@agentstep/agent-sdk 0.4.28 → 0.4.30

package/dist/{chunk-I5ZA45YL.js → chunk-QWGJS6V6.js}

@@ -1,10 +1,10 @@
 import {
   init_session_resources,
   session_resources_exports
-} from "./chunk-R5OZHLAD.js";
+} from "./chunk-4PVPM2WC.js";
 import {
   DEFAULT_TENANT_ID
-} from "./chunk-JDELTTHV.js";
+} from "./chunk-BBYQMNGK.js";
 import {
   init_ids,
   newId
@@ -12,7 +12,7 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-SXE7H3VK.js";
+} from "./chunk-SLAOS6JN.js";
 import {
   schema_exports
 } from "./chunk-LHHBOQUR.js";
@@ -95,7 +95,7 @@ function hydrateSession(row) {
 }
 function createSession(input) {
   const db = getDrizzle();
-  const id = newId("sess");
+  const id = newId("sesn");
   const now = nowMs();
   db.insert(schema_exports.sessions).values({
     id,

package/dist/{chunk-YCXELHKG.js → chunk-REGPK5NG.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-EF5QCTEQ.js";
+} from "./chunk-EFDAVLKN.js";
 import {
   ApiError
 } from "./chunk-EZYKRG4W.js";

package/dist/{chunk-NUO56TF7.js → chunk-S5HVHCAK.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_TENANT_ID
-} from "./chunk-JDELTTHV.js";
+} from "./chunk-BBYQMNGK.js";
 import {
   init_ids,
   newId
@@ -8,7 +8,7 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-SXE7H3VK.js";
+} from "./chunk-SLAOS6JN.js";
 import {
   schema_exports
 } from "./chunk-LHHBOQUR.js";

package/dist/{chunk-SXE7H3VK.js → chunk-SLAOS6JN.js}

@@ -5,7 +5,7 @@ import {
 import {
   getDb,
   init_client
-} from "./chunk-5GZEX4HV.js";
+} from "./chunk-4C7XJI2V.js";
 import {
   __esm
 } from "./chunk-2ESYSVXG.js";

package/dist/{chunk-NXRJ7Z4G.js → chunk-SW75SNDB.js}

@@ -5,7 +5,7 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-SXE7H3VK.js";
+} from "./chunk-SLAOS6JN.js";
 import {
   schema_exports
 } from "./chunk-LHHBOQUR.js";

package/dist/{chunk-JK5TPJHH.js → chunk-SXTHM67U.js}

@@ -1,7 +1,7 @@
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-SXE7H3VK.js";
+} from "./chunk-SLAOS6JN.js";
 
 // src/db/traces.ts
 init_drizzle();

package/dist/{chunk-NWFYV2VI.js → chunk-TRGHIMCR.js}

@@ -6,20 +6,20 @@ import {
   reconcileDockerOrphanSandboxes,
   reconcileOrphanSandboxes,
   releaseSession
-} from "./chunk-F3M4HKEJ.js";
+} from "./chunk-EN3ICYTL.js";
 import {
   appendEvent,
   dropEmitter
-} from "./chunk-BMPB7XJH.js";
+} from "./chunk-TRQX5AIZ.js";
 import {
   archiveSession,
   getSessionRow,
   listIdleSessions,
   updateSessionStatus
-} from "./chunk-I5ZA45YL.js";
+} from "./chunk-QWGJS6V6.js";
 import {
   getConfig
-} from "./chunk-EF5QCTEQ.js";
+} from "./chunk-EFDAVLKN.js";
 import {
   init_clock,
   nowMs

package/dist/{chunk-BMPB7XJH.js → chunk-TRQX5AIZ.js}

@@ -1,19 +1,19 @@
 import {
   getSession
-} from "./chunk-I5ZA45YL.js";
+} from "./chunk-QWGJS6V6.js";
 import {
   appendEvent,
   appendEventsBatch,
   listEvents,
   rowToManagedEvent
-} from "./chunk-O45IQUWS.js";
+} from "./chunk-5NBZZZKH.js";
 import {
   getAgent
-} from "./chunk-JEI7I3EH.js";
+} from "./chunk-TXUUUO5R.js";
 import {
   getDb,
   init_client
-} from "./chunk-5GZEX4HV.js";
+} from "./chunk-4C7XJI2V.js";
 
 // src/sessions/bus.ts
 import { EventEmitter } from "events";

package/dist/{chunk-JEI7I3EH.js → chunk-TXUUUO5R.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_TENANT_ID
-} from "./chunk-JDELTTHV.js";
+} from "./chunk-BBYQMNGK.js";
 import {
   init_ids,
   newId
@@ -8,7 +8,7 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-SXE7H3VK.js";
+} from "./chunk-SLAOS6JN.js";
 import {
   schema_exports
 } from "./chunk-LHHBOQUR.js";

package/dist/{chunk-P6NCA7G5.js → chunk-TZZMVXFM.js}

@@ -1,6 +1,6 @@
 import {
   SUPPORTED_PROVIDERS
-} from "./chunk-ATTHVKNE.js";
+} from "./chunk-JN3G4Y4L.js";
 import {
   addUpstreamKey,
   deleteUpstreamKey,
@@ -8,20 +8,20 @@ import {
   enableUpstreamKey,
   getUpstreamKey,
   listUpstreamKeys
-} from "./chunk-BZ6HFTHU.js";
+} from "./chunk-YGTC5UP5.js";
 import {
   requireGlobalAdmin
 } from "./chunk-23UKWXJH.js";
 import {
   recordAudit
-} from "./chunk-MHQXDTJB.js";
+} from "./chunk-NC4FHDIP.js";
 import {
   requireFeature
 } from "./chunk-2N2KL4KM.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-3QIIJADA.js";
+} from "./chunk-LOAFGJWC.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-ND7BRD6B.js → chunk-UF3NB27E.js}

@@ -1,32 +1,32 @@
 import {
   resolveRemoteSessionId
-} from "./chunk-YGAHGTVZ.js";
+} from "./chunk-YIOKUA23.js";
 import {
   assertResourceTenant
 } from "./chunk-23UKWXJH.js";
 import {
   authenticateAndIntercept
-} from "./chunk-ZMMDLKR3.js";
+} from "./chunk-FGQFNIRI.js";
 import {
   forwardToAnthropic
-} from "./chunk-T45NOW43.js";
+} from "./chunk-L43UD7PK.js";
 import {
   ensureInitialized
-} from "./chunk-DWAA3F5Y.js";
+} from "./chunk-LR4TA74O.js";
 import {
   getProxiedTenantId,
   isProxied
-} from "./chunk-NIOWKTIF.js";
+} from "./chunk-NT2AI5IE.js";
 import {
   subscribe
-} from "./chunk-BMPB7XJH.js";
+} from "./chunk-TRQX5AIZ.js";
 import {
   getSession
-} from "./chunk-I5ZA45YL.js";
+} from "./chunk-QWGJS6V6.js";
 import {
   getDb,
   init_client
-} from "./chunk-5GZEX4HV.js";
+} from "./chunk-4C7XJI2V.js";
 import {
   notFound,
   toResponse

package/dist/{chunk-36VCC3BY.js → chunk-ULJVEN67.js}

@@ -3,21 +3,21 @@ import {
 } from "./chunk-23UKWXJH.js";
 import {
   recordAudit
-} from "./chunk-MHQXDTJB.js";
+} from "./chunk-NC4FHDIP.js";
 import {
   requireFeature
 } from "./chunk-2N2KL4KM.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-3QIIJADA.js";
+} from "./chunk-LOAFGJWC.js";
 import {
   archiveTenant,
   createTenant,
   getTenant,
   listTenants,
   renameTenant
-} from "./chunk-JDELTTHV.js";
+} from "./chunk-BBYQMNGK.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-UXMCHRGA.js → chunk-ULQOJ3WO.js}

@@ -1,9 +1,9 @@
 import {
   listEntries
-} from "./chunk-VIGJQU6V.js";
+} from "./chunk-7GNSB22P.js";
 import {
   getConfig
-} from "./chunk-EF5QCTEQ.js";
+} from "./chunk-EFDAVLKN.js";
 
 // src/observability/redactor.ts
 var REDACTED = "[REDACTED]";

package/dist/{chunk-B2JLKTBJ.js → chunk-VC25NYHW.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-EF5QCTEQ.js";
+} from "./chunk-EFDAVLKN.js";
 
 // src/backends/opencode/auth.ts
 function buildOpencodeAuthEnv() {

package/dist/{chunk-CCE6MVB3.js → chunk-VMILIALE.js}

@@ -2,10 +2,10 @@ import {
   reportUpstreamFailure,
   reportUpstreamSuccess,
   resolveAnthropicKey
-} from "./chunk-ATTHVKNE.js";
+} from "./chunk-JN3G4Y4L.js";
 import {
   resolveRemoteSessionId
-} from "./chunk-YGAHGTVZ.js";
+} from "./chunk-YIOKUA23.js";
 import {
   assertResourceTenant
 } from "./chunk-23UKWXJH.js";
@@ -20,45 +20,45 @@ import {
   listMemoryStores,
   searchMemories,
   updateMemory
-} from "./chunk-NUINUAXO.js";
+} from "./chunk-7V277COF.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-3QIIJADA.js";
+} from "./chunk-LOAFGJWC.js";
 import {
   forwardToAnthropic
-} from "./chunk-T45NOW43.js";
+} from "./chunk-L43UD7PK.js";
 import {
   enqueueTurn
-} from "./chunk-AQXCXWAZ.js";
+} from "./chunk-XQEMI2MI.js";
 import {
   runTurn,
   writePermissionResponse
-} from "./chunk-AYNYP3G3.js";
+} from "./chunk-H62LRJJP.js";
 import {
   getProxiedTenantId,
   isProxied
-} from "./chunk-NIOWKTIF.js";
+} from "./chunk-NT2AI5IE.js";
 import {
   getActor
 } from "./chunk-LAWTTG2E.js";
 import {
   appendEvent
-} from "./chunk-BMPB7XJH.js";
+} from "./chunk-TRQX5AIZ.js";
 import {
   bumpSessionStats,
   getSession,
   getSessionRow,
   setOutcomeCriteria,
   updateSessionMutable
-} from "./chunk-I5ZA45YL.js";
+} from "./chunk-QWGJS6V6.js";
 import {
   listEvents,
   rowToManagedEvent
-} from "./chunk-O45IQUWS.js";
+} from "./chunk-5NBZZZKH.js";
 import {
   getAgent
-} from "./chunk-JEI7I3EH.js";
+} from "./chunk-TXUUUO5R.js";
 import {
   init_clock,
   nowMs
@@ -66,7 +66,7 @@ import {
 import {
   getDb,
   init_client
-} from "./chunk-5GZEX4HV.js";
+} from "./chunk-4C7XJI2V.js";
 import {
   badRequest,
   notFound
@@ -633,9 +633,12 @@ function handleListEvents(request, sessionId) {
     const order = url.searchParams.get("order") === "desc" ? "desc" : "asc";
     const afterSeq = Number(url.searchParams.get("after_seq") ?? url.searchParams.get("page") ?? "0");
     const rows = listEvents(sessionId, { limit, order, afterSeq });
+    const data = rows.map(rowToManagedEvent);
     return jsonOk({
-      data: rows.map(rowToManagedEvent),
-      next_page: rows.length > 0 ? String(rows[rows.length - 1].seq) : null
+      data,
+      has_more: rows.length === limit,
+      first_id: data.length > 0 ? data[0].id : null,
+      last_id: data.length > 0 ? data[data.length - 1].id : null
     });
   });
 }

package/dist/chunk-VUADJZRV.js

@@ -0,0 +1,212 @@
+import {
+  loadVaultForCaller
+} from "./chunk-65XR7JU6.js";
+import {
+  jsonOk,
+  routeWrap
+} from "./chunk-LOAFGJWC.js";
+import {
+  createCredential,
+  deleteCredential,
+  getCredential,
+  listCredentials,
+  updateCredential
+} from "./chunk-JSKZXF5J.js";
+import {
+  badRequest,
+  conflict,
+  notFound
+} from "./chunk-EZYKRG4W.js";
+
+// src/handlers/credentials.ts
+import { z } from "zod";
+var TokenEndpointAuthSchema = z.object({
+  type: z.string().min(1),
+  client_secret: z.string().min(1)
+});
+var OAuthRefreshSchema = z.object({
+  token_endpoint: z.string().url(),
+  client_id: z.string().min(1),
+  scope: z.string().optional(),
+  refresh_token: z.string().min(1),
+  token_endpoint_auth: TokenEndpointAuthSchema.optional()
+});
+var StaticBearerAuthSchema = z.object({
+  type: z.literal("static_bearer"),
+  mcp_server_url: z.string().url().optional(),
+  token: z.string().min(1)
+});
+var McpOauthAuthSchema = z.object({
+  type: z.literal("mcp_oauth"),
+  mcp_server_url: z.string().url().optional(),
+  access_token: z.string().min(1),
+  expires_at: z.string().optional(),
+  refresh: OAuthRefreshSchema.optional()
+});
+var CreateCredentialSchema = z.object({
+  display_name: z.string().min(1).max(200),
+  auth: z.discriminatedUnion("type", [StaticBearerAuthSchema, McpOauthAuthSchema]),
+  metadata: z.record(z.string()).optional()
+});
+var UpdateStaticBearerAuthSchema = z.object({
+  type: z.literal("static_bearer").optional(),
+  token: z.string().min(1).optional(),
+  mcp_server_url: z.string().url().nullish()
+});
+var UpdateMcpOauthAuthSchema = z.object({
+  type: z.literal("mcp_oauth").optional(),
+  access_token: z.string().min(1).optional(),
+  expires_at: z.string().nullish(),
+  refresh: OAuthRefreshSchema.optional()
+});
+var UpdateAuthSchema = z.object({
+  type: z.enum(["static_bearer", "mcp_oauth"]).optional(),
+  token: z.string().min(1).optional(),
+  mcp_server_url: z.string().url().nullish(),
+  access_token: z.string().min(1).optional(),
+  expires_at: z.string().nullish(),
+  refresh: OAuthRefreshSchema.optional()
+}).optional();
+var UpdateCredentialSchema = z.object({
+  display_name: z.string().min(1).max(200).optional(),
+  auth: UpdateAuthSchema
+});
+function handleCreateCredential(request, vaultId) {
+  return routeWrap(request, async ({ auth }) => {
+    loadVaultForCaller(auth, vaultId);
+    const body = await request.json();
+    const parsed = CreateCredentialSchema.safeParse(body);
+    if (!parsed.success) throw badRequest(parsed.error.message);
+    const { auth: authData } = parsed.data;
+    try {
+      if (authData.type === "mcp_oauth") {
+        const refreshConfig = authData.refresh ? {
+          token_endpoint: authData.refresh.token_endpoint,
+          client_id: authData.refresh.client_id,
+          scope: authData.refresh.scope,
+          refresh_token: authData.refresh.refresh_token,
+          token_endpoint_auth: authData.refresh.token_endpoint_auth
+        } : null;
+        const cred2 = createCredential({
+          vault_id: vaultId,
+          display_name: parsed.data.display_name,
+          auth_type: "mcp_oauth",
+          token: authData.access_token,
+          mcp_server_url: authData.mcp_server_url ?? null,
+          expires_at: authData.expires_at ?? null,
+          refresh_config: refreshConfig
+        });
+        return jsonOk(cred2, 201);
+      }
+      const cred = createCredential({
+        vault_id: vaultId,
+        display_name: parsed.data.display_name,
+        auth_type: "static_bearer",
+        token: authData.token,
+        mcp_server_url: authData.mcp_server_url ?? null
+      });
+      return jsonOk(cred, 201);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes("UNIQUE constraint failed") || msg.includes("SQLITE_CONSTRAINT")) {
+        throw conflict(
+          `Credential "${parsed.data.display_name}" already exists in this vault`
+        );
+      }
+      throw err;
+    }
+  });
+}
+function handleListCredentials(request, vaultId) {
+  return routeWrap(request, async ({ auth, request: req }) => {
+    loadVaultForCaller(auth, vaultId);
+    const url = new URL(req.url);
+    const requestedLimit = Number(url.searchParams.get("limit") || "100");
+    const data = listCredentials(vaultId);
+    return jsonOk({
+      data,
+      has_more: data.length === requestedLimit,
+      first_id: data.length > 0 ? data[0].id : null,
+      last_id: data.length > 0 ? data[data.length - 1].id : null
+    });
+  });
+}
+function handleGetCredential(request, vaultId, credentialId) {
+  return routeWrap(request, async ({ auth }) => {
+    loadVaultForCaller(auth, vaultId);
+    const cred = getCredential(credentialId);
+    if (!cred || cred.vault_id !== vaultId) {
+      throw notFound(`credential not found: ${credentialId}`);
+    }
+    return jsonOk(cred);
+  });
+}
+function handleUpdateCredential(request, vaultId, credentialId) {
+  return routeWrap(request, async ({ auth }) => {
+    loadVaultForCaller(auth, vaultId);
+    const existing = getCredential(credentialId);
+    if (!existing || existing.vault_id !== vaultId) {
+      throw notFound(`credential not found: ${credentialId}`);
+    }
+    const body = await request.json();
+    const parsed = UpdateCredentialSchema.safeParse(body);
+    if (!parsed.success) throw badRequest(parsed.error.message);
+    try {
+      const authData = parsed.data.auth;
+      const isMcpOauth = existing.auth.type === "mcp_oauth" || authData?.type === "mcp_oauth";
+      if (isMcpOauth && authData) {
+        const refreshConfig = authData.refresh ? {
+          token_endpoint: authData.refresh.token_endpoint,
+          client_id: authData.refresh.client_id,
+          scope: authData.refresh.scope,
+          refresh_token: authData.refresh.refresh_token,
+          token_endpoint_auth: authData.refresh.token_endpoint_auth
+        } : void 0;
+        const updated2 = updateCredential(credentialId, {
+          display_name: parsed.data.display_name,
+          auth_type: authData.type,
+          token: authData.access_token,
+          expires_at: authData.expires_at,
+          refresh_config: refreshConfig
+        });
+        if (!updated2) throw notFound(`credential not found: ${credentialId}`);
+        return jsonOk(updated2);
+      }
+      const updated = updateCredential(credentialId, {
+        display_name: parsed.data.display_name,
+        auth_type: authData?.type,
+        token: authData?.token,
+        mcp_server_url: authData?.mcp_server_url
+      });
+      if (!updated) throw notFound(`credential not found: ${credentialId}`);
+      return jsonOk(updated);
+    } catch (err) {
+      if (err instanceof Error && (err.message.includes("UNIQUE constraint failed") || err.message.includes("SQLITE_CONSTRAINT"))) {
+        throw conflict(
+          `Credential "${parsed.data.display_name}" already exists in this vault`
+        );
+      }
+      throw err;
+    }
+  });
+}
+function handleDeleteCredential(request, vaultId, credentialId) {
+  return routeWrap(request, async ({ auth }) => {
+    loadVaultForCaller(auth, vaultId);
+    const existing = getCredential(credentialId);
+    if (!existing || existing.vault_id !== vaultId) {
+      throw notFound(`credential not found: ${credentialId}`);
+    }
+    const deleted = deleteCredential(credentialId);
+    if (!deleted) throw notFound(`credential not found: ${credentialId}`);
+    return jsonOk({ id: credentialId, type: "vault_credential_deleted" });
+  });
+}
+
+export {
+  handleCreateCredential,
+  handleListCredentials,
+  handleGetCredential,
+  handleUpdateCredential,
+  handleDeleteCredential
+};

package/dist/{chunk-ADK2TYO4.js → chunk-WHV4YUQB.js}

@@ -5,7 +5,7 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-SXE7H3VK.js";
+} from "./chunk-SLAOS6JN.js";
 import {
   schema_exports
 } from "./chunk-LHHBOQUR.js";

package/dist/{chunk-AWHHLOWE.js → chunk-WP5EWNGJ.js}

@@ -1,17 +1,17 @@
 import {
   listTraces
-} from "./chunk-JK5TPJHH.js";
+} from "./chunk-SXTHM67U.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-3QIIJADA.js";
+} from "./chunk-LOAFGJWC.js";
 import {
   exportTrace
-} from "./chunk-Y2KDIPCT.js";
+} from "./chunk-F3BVYYRX.js";
 import {
   listEventsByTrace,
   rowToManagedEvent
-} from "./chunk-O45IQUWS.js";
+} from "./chunk-5NBZZZKH.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-HDSLSNN5.js → chunk-X2EEOO6Q.js}

@@ -4,14 +4,14 @@ import {
 import {
   jsonOk,
   routeWrap
-} from "./chunk-3QIIJADA.js";
+} from "./chunk-LOAFGJWC.js";
 import {
   getProxiedTenantId
-} from "./chunk-NIOWKTIF.js";
+} from "./chunk-NT2AI5IE.js";
 import {
   getSession,
   updateSessionResources
-} from "./chunk-I5ZA45YL.js";
+} from "./chunk-QWGJS6V6.js";
 import {
   countResources,
   createResource,
@@ -19,11 +19,11 @@ import {
   getResource,
   init_session_resources,
   listResources
-} from "./chunk-R5OZHLAD.js";
+} from "./chunk-4PVPM2WC.js";
 import {
   getDb,
   init_client
-} from "./chunk-5GZEX4HV.js";
+} from "./chunk-4C7XJI2V.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-AQXCXWAZ.js → chunk-XQEMI2MI.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-EF5QCTEQ.js";
+} from "./chunk-EFDAVLKN.js";
 import {
   serverBusy
 } from "./chunk-EZYKRG4W.js";

package/dist/{chunk-OWP537VU.js → chunk-XTTHH5MF.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-EF5QCTEQ.js";
+} from "./chunk-EFDAVLKN.js";
 
 // src/backends/factory/auth.ts
 function buildFactoryAuthEnv() {

package/dist/{chunk-2BDD6OHG.js → chunk-XUNTHJIE.js}

@@ -444,6 +444,13 @@ function runMigrations(db) {
       UNIQUE(vault_id, display_name)
     )
   `);
+  const credCols = db.prepare(`PRAGMA table_info(vault_credentials)`).all();
+  if (!credCols.some((c) => c.name === "expires_at")) {
+    db.exec(`ALTER TABLE vault_credentials ADD COLUMN expires_at TEXT`);
+  }
+  if (!credCols.some((c) => c.name === "refresh_config_encrypted")) {
+    db.exec(`ALTER TABLE vault_credentials ADD COLUMN refresh_config_encrypted TEXT`);
+  }
   const sessCols3 = db.prepare(`PRAGMA table_info(sessions)`).all();
   if (sessCols3.some((c) => c.name === "sprite_name")) {
     db.exec(`ALTER TABLE sessions RENAME COLUMN sprite_name TO sandbox_name`);