@agents24/node 0.3.0 → 0.5.0

package/dist/bff.cjs

@@ -2,7 +2,46 @@
 
 var crypto = require('crypto');
 
-// src/bff.ts
+// src/bff-agent-resolution.ts
+function clean(value) {
+  const result = typeof value === "string" ? value.trim() : "";
+  return result || void 0;
+}
+function required(value, field) {
+  const result = clean(value);
+  if (!result || /[\r\n\0]/.test(result)) throw new Error(`${field} is required.`);
+  return result;
+}
+function prepareAgents24BffAgentResolution(options) {
+  if (!options.agents.length || options.agents.length > 50) {
+    throw new Error("agents must contain between one and 50 Agents.");
+  }
+  const configured = options.agents.map((item) => {
+    const agentId = clean(item.agentId);
+    const agentAlias = clean(item.agentAlias);
+    if (Boolean(agentId) === Boolean(agentAlias)) {
+      throw new Error("Each Agent requires exactly one of agentId or agentAlias.");
+    }
+    return { agentId, agentAlias, agentVersionId: clean(item.agentVersionId) };
+  });
+  return async () => {
+    const agents = await Promise.all(configured.map(async (item) => {
+      if (item.agentAlias) {
+        const resolution = await options.client.embed.resolveAgentAlias(item.agentAlias);
+        return {
+          agentId: required(resolution.agent_id, "agentId"),
+          agentAlias: required(item.agentAlias, "agentAlias"),
+          agentVersionId: item.agentVersionId
+        };
+      }
+      return { agentId: required(item.agentId, "agentId"), agentVersionId: item.agentVersionId };
+    }));
+    if (new Set(agents.map((item) => item.agentId)).size !== agents.length) {
+      throw new Error("Configured Agent selectors must resolve to unique Agents.");
+    }
+    return agents;
+  };
+}
 
 // src/errors.ts
 var Agents24SDKError = class extends Error {
@@ -41,29 +80,7 @@ var Agents24SDKError = class extends Error {
   }
 };
 
-// src/bff.ts
-var JSON_LIMIT_BYTES = 1048576;
-function normalized(value, field) {
-  const result = String(value || "").trim();
-  if (!result || /[\r\n\0]/.test(result)) throw new Error(`${field} is required.`);
-  return result;
-}
-function normalizeBasePath(value) {
-  const path = String(value || "/api/agents24").trim().replace(/\/+$/, "");
-  if (!path.startsWith("/") || /[\r\n\0?#]/.test(path)) throw new Error("basePath must be an absolute path.");
-  return path;
-}
-function browserRequestIsSameOrigin(request) {
-  const fetchSite = String(request.headers.get("sec-fetch-site") || "").trim().toLowerCase();
-  if (fetchSite) return fetchSite === "same-origin";
-  const rawOrigin = String(request.headers.get("origin") || "").trim();
-  if (!rawOrigin) return true;
-  try {
-    return rawOrigin !== "null" && new URL(rawOrigin).origin === new URL(request.url).origin;
-  } catch {
-    return false;
-  }
-}
+// src/bff-errors.ts
 function publicError(status, code, message, retryable = false, violations) {
   const category = status === 401 ? "authentication" : status === 403 ? "authorization" : status === 404 ? "not_found" : status === 409 ? "conflict" : status === 429 ? "rate_limit" : status >= 500 ? "internal" : "validation";
   return Response.json({
@@ -142,13 +159,79 @@ function errorResponse(error) {
     const sdkError = error;
     const status = sdkError.status && sdkError.status >= 400 && sdkError.status <= 599 ? sdkError.status : 502;
     const policyError = safeResourcePolicyError(sdkError.failure);
-    if (policyError) {
-      return resourcePolicyFailureResponse(status, policyError);
-    }
+    if (policyError) return resourcePolicyFailureResponse(status, policyError);
     return publicError(status, `UPSTREAM_${status}`, "The Agent request failed.", status >= 500);
   }
   return publicError(500, "BFF_REQUEST_FAILED", "The Agent request could not be completed.", true);
 }
+
+// src/bff.ts
+var JSON_LIMIT_BYTES = 1048576;
+var MAX_INPUT_LENGTH = 2e5;
+var MAX_ATTACHMENTS = 10;
+var MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
+var HITL_ACTIONS = /* @__PURE__ */ new Set(["approve", "reject", "connect", "skip", "respond"]);
+var CUSTOMER_IDENTITY_CACHE_TTL_MS = 6e4;
+var CUSTOMER_IDENTITY_CACHE_MAX_ENTRIES = 1024;
+function createCustomerIdentityResolver(embed, integrationId, integrationName) {
+  const cache = /* @__PURE__ */ new Map();
+  return async (principal) => {
+    const profile = {
+      display_name: principal.displayName,
+      email: principal.email,
+      avatar_url: principal.avatarUrl
+    };
+    const profileFields = Object.fromEntries(Object.entries(profile).filter(([, value2]) => value2 !== void 0));
+    const key = JSON.stringify([integrationId, principal.issuer, principal.subject, profileFields]);
+    const now = Date.now();
+    const cached = cache.get(key);
+    if (cached && cached.expiresAt > now) {
+      cache.delete(key);
+      cache.set(key, cached);
+      return cached.value;
+    }
+    if (cached) cache.delete(key);
+    const value = embed.resolveCustomerPrincipal({
+      integration_id: integrationId,
+      ...integrationName ? { integration_name: integrationName } : {},
+      ...principal.issuer ? { issuer: principal.issuer } : {},
+      subject: principal.subject,
+      ...Object.keys(profileFields).length ? { profile: profileFields } : {}
+    }).then((result) => normalized(result.customer_principal_ref, "customer_principal_ref"));
+    const entry = { expiresAt: now + CUSTOMER_IDENTITY_CACHE_TTL_MS, value };
+    cache.set(key, entry);
+    while (cache.size > CUSTOMER_IDENTITY_CACHE_MAX_ENTRIES) {
+      const oldest = cache.keys().next().value;
+      if (oldest === void 0) break;
+      cache.delete(oldest);
+    }
+    void value.catch(() => {
+      if (cache.get(key) === entry) cache.delete(key);
+    });
+    return value;
+  };
+}
+function normalized(value, field) {
+  const result = String(value || "").trim();
+  if (!result || /[\r\n\0]/.test(result)) throw new Error(`${field} is required.`);
+  return result;
+}
+function normalizeBasePath(value) {
+  const path = String(value || "/api/agents24").trim().replace(/\/+$/, "");
+  if (!path.startsWith("/") || /[\r\n\0?#]/.test(path)) throw new Error("basePath must be an absolute path.");
+  return path;
+}
+function browserRequestIsSameOrigin(request) {
+  const fetchSite = String(request.headers.get("sec-fetch-site") || "").trim().toLowerCase();
+  if (fetchSite) return fetchSite === "same-origin";
+  const rawOrigin = String(request.headers.get("origin") || "").trim();
+  if (!rawOrigin) return true;
+  try {
+    return rawOrigin !== "null" && new URL(rawOrigin).origin === new URL(request.url).origin;
+  } catch {
+    return false;
+  }
+}
 function mergeHeaders(response, additional) {
   if (!additional) return response;
   const headers = new Headers(response.headers);
@@ -206,7 +289,7 @@ function sseHeaders(headers) {
   result.set("X-Accel-Buffering", "no");
   return result;
 }
-function sseResponse(execute, headers) {
+function sseResponse(execute, headers, failurePayload) {
   const stream = new TransformStream();
   const writer = stream.writable.getWriter();
   const encoder = new TextEncoder();
@@ -214,6 +297,10 @@ function sseResponse(execute, headers) {
 
 `));
   void execute(write).catch(async (error) => {
+    if (failurePayload) {
+      await write(failurePayload(error)).catch(() => void 0);
+      return;
+    }
     const message = "The Agent stream failed.";
     const event = {
       version: "run-stream.v3",
@@ -237,7 +324,7 @@ function bootstrapDocument(raw, agentVersionId) {
     version: String(raw.version || "agents24.embed.bootstrap.v1"),
     deployment: {
       id: "server-embed",
-      name: String(raw.agent_name || "Agents24 Agent"),
+      name: normalized(String(raw.agent_name || ""), "agent_name"),
       version_policy: agentVersionId ? { mode: "pinned", version_id: agentVersionId } : { mode: "latest_published" },
       resolved_agent_version_id: resolvedVersionId,
       resolved_agent_version_number: Number.isFinite(versionNumber) ? versionNumber : 0,
@@ -249,9 +336,12 @@ function bootstrapDocument(raw, agentVersionId) {
     native_profiles: []
   };
 }
-function createAgents24BffHandler(options) {
+function createAgents24BffHandlerWithResolver(options, resolveCustomerIdentity) {
   const agentId = normalized(options.agentId, "agentId");
   const agentVersionId = stringValue(options.agentVersionId);
+  const runtimeTarget = options.runtimeTarget || "published";
+  const integrationId = normalized(options.integrationId, "integrationId");
+  if (runtimeTarget === "draft" && agentVersionId) throw new Error("agentVersionId cannot be used with draft runtimeTarget.");
   const basePath = normalizeBasePath(options.basePath);
   const embed = options.client.embed;
   return async (request) => {
@@ -276,42 +366,44 @@ function createAgents24BffHandler(options) {
     const principal = resolution.principal;
     const idempotencyKey = stringValue(request.headers.get("idempotency-key"));
     try {
-      let customerPrincipalRef = "";
-      if (!(request.method === "GET" && (path === "/bootstrap" || path === "/resource-policy"))) {
-        const entitlement = await embed.getResourcePolicy(agentId, {
-          external_user_id: principal.subject,
-          ...principal.issuer ? { external_user_issuer: principal.issuer } : {},
-          ...agentVersionId ? { agent_version_id: agentVersionId } : {}
-        });
-        customerPrincipalRef = stringValue(entitlement.customer_principal_ref) || principal.subject;
-      }
+      const customerPrincipalRef = await resolveCustomerIdentity(principal);
       const identity = {
         external_user_id: customerPrincipalRef,
         ...principal.externalSessionId ? { external_session_id: principal.externalSessionId } : {}
       };
       const threadIdentity = {
         externalUserId: customerPrincipalRef,
+        runtimeTarget,
         ...principal.externalSessionId ? { externalSessionId: principal.externalSessionId } : {}
       };
       let response;
       if (request.method === "GET" && path === "/bootstrap") {
-        const raw = await embed.getRuntimeBootstrap(agentId, agentVersionId);
+        const raw = await embed.getRuntimeBootstrap(agentId, agentVersionId, runtimeTarget);
         response = json(bootstrapDocument(raw, agentVersionId));
       } else if (request.method === "GET" && path === "/resource-policy") {
         response = json(await embed.getResourcePolicy(agentId, {
-          external_user_id: principal.subject,
-          ...principal.issuer ? { external_user_issuer: principal.issuer } : {},
-          ...agentVersionId ? { agent_version_id: agentVersionId } : {}
+          external_user_id: customerPrincipalRef,
+          integration_id: integrationId,
+          ...agentVersionId ? { agent_version_id: agentVersionId } : {},
+          runtime_target: runtimeTarget
         }));
       } else if (request.method === "POST" && path === "/chat/stream") {
         const body = await requestJson(request);
         const input = stringValue(body.input);
         const attachmentIds = stringList(body.attachmentIds);
         if (!input && attachmentIds.length === 0) throw new BffInputError(400, "INPUT_REQUIRED", "A message or attachment is required.");
+        if (input && input.length > MAX_INPUT_LENGTH) {
+          throw new BffInputError(413, "INPUT_TOO_LARGE", "The message is too large.");
+        }
+        if (attachmentIds.length > MAX_ATTACHMENTS) {
+          throw new BffInputError(400, "TOO_MANY_ATTACHMENTS", `At most ${MAX_ATTACHMENTS} attachments are allowed.`);
+        }
         response = sseResponse(async (write) => {
           await embed.streamAgent(agentId, {
             ...identity,
+            integration_id: integrationId,
             ...agentVersionId ? { agent_version_id: agentVersionId } : {},
+            runtime_target: runtimeTarget,
             ...input ? { input } : {},
             attachment_ids: attachmentIds,
             ...stringValue(body.threadId) ? { thread_id: stringValue(body.threadId) } : {},
@@ -331,6 +423,8 @@ function createAgents24BffHandler(options) {
         response = sseResponse(async (write) => {
           await embed.attachAgentRun(agentId, runId, {
             ...identity,
+            runtime_target: runtimeTarget,
+            integration_id: integrationId,
             ...cursor === void 0 ? {} : { cursor: Number(cursor) }
           }, (event) => write(event), {
             idempotencyKey,
@@ -339,7 +433,10 @@ function createAgents24BffHandler(options) {
         });
       } else if (request.method === "POST" && /^\/runs\/[^/]+\/cancel$/.test(path)) {
         const runId = routeId(path, /^\/runs\/([^/]+)\/cancel$/, "runId");
-        response = json(await embed.cancelAgentRun(agentId, runId, threadIdentity, { idempotencyKey }));
+        response = json(await embed.cancelAgentRun(agentId, runId, {
+          ...threadIdentity,
+          integrationId
+        }, { idempotencyKey }));
       } else if (request.method === "PUT" && /^\/runs\/[^/]+\/feedback$/.test(path)) {
         const runId = routeId(path, /^\/runs\/([^/]+)\/feedback$/, "runId");
         const body = await requestJson(request);
@@ -358,6 +455,8 @@ function createAgents24BffHandler(options) {
         }
         response = json(await embed.setAgentRunFeedback(agentId, runId, {
           ...identity,
+          runtime_target: runtimeTarget,
+          integration_id: integrationId,
           rating,
           ...rating === "dislike" && reason ? { reason } : {},
           ...rating === "dislike" && comment ? { comment } : {}
@@ -365,43 +464,71 @@ function createAgents24BffHandler(options) {
       } else if (request.method === "GET" && path === "/threads") {
         const skip = Number(url.searchParams.get("skip") || 0);
         const limit = Number(url.searchParams.get("limit") || 20);
+        if (!Number.isInteger(skip) || skip < 0 || !Number.isInteger(limit) || limit < 1 || limit > 100) {
+          throw new BffInputError(400, "INVALID_PAGINATION", "skip must be non-negative and limit must be between 1 and 100.");
+        }
         response = json(await embed.listAgentThreads(agentId, {
           ...threadIdentity,
-          skip: Number.isFinite(skip) ? skip : 0,
-          limit: Number.isFinite(limit) ? limit : 20
+          integrationId,
+          runtimeTarget,
+          skip,
+          limit
         }));
       } else if (request.method === "GET" && path === "/threads/events") {
         const rawCursor = url.searchParams.get("cursor");
         const cursor = rawCursor === null ? void 0 : Number(rawCursor);
+        if (cursor !== void 0 && (!Number.isInteger(cursor) || cursor < 0)) {
+          throw new BffInputError(400, "INVALID_CURSOR", "cursor must be a non-negative integer.");
+        }
         response = sseResponse(async (write) => {
           await embed.subscribeAgentThreadEvents(agentId, {
             ...threadIdentity,
-            ...cursor !== void 0 && Number.isFinite(cursor) ? { cursor } : {},
+            integrationId,
+            ...cursor !== void 0 ? { cursor } : {},
             signal: request.signal
           }, (event) => write(event));
-        });
+        }, void 0, () => ({
+          schema_version: "agents24.thread_summary_event.v1",
+          event: "snapshot_required",
+          cursor,
+          reason: "stream_failed"
+        }));
       } else if (/^\/threads\/[^/]+$/.test(path) && request.method === "GET") {
         const threadId = routeId(path, /^\/threads\/([^/]+)$/, "threadId");
         const rawBefore = url.searchParams.get("before_turn_index");
         const rawLimit = url.searchParams.get("limit");
         const before = rawBefore === null ? void 0 : Number(rawBefore);
         const limit = rawLimit === null ? void 0 : Number(rawLimit);
+        if (before !== void 0 && (!Number.isInteger(before) || before < 0)) {
+          throw new BffInputError(400, "INVALID_PAGINATION", "before_turn_index is invalid.");
+        }
+        if (limit !== void 0 && (!Number.isInteger(limit) || limit < 1 || limit > 100)) {
+          throw new BffInputError(400, "INVALID_PAGINATION", "limit must be between 1 and 100.");
+        }
         response = json(await embed.getAgentThread(agentId, threadId, {
           ...threadIdentity,
-          ...before !== void 0 && Number.isFinite(before) ? { beforeTurnIndex: before } : {},
-          ...limit !== void 0 && Number.isFinite(limit) ? { limit } : {}
+          integrationId,
+          ...before !== void 0 ? { beforeTurnIndex: before } : {},
+          ...limit !== void 0 ? { limit } : {}
         }));
       } else if (/^\/threads\/[^/]+$/.test(path) && request.method === "DELETE") {
         const threadId = routeId(path, /^\/threads\/([^/]+)$/, "threadId");
-        response = json(await embed.deleteAgentThread(agentId, threadId, threadIdentity, { idempotencyKey }));
+        response = json(await embed.deleteAgentThread(agentId, threadId, { ...threadIdentity, integrationId }, { idempotencyKey }));
       } else if (request.method === "POST" && path === "/attachments/upload") {
         const form = await request.formData();
         const files = form.getAll("files").filter((entry) => entry instanceof File);
         if (files.length === 0) throw new BffInputError(400, "ATTACHMENT_REQUIRED", "At least one attachment is required.");
+        if (files.length > MAX_ATTACHMENTS) {
+          throw new BffInputError(400, "TOO_MANY_ATTACHMENTS", `At most ${MAX_ATTACHMENTS} attachments are allowed.`);
+        }
+        if (files.some((file) => file.size > MAX_ATTACHMENT_BYTES)) {
+          throw new BffInputError(413, "ATTACHMENT_TOO_LARGE", "An attachment exceeds the allowed size.");
+        }
         response = json(await embed.uploadAgentAttachments(agentId, {
           ...threadIdentity,
           files,
           ...stringValue(form.get("thread_id")) ? { threadId: stringValue(form.get("thread_id")) } : {},
+          integrationId,
           idempotencyKey
         }));
       } else if (request.method === "POST" && /^\/attachments\/[^/]+\/content-access$/.test(path)) {
@@ -414,6 +541,8 @@ function createAgents24BffHandler(options) {
         response = json(await embed.createAttachmentContentAccess(agentId, attachmentId, {
           external_user_id: threadIdentity.externalUserId,
           ...threadIdentity.externalSessionId ? { external_session_id: threadIdentity.externalSessionId } : {},
+          runtime_target: runtimeTarget,
+          integration_id: integrationId,
           disposition
         }));
       } else if (request.method === "POST" && /^\/runs\/[^/]+\/hitl\/[^/]+\/resume$/.test(path)) {
@@ -421,11 +550,17 @@ function createAgents24BffHandler(options) {
         const runId = routeId(path, /^\/runs\/([^/]+)\/hitl\//, "runId");
         const interruptId = match?.[2] ? decodeURIComponent(match[2]) : "";
         const body = await requestJson(request);
+        const action = stringValue(body.action);
+        if (!action || !HITL_ACTIONS.has(action)) {
+          throw new BffInputError(400, "INVALID_HITL_ACTION", "The HITL action is invalid.");
+        }
         response = json(await embed.resumeAgentRun(agentId, runId, {
           ...identity,
+          runtime_target: runtimeTarget,
+          integration_id: integrationId,
           schema_version: "agents24.hitl.resume.v2",
           interrupt_id: normalized(interruptId, "interruptId"),
-          action: normalized(String(body.action || ""), "action"),
+          action,
           ...stringValue(body.comment) ? { comment: stringValue(body.comment) } : {},
           ...Array.isArray(body.answers) ? { answers: body.answers } : {}
         }, { idempotencyKey }));
@@ -437,6 +572,8 @@ function createAgents24BffHandler(options) {
         const callbackOrigin = new URL(request.url).origin;
         response = json(await embed.startAgentRunMcpAuth(agentId, normalized(runId, "runId"), normalized(serverId, "serverId"), {
           ...identity,
+          runtime_target: runtimeTarget,
+          integration_id: integrationId,
           interrupt_id: normalized(String(body.interruptId || ""), "interruptId"),
           callback_origin: callbackOrigin,
           popup_nonce: normalized(String(body.popupNonce || ""), "popupNonce")
@@ -458,6 +595,298 @@ function createAgents24BffHandler(options) {
     }
   };
 }
+function createResolvedAgents24BffHandler(options) {
+  const runtimeTarget = options.runtimeTarget || "published";
+  const basePath = normalizeBasePath(options.basePath);
+  const integrationId = normalized(options.integrationId, "integrationId");
+  const agents = options.agents.map((item) => ({
+    agentId: normalized(item.agentId, "agentId"),
+    agentAlias: stringValue(item.agentAlias),
+    agentVersionId: stringValue(item.agentVersionId)
+  }));
+  if (!agents.length || agents.length > 50) throw new Error("agents must contain between one and 50 Agents.");
+  if (new Set(agents.map((agent) => agent.agentId)).size !== agents.length) throw new Error("agents must contain unique Agent IDs.");
+  if (runtimeTarget === "draft" && agents.some((agent) => agent.agentVersionId)) {
+    throw new Error("agentVersionId cannot be used with draft runtimeTarget.");
+  }
+  const resolveCustomerIdentity = createCustomerIdentityResolver(
+    options.client.embed,
+    integrationId,
+    stringValue(options.integrationName)
+  );
+  const scopedHandlers = new Map(agents.map((agent) => [
+    agent.agentId,
+    createAgents24BffHandlerWithResolver({
+      client: options.client,
+      agentId: agent.agentId,
+      agentVersionId: agent.agentVersionId,
+      runtimeTarget,
+      integrationId,
+      integrationName: options.integrationName,
+      basePath: `${basePath}/agents/${encodeURIComponent(agent.agentId)}`,
+      resolvePrincipal: options.resolvePrincipal,
+      revokePrincipal: options.revokePrincipal
+    }, resolveCustomerIdentity)
+  ]));
+  const agentBySelector = /* @__PURE__ */ new Map();
+  for (const agent of agents) {
+    agentBySelector.set(agent.agentId, agent);
+    if (agent.agentAlias) agentBySelector.set(agent.agentAlias, agent);
+  }
+  return async (request) => {
+    const url = new URL(request.url);
+    if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) {
+      return publicError(404, "NOT_FOUND", "The requested BFF route does not exist.");
+    }
+    if (!browserRequestIsSameOrigin(request)) {
+      return publicError(403, "BFF_ORIGIN_DENIED", "The BFF accepts same-origin browser requests only.");
+    }
+    const path = url.pathname.slice(basePath.length) || "/";
+    let resolution;
+    try {
+      resolution = await options.resolvePrincipal(request);
+      resolution.principal.subject = normalized(resolution.principal.subject, "subject");
+      if (resolution.principal.issuer !== void 0) resolution.principal.issuer = normalized(resolution.principal.issuer, "issuer");
+    } catch {
+      return publicError(401, "PRINCIPAL_REQUIRED", "A valid application session is required.");
+    }
+    try {
+      const externalUserId = await resolveCustomerIdentity(resolution.principal);
+      const identity = {
+        external_user_id: externalUserId,
+        ...resolution.principal.externalSessionId ? { external_session_id: resolution.principal.externalSessionId } : {}
+      };
+      const requestedAgent = (value) => {
+        const agentId = stringValue(value) || agents[0].agentId;
+        const configured = agentBySelector.get(agentId);
+        if (!configured) throw new BffInputError(404, "AGENT_NOT_CONFIGURED", "The requested Agent is not available.");
+        return configured;
+      };
+      const dispatchToAgent = async (agentId) => {
+        const handler = scopedHandlers.get(agentId);
+        if (!handler) throw new BffInputError(404, "NOT_FOUND", "The requested resource does not exist.");
+        const target = new URL(request.url);
+        target.pathname = `${basePath}/agents/${encodeURIComponent(agentId)}${path}`;
+        const body = request.method === "GET" || request.method === "HEAD" ? void 0 : await request.arrayBuffer();
+        return handler(new Request(target, {
+          method: request.method,
+          headers: request.headers,
+          body,
+          signal: request.signal
+        }));
+      };
+      const resolveRunAgent = async (runId) => {
+        const result = await options.client.embed.resolveConversationRun(runId, {
+          agent_ids: agents.map((agent) => agent.agentId),
+          ...identity,
+          integration_id: integrationId,
+          runtime_target: runtimeTarget
+        });
+        return requestedAgent(result.agent_id).agentId;
+      };
+      if (request.method === "GET" && path === "/bootstrap") {
+        const candidates = await Promise.all(agents.map(async (agent) => {
+          const [raw, policy] = await Promise.all([
+            options.client.embed.getRuntimeBootstrap(agent.agentId, agent.agentVersionId, runtimeTarget),
+            options.client.embed.getResourcePolicy(agent.agentId, {
+              external_user_id: externalUserId,
+              integration_id: integrationId,
+              ...agent.agentVersionId ? { agent_version_id: agent.agentVersionId } : {},
+              runtime_target: runtimeTarget
+            })
+          ]);
+          const alias = normalized(String(raw.agent_alias || ""), "agent_alias");
+          agent.agentAlias = alias;
+          agentBySelector.set(alias, agent);
+          for (const item of stringList(raw.agent_aliases)) agentBySelector.set(item, agent);
+          return { agent, raw, policy };
+        }));
+        const selected = requestedAgent(url.searchParams.get("agent_id"));
+        const allowed = candidates.filter((candidate) => candidate.policy.agent_access_allowed !== false);
+        const selectedCandidate = allowed.find((candidate) => candidate.agent.agentId === selected.agentId) || allowed[0];
+        if (!selectedCandidate) throw new BffInputError(403, "RESOURCE_POLICY_ACCESS_DENIED", "No configured Agent is available.");
+        const document = bootstrapDocument(selectedCandidate.raw, selectedCandidate.agent.agentVersionId);
+        const features = objectValue(document.features);
+        features.models = selectedCandidate.policy.model_selection;
+        features.agents = {
+          selectable: allowed.length > 1,
+          default_id: normalized(String(allowed[0].raw.agent_alias || ""), "agent_alias"),
+          options: allowed.map((candidate) => ({
+            id: normalized(String(candidate.raw.agent_alias || ""), "agent_alias"),
+            label: normalized(String(candidate.raw.agent_name || ""), "agent_name")
+          }))
+        };
+        document.features = features;
+        document.capabilities = [
+          .../* @__PURE__ */ new Set([
+            ...document.capabilities || [],
+            ...allowed.length > 1 ? ["agents.select"] : [],
+            ...selectedCandidate.policy.model_selection.selectable ? ["models.select"] : []
+          ])
+        ];
+        return mergeHeaders(json(document), resolution.responseHeaders);
+      }
+      if (request.method === "POST" && path === "/chat/stream") {
+        const body = await requestJson(request);
+        const selected = requestedAgent(body.requestedAgentId);
+        const input = stringValue(body.input);
+        const attachmentIds = stringList(body.attachmentIds);
+        if (!input && attachmentIds.length === 0) throw new BffInputError(400, "INPUT_REQUIRED", "A message or attachment is required.");
+        if (input && input.length > MAX_INPUT_LENGTH) throw new BffInputError(413, "INPUT_TOO_LARGE", "The message is too large.");
+        if (attachmentIds.length > MAX_ATTACHMENTS) throw new BffInputError(400, "TOO_MANY_ATTACHMENTS", `At most ${MAX_ATTACHMENTS} attachments are allowed.`);
+        return mergeHeaders(sseResponse(async (write) => {
+          await options.client.embed.streamAgent(selected.agentId, {
+            ...identity,
+            ...selected.agentVersionId ? { agent_version_id: selected.agentVersionId } : {},
+            runtime_target: runtimeTarget,
+            integration_id: integrationId,
+            ...input ? { input } : {},
+            attachment_ids: attachmentIds,
+            ...stringValue(body.threadId) ? { thread_id: stringValue(body.threadId) } : {},
+            ...stringValue(body.requestedModelId) ? { requested_model_id: stringValue(body.requestedModelId) } : {},
+            tool_inputs: objectValue(body.toolInputs),
+            metadata: objectValue(body.metadata),
+            client: objectValue(body.client)
+          }, (event) => write(event), { idempotencyKey: stringValue(request.headers.get("idempotency-key")), signal: request.signal });
+        }), resolution.responseHeaders);
+      }
+      if (request.method === "GET" && path === "/threads") {
+        const skip = Number(url.searchParams.get("skip") || 0);
+        const limit = Number(url.searchParams.get("limit") || 20);
+        if (!Number.isInteger(skip) || skip < 0 || !Number.isInteger(limit) || limit < 1 || limit > 100) {
+          throw new BffInputError(400, "INVALID_PAGINATION", "skip must be non-negative and limit must be between 1 and 100.");
+        }
+        return mergeHeaders(json(await options.client.embed.listAgentThreadsMulti({
+          agent_ids: agents.map((agent) => agent.agentId),
+          external_user_id: externalUserId,
+          ...resolution.principal.externalSessionId ? { external_session_id: resolution.principal.externalSessionId } : {},
+          runtime_target: runtimeTarget,
+          integration_id: integrationId,
+          skip,
+          limit
+        })), resolution.responseHeaders);
+      }
+      if (request.method === "GET" && path === "/threads/events") {
+        const rawCursor = url.searchParams.get("cursor");
+        const cursor = rawCursor === null ? void 0 : Number(rawCursor);
+        if (cursor !== void 0 && (!Number.isInteger(cursor) || cursor < 0)) {
+          throw new BffInputError(400, "INVALID_CURSOR", "cursor must be a non-negative integer.");
+        }
+        return mergeHeaders(sseResponse(async (write) => {
+          await options.client.embed.subscribeAgentThreadEventsMulti({
+            agentIds: agents.map((agent) => agent.agentId),
+            externalUserId,
+            ...resolution.principal.externalSessionId ? { externalSessionId: resolution.principal.externalSessionId } : {},
+            ...cursor === void 0 ? {} : { cursor },
+            runtimeTarget,
+            integrationId,
+            signal: request.signal
+          }, (event) => write(event));
+        }, void 0, () => ({
+          schema_version: "agents24.thread_summary_event.v1",
+          event: "snapshot_required",
+          cursor,
+          reason: "stream_failed"
+        })), resolution.responseHeaders);
+      }
+      if (/^\/threads\/[^/]+$/.test(path) && request.method === "GET") {
+        const threadId = routeId(path, /^\/threads\/([^/]+)$/, "threadId");
+        const rawBefore = url.searchParams.get("before_turn_index");
+        const rawLimit = url.searchParams.get("limit");
+        const beforeTurnIndex = rawBefore === null ? void 0 : Number(rawBefore);
+        const detailLimit = rawLimit === null ? void 0 : Number(rawLimit);
+        if (beforeTurnIndex !== void 0 && (!Number.isInteger(beforeTurnIndex) || beforeTurnIndex < 0)) {
+          throw new BffInputError(400, "INVALID_PAGINATION", "before_turn_index is invalid.");
+        }
+        if (detailLimit !== void 0 && (!Number.isInteger(detailLimit) || detailLimit < 1 || detailLimit > 100)) {
+          throw new BffInputError(400, "INVALID_PAGINATION", "limit must be between 1 and 100.");
+        }
+        return mergeHeaders(json(await options.client.embed.getConversationThread(threadId, {
+          agentIds: agents.map((agent) => agent.agentId),
+          externalUserId,
+          ...resolution.principal.externalSessionId ? { externalSessionId: resolution.principal.externalSessionId } : {},
+          integrationId,
+          runtimeTarget,
+          beforeTurnIndex,
+          limit: detailLimit
+        })), resolution.responseHeaders);
+      }
+      if (/^\/threads\/[^/]+\/runtime-selection$/.test(path) && request.method === "PATCH") {
+        const threadId = routeId(path, /^\/threads\/([^/]+)\//, "threadId");
+        const body = await requestJson(request);
+        const selected = requestedAgent(body.preferredAgentId);
+        return mergeHeaders(json(await options.client.embed.setConversationRuntimeSelection(threadId, {
+          agent_ids: agents.map((agent) => agent.agentId),
+          preferred_agent_id: selected.agentId,
+          ...stringValue(body.preferredModelId) ? { preferred_model_id: stringValue(body.preferredModelId) } : {},
+          ...identity,
+          integration_id: integrationId,
+          runtime_target: runtimeTarget
+        })), resolution.responseHeaders);
+      }
+      if (/^\/threads\/[^/]+$/.test(path) && request.method === "DELETE") {
+        const threadId = routeId(path, /^\/threads\/([^/]+)$/, "threadId");
+        return mergeHeaders(json(await options.client.embed.deleteConversationThread(threadId, {
+          agentIds: agents.map((agent) => agent.agentId),
+          externalUserId,
+          ...resolution.principal.externalSessionId ? { externalSessionId: resolution.principal.externalSessionId } : {},
+          integrationId,
+          runtimeTarget
+        }, { idempotencyKey: stringValue(request.headers.get("idempotency-key")) })), resolution.responseHeaders);
+      }
+      if (request.method === "POST" && path === "/attachments/upload") {
+        const form = await request.clone().formData();
+        const selected = requestedAgent(form.get("requested_agent_id"));
+        const policy = await options.client.embed.getResourcePolicy(selected.agentId, {
+          external_user_id: externalUserId,
+          integration_id: integrationId,
+          ...selected.agentVersionId ? { agent_version_id: selected.agentVersionId } : {},
+          runtime_target: runtimeTarget
+        });
+        if (policy.agent_access_allowed === false) throw new BffInputError(403, "RESOURCE_POLICY_ACCESS_DENIED", "The requested Agent is not available.");
+        return dispatchToAgent(selected.agentId);
+      }
+      if (request.method === "POST" && /^\/attachments\/[^/]+\/content-access$/.test(path)) {
+        return dispatchToAgent(agents[0].agentId);
+      }
+      if (/^\/runs\/[^/]+\/(?:attach|cancel|feedback)$/.test(path) || /^\/runs\/[^/]+\/hitl\/[^/]+\/resume$/.test(path) || /^\/runs\/[^/]+\/mcp\/servers\/[^/]+\/auth\/start$/.test(path)) {
+        const runId = routeId(path, /^\/runs\/([^/]+)\//, "runId");
+        return dispatchToAgent(await resolveRunAgent(runId));
+      }
+      if (request.method === "POST" && path === "/mcp/callback/redeem") {
+        throw new BffInputError(409, "MCP_CALLBACK_DIRECT", "Server-embed MCP callbacks complete in the authorization popup.");
+      }
+      if (request.method === "POST" && path === "/session/revoke") {
+        const headers = await options.revokePrincipal?.(request, resolution.principal);
+        return mergeHeaders(new Response(null, { status: 204, ...headers ? { headers } : {} }), resolution.responseHeaders);
+      }
+      return mergeHeaders(publicError(404, "NOT_FOUND", "The requested BFF route does not exist."), resolution.responseHeaders);
+    } catch (error) {
+      if (error instanceof BffInputError) return mergeHeaders(publicError(error.status, error.code, error.message), resolution.responseHeaders);
+      return mergeHeaders(errorResponse(error), resolution.responseHeaders);
+    }
+  };
+}
+function createAgents24BffHandler(options) {
+  const resolveAgents = prepareAgents24BffAgentResolution(options);
+  let resolvedHandler;
+  const resolve = async () => {
+    const agents = await resolveAgents();
+    return createResolvedAgents24BffHandler({ ...options, agents });
+  };
+  return async (request) => {
+    if (!browserRequestIsSameOrigin(request)) {
+      return publicError(403, "BFF_ORIGIN_DENIED", "The BFF accepts same-origin browser requests only.");
+    }
+    resolvedHandler ||= resolve();
+    try {
+      return (await resolvedHandler)(request);
+    } catch (error) {
+      resolvedHandler = void 0;
+      return errorResponse(error);
+    }
+  };
+}
 
 exports.createAgents24BffHandler = createAgents24BffHandler;
 //# sourceMappingURL=bff.cjs.map