@agent-native/core 0.97.0 → 0.98.0

package/dist/observability/traces.js.map

@@ -1 +1 @@
-{"version":3,"file":"traces.js","sourceRoot":"","sources":["../../src/observability/traces.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE5E,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE1D,SAAS,MAAM;IACb,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB;IACtD,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG;SACP,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3C,OAAO,qBAAqB,CAC1B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACvE,MAAM,MAAM,GACV,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;QACzD,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,GAAG,GACP,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACnD,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACxD,MAAM;QACN,UAAU;QACV,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GACZ,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACxD,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAC7D,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC/C,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACpD,GAAG,CAAC;IAEN,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,UAA8B,EAC9B,KAAa;IAEb,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACxD,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrD,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,8BAA8B,CAAC,IAyBvC;IACC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC;IAC7C,MAAM,UAAU,GAA4B;QAC1C,GAAG,0BAA0B,EAAE;QAC/B,MAAM,EAAE,qBAAqB;QAC7B,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,cAAc,EAAE,IAAI,CAAC,YAAY;QACjC,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,YAAY,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY;QAClD,iBAAiB,EAAE,IAAI,CAAC,eAAe;QACvC,kBAAkB,EAAE,IAAI,CAAC,gBAAgB;QACzC,eAAe,EAAE,IAAI,CAAC,aAAa;QACnC,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,gBAAgB,EAAE,IAAI,CAAC,eAAe;QACtC,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,sBAAsB,EAAE,IAAI,CAAC,oBAAoB;QACjD,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAClD,aAAa,EAAE,IAAI,CAAC,SAAS;QAC7B,YAAY,EAAE,IAAI,CAAC,KAAK;QACxB,cAAc,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QAC1C,WAAW,EAAE,IAAI,CAAC,SAAS;QAC3B,aAAa,EAAE,WAAW;QAC1B,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,YAAY,EAAE,QAAQ;QACtB,gBAAgB,EAAE,IAAI,CAAC,WAAW;QAClC,iBAAiB,EAAE,IAAI,CAAC,YAAY;QACpC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI;QAC/D,YAAY,EAAE,IAAI,CAAC,MAAM,KAAK,OAAO;QACrC,SAAS,EAAE,KAAK;QAChB,2BAA2B,EAAE,IAAI,CAAC,eAAe;QACjD,+BAA+B,EAAE,IAAI,CAAC,gBAAgB;QACtD,iBAAiB,EAAE,CAAC;QACpB,kBAAkB,EAAE,OAAO;KAC5B,CAAC;IACF,IAAI,IAAI,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;QACvC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,qBAAqB;aACnD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;aAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC,qBAAqB;aACxD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;aACzC,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YACtE,UAAU,CAAC,kBAAkB,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,IAAI,KAAK;QAAE,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,yBAAyB,CAAC;aACnC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,KAAK,CAAC,gBAAgB,EAAE,UAAU,EAAE;gBAClC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;aACjC,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AAED;;;;;;2BAM2B;AAC3B,MAAM,uBAAuB,GAC3B,uGAAuG,CAAC;AAE1G;;;wEAGwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,UAAU,CAAC,KAAK,EAAE,IAAI,OAAO,EAAU,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,IAAqB;IACvD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC;QAAE,OAAO,YAAY,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,sBAAsB,CAAC,CAAC;QACxD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO;gBACL,GAAG,4BAA4B;gBAC/B,GAAG,MAAM;aACa,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,4BAA4B,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IA6CzC;IACC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;IAE9B,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,kBAAkB,GAAG,cAAc,CAAC,WAAW,EAAE;QACrD,cAAc,EAAE,KAAK;QACrB,iBAAiB,EAAE,QAAQ,IAAI,SAAS;QACxC,eAAe,EAAE,MAAM,IAAI,SAAS;QACpC,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,8BAA8B,EAAE,IAAI,CAAC,oBAAoB;QACzD,qBAAqB,EACnB,IAAI,CAAC,qBAAqB,EAAE,MAAM,KAAK,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,YAAY;YAC5C,CAAC,CAAC,SAAS;QACf,0BAA0B,EACxB,IAAI,CAAC,qBAAqB,EAAE,MAAM,KAAK,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS;YACzC,CAAC,CAAC,SAAS;KAChB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,oEAAoE;IACpE,MAAM,YAAY,GAAG,IAAI,GAAG,EAUzB,CAAC;IACJ,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEvD,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAa,CAAC;IAE/C,MAAM,gBAAgB,GAAG,CAAC,KAAqB,EAAQ,EAAE;QACvD,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;gBACrB,iEAAiE;gBACjE,oEAAoE;gBACpE,qEAAqE;gBACrE,uEAAuE;gBACvE,MAAM,KAAK,GAYP;oBACF,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;oBACnB,QAAQ,EAAE,KAAK,CAAC,IAAI;oBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,IAAI;iBACf,CAAC;gBACF,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjC,KAAK,cAAc,CAAC,WAAW,EAAE;oBAC/B,WAAW,EAAE,KAAK,CAAC,IAAI;iBACxB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;oBACf,IAAI,CAAC,IAAI;wBAAE,OAAO;oBAClB,sEAAsE;oBACtE,+DAA+D;oBAC/D,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;wBACpB,YAAY,CAAC,IAAI,EAAE;4BACjB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;4BAC9B,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;yBAC3C,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;wBACtB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjD,IAAI,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;oBAC1B,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjD,MAAM,OAAO,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC;gBAC/B,MAAM,OAAO,GACX,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC7B,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;wBAC7B,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBACD,aAAa,EAAE,CAAC;gBAEhB,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;oBAChC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC/B,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAC/C,IAAI,OAAO;oBAAE,WAAW,EAAE,CAAC;;oBACtB,eAAe,EAAE,CAAC;gBAEvB,uEAAuE;gBACvE,oEAAoE;gBACpE,MAAM,aAAa,GAAG;oBACpB,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAwB;oBAC9D,YAAY,EAAE,OAAO,CAAC,CAAC,CAAE,KAAK,CAAC,MAAiB,CAAC,CAAC,CAAC,IAAI;iBACxD,CAAC;gBACF,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;oBACtB,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBAC3C,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE;wBAC7B,MAAM,EAAE,aAAa,CAAC,MAAM;wBAC5B,YAAY,EAAE,aAAa,CAAC,YAAY;wBACxC,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,OAAO,EAAE,CAAC;oBACnB,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC;gBACpC,CAAC;gBAED,MAAM,IAAI,GAAc;oBACtB,EAAE,EAAE,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE;oBAC/B,KAAK;oBACL,QAAQ;oBACR,MAAM;oBACN,YAAY;oBACZ,QAAQ,EAAE,WAAW;oBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,WAAW,EAAE,CAAC;oBACd,YAAY,EAAE,CAAC;oBACf,eAAe,EAAE,CAAC;oBAClB,gBAAgB,EAAE,CAAC;oBACnB,aAAa,EAAE,CAAC;oBAChB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBACtD,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;oBACrC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;oBAC3C,QAAQ,EACN,MAAM,CAAC,eAAe,IAAI,OAAO;wBAC/B,CAAC,CAAC,yDAAyD;4BACzD,sDAAsD;4BACtD,uDAAuD;4BACvD,oCAAoC;4BACpC;gCACE,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAGzC;6BACF;wBACH,CAAC,CAAC,IAAI;oBACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAEV,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,IAAI,KAAiC,CAAC;IACtC,IAAI,SAAS,GAAwB,SAAS,CAAC;IAC/C,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,WAAW,GAAmC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACxE,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACzD,SAAS,GAAG,cAAc,EAAE,MAAM,IAAI,OAAO,CAAC;QAC9C,YAAY;YACV,cAAc,EAAE,YAAY,KAAK,SAAS;gBACxC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC;QAClC,MAAM,aAAa,GAAG,cAAc,EAAE,QAAQ,IAAI,IAAI,CAAC;QACvD,WAAW;YACT,WAAW,IAAI,aAAa;gBAC1B,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE;gBACtD,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,CAAC;QAE1C,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC5D,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,GAAG,aAAa,CAC3B,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,eAAe,EACrB,KAAK,CAAC,gBAAgB,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAEV,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,GAAG,CAAC,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAc;gBACzB,EAAE,EAAE,SAAS;gBACb,KAAK;gBACL,QAAQ;gBACR,MAAM;gBACN,YAAY;gBACZ,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,KAAK,CAAC,KAAK;gBACjB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,aAAa;gBACb,UAAU,EAAE,eAAe;gBAC3B,MAAM,EAAE,SAAS;gBACjB,YAAY;gBACZ,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,QAAQ;aACpB,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,8BAA8B,CAAC;gBAC7B,KAAK;gBACL,QAAQ;gBACR,MAAM;gBACN,YAAY;gBACZ,SAAS;gBACT,UAAU,EACR,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ;oBACvC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;oBACtB,CAAC,CAAC,SAAS;gBACf,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,aAAa;gBACb,UAAU,EAAE,eAAe;gBAC3B,MAAM,EAAE,SAAS;gBACjB,YAAY;gBACZ,SAAS,EAAE,aAAa;gBACxB,eAAe;gBACf,WAAW;gBACX,SAAS,EAAE,QAAQ;gBACnB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;gBACjD,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;aAChD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAc;YAC5B,EAAE,EAAE,YAAY;YAChB,KAAK;YACL,QAAQ;YACR,MAAM;YACN,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;YACpC,YAAY,EAAE,KAAK,EAAE,YAAY,IAAI,CAAC;YACtC,eAAe,EAAE,KAAK,EAAE,eAAe,IAAI,CAAC;YAC5C,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,IAAI,CAAC;YAC9C,aAAa;YACb,UAAU,EAAE,eAAe;YAC3B,MAAM,EAAE,SAAS;YACjB,YAAY;YACZ,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,QAAQ;SACpB,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEvB,MAAM,OAAO,GAAiB;YAC5B,KAAK;YACL,QAAQ;YACR,MAAM;YACN,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,aAAa;YACxB,eAAe;YACf,WAAW;YACX,eAAe;YACf,kBAAkB,EAAE,aAAa;YACjC,gBAAgB,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;YACzC,iBAAiB,EAAE,KAAK,EAAE,YAAY,IAAI,CAAC;YAC3C,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,QAAQ,CAAC,KAAK;YACrC,SAAS,EAAE,QAAQ;SACpB,CAAC;QAEF,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE9D,uEAAuE;QACvE,uEAAuE;QACvE,6EAA6E;QAC7E,0EAA0E;QAC1E,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,CAAC,MAAM,cAAc,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE;oBACjD,MAAM,EAAE,SAAS;oBACjB,YAAY;oBACZ,UAAU,EAAE;wBACV,WAAW,EAAE,KAAK,CAAC,KAAK;wBACxB,kBAAkB,EAAE,KAAK,CAAC,WAAW;wBACrC,mBAAmB,EAAE,KAAK,CAAC,YAAY;wBACvC,uBAAuB,EAAE,KAAK,CAAC,eAAe;wBAC9C,wBAAwB,EAAE,KAAK,CAAC,gBAAgB;wBAChD,qBAAqB,EAAE,aAAa;qBACrC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;gBACzC,YAAY,CAAC,QAAQ,EAAE;oBACrB,MAAM,EAAE,OAAO;oBACf,YAAY,EAAE,mCAAmC;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC1B,YAAY,CAAC,MAAM,kBAAkB,EAAE;gBACrC,MAAM,EAAE,SAAS;gBACjB,YAAY;gBACZ,UAAU,EAAE;oBACV,kBAAkB,EAAE,aAAa;oBACjC,wBAAwB,EAAE,eAAe;oBACzC,oBAAoB,EAAE,WAAW;oBACjC,mBAAmB,EAAE,eAAe;oBACpC,oBAAoB,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;oBAC7C,qBAAqB,EAAE,KAAK,EAAE,YAAY,IAAI,CAAC;oBAC/C,uBAAuB,EAAE,aAAa;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,KAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAkB,EAClB,OAAqB,EACrB,KAAa,EACb,MAA2B;IAE3B,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3E,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAElD,qDAAqD;IACrD,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC","sourcesContent":["import type { AgentLoopUsage } from \"../agent/production-agent.js\";\nimport type { AgentChatEvent, AgentToolInput } from \"../agent/types.js\";\nimport { type AgentSpan, endAgentSpan, startAgentSpan } from \"./tracing.js\";\nimport type { TraceSpan, TraceSummary, ObservabilityConfig } from \"./types.js\";\nimport { DEFAULT_OBSERVABILITY_CONFIG } from \"./types.js\";\n\nfunction spanId(): string {\n  return `span-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;\n}\n\nfunction normalizeTrackingSlug(value: string | undefined): string | undefined {\n  const raw = value?.trim().toLowerCase();\n  if (!raw) return undefined;\n  return raw\n    .replace(/^@agent-native\\//, \"\")\n    .replace(/[^a-z0-9._-]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n}\n\nfunction appSlugFromUrl(value: string | undefined): string | undefined {\n  if (!value?.trim()) return undefined;\n  try {\n    const raw = /^[a-z][a-z0-9+.-]*:\\/\\//i.test(value)\n      ? value\n      : `https://${value}`;\n    const hostname = new URL(raw).hostname.toLowerCase();\n    if (hostname.endsWith(\".agent-native.com\")) {\n      return normalizeTrackingSlug(\n        hostname.slice(0, -\".agent-native.com\".length),\n      );\n    }\n    return normalizeTrackingSlug(hostname.split(\".\")[0]);\n  } catch {\n    return undefined;\n  }\n}\n\nfunction trackingIdentityProperties(): Record<string, string> {\n  const packageApp = normalizeTrackingSlug(process.env.npm_package_name);\n  const urlApp =\n    appSlugFromUrl(process.env.APP_URL) ||\n    appSlugFromUrl(process.env.BETTER_AUTH_URL) ||\n    appSlugFromUrl(process.env.URL) ||\n    appSlugFromUrl(process.env.DEPLOY_URL) ||\n    appSlugFromUrl(process.env.VERCEL_PROJECT_PRODUCTION_URL) ||\n    appSlugFromUrl(process.env.VERCEL_URL);\n  const app =\n    normalizeTrackingSlug(process.env.AGENT_NATIVE_APP) ||\n    normalizeTrackingSlug(process.env.VITE_AGENT_NATIVE_APP) ||\n    urlApp ||\n    packageApp ||\n    normalizeTrackingSlug(process.env.APP_NAME);\n  const template =\n    normalizeTrackingSlug(process.env.AGENT_NATIVE_TEMPLATE) ||\n    normalizeTrackingSlug(process.env.VITE_AGENT_NATIVE_TEMPLATE) ||\n    normalizeTrackingSlug(process.env.APP_TEMPLATE) ||\n    normalizeTrackingSlug(process.env.VITE_APP_TEMPLATE) ||\n    app;\n\n  return {\n    ...(app ? { app, agent_native_app: app } : {}),\n    ...(template ? { template, agent_native_template: template } : {}),\n  };\n}\n\nfunction llmProviderFromEngine(\n  engineName: string | undefined,\n  model: string,\n): string {\n  const engine = engineName?.trim();\n  if (engine?.startsWith(\"ai-sdk:\")) return engine.slice(\"ai-sdk:\".length);\n  if (engine) return engine;\n  if (/claude|anthropic/i.test(model)) return \"anthropic\";\n  if (/gpt|openai|codex/i.test(model)) return \"openai\";\n  if (/gemini|google/i.test(model)) return \"google\";\n  return \"unknown\";\n}\n\nfunction costUsdFromCenticents(value: number): number {\n  return Math.round((value / 10_000) * 1_000_000) / 1_000_000;\n}\n\nfunction emitLlmGenerationTrackingEvent(args: {\n  runId: string;\n  threadId: string | null;\n  userId: string | null;\n  parentSpanId: string;\n  llmSpanId: string;\n  engineName: string | undefined;\n  model: string;\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheWriteTokens: number;\n  costCentsX100: number;\n  durationMs: number;\n  status: \"success\" | \"error\";\n  errorMessage: string | null;\n  toolCalls: number;\n  successfulTools: number;\n  failedTools: number;\n  createdAt: number;\n  experimentAssignments?: Array<{\n    experimentId: string;\n    variantId: string;\n  }>;\n  modelSelectionSource?: string;\n}): void {\n  const provider = llmProviderFromEngine(args.engineName, args.model);\n  const costUsd = costUsdFromCenticents(args.costCentsX100);\n  const error = args.errorMessage ?? undefined;\n  const properties: Record<string, unknown> = {\n    ...trackingIdentityProperties(),\n    source: \"agent_observability\",\n    span_type: \"llm_call\",\n    run_id: args.runId,\n    thread_id: args.threadId,\n    parent_span_id: args.parentSpanId,\n    span_id: args.llmSpanId,\n    model: args.model,\n    provider,\n    input_tokens: args.inputTokens,\n    output_tokens: args.outputTokens,\n    total_tokens: args.inputTokens + args.outputTokens,\n    cache_read_tokens: args.cacheReadTokens,\n    cache_write_tokens: args.cacheWriteTokens,\n    cost_cents_x100: args.costCentsX100,\n    cost_usd: costUsd,\n    duration_ms: args.durationMs,\n    status: args.status,\n    tool_calls: args.toolCalls,\n    successful_tools: args.successfulTools,\n    failed_tools: args.failedTools,\n    model_selection_source: args.modelSelectionSource,\n    created_at: new Date(args.createdAt).toISOString(),\n    created_at_ms: args.createdAt,\n    $ai_trace_id: args.runId,\n    $ai_session_id: args.threadId ?? undefined,\n    $ai_span_id: args.llmSpanId,\n    $ai_span_name: \"agent_run\",\n    $ai_parent_id: args.parentSpanId,\n    $ai_model: args.model,\n    $ai_provider: provider,\n    $ai_input_tokens: args.inputTokens,\n    $ai_output_tokens: args.outputTokens,\n    $ai_latency: Math.round((args.durationMs / 1000) * 1000) / 1000,\n    $ai_is_error: args.status === \"error\",\n    $ai_error: error,\n    $ai_cache_read_input_tokens: args.cacheReadTokens,\n    $ai_cache_creation_input_tokens: args.cacheWriteTokens,\n    $ai_request_count: 1,\n    $ai_total_cost_usd: costUsd,\n  };\n  if (args.experimentAssignments?.length) {\n    properties.experiment_ids = args.experimentAssignments\n      .map((assignment) => assignment.experimentId)\n      .join(\",\");\n    properties.experiment_variants = args.experimentAssignments\n      .map((assignment) => assignment.variantId)\n      .join(\",\");\n    if (args.experimentAssignments.length === 1) {\n      properties.experiment_id = args.experimentAssignments[0].experimentId;\n      properties.experiment_variant = args.experimentAssignments[0].variantId;\n    }\n  }\n  if (error) properties.error_message = error;\n\n  for (const key of Object.keys(properties)) {\n    if (properties[key] === undefined) delete properties[key];\n  }\n\n  try {\n    void import(\"../tracking/registry.js\")\n      .then(({ track }) => {\n        track(\"$ai_generation\", properties, {\n          userId: args.userId ?? undefined,\n        });\n      })\n      .catch(() => {});\n  } catch {\n    // Tracking must never affect the agent run or trace persistence.\n  }\n}\n\n/** Keys whose values are stripped from persisted tool inputs when\n *  `captureToolArgs` is enabled. Matched case-insensitively and tolerant\n *  of `_` / `-` separators. M14 in the MCP/A2A audit: tool calls\n *  routinely receive credentials verbatim (db-exec INSERTs, fetchTool\n *  Authorization headers, ad-hoc bearer tokens) — keeping those values\n *  out of agent_trace_spans.metadata avoids long-term storage of\n *  short-lived secrets. */\nconst SENSITIVE_FIELD_PATTERN =\n  /^(authorization|cookie|api[_-]?key|password|secret|token|access[_-]?token|refresh[_-]?token|bearer)$/i;\n\n/** Recursively walk a structured value and replace sensitive field\n *  values with the literal string \"[REDACTED]\". Pure (returns a copy);\n *  the original input is never mutated. Cycles are tolerated via a\n *  small WeakSet seen-tracker that returns \"[Circular]\" for repeats. */\nexport function redactSensitiveFields(value: unknown): unknown {\n  return redactWalk(value, new WeakSet<object>());\n}\n\nfunction redactWalk(value: unknown, seen: WeakSet<object>): unknown {\n  if (value === null || typeof value !== \"object\") return value;\n  if (seen.has(value as object)) return \"[Circular]\";\n  seen.add(value as object);\n  if (Array.isArray(value)) {\n    return value.map((v) => redactWalk(v, seen));\n  }\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n    if (SENSITIVE_FIELD_PATTERN.test(k)) {\n      out[k] = \"[REDACTED]\";\n    } else {\n      out[k] = redactWalk(v, seen);\n    }\n  }\n  return out;\n}\n\nexport async function getObservabilityConfig(): Promise<ObservabilityConfig> {\n  try {\n    const { getSetting } = await import(\"../settings/store.js\");\n    const stored = await getSetting(\"observability-config\");\n    if (stored) {\n      return {\n        ...DEFAULT_OBSERVABILITY_CONFIG,\n        ...stored,\n      } as ObservabilityConfig;\n    }\n  } catch {}\n  return DEFAULT_OBSERVABILITY_CONFIG;\n}\n\nexport async function instrumentAgentLoop(opts: {\n  runAgentLoop: (loopOpts: {\n    engine: any;\n    model: string;\n    systemPrompt: string;\n    tools: any[];\n    messages: any[];\n    actions: Record<string, any>;\n    send: (event: AgentChatEvent) => void;\n    signal: AbortSignal;\n    providerOptions?: any;\n  }) => Promise<AgentLoopUsage>;\n  loopOpts: {\n    engine: any;\n    model: string;\n    systemPrompt: string;\n    tools: any[];\n    messages: any[];\n    actions: Record<string, any>;\n    send: (event: AgentChatEvent) => void;\n    signal: AbortSignal;\n    providerOptions?: any;\n  };\n  runId: string;\n  threadId: string | null;\n  /** Owner of this run; persisted on every span + summary so dashboard\n   *  reads can filter to a single user. Null for unauthenticated callers\n   *  (background tasks, etc.) — those rows aren't returned by per-user\n   *  reads. */\n  userId: string | null;\n  config: ObservabilityConfig;\n  metadata?: Record<string, unknown> | null;\n  experimentAssignments?: Array<{\n    experimentId: string;\n    variantId: string;\n  }>;\n  modelSelectionSource?: string;\n  classifyError?: (error: unknown) =>\n    | {\n        status?: \"success\" | \"error\";\n        errorMessage?: string | null;\n        metadata?: Record<string, unknown> | null;\n      }\n    | null\n    | undefined;\n}): Promise<AgentLoopUsage> {\n  const { runAgentLoop, loopOpts, runId, threadId, userId, config } = opts;\n  const runStart = Date.now();\n  const parentSpanId = spanId();\n\n  // Optional OpenTelemetry root span for this run. No-ops unless a host has\n  // installed `@opentelemetry/api` and registered a provider. The promise is\n  // resolved before the loop runs so child tool/model spans can parent under\n  // it conceptually (we keep them flat in the same tracer, which is enough\n  // for the dashboards an embedding app would build).\n  const otelRunSpanPromise = startAgentSpan(\"agent.run\", {\n    \"agent.run_id\": runId,\n    \"agent.thread_id\": threadId ?? undefined,\n    \"agent.user_id\": userId ?? undefined,\n    \"agent.model\": loopOpts.model,\n    \"agent.model_selection_source\": opts.modelSelectionSource,\n    \"agent.experiment_id\":\n      opts.experimentAssignments?.length === 1\n        ? opts.experimentAssignments[0].experimentId\n        : undefined,\n    \"agent.experiment_variant\":\n      opts.experimentAssignments?.length === 1\n        ? opts.experimentAssignments[0].variantId\n        : undefined,\n  });\n\n  const spans: TraceSpan[] = [];\n  let toolInvocationCounter = 0;\n  // Keyed by counter to handle concurrent calls to the same tool name\n  const pendingTools = new Map<\n    number,\n    {\n      spanId: string;\n      startMs: number;\n      toolName: string;\n      input: AgentToolInput;\n      otelSpan: AgentSpan | null;\n      endResult?: { status: \"success\" | \"error\"; errorMessage: string | null };\n    }\n  >();\n  // Secondary index: tool name → FIFO queue of pending invocation counters.\n  // tool_start/tool_done events carry only the tool name (no call id), so to\n  // pair starts and dones correctly when the agent runs concurrent calls to the\n  // same tool name (read-only / parallelSafe batches via Promise.all), we keep a\n  // queue per name and match each done to the OLDEST still-pending start.\n  const toolNameToCounters = new Map<string, number[]>();\n\n  let toolCallCount = 0;\n  let successfulTools = 0;\n  let failedTools = 0;\n\n  // Track in-flight OTel tool spans so they're all ended even if the loop\n  // throws before a matching `tool_done` arrives.\n  const openOtelToolSpans = new Set<AgentSpan>();\n\n  const instrumentedSend = (event: AgentChatEvent): void => {\n    try {\n      if (event.type === \"tool_start\") {\n        const counter = toolInvocationCounter++;\n        const sid = spanId();\n        // Start the OTel tool span synchronously-ish: kick off the async\n        // resolution and stash the span once it lands. Tool spans are short\n        // and the api tracer is synchronous in practice, but we tolerate the\n        // microtask gap by recording the span on the pending entry when ready.\n        const entry: {\n          spanId: string;\n          startMs: number;\n          toolName: string;\n          input: AgentToolInput;\n          otelSpan: AgentSpan | null;\n          // Set by the done handler if it fires before the span promise\n          // resolves, so the resolved span is ended with the correct status.\n          endResult?: {\n            status: \"success\" | \"error\";\n            errorMessage: string | null;\n          };\n        } = {\n          spanId: sid,\n          startMs: Date.now(),\n          toolName: event.tool,\n          input: event.input,\n          otelSpan: null,\n        };\n        pendingTools.set(counter, entry);\n        void startAgentSpan(\"tool.call\", {\n          \"tool.name\": event.tool,\n        }).then((span) => {\n          if (!span) return;\n          // If `tool_done` already ran for this call, end the span now with the\n          // status it recorded; otherwise stash it for the done handler.\n          if (entry.endResult) {\n            endAgentSpan(span, {\n              status: entry.endResult.status,\n              errorMessage: entry.endResult.errorMessage,\n            });\n          } else {\n            entry.otelSpan = span;\n            openOtelToolSpans.add(span);\n          }\n        });\n        const queue = toolNameToCounters.get(event.tool);\n        if (queue) queue.push(counter);\n        else toolNameToCounters.set(event.tool, [counter]);\n      } else if (event.type === \"tool_done\") {\n        const queue = toolNameToCounters.get(event.tool);\n        const counter = queue?.shift();\n        const pending =\n          counter !== undefined ? pendingTools.get(counter) : undefined;\n        if (counter !== undefined) {\n          pendingTools.delete(counter);\n          if (queue && queue.length === 0)\n            toolNameToCounters.delete(event.tool);\n        }\n        toolCallCount++;\n\n        const isError =\n          typeof event.result === \"string\" &&\n          (event.result.startsWith(\"Error\") ||\n            event.result.startsWith(\"Error running \"));\n        if (isError) failedTools++;\n        else successfulTools++;\n\n        // Finalize the OTel tool span. If the span promise hasn't resolved yet\n        // we record the result on the entry so its `.then` handler ends it.\n        const otelEndResult = {\n          status: (isError ? \"error\" : \"success\") as \"success\" | \"error\",\n          errorMessage: isError ? (event.result as string) : null,\n        };\n        if (pending?.otelSpan) {\n          openOtelToolSpans.delete(pending.otelSpan);\n          endAgentSpan(pending.otelSpan, {\n            status: otelEndResult.status,\n            errorMessage: otelEndResult.errorMessage,\n            attributes: { \"tool.name\": event.tool },\n          });\n        } else if (pending) {\n          pending.endResult = otelEndResult;\n        }\n\n        const span: TraceSpan = {\n          id: pending?.spanId ?? spanId(),\n          runId,\n          threadId,\n          userId,\n          parentSpanId,\n          spanType: \"tool_call\",\n          name: event.tool,\n          inputTokens: 0,\n          outputTokens: 0,\n          cacheReadTokens: 0,\n          cacheWriteTokens: 0,\n          costCentsX100: 0,\n          durationMs: pending ? Date.now() - pending.startMs : 0,\n          status: isError ? \"error\" : \"success\",\n          errorMessage: isError ? event.result : null,\n          metadata:\n            config.captureToolArgs && pending\n              ? // Strip Authorization/api-key/token-shaped values before\n                // persisting (M14 in the MCP/A2A audit). Tool-runtime\n                // execution still sees the unredacted input — only the\n                // long-lived span row is sanitized.\n                {\n                  input: redactSensitiveFields(pending.input) as Record<\n                    string,\n                    string\n                  >,\n                }\n              : null,\n          createdAt: Date.now(),\n        };\n        spans.push(span);\n      }\n    } catch {}\n\n    loopOpts.send(event);\n  };\n\n  let usage: AgentLoopUsage | undefined;\n  let runStatus: \"success\" | \"error\" = \"success\";\n  let errorMessage: string | null = null;\n  let runMetadata: Record<string, unknown> | null = opts.metadata ?? null;\n  try {\n    usage = await runAgentLoop({ ...loopOpts, send: instrumentedSend });\n  } catch (err: any) {\n    const classification = opts.classifyError?.(err) ?? null;\n    runStatus = classification?.status ?? \"error\";\n    errorMessage =\n      classification?.errorMessage === undefined\n        ? (err?.message ?? String(err))\n        : classification.errorMessage;\n    const errorMetadata = classification?.metadata ?? null;\n    runMetadata =\n      runMetadata || errorMetadata\n        ? { ...(runMetadata ?? {}), ...(errorMetadata ?? {}) }\n        : null;\n    throw err;\n  } finally {\n    const runEnd = Date.now();\n    const totalDurationMs = runEnd - runStart;\n\n    let costCentsX100 = 0;\n    try {\n      const { calculateCost } = await import(\"../usage/store.js\");\n      if (usage) {\n        costCentsX100 = calculateCost(\n          usage.inputTokens,\n          usage.outputTokens,\n          usage.model,\n          usage.cacheReadTokens,\n          usage.cacheWriteTokens,\n        );\n      }\n    } catch {}\n\n    let llmCallCount = 0;\n    if (usage) {\n      llmCallCount = 1;\n      const llmSpanId = spanId();\n      const llmSpan: TraceSpan = {\n        id: llmSpanId,\n        runId,\n        threadId,\n        userId,\n        parentSpanId,\n        spanType: \"llm_call\",\n        name: usage.model,\n        inputTokens: usage.inputTokens,\n        outputTokens: usage.outputTokens,\n        cacheReadTokens: usage.cacheReadTokens,\n        cacheWriteTokens: usage.cacheWriteTokens,\n        costCentsX100,\n        durationMs: totalDurationMs,\n        status: runStatus,\n        errorMessage,\n        metadata: null,\n        createdAt: runStart,\n      };\n      spans.push(llmSpan);\n      emitLlmGenerationTrackingEvent({\n        runId,\n        threadId,\n        userId,\n        parentSpanId,\n        llmSpanId,\n        engineName:\n          typeof loopOpts.engine?.name === \"string\"\n            ? loopOpts.engine.name\n            : undefined,\n        model: usage.model,\n        inputTokens: usage.inputTokens,\n        outputTokens: usage.outputTokens,\n        cacheReadTokens: usage.cacheReadTokens,\n        cacheWriteTokens: usage.cacheWriteTokens,\n        costCentsX100,\n        durationMs: totalDurationMs,\n        status: runStatus,\n        errorMessage,\n        toolCalls: toolCallCount,\n        successfulTools,\n        failedTools,\n        createdAt: runStart,\n        experimentAssignments: opts.experimentAssignments,\n        modelSelectionSource: opts.modelSelectionSource,\n      });\n    }\n\n    const parentSpan: TraceSpan = {\n      id: parentSpanId,\n      runId,\n      threadId,\n      userId,\n      parentSpanId: null,\n      spanType: \"agent_run\",\n      name: \"agent_run\",\n      inputTokens: usage?.inputTokens ?? 0,\n      outputTokens: usage?.outputTokens ?? 0,\n      cacheReadTokens: usage?.cacheReadTokens ?? 0,\n      cacheWriteTokens: usage?.cacheWriteTokens ?? 0,\n      costCentsX100,\n      durationMs: totalDurationMs,\n      status: runStatus,\n      errorMessage,\n      metadata: runMetadata,\n      createdAt: runStart,\n    };\n    spans.push(parentSpan);\n\n    const summary: TraceSummary = {\n      runId,\n      threadId,\n      userId,\n      totalSpans: spans.length,\n      llmCalls: llmCallCount,\n      toolCalls: toolCallCount,\n      successfulTools,\n      failedTools,\n      totalDurationMs,\n      totalCostCentsX100: costCentsX100,\n      totalInputTokens: usage?.inputTokens ?? 0,\n      totalOutputTokens: usage?.outputTokens ?? 0,\n      model: usage?.model ?? loopOpts.model,\n      createdAt: runStart,\n    };\n\n    writeTraceData(spans, summary, runId, config).catch(() => {});\n\n    // OpenTelemetry export (no-op unless a provider is registered). Emit a\n    // self-contained `llm.call` span carrying model + token usage, end any\n    // tool spans still open (loop threw mid-tool), and end the run span. Awaited\n    // so the spans are emitted before the function returns; cheap when no-op.\n    try {\n      if (usage) {\n        endAgentSpan(await startAgentSpan(\"llm.call\", {}), {\n          status: runStatus,\n          errorMessage,\n          attributes: {\n            \"llm.model\": usage.model,\n            \"llm.input_tokens\": usage.inputTokens,\n            \"llm.output_tokens\": usage.outputTokens,\n            \"llm.cache_read_tokens\": usage.cacheReadTokens,\n            \"llm.cache_write_tokens\": usage.cacheWriteTokens,\n            \"llm.cost_cents_x100\": costCentsX100,\n          },\n        });\n      }\n      for (const toolSpan of openOtelToolSpans) {\n        endAgentSpan(toolSpan, {\n          status: \"error\",\n          errorMessage: \"Agent run ended before tool_done.\",\n        });\n      }\n      openOtelToolSpans.clear();\n      endAgentSpan(await otelRunSpanPromise, {\n        status: runStatus,\n        errorMessage,\n        attributes: {\n          \"agent.tool_calls\": toolCallCount,\n          \"agent.successful_tools\": successfulTools,\n          \"agent.failed_tools\": failedTools,\n          \"agent.duration_ms\": totalDurationMs,\n          \"agent.input_tokens\": usage?.inputTokens ?? 0,\n          \"agent.output_tokens\": usage?.outputTokens ?? 0,\n          \"agent.cost_cents_x100\": costCentsX100,\n        },\n      });\n    } catch {\n      // OTel export must never break the run.\n    }\n  }\n\n  return usage!;\n}\n\nasync function writeTraceData(\n  spans: TraceSpan[],\n  summary: TraceSummary,\n  runId: string,\n  config: ObservabilityConfig,\n): Promise<void> {\n  const { insertTraceSpan, upsertTraceSummary } = await import(\"./store.js\");\n  await Promise.all(spans.map((s) => insertTraceSpan(s).catch(() => {})));\n  await upsertTraceSummary(summary).catch(() => {});\n\n  // Fire automated evals after trace data is persisted\n  try {\n    const { evaluateRun } = await import(\"./evals.js\");\n    await evaluateRun(runId, { sampleRate: config.evalSampleRate });\n  } catch {}\n}\n"]}
+{"version":3,"file":"traces.js","sourceRoot":"","sources":["../../src/observability/traces.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAE1D,SAAS,MAAM;IACb,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,qBAAqB,CAC5B,UAA8B,EAC9B,KAAa;IAEb,MAAM,MAAM,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IACxD,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrD,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,8BAA8B,CAAC,IAyBvC;IACC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC;IAC7C,MAAM,UAAU,GAA4B;QAC1C,GAAG,0BAA0B,EAAE;QAC/B,MAAM,EAAE,qBAAqB;QAC7B,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,IAAI,CAAC,KAAK;QAClB,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,cAAc,EAAE,IAAI,CAAC,YAAY;QACjC,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ;QACR,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,YAAY,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY;QAClD,iBAAiB,EAAE,IAAI,CAAC,eAAe;QACvC,kBAAkB,EAAE,IAAI,CAAC,gBAAgB;QACzC,eAAe,EAAE,IAAI,CAAC,aAAa;QACnC,QAAQ,EAAE,OAAO;QACjB,WAAW,EAAE,IAAI,CAAC,UAAU;QAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,gBAAgB,EAAE,IAAI,CAAC,eAAe;QACtC,YAAY,EAAE,IAAI,CAAC,WAAW;QAC9B,sBAAsB,EAAE,IAAI,CAAC,oBAAoB;QACjD,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;QAClD,aAAa,EAAE,IAAI,CAAC,SAAS;QAC7B,YAAY,EAAE,IAAI,CAAC,KAAK;QACxB,cAAc,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;QAC1C,WAAW,EAAE,IAAI,CAAC,SAAS;QAC3B,aAAa,EAAE,WAAW;QAC1B,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,YAAY,EAAE,QAAQ;QACtB,gBAAgB,EAAE,IAAI,CAAC,WAAW;QAClC,iBAAiB,EAAE,IAAI,CAAC,YAAY;QACpC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI;QAC/D,YAAY,EAAE,IAAI,CAAC,MAAM,KAAK,OAAO;QACrC,SAAS,EAAE,KAAK;QAChB,2BAA2B,EAAE,IAAI,CAAC,eAAe;QACjD,+BAA+B,EAAE,IAAI,CAAC,gBAAgB;QACtD,iBAAiB,EAAE,CAAC;QACpB,kBAAkB,EAAE,OAAO;KAC5B,CAAC;IACF,IAAI,IAAI,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;QACvC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,qBAAqB;aACnD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;aAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC,qBAAqB;aACxD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;aACzC,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,UAAU,CAAC,aAAa,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YACtE,UAAU,CAAC,kBAAkB,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,IAAI,KAAK;QAAE,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,yBAAyB,CAAC;aACnC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YAClB,KAAK,CAAC,gBAAgB,EAAE,UAAU,EAAE;gBAClC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;aACjC,CAAC,CAAC;QACL,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AAED;;;;;;2BAM2B;AAC3B,MAAM,uBAAuB,GAC3B,uGAAuG,CAAC;AAE1G;;;wEAGwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,UAAU,CAAC,KAAK,EAAE,IAAI,OAAO,EAAU,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,IAAqB;IACvD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC;QAAE,OAAO,YAAY,CAAC;IACnD,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,MAAM,GAAwC,IAAI,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,GAAG,CAAC,MAAM,UAAU,CACxB,sBAAsB,CACvB,CAAwC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,MAAM,EAAE,8BAA8B,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,4BAA4B;QAC/B,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QACjB,GAAG,8BAA8B,CAAC,MAAM,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IA+CzC;IACC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC;IAC9B,MAAM,wBAAwB,GAC5B,MAAM,CAAC,wBAAwB,IAAI,IAAI,CAAC,cAAc,IAAI,QAAQ,IAAI,MAAM;QAC1E,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;aACjB,IAAI,CAAC,CAAC,EAAE,8BAA8B,EAAE,EAAE,EAAE,CAC3C,8BAA8B,CAAC,QAAQ,EAAE;YACvC,MAAM;YACN,YAAY,EAAE,KAAK;SACpB,CAAC,CACH;aACA,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACtB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,kBAAkB,GAAG,cAAc,CAAC,WAAW,EAAE;QACrD,cAAc,EAAE,KAAK;QACrB,iBAAiB,EAAE,QAAQ,IAAI,SAAS;QACxC,eAAe,EAAE,MAAM,IAAI,SAAS;QACpC,aAAa,EAAE,QAAQ,CAAC,KAAK;QAC7B,8BAA8B,EAAE,IAAI,CAAC,oBAAoB;QACzD,qBAAqB,EACnB,IAAI,CAAC,qBAAqB,EAAE,MAAM,KAAK,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,YAAY;YAC5C,CAAC,CAAC,SAAS;QACf,0BAA0B,EACxB,IAAI,CAAC,qBAAqB,EAAE,MAAM,KAAK,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS;YACzC,CAAC,CAAC,SAAS;KAChB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,oEAAoE;IACpE,MAAM,YAAY,GAAG,IAAI,GAAG,EAUzB,CAAC;IACJ,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEvD,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAa,CAAC;IAE/C,MAAM,gBAAgB,GAAG,CAAC,KAAqB,EAAQ,EAAE;QACvD,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,qBAAqB,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;gBACrB,iEAAiE;gBACjE,oEAAoE;gBACpE,qEAAqE;gBACrE,uEAAuE;gBACvE,MAAM,KAAK,GAYP;oBACF,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;oBACnB,QAAQ,EAAE,KAAK,CAAC,IAAI;oBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,QAAQ,EAAE,IAAI;iBACf,CAAC;gBACF,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjC,KAAK,cAAc,CAAC,WAAW,EAAE;oBAC/B,WAAW,EAAE,KAAK,CAAC,IAAI;iBACxB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;oBACf,IAAI,CAAC,IAAI;wBAAE,OAAO;oBAClB,sEAAsE;oBACtE,+DAA+D;oBAC/D,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;wBACpB,YAAY,CAAC,IAAI,EAAE;4BACjB,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM;4BAC9B,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY;yBAC3C,CAAC,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACN,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;wBACtB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjD,IAAI,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;oBAC1B,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjD,MAAM,OAAO,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC;gBAC/B,MAAM,OAAO,GACX,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC1B,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAC7B,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;wBAC7B,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBACD,aAAa,EAAE,CAAC;gBAEhB,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;oBAChC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC/B,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAC/C,IAAI,OAAO;oBAAE,WAAW,EAAE,CAAC;;oBACtB,eAAe,EAAE,CAAC;gBAEvB,uEAAuE;gBACvE,oEAAoE;gBACpE,MAAM,aAAa,GAAG;oBACpB,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAwB;oBAC9D,YAAY,EAAE,OAAO,CAAC,CAAC,CAAE,KAAK,CAAC,MAAiB,CAAC,CAAC,CAAC,IAAI;iBACxD,CAAC;gBACF,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;oBACtB,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBAC3C,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE;wBAC7B,MAAM,EAAE,aAAa,CAAC,MAAM;wBAC5B,YAAY,EAAE,aAAa,CAAC,YAAY;wBACxC,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE;qBACxC,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,OAAO,EAAE,CAAC;oBACnB,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC;gBACpC,CAAC;gBAED,MAAM,IAAI,GAAc;oBACtB,EAAE,EAAE,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE;oBAC/B,KAAK;oBACL,QAAQ;oBACR,MAAM;oBACN,YAAY;oBACZ,QAAQ,EAAE,WAAW;oBACrB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,WAAW,EAAE,CAAC;oBACd,YAAY,EAAE,CAAC;oBACf,eAAe,EAAE,CAAC;oBAClB,gBAAgB,EAAE,CAAC;oBACnB,aAAa,EAAE,CAAC;oBAChB,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBACtD,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;oBACrC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;oBAC3C,QAAQ,EACN,MAAM,CAAC,eAAe,IAAI,OAAO;wBAC/B,CAAC,CAAC,yDAAyD;4BACzD,sDAAsD;4BACtD,uDAAuD;4BACvD,oCAAoC;4BACpC;gCACE,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAGzC;6BACF;wBACH,CAAC,CAAC,IAAI;oBACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAEV,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,IAAI,KAAiC,CAAC;IACtC,IAAI,SAAS,GAAwB,SAAS,CAAC;IAC/C,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,IAAI,WAAW,GAAmC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IACxE,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;QACzD,SAAS,GAAG,cAAc,EAAE,MAAM,IAAI,OAAO,CAAC;QAC9C,YAAY;YACV,cAAc,EAAE,YAAY,KAAK,SAAS;gBACxC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC;QAClC,MAAM,aAAa,GAAG,cAAc,EAAE,QAAQ,IAAI,IAAI,CAAC;QACvD,WAAW;YACT,WAAW,IAAI,aAAa;gBAC1B,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE;gBACtD,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,eAAe,GAAG,MAAM,GAAG,QAAQ,CAAC;QAE1C,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YAC5D,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,GAAG,aAAa,CAC3B,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,eAAe,EACrB,KAAK,CAAC,gBAAgB,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAEV,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,GAAG,CAAC,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAc;gBACzB,EAAE,EAAE,SAAS;gBACb,KAAK;gBACL,QAAQ;gBACR,MAAM;gBACN,YAAY;gBACZ,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,KAAK,CAAC,KAAK;gBACjB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,aAAa;gBACb,UAAU,EAAE,eAAe;gBAC3B,MAAM,EAAE,SAAS;gBACjB,YAAY;gBACZ,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,QAAQ;aACpB,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpB,8BAA8B,CAAC;gBAC7B,KAAK;gBACL,QAAQ;gBACR,MAAM;gBACN,YAAY;gBACZ,SAAS;gBACT,UAAU,EACR,OAAO,QAAQ,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ;oBACvC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI;oBACtB,CAAC,CAAC,SAAS;gBACf,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,aAAa;gBACb,UAAU,EAAE,eAAe;gBAC3B,MAAM,EAAE,SAAS;gBACjB,YAAY;gBACZ,SAAS,EAAE,aAAa;gBACxB,eAAe;gBACf,WAAW;gBACX,SAAS,EAAE,QAAQ;gBACnB,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;gBACjD,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;aAChD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAc;YAC5B,EAAE,EAAE,YAAY;YAChB,KAAK;YACL,QAAQ;YACR,MAAM;YACN,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,WAAW;YACrB,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;YACpC,YAAY,EAAE,KAAK,EAAE,YAAY,IAAI,CAAC;YACtC,eAAe,EAAE,KAAK,EAAE,eAAe,IAAI,CAAC;YAC5C,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,IAAI,CAAC;YAC9C,aAAa;YACb,UAAU,EAAE,eAAe;YAC3B,MAAM,EAAE,SAAS;YACjB,YAAY;YACZ,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,QAAQ;SACpB,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEvB,MAAM,OAAO,GAAiB;YAC5B,KAAK;YACL,QAAQ;YACR,MAAM;YACN,UAAU,EAAE,KAAK,CAAC,MAAM;YACxB,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,aAAa;YACxB,eAAe;YACf,WAAW;YACX,eAAe;YACf,kBAAkB,EAAE,aAAa;YACjC,gBAAgB,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;YACzC,iBAAiB,EAAE,KAAK,EAAE,YAAY,IAAI,CAAC;YAC3C,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,QAAQ,CAAC,KAAK;YACrC,SAAS,EAAE,QAAQ;SACpB,CAAC;QAEF,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAE9D,uEAAuE;QACvE,uEAAuE;QACvE,6EAA6E;QAC7E,0EAA0E;QAC1E,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,CAAC,MAAM,cAAc,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE;oBACjD,MAAM,EAAE,SAAS;oBACjB,YAAY;oBACZ,UAAU,EAAE;wBACV,WAAW,EAAE,KAAK,CAAC,KAAK;wBACxB,kBAAkB,EAAE,KAAK,CAAC,WAAW;wBACrC,mBAAmB,EAAE,KAAK,CAAC,YAAY;wBACvC,uBAAuB,EAAE,KAAK,CAAC,eAAe;wBAC9C,wBAAwB,EAAE,KAAK,CAAC,gBAAgB;wBAChD,qBAAqB,EAAE,aAAa;qBACrC;iBACF,CAAC,CAAC;YACL,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;gBACzC,YAAY,CAAC,QAAQ,EAAE;oBACrB,MAAM,EAAE,OAAO;oBACf,YAAY,EAAE,mCAAmC;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC1B,YAAY,CAAC,MAAM,kBAAkB,EAAE;gBACrC,MAAM,EAAE,SAAS;gBACjB,YAAY;gBACZ,UAAU,EAAE;oBACV,kBAAkB,EAAE,aAAa;oBACjC,wBAAwB,EAAE,eAAe;oBACzC,oBAAoB,EAAE,WAAW;oBACjC,mBAAmB,EAAE,eAAe;oBACpC,oBAAoB,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC;oBAC7C,qBAAqB,EAAE,KAAK,EAAE,YAAY,IAAI,CAAC;oBAC/C,uBAAuB,EAAE,aAAa;iBACvC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,KAAK,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,MAAM,wBAAwB,CAAC;YACzD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAClE,MAAM,sBAAsB,CAAC;oBAC3B,eAAe,EAAE,MAAM,CAAC,sBAAsB;oBAC9C,sBAAsB,EAAE,iBAAiB,CAAC,KAAK;oBAC/C,IAAI,EAAE,IAAI,CAAC,cAAc;oBACzB,cAAc,EAAE,iBAAiB,CAAC,KAAK;oBACvC,0BAA0B,EAAE,KAAK;oBACjC,QAAQ;oBACR,MAAM;oBACN,UAAU,EAAE,MAAM,CAAC,2BAA2B;iBAC/C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;IAED,OAAO,KAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAkB,EAClB,OAAqB,EACrB,KAAa,EACb,MAA2B;IAE3B,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3E,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAElD,qDAAqD;IACrD,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;AACZ,CAAC","sourcesContent":["import type { AgentLoopUsage } from \"../agent/production-agent.js\";\nimport type { AgentChatEvent, AgentToolInput } from \"../agent/types.js\";\nimport { type AgentSpan, endAgentSpan, startAgentSpan } from \"./tracing.js\";\nimport { trackingIdentityProperties } from \"./tracking-identity.js\";\nimport type { TraceSpan, TraceSummary, ObservabilityConfig } from \"./types.js\";\nimport { DEFAULT_OBSERVABILITY_CONFIG } from \"./types.js\";\n\nfunction spanId(): string {\n  return `span-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;\n}\n\nfunction llmProviderFromEngine(\n  engineName: string | undefined,\n  model: string,\n): string {\n  const engine = engineName?.trim();\n  if (engine?.startsWith(\"ai-sdk:\")) return engine.slice(\"ai-sdk:\".length);\n  if (engine) return engine;\n  if (/claude|anthropic/i.test(model)) return \"anthropic\";\n  if (/gpt|openai|codex/i.test(model)) return \"openai\";\n  if (/gemini|google/i.test(model)) return \"google\";\n  return \"unknown\";\n}\n\nfunction costUsdFromCenticents(value: number): number {\n  return Math.round((value / 10_000) * 1_000_000) / 1_000_000;\n}\n\nfunction emitLlmGenerationTrackingEvent(args: {\n  runId: string;\n  threadId: string | null;\n  userId: string | null;\n  parentSpanId: string;\n  llmSpanId: string;\n  engineName: string | undefined;\n  model: string;\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheWriteTokens: number;\n  costCentsX100: number;\n  durationMs: number;\n  status: \"success\" | \"error\";\n  errorMessage: string | null;\n  toolCalls: number;\n  successfulTools: number;\n  failedTools: number;\n  createdAt: number;\n  experimentAssignments?: Array<{\n    experimentId: string;\n    variantId: string;\n  }>;\n  modelSelectionSource?: string;\n}): void {\n  const provider = llmProviderFromEngine(args.engineName, args.model);\n  const costUsd = costUsdFromCenticents(args.costCentsX100);\n  const error = args.errorMessage ?? undefined;\n  const properties: Record<string, unknown> = {\n    ...trackingIdentityProperties(),\n    source: \"agent_observability\",\n    span_type: \"llm_call\",\n    run_id: args.runId,\n    thread_id: args.threadId,\n    parent_span_id: args.parentSpanId,\n    span_id: args.llmSpanId,\n    model: args.model,\n    provider,\n    input_tokens: args.inputTokens,\n    output_tokens: args.outputTokens,\n    total_tokens: args.inputTokens + args.outputTokens,\n    cache_read_tokens: args.cacheReadTokens,\n    cache_write_tokens: args.cacheWriteTokens,\n    cost_cents_x100: args.costCentsX100,\n    cost_usd: costUsd,\n    duration_ms: args.durationMs,\n    status: args.status,\n    tool_calls: args.toolCalls,\n    successful_tools: args.successfulTools,\n    failed_tools: args.failedTools,\n    model_selection_source: args.modelSelectionSource,\n    created_at: new Date(args.createdAt).toISOString(),\n    created_at_ms: args.createdAt,\n    $ai_trace_id: args.runId,\n    $ai_session_id: args.threadId ?? undefined,\n    $ai_span_id: args.llmSpanId,\n    $ai_span_name: \"agent_run\",\n    $ai_parent_id: args.parentSpanId,\n    $ai_model: args.model,\n    $ai_provider: provider,\n    $ai_input_tokens: args.inputTokens,\n    $ai_output_tokens: args.outputTokens,\n    $ai_latency: Math.round((args.durationMs / 1000) * 1000) / 1000,\n    $ai_is_error: args.status === \"error\",\n    $ai_error: error,\n    $ai_cache_read_input_tokens: args.cacheReadTokens,\n    $ai_cache_creation_input_tokens: args.cacheWriteTokens,\n    $ai_request_count: 1,\n    $ai_total_cost_usd: costUsd,\n  };\n  if (args.experimentAssignments?.length) {\n    properties.experiment_ids = args.experimentAssignments\n      .map((assignment) => assignment.experimentId)\n      .join(\",\");\n    properties.experiment_variants = args.experimentAssignments\n      .map((assignment) => assignment.variantId)\n      .join(\",\");\n    if (args.experimentAssignments.length === 1) {\n      properties.experiment_id = args.experimentAssignments[0].experimentId;\n      properties.experiment_variant = args.experimentAssignments[0].variantId;\n    }\n  }\n  if (error) properties.error_message = error;\n\n  for (const key of Object.keys(properties)) {\n    if (properties[key] === undefined) delete properties[key];\n  }\n\n  try {\n    void import(\"../tracking/registry.js\")\n      .then(({ track }) => {\n        track(\"$ai_generation\", properties, {\n          userId: args.userId ?? undefined,\n        });\n      })\n      .catch(() => {});\n  } catch {\n    // Tracking must never affect the agent run or trace persistence.\n  }\n}\n\n/** Keys whose values are stripped from persisted tool inputs when\n *  `captureToolArgs` is enabled. Matched case-insensitively and tolerant\n *  of `_` / `-` separators. M14 in the MCP/A2A audit: tool calls\n *  routinely receive credentials verbatim (db-exec INSERTs, fetchTool\n *  Authorization headers, ad-hoc bearer tokens) — keeping those values\n *  out of agent_trace_spans.metadata avoids long-term storage of\n *  short-lived secrets. */\nconst SENSITIVE_FIELD_PATTERN =\n  /^(authorization|cookie|api[_-]?key|password|secret|token|access[_-]?token|refresh[_-]?token|bearer)$/i;\n\n/** Recursively walk a structured value and replace sensitive field\n *  values with the literal string \"[REDACTED]\". Pure (returns a copy);\n *  the original input is never mutated. Cycles are tolerated via a\n *  small WeakSet seen-tracker that returns \"[Circular]\" for repeats. */\nexport function redactSensitiveFields(value: unknown): unknown {\n  return redactWalk(value, new WeakSet<object>());\n}\n\nfunction redactWalk(value: unknown, seen: WeakSet<object>): unknown {\n  if (value === null || typeof value !== \"object\") return value;\n  if (seen.has(value as object)) return \"[Circular]\";\n  seen.add(value as object);\n  if (Array.isArray(value)) {\n    return value.map((v) => redactWalk(v, seen));\n  }\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(value as Record<string, unknown>)) {\n    if (SENSITIVE_FIELD_PATTERN.test(k)) {\n      out[k] = \"[REDACTED]\";\n    } else {\n      out[k] = redactWalk(v, seen);\n    }\n  }\n  return out;\n}\n\nexport async function getObservabilityConfig(): Promise<ObservabilityConfig> {\n  let stored: Partial<ObservabilityConfig> | null = null;\n  try {\n    const { getSetting } = await import(\"../settings/store.js\");\n    stored = (await getSetting(\n      \"observability-config\",\n    )) as Partial<ObservabilityConfig> | null;\n  } catch {}\n  const { resolveInferredSentimentConfig } = await import(\"./sentiment.js\");\n  return {\n    ...DEFAULT_OBSERVABILITY_CONFIG,\n    ...(stored ?? {}),\n    ...resolveInferredSentimentConfig(stored),\n  };\n}\n\nexport async function instrumentAgentLoop(opts: {\n  runAgentLoop: (loopOpts: {\n    engine: any;\n    model: string;\n    systemPrompt: string;\n    tools: any[];\n    messages: any[];\n    actions: Record<string, any>;\n    send: (event: AgentChatEvent) => void;\n    signal: AbortSignal;\n    providerOptions?: any;\n  }) => Promise<AgentLoopUsage>;\n  loopOpts: {\n    engine: any;\n    model: string;\n    systemPrompt: string;\n    tools: any[];\n    messages: any[];\n    actions: Record<string, any>;\n    send: (event: AgentChatEvent) => void;\n    signal: AbortSignal;\n    providerOptions?: any;\n  };\n  runId: string;\n  threadId: string | null;\n  /** Owner of this run; persisted on every span + summary so dashboard\n   *  reads can filter to a single user. Null for unauthenticated callers\n   *  (background tasks, etc.) — those rows aren't returned by per-user\n   *  reads. */\n  userId: string | null;\n  config: ObservabilityConfig;\n  metadata?: Record<string, unknown> | null;\n  experimentAssignments?: Array<{\n    experimentId: string;\n    variantId: string;\n  }>;\n  modelSelectionSource?: string;\n  /** Raw user-authored message before prompt/context enrichment. */\n  sentimentInput?: string;\n  classifyError?: (error: unknown) =>\n    | {\n        status?: \"success\" | \"error\";\n        errorMessage?: string | null;\n        metadata?: Record<string, unknown> | null;\n      }\n    | null\n    | undefined;\n}): Promise<AgentLoopUsage> {\n  const { runAgentLoop, loopOpts, runId, threadId, userId, config } = opts;\n  const runStart = Date.now();\n  const parentSpanId = spanId();\n  const precedingResponsePromise =\n    config.inferredSentimentEnabled && opts.sentimentInput && threadId && userId\n      ? import(\"./store.js\")\n          .then(({ getLatestTraceSummaryForThread }) =>\n            getLatestTraceSummaryForThread(threadId, {\n              userId,\n              excludeRunId: runId,\n            }),\n          )\n          .catch(() => null)\n      : Promise.resolve(null);\n\n  // Optional OpenTelemetry root span for this run. No-ops unless a host has\n  // installed `@opentelemetry/api` and registered a provider. The promise is\n  // resolved before the loop runs so child tool/model spans can parent under\n  // it conceptually (we keep them flat in the same tracer, which is enough\n  // for the dashboards an embedding app would build).\n  const otelRunSpanPromise = startAgentSpan(\"agent.run\", {\n    \"agent.run_id\": runId,\n    \"agent.thread_id\": threadId ?? undefined,\n    \"agent.user_id\": userId ?? undefined,\n    \"agent.model\": loopOpts.model,\n    \"agent.model_selection_source\": opts.modelSelectionSource,\n    \"agent.experiment_id\":\n      opts.experimentAssignments?.length === 1\n        ? opts.experimentAssignments[0].experimentId\n        : undefined,\n    \"agent.experiment_variant\":\n      opts.experimentAssignments?.length === 1\n        ? opts.experimentAssignments[0].variantId\n        : undefined,\n  });\n\n  const spans: TraceSpan[] = [];\n  let toolInvocationCounter = 0;\n  // Keyed by counter to handle concurrent calls to the same tool name\n  const pendingTools = new Map<\n    number,\n    {\n      spanId: string;\n      startMs: number;\n      toolName: string;\n      input: AgentToolInput;\n      otelSpan: AgentSpan | null;\n      endResult?: { status: \"success\" | \"error\"; errorMessage: string | null };\n    }\n  >();\n  // Secondary index: tool name → FIFO queue of pending invocation counters.\n  // tool_start/tool_done events carry only the tool name (no call id), so to\n  // pair starts and dones correctly when the agent runs concurrent calls to the\n  // same tool name (read-only / parallelSafe batches via Promise.all), we keep a\n  // queue per name and match each done to the OLDEST still-pending start.\n  const toolNameToCounters = new Map<string, number[]>();\n\n  let toolCallCount = 0;\n  let successfulTools = 0;\n  let failedTools = 0;\n\n  // Track in-flight OTel tool spans so they're all ended even if the loop\n  // throws before a matching `tool_done` arrives.\n  const openOtelToolSpans = new Set<AgentSpan>();\n\n  const instrumentedSend = (event: AgentChatEvent): void => {\n    try {\n      if (event.type === \"tool_start\") {\n        const counter = toolInvocationCounter++;\n        const sid = spanId();\n        // Start the OTel tool span synchronously-ish: kick off the async\n        // resolution and stash the span once it lands. Tool spans are short\n        // and the api tracer is synchronous in practice, but we tolerate the\n        // microtask gap by recording the span on the pending entry when ready.\n        const entry: {\n          spanId: string;\n          startMs: number;\n          toolName: string;\n          input: AgentToolInput;\n          otelSpan: AgentSpan | null;\n          // Set by the done handler if it fires before the span promise\n          // resolves, so the resolved span is ended with the correct status.\n          endResult?: {\n            status: \"success\" | \"error\";\n            errorMessage: string | null;\n          };\n        } = {\n          spanId: sid,\n          startMs: Date.now(),\n          toolName: event.tool,\n          input: event.input,\n          otelSpan: null,\n        };\n        pendingTools.set(counter, entry);\n        void startAgentSpan(\"tool.call\", {\n          \"tool.name\": event.tool,\n        }).then((span) => {\n          if (!span) return;\n          // If `tool_done` already ran for this call, end the span now with the\n          // status it recorded; otherwise stash it for the done handler.\n          if (entry.endResult) {\n            endAgentSpan(span, {\n              status: entry.endResult.status,\n              errorMessage: entry.endResult.errorMessage,\n            });\n          } else {\n            entry.otelSpan = span;\n            openOtelToolSpans.add(span);\n          }\n        });\n        const queue = toolNameToCounters.get(event.tool);\n        if (queue) queue.push(counter);\n        else toolNameToCounters.set(event.tool, [counter]);\n      } else if (event.type === \"tool_done\") {\n        const queue = toolNameToCounters.get(event.tool);\n        const counter = queue?.shift();\n        const pending =\n          counter !== undefined ? pendingTools.get(counter) : undefined;\n        if (counter !== undefined) {\n          pendingTools.delete(counter);\n          if (queue && queue.length === 0)\n            toolNameToCounters.delete(event.tool);\n        }\n        toolCallCount++;\n\n        const isError =\n          typeof event.result === \"string\" &&\n          (event.result.startsWith(\"Error\") ||\n            event.result.startsWith(\"Error running \"));\n        if (isError) failedTools++;\n        else successfulTools++;\n\n        // Finalize the OTel tool span. If the span promise hasn't resolved yet\n        // we record the result on the entry so its `.then` handler ends it.\n        const otelEndResult = {\n          status: (isError ? \"error\" : \"success\") as \"success\" | \"error\",\n          errorMessage: isError ? (event.result as string) : null,\n        };\n        if (pending?.otelSpan) {\n          openOtelToolSpans.delete(pending.otelSpan);\n          endAgentSpan(pending.otelSpan, {\n            status: otelEndResult.status,\n            errorMessage: otelEndResult.errorMessage,\n            attributes: { \"tool.name\": event.tool },\n          });\n        } else if (pending) {\n          pending.endResult = otelEndResult;\n        }\n\n        const span: TraceSpan = {\n          id: pending?.spanId ?? spanId(),\n          runId,\n          threadId,\n          userId,\n          parentSpanId,\n          spanType: \"tool_call\",\n          name: event.tool,\n          inputTokens: 0,\n          outputTokens: 0,\n          cacheReadTokens: 0,\n          cacheWriteTokens: 0,\n          costCentsX100: 0,\n          durationMs: pending ? Date.now() - pending.startMs : 0,\n          status: isError ? \"error\" : \"success\",\n          errorMessage: isError ? event.result : null,\n          metadata:\n            config.captureToolArgs && pending\n              ? // Strip Authorization/api-key/token-shaped values before\n                // persisting (M14 in the MCP/A2A audit). Tool-runtime\n                // execution still sees the unredacted input — only the\n                // long-lived span row is sanitized.\n                {\n                  input: redactSensitiveFields(pending.input) as Record<\n                    string,\n                    string\n                  >,\n                }\n              : null,\n          createdAt: Date.now(),\n        };\n        spans.push(span);\n      }\n    } catch {}\n\n    loopOpts.send(event);\n  };\n\n  let usage: AgentLoopUsage | undefined;\n  let runStatus: \"success\" | \"error\" = \"success\";\n  let errorMessage: string | null = null;\n  let runMetadata: Record<string, unknown> | null = opts.metadata ?? null;\n  try {\n    usage = await runAgentLoop({ ...loopOpts, send: instrumentedSend });\n  } catch (err: any) {\n    const classification = opts.classifyError?.(err) ?? null;\n    runStatus = classification?.status ?? \"error\";\n    errorMessage =\n      classification?.errorMessage === undefined\n        ? (err?.message ?? String(err))\n        : classification.errorMessage;\n    const errorMetadata = classification?.metadata ?? null;\n    runMetadata =\n      runMetadata || errorMetadata\n        ? { ...(runMetadata ?? {}), ...(errorMetadata ?? {}) }\n        : null;\n    throw err;\n  } finally {\n    const runEnd = Date.now();\n    const totalDurationMs = runEnd - runStart;\n\n    let costCentsX100 = 0;\n    try {\n      const { calculateCost } = await import(\"../usage/store.js\");\n      if (usage) {\n        costCentsX100 = calculateCost(\n          usage.inputTokens,\n          usage.outputTokens,\n          usage.model,\n          usage.cacheReadTokens,\n          usage.cacheWriteTokens,\n        );\n      }\n    } catch {}\n\n    let llmCallCount = 0;\n    if (usage) {\n      llmCallCount = 1;\n      const llmSpanId = spanId();\n      const llmSpan: TraceSpan = {\n        id: llmSpanId,\n        runId,\n        threadId,\n        userId,\n        parentSpanId,\n        spanType: \"llm_call\",\n        name: usage.model,\n        inputTokens: usage.inputTokens,\n        outputTokens: usage.outputTokens,\n        cacheReadTokens: usage.cacheReadTokens,\n        cacheWriteTokens: usage.cacheWriteTokens,\n        costCentsX100,\n        durationMs: totalDurationMs,\n        status: runStatus,\n        errorMessage,\n        metadata: null,\n        createdAt: runStart,\n      };\n      spans.push(llmSpan);\n      emitLlmGenerationTrackingEvent({\n        runId,\n        threadId,\n        userId,\n        parentSpanId,\n        llmSpanId,\n        engineName:\n          typeof loopOpts.engine?.name === \"string\"\n            ? loopOpts.engine.name\n            : undefined,\n        model: usage.model,\n        inputTokens: usage.inputTokens,\n        outputTokens: usage.outputTokens,\n        cacheReadTokens: usage.cacheReadTokens,\n        cacheWriteTokens: usage.cacheWriteTokens,\n        costCentsX100,\n        durationMs: totalDurationMs,\n        status: runStatus,\n        errorMessage,\n        toolCalls: toolCallCount,\n        successfulTools,\n        failedTools,\n        createdAt: runStart,\n        experimentAssignments: opts.experimentAssignments,\n        modelSelectionSource: opts.modelSelectionSource,\n      });\n    }\n\n    const parentSpan: TraceSpan = {\n      id: parentSpanId,\n      runId,\n      threadId,\n      userId,\n      parentSpanId: null,\n      spanType: \"agent_run\",\n      name: \"agent_run\",\n      inputTokens: usage?.inputTokens ?? 0,\n      outputTokens: usage?.outputTokens ?? 0,\n      cacheReadTokens: usage?.cacheReadTokens ?? 0,\n      cacheWriteTokens: usage?.cacheWriteTokens ?? 0,\n      costCentsX100,\n      durationMs: totalDurationMs,\n      status: runStatus,\n      errorMessage,\n      metadata: runMetadata,\n      createdAt: runStart,\n    };\n    spans.push(parentSpan);\n\n    const summary: TraceSummary = {\n      runId,\n      threadId,\n      userId,\n      totalSpans: spans.length,\n      llmCalls: llmCallCount,\n      toolCalls: toolCallCount,\n      successfulTools,\n      failedTools,\n      totalDurationMs,\n      totalCostCentsX100: costCentsX100,\n      totalInputTokens: usage?.inputTokens ?? 0,\n      totalOutputTokens: usage?.outputTokens ?? 0,\n      model: usage?.model ?? loopOpts.model,\n      createdAt: runStart,\n    };\n\n    writeTraceData(spans, summary, runId, config).catch(() => {});\n\n    // OpenTelemetry export (no-op unless a provider is registered). Emit a\n    // self-contained `llm.call` span carrying model + token usage, end any\n    // tool spans still open (loop threw mid-tool), and end the run span. Awaited\n    // so the spans are emitted before the function returns; cheap when no-op.\n    try {\n      if (usage) {\n        endAgentSpan(await startAgentSpan(\"llm.call\", {}), {\n          status: runStatus,\n          errorMessage,\n          attributes: {\n            \"llm.model\": usage.model,\n            \"llm.input_tokens\": usage.inputTokens,\n            \"llm.output_tokens\": usage.outputTokens,\n            \"llm.cache_read_tokens\": usage.cacheReadTokens,\n            \"llm.cache_write_tokens\": usage.cacheWriteTokens,\n            \"llm.cost_cents_x100\": costCentsX100,\n          },\n        });\n      }\n      for (const toolSpan of openOtelToolSpans) {\n        endAgentSpan(toolSpan, {\n          status: \"error\",\n          errorMessage: \"Agent run ended before tool_done.\",\n        });\n      }\n      openOtelToolSpans.clear();\n      endAgentSpan(await otelRunSpanPromise, {\n        status: runStatus,\n        errorMessage,\n        attributes: {\n          \"agent.tool_calls\": toolCallCount,\n          \"agent.successful_tools\": successfulTools,\n          \"agent.failed_tools\": failedTools,\n          \"agent.duration_ms\": totalDurationMs,\n          \"agent.input_tokens\": usage?.inputTokens ?? 0,\n          \"agent.output_tokens\": usage?.outputTokens ?? 0,\n          \"agent.cost_cents_x100\": costCentsX100,\n        },\n      });\n    } catch {\n      // OTel export must never break the run.\n    }\n  }\n\n  // Classify only after the main loop has finished so the tiny managed Luna\n  // request cannot contend with the user's response for a gateway slot. This\n  // short, awaited tail keeps serverless runtimes alive long enough to emit the\n  // event, while the response content has already streamed to the client.\n  if (usage && opts.sentimentInput) {\n    try {\n      const precedingResponse = await precedingResponsePromise;\n      if (precedingResponse) {\n        const { inferAndTrackSentiment } = await import(\"./sentiment.js\");\n        await inferAndTrackSentiment({\n          classifierModel: config.inferredSentimentModel,\n          precedingResponseModel: precedingResponse.model,\n          text: opts.sentimentInput,\n          precedingRunId: precedingResponse.runId,\n          classificationTriggerRunId: runId,\n          threadId,\n          userId,\n          sampleRate: config.inferredSentimentSampleRate,\n        });\n      }\n    } catch {\n      // Optional inference must never alter the result of the main run.\n    }\n  }\n\n  return usage!;\n}\n\nasync function writeTraceData(\n  spans: TraceSpan[],\n  summary: TraceSummary,\n  runId: string,\n  config: ObservabilityConfig,\n): Promise<void> {\n  const { insertTraceSpan, upsertTraceSummary } = await import(\"./store.js\");\n  await Promise.all(spans.map((s) => insertTraceSpan(s).catch(() => {})));\n  await upsertTraceSummary(summary).catch(() => {});\n\n  // Fire automated evals after trace data is persisted\n  try {\n    const { evaluateRun } = await import(\"./evals.js\");\n    await evaluateRun(runId, { sampleRate: config.evalSampleRate });\n  } catch {}\n}\n"]}

package/dist/observability/tracking-identity.d.ts

@@ -0,0 +1,3 @@
+/** Shared app/template dimensions for central observability tracking events. */
+export declare function trackingIdentityProperties(): Record<string, string>;
+//# sourceMappingURL=tracking-identity.d.ts.map

package/dist/observability/tracking-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracking-identity.d.ts","sourceRoot":"","sources":["../../src/observability/tracking-identity.ts"],"names":[],"mappings":"AA2BA,gFAAgF;AAChF,wBAAgB,0BAA0B,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0BnE"}

package/dist/observability/tracking-identity.js

@@ -0,0 +1,51 @@
+function normalizeTrackingSlug(value) {
+    const raw = value?.trim().toLowerCase();
+    if (!raw)
+        return undefined;
+    return raw
+        .replace(/^@agent-native\//, "")
+        .replace(/[^a-z0-9._-]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}
+function appSlugFromUrl(value) {
+    if (!value?.trim())
+        return undefined;
+    try {
+        const raw = /^[a-z][a-z0-9+.-]*:\/\//i.test(value)
+            ? value
+            : `https://${value}`;
+        const hostname = new URL(raw).hostname.toLowerCase();
+        if (hostname.endsWith(".agent-native.com")) {
+            return normalizeTrackingSlug(hostname.slice(0, -".agent-native.com".length));
+        }
+        return normalizeTrackingSlug(hostname.split(".")[0]);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Shared app/template dimensions for central observability tracking events. */
+export function trackingIdentityProperties() {
+    const packageApp = normalizeTrackingSlug(process.env.npm_package_name);
+    const urlApp = appSlugFromUrl(process.env.APP_URL) ||
+        appSlugFromUrl(process.env.BETTER_AUTH_URL) ||
+        appSlugFromUrl(process.env.URL) ||
+        appSlugFromUrl(process.env.DEPLOY_URL) ||
+        appSlugFromUrl(process.env.VERCEL_PROJECT_PRODUCTION_URL) ||
+        appSlugFromUrl(process.env.VERCEL_URL);
+    const app = normalizeTrackingSlug(process.env.AGENT_NATIVE_APP) ||
+        normalizeTrackingSlug(process.env.VITE_AGENT_NATIVE_APP) ||
+        urlApp ||
+        packageApp ||
+        normalizeTrackingSlug(process.env.APP_NAME);
+    const template = normalizeTrackingSlug(process.env.AGENT_NATIVE_TEMPLATE) ||
+        normalizeTrackingSlug(process.env.VITE_AGENT_NATIVE_TEMPLATE) ||
+        normalizeTrackingSlug(process.env.APP_TEMPLATE) ||
+        normalizeTrackingSlug(process.env.VITE_APP_TEMPLATE) ||
+        app;
+    return {
+        ...(app ? { app, agent_native_app: app } : {}),
+        ...(template ? { template, agent_native_template: template } : {}),
+    };
+}
+//# sourceMappingURL=tracking-identity.js.map

package/dist/observability/tracking-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracking-identity.js","sourceRoot":"","sources":["../../src/observability/tracking-identity.ts"],"names":[],"mappings":"AAAA,SAAS,qBAAqB,CAAC,KAAyB;IACtD,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG;SACP,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;YAChD,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3C,OAAO,qBAAqB,CAC1B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,0BAA0B;IACxC,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACvE,MAAM,MAAM,GACV,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACnC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;QACzD,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,GAAG,GACP,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACnD,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACxD,MAAM;QACN,UAAU;QACV,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GACZ,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACxD,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAC7D,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC/C,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACpD,GAAG,CAAC;IAEN,OAAO;QACL,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC","sourcesContent":["function normalizeTrackingSlug(value: string | undefined): string | undefined {\n  const raw = value?.trim().toLowerCase();\n  if (!raw) return undefined;\n  return raw\n    .replace(/^@agent-native\\//, \"\")\n    .replace(/[^a-z0-9._-]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n}\n\nfunction appSlugFromUrl(value: string | undefined): string | undefined {\n  if (!value?.trim()) return undefined;\n  try {\n    const raw = /^[a-z][a-z0-9+.-]*:\\/\\//i.test(value)\n      ? value\n      : `https://${value}`;\n    const hostname = new URL(raw).hostname.toLowerCase();\n    if (hostname.endsWith(\".agent-native.com\")) {\n      return normalizeTrackingSlug(\n        hostname.slice(0, -\".agent-native.com\".length),\n      );\n    }\n    return normalizeTrackingSlug(hostname.split(\".\")[0]);\n  } catch {\n    return undefined;\n  }\n}\n\n/** Shared app/template dimensions for central observability tracking events. */\nexport function trackingIdentityProperties(): Record<string, string> {\n  const packageApp = normalizeTrackingSlug(process.env.npm_package_name);\n  const urlApp =\n    appSlugFromUrl(process.env.APP_URL) ||\n    appSlugFromUrl(process.env.BETTER_AUTH_URL) ||\n    appSlugFromUrl(process.env.URL) ||\n    appSlugFromUrl(process.env.DEPLOY_URL) ||\n    appSlugFromUrl(process.env.VERCEL_PROJECT_PRODUCTION_URL) ||\n    appSlugFromUrl(process.env.VERCEL_URL);\n  const app =\n    normalizeTrackingSlug(process.env.AGENT_NATIVE_APP) ||\n    normalizeTrackingSlug(process.env.VITE_AGENT_NATIVE_APP) ||\n    urlApp ||\n    packageApp ||\n    normalizeTrackingSlug(process.env.APP_NAME);\n  const template =\n    normalizeTrackingSlug(process.env.AGENT_NATIVE_TEMPLATE) ||\n    normalizeTrackingSlug(process.env.VITE_AGENT_NATIVE_TEMPLATE) ||\n    normalizeTrackingSlug(process.env.APP_TEMPLATE) ||\n    normalizeTrackingSlug(process.env.VITE_APP_TEMPLATE) ||\n    app;\n\n  return {\n    ...(app ? { app, agent_native_app: app } : {}),\n    ...(template ? { template, agent_native_template: template } : {}),\n  };\n}\n"]}

package/dist/observability/types.d.ts

@@ -155,6 +155,16 @@ export interface ObservabilityConfig {
     captureToolArgs: boolean;
     captureToolResults: boolean;
     evalSampleRate: number;
+    /**
+     * Classify the raw user message as positive, negative, or neutral. Off by
+     * default for self-hosted apps; first-party agent-native.com deployments
+     * enable it automatically unless explicitly disabled.
+     */
+    inferredSentimentEnabled: boolean;
+    /** Deterministic fraction of eligible user messages to classify (0-1). */
+    inferredSentimentSampleRate: number;
+    /** Model used by the managed Builder classifier. */
+    inferredSentimentModel: string;
     exporters: ObservabilityExporterConfig[];
 }
 export interface ObservabilityExporterConfig {

package/dist/observability/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/observability/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAE7C,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;0EAEsE;IACtE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,aAAa,GAAG,UAAU,GAAG,MAAM,CAAC;AAE7E,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,YAAY,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB;iCAC6B;IAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;8BAC0B;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAID,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE5E,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,2BAA2B,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,eAAO,MAAM,4BAA4B,EAAE,mBAO1C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/observability/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;AAE7C,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;0EAEsE;IACtE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,aAAa,GAAG,UAAU,GAAG,MAAM,CAAC;AAE7E,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,YAAY,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB;iCAC6B;IAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;8BAC0B;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAID,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE5E,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC,0EAA0E;IAC1E,2BAA2B,EAAE,MAAM,CAAC;IACpC,oDAAoD;IACpD,sBAAsB,EAAE,MAAM,CAAC;IAC/B,SAAS,EAAE,2BAA2B,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,eAAO,MAAM,4BAA4B,EAAE,mBAU1C,CAAC"}

package/dist/observability/types.js

@@ -11,6 +11,9 @@ export const DEFAULT_OBSERVABILITY_CONFIG = {
     captureToolArgs: false,
     captureToolResults: false,
     evalSampleRate: 0,
+    inferredSentimentEnabled: false,
+    inferredSentimentSampleRate: 0,
+    inferredSentimentModel: "gpt-5-6-luna",
     exporters: [],
 };
 //# sourceMappingURL=types.js.map

package/dist/observability/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/observability/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAwLH,MAAM,CAAC,MAAM,4BAA4B,GAAwB;IAC/D,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,KAAK;IACrB,eAAe,EAAE,KAAK;IACtB,kBAAkB,EAAE,KAAK;IACzB,cAAc,EAAE,CAAC;IACjB,SAAS,EAAE,EAAE;CACd,CAAC","sourcesContent":["/**\n * Shared types for the agent observability system.\n *\n * Covers traces, feedback, evals, experiments, and satisfaction scoring.\n * Each domain module imports from here so the data model is consistent\n * across the entire observability stack.\n */\n\n// ─── Traces ───────────────────────────────────────────────────────────\n\nexport type SpanType = \"llm_call\" | \"tool_call\" | \"agent_run\";\nexport type SpanStatus = \"success\" | \"error\";\n\nexport interface TraceSpan {\n  id: string;\n  runId: string;\n  threadId: string | null;\n  /** Owner of the run that produced this span. Null for legacy rows\n   *  written before per-user isolation; null also means \"no auth context\"\n   *  (background tasks, etc.) and is filtered out of per-user reads. */\n  userId: string | null;\n  parentSpanId: string | null;\n  spanType: SpanType;\n  name: string;\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheWriteTokens: number;\n  costCentsX100: number;\n  durationMs: number;\n  status: SpanStatus;\n  errorMessage: string | null;\n  metadata: Record<string, unknown> | null;\n  createdAt: number;\n}\n\nexport interface TraceSummary {\n  runId: string;\n  threadId: string | null;\n  /** See `TraceSpan.userId`. */\n  userId: string | null;\n  totalSpans: number;\n  llmCalls: number;\n  toolCalls: number;\n  successfulTools: number;\n  failedTools: number;\n  totalDurationMs: number;\n  totalCostCentsX100: number;\n  totalInputTokens: number;\n  totalOutputTokens: number;\n  model: string;\n  createdAt: number;\n}\n\n// ─── Feedback ────────────���────────────────────────────────────────────\n\nexport type FeedbackType = \"thumbs_up\" | \"thumbs_down\" | \"category\" | \"text\";\n\nexport interface FeedbackEntry {\n  id: string;\n  runId: string | null;\n  threadId: string | null;\n  messageSeq: number | null;\n  feedbackType: FeedbackType;\n  value: string;\n  userId: string | null;\n  createdAt: number;\n}\n\nexport interface SatisfactionScore {\n  id: string;\n  threadId: string;\n  /** Owner of the thread the score was computed for. Same null semantics\n   *  as `TraceSpan.userId`. */\n  userId: string | null;\n  frustrationScore: number;\n  rephrasingScore: number;\n  abandonmentScore: number;\n  sentimentScore: number;\n  lengthTrendScore: number;\n  computedAt: number;\n}\n\n// ─── Evals ─────────��──────────────────────────────────────────────────\n\nexport type EvalType = \"automated\" | \"llm_judge\" | \"human\";\n\nexport interface EvalResult {\n  id: string;\n  runId: string;\n  threadId: string | null;\n  /** Owner of the run being evaluated. Same null semantics as\n   *  `TraceSpan.userId`. */\n  userId: string | null;\n  evalType: EvalType;\n  criteria: string;\n  score: number;\n  reasoning: string | null;\n  metadata: Record<string, unknown> | null;\n  createdAt: number;\n}\n\nexport interface EvalDataset {\n  id: string;\n  name: string;\n  description: string;\n  entries: EvalTestCase[];\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport interface EvalTestCase {\n  input: string;\n  expectedOutput?: string;\n  context?: Record<string, unknown>;\n  tags?: string[];\n}\n\nexport interface EvalCriteria {\n  name: string;\n  description: string;\n  rubric?: string;\n  scoreRange?: { min: number; max: number };\n}\n\n// ─── Experiments ───────��──────────────────────────────────────────────\n\nexport type ExperimentStatus = \"draft\" | \"running\" | \"paused\" | \"completed\";\n\nexport interface ExperimentVariant {\n  id: string;\n  weight: number;\n  config: Record<string, unknown>;\n}\n\nexport interface Experiment {\n  id: string;\n  name: string;\n  status: ExperimentStatus;\n  variants: ExperimentVariant[];\n  metrics: string[];\n  assignmentLevel: \"user\" | \"session\";\n  startedAt: number | null;\n  endedAt: number | null;\n  createdAt: number;\n  /**\n   * Email of the user who created this experiment. Used to scope mutations\n   * (PUT /experiments/:id, POST /experiments/:id/results) so one user can't\n   * silently change another user's experiment in a multi-tenant deployment.\n   * Null on legacy rows from before the owner_email migration shipped.\n   */\n  ownerEmail?: string | null;\n}\n\nexport interface ExperimentAssignment {\n  experimentId: string;\n  userId: string;\n  variantId: string;\n  assignedAt: number;\n}\n\nexport interface ExperimentMetricResult {\n  id: string;\n  experimentId: string;\n  variantId: string;\n  metric: string;\n  value: number;\n  sampleSize: number;\n  confidenceLow: number;\n  confidenceHigh: number;\n  computedAt: number;\n}\n\n// ─── Observability config ─────────────────────────────────────────────\n\nexport interface ObservabilityConfig {\n  enabled: boolean;\n  capturePrompts: boolean;\n  captureToolArgs: boolean;\n  captureToolResults: boolean;\n  evalSampleRate: number;\n  exporters: ObservabilityExporterConfig[];\n}\n\nexport interface ObservabilityExporterConfig {\n  type: \"otlp\" | \"console\" | \"custom\";\n  endpoint?: string;\n  headers?: Record<string, string>;\n}\n\nexport const DEFAULT_OBSERVABILITY_CONFIG: ObservabilityConfig = {\n  enabled: true,\n  capturePrompts: false,\n  captureToolArgs: false,\n  captureToolResults: false,\n  evalSampleRate: 0,\n  exporters: [],\n};\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/observability/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAkMH,MAAM,CAAC,MAAM,4BAA4B,GAAwB;IAC/D,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,KAAK;IACrB,eAAe,EAAE,KAAK;IACtB,kBAAkB,EAAE,KAAK;IACzB,cAAc,EAAE,CAAC;IACjB,wBAAwB,EAAE,KAAK;IAC/B,2BAA2B,EAAE,CAAC;IAC9B,sBAAsB,EAAE,cAAc;IACtC,SAAS,EAAE,EAAE;CACd,CAAC","sourcesContent":["/**\n * Shared types for the agent observability system.\n *\n * Covers traces, feedback, evals, experiments, and satisfaction scoring.\n * Each domain module imports from here so the data model is consistent\n * across the entire observability stack.\n */\n\n// ─── Traces ───────────────────────────────────────────────────────────\n\nexport type SpanType = \"llm_call\" | \"tool_call\" | \"agent_run\";\nexport type SpanStatus = \"success\" | \"error\";\n\nexport interface TraceSpan {\n  id: string;\n  runId: string;\n  threadId: string | null;\n  /** Owner of the run that produced this span. Null for legacy rows\n   *  written before per-user isolation; null also means \"no auth context\"\n   *  (background tasks, etc.) and is filtered out of per-user reads. */\n  userId: string | null;\n  parentSpanId: string | null;\n  spanType: SpanType;\n  name: string;\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheWriteTokens: number;\n  costCentsX100: number;\n  durationMs: number;\n  status: SpanStatus;\n  errorMessage: string | null;\n  metadata: Record<string, unknown> | null;\n  createdAt: number;\n}\n\nexport interface TraceSummary {\n  runId: string;\n  threadId: string | null;\n  /** See `TraceSpan.userId`. */\n  userId: string | null;\n  totalSpans: number;\n  llmCalls: number;\n  toolCalls: number;\n  successfulTools: number;\n  failedTools: number;\n  totalDurationMs: number;\n  totalCostCentsX100: number;\n  totalInputTokens: number;\n  totalOutputTokens: number;\n  model: string;\n  createdAt: number;\n}\n\n// ─── Feedback ────────────���────────────────────────────────────────────\n\nexport type FeedbackType = \"thumbs_up\" | \"thumbs_down\" | \"category\" | \"text\";\n\nexport interface FeedbackEntry {\n  id: string;\n  runId: string | null;\n  threadId: string | null;\n  messageSeq: number | null;\n  feedbackType: FeedbackType;\n  value: string;\n  userId: string | null;\n  createdAt: number;\n}\n\nexport interface SatisfactionScore {\n  id: string;\n  threadId: string;\n  /** Owner of the thread the score was computed for. Same null semantics\n   *  as `TraceSpan.userId`. */\n  userId: string | null;\n  frustrationScore: number;\n  rephrasingScore: number;\n  abandonmentScore: number;\n  sentimentScore: number;\n  lengthTrendScore: number;\n  computedAt: number;\n}\n\n// ─── Evals ─────────��──────────────────────────────────────────────────\n\nexport type EvalType = \"automated\" | \"llm_judge\" | \"human\";\n\nexport interface EvalResult {\n  id: string;\n  runId: string;\n  threadId: string | null;\n  /** Owner of the run being evaluated. Same null semantics as\n   *  `TraceSpan.userId`. */\n  userId: string | null;\n  evalType: EvalType;\n  criteria: string;\n  score: number;\n  reasoning: string | null;\n  metadata: Record<string, unknown> | null;\n  createdAt: number;\n}\n\nexport interface EvalDataset {\n  id: string;\n  name: string;\n  description: string;\n  entries: EvalTestCase[];\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport interface EvalTestCase {\n  input: string;\n  expectedOutput?: string;\n  context?: Record<string, unknown>;\n  tags?: string[];\n}\n\nexport interface EvalCriteria {\n  name: string;\n  description: string;\n  rubric?: string;\n  scoreRange?: { min: number; max: number };\n}\n\n// ─── Experiments ───────��──────────────────────────────────────────────\n\nexport type ExperimentStatus = \"draft\" | \"running\" | \"paused\" | \"completed\";\n\nexport interface ExperimentVariant {\n  id: string;\n  weight: number;\n  config: Record<string, unknown>;\n}\n\nexport interface Experiment {\n  id: string;\n  name: string;\n  status: ExperimentStatus;\n  variants: ExperimentVariant[];\n  metrics: string[];\n  assignmentLevel: \"user\" | \"session\";\n  startedAt: number | null;\n  endedAt: number | null;\n  createdAt: number;\n  /**\n   * Email of the user who created this experiment. Used to scope mutations\n   * (PUT /experiments/:id, POST /experiments/:id/results) so one user can't\n   * silently change another user's experiment in a multi-tenant deployment.\n   * Null on legacy rows from before the owner_email migration shipped.\n   */\n  ownerEmail?: string | null;\n}\n\nexport interface ExperimentAssignment {\n  experimentId: string;\n  userId: string;\n  variantId: string;\n  assignedAt: number;\n}\n\nexport interface ExperimentMetricResult {\n  id: string;\n  experimentId: string;\n  variantId: string;\n  metric: string;\n  value: number;\n  sampleSize: number;\n  confidenceLow: number;\n  confidenceHigh: number;\n  computedAt: number;\n}\n\n// ─── Observability config ─────────────────────────────────────────────\n\nexport interface ObservabilityConfig {\n  enabled: boolean;\n  capturePrompts: boolean;\n  captureToolArgs: boolean;\n  captureToolResults: boolean;\n  evalSampleRate: number;\n  /**\n   * Classify the raw user message as positive, negative, or neutral. Off by\n   * default for self-hosted apps; first-party agent-native.com deployments\n   * enable it automatically unless explicitly disabled.\n   */\n  inferredSentimentEnabled: boolean;\n  /** Deterministic fraction of eligible user messages to classify (0-1). */\n  inferredSentimentSampleRate: number;\n  /** Model used by the managed Builder classifier. */\n  inferredSentimentModel: string;\n  exporters: ObservabilityExporterConfig[];\n}\n\nexport interface ObservabilityExporterConfig {\n  type: \"otlp\" | \"console\" | \"custom\";\n  endpoint?: string;\n  headers?: Record<string, string>;\n}\n\nexport const DEFAULT_OBSERVABILITY_CONFIG: ObservabilityConfig = {\n  enabled: true,\n  capturePrompts: false,\n  captureToolArgs: false,\n  captureToolResults: false,\n  evalSampleRate: 0,\n  inferredSentimentEnabled: false,\n  inferredSentimentSampleRate: 0,\n  inferredSentimentModel: \"gpt-5-6-luna\",\n  exporters: [],\n};\n"]}

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/provider-api/corpus-jobs.d.ts

@@ -73,6 +73,7 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     offset?: unknown;
     limit?: unknown;
 }, {
+    deleted?: undefined;
     jobs: {
         id: string;
         name: string;
@@ -83,7 +84,6 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
         updatedAt: string;
     }[];
     total: number;
-    deleted?: undefined;
     jobId?: undefined;
 } | {
     jobs?: undefined;
@@ -91,9 +91,9 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     deleted: boolean;
     jobId: string;
 } | {
+    deleted?: undefined;
     jobs?: undefined;
     total?: undefined;
-    deleted?: undefined;
     jobId?: undefined;
     hits: Record<string, unknown>[];
     offset: number;

package/dist/resources/handlers.d.ts

@@ -49,8 +49,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/storage.d.ts

@@ -45,6 +45,12 @@ export interface ReadSecretResult {
  * is responsible for never logging the returned value.
  */
 export declare function readAppSecret(ref: SecretRef): Promise<ReadSecretResult | null>;
+/** Read several keys from one scope in a single database round trip. */
+export declare function readAppSecrets(args: {
+    keys: readonly string[];
+    scope: SecretScope;
+    scopeId: string;
+}): Promise<Map<string, ReadSecretResult>>;
 /**
  * Return just the metadata for a secret (no value). Used by the list route so
  * the UI can show the "Set" pill and last-4 without the decrypted value going

package/dist/secrets/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA8EjD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3C;AAMD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA8D3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAItD;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA2B5B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,EAAE,CAAC,CA0BvB;AAeD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAStE"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA8EjD;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI3C;AAMD,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,SAAS;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA8D3E;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAoCD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmBlC;AAED,wEAAwE;AACxE,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAyBzC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAItD;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,SAAS,GACb,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CA2B5B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,EAAE,CAAC,CA0BvB;AAeD,wBAAsB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAStE"}

package/dist/secrets/storage.js

@@ -147,15 +147,44 @@ export async function writeAppSecret(args) {
     });
     return String(rows[0]?.id ?? id);
 }
+/**
+ * True only when the database says the app_secrets table itself is missing.
+ * Other query failures must propagate unchanged: attempting schema bootstrap
+ * for connectivity, permission, or syntax errors both hides the real failure
+ * and can introduce DDL onto a latency-sensitive read path.
+ */
+function isMissingAppSecretsTableError(error) {
+    if (!(error instanceof Error))
+        return false;
+    const code = String(error.code ?? "");
+    const message = error.message.toLowerCase();
+    const namesAppSecrets = /(?:app_secrets|"app_secrets")/.test(message);
+    if (code === "42P01")
+        return namesAppSecrets;
+    return (namesAppSecrets &&
+        (message.includes("no such table") ||
+            (message.includes("relation") && message.includes("does not exist"))));
+}
+/** Execute a read without schema probes on the normal path. */
+async function executeAppSecretsRead(query) {
+    const client = getDbExec();
+    try {
+        return await client.execute(query);
+    }
+    catch (error) {
+        if (!isMissingAppSecretsTableError(error))
+            throw error;
+        await ensureTable();
+        return client.execute(query);
+    }
+}
 /**
  * Read a secret's plaintext value. Returns null when not found. The caller
  * is responsible for never logging the returned value.
  */
 export async function readAppSecret(ref) {
-    await ensureTable();
     const { key, scope, scopeId } = ref;
-    const client = getDbExec();
-    const { rows } = await client.execute({
+    const { rows } = await executeAppSecretsRead({
         sql: `SELECT encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,
         args: [scope, scopeId, key],
     });
@@ -175,6 +204,35 @@ export async function readAppSecret(ref) {
         return null;
     }
 }
+/** Read several keys from one scope in a single database round trip. */
+export async function readAppSecrets(args) {
+    const keys = [...new Set(args.keys.filter(Boolean))];
+    if (keys.length === 0)
+        return new Map();
+    const placeholders = keys.map(() => "?").join(", ");
+    const { rows } = await executeAppSecretsRead({
+        sql: `SELECT key, encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key IN (${placeholders})`,
+        args: [args.scope, args.scopeId, ...keys],
+    });
+    const results = new Map();
+    for (const row of rows) {
+        const key = String(row.key ?? "");
+        if (!key)
+            continue;
+        try {
+            const value = decryptValue(row.encrypted_value);
+            results.set(key, {
+                value,
+                last4: last4(value),
+                updatedAt: Number(row.updated_at ?? 0),
+            });
+        }
+        catch {
+            // Match readAppSecret: corrupted or stale ciphertext behaves as missing.
+        }
+    }
+    return results;
+}
 /**
  * Return just the metadata for a secret (no value). Used by the list route so
  * the UI can show the "Set" pill and last-4 without the decrypted value going

package/dist/secrets/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,kBAAkB,IAAI,YAAY,GACnC,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,SAAS,GAAG,UAAU,EAAE;gBAC5B,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC;gBAC1D,CAAC,CAAC,sBAAsB,CAAC;YAE3B,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,kEAAkE;gBAClE,mEAAmE;gBACnE,qEAAqE;gBACrE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,yEAAyE;gBACzE,yEAAyE;gBACzE,uEAAuE;gBACvE,qEAAqE;gBACrE,MAAM,iBAAiB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBAClD,MAAM,kBAAkB,CACtB,aAAa,EACb,aAAa,EACb,mEAAmE,CACpE,CAAC;gBACF,MAAM,kBAAkB,CACtB,aAAa,EACb,eAAe,EACf,qEAAqE,CACtE,CAAC;gBACF,OAAO;YACT,CAAC;YAED,0EAA0E;YAC1E,sDAAsD;YACtD,uEAAuE;YACvE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAEhC,2DAA2D;YAC3D,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,qDAAqD,CACtD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;YAED,2CAA2C;YAC3C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAoBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACvE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IAExB,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,yEAAyE;IACzE,mEAAmE;IACnE,kEAAkE;IAClE,uEAAuE;IACvE,oEAAoE;IACpE,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,SAAS,GAAG;;;;;;uCAMmB,CAAC;IACtC,MAAM,UAAU,GAAG;QACjB,EAAE;QACF,KAAK;QACL,OAAO;QACP,GAAG;QACH,SAAS;QACT,WAAW,IAAI,IAAI;QACnB,YAAY,IAAI,IAAI;QACpB,GAAG;QACH,GAAG;KACJ,CAAC;IAEF,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,GAAG,SAAS,eAAe;YAChC,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,2EAA2E;IAC3E,4DAA4D;IAC5D,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,iFAAiF;QACtF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,0GAA0G;QAC/G,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAyB,CAAC,CAAC;QAC9D,OAAO;YACL,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAc;IAEd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,kJAAkJ;QACvJ,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;QAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG;QACH,KAAK;QACL,OAAO;QACP,KAAK,EAAE,UAAU;QACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkB,EAClB,OAAe;IAEf,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,4JAA4J;QACjK,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;YAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,GAAa;YACtB,KAAK;YACL,OAAO;YACP,KAAK,EAAE,UAAU;YACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;YACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;YAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;SACvC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAkB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc;IAClD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC5C,GAAG,EAAE,sEAAsE;QAC3E,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,YAAY,GAAG,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["/**\n * Storage layer for the framework secrets registry.\n *\n * Values are encrypted at rest with AES-256-GCM. The encryption key is\n * derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the existing\n * `BETTER_AUTH_SECRET` env var (fallback so templates don't need a second\n * secret during development). If neither is set in production we fall back\n * to a machine-local key derived from the cwd — the secret is still only\n * readable on this machine, but consider setting `SECRETS_ENCRYPTION_KEY`\n * for a stable, rotatable key.\n *\n * Secret values are NEVER logged and NEVER returned from any route handler.\n */\n\nimport { randomUUID } from \"node:crypto\";\n\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { ensureColumnExists, ensureTableExists } from \"../db/ddl-guard.js\";\nimport {\n  encryptSecretValue as encryptValue,\n  decryptSecretValue as decryptValue,\n} from \"./crypto.js\";\nimport type { SecretScope } from \"./register.js\";\nimport { APP_SECRETS_CREATE_SQL } from \"./schema.js\";\n\n// ---------------------------------------------------------------------------\n// Table bootstrap\n// ---------------------------------------------------------------------------\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      // Postgres version of the CREATE TABLE — the generic `INTEGER` maps to\n      // BIGINT on Postgres, which we need for millisecond timestamps.\n      const createSql = isPostgres()\n        ? APP_SECRETS_CREATE_SQL.replace(/\\bINTEGER\\b/g, \"BIGINT\")\n        : APP_SECRETS_CREATE_SQL;\n\n      if (isPostgres()) {\n        // Hot path: in production the table and both additive columns are\n        // virtually always already present. Issuing `CREATE`/`ALTER` would\n        // still take an ACCESS EXCLUSIVE lock — which, in a fresh background\n        // worker process behind a concurrent connection on the shared Neon DB,\n        // can block ~indefinitely. `ensureTableExists` / `ensureColumnExists`\n        // check `information_schema` first (a plain read, no lock) and run DDL\n        // ONLY for what is actually missing, wrapping any DDL that must run in a\n        // transaction-scoped `lock_timeout` so a contended lock fails fast. They\n        // also re-probe after a swallowed lock-timeout and THROW if the schema\n        // is still missing, so a timed-out DDL never poisons this init memo.\n        await ensureTableExists(\"app_secrets\", createSql);\n        await ensureColumnExists(\n          \"app_secrets\",\n          \"description\",\n          `ALTER TABLE app_secrets ADD COLUMN IF NOT EXISTS description TEXT`,\n        );\n        await ensureColumnExists(\n          \"app_secrets\",\n          \"url_allowlist\",\n          `ALTER TABLE app_secrets ADD COLUMN IF NOT EXISTS url_allowlist TEXT`,\n        );\n        return;\n      }\n\n      // SQLite (local dev): no ACCESS EXCLUSIVE lock problem, keep the original\n      // create-then-additive-alter behaviour. SQLite has no\n      // `ADD COLUMN IF NOT EXISTS`, so the ALTERs stay wrapped in try/catch.\n      await client.execute(createSql);\n\n      // Additive migration: description column (for ad-hoc keys)\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN description TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n\n      // Additive migration: url_allowlist column\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN url_allowlist TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n    })().catch((err) => {\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\n// ---------------------------------------------------------------------------\n// Encryption — see ./crypto.ts (shared with per-user credentials)\n// ---------------------------------------------------------------------------\n\n/**\n * Return the last 4 characters of a secret, with any leading characters\n * masked. Used to show a preview without leaking the value.\n */\nexport function last4(value: string): string {\n  if (!value) return \"\";\n  if (value.length <= 4) return \"••••\";\n  return \"••••\" + value.slice(-4);\n}\n\n// ---------------------------------------------------------------------------\n// CRUD\n// ---------------------------------------------------------------------------\n\nexport interface SecretRef {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n}\n\nexport interface WriteSecretArgs extends SecretRef {\n  value: string;\n  /** Optional human-readable description (used for ad-hoc keys). */\n  description?: string;\n  /** Optional JSON-stringified array of allowed URL origins. */\n  urlAllowlist?: string;\n}\n\n/**\n * Write (insert or update) a secret. The value is encrypted before being\n * stored — the caller's plaintext is never persisted. Returns the new\n * record's id.\n */\nexport async function writeAppSecret(args: WriteSecretArgs): Promise<string> {\n  await ensureTable();\n  const { key, value, scope, scopeId, description, urlAllowlist } = args;\n  if (!key || !value || !scope || !scopeId) {\n    throw new Error(\n      \"writeAppSecret: key, value, scope, and scopeId are all required\",\n    );\n  }\n  const client = getDbExec();\n  const now = Date.now();\n  const encrypted = encryptValue(value);\n  const id = randomUUID();\n\n  // Atomic upsert by (scope, scope_id, key). Previously this was a\n  // SELECT-then-branch (UPDATE if found, else INSERT): under concurrent\n  // writers for the same key both could see \"no row\" and both attempt\n  // INSERT, and the loser threw a raw UNIQUE(scope, scope_id, key)\n  // constraint violation (a user-facing 500) instead of updating. A single\n  // `INSERT ... ON CONFLICT DO UPDATE` closes that window — it's one\n  // statement, so there's no gap between \"check\" and \"act\". `id` is\n  // deliberately left out of the `DO UPDATE SET` list so an existing row\n  // keeps its original id (any stored references stay stable); only a\n  // genuinely new row gets the freshly generated `id`. This syntax is\n  // portable across SQLite (UPSERT since 3.24) and Postgres.\n  const upsertSql = `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at)\n    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)\n    ON CONFLICT (scope, scope_id, key) DO UPDATE SET\n      encrypted_value = excluded.encrypted_value,\n      description = excluded.description,\n      url_allowlist = excluded.url_allowlist,\n      updated_at = excluded.updated_at`;\n  const upsertArgs = [\n    id,\n    scope,\n    scopeId,\n    key,\n    encrypted,\n    description ?? null,\n    urlAllowlist ?? null,\n    now,\n    now,\n  ];\n\n  if (isPostgres()) {\n    const { rows } = await client.execute({\n      sql: `${upsertSql} RETURNING id`,\n      args: upsertArgs,\n    });\n    return String(rows[0]?.id ?? id);\n  }\n\n  // SQLite: RETURNING support varies across better-sqlite3/libsql builds, so\n  // (matching the convention elsewhere in this codebase, e.g.\n  // integrations/pending-tasks-store.ts) re-read the id afterward instead of\n  // relying on it. The row is guaranteed to exist at this point, so this is\n  // a plain lookup rather than a TOCTOU-prone gate on the write itself.\n  await client.execute({ sql: upsertSql, args: upsertArgs });\n  const { rows } = await client.execute({\n    sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  return String(rows[0]?.id ?? id);\n}\n\nexport interface ReadSecretResult {\n  value: string;\n  last4: string;\n  updatedAt: number;\n}\n\n/**\n * Read a secret's plaintext value. Returns null when not found. The caller\n * is responsible for never logging the returned value.\n */\nexport async function readAppSecret(\n  ref: SecretRef,\n): Promise<ReadSecretResult | null> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  try {\n    const value = decryptValue(rows[0].encrypted_value as string);\n    return {\n      value,\n      last4: last4(value),\n      updatedAt: Number(rows[0].updated_at ?? 0),\n    };\n  } catch {\n    // Decryption failure — key rotated, tampered row, etc. Don't throw up the\n    // stack in a way that could leak the ciphertext; just report missing.\n    return null;\n  }\n}\n\n/**\n * Return just the metadata for a secret (no value). Used by the list route so\n * the UI can show the \"Set\" pill and last-4 without the decrypted value going\n * over the wire.\n */\nexport async function getAppSecretMeta(\n  ref: SecretRef,\n): Promise<{ last4: string; updatedAt: number } | null> {\n  const result = await readAppSecret(ref);\n  if (!result) return null;\n  return { last4: result.last4, updatedAt: result.updatedAt };\n}\n\nexport interface SecretMeta {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n  last4: string;\n  description: string | null;\n  urlAllowlist: string[] | null;\n  createdAt: number;\n  updatedAt: number;\n}\n\n/**\n * Read a secret's metadata, including ad-hoc fields (description, allowlist),\n * without ever decrypting or returning the plaintext value. Used by the\n * ad-hoc list route and any UI that wants to render a key tile.\n */\nexport async function readAppSecretMeta(\n  ref: SecretRef,\n): Promise<SecretMeta | null> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  const row = rows[0];\n  let last4Value = \"\";\n  try {\n    const value = decryptValue(row.encrypted_value as string);\n    last4Value = last4(value);\n  } catch {\n    last4Value = \"\";\n  }\n  return {\n    key,\n    scope,\n    scopeId,\n    last4: last4Value,\n    description: (row.description as string | null) ?? null,\n    urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n  };\n}\n\n/**\n * List all secrets for a given scope. Returns metadata only — values are\n * never decrypted or returned. Used by the ad-hoc list route to surface\n * user-created keys.\n */\nexport async function listAppSecretsForScope(\n  scope: SecretScope,\n  scopeId: string,\n): Promise<SecretMeta[]> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT key, encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? ORDER BY updated_at DESC`,\n    args: [scope, scopeId],\n  });\n  return rows.map((row) => {\n    let last4Value = \"\";\n    try {\n      const value = decryptValue(row.encrypted_value as string);\n      last4Value = last4(value);\n    } catch {\n      last4Value = \"\";\n    }\n    return {\n      key: row.key as string,\n      scope,\n      scopeId,\n      last4: last4Value,\n      description: (row.description as string | null) ?? null,\n      urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n      createdAt: Number(row.created_at ?? 0),\n      updatedAt: Number(row.updated_at ?? 0),\n    };\n  });\n}\n\nfunction parseAllowlist(raw: string | null): string[] | null {\n  if (!raw) return null;\n  try {\n    const parsed = JSON.parse(raw);\n    if (Array.isArray(parsed) && parsed.every((v) => typeof v === \"string\")) {\n      return parsed;\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function deleteAppSecret(ref: SecretRef): Promise<boolean> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rowsAffected } = await client.execute({\n    sql: `DELETE FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,\n    args: [scope, scopeId, key],\n  });\n  return rowsAffected > 0;\n}\n"]}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/secrets/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,kBAAkB,IAAI,YAAY,EAClC,kBAAkB,IAAI,YAAY,GACnC,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAErD,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,uEAAuE;YACvE,gEAAgE;YAChE,MAAM,SAAS,GAAG,UAAU,EAAE;gBAC5B,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC;gBAC1D,CAAC,CAAC,sBAAsB,CAAC;YAE3B,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,kEAAkE;gBAClE,mEAAmE;gBACnE,qEAAqE;gBACrE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,yEAAyE;gBACzE,yEAAyE;gBACzE,uEAAuE;gBACvE,qEAAqE;gBACrE,MAAM,iBAAiB,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBAClD,MAAM,kBAAkB,CACtB,aAAa,EACb,aAAa,EACb,mEAAmE,CACpE,CAAC;gBACF,MAAM,kBAAkB,CACtB,aAAa,EACb,eAAe,EACf,qEAAqE,CACtE,CAAC;gBACF,OAAO;YACT,CAAC;YAED,0EAA0E;YAC1E,sDAAsD;YACtD,uEAAuE;YACvE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAEhC,2DAA2D;YAC3D,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,qDAAqD,CACtD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;YAED,2CAA2C;YAC3C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,uDAAuD,CACxD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,KAAa;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAoBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC;IACvE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IAExB,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,yEAAyE;IACzE,mEAAmE;IACnE,kEAAkE;IAClE,uEAAuE;IACvE,oEAAoE;IACpE,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,SAAS,GAAG;;;;;;uCAMmB,CAAC;IACtC,MAAM,UAAU,GAAG;QACjB,EAAE;QACF,KAAK;QACL,OAAO;QACP,GAAG;QACH,SAAS;QACT,WAAW,IAAI,IAAI;QACnB,YAAY,IAAI,IAAI;QACpB,GAAG;QACH,GAAG;KACJ,CAAC;IAEF,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,GAAG,SAAS,eAAe;YAChC,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,2EAA2E;IAC3E,4DAA4D;IAC5D,2EAA2E;IAC3E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,iFAAiF;QACtF,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;AACnC,CAAC;AAUD;;;;;GAKG;AACH,SAAS,6BAA6B,CAAC,KAAc;IACnD,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAE,KAAoC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,eAAe,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtE,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,eAAe,CAAC;IAC7C,OAAO,CACL,eAAe;QACf,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;YAChC,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,KAAK,UAAU,qBAAqB,CAAC,KAA0B;IAC7D,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,6BAA6B,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QACvD,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAc;IAEd,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,qBAAqB,CAAC;QAC3C,GAAG,EAAE,0GAA0G;QAC/G,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAyB,CAAC,CAAC;QAC9D,OAAO;YACL,KAAK;YACL,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,sEAAsE;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAIpC;IACC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAExC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,qBAAqB,CAAC;QAC3C,GAAG,EAAE,yGAAyG,YAAY,GAAG;QAC7H,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;YAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;gBACf,KAAK;gBACL,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;gBACnB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;aACvC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAc;IAEd,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAaD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAc;IAEd,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,kJAAkJ;QACvJ,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;QAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,EAAE,CAAC;IAClB,CAAC;IACD,OAAO;QACL,GAAG;QACH,KAAK;QACL,OAAO;QACP,KAAK,EAAE,UAAU;QACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;QACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAAkB,EAClB,OAAe;IAEf,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,4JAA4J;QACjK,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACtB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,eAAyB,CAAC,CAAC;YAC1D,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,GAAa;YACtB,KAAK;YACL,OAAO;YACP,KAAK,EAAE,UAAU;YACjB,WAAW,EAAG,GAAG,CAAC,WAA6B,IAAI,IAAI;YACvD,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,aAA8B,CAAC;YAChE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;YACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;SACvC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAkB;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc;IAClD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC5C,GAAG,EAAE,sEAAsE;QAC3E,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,OAAO,YAAY,GAAG,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["/**\n * Storage layer for the framework secrets registry.\n *\n * Values are encrypted at rest with AES-256-GCM. The encryption key is\n * derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the existing\n * `BETTER_AUTH_SECRET` env var (fallback so templates don't need a second\n * secret during development). If neither is set in production we fall back\n * to a machine-local key derived from the cwd — the secret is still only\n * readable on this machine, but consider setting `SECRETS_ENCRYPTION_KEY`\n * for a stable, rotatable key.\n *\n * Secret values are NEVER logged and NEVER returned from any route handler.\n */\n\nimport { randomUUID } from \"node:crypto\";\n\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { ensureColumnExists, ensureTableExists } from \"../db/ddl-guard.js\";\nimport {\n  encryptSecretValue as encryptValue,\n  decryptSecretValue as decryptValue,\n} from \"./crypto.js\";\nimport type { SecretScope } from \"./register.js\";\nimport { APP_SECRETS_CREATE_SQL } from \"./schema.js\";\n\n// ---------------------------------------------------------------------------\n// Table bootstrap\n// ---------------------------------------------------------------------------\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      // Postgres version of the CREATE TABLE — the generic `INTEGER` maps to\n      // BIGINT on Postgres, which we need for millisecond timestamps.\n      const createSql = isPostgres()\n        ? APP_SECRETS_CREATE_SQL.replace(/\\bINTEGER\\b/g, \"BIGINT\")\n        : APP_SECRETS_CREATE_SQL;\n\n      if (isPostgres()) {\n        // Hot path: in production the table and both additive columns are\n        // virtually always already present. Issuing `CREATE`/`ALTER` would\n        // still take an ACCESS EXCLUSIVE lock — which, in a fresh background\n        // worker process behind a concurrent connection on the shared Neon DB,\n        // can block ~indefinitely. `ensureTableExists` / `ensureColumnExists`\n        // check `information_schema` first (a plain read, no lock) and run DDL\n        // ONLY for what is actually missing, wrapping any DDL that must run in a\n        // transaction-scoped `lock_timeout` so a contended lock fails fast. They\n        // also re-probe after a swallowed lock-timeout and THROW if the schema\n        // is still missing, so a timed-out DDL never poisons this init memo.\n        await ensureTableExists(\"app_secrets\", createSql);\n        await ensureColumnExists(\n          \"app_secrets\",\n          \"description\",\n          `ALTER TABLE app_secrets ADD COLUMN IF NOT EXISTS description TEXT`,\n        );\n        await ensureColumnExists(\n          \"app_secrets\",\n          \"url_allowlist\",\n          `ALTER TABLE app_secrets ADD COLUMN IF NOT EXISTS url_allowlist TEXT`,\n        );\n        return;\n      }\n\n      // SQLite (local dev): no ACCESS EXCLUSIVE lock problem, keep the original\n      // create-then-additive-alter behaviour. SQLite has no\n      // `ADD COLUMN IF NOT EXISTS`, so the ALTERs stay wrapped in try/catch.\n      await client.execute(createSql);\n\n      // Additive migration: description column (for ad-hoc keys)\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN description TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n\n      // Additive migration: url_allowlist column\n      try {\n        await client.execute(\n          `ALTER TABLE app_secrets ADD COLUMN url_allowlist TEXT`,\n        );\n      } catch {\n        // Column already exists — expected\n      }\n    })().catch((err) => {\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\n// ---------------------------------------------------------------------------\n// Encryption — see ./crypto.ts (shared with per-user credentials)\n// ---------------------------------------------------------------------------\n\n/**\n * Return the last 4 characters of a secret, with any leading characters\n * masked. Used to show a preview without leaking the value.\n */\nexport function last4(value: string): string {\n  if (!value) return \"\";\n  if (value.length <= 4) return \"••••\";\n  return \"••••\" + value.slice(-4);\n}\n\n// ---------------------------------------------------------------------------\n// CRUD\n// ---------------------------------------------------------------------------\n\nexport interface SecretRef {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n}\n\nexport interface WriteSecretArgs extends SecretRef {\n  value: string;\n  /** Optional human-readable description (used for ad-hoc keys). */\n  description?: string;\n  /** Optional JSON-stringified array of allowed URL origins. */\n  urlAllowlist?: string;\n}\n\n/**\n * Write (insert or update) a secret. The value is encrypted before being\n * stored — the caller's plaintext is never persisted. Returns the new\n * record's id.\n */\nexport async function writeAppSecret(args: WriteSecretArgs): Promise<string> {\n  await ensureTable();\n  const { key, value, scope, scopeId, description, urlAllowlist } = args;\n  if (!key || !value || !scope || !scopeId) {\n    throw new Error(\n      \"writeAppSecret: key, value, scope, and scopeId are all required\",\n    );\n  }\n  const client = getDbExec();\n  const now = Date.now();\n  const encrypted = encryptValue(value);\n  const id = randomUUID();\n\n  // Atomic upsert by (scope, scope_id, key). Previously this was a\n  // SELECT-then-branch (UPDATE if found, else INSERT): under concurrent\n  // writers for the same key both could see \"no row\" and both attempt\n  // INSERT, and the loser threw a raw UNIQUE(scope, scope_id, key)\n  // constraint violation (a user-facing 500) instead of updating. A single\n  // `INSERT ... ON CONFLICT DO UPDATE` closes that window — it's one\n  // statement, so there's no gap between \"check\" and \"act\". `id` is\n  // deliberately left out of the `DO UPDATE SET` list so an existing row\n  // keeps its original id (any stored references stay stable); only a\n  // genuinely new row gets the freshly generated `id`. This syntax is\n  // portable across SQLite (UPSERT since 3.24) and Postgres.\n  const upsertSql = `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, description, url_allowlist, created_at, updated_at)\n    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)\n    ON CONFLICT (scope, scope_id, key) DO UPDATE SET\n      encrypted_value = excluded.encrypted_value,\n      description = excluded.description,\n      url_allowlist = excluded.url_allowlist,\n      updated_at = excluded.updated_at`;\n  const upsertArgs = [\n    id,\n    scope,\n    scopeId,\n    key,\n    encrypted,\n    description ?? null,\n    urlAllowlist ?? null,\n    now,\n    now,\n  ];\n\n  if (isPostgres()) {\n    const { rows } = await client.execute({\n      sql: `${upsertSql} RETURNING id`,\n      args: upsertArgs,\n    });\n    return String(rows[0]?.id ?? id);\n  }\n\n  // SQLite: RETURNING support varies across better-sqlite3/libsql builds, so\n  // (matching the convention elsewhere in this codebase, e.g.\n  // integrations/pending-tasks-store.ts) re-read the id afterward instead of\n  // relying on it. The row is guaranteed to exist at this point, so this is\n  // a plain lookup rather than a TOCTOU-prone gate on the write itself.\n  await client.execute({ sql: upsertSql, args: upsertArgs });\n  const { rows } = await client.execute({\n    sql: `SELECT id FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  return String(rows[0]?.id ?? id);\n}\n\nexport interface ReadSecretResult {\n  value: string;\n  last4: string;\n  updatedAt: number;\n}\n\ntype AppSecretsReadQuery = { sql: string; args: unknown[] };\n\n/**\n * True only when the database says the app_secrets table itself is missing.\n * Other query failures must propagate unchanged: attempting schema bootstrap\n * for connectivity, permission, or syntax errors both hides the real failure\n * and can introduce DDL onto a latency-sensitive read path.\n */\nfunction isMissingAppSecretsTableError(error: unknown): boolean {\n  if (!(error instanceof Error)) return false;\n  const code = String((error as Error & { code?: unknown }).code ?? \"\");\n  const message = error.message.toLowerCase();\n  const namesAppSecrets = /(?:app_secrets|\"app_secrets\")/.test(message);\n\n  if (code === \"42P01\") return namesAppSecrets;\n  return (\n    namesAppSecrets &&\n    (message.includes(\"no such table\") ||\n      (message.includes(\"relation\") && message.includes(\"does not exist\")))\n  );\n}\n\n/** Execute a read without schema probes on the normal path. */\nasync function executeAppSecretsRead(query: AppSecretsReadQuery) {\n  const client = getDbExec();\n  try {\n    return await client.execute(query);\n  } catch (error) {\n    if (!isMissingAppSecretsTableError(error)) throw error;\n    await ensureTable();\n    return client.execute(query);\n  }\n}\n\n/**\n * Read a secret's plaintext value. Returns null when not found. The caller\n * is responsible for never logging the returned value.\n */\nexport async function readAppSecret(\n  ref: SecretRef,\n): Promise<ReadSecretResult | null> {\n  const { key, scope, scopeId } = ref;\n  const { rows } = await executeAppSecretsRead({\n    sql: `SELECT encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  try {\n    const value = decryptValue(rows[0].encrypted_value as string);\n    return {\n      value,\n      last4: last4(value),\n      updatedAt: Number(rows[0].updated_at ?? 0),\n    };\n  } catch {\n    // Decryption failure — key rotated, tampered row, etc. Don't throw up the\n    // stack in a way that could leak the ciphertext; just report missing.\n    return null;\n  }\n}\n\n/** Read several keys from one scope in a single database round trip. */\nexport async function readAppSecrets(args: {\n  keys: readonly string[];\n  scope: SecretScope;\n  scopeId: string;\n}): Promise<Map<string, ReadSecretResult>> {\n  const keys = [...new Set(args.keys.filter(Boolean))];\n  if (keys.length === 0) return new Map();\n\n  const placeholders = keys.map(() => \"?\").join(\", \");\n  const { rows } = await executeAppSecretsRead({\n    sql: `SELECT key, encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key IN (${placeholders})`,\n    args: [args.scope, args.scopeId, ...keys],\n  });\n  const results = new Map<string, ReadSecretResult>();\n  for (const row of rows) {\n    const key = String(row.key ?? \"\");\n    if (!key) continue;\n    try {\n      const value = decryptValue(row.encrypted_value as string);\n      results.set(key, {\n        value,\n        last4: last4(value),\n        updatedAt: Number(row.updated_at ?? 0),\n      });\n    } catch {\n      // Match readAppSecret: corrupted or stale ciphertext behaves as missing.\n    }\n  }\n  return results;\n}\n\n/**\n * Return just the metadata for a secret (no value). Used by the list route so\n * the UI can show the \"Set\" pill and last-4 without the decrypted value going\n * over the wire.\n */\nexport async function getAppSecretMeta(\n  ref: SecretRef,\n): Promise<{ last4: string; updatedAt: number } | null> {\n  const result = await readAppSecret(ref);\n  if (!result) return null;\n  return { last4: result.last4, updatedAt: result.updatedAt };\n}\n\nexport interface SecretMeta {\n  key: string;\n  scope: SecretScope;\n  scopeId: string;\n  last4: string;\n  description: string | null;\n  urlAllowlist: string[] | null;\n  createdAt: number;\n  updatedAt: number;\n}\n\n/**\n * Read a secret's metadata, including ad-hoc fields (description, allowlist),\n * without ever decrypting or returning the plaintext value. Used by the\n * ad-hoc list route and any UI that wants to render a key tile.\n */\nexport async function readAppSecretMeta(\n  ref: SecretRef,\n): Promise<SecretMeta | null> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,\n    args: [scope, scopeId, key],\n  });\n  if (rows.length === 0) return null;\n  const row = rows[0];\n  let last4Value = \"\";\n  try {\n    const value = decryptValue(row.encrypted_value as string);\n    last4Value = last4(value);\n  } catch {\n    last4Value = \"\";\n  }\n  return {\n    key,\n    scope,\n    scopeId,\n    last4: last4Value,\n    description: (row.description as string | null) ?? null,\n    urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n  };\n}\n\n/**\n * List all secrets for a given scope. Returns metadata only — values are\n * never decrypted or returned. Used by the ad-hoc list route to surface\n * user-created keys.\n */\nexport async function listAppSecretsForScope(\n  scope: SecretScope,\n  scopeId: string,\n): Promise<SecretMeta[]> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT key, encrypted_value, description, url_allowlist, created_at, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? ORDER BY updated_at DESC`,\n    args: [scope, scopeId],\n  });\n  return rows.map((row) => {\n    let last4Value = \"\";\n    try {\n      const value = decryptValue(row.encrypted_value as string);\n      last4Value = last4(value);\n    } catch {\n      last4Value = \"\";\n    }\n    return {\n      key: row.key as string,\n      scope,\n      scopeId,\n      last4: last4Value,\n      description: (row.description as string | null) ?? null,\n      urlAllowlist: parseAllowlist(row.url_allowlist as string | null),\n      createdAt: Number(row.created_at ?? 0),\n      updatedAt: Number(row.updated_at ?? 0),\n    };\n  });\n}\n\nfunction parseAllowlist(raw: string | null): string[] | null {\n  if (!raw) return null;\n  try {\n    const parsed = JSON.parse(raw);\n    if (Array.isArray(parsed) && parsed.every((v) => typeof v === \"string\")) {\n      return parsed;\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function deleteAppSecret(ref: SecretRef): Promise<boolean> {\n  await ensureTable();\n  const { key, scope, scopeId } = ref;\n  const client = getDbExec();\n  const { rowsAffected } = await client.execute({\n    sql: `DELETE FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ?`,\n    args: [scope, scopeId, key],\n  });\n  return rowsAffected > 0;\n}\n"]}