@agent-native/core 0.96.0 → 0.97.0

package/dist/secrets/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA8EjD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3C;AAMD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA0C3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAItD;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA2B5B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,EAAE,CAAC,CA0BvB;AAeD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAStE"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA8EjD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3C;AAMD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA8D3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAItD;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA2B5B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,EAAE,CAAC,CA0BvB;AAeD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAStE"}

package/dist/secrets/storage.js

@@ -98,36 +98,54 @@ export async function writeAppSecret(args) {
     const client = getDbExec();
     const now = Date.now();
     const encrypted = encryptValue(value);
-    // Upsert by (scope, scope_id, key). Keep the existing row's id on update so
-    // references stay stable.
-    const { rows } = await client.execute({
-        sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,
-        args: [scope, scopeId, key],
-    });
-    if (rows.length > 0) {
-        const id = rows[0].id;
-        await client.execute({
-            sql: `UPDATE app_secrets SET encrypted_value = ?, description = ?, url_allowlist = ?, updated_at = ? WHERE id = ?`,
-            args: [encrypted, description ?? null, urlAllowlist ?? null, now, id],
+    const id = randomUUID();
+    // Atomic upsert by (scope, scope_id, key). Previously this was a
+    // SELECT-then-branch (UPDATE if found, else INSERT): under concurrent
+    // writers for the same key both could see "no row" and both attempt
+    // INSERT, and the loser threw a raw UNIQUE(scope, scope_id, key)
+    // constraint violation (a user-facing 500) instead of updating. A single
+    // `INSERT ... ON CONFLICT DO UPDATE` closes that window — it's one
+    // statement, so there's no gap between "check" and "act". `id` is
+    // deliberately left out of the `DO UPDATE SET` list so an existing row
+    // keeps its original id (any stored references stay stable); only a
+    // genuinely new row gets the freshly generated `id`. This syntax is
+    // portable across SQLite (UPSERT since 3.24) and Postgres.
+    const upsertSql = `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT (scope, scope_id, key) DO UPDATE SET
+      encrypted_value = excluded.encrypted_value,
+      description = excluded.description,
+      url_allowlist = excluded.url_allowlist,
+      updated_at = excluded.updated_at`;
+    const upsertArgs = [
+        id,
+        scope,
+        scopeId,
+        key,
+        encrypted,
+        description ?? null,
+        urlAllowlist ?? null,
+        now,
+        now,
+    ];
+    if (isPostgres()) {
+        const { rows } = await client.execute({
+            sql: `${upsertSql} RETURNING id`,
+            args: upsertArgs,
         });
-        return id;
+        return String(rows[0]?.id ?? id);
     }
-    const id = randomUUID();
-    await client.execute({
-        sql: `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        args: [
-            id,
-            scope,
-            scopeId,
-            key,
-            encrypted,
-            description ?? null,
-            urlAllowlist ?? null,
-            now,
-            now,
-        ],
+    // SQLite: RETURNING support varies across better-sqlite3/libsql builds, so
+    // (matching the convention elsewhere in this codebase, e.g.
+    // integrations/pending-tasks-store.ts) re-read the id afterward instead of
+    // relying on it. The row is guaranteed to exist at this point, so this is
+    // a plain lookup rather than a TOCTOU-prone gate on the write itself.
+    await client.execute({ sql: upsertSql, args: upsertArgs });
+    const { rows } = await client.execute({
+        sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,
+        args: [scope, scopeId, key],
     });
-    return id;
+    return String(rows[0]?.id ?? id);
 }
 /**
  * Read a secret's plaintext value. Returns null when not found. The caller

package/dist/secrets/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,kBAAkB,IAAI,YAAY,GACnC,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,SAAS,GAAG,UAAU,EAAE;gBAC5B,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC;gBAC1D,CAAC,CAAC,sBAAsB,CAAC;YAE3B,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,kEAAkE;gBAClE,mEAAmE;gBACnE,qEAAqE;gBACrE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,yEAAyE;gBACzE,yEAAyE;gBACzE,uEAAuE;gBACvE,qEAAqE;gBACrE,MAAM,iBAAiB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBAClD,MAAM,kBAAkB,CACtB,aAAa,EACb,aAAa,EACb,mEAAmE,CACpE,CAAC;gBACF,MAAM,kBAAkB,CACtB,aAAa,EACb,eAAe,EACf,qEAAqE,CACtE,CAAC;gBACF,OAAO;YACT,CAAC;YAED,0EAA0E;YAC1E,sDAAsD;YACtD,uEAAuE;YACvE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAEhC,2DAA2D;YAC3D,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,qDAAqD,CACtD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;YAED,2CAA2C;YAC3C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAoBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACvE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAEtC,4EAA4E;IAC5E,0BAA0B;IAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,yEAAyE;QAC9E,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAY,CAAC;QAChC,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,6GAA6G;YAClH,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,IAAI,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,4JAA4J;QACjK,IAAI,EAAE;YACJ,EAAE;YACF,KAAK;YACL,OAAO;YACP,GAAG;YACH,SAAS;YACT,WAAW,IAAI,IAAI;YACnB,YAAY,IAAI,IAAI;YACpB,GAAG;YACH,GAAG;SACJ;KACF,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,0GAA0G;QAC/G,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAyB,CAAC,CAAC;QAC9D,OAAO;YACL,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAc;IAEd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,kJAAkJ;QACvJ,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;QAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG;QACH,KAAK;QACL,OAAO;QACP,KAAK,EAAE,UAAU;QACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkB,EAClB,OAAe;IAEf,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,4JAA4J;QACjK,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;YAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,GAAa;YACtB,KAAK;YACL,OAAO;YACP,KAAK,EAAE,UAAU;YACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;YACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;YAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;SACvC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAkB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc;IAClD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC5C,GAAG,EAAE,sEAAsE;QAC3E,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,YAAY,GAAG,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["/**\n * Storage layer for the framework secrets registry.\n *\n * Values are encrypted at rest with AES-256-GCM. The encryption key is\n * derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the existing\n * `BETTER_AUTH_SECRET` env var (fallback so templates don't need a second\n * secret during development). If neither is set in production we fall back\n * to a machine-local key derived from the cwd — the secret is still only\n * readable on this machine, but consider setting `SECRETS_ENCRYPTION_KEY`\n * for a stable, rotatable key.\n *\n * Secret values are NEVER logged and NEVER returned from any route handler.\n */\n\nimport { randomUUID } from \"node:crypto\";\n\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { ensureColumnExists, ensureTableExists } from \"../db/ddl-guard.js\";\nimport {\n  encryptSecretValue as encryptValue,\n  decryptSecretValue as decryptValue,\n} from \"./crypto.js\";\nimport type { SecretScope } from \"./register.js\";\nimport { APP_SECRETS_CREATE_SQL } from \"./schema.js\";\n\n// ---------------------------------------------------------------------------\n// Table bootstrap\n// ---------------------------------------------------------------------------\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      // Postgres version of the CREATE TABLE — the generic `INTEGER` maps to\n      // BIGINT on Postgres, which we need for millisecond timestamps.\n      const createSql = isPostgres()\n        ? APP_SECRETS_CREATE_SQL.replace(/\\bINTEGER\\b/g, \"BIGINT\")\n        : APP_SECRETS_CREATE_SQL;\n\n      if (isPostgres()) {\n        // Hot path: in production the table and both additive columns are\n        // virtually always already present. Issuing `CREATE`/`ALTER` would\n        // still take an ACCESS EXCLUSIVE lock — which, in a fresh background\n        // worker process behind a concurrent connection on the shared Neon DB,\n        // can block ~indefinitely. `ensureTableExists` / `ensureColumnExists`\n        // check `information_schema` first (a plain read, no lock) and run DDL\n        // ONLY for what is actually missing, wrapping any DDL that must run in a\n        // transaction-scoped `lock_timeout` so a contended lock fails fast. They\n        // also re-probe after a swallowed lock-timeout and THROW if the schema\n        // is still missing, so a timed-out DDL never poisons this init memo.\n        await ensureTableExists(\"app_secrets\", createSql);\n        await ensureColumnExists(\n          \"app_secrets\",\n          \"description\",\n          `ALTER TABLE app_secrets ADD COLUMN IF NOT EXISTS description TEXT`,\n        );\n        await ensureColumnExists(\n          \"app_secrets\",\n          \"url_allowlist\",\n          `ALTER TABLE app_secrets ADD COLUMN IF NOT EXISTS url_allowlist TEXT`,\n        );\n        return;\n      }\n\n      // SQLite (local dev): no ACCESS EXCLUSIVE lock problem, keep the original\n      // create-then-additive-alter behaviour. SQLite has no\n      // `ADD COLUMN IF NOT EXISTS`, so the ALTERs stay wrapped in try/catch.\n      await client.execute(createSql);\n\n      // Additive migration: description column (for ad-hoc keys)\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN description TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n\n      // Additive migration: url_allowlist column\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN url_allowlist TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n    })().catch((err) => {\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\n// ---------------------------------------------------------------------------\n// Encryption — see ./crypto.ts (shared with per-user credentials)\n// ---------------------------------------------------------------------------\n\n/**\n * Return the last 4 characters of a secret, with any leading characters\n * masked. Used to show a preview without leaking the value.\n */\nexport function last4(value: string): string {\n  if (!value) return \"\";\n  if (value.length <= 4) return \"••••\";\n  return \"••••\" + value.slice(-4);\n}\n\n// ---------------------------------------------------------------------------\n// CRUD\n// ---------------------------------------------------------------------------\n\nexport interface SecretRef {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n}\n\nexport interface WriteSecretArgs extends SecretRef {\n  value: string;\n  /** Optional human-readable description (used for ad-hoc keys). */\n  description?: string;\n  /** Optional JSON-stringified array of allowed URL origins. */\n  urlAllowlist?: string;\n}\n\n/**\n * Write (insert or update) a secret. The value is encrypted before being\n * stored — the caller's plaintext is never persisted. Returns the new\n * record's id.\n */\nexport async function writeAppSecret(args: WriteSecretArgs): Promise<string> {\n  await ensureTable();\n  const { key, value, scope, scopeId, description, urlAllowlist } = args;\n  if (!key || !value || !scope || !scopeId) {\n    throw new Error(\n      \"writeAppSecret: key, value, scope, and scopeId are all required\",\n    );\n  }\n  const client = getDbExec();\n  const now = Date.now();\n  const encrypted = encryptValue(value);\n\n  // Upsert by (scope, scope_id, key). Keep the existing row's id on update so\n  // references stay stable.\n  const { rows } = await client.execute({\n    sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length > 0) {\n    const id = rows[0].id as string;\n    await client.execute({\n      sql: `UPDATE app_secrets SET encrypted_value = ?, description = ?, url_allowlist = ?, updated_at = ? WHERE id = ?`,\n      args: [encrypted, description ?? null, urlAllowlist ?? null, now, id],\n    });\n    return id;\n  }\n  const id = randomUUID();\n  await client.execute({\n    sql: `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      scope,\n      scopeId,\n      key,\n      encrypted,\n      description ?? null,\n      urlAllowlist ?? null,\n      now,\n      now,\n    ],\n  });\n  return id;\n}\n\nexport interface ReadSecretResult {\n  value: string;\n  last4: string;\n  updatedAt: number;\n}\n\n/**\n * Read a secret's plaintext value. Returns null when not found. The caller\n * is responsible for never logging the returned value.\n */\nexport async function readAppSecret(\n  ref: SecretRef,\n): Promise<ReadSecretResult | null> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  try {\n    const value = decryptValue(rows[0].encrypted_value as string);\n    return {\n      value,\n      last4: last4(value),\n      updatedAt: Number(rows[0].updated_at ?? 0),\n    };\n  } catch {\n    // Decryption failure — key rotated, tampered row, etc. Don't throw up the\n    // stack in a way that could leak the ciphertext; just report missing.\n    return null;\n  }\n}\n\n/**\n * Return just the metadata for a secret (no value). Used by the list route so\n * the UI can show the \"Set\" pill and last-4 without the decrypted value going\n * over the wire.\n */\nexport async function getAppSecretMeta(\n  ref: SecretRef,\n): Promise<{ last4: string; updatedAt: number } | null> {\n  const result = await readAppSecret(ref);\n  if (!result) return null;\n  return { last4: result.last4, updatedAt: result.updatedAt };\n}\n\nexport interface SecretMeta {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n  last4: string;\n  description: string | null;\n  urlAllowlist: string[] | null;\n  createdAt: number;\n  updatedAt: number;\n}\n\n/**\n * Read a secret's metadata, including ad-hoc fields (description, allowlist),\n * without ever decrypting or returning the plaintext value. Used by the\n * ad-hoc list route and any UI that wants to render a key tile.\n */\nexport async function readAppSecretMeta(\n  ref: SecretRef,\n): Promise<SecretMeta | null> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  const row = rows[0];\n  let last4Value = \"\";\n  try {\n    const value = decryptValue(row.encrypted_value as string);\n    last4Value = last4(value);\n  } catch {\n    last4Value = \"\";\n  }\n  return {\n    key,\n    scope,\n    scopeId,\n    last4: last4Value,\n    description: (row.description as string | null) ?? null,\n    urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n  };\n}\n\n/**\n * List all secrets for a given scope. Returns metadata only — values are\n * never decrypted or returned. Used by the ad-hoc list route to surface\n * user-created keys.\n */\nexport async function listAppSecretsForScope(\n  scope: SecretScope,\n  scopeId: string,\n): Promise<SecretMeta[]> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT key, encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? ORDER BY updated_at DESC`,\n    args: [scope, scopeId],\n  });\n  return rows.map((row) => {\n    let last4Value = \"\";\n    try {\n      const value = decryptValue(row.encrypted_value as string);\n      last4Value = last4(value);\n    } catch {\n      last4Value = \"\";\n    }\n    return {\n      key: row.key as string,\n      scope,\n      scopeId,\n      last4: last4Value,\n      description: (row.description as string | null) ?? null,\n      urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n      createdAt: Number(row.created_at ?? 0),\n      updatedAt: Number(row.updated_at ?? 0),\n    };\n  });\n}\n\nfunction parseAllowlist(raw: string | null): string[] | null {\n  if (!raw) return null;\n  try {\n    const parsed = JSON.parse(raw);\n    if (Array.isArray(parsed) && parsed.every((v) => typeof v === \"string\")) {\n      return parsed;\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function deleteAppSecret(ref: SecretRef): Promise<boolean> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rowsAffected } = await client.execute({\n    sql: `DELETE FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,\n    args: [scope, scopeId, key],\n  });\n  return rowsAffected > 0;\n}\n"]}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,kBAAkB,IAAI,YAAY,GACnC,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,SAAS,GAAG,UAAU,EAAE;gBAC5B,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC;gBAC1D,CAAC,CAAC,sBAAsB,CAAC;YAE3B,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,kEAAkE;gBAClE,mEAAmE;gBACnE,qEAAqE;gBACrE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,yEAAyE;gBACzE,yEAAyE;gBACzE,uEAAuE;gBACvE,qEAAqE;gBACrE,MAAM,iBAAiB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBAClD,MAAM,kBAAkB,CACtB,aAAa,EACb,aAAa,EACb,mEAAmE,CACpE,CAAC;gBACF,MAAM,kBAAkB,CACtB,aAAa,EACb,eAAe,EACf,qEAAqE,CACtE,CAAC;gBACF,OAAO;YACT,CAAC;YAED,0EAA0E;YAC1E,sDAAsD;YACtD,uEAAuE;YACvE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAEhC,2DAA2D;YAC3D,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,qDAAqD,CACtD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;YAED,2CAA2C;YAC3C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAoBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACvE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IAExB,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,yEAAyE;IACzE,mEAAmE;IACnE,kEAAkE;IAClE,uEAAuE;IACvE,oEAAoE;IACpE,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,SAAS,GAAG;;;;;;uCAMmB,CAAC;IACtC,MAAM,UAAU,GAAG;QACjB,EAAE;QACF,KAAK;QACL,OAAO;QACP,GAAG;QACH,SAAS;QACT,WAAW,IAAI,IAAI;QACnB,YAAY,IAAI,IAAI;QACpB,GAAG;QACH,GAAG;KACJ,CAAC;IAEF,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,GAAG,SAAS,eAAe;YAChC,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,2EAA2E;IAC3E,4DAA4D;IAC5D,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,iFAAiF;QACtF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,0GAA0G;QAC/G,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAyB,CAAC,CAAC;QAC9D,OAAO;YACL,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAc;IAEd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,kJAAkJ;QACvJ,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;QAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG;QACH,KAAK;QACL,OAAO;QACP,KAAK,EAAE,UAAU;QACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkB,EAClB,OAAe;IAEf,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,4JAA4J;QACjK,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;YAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,GAAa;YACtB,KAAK;YACL,OAAO;YACP,KAAK,EAAE,UAAU;YACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;YACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;YAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;SACvC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAkB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc;IAClD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC5C,GAAG,EAAE,sEAAsE;QAC3E,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,YAAY,GAAG,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["/**\n * Storage layer for the framework secrets registry.\n *\n * Values are encrypted at rest with AES-256-GCM. The encryption key is\n * derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the existing\n * `BETTER_AUTH_SECRET` env var (fallback so templates don't need a second\n * secret during development). If neither is set in production we fall back\n * to a machine-local key derived from the cwd — the secret is still only\n * readable on this machine, but consider setting `SECRETS_ENCRYPTION_KEY`\n * for a stable, rotatable key.\n *\n * Secret values are NEVER logged and NEVER returned from any route handler.\n */\n\nimport { randomUUID } from \"node:crypto\";\n\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { ensureColumnExists, ensureTableExists } from \"../db/ddl-guard.js\";\nimport {\n  encryptSecretValue as encryptValue,\n  decryptSecretValue as decryptValue,\n} from \"./crypto.js\";\nimport type { SecretScope } from \"./register.js\";\nimport { APP_SECRETS_CREATE_SQL } from \"./schema.js\";\n\n// ---------------------------------------------------------------------------\n// Table bootstrap\n// ---------------------------------------------------------------------------\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      // Postgres version of the CREATE TABLE — the generic `INTEGER` maps to\n      // BIGINT on Postgres, which we need for millisecond timestamps.\n      const createSql = isPostgres()\n        ? APP_SECRETS_CREATE_SQL.replace(/\\bINTEGER\\b/g, \"BIGINT\")\n        : APP_SECRETS_CREATE_SQL;\n\n      if (isPostgres()) {\n        // Hot path: in production the table and both additive columns are\n        // virtually always already present. Issuing `CREATE`/`ALTER` would\n        // still take an ACCESS EXCLUSIVE lock — which, in a fresh background\n        // worker process behind a concurrent connection on the shared Neon DB,\n        // can block ~indefinitely. `ensureTableExists` / `ensureColumnExists`\n        // check `information_schema` first (a plain read, no lock) and run DDL\n        // ONLY for what is actually missing, wrapping any DDL that must run in a\n        // transaction-scoped `lock_timeout` so a contended lock fails fast. They\n        // also re-probe after a swallowed lock-timeout and THROW if the schema\n        // is still missing, so a timed-out DDL never poisons this init memo.\n        await ensureTableExists(\"app_secrets\", createSql);\n        await ensureColumnExists(\n          \"app_secrets\",\n          \"description\",\n          `ALTER TABLE app_secrets ADD COLUMN IF NOT EXISTS description TEXT`,\n        );\n        await ensureColumnExists(\n          \"app_secrets\",\n          \"url_allowlist\",\n          `ALTER TABLE app_secrets ADD COLUMN IF NOT EXISTS url_allowlist TEXT`,\n        );\n        return;\n      }\n\n      // SQLite (local dev): no ACCESS EXCLUSIVE lock problem, keep the original\n      // create-then-additive-alter behaviour. SQLite has no\n      // `ADD COLUMN IF NOT EXISTS`, so the ALTERs stay wrapped in try/catch.\n      await client.execute(createSql);\n\n      // Additive migration: description column (for ad-hoc keys)\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN description TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n\n      // Additive migration: url_allowlist column\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN url_allowlist TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n    })().catch((err) => {\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\n// ---------------------------------------------------------------------------\n// Encryption — see ./crypto.ts (shared with per-user credentials)\n// ---------------------------------------------------------------------------\n\n/**\n * Return the last 4 characters of a secret, with any leading characters\n * masked. Used to show a preview without leaking the value.\n */\nexport function last4(value: string): string {\n  if (!value) return \"\";\n  if (value.length <= 4) return \"••••\";\n  return \"••••\" + value.slice(-4);\n}\n\n// ---------------------------------------------------------------------------\n// CRUD\n// ---------------------------------------------------------------------------\n\nexport interface SecretRef {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n}\n\nexport interface WriteSecretArgs extends SecretRef {\n  value: string;\n  /** Optional human-readable description (used for ad-hoc keys). */\n  description?: string;\n  /** Optional JSON-stringified array of allowed URL origins. */\n  urlAllowlist?: string;\n}\n\n/**\n * Write (insert or update) a secret. The value is encrypted before being\n * stored — the caller's plaintext is never persisted. Returns the new\n * record's id.\n */\nexport async function writeAppSecret(args: WriteSecretArgs): Promise<string> {\n  await ensureTable();\n  const { key, value, scope, scopeId, description, urlAllowlist } = args;\n  if (!key || !value || !scope || !scopeId) {\n    throw new Error(\n      \"writeAppSecret: key, value, scope, and scopeId are all required\",\n    );\n  }\n  const client = getDbExec();\n  const now = Date.now();\n  const encrypted = encryptValue(value);\n  const id = randomUUID();\n\n  // Atomic upsert by (scope, scope_id, key). Previously this was a\n  // SELECT-then-branch (UPDATE if found, else INSERT): under concurrent\n  // writers for the same key both could see \"no row\" and both attempt\n  // INSERT, and the loser threw a raw UNIQUE(scope, scope_id, key)\n  // constraint violation (a user-facing 500) instead of updating. A single\n  // `INSERT ... ON CONFLICT DO UPDATE` closes that window — it's one\n  // statement, so there's no gap between \"check\" and \"act\". `id` is\n  // deliberately left out of the `DO UPDATE SET` list so an existing row\n  // keeps its original id (any stored references stay stable); only a\n  // genuinely new row gets the freshly generated `id`. This syntax is\n  // portable across SQLite (UPSERT since 3.24) and Postgres.\n  const upsertSql = `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at)\n    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)\n    ON CONFLICT (scope, scope_id, key) DO UPDATE SET\n      encrypted_value = excluded.encrypted_value,\n      description = excluded.description,\n      url_allowlist = excluded.url_allowlist,\n      updated_at = excluded.updated_at`;\n  const upsertArgs = [\n    id,\n    scope,\n    scopeId,\n    key,\n    encrypted,\n    description ?? null,\n    urlAllowlist ?? null,\n    now,\n    now,\n  ];\n\n  if (isPostgres()) {\n    const { rows } = await client.execute({\n      sql: `${upsertSql} RETURNING id`,\n      args: upsertArgs,\n    });\n    return String(rows[0]?.id ?? id);\n  }\n\n  // SQLite: RETURNING support varies across better-sqlite3/libsql builds, so\n  // (matching the convention elsewhere in this codebase, e.g.\n  // integrations/pending-tasks-store.ts) re-read the id afterward instead of\n  // relying on it. The row is guaranteed to exist at this point, so this is\n  // a plain lookup rather than a TOCTOU-prone gate on the write itself.\n  await client.execute({ sql: upsertSql, args: upsertArgs });\n  const { rows } = await client.execute({\n    sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  return String(rows[0]?.id ?? id);\n}\n\nexport interface ReadSecretResult {\n  value: string;\n  last4: string;\n  updatedAt: number;\n}\n\n/**\n * Read a secret's plaintext value. Returns null when not found. The caller\n * is responsible for never logging the returned value.\n */\nexport async function readAppSecret(\n  ref: SecretRef,\n): Promise<ReadSecretResult | null> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  try {\n    const value = decryptValue(rows[0].encrypted_value as string);\n    return {\n      value,\n      last4: last4(value),\n      updatedAt: Number(rows[0].updated_at ?? 0),\n    };\n  } catch {\n    // Decryption failure — key rotated, tampered row, etc. Don't throw up the\n    // stack in a way that could leak the ciphertext; just report missing.\n    return null;\n  }\n}\n\n/**\n * Return just the metadata for a secret (no value). Used by the list route so\n * the UI can show the \"Set\" pill and last-4 without the decrypted value going\n * over the wire.\n */\nexport async function getAppSecretMeta(\n  ref: SecretRef,\n): Promise<{ last4: string; updatedAt: number } | null> {\n  const result = await readAppSecret(ref);\n  if (!result) return null;\n  return { last4: result.last4, updatedAt: result.updatedAt };\n}\n\nexport interface SecretMeta {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n  last4: string;\n  description: string | null;\n  urlAllowlist: string[] | null;\n  createdAt: number;\n  updatedAt: number;\n}\n\n/**\n * Read a secret's metadata, including ad-hoc fields (description, allowlist),\n * without ever decrypting or returning the plaintext value. Used by the\n * ad-hoc list route and any UI that wants to render a key tile.\n */\nexport async function readAppSecretMeta(\n  ref: SecretRef,\n): Promise<SecretMeta | null> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  const row = rows[0];\n  let last4Value = \"\";\n  try {\n    const value = decryptValue(row.encrypted_value as string);\n    last4Value = last4(value);\n  } catch {\n    last4Value = \"\";\n  }\n  return {\n    key,\n    scope,\n    scopeId,\n    last4: last4Value,\n    description: (row.description as string | null) ?? null,\n    urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n  };\n}\n\n/**\n * List all secrets for a given scope. Returns metadata only — values are\n * never decrypted or returned. Used by the ad-hoc list route to surface\n * user-created keys.\n */\nexport async function listAppSecretsForScope(\n  scope: SecretScope,\n  scopeId: string,\n): Promise<SecretMeta[]> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT key, encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? ORDER BY updated_at DESC`,\n    args: [scope, scopeId],\n  });\n  return rows.map((row) => {\n    let last4Value = \"\";\n    try {\n      const value = decryptValue(row.encrypted_value as string);\n      last4Value = last4(value);\n    } catch {\n      last4Value = \"\";\n    }\n    return {\n      key: row.key as string,\n      scope,\n      scopeId,\n      last4: last4Value,\n      description: (row.description as string | null) ?? null,\n      urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n      createdAt: Number(row.created_at ?? 0),\n      updatedAt: Number(row.updated_at ?? 0),\n    };\n  });\n}\n\nfunction parseAllowlist(raw: string | null): string[] | null {\n  if (!raw) return null;\n  try {\n    const parsed = JSON.parse(raw);\n    if (Array.isArray(parsed) && parsed.every((v) => typeof v === \"string\")) {\n      return parsed;\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function deleteAppSecret(ref: SecretRef): Promise<boolean> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rowsAffected } = await client.execute({\n    sql: `DELETE FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,\n    args: [scope, scopeId, key],\n  });\n  return rowsAffected > 0;\n}\n"]}

package/dist/server/action-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-discovery.d.ts","sourceRoot":"","sources":["../../src/server/action-discovery.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA2ChE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,IAAI,CAKN;AA4RD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAqC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAgGtC;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAqJf;AAED,oDAAoD;AACpD,eAAO,MAAM,mBAAmB,4BAAsB,CAAC"}
+{"version":3,"file":"action-discovery.d.ts","sourceRoot":"","sources":["../../src/server/action-discovery.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA2ChE;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,IAAI,CAKN;AA4RD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAqC7B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAgGtC;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACpC,OAAO,CAAC,IAAI,CAAC,CAyJf;AAED,oDAAoD;AACpD,eAAO,MAAM,mBAAmB,4BAAsB,CAAC"}

package/dist/server/action-discovery.js

@@ -531,6 +531,10 @@ export async function mergeCoreSharingActions(registry) {
             () => import("../audit/actions/list-audit-events.js"),
         ],
         ["get-audit-event", () => import("../audit/actions/get-audit-event.js")],
+        [
+            "export-audit-events",
+            () => import("../audit/actions/export-audit-events.js"),
+        ],
         // History kit — reusable version snapshots and restore surface.
         [
             "create-resource-version",

package/dist/server/action-discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-discovery.js","sourceRoot":"","sources":["../../src/server/action-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AA+BjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,sDAAsD;AACtD,yFAAyF;AACzF,IAAI,GAAoC,CAAC;AACzC,KAAK,UAAU,KAAK;IAClB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,0DAA0D;AAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,SAAS;IACT,KAAK;IACL,YAAY;IACZ,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GAAgC,EAAE,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAoC;IAEpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,qBAAqB,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,qBAAqB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACtC,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,iBAAiB;IACxB,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,IAAY,EACZ,SAA4C;IAE5C,MAAM,IAAI,GAAe;QACvB,WAAW,EAAE,YAAY,IAAI,8CAA8C;QAC3E,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,+DAA+D;iBAClE;aACF;SACF;KACF,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,KAAK,EAAE,IAA4B,EAAmB,EAAE;YAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,+DAA+D;YAC/D,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA0B;IACrD,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAC1E,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACvE,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC/C,GAAG,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,IACE,KAAK,CAAC,WAAW;QACjB,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EACjC,CAAC;QACD,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,IACE,KAAK,CAAC,MAAM;QACZ,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAC5B,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,IACE,KAAK,CAAC,MAAM;QACZ,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAC5B,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACzE,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC7C,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,CAAC;IACD,IACE,OAAO,KAAK,CAAC,aAAa,KAAK,SAAS;QACxC,OAAO,KAAK,CAAC,aAAa,KAAK,UAAU,EACzC,CAAC;QACD,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,GAAY;IACzD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,SAAS,GAAG,GAAwD,CAAC;IAC3E,IAAI,SAAS,EAAE,IAAI,KAAK,4BAA4B;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAEnD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACpD,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAwB,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,qEAAqE;IACrE,8DAA8D;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,eAAe,CAAC;QACpD,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,eAAe,CAAC;QACpD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CACpC,UAAkB,EAClB,QAAqC,EACrC,YAAqB;IAErB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QACvC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,YAAY,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAE7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YAEtD,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;iBAC5B,CAAC;YACJ,CAAC;iBAAM,IACL,GAAG,CAAC,OAAO;gBACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAC/B,GAAG,CAAC,OAAO,CAAC,IAAI;gBAChB,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,UAAU,EACrC,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;oBACtB,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;oBACpB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;iBACpC,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,WAAW;YACX,MAAM,GAAG,GACP,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CACV,+BAA+B,IAAI,sCAAsC;gBACvE,gFAAgF,GAAG,EAAE,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAgC;IAEhC,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAA6C,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;aAC5B,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,IACE,GAAG;YACH,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,CAAC,IAAI;YACR,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAC7B,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;aAC5B,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY;IAEZ,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAgC,EAAE,CAAC;IAEjD,wEAAwE;IACxE,0EAA0E;IAC1E,WAAW;IACX,IAAI,CAAC;QACH,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,2DAA2D,UAAU,MAAM,GAAG,EAAE,OAAO,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,mEAAmE;IACnE,gEAAgE;IAChE,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,YAAoB,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxD,YAAY,GAAG,QAAQ,CAAC,OAAO,CAC7B,SAAS,EACT,sCAAsC,CACvC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,QAAQ,CAAC,OAAO,CAC7B,IAAI,EACJ,mCAAmC,CACpC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC1D,MAAM,aAAa,GAAG,6BAA6B,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;YACxE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,OAAO,CAAC,GAAG,CACT,kEAAkE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,gDAAgD;oBACjJ,kGAAkG,CACrG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CACV,4DAA4D;YAC1D,kDAAkD;YAClD,sFAAsF;YACtF,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,uDAAuD;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,iCAAiC;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,uBAAuB,EAAE,GAC/B,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,uBAAuB,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAqC;IAErC,MAAM,OAAO,GAAwC;QACnD,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QACxE;YACE,kBAAkB;YAClB,GAAG,EAAE,CAAC,MAAM,CAAC,wCAAwC,CAAC;SACvD;QACD;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,yBAAyB;YACzB,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC;SAC9D;QACD;YACE,4BAA4B;YAC5B,GAAG,EAAE,CAAC,MAAM,CAAC,kDAAkD,CAAC;SACjE;QACD,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC;QACxE;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,uDAAuD,CAAC;SACtE;QACD;YACE,aAAa;YACb,GAAG,EAAE,CAAC,MAAM,CAAC,8CAA8C,CAAC;SAC7D;QACD;YACE,eAAe;YACf,GAAG,EAAE,CAAC,MAAM,CAAC,gDAAgD,CAAC;SAC/D;QACD;YACE,iBAAiB;YACjB,GAAG,EAAE,CAAC,MAAM,CAAC,kDAAkD,CAAC;SACjE;QACD;YACE,gBAAgB;YAChB,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC;SAChE;QACD;YACE,6BAA6B;YAC7B,GAAG,EAAE,CAAC,MAAM,CAAC,wDAAwD,CAAC;SACvE;QACD;YACE,6BAA6B;YAC7B,GAAG,EAAE,CAAC,MAAM,CAAC,wDAAwD,CAAC;SACvE;QACD;YACE,mBAAmB;YACnB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACzE,qEAAqE;QACrE;YACE,mBAAmB;YACnB,GAAG,EAAE,CAAC,MAAM,CAAC,uCAAuC,CAAC;SACtD;QACD,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACxE,gEAAgE;QAChE;YACE,yBAAyB;YACzB,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC;SAC9D;QACD;YACE,wBAAwB;YACxB,GAAG,EAAE,CAAC,MAAM,CAAC,8CAA8C,CAAC;SAC7D;QACD;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,0BAA0B;YAC1B,GAAG,EAAE,CAAC,MAAM,CAAC,gDAAgD,CAAC;SAC/D;QACD;YACE,uBAAuB;YACvB,GAAG,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC;SAC5D;QACD,+EAA+E;QAC/E;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC;SAC1D;QACD;YACE,uBAAuB;YACvB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC;SAC1D;QACD;YACE,uBAAuB;YACvB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,uBAAuB;YACvB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,yBAAyB;YACzB,GAAG,EAAE,CAAC,MAAM,CAAC,8CAA8C,CAAC;SAC7D;QACD;YACE,qBAAqB;YACrB,GAAG,EAAE,CAAC,MAAM,CAAC,0CAA0C,CAAC;SACzD;QACD;YACE,mBAAmB;YACnB,GAAG,EAAE,CAAC,MAAM,CAAC,wCAAwC,CAAC;SACvD;QACD,0EAA0E;QAC1E,oEAAoE;QACpE;YACE,0BAA0B;YAC1B,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,yBAAyB;YACzB,GAAG,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC;SAC1D;QACD;YACE,0BAA0B;YAC1B,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;YACxB,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBACrD,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,kEAAkE;oBAClE,gEAAgE;oBAChE,+DAA+D;oBAC/D,2DAA2D;oBAC3D,GAAG,mBAAmB,CAAC,GAAG,CAAC;iBAC5B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC","sourcesContent":["import nodePath from \"node:path\";\n\n/**\n * Auto-discover actions from a template's actions/ directory.\n *\n * Scans for .ts/.js files and builds an action registry suitable for\n * `createAgentChatPlugin({ actions })`.\n *\n * Supports two action conventions:\n *\n * 1. **Full interface** — exports `tool: ActionTool` and `run(args): Promise<string>`.\n *    These are used directly.\n *\n * 2. **CLI-style** — exports only `default async function(args: string[])`.\n *    These are wrapped: args are converted from `Record<string, string>` to\n *    `[\"--key\", \"value\", ...]`, console output is captured, and a tool\n *    definition is synthesized from the action name.\n *\n * 3. **defineAction** — exports `default` from `defineAction()`. Has `tool` and `run`.\n *\n * Usage in agent-chat plugins:\n * ```ts\n * import { autoDiscoverActions } from \"@agent-native/core/server\";\n *\n * export default createAgentChatPlugin({\n *   actions: () => autoDiscoverActions(import.meta.url),\n * });\n * ```\n */\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport type { ActionTool } from \"../agent/types.js\";\nimport { captureCliOutput } from \"./cli-capture.js\";\n\n// Lazy fs — loaded via dynamic import() on first use.\n// Avoids require() which bundlers convert to createRequire() that crashes on CF Workers.\nlet _fs: typeof import(\"fs\") | undefined;\nasync function getFs(): Promise<typeof import(\"fs\")> {\n  if (!_fs) {\n    _fs = await import(\"node:fs\");\n  }\n  return _fs;\n}\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\n\n/** Files to skip during auto-discovery (no extension). */\nconst SKIP_FILES = new Set([\n  \"helpers\",\n  \"run\",\n  \"db-connect\",\n  \"db-status\",\n  \"registry\",\n]);\n\nfunction isRuntimeSourceFile(filename: string): boolean {\n  if (!/\\.(ts|js)$/.test(filename)) return false;\n  if (/\\.d\\.ts$/.test(filename)) return false;\n  if (/\\.(test|spec)\\.(ts|js)$/.test(filename)) return false;\n  return true;\n}\n\n/**\n * Global registry of actions contributed by published packages\n * (e.g. `@agent-native/dispatch`). Populated by `registerPackageActions()`\n * which the package calls from import side effects, then merged into\n * `autoDiscoverActions` after the template's local `actions/` directory.\n *\n * Ordering: template `actions/` files always win on name collision so\n * consumers can override a packaged action by dropping a same-named file\n * in their own `actions/` dir.\n */\nconst packageActionRegistry: Record<string, ActionEntry> = {};\n\n/**\n * Register a map of actions contributed by a published package.\n *\n * Called from a package's server entrypoint via import side effects:\n * ```ts\n * // packages/dispatch/src/server/index.ts\n * import { registerPackageActions } from \"@agent-native/core/server\";\n * import { actions } from \"../actions/index.js\";\n * registerPackageActions(actions);\n * ```\n *\n * Idempotent — re-registering the same name from the same import is a no-op\n * so HMR / repeated dynamic imports don't double-warn.\n */\nexport function registerPackageActions(\n  actions: Record<string, ActionEntry>,\n): void {\n  for (const [name, entry] of Object.entries(actions)) {\n    if (packageActionRegistry[name]) continue;\n    packageActionRegistry[name] = entry;\n  }\n}\n\n/** Internal — used by `autoDiscoverActions`. Returns a shallow copy. */\nfunction getPackageActions(): Record<string, ActionEntry> {\n  return { ...packageActionRegistry };\n}\n\n/**\n * Split a string into shell-like tokens, handling double and single quotes.\n * `--title \"My Page\" --content \"\"` → `[\"--title\", \"My Page\", \"--content\", \"\"]`\n */\nfunction splitShellArgs(input: string): string[] {\n  const tokens: string[] = [];\n  let current = \"\";\n  let inDouble = false;\n  let inSingle = false;\n  let wasQuoted = false;\n\n  for (let i = 0; i < input.length; i++) {\n    const ch = input[i];\n    if (ch === '\"' && !inSingle) {\n      inDouble = !inDouble;\n      wasQuoted = true;\n      continue;\n    }\n    if (ch === \"'\" && !inDouble) {\n      inSingle = !inSingle;\n      wasQuoted = true;\n      continue;\n    }\n    if ((ch === \" \" || ch === \"\\t\") && !inDouble && !inSingle) {\n      if (current.length > 0 || wasQuoted) {\n        tokens.push(current);\n      }\n      current = \"\";\n      wasQuoted = false;\n      continue;\n    }\n    current += ch;\n  }\n  if (current.length > 0 || wasQuoted) {\n    tokens.push(current);\n  }\n  return tokens;\n}\n\n/**\n * Wrap a CLI-style action (that writes to console.log) as an ActionEntry\n * by capturing stdout/stderr and intercepting process.exit. Uses the\n * shared AsyncLocalStorage-backed capture so concurrent invocations do\n * not corrupt the global `console.log` / `process.stdout.write` /\n * `process.exit` pointers (see `cli-capture.ts`).\n */\nfunction wrapDefaultExport(\n  name: string,\n  defaultFn: (args: string[]) => Promise<void>,\n): ActionEntry {\n  const tool: ActionTool = {\n    description: `Run the \"${name}\" action. Pass arguments as key-value pairs.`,\n    parameters: {\n      type: \"object\",\n      properties: {\n        args: {\n          type: \"string\",\n          description:\n            \"Space-separated CLI arguments (e.g. '--id abc --title Hello')\",\n        },\n      },\n    },\n  };\n\n  return {\n    tool,\n    run: async (args: Record<string, string>): Promise<string> => {\n      const cliArgs: string[] = [];\n      // If only an \"args\" key was provided, split it into CLI tokens\n      if (args.args && Object.keys(args).length === 1) {\n        cliArgs.push(...splitShellArgs(args.args));\n      } else {\n        for (const [k, v] of Object.entries(args)) {\n          cliArgs.push(`--${k}`, v);\n        }\n      }\n      return captureCliOutput(() => defaultFn(cliArgs));\n    },\n  };\n}\n\nfunction preserveActionFlags(entry: Record<string, any>): Partial<ActionEntry> {\n  const out: Partial<ActionEntry> = {};\n  if (typeof entry.agentTool === \"boolean\") out.agentTool = entry.agentTool;\n  if (typeof entry.requiresAuth === \"boolean\") {\n    out.requiresAuth = entry.requiresAuth;\n  }\n  if (typeof entry.readOnly === \"boolean\") out.readOnly = entry.readOnly;\n  if (typeof entry.allowInPlanMode === \"boolean\") {\n    out.allowInPlanMode = entry.allowInPlanMode;\n  }\n  if (typeof entry.parallelSafe === \"boolean\") {\n    out.parallelSafe = entry.parallelSafe;\n  }\n  if (typeof entry.toolCallable === \"boolean\") {\n    out.toolCallable = entry.toolCallable;\n  }\n  if (\n    entry.publicAgent &&\n    typeof entry.publicAgent === \"object\" &&\n    !Array.isArray(entry.publicAgent)\n  ) {\n    out.publicAgent = entry.publicAgent;\n  }\n  if (typeof entry.link === \"function\") {\n    out.link = entry.link;\n  }\n  if (\n    entry.mcpApp &&\n    typeof entry.mcpApp === \"object\" &&\n    !Array.isArray(entry.mcpApp)\n  ) {\n    out.mcpApp = entry.mcpApp;\n  }\n  if (\n    entry.chatUI &&\n    typeof entry.chatUI === \"object\" &&\n    !Array.isArray(entry.chatUI)\n  ) {\n    out.chatUI = entry.chatUI;\n  }\n  if (typeof entry.timeoutMs === \"number\") out.timeoutMs = entry.timeoutMs;\n  if (typeof entry.maxResultChars === \"number\") {\n    out.maxResultChars = entry.maxResultChars;\n  }\n  if (\n    typeof entry.needsApproval === \"boolean\" ||\n    typeof entry.needsApproval === \"function\"\n  ) {\n    out.needsApproval = entry.needsApproval;\n  }\n  return out;\n}\n\nfunction shouldRetryWithJiti(filePath: string, err: unknown): boolean {\n  if (!filePath.endsWith(\".ts\")) return false;\n  const candidate = err as { code?: unknown; message?: unknown } | undefined;\n  if (candidate?.code === \"ERR_UNKNOWN_FILE_EXTENSION\") return true;\n  return /Unknown file extension \".ts\"/.test(String(candidate?.message ?? \"\"));\n}\n\nasync function importRuntimeSourceModule(\n  filePath: string,\n): Promise<Record<string, any>> {\n  try {\n    return await import(/* @vite-ignore */ pathToFileURL(filePath).href);\n  } catch (err) {\n    if (!shouldRetryWithJiti(filePath, err)) throw err;\n\n    const { createJiti } = await import(\"jiti\");\n    const jiti = createJiti(pathToFileURL(filePath).href, {\n      interopDefault: true,\n    });\n    return (await jiti.import(filePath)) as Record<string, any>;\n  }\n}\n\n/**\n * Resolve the actions directory from the caller's context.\n *\n * @param from - Either an `import.meta.url` (file:// URL from a plugin file),\n *   an absolute directory path, or \"auto\" to use `process.cwd() + \"/actions\"`.\n *   When an import.meta.url is provided, the actions directory is resolved as\n *   `../../actions/` relative to the caller (typically `server/plugins/agent-chat.ts`).\n *   If the resolved directory doesn't exist, falls back to `../../scripts/` for\n *   backwards compatibility, then to `process.cwd() + \"/actions\"`.\n */\nasync function resolveActionsDir(from: string): Promise<string> {\n  const fs = await getFs();\n  const exists = (p: string) => {\n    try {\n      return fs.existsSync(p);\n    } catch {\n      return false;\n    }\n  };\n  // On edge runtimes (e.g. Cloudflare Workers), import.meta.url may be\n  // undefined after bundling. Fall back to cwd-based discovery.\n  if (!from) {\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  if (from.startsWith(\"file://\") || from.startsWith(\"file:///\")) {\n    const callerPath = fileURLToPath(from);\n    const callerDir = nodePath.dirname(callerPath);\n    const actionsResolved = nodePath.resolve(callerDir, \"../../actions\");\n    if (exists(actionsResolved)) return actionsResolved;\n    const scriptsResolved = nodePath.resolve(callerDir, \"../../scripts\");\n    if (exists(scriptsResolved)) return scriptsResolved;\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  if (from === \"auto\") {\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  return nodePath.resolve(from);\n}\n\n/**\n * Load actions from a single directory into the given registry. Shared by\n * both the template-actions discovery path and the workspace-core actions\n * layer. When `skipExisting` is true, an entry with the same name that's\n * already in the registry is left untouched (template-wins on collision).\n */\nasync function loadActionsIntoRegistry(\n  actionsDir: string,\n  registry: Record<string, ActionEntry>,\n  skipExisting: boolean,\n): Promise<void> {\n  let files: string[];\n  try {\n    const fs = await getFs();\n    if (!fs.existsSync(actionsDir)) return;\n    files = fs.readdirSync(actionsDir);\n  } catch {\n    return;\n  }\n\n  const actionFiles = files.filter((f) => {\n    if (!isRuntimeSourceFile(f)) return false;\n    const name = f.replace(/\\.(ts|js)$/, \"\");\n    if (name.startsWith(\"_\")) return false;\n    if (SKIP_FILES.has(name)) return false;\n    return true;\n  });\n\n  for (const file of actionFiles) {\n    const name = file.replace(/\\.(ts|js)$/, \"\");\n    if (skipExisting && registry[name]) continue;\n\n    const filePath = nodePath.join(actionsDir, file);\n    try {\n      const mod = await importRuntimeSourceModule(filePath);\n\n      if (mod.tool && typeof mod.run === \"function\") {\n        registry[name] = {\n          tool: mod.tool,\n          run: mod.run,\n          ...(mod.http !== undefined ? { http: mod.http } : {}),\n          ...preserveActionFlags(mod),\n        };\n      } else if (\n        mod.default &&\n        typeof mod.default === \"object\" &&\n        mod.default.tool &&\n        typeof mod.default.run === \"function\"\n      ) {\n        registry[name] = {\n          tool: mod.default.tool,\n          run: mod.default.run,\n          ...(mod.default.http !== undefined ? { http: mod.default.http } : {}),\n          ...preserveActionFlags(mod.default),\n        };\n      } else if (typeof mod.default === \"function\") {\n        registry[name] = wrapDefaultExport(name, mod.default);\n      }\n    } catch (err) {\n      // CLI-style scripts (top-level execution) throw on import — expected,\n      // they're available via `pnpm action <name>` / shell instead. But a\n      // syntax error, bad import, or malformed defineAction in a real action\n      // file lands here too and would silently vanish from the agent's tools.\n      // Warn so a broken action file is diagnosable instead of mysteriously\n      // missing.\n      const msg =\n        err instanceof Error ? (err.stack ?? err.message) : String(err);\n      console.warn(\n        `[action-discovery] Skipped \"${file}\" — failed to import. If this is an ` +\n          `agent action (not a CLI script), it will be missing from the agent's tools:\\n${msg}`,\n      );\n    }\n  }\n}\n\n/**\n * Normalize a pre-bundled static action registry (name → raw module) into\n * the `Record<string, ActionEntry>` shape the agent-chat plugin expects.\n *\n * Used by `autoDiscoverActions` when `.generated/actions-registry.ts` is\n * present so that Nitro-bundled serverless functions (Netlify, Vercel,\n * AWS-Lambda) can serve `/_agent-native/actions/*` routes without relying\n * on a filesystem scan that doesn't work in bundled output.\n */\nexport function loadActionsFromStaticRegistry(\n  modules: Record<string, unknown>,\n): Record<string, ActionEntry> {\n  const registry: Record<string, ActionEntry> = {};\n  for (const [name, raw] of Object.entries(modules)) {\n    const mod = raw as Record<string, any> | null | undefined;\n    if (!mod) continue;\n\n    if (mod.tool && typeof mod.run === \"function\") {\n      registry[name] = {\n        tool: mod.tool,\n        run: mod.run,\n        ...(mod.http !== undefined ? { http: mod.http } : {}),\n        ...preserveActionFlags(mod),\n      };\n      continue;\n    }\n\n    const def = mod.default;\n    if (\n      def &&\n      typeof def === \"object\" &&\n      def.tool &&\n      typeof def.run === \"function\"\n    ) {\n      registry[name] = {\n        tool: def.tool,\n        run: def.run,\n        ...(def.http !== undefined ? { http: def.http } : {}),\n        ...preserveActionFlags(def),\n      };\n      continue;\n    }\n\n    if (typeof def === \"function\") {\n      registry[name] = wrapDefaultExport(name, def);\n    }\n  }\n  return registry;\n}\n\n/**\n * Auto-discover actions from a directory.\n *\n * Merges in any actions from the enterprise workspace core (if present in\n * the ancestor chain). Template actions take precedence over workspace-core\n * actions on name collision, so an app can override an enterprise-wide\n * action by dropping a same-named file under its own `actions/`.\n *\n * Note: this helper uses a filesystem scan, which works in dev and in\n * non-bundled Node deployments. In bundled serverless functions (Nitro's\n * netlify / vercel / aws-lambda presets) the `actions/` directory is not\n * on disk at runtime; templates should pass the static registry generated\n * by the Vite plugin to `createAgentChatPlugin({ actions })` instead, so\n * the bundler sees static imports and pulls every action into the bundle.\n *\n * @param from - The caller's `import.meta.url` or an absolute path to the\n *   actions directory.\n * @returns A record mapping action names to ActionEntry objects, suitable for\n *   passing to `createAgentChatPlugin({ actions })`.\n */\nexport async function autoDiscoverActions(\n  from: string,\n): Promise<Record<string, ActionEntry>> {\n  const actionsDir = await resolveActionsDir(from);\n  const registry: Record<string, ActionEntry> = {};\n\n  // 1. Template actions first — these are the authoritative layer for the\n  //    current app and must override any workspace-core entry with the same\n  //    name.\n  try {\n    await loadActionsIntoRegistry(actionsDir, registry, false);\n  } catch (err: any) {\n    console.warn(\n      `[autoDiscoverActions] Could not read actions directory: ${actionsDir} — ${err?.message}`,\n    );\n  }\n\n  // 1b. Fallback: if filesystem discovery found no template actions (common\n  //     in bundled serverless environments like Netlify/Vercel where the\n  //     actions/ directory doesn't exist on disk), try importing the\n  //     generated static registry at .generated/actions-registry.\n  //\n  //     This prevents the silent-empty-tools footgun where the agent has no\n  //     template actions and falls back to generic tools like web-request.\n  //     Prefer `loadActionsFromStaticRegistry` over `autoDiscoverActions` for\n  //     production reliability — this fallback is a safety net, not the\n  //     primary path.\n  if (Object.keys(registry).length === 0 && from) {\n    try {\n      let registryPath: string;\n      if (from.startsWith(\"file://\") || from.startsWith(\"file:///\")) {\n        const callerDir = nodePath.dirname(fileURLToPath(from));\n        registryPath = nodePath.resolve(\n          callerDir,\n          \"../../.generated/actions-registry.js\",\n        );\n      } else {\n        registryPath = nodePath.resolve(\n          from,\n          \"../.generated/actions-registry.js\",\n        );\n      }\n      const mod = await import(/* @vite-ignore */ registryPath);\n      const staticEntries = loadActionsFromStaticRegistry(mod.default || mod);\n      Object.assign(registry, staticEntries);\n      if (Object.keys(staticEntries).length > 0) {\n        console.log(\n          `[autoDiscoverActions] Filesystem scan found 0 actions — loaded ${Object.keys(staticEntries).length} from .generated/actions-registry.ts instead. ` +\n            `Consider switching to loadActionsFromStaticRegistry(actionsRegistry) for production reliability.`,\n        );\n      }\n    } catch {\n      // No generated registry available — registry stays empty.\n    }\n  }\n\n  // If still empty after all fallbacks, warn loudly.\n  if (Object.keys(registry).length === 0) {\n    console.warn(\n      `[autoDiscoverActions] WARNING: No template actions found! ` +\n        `The agent will have no template-specific tools. ` +\n        `If in production, switch from autoDiscoverActions to loadActionsFromStaticRegistry. ` +\n        `See: https://docs.agent-native.com/actions#static-registry`,\n    );\n  }\n\n  // 1c. Package-registered actions — contributed by published packages\n  //     (e.g. @agent-native/dispatch) via `registerPackageActions()` from\n  //     import side effects. Merged with skip-existing so the template's\n  //     own actions/ files always win on name collision.\n  for (const [name, entry] of Object.entries(getPackageActions())) {\n    if (registry[name]) continue;\n    registry[name] = entry;\n  }\n\n  // 2. Workspace-core actions — merged in with skipExisting so they can't\n  //    overwrite template entries.\n  try {\n    const { getWorkspaceCoreExports } =\n      await import(\"../deploy/workspace-core.js\");\n    const ws = await getWorkspaceCoreExports(process.cwd());\n    if (ws && ws.actionsDir) {\n      await loadActionsIntoRegistry(ws.actionsDir, registry, true);\n    }\n  } catch {\n    // workspace-core discovery unavailable (e.g. edge runtime) — skip.\n  }\n\n  // 3. Framework-level sharing + file-upload actions — always available to any\n  //    template. Merged with skipExisting so templates can override by\n  //    providing a same-named file.\n  try {\n    await mergeCoreSharingActions(registry);\n  } catch {\n    // Ignore — templates without sharing still work.\n  }\n\n  return registry;\n}\n\nexport async function mergeCoreSharingActions(\n  registry: Record<string, ActionEntry>,\n): Promise<void> {\n  const entries: Array<[string, () => Promise<any>]> = [\n    [\"share-resource\", () => import(\"../sharing/actions/share-resource.js\")],\n    [\n      \"unshare-resource\",\n      () => import(\"../sharing/actions/unshare-resource.js\"),\n    ],\n    [\n      \"list-resource-shares\",\n      () => import(\"../sharing/actions/list-resource-shares.js\"),\n    ],\n    [\n      \"set-resource-visibility\",\n      () => import(\"../sharing/actions/set-resource-visibility.js\"),\n    ],\n    [\n      \"create-agent-resource-link\",\n      () => import(\"../sharing/actions/create-agent-resource-link.js\"),\n    ],\n    [\"upload-image\", () => import(\"../file-upload/actions/upload-image.js\")],\n    [\n      \"context-manifest-get\",\n      () => import(\"../agent/context-xray/actions/context-manifest-get.js\"),\n    ],\n    [\n      \"context-pin\",\n      () => import(\"../agent/context-xray/actions/context-pin.js\"),\n    ],\n    [\n      \"context-evict\",\n      () => import(\"../agent/context-xray/actions/context-evict.js\"),\n    ],\n    [\n      \"context-restore\",\n      () => import(\"../agent/context-xray/actions/context-restore.js\"),\n    ],\n    [\n      \"context-report\",\n      () => import(\"../agent/context-xray/actions/context-report.js\"),\n    ],\n    [\n      \"get-localization-preference\",\n      () => import(\"../localization/actions/get-localization-preference.js\"),\n    ],\n    [\n      \"set-localization-preference\",\n      () => import(\"../localization/actions/set-localization-preference.js\"),\n    ],\n    [\n      \"change-appearance\",\n      () => import(\"../appearance/actions/change-appearance.js\"),\n    ],\n    [\"toggle-demo-mode\", () => import(\"../demo/actions/toggle-demo-mode.js\")],\n    // Audit log — read surface (who changed what, when, agent vs human).\n    [\n      \"list-audit-events\",\n      () => import(\"../audit/actions/list-audit-events.js\"),\n    ],\n    [\"get-audit-event\", () => import(\"../audit/actions/get-audit-event.js\")],\n    // History kit — reusable version snapshots and restore surface.\n    [\n      \"create-resource-version\",\n      () => import(\"../history/actions/create-resource-version.js\"),\n    ],\n    [\n      \"list-resource-versions\",\n      () => import(\"../history/actions/list-resource-versions.js\"),\n    ],\n    [\n      \"get-resource-version\",\n      () => import(\"../history/actions/get-resource-version.js\"),\n    ],\n    [\n      \"restore-resource-version\",\n      () => import(\"../history/actions/restore-resource-version.js\"),\n    ],\n    [\n      \"list-resource-history\",\n      () => import(\"../history/actions/list-resource-history.js\"),\n    ],\n    // Comments/review kit — reusable inline comments, feedback, and review status.\n    [\n      \"list-review-comments\",\n      () => import(\"../review/actions/list-review-comments.js\"),\n    ],\n    [\n      \"create-review-comment\",\n      () => import(\"../review/actions/create-review-comment.js\"),\n    ],\n    [\n      \"reply-review-comment\",\n      () => import(\"../review/actions/reply-review-comment.js\"),\n    ],\n    [\n      \"resolve-review-thread\",\n      () => import(\"../review/actions/resolve-review-thread.js\"),\n    ],\n    [\n      \"delete-review-comment\",\n      () => import(\"../review/actions/delete-review-comment.js\"),\n    ],\n    [\n      \"consume-review-feedback\",\n      () => import(\"../review/actions/consume-review-feedback.js\"),\n    ],\n    [\n      \"get-review-feedback\",\n      () => import(\"../review/actions/get-review-feedback.js\"),\n    ],\n    [\n      \"set-review-status\",\n      () => import(\"../review/actions/set-review-status.js\"),\n    ],\n    // Org service tokens (CI credentials, e.g. PLAN_RECAP_TOKEN). Mint/revoke\n    // are toolCallable:false — preserved via preserveActionFlags below.\n    [\n      \"create-org-service-token\",\n      () => import(\"../mcp/actions/create-org-service-token.js\"),\n    ],\n    [\n      \"list-org-service-tokens\",\n      () => import(\"../mcp/actions/list-org-service-tokens.js\"),\n    ],\n    [\n      \"revoke-org-service-token\",\n      () => import(\"../mcp/actions/revoke-org-service-token.js\"),\n    ],\n  ];\n  for (const [name, loader] of entries) {\n    if (registry[name]) continue;\n    try {\n      const mod = await loader();\n      const def = mod.default;\n      if (def && def.tool && typeof def.run === \"function\") {\n        registry[name] = {\n          tool: def.tool,\n          run: def.run,\n          ...(def.http !== undefined ? { http: def.http } : {}),\n          // Carry security-relevant flags (toolCallable, publicAgent, link,\n          // mcpApp) plus readOnly/parallelSafe. Without this, the sharing\n          // actions' `toolCallable: false` (audit-H5) is dropped and the\n          // tools-iframe bridge 403 in action-routes.ts never fires.\n          ...preserveActionFlags(def),\n        };\n      }\n    } catch {\n      // Skip any sharing action that fails to import.\n    }\n  }\n}\n\n/** @deprecated Use `autoDiscoverActions` instead */\nexport const autoDiscoverScripts = autoDiscoverActions;\n"]}
+{"version":3,"file":"action-discovery.js","sourceRoot":"","sources":["../../src/server/action-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AA+BjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,sDAAsD;AACtD,yFAAyF;AACzF,IAAI,GAAoC,CAAC;AACzC,KAAK,UAAU,KAAK;IAClB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAExD,0DAA0D;AAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,SAAS;IACT,KAAK;IACL,YAAY;IACZ,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,qBAAqB,GAAgC,EAAE,CAAC;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAoC;IAEpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,qBAAqB,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,qBAAqB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACtC,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAS,iBAAiB;IACxB,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,QAAQ,GAAG,CAAC,QAAQ,CAAC;YACrB,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,IAAY,EACZ,SAA4C;IAE5C,MAAM,IAAI,GAAe;QACvB,WAAW,EAAE,YAAY,IAAI,8CAA8C;QAC3E,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,IAAI,EAAE;oBACJ,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,+DAA+D;iBAClE;aACF;SACF;KACF,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,GAAG,EAAE,KAAK,EAAE,IAA4B,EAAmB,EAAE;YAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,+DAA+D;YAC/D,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAA0B;IACrD,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAC1E,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACvE,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC/C,GAAG,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC5C,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,CAAC;IACD,IACE,KAAK,CAAC,WAAW;QACjB,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EACjC,CAAC;QACD,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC;IACD,IACE,KAAK,CAAC,MAAM;QACZ,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAC5B,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,IACE,KAAK,CAAC,MAAM;QACZ,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAC5B,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IACzE,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC7C,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,CAAC;IACD,IACE,OAAO,KAAK,CAAC,aAAa,KAAK,SAAS;QACxC,OAAO,KAAK,CAAC,aAAa,KAAK,UAAU,EACzC,CAAC;QACD,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,GAAY;IACzD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,SAAS,GAAG,GAAwD,CAAC;IAC3E,IAAI,SAAS,EAAE,IAAI,KAAK,4BAA4B;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAEnD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACpD,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAwB,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAY;IAC3C,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IACF,qEAAqE;IACrE,8DAA8D;IAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,eAAe,CAAC;QACpD,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO,eAAe,CAAC;QACpD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1C,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CACpC,UAAkB,EAClB,QAAqC,EACrC,YAAqB;IAErB,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QACvC,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACrC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,YAAY,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAE7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YAEtD,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;iBAC5B,CAAC;YACJ,CAAC;iBAAM,IACL,GAAG,CAAC,OAAO;gBACX,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAC/B,GAAG,CAAC,OAAO,CAAC,IAAI;gBAChB,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,UAAU,EACrC,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI;oBACtB,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG;oBACpB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrE,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC;iBACpC,CAAC;YACJ,CAAC;iBAAM,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,oEAAoE;YACpE,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,WAAW;YACX,MAAM,GAAG,GACP,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CACV,+BAA+B,IAAI,sCAAsC;gBACvE,gFAAgF,GAAG,EAAE,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAgC;IAEhC,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,GAA6C,CAAC;QAC1D,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9C,QAAQ,CAAC,IAAI,CAAC,GAAG;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;aAC5B,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;QACxB,IACE,GAAG;YACH,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,CAAC,IAAI;YACR,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAC7B,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG;gBACf,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,mBAAmB,CAAC,GAAG,CAAC;aAC5B,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY;IAEZ,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAgC,EAAE,CAAC;IAEjD,wEAAwE;IACxE,0EAA0E;IAC1E,WAAW;IACX,IAAI,CAAC;QACH,MAAM,uBAAuB,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CACV,2DAA2D,UAAU,MAAM,GAAG,EAAE,OAAO,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,uEAAuE;IACvE,mEAAmE;IACnE,gEAAgE;IAChE,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,sEAAsE;IACtE,oBAAoB;IACpB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,YAAoB,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9D,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxD,YAAY,GAAG,QAAQ,CAAC,OAAO,CAC7B,SAAS,EACT,sCAAsC,CACvC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,QAAQ,CAAC,OAAO,CAC7B,IAAI,EACJ,mCAAmC,CACpC,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAC1D,MAAM,aAAa,GAAG,6BAA6B,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;YACxE,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACvC,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,OAAO,CAAC,GAAG,CACT,kEAAkE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,gDAAgD;oBACjJ,kGAAkG,CACrG,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;QAC5D,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CACV,4DAA4D;YAC1D,kDAAkD;YAClD,sFAAsF;YACtF,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,wEAAwE;IACxE,uEAAuE;IACvE,uDAAuD;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,wEAAwE;IACxE,iCAAiC;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,uBAAuB,EAAE,GAC/B,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACxD,IAAI,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,uBAAuB,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;IACrE,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,kCAAkC;IAClC,IAAI,CAAC;QACH,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAqC;IAErC,MAAM,OAAO,GAAwC;QACnD,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QACxE;YACE,kBAAkB;YAClB,GAAG,EAAE,CAAC,MAAM,CAAC,wCAAwC,CAAC;SACvD;QACD;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,yBAAyB;YACzB,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC;SAC9D;QACD;YACE,4BAA4B;YAC5B,GAAG,EAAE,CAAC,MAAM,CAAC,kDAAkD,CAAC;SACjE;QACD,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,wCAAwC,CAAC,CAAC;QACxE;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,uDAAuD,CAAC;SACtE;QACD;YACE,aAAa;YACb,GAAG,EAAE,CAAC,MAAM,CAAC,8CAA8C,CAAC;SAC7D;QACD;YACE,eAAe;YACf,GAAG,EAAE,CAAC,MAAM,CAAC,gDAAgD,CAAC;SAC/D;QACD;YACE,iBAAiB;YACjB,GAAG,EAAE,CAAC,MAAM,CAAC,kDAAkD,CAAC;SACjE;QACD;YACE,gBAAgB;YAChB,GAAG,EAAE,CAAC,MAAM,CAAC,iDAAiD,CAAC;SAChE;QACD;YACE,6BAA6B;YAC7B,GAAG,EAAE,CAAC,MAAM,CAAC,wDAAwD,CAAC;SACvE;QACD;YACE,6BAA6B;YAC7B,GAAG,EAAE,CAAC,MAAM,CAAC,wDAAwD,CAAC;SACvE;QACD;YACE,mBAAmB;YACnB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACzE,qEAAqE;QACrE;YACE,mBAAmB;YACnB,GAAG,EAAE,CAAC,MAAM,CAAC,uCAAuC,CAAC;SACtD;QACD,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;QACxE;YACE,qBAAqB;YACrB,GAAG,EAAE,CAAC,MAAM,CAAC,yCAAyC,CAAC;SACxD;QACD,gEAAgE;QAChE;YACE,yBAAyB;YACzB,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC;SAC9D;QACD;YACE,wBAAwB;YACxB,GAAG,EAAE,CAAC,MAAM,CAAC,8CAA8C,CAAC;SAC7D;QACD;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,0BAA0B;YAC1B,GAAG,EAAE,CAAC,MAAM,CAAC,gDAAgD,CAAC;SAC/D;QACD;YACE,uBAAuB;YACvB,GAAG,EAAE,CAAC,MAAM,CAAC,6CAA6C,CAAC;SAC5D;QACD,+EAA+E;QAC/E;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC;SAC1D;QACD;YACE,uBAAuB;YACvB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,sBAAsB;YACtB,GAAG,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC;SAC1D;QACD;YACE,uBAAuB;YACvB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,uBAAuB;YACvB,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,yBAAyB;YACzB,GAAG,EAAE,CAAC,MAAM,CAAC,8CAA8C,CAAC;SAC7D;QACD;YACE,qBAAqB;YACrB,GAAG,EAAE,CAAC,MAAM,CAAC,0CAA0C,CAAC;SACzD;QACD;YACE,mBAAmB;YACnB,GAAG,EAAE,CAAC,MAAM,CAAC,wCAAwC,CAAC;SACvD;QACD,0EAA0E;QAC1E,oEAAoE;QACpE;YACE,0BAA0B;YAC1B,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;QACD;YACE,yBAAyB;YACzB,GAAG,EAAE,CAAC,MAAM,CAAC,2CAA2C,CAAC;SAC1D;QACD;YACE,0BAA0B;YAC1B,GAAG,EAAE,CAAC,MAAM,CAAC,4CAA4C,CAAC;SAC3D;KACF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC;YACxB,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBACrD,QAAQ,CAAC,IAAI,CAAC,GAAG;oBACf,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,GAAG,EAAE,GAAG,CAAC,GAAG;oBACZ,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrD,kEAAkE;oBAClE,gEAAgE;oBAChE,+DAA+D;oBAC/D,2DAA2D;oBAC3D,GAAG,mBAAmB,CAAC,GAAG,CAAC;iBAC5B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC","sourcesContent":["import nodePath from \"node:path\";\n\n/**\n * Auto-discover actions from a template's actions/ directory.\n *\n * Scans for .ts/.js files and builds an action registry suitable for\n * `createAgentChatPlugin({ actions })`.\n *\n * Supports two action conventions:\n *\n * 1. **Full interface** — exports `tool: ActionTool` and `run(args): Promise<string>`.\n *    These are used directly.\n *\n * 2. **CLI-style** — exports only `default async function(args: string[])`.\n *    These are wrapped: args are converted from `Record<string, string>` to\n *    `[\"--key\", \"value\", ...]`, console output is captured, and a tool\n *    definition is synthesized from the action name.\n *\n * 3. **defineAction** — exports `default` from `defineAction()`. Has `tool` and `run`.\n *\n * Usage in agent-chat plugins:\n * ```ts\n * import { autoDiscoverActions } from \"@agent-native/core/server\";\n *\n * export default createAgentChatPlugin({\n *   actions: () => autoDiscoverActions(import.meta.url),\n * });\n * ```\n */\nimport type { ActionEntry } from \"../agent/production-agent.js\";\nimport type { ActionTool } from \"../agent/types.js\";\nimport { captureCliOutput } from \"./cli-capture.js\";\n\n// Lazy fs — loaded via dynamic import() on first use.\n// Avoids require() which bundlers convert to createRequire() that crashes on CF Workers.\nlet _fs: typeof import(\"fs\") | undefined;\nasync function getFs(): Promise<typeof import(\"fs\")> {\n  if (!_fs) {\n    _fs = await import(\"node:fs\");\n  }\n  return _fs;\n}\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\n\n/** Files to skip during auto-discovery (no extension). */\nconst SKIP_FILES = new Set([\n  \"helpers\",\n  \"run\",\n  \"db-connect\",\n  \"db-status\",\n  \"registry\",\n]);\n\nfunction isRuntimeSourceFile(filename: string): boolean {\n  if (!/\\.(ts|js)$/.test(filename)) return false;\n  if (/\\.d\\.ts$/.test(filename)) return false;\n  if (/\\.(test|spec)\\.(ts|js)$/.test(filename)) return false;\n  return true;\n}\n\n/**\n * Global registry of actions contributed by published packages\n * (e.g. `@agent-native/dispatch`). Populated by `registerPackageActions()`\n * which the package calls from import side effects, then merged into\n * `autoDiscoverActions` after the template's local `actions/` directory.\n *\n * Ordering: template `actions/` files always win on name collision so\n * consumers can override a packaged action by dropping a same-named file\n * in their own `actions/` dir.\n */\nconst packageActionRegistry: Record<string, ActionEntry> = {};\n\n/**\n * Register a map of actions contributed by a published package.\n *\n * Called from a package's server entrypoint via import side effects:\n * ```ts\n * // packages/dispatch/src/server/index.ts\n * import { registerPackageActions } from \"@agent-native/core/server\";\n * import { actions } from \"../actions/index.js\";\n * registerPackageActions(actions);\n * ```\n *\n * Idempotent — re-registering the same name from the same import is a no-op\n * so HMR / repeated dynamic imports don't double-warn.\n */\nexport function registerPackageActions(\n  actions: Record<string, ActionEntry>,\n): void {\n  for (const [name, entry] of Object.entries(actions)) {\n    if (packageActionRegistry[name]) continue;\n    packageActionRegistry[name] = entry;\n  }\n}\n\n/** Internal — used by `autoDiscoverActions`. Returns a shallow copy. */\nfunction getPackageActions(): Record<string, ActionEntry> {\n  return { ...packageActionRegistry };\n}\n\n/**\n * Split a string into shell-like tokens, handling double and single quotes.\n * `--title \"My Page\" --content \"\"` → `[\"--title\", \"My Page\", \"--content\", \"\"]`\n */\nfunction splitShellArgs(input: string): string[] {\n  const tokens: string[] = [];\n  let current = \"\";\n  let inDouble = false;\n  let inSingle = false;\n  let wasQuoted = false;\n\n  for (let i = 0; i < input.length; i++) {\n    const ch = input[i];\n    if (ch === '\"' && !inSingle) {\n      inDouble = !inDouble;\n      wasQuoted = true;\n      continue;\n    }\n    if (ch === \"'\" && !inDouble) {\n      inSingle = !inSingle;\n      wasQuoted = true;\n      continue;\n    }\n    if ((ch === \" \" || ch === \"\\t\") && !inDouble && !inSingle) {\n      if (current.length > 0 || wasQuoted) {\n        tokens.push(current);\n      }\n      current = \"\";\n      wasQuoted = false;\n      continue;\n    }\n    current += ch;\n  }\n  if (current.length > 0 || wasQuoted) {\n    tokens.push(current);\n  }\n  return tokens;\n}\n\n/**\n * Wrap a CLI-style action (that writes to console.log) as an ActionEntry\n * by capturing stdout/stderr and intercepting process.exit. Uses the\n * shared AsyncLocalStorage-backed capture so concurrent invocations do\n * not corrupt the global `console.log` / `process.stdout.write` /\n * `process.exit` pointers (see `cli-capture.ts`).\n */\nfunction wrapDefaultExport(\n  name: string,\n  defaultFn: (args: string[]) => Promise<void>,\n): ActionEntry {\n  const tool: ActionTool = {\n    description: `Run the \"${name}\" action. Pass arguments as key-value pairs.`,\n    parameters: {\n      type: \"object\",\n      properties: {\n        args: {\n          type: \"string\",\n          description:\n            \"Space-separated CLI arguments (e.g. '--id abc --title Hello')\",\n        },\n      },\n    },\n  };\n\n  return {\n    tool,\n    run: async (args: Record<string, string>): Promise<string> => {\n      const cliArgs: string[] = [];\n      // If only an \"args\" key was provided, split it into CLI tokens\n      if (args.args && Object.keys(args).length === 1) {\n        cliArgs.push(...splitShellArgs(args.args));\n      } else {\n        for (const [k, v] of Object.entries(args)) {\n          cliArgs.push(`--${k}`, v);\n        }\n      }\n      return captureCliOutput(() => defaultFn(cliArgs));\n    },\n  };\n}\n\nfunction preserveActionFlags(entry: Record<string, any>): Partial<ActionEntry> {\n  const out: Partial<ActionEntry> = {};\n  if (typeof entry.agentTool === \"boolean\") out.agentTool = entry.agentTool;\n  if (typeof entry.requiresAuth === \"boolean\") {\n    out.requiresAuth = entry.requiresAuth;\n  }\n  if (typeof entry.readOnly === \"boolean\") out.readOnly = entry.readOnly;\n  if (typeof entry.allowInPlanMode === \"boolean\") {\n    out.allowInPlanMode = entry.allowInPlanMode;\n  }\n  if (typeof entry.parallelSafe === \"boolean\") {\n    out.parallelSafe = entry.parallelSafe;\n  }\n  if (typeof entry.toolCallable === \"boolean\") {\n    out.toolCallable = entry.toolCallable;\n  }\n  if (\n    entry.publicAgent &&\n    typeof entry.publicAgent === \"object\" &&\n    !Array.isArray(entry.publicAgent)\n  ) {\n    out.publicAgent = entry.publicAgent;\n  }\n  if (typeof entry.link === \"function\") {\n    out.link = entry.link;\n  }\n  if (\n    entry.mcpApp &&\n    typeof entry.mcpApp === \"object\" &&\n    !Array.isArray(entry.mcpApp)\n  ) {\n    out.mcpApp = entry.mcpApp;\n  }\n  if (\n    entry.chatUI &&\n    typeof entry.chatUI === \"object\" &&\n    !Array.isArray(entry.chatUI)\n  ) {\n    out.chatUI = entry.chatUI;\n  }\n  if (typeof entry.timeoutMs === \"number\") out.timeoutMs = entry.timeoutMs;\n  if (typeof entry.maxResultChars === \"number\") {\n    out.maxResultChars = entry.maxResultChars;\n  }\n  if (\n    typeof entry.needsApproval === \"boolean\" ||\n    typeof entry.needsApproval === \"function\"\n  ) {\n    out.needsApproval = entry.needsApproval;\n  }\n  return out;\n}\n\nfunction shouldRetryWithJiti(filePath: string, err: unknown): boolean {\n  if (!filePath.endsWith(\".ts\")) return false;\n  const candidate = err as { code?: unknown; message?: unknown } | undefined;\n  if (candidate?.code === \"ERR_UNKNOWN_FILE_EXTENSION\") return true;\n  return /Unknown file extension \".ts\"/.test(String(candidate?.message ?? \"\"));\n}\n\nasync function importRuntimeSourceModule(\n  filePath: string,\n): Promise<Record<string, any>> {\n  try {\n    return await import(/* @vite-ignore */ pathToFileURL(filePath).href);\n  } catch (err) {\n    if (!shouldRetryWithJiti(filePath, err)) throw err;\n\n    const { createJiti } = await import(\"jiti\");\n    const jiti = createJiti(pathToFileURL(filePath).href, {\n      interopDefault: true,\n    });\n    return (await jiti.import(filePath)) as Record<string, any>;\n  }\n}\n\n/**\n * Resolve the actions directory from the caller's context.\n *\n * @param from - Either an `import.meta.url` (file:// URL from a plugin file),\n *   an absolute directory path, or \"auto\" to use `process.cwd() + \"/actions\"`.\n *   When an import.meta.url is provided, the actions directory is resolved as\n *   `../../actions/` relative to the caller (typically `server/plugins/agent-chat.ts`).\n *   If the resolved directory doesn't exist, falls back to `../../scripts/` for\n *   backwards compatibility, then to `process.cwd() + \"/actions\"`.\n */\nasync function resolveActionsDir(from: string): Promise<string> {\n  const fs = await getFs();\n  const exists = (p: string) => {\n    try {\n      return fs.existsSync(p);\n    } catch {\n      return false;\n    }\n  };\n  // On edge runtimes (e.g. Cloudflare Workers), import.meta.url may be\n  // undefined after bundling. Fall back to cwd-based discovery.\n  if (!from) {\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  if (from.startsWith(\"file://\") || from.startsWith(\"file:///\")) {\n    const callerPath = fileURLToPath(from);\n    const callerDir = nodePath.dirname(callerPath);\n    const actionsResolved = nodePath.resolve(callerDir, \"../../actions\");\n    if (exists(actionsResolved)) return actionsResolved;\n    const scriptsResolved = nodePath.resolve(callerDir, \"../../scripts\");\n    if (exists(scriptsResolved)) return scriptsResolved;\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  if (from === \"auto\") {\n    const cwdActions = nodePath.join(process.cwd(), \"actions\");\n    if (exists(cwdActions)) return cwdActions;\n    return nodePath.join(process.cwd(), \"scripts\");\n  }\n  return nodePath.resolve(from);\n}\n\n/**\n * Load actions from a single directory into the given registry. Shared by\n * both the template-actions discovery path and the workspace-core actions\n * layer. When `skipExisting` is true, an entry with the same name that's\n * already in the registry is left untouched (template-wins on collision).\n */\nasync function loadActionsIntoRegistry(\n  actionsDir: string,\n  registry: Record<string, ActionEntry>,\n  skipExisting: boolean,\n): Promise<void> {\n  let files: string[];\n  try {\n    const fs = await getFs();\n    if (!fs.existsSync(actionsDir)) return;\n    files = fs.readdirSync(actionsDir);\n  } catch {\n    return;\n  }\n\n  const actionFiles = files.filter((f) => {\n    if (!isRuntimeSourceFile(f)) return false;\n    const name = f.replace(/\\.(ts|js)$/, \"\");\n    if (name.startsWith(\"_\")) return false;\n    if (SKIP_FILES.has(name)) return false;\n    return true;\n  });\n\n  for (const file of actionFiles) {\n    const name = file.replace(/\\.(ts|js)$/, \"\");\n    if (skipExisting && registry[name]) continue;\n\n    const filePath = nodePath.join(actionsDir, file);\n    try {\n      const mod = await importRuntimeSourceModule(filePath);\n\n      if (mod.tool && typeof mod.run === \"function\") {\n        registry[name] = {\n          tool: mod.tool,\n          run: mod.run,\n          ...(mod.http !== undefined ? { http: mod.http } : {}),\n          ...preserveActionFlags(mod),\n        };\n      } else if (\n        mod.default &&\n        typeof mod.default === \"object\" &&\n        mod.default.tool &&\n        typeof mod.default.run === \"function\"\n      ) {\n        registry[name] = {\n          tool: mod.default.tool,\n          run: mod.default.run,\n          ...(mod.default.http !== undefined ? { http: mod.default.http } : {}),\n          ...preserveActionFlags(mod.default),\n        };\n      } else if (typeof mod.default === \"function\") {\n        registry[name] = wrapDefaultExport(name, mod.default);\n      }\n    } catch (err) {\n      // CLI-style scripts (top-level execution) throw on import — expected,\n      // they're available via `pnpm action <name>` / shell instead. But a\n      // syntax error, bad import, or malformed defineAction in a real action\n      // file lands here too and would silently vanish from the agent's tools.\n      // Warn so a broken action file is diagnosable instead of mysteriously\n      // missing.\n      const msg =\n        err instanceof Error ? (err.stack ?? err.message) : String(err);\n      console.warn(\n        `[action-discovery] Skipped \"${file}\" — failed to import. If this is an ` +\n          `agent action (not a CLI script), it will be missing from the agent's tools:\\n${msg}`,\n      );\n    }\n  }\n}\n\n/**\n * Normalize a pre-bundled static action registry (name → raw module) into\n * the `Record<string, ActionEntry>` shape the agent-chat plugin expects.\n *\n * Used by `autoDiscoverActions` when `.generated/actions-registry.ts` is\n * present so that Nitro-bundled serverless functions (Netlify, Vercel,\n * AWS-Lambda) can serve `/_agent-native/actions/*` routes without relying\n * on a filesystem scan that doesn't work in bundled output.\n */\nexport function loadActionsFromStaticRegistry(\n  modules: Record<string, unknown>,\n): Record<string, ActionEntry> {\n  const registry: Record<string, ActionEntry> = {};\n  for (const [name, raw] of Object.entries(modules)) {\n    const mod = raw as Record<string, any> | null | undefined;\n    if (!mod) continue;\n\n    if (mod.tool && typeof mod.run === \"function\") {\n      registry[name] = {\n        tool: mod.tool,\n        run: mod.run,\n        ...(mod.http !== undefined ? { http: mod.http } : {}),\n        ...preserveActionFlags(mod),\n      };\n      continue;\n    }\n\n    const def = mod.default;\n    if (\n      def &&\n      typeof def === \"object\" &&\n      def.tool &&\n      typeof def.run === \"function\"\n    ) {\n      registry[name] = {\n        tool: def.tool,\n        run: def.run,\n        ...(def.http !== undefined ? { http: def.http } : {}),\n        ...preserveActionFlags(def),\n      };\n      continue;\n    }\n\n    if (typeof def === \"function\") {\n      registry[name] = wrapDefaultExport(name, def);\n    }\n  }\n  return registry;\n}\n\n/**\n * Auto-discover actions from a directory.\n *\n * Merges in any actions from the enterprise workspace core (if present in\n * the ancestor chain). Template actions take precedence over workspace-core\n * actions on name collision, so an app can override an enterprise-wide\n * action by dropping a same-named file under its own `actions/`.\n *\n * Note: this helper uses a filesystem scan, which works in dev and in\n * non-bundled Node deployments. In bundled serverless functions (Nitro's\n * netlify / vercel / aws-lambda presets) the `actions/` directory is not\n * on disk at runtime; templates should pass the static registry generated\n * by the Vite plugin to `createAgentChatPlugin({ actions })` instead, so\n * the bundler sees static imports and pulls every action into the bundle.\n *\n * @param from - The caller's `import.meta.url` or an absolute path to the\n *   actions directory.\n * @returns A record mapping action names to ActionEntry objects, suitable for\n *   passing to `createAgentChatPlugin({ actions })`.\n */\nexport async function autoDiscoverActions(\n  from: string,\n): Promise<Record<string, ActionEntry>> {\n  const actionsDir = await resolveActionsDir(from);\n  const registry: Record<string, ActionEntry> = {};\n\n  // 1. Template actions first — these are the authoritative layer for the\n  //    current app and must override any workspace-core entry with the same\n  //    name.\n  try {\n    await loadActionsIntoRegistry(actionsDir, registry, false);\n  } catch (err: any) {\n    console.warn(\n      `[autoDiscoverActions] Could not read actions directory: ${actionsDir} — ${err?.message}`,\n    );\n  }\n\n  // 1b. Fallback: if filesystem discovery found no template actions (common\n  //     in bundled serverless environments like Netlify/Vercel where the\n  //     actions/ directory doesn't exist on disk), try importing the\n  //     generated static registry at .generated/actions-registry.\n  //\n  //     This prevents the silent-empty-tools footgun where the agent has no\n  //     template actions and falls back to generic tools like web-request.\n  //     Prefer `loadActionsFromStaticRegistry` over `autoDiscoverActions` for\n  //     production reliability — this fallback is a safety net, not the\n  //     primary path.\n  if (Object.keys(registry).length === 0 && from) {\n    try {\n      let registryPath: string;\n      if (from.startsWith(\"file://\") || from.startsWith(\"file:///\")) {\n        const callerDir = nodePath.dirname(fileURLToPath(from));\n        registryPath = nodePath.resolve(\n          callerDir,\n          \"../../.generated/actions-registry.js\",\n        );\n      } else {\n        registryPath = nodePath.resolve(\n          from,\n          \"../.generated/actions-registry.js\",\n        );\n      }\n      const mod = await import(/* @vite-ignore */ registryPath);\n      const staticEntries = loadActionsFromStaticRegistry(mod.default || mod);\n      Object.assign(registry, staticEntries);\n      if (Object.keys(staticEntries).length > 0) {\n        console.log(\n          `[autoDiscoverActions] Filesystem scan found 0 actions — loaded ${Object.keys(staticEntries).length} from .generated/actions-registry.ts instead. ` +\n            `Consider switching to loadActionsFromStaticRegistry(actionsRegistry) for production reliability.`,\n        );\n      }\n    } catch {\n      // No generated registry available — registry stays empty.\n    }\n  }\n\n  // If still empty after all fallbacks, warn loudly.\n  if (Object.keys(registry).length === 0) {\n    console.warn(\n      `[autoDiscoverActions] WARNING: No template actions found! ` +\n        `The agent will have no template-specific tools. ` +\n        `If in production, switch from autoDiscoverActions to loadActionsFromStaticRegistry. ` +\n        `See: https://docs.agent-native.com/actions#static-registry`,\n    );\n  }\n\n  // 1c. Package-registered actions — contributed by published packages\n  //     (e.g. @agent-native/dispatch) via `registerPackageActions()` from\n  //     import side effects. Merged with skip-existing so the template's\n  //     own actions/ files always win on name collision.\n  for (const [name, entry] of Object.entries(getPackageActions())) {\n    if (registry[name]) continue;\n    registry[name] = entry;\n  }\n\n  // 2. Workspace-core actions — merged in with skipExisting so they can't\n  //    overwrite template entries.\n  try {\n    const { getWorkspaceCoreExports } =\n      await import(\"../deploy/workspace-core.js\");\n    const ws = await getWorkspaceCoreExports(process.cwd());\n    if (ws && ws.actionsDir) {\n      await loadActionsIntoRegistry(ws.actionsDir, registry, true);\n    }\n  } catch {\n    // workspace-core discovery unavailable (e.g. edge runtime) — skip.\n  }\n\n  // 3. Framework-level sharing + file-upload actions — always available to any\n  //    template. Merged with skipExisting so templates can override by\n  //    providing a same-named file.\n  try {\n    await mergeCoreSharingActions(registry);\n  } catch {\n    // Ignore — templates without sharing still work.\n  }\n\n  return registry;\n}\n\nexport async function mergeCoreSharingActions(\n  registry: Record<string, ActionEntry>,\n): Promise<void> {\n  const entries: Array<[string, () => Promise<any>]> = [\n    [\"share-resource\", () => import(\"../sharing/actions/share-resource.js\")],\n    [\n      \"unshare-resource\",\n      () => import(\"../sharing/actions/unshare-resource.js\"),\n    ],\n    [\n      \"list-resource-shares\",\n      () => import(\"../sharing/actions/list-resource-shares.js\"),\n    ],\n    [\n      \"set-resource-visibility\",\n      () => import(\"../sharing/actions/set-resource-visibility.js\"),\n    ],\n    [\n      \"create-agent-resource-link\",\n      () => import(\"../sharing/actions/create-agent-resource-link.js\"),\n    ],\n    [\"upload-image\", () => import(\"../file-upload/actions/upload-image.js\")],\n    [\n      \"context-manifest-get\",\n      () => import(\"../agent/context-xray/actions/context-manifest-get.js\"),\n    ],\n    [\n      \"context-pin\",\n      () => import(\"../agent/context-xray/actions/context-pin.js\"),\n    ],\n    [\n      \"context-evict\",\n      () => import(\"../agent/context-xray/actions/context-evict.js\"),\n    ],\n    [\n      \"context-restore\",\n      () => import(\"../agent/context-xray/actions/context-restore.js\"),\n    ],\n    [\n      \"context-report\",\n      () => import(\"../agent/context-xray/actions/context-report.js\"),\n    ],\n    [\n      \"get-localization-preference\",\n      () => import(\"../localization/actions/get-localization-preference.js\"),\n    ],\n    [\n      \"set-localization-preference\",\n      () => import(\"../localization/actions/set-localization-preference.js\"),\n    ],\n    [\n      \"change-appearance\",\n      () => import(\"../appearance/actions/change-appearance.js\"),\n    ],\n    [\"toggle-demo-mode\", () => import(\"../demo/actions/toggle-demo-mode.js\")],\n    // Audit log — read surface (who changed what, when, agent vs human).\n    [\n      \"list-audit-events\",\n      () => import(\"../audit/actions/list-audit-events.js\"),\n    ],\n    [\"get-audit-event\", () => import(\"../audit/actions/get-audit-event.js\")],\n    [\n      \"export-audit-events\",\n      () => import(\"../audit/actions/export-audit-events.js\"),\n    ],\n    // History kit — reusable version snapshots and restore surface.\n    [\n      \"create-resource-version\",\n      () => import(\"../history/actions/create-resource-version.js\"),\n    ],\n    [\n      \"list-resource-versions\",\n      () => import(\"../history/actions/list-resource-versions.js\"),\n    ],\n    [\n      \"get-resource-version\",\n      () => import(\"../history/actions/get-resource-version.js\"),\n    ],\n    [\n      \"restore-resource-version\",\n      () => import(\"../history/actions/restore-resource-version.js\"),\n    ],\n    [\n      \"list-resource-history\",\n      () => import(\"../history/actions/list-resource-history.js\"),\n    ],\n    // Comments/review kit — reusable inline comments, feedback, and review status.\n    [\n      \"list-review-comments\",\n      () => import(\"../review/actions/list-review-comments.js\"),\n    ],\n    [\n      \"create-review-comment\",\n      () => import(\"../review/actions/create-review-comment.js\"),\n    ],\n    [\n      \"reply-review-comment\",\n      () => import(\"../review/actions/reply-review-comment.js\"),\n    ],\n    [\n      \"resolve-review-thread\",\n      () => import(\"../review/actions/resolve-review-thread.js\"),\n    ],\n    [\n      \"delete-review-comment\",\n      () => import(\"../review/actions/delete-review-comment.js\"),\n    ],\n    [\n      \"consume-review-feedback\",\n      () => import(\"../review/actions/consume-review-feedback.js\"),\n    ],\n    [\n      \"get-review-feedback\",\n      () => import(\"../review/actions/get-review-feedback.js\"),\n    ],\n    [\n      \"set-review-status\",\n      () => import(\"../review/actions/set-review-status.js\"),\n    ],\n    // Org service tokens (CI credentials, e.g. PLAN_RECAP_TOKEN). Mint/revoke\n    // are toolCallable:false — preserved via preserveActionFlags below.\n    [\n      \"create-org-service-token\",\n      () => import(\"../mcp/actions/create-org-service-token.js\"),\n    ],\n    [\n      \"list-org-service-tokens\",\n      () => import(\"../mcp/actions/list-org-service-tokens.js\"),\n    ],\n    [\n      \"revoke-org-service-token\",\n      () => import(\"../mcp/actions/revoke-org-service-token.js\"),\n    ],\n  ];\n  for (const [name, loader] of entries) {\n    if (registry[name]) continue;\n    try {\n      const mod = await loader();\n      const def = mod.default;\n      if (def && def.tool && typeof def.run === \"function\") {\n        registry[name] = {\n          tool: def.tool,\n          run: def.run,\n          ...(def.http !== undefined ? { http: def.http } : {}),\n          // Carry security-relevant flags (toolCallable, publicAgent, link,\n          // mcpApp) plus readOnly/parallelSafe. Without this, the sharing\n          // actions' `toolCallable: false` (audit-H5) is dropped and the\n          // tools-iframe bridge 403 in action-routes.ts never fires.\n          ...preserveActionFlags(def),\n        };\n      }\n    } catch {\n      // Skip any sharing action that fails to import.\n    }\n  }\n}\n\n/** @deprecated Use `autoDiscoverActions` instead */\nexport const autoDiscoverScripts = autoDiscoverActions;\n"]}

package/dist/server/agent-chat-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAEZ,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAsCrC,OAAO,KAAK,EAGV,UAAU,EACX,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAQL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAKrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EAEnB,WAAW,EACX,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAe/B,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAElB,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAoBL,KAAK,UAAU,EAGhB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,gBAAgB,EAcjB,MAAM,wBAAwB,CAAC;AAkBhC,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;AA+BpC,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AA4E5B,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACrE,iBAAiB,EAAE,CACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KACzB,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;CACjC;AAsID,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,6BAA6B;;;;YA/L/B,MAAM;eACH,MAAM;iBACJ,MAAM;sBACD,MAAM;mBACT,MAAM;mBACN,MAAM;eACV;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI;kBACpC,KAAK,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;YACtC,IAAI,EAAE,MAAM,CAAC;YACb,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;SAC7B,CAAC;;;GAiNH;AAmaD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,KAAK,CAAC;IACP,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;CACzC,CAAC,CASD;AAmBD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,OAAO,GAAE,0BAA0B,GAAG;IAAE,KAAK,CAAC,EAAE,GAAG,CAAA;CAAO,GACzD;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAa7C;AAmYD,iBAAS,6BAA6B,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAyDpE;AA+rCD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,wCAAwC;IACxC,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;sDAGkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EACH,OAAO,0BAA0B,EAAE,WAAW,GAC9C,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,gBAAgB,CAAC,EACb,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QACd,mEAAmE;QACnE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,uEAAuE;QACvE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gFAAgF;QAChF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gFAAgF;QAChF,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC,CAAC;KACJ,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,GAAG,EACV,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,8BAA8B,EAAE,2BAA2B,CAAC;IACxF;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC;QACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;KACtB,KACG,IAAI,GACJ;QACE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,GACD,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,CAAC,CAAC;IACP;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC7B,OAAO,EAAE,OAAO,iBAAiB,EAAE,OAAO,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,iBAAiB,EAAE,iBAAiB,CAAC;QACrD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/B,KACG,OAAO,iBAAiB,EAAE,OAAO,GACjC,MAAM,GACN,IAAI,GACJ,SAAS,GACT,OAAO,CAAC,OAAO,iBAAiB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC3E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE;QACd,UAAU,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,SAAS,CAAC;QAC7C;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,KAAK,kBAAkB,GAAG,OAAO,iCAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAC7C,aAAa,EAAE,IAAI,CACjB,sBAAsB,EACtB,oBAAoB,GAAG,kBAAkB,CAC1C,EACD,cAAc,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EACjD,MAAM,GAAE,kBAAsD,kEAU/D;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,UAAU,EAAE,EAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAC1B;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,cAAc,EAAE,UAAU,EAAE,CAAA;CAAE,CAKvD;AAuLD;;;;;;;;GAQG;AACH,iBAAS,qBAAqB,CAC5B,QAAQ,CAAC,EAAE,cAAc,EACzB,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E;IACD,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6BAA6B,EAAE,MAAM,CAAC;IACtC,4BAA4B,EAAE,MAAM,CAAC;CACtC,CAuLA;AAED,eAAO,MAAM,gCAAgC;;;;;;;CAczC,CAAC;AAEL;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,UAAQ,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,GAAE,MAAM,GAAG,IAAgC,GAC/C,OAAO,CAAC,MAAM,CAAC,CAkOjB;AAsBD;;;;;;;;;;;GAWG;AACH,iBAAS,qBAAqB,CAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,IAAI,GAAE,KAAK,GAAG,MAAe,GAC5B,MAAM,CAoER;AA0KD,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,OAAO,CA2BV;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAC3C,cAAc,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAgCtC;AAmBD,KAAK,0BAA0B,GAC3B,qCAAqC,GACrC,0CAA0C,GAC1C,SAAS,GACT,iBAAiB,GACjB,YAAY,GACZ,UAAU,GACV,KAAK,GACL,cAAc,GACd,4BAA4B,GAC5B,uBAAuB,CAAC;AAE5B,KAAK,uBAAuB,GAAG,OAAO,CACpC,MAAM,CAAC,0BAA0B,EAAE,MAAM,GAAG,SAAS,CAAC,CACvD,CAAC;AAiCF,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,uBAAqC,GACzC,OAAO,CAwBT;AAED,KAAK,8BAA8B,GAAG;IACpC,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACvD,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;IACjC,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACnD,wBAAwB,CAAC,EAAE,OAAO,wBAAwB,CAAC;IAC3D,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;CACxD,CAAC;AAEF,wBAAsB,yCAAyC,CAC7D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE,8BAAmC,GACxC,OAAO,CAAC,OAAO,CAAC,CAqClB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CAuyJhB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAa9E,yEAAyE;AACzE,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAE7D;AAED,yFAAyF;AACzF,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAKhE"}
+{"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAEZ,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,EAC1B,MAAM,6BAA6B,CAAC;AAuCrC,OAAO,KAAK,EAGV,UAAU,EACX,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAQL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAKrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAEL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EAEnB,WAAW,EACX,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAe/B,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACd,kBAAkB,EAElB,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAoBL,KAAK,UAAU,EAGhB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,gBAAgB,EAcjB,MAAM,wBAAwB,CAAC;AAkBhC,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;AA+BpC,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,oBAAoB,CAAC;AA4E5B,MAAM,WAAW,6BAA6B;IAC5C,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACrE,iBAAiB,EAAE,CACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KACzB,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;CACjC;AAsID,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,6BAA6B;;;;YA/L/B,MAAM;eACH,MAAM;iBACJ,MAAM;sBACD,MAAM;mBACT,MAAM;mBACN,MAAM;eACV;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI;kBACpC,KAAK,CAAC;YACd,EAAE,CAAC,EAAE,MAAM,CAAC;YACZ,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;YACtC,IAAI,EAAE,MAAM,CAAC;YACb,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;SAC7B,CAAC;;;GAiNH;AAmaD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GACnC,KAAK,CAAC;IACP,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;CACzC,CAAC,CASD;AAmBD,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,OAAO,GAAE,0BAA0B,GAAG;IAAE,KAAK,CAAC,EAAE,GAAG,CAAA;CAAO,GACzD;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAa7C;AAuYD,iBAAS,6BAA6B,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAyDpE;AA+rCD,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,wCAAwC;IACxC,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;sDAGkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EACH,OAAO,0BAA0B,EAAE,WAAW,GAC9C,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,gBAAgB,CAAC,EACb,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QACd,mEAAmE;QACnE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,uEAAuE;QACvE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gFAAgF;QAChF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gFAAgF;QAChF,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC,CAAC;KACJ,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,GAAG,EACV,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,8BAA8B,EAAE,2BAA2B,CAAC;IACxF;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC;QACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;KACtB,KACG,IAAI,GACJ;QACE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,GACD,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,CAAC,CAAC;IACP;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC7B,OAAO,EAAE,OAAO,iBAAiB,EAAE,OAAO,CAAC;QAC3C,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,iBAAiB,EAAE,iBAAiB,CAAC;QACrD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/B,KACG,OAAO,iBAAiB,EAAE,OAAO,GACjC,MAAM,GACN,IAAI,GACJ,SAAS,GACT,OAAO,CAAC,OAAO,iBAAiB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC3E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE;QACd,UAAU,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,SAAS,CAAC;QAC7C;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,KAAK,kBAAkB,GAAG,OAAO,iCAAiC,CAAC;AAEnE;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAC7C,aAAa,EAAE,IAAI,CACjB,sBAAsB,EACtB,oBAAoB,GAAG,kBAAkB,CAC1C,EACD,cAAc,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EACjD,MAAM,GAAE,kBAAsD,kEAU/D;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,cAAc,EAAE,UAAU,EAAE,EAC5B,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAC1B;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,cAAc,EAAE,UAAU,EAAE,CAAA;CAAE,CAKvD;AAuLD;;;;;;;;GAQG;AACH,iBAAS,qBAAqB,CAC5B,QAAQ,CAAC,EAAE,cAAc,EACzB,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,GAC1E;IACD,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,6BAA6B,EAAE,MAAM,CAAC;IACtC,4BAA4B,EAAE,MAAM,CAAC;CACtC,CAuLA;AAED,eAAO,MAAM,gCAAgC;;;;;;;CAczC,CAAC;AAEL;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,UAAQ,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,GAAE,MAAM,GAAG,IAAgC,GAC/C,OAAO,CAAC,MAAM,CAAC,CAkOjB;AAsBD;;;;;;;;;;;GAWG;AACH,iBAAS,qBAAqB,CAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EACrC,IAAI,GAAE,KAAK,GAAG,MAAe,GAC5B,MAAM,CAoER;AA0KD,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,OAAO,CA2BV;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAC3C,cAAc,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAgCtC;AAmBD,KAAK,0BAA0B,GAC3B,qCAAqC,GACrC,0CAA0C,GAC1C,SAAS,GACT,iBAAiB,GACjB,YAAY,GACZ,UAAU,GACV,KAAK,GACL,cAAc,GACd,4BAA4B,GAC5B,uBAAuB,CAAC;AAE5B,KAAK,uBAAuB,GAAG,OAAO,CACpC,MAAM,CAAC,0BAA0B,EAAE,MAAM,GAAG,SAAS,CAAC,CACvD,CAAC;AAiCF,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,uBAAqC,GACzC,OAAO,CAwBT;AAED,KAAK,8BAA8B,GAAG;IACpC,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACvD,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;IACjC,oBAAoB,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACnD,wBAAwB,CAAC,EAAE,OAAO,wBAAwB,CAAC;IAC3D,sBAAsB,CAAC,EAAE,OAAO,sBAAsB,CAAC;CACxD,CAAC;AAEF,wBAAsB,yCAAyC,CAC7D,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,OAAO,EACZ,IAAI,GAAE,8BAAmC,GACxC,OAAO,CAAC,OAAO,CAAC,CAqClB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CA20JhB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAa9E,yEAAyE;AACzE,wBAAgB,mBAAmB,IAAI,gBAAgB,GAAG,IAAI,CAE7D;AAED,yFAAyF;AACzF,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAKhE"}

package/dist/server/agent-chat-plugin.js

@@ -1,7 +1,7 @@
 import nodePath from "node:path";
-import { createError, defineEventHandler, setResponseStatus, setResponseHeader, getMethod, getQuery, getHeader, } from "h3";
+import { createError, defineEventHandler, setResponseStatus, setResponseHeader, getMethod, getQuery, getHeader, getRequestIP, } from "h3";
 import { appendA2AArtifactLinks, buildA2ARecoverableArtifactMessage, } from "../a2a/artifact-response.js";
-import { hasConfiguredA2ASecret, isA2AProductionRuntime, } from "../a2a/auth-policy.js";
+import { hasConfiguredA2ASecret, isLoopbackAddress, isTrustedLocalRuntime, } from "../a2a/auth-policy.js";
 import { applyAgentTextEventToBuffer, collectFinalResponseTextFromAgentEvents, } from "../a2a/response-text.js";
 import { updateTaskStatusMessage } from "../a2a/task-store.js";
 import { ACTION_CHAT_UI_DATA_WIDGET_RENDERER } from "../action-ui.js";
@@ -727,6 +727,9 @@ function appStateKeyForBrowserTab(key, browserTabId) {
  * entries are pruned on read.
  */
 const generateTitleRateLimit = new Map();
+/** Only sweep drained rate-limit entries once the map grows past this size,
+ * so the common small-map case stays O(1). */
+const RATE_LIMIT_SWEEP_THRESHOLD = 1000;
 /**
  * Creates the `set-search-params` / `set-url-path` tools. Writes a one-shot
  * URL command to application_state; the client's URLSync component applies
@@ -5012,11 +5015,14 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         return { error: "Invalid or expired processor token" };
                     }
                 }
-                else if (isA2AProductionRuntime()) {
-                    setResponseStatus(event, 503);
-                    return {
-                        error: "Agent Teams processor not configured — set A2A_SECRET on this deployment.",
-                    };
+                else {
+                    const loopback = isLoopbackAddress(getRequestIP(event, { xForwardedFor: false }));
+                    if (!isTrustedLocalRuntime({ loopback })) {
+                        setResponseStatus(event, 503);
+                        return {
+                            error: "Agent Teams processor not configured — set A2A_SECRET on this deployment (or A2A_ALLOW_UNSIGNED_INTERNAL=1 for trusted local dev).",
+                        };
+                    }
                 }
                 try {
                     return await processAgentTeamRun({
@@ -5544,6 +5550,10 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 // Stream NDJSON — each source flushes its batch as soon as it's ready.
                 setResponseHeader(event, "Content-Type", "application/x-ndjson");
                 setResponseHeader(event, "Cache-Control", "no-cache");
+                // Lets `cancel()` signal in-flight source work to stop early on
+                // client disconnect, instead of only being noticed the next time
+                // `flush()`'s `controller.enqueue` throws.
+                const mentionsAbort = new AbortController();
                 const stream = new ReadableStream({
                     start(controller) {
                         return runWithRequestContext({
@@ -5552,17 +5562,21 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         }, () => mentionsStreamWork(controller));
                     },
                     cancel() {
-                        // Client disconnected — stop enqueuing
+                        // Client disconnected — stop enqueuing and let in-flight source
+                        // work short-circuit instead of running to completion unseen.
+                        mentionsAbort.abort();
                     },
                 });
                 return stream;
                 async function mentionsStreamWork(controller) {
                     const MAX_RESULTS = 50;
                     let totalSent = 0;
-                    let cancelled = false;
+                    let cancelled = mentionsAbort.signal.aborted;
                     const flush = (batch) => {
-                        if (cancelled)
+                        if (cancelled || mentionsAbort.signal.aborted) {
+                            cancelled = true;
                             return;
+                        }
                         const filtered = batch.filter(matchesQuery);
                         if (filtered.length === 0)
                             return;
@@ -5628,6 +5642,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     }
                     // 3. Custom mention providers (each flushes independently)
                     for (const [key, provider] of Object.entries(mentionProviders)) {
+                        // Client already disconnected — don't spawn more provider work.
+                        if (mentionsAbort.signal.aborted)
+                            break;
                         sources.push((async () => {
                             try {
                                 const providerItems = await provider.search(q, event);
@@ -5696,8 +5713,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         }
                     })());
                     await Promise.all(sources);
-                    if (!cancelled)
+                    if (!cancelled && !mentionsAbort.signal.aborted) {
                         controller.close();
+                    }
                 }
             }));
             // ─── Generate thread title ──────────────────────────────────────────
@@ -5720,6 +5738,19 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 }
                 recent.push(now);
                 generateTitleRateLimit.set(ownerEmail, recent);
+                // Opportunistic eviction: keep the map from growing unbounded by
+                // the count of distinct users on a long-lived process. Drop any
+                // key whose window has fully drained (no timestamps within the
+                // rolling window).
+                if (generateTitleRateLimit.size > RATE_LIMIT_SWEEP_THRESHOLD) {
+                    for (const [email, times] of generateTitleRateLimit) {
+                        if (email === ownerEmail)
+                            continue;
+                        if (times.every((t) => now - t >= limitWindowMs)) {
+                            generateTitleRateLimit.delete(email);
+                        }
+                    }
+                }
                 const body = await readBody(event);
                 const message = body?.message;
                 if (!message || typeof message !== "string") {
@@ -6531,8 +6562,11 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 }
                 // Validate + HMAC-authenticate the self-dispatch and prepare the
                 // background-worker body. Pure decision (unit-tested in
-                // durable-background.spec.ts); the route only wires it to h3.
-                const prepared = prepareProcessRunRequest(processBody, getHeader(event, "authorization"));
+                // durable-background.spec.ts); the route only wires it to h3. This
+                // handler DOES have the h3 event, so it can see the real socket
+                // peer — thread the loopback signal through so unsigned local-dev
+                // self-dispatch (no A2A_SECRET) still works over 127.0.0.1/::1.
+                const prepared = prepareProcessRunRequest(processBody, getHeader(event, "authorization"), isLoopbackAddress(getRequestIP(event, { xForwardedFor: false })));
                 if (!prepared.ok) {
                     // DIAGNOSTIC: record the auth/validation failure ONTO the run
                     // before returning the error status. Without this, a 401 (e.g.