@apart-tech/intelligence-core 1.11.4 → 1.11.5

package/dist/index.js

@@ -7,6 +7,9 @@ export { encryptAesGcm, decryptAesGcm, deriveKey, deriveKeyV2 } from "./lib/cryp
 export { getAgentKeySecret, getPiiKeySecret, getEmbeddingKeySecret } from "./lib/encryption-keys.js";
 // JWT
 export { verifyAuth0Jwt } from "./lib/jwt.js";
+export { isUserPrincipal, isOrgAgentPrincipal, isDelegatedAgentPrincipal, } from "./auth/principal.js";
+export { buildAbility, intersect, UnsupportedIntersectionError, } from "./auth/ability.js";
+export { DELEGATION_ALGORITHM, DELEGATION_ISSUER, DELEGATION_KEY_MIN_BYTES, DELEGATION_TTL_SECONDS, DelegationKeyLoadError, DelegationTokenError, loadDelegationKeyFromEnv, mintDelegationToken, peekIssuer, verifyDelegationToken, } from "./auth/delegation-jwt.js";
 // Types
 export * from "./types/index.js";
 // Config
@@ -27,11 +30,14 @@ export { OrgAgentConfigService } from "./services/org-agent-config-service.js";
 export { OrgAgentTypeService } from "./services/org-agent-type-service.js";
 export { OrgMcpServerService } from "./services/org-mcp-server-service.js";
 export { AgentRunService } from "./services/agent-run-service.js";
+export { AuditEventService } from "./services/audit-event-service.js";
+export { cancelOrphanedAgentRuns } from "./services/delegation-cleanup-service.js";
 export { AgentScheduleService } from "./services/agent-schedule-service.js";
 export { CLI_REFERENCE } from "./services/agent-cli-reference.js";
 export { UserService } from "./services/user-service.js";
 export { MembershipService } from "./services/membership-service.js";
 export { InviteService } from "./services/invite-service.js";
+export { UsageService } from "./services/usage-service.js";
 // Providers
 export { createEmbeddingProvider, validateEmbeddingKey, OpenAIEmbeddingProvider, VoyageEmbeddingProvider, OllamaEmbeddingProvider } from "./providers/index.js";
 export { BatchingEmbeddingProvider } from "./providers/batching.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,WAAW;AACX,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGvF,SAAS;AACT,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAErG,MAAM;AACN,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,WAAW;AACX,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAG3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAG7D,YAAY;AACZ,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEhK,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,WAAW;AACX,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGvF,SAAS;AACT,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAErG,MAAM;AACN,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAW9C,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,YAAY,EACZ,SAAS,EACT,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAS3B,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,UAAU,EACV,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAElC,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,WAAW;AACX,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAG3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAE3E,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAMtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAKnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAG3D,YAAY;AACZ,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEhK,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/lib/__tests__/jwt.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=jwt.test.d.ts.map

package/dist/lib/__tests__/jwt.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.test.d.ts","sourceRoot":"","sources":["../../../src/lib/__tests__/jwt.test.ts"],"names":[],"mappings":""}

package/dist/lib/__tests__/jwt.test.js

@@ -0,0 +1,97 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { JWKS_CACHE_MAX_AGE_MS, JWKS_COOLDOWN_MS, createAuth0JwksResolver, resetJwksCache, verifyAuth0Jwt, } from "../jwt.js";
+// A minimal JWKS response body. jose parses this on reload() but won't
+// fail just because the keys are not usable for real verification —
+// failure only happens when a JWT is actually verified against a key.
+const FAKE_JWKS_BODY = JSON.stringify({
+    keys: [
+        {
+            kty: "RSA",
+            kid: "test-key-1",
+            use: "sig",
+            alg: "RS256",
+            n: "xGP_acGn7xCn3OQ0qoBXwOyw5nSGY3SnlbSXr3QxBOQPfOSmM0wQ4TgKGhY0t5T3pNS6EHF3OwBf3jL5p8O5_yQ",
+            e: "AQAB",
+        },
+    ],
+});
+function fakeJwksFetch(counter) {
+    return async (_url, _init) => {
+        counter.calls += 1;
+        return new Response(FAKE_JWKS_BODY, {
+            status: 200,
+            headers: { "content-type": "application/json" },
+        });
+    };
+}
+describe("JWKS bounded cache (finding M6)", () => {
+    afterEach(() => {
+        resetJwksCache();
+    });
+    it("publishes explicit cache bounds as source-visible constants", () => {
+        // The finding is that the JWKS cache has no visible invalidation.
+        // Closing it means the bounds live in our source, not in a library
+        // default that a future version bump could silently change.
+        expect(JWKS_CACHE_MAX_AGE_MS).toBe(5 * 60 * 1000);
+        expect(JWKS_COOLDOWN_MS).toBe(30 * 1000);
+    });
+    it("reload() on a fresh resolver triggers exactly one fetch", async () => {
+        const counter = { calls: 0 };
+        const resolver = createAuth0JwksResolver("example.auth0.com", {
+            cacheMaxAgeMs: 50,
+            cooldownMs: 0,
+            fetchImpl: fakeJwksFetch(counter),
+        });
+        await resolver.reload();
+        expect(counter.calls).toBe(1);
+        expect(resolver.fresh).toBe(true);
+    });
+    it("fresh becomes false after cacheMaxAge elapses", async () => {
+        const counter = { calls: 0 };
+        const resolver = createAuth0JwksResolver("example.auth0.com", {
+            cacheMaxAgeMs: 30,
+            cooldownMs: 0,
+            fetchImpl: fakeJwksFetch(counter),
+        });
+        await resolver.reload();
+        expect(resolver.fresh).toBe(true);
+        // Wait past cacheMaxAge. After this, jose's bounded-age check
+        // returns false, which is the signal that triggers automatic
+        // refetch on the next verification attempt.
+        await new Promise((r) => setTimeout(r, 60));
+        expect(resolver.fresh).toBe(false);
+    });
+    it("a second reload after cache expiry triggers a second fetch", async () => {
+        // The core M6 guarantee: a rotated/compromised signing key at
+        // Auth0 cannot stay trusted indefinitely. After cacheMaxAge
+        // elapses, jose re-fetches the JWKS — observable here via the
+        // mock fetch's call counter.
+        const counter = { calls: 0 };
+        const resolver = createAuth0JwksResolver("example.auth0.com", {
+            cacheMaxAgeMs: 20,
+            cooldownMs: 0,
+            fetchImpl: fakeJwksFetch(counter),
+        });
+        await resolver.reload();
+        expect(counter.calls).toBe(1);
+        await new Promise((r) => setTimeout(r, 40));
+        await resolver.reload();
+        expect(counter.calls).toBe(2);
+    });
+});
+describe("verifyAuth0Jwt", () => {
+    afterEach(() => {
+        resetJwksCache();
+    });
+    it("rejects a malformed token without touching the network", async () => {
+        // Sanity regression: verifyAuth0Jwt should fail fast on obviously
+        // invalid input. jose throws a parse error before any JWKS
+        // retrieval is attempted, so this is safe to run without
+        // mocking the network.
+        await expect(verifyAuth0Jwt("not-a-real-jwt", {
+            domain: "example.auth0.com",
+            audience: "https://api.example.com",
+        })).rejects.toThrow();
+    });
+});
+//# sourceMappingURL=jwt.test.js.map

package/dist/lib/__tests__/jwt.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.test.js","sourceRoot":"","sources":["../../../src/lib/__tests__/jwt.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,uEAAuE;AACvE,oEAAoE;AACpE,sEAAsE;AACtE,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;IACpC,IAAI,EAAE;QACJ;YACE,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,YAAY;YACjB,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO;YACZ,CAAC,EAAE,yFAAyF;YAC5F,CAAC,EAAE,MAAM;SACV;KACF;CACF,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO,KAAK,EAAE,IAAkB,EAAE,KAAmB,EAAqB,EAAE;QAC1E,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE;YAClC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,SAAS,CAAC,GAAG,EAAE;QACb,cAAc,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,kEAAkE;QAClE,mEAAmE;QACnE,4DAA4D;QAC5D,MAAM,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,mBAAmB,EAAE;YAC5D,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC;SAClC,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAExB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,mBAAmB,EAAE;YAC5D,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC;SAClC,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,8DAA8D;QAC9D,6DAA6D;QAC7D,4CAA4C;QAC5C,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAE5C,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,8DAA8D;QAC9D,4DAA4D;QAC5D,8DAA8D;QAC9D,6BAA6B;QAC7B,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,uBAAuB,CAAC,mBAAmB,EAAE;YAC5D,aAAa,EAAE,EAAE;YACjB,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC;SAClC,CAAC,CAAC;QAEH,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE9B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC;QAExB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,SAAS,CAAC,GAAG,EAAE;QACb,cAAc,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,kEAAkE;QAClE,2DAA2D;QAC3D,yDAAyD;QACzD,uBAAuB;QACvB,MAAM,MAAM,CACV,cAAc,CAAC,gBAAgB,EAAE;YAC/B,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,yBAAyB;SACpC,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/jwt.d.ts

@@ -1,3 +1,4 @@
+import { createRemoteJWKSet } from "jose";
 import type { JWTPayload } from "jose";
 export interface Auth0Config {
     domain: string;
@@ -6,8 +7,27 @@ export interface Auth0Config {
 export interface Auth0JwtPayload extends JWTPayload {
     sub: string;
     email?: string;
+    email_verified?: boolean;
     name?: string;
     org_id?: string;
 }
+export declare const JWKS_CACHE_MAX_AGE_MS: number;
+export declare const JWKS_COOLDOWN_MS: number;
+export type JwksResolver = ReturnType<typeof createRemoteJWKSet>;
+/**
+ * Build a remote JWKS resolver for an Auth0 domain with bounded caching.
+ * Exported for test injection; production callers use {@link getJWKS}.
+ */
+export declare function createAuth0JwksResolver(domain: string, options?: {
+    cacheMaxAgeMs?: number;
+    cooldownMs?: number;
+    fetchImpl?: (url: URL | string, init?: RequestInit) => Promise<Response>;
+}): JwksResolver;
+/**
+ * Invalidate the per-process JWKS cache for a given Auth0 domain.
+ * Intended for tests and for manual revocation flows. Production auth
+ * flows rely on the bounded cacheMaxAge above to rotate keys.
+ */
+export declare function resetJwksCache(domain?: string): void;
 export declare function verifyAuth0Jwt(token: string, config: Auth0Config): Promise<Auth0JwtPayload>;
 //# sourceMappingURL=jwt.d.ts.map

package/dist/lib/jwt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEvC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAaD,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,eAAe,CAAC,CAc1B"}
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA0B,MAAM,MAAM,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAEvC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAsBD,eAAO,MAAM,qBAAqB,QAAgB,CAAC;AACnD,eAAO,MAAM,gBAAgB,QAAY,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIjE;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC1E,GACA,YAAY,CAcd;AAUD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAMpD;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,eAAe,CAAC,CAc1B"}

package/dist/lib/jwt.js

@@ -1,13 +1,66 @@
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
+// Bounded JWKS cache for Auth0 signing keys (closes finding M6).
+//
+// jose's createRemoteJWKSet has three relevant knobs: cooldownDuration
+// (minimum gap between HTTP refetches triggered by kid misses),
+// cacheMaxAge (maximum age before a refetch is mandatory regardless of
+// kid state), and reload() (manual invalidation). We configure the
+// first two explicitly so the security bounds are visible at the call
+// site instead of inherited from whatever jose's defaults happen to be
+// in the currently installed version.
+//
+// Exposure window for a compromised or rotated Auth0 signing key:
+//   - worst case ≤ JWKS_CACHE_MAX_AGE_MS (5 minutes) before jose
+//     force-refetches and drops the stale key from its internal cache.
+//   - best case: the next token Auth0 issues carries a kid not in
+//     cache, jose refetches immediately (subject to cooldown).
+//
+// We intentionally use a tighter cacheMaxAge than jose's 10-minute
+// default because Auth0 key rotations and key compromises are both
+// security-critical events where we'd rather hit jwks.json every few
+// minutes than trust a stale key for longer.
+export const JWKS_CACHE_MAX_AGE_MS = 5 * 60 * 1000;
+export const JWKS_COOLDOWN_MS = 30 * 1000;
 const jwksCache = new Map();
+/**
+ * Build a remote JWKS resolver for an Auth0 domain with bounded caching.
+ * Exported for test injection; production callers use {@link getJWKS}.
+ */
+export function createAuth0JwksResolver(domain, options) {
+    const url = new URL(`https://${domain}/.well-known/jwks.json`);
+    const createOpts = {
+        cacheMaxAge: options?.cacheMaxAgeMs ?? JWKS_CACHE_MAX_AGE_MS,
+        cooldownDuration: options?.cooldownMs ?? JWKS_COOLDOWN_MS,
+    };
+    if (options?.fetchImpl) {
+        // jose exposes a named `customFetch` symbol for fetch injection;
+        // tests pass their mock in this way. Production callers never
+        // need it — the default fetch is used.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        createOpts[customFetch] = options.fetchImpl;
+    }
+    return createRemoteJWKSet(url, createOpts);
+}
 function getJWKS(domain) {
     const key = domain;
     if (!jwksCache.has(key)) {
-        const url = new URL(`https://${domain}/.well-known/jwks.json`);
-        jwksCache.set(key, createRemoteJWKSet(url));
+        jwksCache.set(key, createAuth0JwksResolver(domain));
     }
     return jwksCache.get(key);
 }
+/**
+ * Invalidate the per-process JWKS cache for a given Auth0 domain.
+ * Intended for tests and for manual revocation flows. Production auth
+ * flows rely on the bounded cacheMaxAge above to rotate keys.
+ */
+export function resetJwksCache(domain) {
+    if (domain) {
+        jwksCache.delete(domain);
+    }
+    else {
+        jwksCache.clear();
+    }
+}
 export async function verifyAuth0Jwt(token, config) {
     const jwks = getJWKS(config.domain);
     const issuer = `https://${config.domain}/`;

package/dist/lib/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAerD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC;IACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,MAAM,wBAAwB,CAAC,CAAC;QAC/D,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,MAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC;IAE3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;KACP,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,OAA0B,CAAC;AACpC,CAAC"}
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../../src/lib/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAgBlE,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,gEAAgE;AAChE,uEAAuE;AACvE,mEAAmE;AACnE,sEAAsE;AACtE,uEAAuE;AACvE,sCAAsC;AACtC,EAAE;AACF,kEAAkE;AAClE,iEAAiE;AACjE,uEAAuE;AACvE,kEAAkE;AAClE,+DAA+D;AAC/D,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,qEAAqE;AACrE,6CAA6C;AAC7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAI1C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAwB,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,OAIC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,MAAM,wBAAwB,CAAC,CAAC;IAC/D,MAAM,UAAU,GAA6C;QAC3D,WAAW,EAAE,OAAO,EAAE,aAAa,IAAI,qBAAqB;QAC5D,gBAAgB,EAAE,OAAO,EAAE,UAAU,IAAI,gBAAgB;KAC1D,CAAC;IACF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,iEAAiE;QACjE,8DAA8D;QAC9D,uCAAuC;QACvC,8DAA8D;QAC7D,UAAkB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACvD,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC;IACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,IAAI,MAAM,EAAE,CAAC;QACX,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,MAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC;IAE3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;QAC/C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM;KACP,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,OAA0B,CAAC;AACpC,CAAC"}

package/dist/services/__tests__/delegation-cleanup-service.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=delegation-cleanup-service.test.d.ts.map

package/dist/services/__tests__/delegation-cleanup-service.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-cleanup-service.test.d.ts","sourceRoot":"","sources":["../../../src/services/__tests__/delegation-cleanup-service.test.ts"],"names":[],"mappings":""}

package/dist/services/__tests__/delegation-cleanup-service.test.js

@@ -0,0 +1,211 @@
+import { describe, expect, it, vi } from "vitest";
+import { cancelOrphanedAgentRuns, } from "../delegation-cleanup-service.js";
+/**
+ * Tiny in-memory fake that satisfies `DelegationCleanupDb`. Uses the
+ * actual Prisma call shapes so the production call sites stay honest
+ * — if the real service ever changes its call arguments, these tests
+ * will catch it via the narrow interface. Audit writes are captured
+ * in-memory so tests can assert on their content.
+ */
+function makeFakeDb(init) {
+    const auditCalls = [];
+    const updatedRuns = [];
+    const db = {
+        agentRun: {
+            findMany: vi.fn(async (_args) => init.pendingRuns.map((r) => ({
+                id: r.id,
+                organizationId: r.organizationId,
+                invokedByUserId: r.invokedByUserId,
+            }))),
+            updateMany: vi.fn(async (args) => {
+                if (init.failBulkUpdate) {
+                    throw new Error("bulk update intentionally failing");
+                }
+                const ids = args.where.id.in;
+                updatedRuns.push(...ids);
+                return { count: ids.length };
+            }),
+        },
+        membership: {
+            findUnique: vi.fn(async (args) => {
+                const runId = [...init.pendingRuns]
+                    .find((r) => r.invokedByUserId === args.where.userId_organizationId.userId &&
+                    r.organizationId === args.where.userId_organizationId.organizationId)?.id;
+                if (runId && init.failMembershipLookup?.has(runId)) {
+                    throw new Error(`membership lookup intentionally failing for ${runId}`);
+                }
+                const key = `${args.where.userId_organizationId.userId}:${args.where.userId_organizationId.organizationId}`;
+                return init.memberships.has(key) ? { id: `membership-${key}` } : null;
+            }),
+        },
+        auditEvent: {
+            create: vi.fn(async (args) => {
+                auditCalls.push(args.data);
+                return args.data;
+            }),
+        },
+    };
+    return { db, auditCalls, updatedRuns };
+}
+describe("cancelOrphanedAgentRuns", () => {
+    it("cancels runs whose invoking user has no membership in the org", async () => {
+        const { db, auditCalls, updatedRuns } = makeFakeDb({
+            pendingRuns: [
+                {
+                    id: "run-1",
+                    organizationId: "org-1",
+                    invokedByUserId: "user-a",
+                    status: "pending",
+                },
+            ],
+            memberships: new Set(), // user-a has no memberships
+        });
+        const result = await cancelOrphanedAgentRuns(db);
+        expect(result.scannedCount).toBe(1);
+        expect(result.cancelledRunIds).toEqual(["run-1"]);
+        expect(updatedRuns).toEqual(["run-1"]);
+        expect(auditCalls).toHaveLength(1);
+        expect(auditCalls[0]).toMatchObject({
+            agentRunId: "run-1",
+            action: "delegation.revoke",
+            result: "allow",
+            principalType: "system",
+            principalId: "delegation-cleanup",
+        });
+    });
+    it("leaves runs whose invoking user still has a membership", async () => {
+        const { db, updatedRuns, auditCalls } = makeFakeDb({
+            pendingRuns: [
+                {
+                    id: "run-active",
+                    organizationId: "org-1",
+                    invokedByUserId: "user-a",
+                    status: "running",
+                },
+            ],
+            memberships: new Set(["user-a:org-1"]),
+        });
+        const result = await cancelOrphanedAgentRuns(db);
+        expect(result.scannedCount).toBe(1);
+        expect(result.cancelledRunIds).toEqual([]);
+        expect(updatedRuns).toEqual([]);
+        expect(auditCalls).toEqual([]);
+    });
+    it("leaves runs whose invokedByUserId is null (API-key-authored)", async () => {
+        // findMany's WHERE already filters `invokedByUserId: not null`,
+        // so the fake wouldn't return these in practice — but the inner
+        // loop also has a belt-and-braces guard for `!run.invokedByUserId`
+        // and this test documents the intent.
+        const { db, updatedRuns } = makeFakeDb({
+            pendingRuns: [
+                {
+                    id: "run-legacy",
+                    organizationId: "org-1",
+                    invokedByUserId: null,
+                    status: "pending",
+                },
+            ],
+            memberships: new Set(),
+        });
+        const result = await cancelOrphanedAgentRuns(db);
+        expect(result.cancelledRunIds).toEqual([]);
+        expect(updatedRuns).toEqual([]);
+    });
+    it("processes a mix of orphaned and active runs in one sweep", async () => {
+        const { db, updatedRuns, auditCalls } = makeFakeDb({
+            pendingRuns: [
+                {
+                    id: "run-orphan",
+                    organizationId: "org-1",
+                    invokedByUserId: "user-gone",
+                    status: "pending",
+                },
+                {
+                    id: "run-active",
+                    organizationId: "org-1",
+                    invokedByUserId: "user-still-here",
+                    status: "running",
+                },
+                {
+                    id: "run-orphan-other-org",
+                    organizationId: "org-2",
+                    invokedByUserId: "user-still-here",
+                    status: "pending",
+                },
+            ],
+            memberships: new Set(["user-still-here:org-1"]),
+        });
+        const result = await cancelOrphanedAgentRuns(db);
+        expect(result.scannedCount).toBe(3);
+        expect(new Set(result.cancelledRunIds)).toEqual(new Set(["run-orphan", "run-orphan-other-org"]));
+        expect(new Set(updatedRuns)).toEqual(new Set(["run-orphan", "run-orphan-other-org"]));
+        expect(auditCalls).toHaveLength(2);
+        const auditedIds = auditCalls.map((a) => a.agentRunId).sort();
+        expect(auditedIds).toEqual(["run-orphan", "run-orphan-other-org"]);
+    });
+    it("continues the sweep when an individual membership lookup throws", async () => {
+        const { db, updatedRuns } = makeFakeDb({
+            pendingRuns: [
+                {
+                    id: "run-bad",
+                    organizationId: "org-1",
+                    invokedByUserId: "user-bad",
+                    status: "pending",
+                },
+                {
+                    id: "run-good",
+                    organizationId: "org-1",
+                    invokedByUserId: "user-gone",
+                    status: "pending",
+                },
+            ],
+            memberships: new Set(),
+            failMembershipLookup: new Set(["run-bad"]),
+        });
+        // Suppress the expected console.error from the sweep's catch block.
+        const consoleErrorSpy = vi
+            .spyOn(console, "error")
+            .mockImplementation(() => { });
+        const result = await cancelOrphanedAgentRuns(db);
+        consoleErrorSpy.mockRestore();
+        // run-bad was skipped (lookup threw) and run-good was cancelled.
+        // scannedCount still reflects both because the sweep read both.
+        expect(result.scannedCount).toBe(2);
+        expect(result.cancelledRunIds).toEqual(["run-good"]);
+        expect(updatedRuns).toEqual(["run-good"]);
+    });
+    it("returns empty cancelledRunIds when the bulk update fails", async () => {
+        const { db, updatedRuns, auditCalls } = makeFakeDb({
+            pendingRuns: [
+                {
+                    id: "run-1",
+                    organizationId: "org-1",
+                    invokedByUserId: "user-a",
+                    status: "pending",
+                },
+            ],
+            memberships: new Set(),
+            failBulkUpdate: true,
+        });
+        const consoleErrorSpy = vi
+            .spyOn(console, "error")
+            .mockImplementation(() => { });
+        const result = await cancelOrphanedAgentRuns(db);
+        consoleErrorSpy.mockRestore();
+        expect(result.cancelledRunIds).toEqual([]);
+        expect(updatedRuns).toEqual([]);
+        // No audit events because no runs successfully transitioned.
+        expect(auditCalls).toEqual([]);
+    });
+    it("is a no-op when there are no pending runs at all", async () => {
+        const { db, updatedRuns, auditCalls } = makeFakeDb({
+            pendingRuns: [],
+            memberships: new Set(),
+        });
+        const result = await cancelOrphanedAgentRuns(db);
+        expect(result).toEqual({ scannedCount: 0, cancelledRunIds: [] });
+        expect(updatedRuns).toEqual([]);
+        expect(auditCalls).toEqual([]);
+    });
+});
+//# sourceMappingURL=delegation-cleanup-service.test.js.map

package/dist/services/__tests__/delegation-cleanup-service.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-cleanup-service.test.js","sourceRoot":"","sources":["../../../src/services/__tests__/delegation-cleanup-service.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAElD,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAE1C;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,IAUnB;IACC,MAAM,UAAU,GAAmC,EAAE,CAAC;IACtD,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,MAAM,EAAE,GAAwB;QAC9B,QAAQ,EAAE;YACR,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,eAAe,EAAE,CAAC,CAAC,eAAe;aACnC,CAAC,CAAC,CACJ;YACD,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC/B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACvD,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7B,WAAW,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;gBACzB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/B,CAAC,CAAC;SACH;QACD,UAAU,EAAE;YACV,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;qBAChC,IAAI,CACH,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM;oBAC7D,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,cAAc,CACvE,EAAE,EAAE,CAAC;gBACR,IAAI,KAAK,IAAI,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACnD,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,cAAc,EAAE,CAAC;gBAC5G,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,cAAc,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACxE,CAAC,CAAC;SACH;QACD,UAAU,EAAE;YACV,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC3B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,IAAI,CAAC,IAAI,CAAC;YACnB,CAAC,CAAC;SACH;KACF,CAAC;IAEF,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC;YACjD,WAAW,EAAE;gBACX;oBACE,EAAE,EAAE,OAAO;oBACX,cAAc,EAAE,OAAO;oBACvB,eAAe,EAAE,QAAQ;oBACzB,MAAM,EAAE,SAAS;iBAClB;aACF;YACD,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,4BAA4B;SACrD,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAClC,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,OAAO;YACf,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,oBAAoB;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;YACjD,WAAW,EAAE;gBACX;oBACE,EAAE,EAAE,YAAY;oBAChB,cAAc,EAAE,OAAO;oBACvB,eAAe,EAAE,QAAQ;oBACzB,MAAM,EAAE,SAAS;iBAClB;aACF;YACD,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC;SACvC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,gEAAgE;QAChE,gEAAgE;QAChE,mEAAmE;QACnE,sCAAsC;QACtC,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC;YACrC,WAAW,EAAE;gBACX;oBACE,EAAE,EAAE,YAAY;oBAChB,cAAc,EAAE,OAAO;oBACvB,eAAe,EAAE,IAAI;oBACrB,MAAM,EAAE,SAAS;iBAClB;aACF;YACD,WAAW,EAAE,IAAI,GAAG,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;YACjD,WAAW,EAAE;gBACX;oBACE,EAAE,EAAE,YAAY;oBAChB,cAAc,EAAE,OAAO;oBACvB,eAAe,EAAE,WAAW;oBAC5B,MAAM,EAAE,SAAS;iBAClB;gBACD;oBACE,EAAE,EAAE,YAAY;oBAChB,cAAc,EAAE,OAAO;oBACvB,eAAe,EAAE,iBAAiB;oBAClC,MAAM,EAAE,SAAS;iBAClB;gBACD;oBACE,EAAE,EAAE,sBAAsB;oBAC1B,cAAc,EAAE,OAAO;oBACvB,eAAe,EAAE,iBAAiB;oBAClC,MAAM,EAAE,SAAS;iBAClB;aACF;YACD,WAAW,EAAE,IAAI,GAAG,CAAC,CAAC,uBAAuB,CAAC,CAAC;SAChD,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAC7C,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC,CAChD,CAAC;QACF,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAClC,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC,CAChD,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC;YACrC,WAAW,EAAE;gBACX;oBACE,EAAE,EAAE,SAAS;oBACb,cAAc,EAAE,OAAO;oBACvB,eAAe,EAAE,UAAU;oBAC3B,MAAM,EAAE,SAAS;iBAClB;gBACD;oBACE,EAAE,EAAE,UAAU;oBACd,cAAc,EAAE,OAAO;oBACvB,eAAe,EAAE,WAAW;oBAC5B,MAAM,EAAE,SAAS;iBAClB;aACF;YACD,WAAW,EAAE,IAAI,GAAG,EAAE;YACtB,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;SAC3C,CAAC,CAAC;QAEH,oEAAoE;QACpE,MAAM,eAAe,GAAG,EAAE;aACvB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;aACvB,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAEjD,eAAe,CAAC,WAAW,EAAE,CAAC;QAE9B,iEAAiE;QACjE,gEAAgE;QAChE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;YACjD,WAAW,EAAE;gBACX;oBACE,EAAE,EAAE,OAAO;oBACX,cAAc,EAAE,OAAO;oBACvB,eAAe,EAAE,QAAQ;oBACzB,MAAM,EAAE,SAAS;iBAClB;aACF;YACD,WAAW,EAAE,IAAI,GAAG,EAAE;YACtB,cAAc,EAAE,IAAI;SACrB,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,EAAE;aACvB,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;aACvB,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAEjD,eAAe,CAAC,WAAW,EAAE,CAAC;QAE9B,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,6DAA6D;QAC7D,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;YACjD,WAAW,EAAE,EAAE;YACf,WAAW,EAAE,IAAI,GAAG,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAEjD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/agent-run-service.d.ts

@@ -12,17 +12,54 @@ export interface AgentRun {
     completedAt: Date | null;
     createdBy: string;
     scheduleId: string | null;
+    /**
+     * FK to `OrgAgentType.id`. Populated by the Phase 1d spawn path for
+     * runs whose agent type resolves to a DB-backed row. Built-in agent
+     * types that have no org-level row stay `null`.
+     */
+    agentId: string | null;
+    /**
+     * FK to `User.id`. Populated by the Phase 1d spawn path whenever a
+     * run is spawned from a user-authenticated request. API-key-authored
+     * runs stay `null` because there is no owning user.
+     */
+    invokedByUserId: string | null;
+    /**
+     * The intersected rule set captured at spawn time (Phase 1d). The
+     * middleware rehydrates this into a `DelegatedAgentPrincipal` ability
+     * on every sandbox callback — see `buildAbility` in core/auth. Stored
+     * as `Json?`; surfaced here as `unknown` so callers must narrow it
+     * before use.
+     */
+    capturedAbility: unknown;
+}
+export interface AgentRunCreateInput {
+    prompt: string;
+    type?: string;
+    model: string;
+    createdBy: string;
+    scheduleId?: string;
+    /**
+     * FK to `OrgAgentType.id` — only set when the agent type is a DB-
+     * backed row. Built-in types without an org override leave this unset.
+     */
+    agentId?: string | null;
+    /**
+     * FK to `User.id` — only set for user-authenticated spawn paths.
+     */
+    invokedByUserId?: string | null;
+    /**
+     * The captured CASL rule set, i.e. `intersect(userAbility,
+     * orgAgentType.intrinsicPolicy)`. Only set for user-authenticated
+     * spawn paths. API-key-authored runs leave this null and the legacy
+     * `OrgAgentPrincipal` path in the middleware grants `manage all`.
+     */
+    capturedAbility?: unknown;
 }
 export declare class AgentRunService {
     private db;
     constructor(db: PrismaClient);
-    create(organizationId: string, input: {
-        prompt: string;
-        type?: string;
-        model: string;
-        createdBy: string;
-        scheduleId?: string;
-    }): Promise<AgentRun>;
+    create(organizationId: string, input: AgentRunCreateInput): Promise<AgentRun>;
     updateStatus(id: string, organizationId: string, update: {
         status: string;
         result?: string;

package/dist/services/agent-run-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-run-service.d.ts","sourceRoot":"","sources":["../../src/services/agent-run-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,qBAAa,eAAe;IACd,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,YAAY;IAE9B,MAAM,CACV,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9F,OAAO,CAAC,QAAQ,CAAC;IAed,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,IAAI,CAAC;KACpB,GACA,OAAO,CAAC,QAAQ,CAAC;IAcd,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAQrE,IAAI,CACR,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACxD,OAAO,CAAC,QAAQ,EAAE,CAAC;IAatB,OAAO,CAAC,UAAU;CAgBnB"}
+{"version":3,"file":"agent-run-service.d.ts","sourceRoot":"","sources":["../../src/services/agent-run-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;IAChB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;OAIG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;OAIG;IACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;;;OAMG;IACH,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,qBAAa,eAAe;IACd,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,YAAY;IAE9B,MAAM,CACV,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,QAAQ,CAAC;IA2Bd,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,WAAW,CAAC,EAAE,IAAI,CAAC;KACpB,GACA,OAAO,CAAC,QAAQ,CAAC;IAcd,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAQrE,IAAI,CACR,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACxD,OAAO,CAAC,QAAQ,EAAE,CAAC;IAatB,OAAO,CAAC,UAAU;CAmBnB"}

package/dist/services/agent-run-service.js

@@ -13,6 +13,17 @@ export class AgentRunService {
                 status: "pending",
                 createdBy: input.createdBy,
                 scheduleId: input.scheduleId ?? null,
+                agentId: input.agentId ?? null,
+                invokedByUserId: input.invokedByUserId ?? null,
+                // Prisma's typed `Json?` wants `undefined` to leave the column
+                // as its default (null) and a concrete object/array to write a
+                // value. `null` and `undefined` both collapse to "don't write
+                // anything" here; API-key spawn paths leave this unset and the
+                // resulting row has capturedAbility = null, which is the correct
+                // shape for legacy runs.
+                capturedAbility: input.capturedAbility == null
+                    ? undefined
+                    : input.capturedAbility,
             },
         });
         return this.toAgentRun(run);
@@ -64,6 +75,9 @@ export class AgentRunService {
             completedAt: run.completedAt,
             createdBy: run.createdBy,
             scheduleId: run.scheduleId,
+            agentId: run.agentId ?? null,
+            invokedByUserId: run.invokedByUserId ?? null,
+            capturedAbility: run.capturedAbility ?? null,
         };
     }
 }

package/dist/services/agent-run-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-run-service.js","sourceRoot":"","sources":["../../src/services/agent-run-service.ts"],"names":[],"mappings":"AAiBA,MAAM,OAAO,eAAe;IACN;IAApB,YAAoB,EAAgB;QAAhB,OAAE,GAAF,EAAE,CAAc;IAAG,CAAC;IAExC,KAAK,CAAC,MAAM,CACV,cAAsB,EACtB,KAA+F;QAE/F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,IAAI,EAAE;gBACJ,cAAc;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,YAAY;gBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;aACrC;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,EAAU,EACV,cAAsB,EACtB,MAMC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE;YAC7B,IAAI,EAAE;gBACJ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,cAAsB;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,IAAI,CACR,cAAsB,EACtB,IAAyD;QAEzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3C,KAAK,EAAE;gBACL,cAAc;gBACd,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C;YACD,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAEO,UAAU,CAAC,GAAQ;QACzB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;SAC3B,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"agent-run-service.js","sourceRoot":"","sources":["../../src/services/agent-run-service.ts"],"names":[],"mappings":"AA6DA,MAAM,OAAO,eAAe;IACN;IAApB,YAAoB,EAAgB;QAAhB,OAAE,GAAF,EAAE,CAAc;IAAG,CAAC;IAExC,KAAK,CAAC,MAAM,CACV,cAAsB,EACtB,KAA0B;QAE1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,IAAI,EAAE;gBACJ,cAAc;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,YAAY;gBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;gBAC9B,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;gBAC9C,+DAA+D;gBAC/D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,+DAA+D;gBAC/D,iEAAiE;gBACjE,yBAAyB;gBACzB,eAAe,EACb,KAAK,CAAC,eAAe,IAAI,IAAI;oBAC3B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAE,KAAK,CAAC,eAA0B;aACxC;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,EAAU,EACV,cAAsB,EACtB,MAMC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YACxC,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE;YAC7B,IAAI,EAAE;gBACJ,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC;SACF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,cAAsB;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC3C,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,IAAI,CACR,cAAsB,EACtB,IAAyD;QAEzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3C,KAAK,EAAE;gBACL,cAAc;gBACd,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C;YACD,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC9B,IAAI,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IAEO,UAAU,CAAC,GAAQ;QACzB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;YAC5B,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;YAC5C,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;SAC7C,CAAC;IACJ,CAAC;CACF"}