate the field absence; use the helper\n * `requireRequestRunContext()` if missing context is a programming error.\n */\nexport function getRequestRunContext(): RequestRunContext | undefined {\n  const store = als.getStore();\n  if (!store) return undefined;\n  return store.run;\n}\n\n/**\n * Ensure a `RequestRunContext` exists on the active request store and\n * return it. Used by the agent-chat handler to attach run state once it\n * starts processing a chat request. Returns `undefined` if there is no\n * active request store (caller should not be invoking this outside ALS).\n */\nexport function ensureRequestRunContext(): RequestRunContext | undefined {\n  const store = als.getStore();\n  if (!store) return undefined;\n  if (!store.run) store.run = {};\n  return store.run;\n}\n"]}

package/dist/server/social-og-image.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"social-og-image.d.ts","sourceRoot":"","sources":["../../src/server/social-og-image.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAaZ,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,mCAAmC,2EAC0B,CAAC;AAC3E,eAAO,MAAM,2CAA2C,oFAC2B,CAAC;AAyNpF,wBAAgB,gCAAgC,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAyBxE;AAqBD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAUtE;AAED,wBAAgB,2BAA2B,CACzC,KAAK,GAAE,uBAA4B,GAClC,MAAM,CA2DR;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,GAAE,uBAA4B,GAClC,OAAO,CAAC,UAAU,CAAC,CAuBrB;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,SAAc,GACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,uBAA4B,2FAsCtC"}
+{"version":3,"file":"social-og-image.d.ts","sourceRoot":"","sources":["../../src/server/social-og-image.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAaZ,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,mCAAmC,2EAC0B,CAAC;AAC3E,eAAO,MAAM,2CAA2C,oFAC2B,CAAC;AA0NpF,wBAAgB,gCAAgC,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAyBxE;AAqBD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAUtE;AAED,wBAAgB,2BAA2B,CACzC,KAAK,GAAE,uBAA4B,GAClC,MAAM,CA2DR;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,GAAE,uBAA4B,GAClC,OAAO,CAAC,UAAU,CAAC,CAuBrB;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,SAAc,GACxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYxB;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,uBAA4B,2FAsCtC"}

package/dist/server/social-og-image.js

@@ -12,6 +12,7 @@ const BRAND_BLUE = "#00B5FF";
 const BRAND_MINT = "#48FFE4";
 const BG = "#000000";
 const FG = "#f5f5f5";
+const GRID_SIZE = 48;
 const DEFAULT_FONT_FAMILY = `${OG_FONT_FAMILY}, Arial, Helvetica, system-ui, sans-serif`;
 const ARABIC_FONT_FAMILY = `${OG_ARABIC_FONT_FAMILY}, ${OG_FONT_FAMILY}, Arial, Helvetica, system-ui, sans-serif`;
 const DEFAULT_ACCENT_TEXT = "100% free and open source";
@@ -218,8 +219,8 @@ export function renderAgentNativeOgImageSvg(input = {}) {
       <stop stop-color="${BRAND_BLUE}"/>
       <stop offset="1" stop-color="${BRAND_MINT}"/>
     </linearGradient>
-    <pattern id="grid" width="48" height="48" patternUnits="userSpaceOnUse">
-      <path d="M 48 0 L 0 0 0 48" fill="none" stroke="#ffffff" stroke-opacity="0.07" stroke-width="1"/>
+    <pattern id="grid" width="${GRID_SIZE}" height="${GRID_SIZE}" patternUnits="userSpaceOnUse">
+      <path d="M 0 0.5 H ${GRID_SIZE} M 0.5 0 V ${GRID_SIZE}" fill="none" stroke="#ffffff" stroke-opacity="0.07" stroke-width="1"/>
     </pattern>
   </defs>
   <rect width="${WIDTH}" height="${HEIGHT}" fill="${BG}"/>