@agentstep/agent-sdk 0.4.41 → 0.5.1

package/dist/{chunk-V5HWHJ4P.js → chunk-74E7GKUG.js}

@@ -1,6 +1,6 @@
 import {
   readSetting
-} from "./chunk-V7MTIMPB.js";
+} from "./chunk-GQYSSSVA.js";
 
 // src/lib/skills-cache.ts
 var DEFAULT_FEED_URL = "https://www.agentstep.com/v1/skills/feed";

package/dist/{chunk-DU7LSFQQ.js → chunk-7SY65LWY.js}

@@ -2,19 +2,19 @@ import {
   getSyncRow,
   getSyncedRemoteId,
   upsertSync
-} from "./chunk-L2RX552S.js";
+} from "./chunk-22OUZJAV.js";
 import {
   injectMcpAuthHeaders
-} from "./chunk-SV2B3P6B.js";
+} from "./chunk-DBFPJSOY.js";
 import {
   listEntries
-} from "./chunk-ZVXIZ2JD.js";
+} from "./chunk-VP527YC5.js";
 import {
   getEnvironment
-} from "./chunk-X6IQ57SC.js";
+} from "./chunk-H6OT5GUL.js";
 import {
   getAgent
-} from "./chunk-ZTH5JRZG.js";
+} from "./chunk-BCIFFAGW.js";
 
 // src/sync/anthropic.ts
 import { createHash } from "crypto";
@@ -47,10 +47,7 @@ async function syncAgent(agentId, vaultEntries, apiKey) {
   const agent = getAgent(agentId);
   if (!agent) throw new Error(`Agent ${agentId} not found`);
   const agentWithAuth = injectMcpAuthHeaders(agent, vaultEntries);
-  const mcpArray = agentWithAuth.mcp_servers ? Object.entries(agentWithAuth.mcp_servers).map(([name, config]) => ({
-    name,
-    ...config
-  })) : [];
+  const mcpArray = agentWithAuth.mcp_servers ?? [];
   const tools = agentWithAuth.tools && agentWithAuth.tools.length > 0 ? agentWithAuth.tools : [{ type: "agent_toolset_20260401" }];
   const agentConfig = {
     name: agentWithAuth.name,

package/dist/{chunk-JCW3ZRES.js → chunk-A46RUKGA.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-V7MTIMPB.js";
+} from "./chunk-GQYSSSVA.js";
 import {
   ApiError
 } from "./chunk-EZYKRG4W.js";

package/dist/{chunk-LZFB3HRK.js → chunk-AQB3P5ZP.js}

@@ -3,17 +3,17 @@ import {
   tenantFilter
 } from "./chunk-23UKWXJH.js";
 import {
-  jsonOk,
+  paginatedOk,
   routeWrap
-} from "./chunk-RH4GKU52.js";
+} from "./chunk-T3IGOI6Z.js";
 import {
   getSession,
   listSessions
-} from "./chunk-3NK6YTA5.js";
+} from "./chunk-KUWJJD6O.js";
 import {
   getDb,
   init_client
-} from "./chunk-6POQAFEC.js";
+} from "./chunk-W3JMIUHV.js";
 import {
   notFound
 } from "./chunk-EZYKRG4W.js";
@@ -39,12 +39,7 @@ function handleListThreads(request, sessionId) {
       // show all threads including completed ones
       tenantFilter: tenantFilter(auth)
     });
-    return jsonOk({
-      data,
-      has_more: data.length === requestedLimit,
-      first_id: data.length > 0 ? data[0].id : null,
-      last_id: data.length > 0 ? data[data.length - 1].id : null
-    });
+    return paginatedOk(data, requestedLimit);
   });
 }
 

package/dist/{chunk-RP6WQ4IH.js → chunk-B5EY2VJC.js}

@@ -3,21 +3,21 @@ import {
 } from "./chunk-23UKWXJH.js";
 import {
   recordAudit
-} from "./chunk-KLN6HPYM.js";
+} from "./chunk-L3IACZ72.js";
 import {
   requireFeature
 } from "./chunk-2N2KL4KM.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-RH4GKU52.js";
+} from "./chunk-T3IGOI6Z.js";
 import {
   archiveTenant,
   createTenant,
   getTenant,
   listTenants,
   renameTenant
-} from "./chunk-AR2TM7CR.js";
+} from "./chunk-I26QP3A3.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-ZTH5JRZG.js → chunk-BCIFFAGW.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_TENANT_ID
-} from "./chunk-AR2TM7CR.js";
+} from "./chunk-I26QP3A3.js";
 import {
   init_ids,
   newId
@@ -13,10 +13,10 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-R5T4LJSK.js";
+} from "./chunk-PZNAQBHQ.js";
 import {
   schema_exports
-} from "./chunk-ZMJ4EP4C.js";
+} from "./chunk-ILHIHMO3.js";
 
 // src/db/agents.ts
 init_drizzle();
@@ -24,14 +24,24 @@ init_ids();
 init_clock();
 import { eq, and, isNull, lt, gt, asc, desc } from "drizzle-orm";
 function hydrate(row, ver) {
+  const modelConfig = ver.model_config_json ? JSON.parse(ver.model_config_json) : {};
+  const rawMcp = ver.mcp_servers_json ? JSON.parse(ver.mcp_servers_json) : {};
+  const mcpServers = Array.isArray(rawMcp) ? rawMcp : Object.entries(rawMcp).map(([name, cfg]) => ({
+    name,
+    type: "url",
+    ...typeof cfg === "string" ? { url: cfg } : cfg
+  }));
   return {
+    type: "agent",
     id: row.id,
     version: ver.version,
     name: row.name,
-    model: ver.model,
+    description: row.description ?? "",
+    model: { id: ver.model, ...modelConfig.speed ? { speed: modelConfig.speed } : {} },
     system: ver.system,
     tools: JSON.parse(ver.tools_json),
-    mcp_servers: JSON.parse(ver.mcp_servers_json),
+    mcp_servers: mcpServers,
+    metadata: row.metadata_json ? JSON.parse(row.metadata_json) : {},
     engine: ver.backend ?? "claude",
     webhook_url: ver.webhook_url ?? null,
     webhook_events: ver.webhook_events_json ? JSON.parse(ver.webhook_events_json) : ["session.status_idle", "session.status_running", "session.error"],
@@ -40,10 +50,11 @@ function hydrate(row, ver) {
     confirmation_mode: Boolean(ver.confirmation_mode),
     callable_agents: ver.callable_agents_json ? JSON.parse(ver.callable_agents_json) : [],
     skills: ver.skills_json ? JSON.parse(ver.skills_json) : [],
-    model_config: ver.model_config_json ? JSON.parse(ver.model_config_json) : {},
+    model_config: modelConfig,
     fallback_json: row.fallback_json ?? null,
     created_at: toIso(row.created_at),
-    updated_at: toIso(row.updated_at)
+    updated_at: toIso(row.updated_at),
+    archived_at: row.archived_at ? new Date(row.archived_at).toISOString() : null
   };
 }
 function createAgent(input) {
@@ -55,6 +66,8 @@ function createAgent(input) {
       id,
       current_version: 1,
       name: input.name,
+      description: input.description ?? null,
+      metadata_json: JSON.stringify(input.metadata ?? {}),
       tenant_id: input.tenant_id ?? DEFAULT_TENANT_ID,
       created_at: now,
       updated_at: now
@@ -98,7 +111,10 @@ function updateAgent(id, input) {
   const db = getDrizzle();
   const existing = getAgent(id);
   if (!existing) return null;
-  const existingVer = db.select({ webhook_secret: schema_exports.agentVersions.webhook_secret }).from(schema_exports.agentVersions).where(
+  const existingVer = db.select({
+    webhook_secret: schema_exports.agentVersions.webhook_secret,
+    mcp_servers_json: schema_exports.agentVersions.mcp_servers_json
+  }).from(schema_exports.agentVersions).where(
     and(
       eq(schema_exports.agentVersions.agent_id, id),
       eq(schema_exports.agentVersions.version, existing.version)
@@ -111,10 +127,10 @@ function updateAgent(id, input) {
     tx.insert(schema_exports.agentVersions).values({
       agent_id: id,
       version: newVersion,
-      model: input.model ?? existing.model,
+      model: input.model ?? existing.model.id,
       system: input.system ?? existing.system,
       tools_json: JSON.stringify(input.tools ?? existing.tools),
-      mcp_servers_json: JSON.stringify(input.mcp_servers ?? existing.mcp_servers),
+      mcp_servers_json: input.mcp_servers ? JSON.stringify(input.mcp_servers) : existingVer?.mcp_servers_json ?? "{}",
       backend: existing.engine,
       webhook_url: input.webhook_url !== void 0 ? input.webhook_url : existing.webhook_url,
       webhook_events_json: JSON.stringify(input.webhook_events ?? existing.webhook_events),
@@ -129,6 +145,8 @@ function updateAgent(id, input) {
     tx.update(schema_exports.agents).set({
       current_version: newVersion,
       name: input.name ?? existing.name,
+      description: input.description !== void 0 ? input.description ?? null : existing.description || null,
+      metadata_json: input.metadata !== void 0 ? JSON.stringify(input.metadata) : JSON.stringify(existing.metadata),
       updated_at: now
     }).where(eq(schema_exports.agents.id, id)).run();
   });
@@ -139,6 +157,18 @@ function archiveAgent(id) {
   const res = db.update(schema_exports.agents).set({ archived_at: nowMs() }).where(and(eq(schema_exports.agents.id, id), isNull(schema_exports.agents.archived_at))).run();
   return res.changes > 0;
 }
+function listAgentVersions(agentId, opts) {
+  const db = getDrizzle();
+  const limit = Math.min(Math.max(opts.limit ?? 20, 1), 100);
+  const row = db.select().from(schema_exports.agents).where(eq(schema_exports.agents.id, agentId)).get();
+  if (!row) return [];
+  const conditions = [eq(schema_exports.agentVersions.agent_id, agentId)];
+  if (opts.cursor) {
+    conditions.push(lt(schema_exports.agentVersions.version, opts.cursor));
+  }
+  const versions = db.select().from(schema_exports.agentVersions).where(and(...conditions)).orderBy(desc(schema_exports.agentVersions.version)).limit(limit).all();
+  return versions.map((ver) => hydrate(row, ver));
+}
 function listAgents(opts) {
   const db = getDrizzle();
   const limit = Math.min(Math.max(opts.limit ?? 20, 1), 100);
@@ -165,5 +195,6 @@ export {
   getAgent,
   updateAgent,
   archiveAgent,
+  listAgentVersions,
   listAgents
 };

package/dist/{chunk-2Z2KAPUL.js → chunk-BJP5BIHE.js}

@@ -1,13 +1,13 @@
 import {
   jsonOk,
   routeWrap
-} from "./chunk-RH4GKU52.js";
+} from "./chunk-T3IGOI6Z.js";
 import {
   resolveContainerProvider
-} from "./chunk-WPK4ZPMG.js";
+} from "./chunk-JRQB3SHR.js";
 import {
   getConfig
-} from "./chunk-V7MTIMPB.js";
+} from "./chunk-GQYSSSVA.js";
 
 // src/handlers/providers.ts
 var LOCAL_PROVIDERS = ["docker", "apple-container", "podman"];

package/dist/{chunk-5EQJOUWM.js → chunk-C35ZTCBP.js}

@@ -1,10 +1,10 @@
 import {
   buildPiArgs
-} from "./chunk-T5VRE77P.js";
+} from "./chunk-6KWJASEO.js";
 import {
   buildPiAuthEnv,
   validatePiRuntime
-} from "./chunk-RVR6C22M.js";
+} from "./chunk-RT5S5KRX.js";
 import {
   preparePiOnSandbox
 } from "./chunk-QYSDP6V5.js";

package/dist/{chunk-OXWELRJL.js → chunk-CBPO2P4I.js}

@@ -78,13 +78,27 @@ var ModelConfigSchema = registry.register(
 var AgentSchema = registry.register(
   "Agent",
   z.object({
+    type: z.literal("agent"),
     id: UlidId,
     version: z.number().int().positive(),
     name: z.string(),
-    model: z.string(),
+    description: z.string().openapi({ description: "Human-readable description of the agent." }),
+    model: z.object({
+      id: z.string(),
+      speed: z.enum(["standard", "fast"]).optional()
+    }).openapi({ description: "Model configuration. `id` is the canonical model identifier." }),
     system: z.string().nullable(),
     tools: z.array(ToolConfigSchema),
-    mcp_servers: z.record(McpServerConfigSchema),
+    mcp_servers: z.array(z.object({
+      name: z.string(),
+      type: z.string(),
+      url: z.string().optional()
+    }).catchall(z.unknown())).openapi({
+      description: "MCP servers configured for this agent. Each entry has a name, type, and optional url."
+    }),
+    metadata: z.record(z.string()).openapi({
+      description: "Key-value metadata attached to the agent. Values must be strings."
+    }),
     engine: z.enum(["claude", "opencode", "codex", "anthropic", "gemini", "factory", "pi"]).openapi({
       description: "Which agent harness powers this agent. `claude` drives `claude -p`; `opencode` drives sst/opencode-ai's `opencode run`; `gemini` drives Google's `gemini -p`; `factory` drives Factory's `droid exec`; `pi` drives the pi.dev coding agent (`pi --mode json`). Immutable after agent creation."
     }),
@@ -94,12 +108,22 @@ var AgentSchema = registry.register(
     webhook_events: z.array(z.string()).openapi({
       description: "Event types that trigger webhook delivery. Defaults to status + error events."
     }),
+    webhook_signing_enabled: z.boolean().openapi({
+      description: "Whether a webhook shared secret is configured. The secret itself is never returned."
+    }),
     threads_enabled: z.boolean().openapi({
       description: "Whether this agent can spawn sub-agents via the spawn_agent tool."
     }),
     confirmation_mode: z.boolean().openapi({
       description: "Whether this agent requires tool confirmation via user.tool_confirmation events. When true, claude runs with --permission-mode default and a PermissionRequest hook bridges tool approvals to the MA API."
     }),
+    callable_agents: z.array(z.object({
+      type: z.literal("agent"),
+      id: z.string(),
+      version: z.number().int().optional()
+    })).openapi({
+      description: "Agents that can be called by this agent via the spawn_agent tool."
+    }),
     skills: z.array(AgentSkillSchema).openapi({
       description: "Skills injected into the container at session start. For Claude backend, written to .claude/skills/<name>/SKILL.md. For all backends, also written to .agents/skills/<name>/SKILL.md. Non-Claude backends also receive skills prepended to the system prompt."
     }),
@@ -107,17 +131,30 @@ var AgentSchema = registry.register(
       description: "Model configuration options. 'fast' speed enables fast mode on Claude (claude engine only)."
     }),
     created_at: IsoTimestamp,
-    updated_at: IsoTimestamp
+    updated_at: IsoTimestamp,
+    archived_at: IsoTimestamp.nullable()
   })
 );
 var CreateAgentRequestSchema = registry.register(
   "CreateAgentRequest",
   z.object({
     name: z.string().min(1).openapi({ example: "my-agent" }),
-    model: z.string().min(1).openapi({ example: "claude-sonnet-4-6" }),
+    model: z.object({ id: z.string().min(1), speed: z.enum(["standard", "fast"]).optional() }).openapi({ description: "Model configuration. `id` is the canonical model identifier.", example: { id: "claude-sonnet-4-6" } }),
+    description: z.string().max(2048).optional().openapi({
+      description: "Human-readable description of the agent."
+    }),
+    metadata: z.record(z.string(), z.string().max(512)).optional().openapi({
+      description: "Key-value metadata. Max 16 keys, values max 512 chars."
+    }),
     system: z.string().nullish().openapi({ example: "You are a helpful assistant." }),
     tools: z.array(ToolConfigSchema).optional(),
-    mcp_servers: z.record(McpServerConfigSchema).optional(),
+    mcp_servers: z.array(z.object({
+      name: z.string(),
+      type: z.string().optional(),
+      url: z.string().optional()
+    }).catchall(z.unknown())).optional().openapi({
+      description: "MCP servers as an array of objects with name, type, and optional url."
+    }),
     engine: z.enum(["claude", "opencode", "codex", "anthropic", "gemini", "factory", "pi"]).optional().openapi({
       description: "Agent harness. Defaults to `claude`. Opencode agents must set `model` to a `provider/model` string (e.g. `anthropic/claude-sonnet-4-6`) and must NOT declare `tools` \u2014 opencode manages its tool surface internally. Gemini agents require GEMINI_API_KEY. Factory agents require FACTORY_API_KEY. Pi agents (pi.dev) require at least one of ANTHROPIC_API_KEY, OPENAI_API_KEY, or GEMINI_API_KEY.",
       example: "claude"
@@ -143,7 +180,7 @@ var CreateAgentRequestSchema = registry.register(
   }).openapi({
     example: {
       name: "my-agent",
-      model: "claude-sonnet-4-6",
+      model: { id: "claude-sonnet-4-6" },
       system: "You are a helpful assistant.",
       tools: [{ type: "agent_toolset_20260401" }]
     }
@@ -152,11 +189,28 @@ var CreateAgentRequestSchema = registry.register(
 var UpdateAgentRequestSchema = registry.register(
   "UpdateAgentRequest",
   z.object({
+    version: z.number().int().min(1).openapi({
+      description: "Current agent version for optimistic concurrency. Must match the agent's current version."
+    }),
     name: z.string().min(1).optional(),
-    model: z.string().min(1).optional(),
+    model: z.object({ id: z.string().min(1), speed: z.enum(["standard", "fast"]).optional() }).optional().openapi({
+      description: "Model configuration. `id` is the canonical model identifier."
+    }),
+    description: z.string().max(2048).optional().openapi({
+      description: "Human-readable description of the agent."
+    }),
+    metadata: z.record(z.string(), z.string().max(512)).optional().openapi({
+      description: "Key-value metadata. Max 16 keys, values max 512 chars."
+    }),
     system: z.string().nullish(),
     tools: z.array(ToolConfigSchema).optional(),
-    mcp_servers: z.record(McpServerConfigSchema).optional(),
+    mcp_servers: z.array(z.object({
+      name: z.string(),
+      type: z.string().optional(),
+      url: z.string().optional()
+    }).catchall(z.unknown())).optional().openapi({
+      description: "MCP servers as an array of objects with name, type, and optional url."
+    }),
     skills: z.array(AgentSkillSchema).max(20).optional().openapi({
       description: "Updated skills list. Replaces the existing skills entirely."
     }),
@@ -198,6 +252,7 @@ var EnvironmentConfigSchema = registry.register(
 var EnvironmentSchema = registry.register(
   "Environment",
   z.object({
+    type: z.literal("environment"),
     id: UlidId,
     name: z.string(),
     description: z.string().nullable().openapi({
@@ -254,7 +309,10 @@ var SessionUsageSchema = z.object({
   input_tokens: z.number().int().nonnegative(),
   output_tokens: z.number().int().nonnegative(),
   cache_read_input_tokens: z.number().int().nonnegative(),
-  cache_creation_input_tokens: z.number().int().nonnegative(),
+  cache_creation: z.object({
+    ephemeral_5m_input_tokens: z.number().int().nonnegative(),
+    ephemeral_1h_input_tokens: z.number().int().nonnegative()
+  }),
   cost_usd: z.number().nonnegative()
 });
 var SessionStatusSchema = registry.register(
@@ -265,7 +323,18 @@ var SessionSchema = registry.register(
   "Session",
   z.object({
     id: UlidId,
-    agent: z.object({ id: UlidId, version: z.number().int().positive() }),
+    agent: z.object({
+      type: z.literal("agent"),
+      id: UlidId,
+      version: z.number().int().positive(),
+      name: z.string(),
+      description: z.string(),
+      model: z.object({ id: z.string(), speed: z.enum(["standard", "fast"]).optional() }),
+      system: z.string().nullable(),
+      tools: z.array(z.record(z.unknown())),
+      mcp_servers: z.array(z.record(z.unknown())),
+      skills: z.array(z.record(z.unknown()))
+    }),
     environment_id: UlidId,
     status: SessionStatusSchema,
     stop_reason: z.union([
@@ -425,11 +494,17 @@ var ManagedEventSchema = registry.register(
 var VaultSchema = registry.register(
   "Vault",
   z.object({
+    type: z.literal("vault"),
     id: UlidId,
-    agent_id: UlidId,
+    agent_id: UlidId.nullable().openapi({ description: "Owning agent ID. Null for unscoped vaults." }),
     name: z.string(),
+    display_name: z.string().openapi({ description: "Anthropic-compatible alias for `name`." }),
+    metadata: z.record(z.string()).openapi({
+      description: "Key-value metadata attached to the vault. Values must be strings."
+    }),
     created_at: IsoTimestamp,
-    updated_at: IsoTimestamp
+    updated_at: IsoTimestamp,
+    archived_at: IsoTimestamp.nullable()
   })
 );
 var VaultEntrySchema = registry.register(
@@ -442,10 +517,21 @@ var VaultEntrySchema = registry.register(
 var CreateVaultRequestSchema = registry.register(
   "CreateVaultRequest",
   z.object({
-    agent_id: UlidId.openapi({ example: "agent_01ABCDEFG..." }),
+    agent_id: UlidId.optional().openapi({ example: "agent_01ABCDEFG...", description: "Owning agent ID. Optional for unscoped vaults." }),
     name: z.string().min(1).openapi({ example: "my-vault" })
   })
 );
+var UpdateVaultRequestSchema = registry.register(
+  "UpdateVaultRequest",
+  z.object({
+    display_name: z.string().min(1).max(255).optional().openapi({
+      description: "Update the vault display name."
+    }),
+    metadata: z.record(z.string().max(512)).optional().openapi({
+      description: "Replaces the metadata entirely. Max 16 key-value pairs."
+    })
+  })
+);
 var SetVaultEntryRequestSchema = registry.register(
   "SetVaultEntryRequest",
   z.object({
@@ -555,9 +641,7 @@ var FileListResponseSchema = registry.register(
   "FileListResponse",
   z.object({
     data: z.array(FileRecordSchema),
-    has_more: z.boolean().openapi({ description: "Whether there are more results beyond this page." }),
-    first_id: z.string().nullable().openapi({ description: "ID of the first item in this page." }),
-    last_id: z.string().nullable().openapi({ description: "ID of the last item in this page." })
+    next_page: z.string().nullable().openapi({ description: "Opaque cursor for the next page, or null if no more results." })
   })
 );
 var FileDeletedResponseSchema = registry.register(
@@ -1093,6 +1177,7 @@ export {
   VaultSchema,
   VaultEntrySchema,
   CreateVaultRequestSchema,
+  UpdateVaultRequestSchema,
   SetVaultEntryRequestSchema,
   VaultDeletedResponseSchema,
   VaultEntryDeletedResponseSchema,

package/dist/{chunk-HH4OXSOV.js → chunk-CE366H6Z.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-23UKWXJH.js";
 import {
   recordAudit
-} from "./chunk-KLN6HPYM.js";
+} from "./chunk-L3IACZ72.js";
 import {
   COMMUNITY_LIMITS,
   hasFeature,
@@ -15,7 +15,7 @@ import {
 import {
   jsonOk,
   routeWrap
-} from "./chunk-RH4GKU52.js";
+} from "./chunk-T3IGOI6Z.js";
 import {
   createApiKey,
   getApiKeyById,
@@ -23,14 +23,14 @@ import {
   listApiKeys,
   revokeApiKey,
   updateApiKeyPermissions
-} from "./chunk-USYY3L7G.js";
+} from "./chunk-T3FQPTOA.js";
 import {
   listSessionsByApiKey
-} from "./chunk-3NK6YTA5.js";
+} from "./chunk-KUWJJD6O.js";
 import {
   getDb,
   init_client
-} from "./chunk-6POQAFEC.js";
+} from "./chunk-W3JMIUHV.js";
 import {
   badRequest,
   forbidden,

package/dist/{chunk-C46UG6GQ.js → chunk-CKFJN5XK.js}

@@ -4,7 +4,7 @@ import {
 import {
   getConfig,
   readSetting
-} from "./chunk-V7MTIMPB.js";
+} from "./chunk-GQYSSSVA.js";
 import {
   __commonJS
 } from "./chunk-2ESYSVXG.js";

package/dist/{chunk-YBZJHDSE.js → chunk-COZG53R3.js}

@@ -4,11 +4,11 @@ import {
   getSources,
   getStats,
   searchSkills
-} from "./chunk-V5HWHJ4P.js";
+} from "./chunk-74E7GKUG.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-RH4GKU52.js";
+} from "./chunk-T3IGOI6Z.js";
 
 // src/handlers/skills.ts
 async function handleGetSkillsCatalog(request) {

package/dist/{chunk-SV2B3P6B.js → chunk-DBFPJSOY.js}

@@ -1,11 +1,12 @@
 // src/sessions/mcp-auth.ts
 function injectMcpAuthHeaders(agent, vaultEntries) {
   const mcpServers = agent.mcp_servers;
-  if (!mcpServers || Object.keys(mcpServers).length === 0) return agent;
+  if (!mcpServers || mcpServers.length === 0) return agent;
   if (vaultEntries.length === 0) return agent;
   const serverLookup = /* @__PURE__ */ new Map();
-  for (const name of Object.keys(mcpServers)) {
-    serverLookup.set(name.toUpperCase().replace(/-/g, "_"), name);
+  for (let i = 0; i < mcpServers.length; i++) {
+    const name = mcpServers[i].name;
+    serverLookup.set(name.toUpperCase().replace(/-/g, "_"), i);
   }
   let mutated = false;
   const merged = {};
@@ -13,10 +14,10 @@ function injectMcpAuthHeaders(agent, vaultEntries) {
     const authMatch = /^MCP_AUTH_(.+)$/i.exec(key);
     if (authMatch) {
       const norm = authMatch[1].toUpperCase();
-      const serverName = serverLookup.get(norm);
-      if (serverName) {
-        merged[serverName] = merged[serverName] ?? {};
-        merged[serverName]["Authorization"] = `Bearer ${value}`;
+      const idx = serverLookup.get(norm);
+      if (idx !== void 0) {
+        merged[idx] = merged[idx] ?? {};
+        merged[idx]["Authorization"] = `Bearer ${value}`;
         mutated = true;
       }
       continue;
@@ -28,10 +29,10 @@ function injectMcpAuthHeaders(agent, vaultEntries) {
       for (let i = parts.length - 1; i >= 1; i--) {
         const serverPart = parts.slice(0, i).join("_").toUpperCase();
         const headerPart = parts.slice(i).join("-");
-        const serverName = serverLookup.get(serverPart);
-        if (serverName) {
-          merged[serverName] = merged[serverName] ?? {};
-          merged[serverName][headerPart] = value;
+        const idx = serverLookup.get(serverPart);
+        if (idx !== void 0) {
+          merged[idx] = merged[idx] ?? {};
+          merged[idx][headerPart] = value;
           mutated = true;
           break;
         }
@@ -39,13 +40,14 @@ function injectMcpAuthHeaders(agent, vaultEntries) {
     }
   }
   if (!mutated) return agent;
-  const newServers = { ...mcpServers };
-  for (const [name, headers] of Object.entries(merged)) {
-    newServers[name] = {
-      ...newServers[name],
-      headers: { ...newServers[name].headers, ...headers }
+  const newServers = mcpServers.map((server, idx) => {
+    const headers = merged[idx];
+    if (!headers) return server;
+    return {
+      ...server,
+      headers: { ...server.headers, ...headers }
     };
-  }
+  });
   return { ...agent, mcp_servers: newServers };
 }
 

package/dist/{chunk-NQVRZAIX.js → chunk-DMMNAQUM.js}

@@ -10,10 +10,10 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-R5T4LJSK.js";
+} from "./chunk-PZNAQBHQ.js";
 import {
   schema_exports
-} from "./chunk-ZMJ4EP4C.js";
+} from "./chunk-ILHIHMO3.js";
 
 // src/db/files.ts
 init_drizzle();

package/dist/{chunk-JWH4OIBP.js → chunk-DRNZ24RF.js}

@@ -1,17 +1,17 @@
 import {
   listTraces
-} from "./chunk-6GP5IKXE.js";
+} from "./chunk-XSNJ7NT2.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-RH4GKU52.js";
+} from "./chunk-T3IGOI6Z.js";
 import {
   exportTrace
-} from "./chunk-GVPJL3XS.js";
+} from "./chunk-MZYJFU4K.js";
 import {
   listEventsByTrace,
   rowToManagedEvent
-} from "./chunk-TH7WJLZC.js";
+} from "./chunk-KGBKIJPF.js";
 import {
   badRequest,
   notFound