@aphexcms/cms-core 9.7.0 → 9.8.1

package/dist/lib/types/agent-change-sets.d.ts

@@ -0,0 +1,70 @@
+export type AgentChangeSetStatus = 'in_progress' | 'completed' | 'failed';
+/** One agent turn. Created eagerly, before the model is even called, so token usage is
+ * captured regardless of whether the turn ends up mutating anything. */
+export interface AgentChangeSet {
+    id: string;
+    organizationId: string;
+    createdBy: string | null;
+    status: AgentChangeSetStatus;
+    /** The turn's first user message, truncated — a human-readable label for the activity list. */
+    summary: string | null;
+    /** `AIProviderAdapter.name`, e.g. `'anthropic'` / `'openai'` / `'openrouter'`. */
+    provider: string;
+    model: string;
+    promptTokens: number;
+    completionTokens: number;
+    createdAt: Date;
+    completedAt: Date | null;
+}
+export interface CreateAgentChangeSetInput {
+    organizationId: string;
+    createdBy?: string | null;
+    summary?: string | null;
+    provider: string;
+    model: string;
+}
+export interface CompleteAgentChangeSetInput {
+    status: AgentChangeSetStatus;
+    promptTokens?: number;
+    completionTokens?: number;
+}
+/** One mutating tool call within a turn. `versionBefore` is what an undo restores to — null
+ * means there's nothing to restore to (e.g. this was a `create_document`, which isn't
+ * undoable in this pass). */
+export interface AgentOperation {
+    id: string;
+    changeSetId: string;
+    organizationId: string;
+    collection: string;
+    documentId: string;
+    toolName: string;
+    arguments: Record<string, unknown>;
+    success: boolean;
+    error: string | null;
+    versionBefore: number | null;
+    versionAfter: number | null;
+    createdAt: Date;
+}
+export interface RecordAgentOperationInput {
+    changeSetId: string;
+    organizationId: string;
+    collection: string;
+    documentId: string;
+    toolName: string;
+    arguments: Record<string, unknown>;
+    success: boolean;
+    error?: string | null;
+    versionBefore?: number | null;
+    versionAfter?: number | null;
+}
+/** A change-set with its operations attached — what the undo endpoint and the activity
+ * detail view both need. */
+export interface AgentChangeSetWithOperations extends AgentChangeSet {
+    operations: AgentOperation[];
+}
+export interface ListAgentChangeSetsOptions {
+    organizationId: string;
+    limit?: number;
+    offset?: number;
+}
+//# sourceMappingURL=agent-change-sets.d.ts.map

package/dist/lib/types/agent-change-sets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-change-sets.d.ts","sourceRoot":"","sources":["../../../src/lib/types/agent-change-sets.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE1E;wEACwE;AACxE,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,+FAA+F;IAC/F,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC;IAChB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACzC,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,2BAA2B;IAC3C,MAAM,EAAE,oBAAoB,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;6BAE6B;AAC7B,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;4BAC4B;AAC5B,MAAM,WAAW,4BAA6B,SAAQ,cAAc;IACnE,UAAU,EAAE,cAAc,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IAC1C,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/lib/types/agent-change-sets.js

@@ -0,0 +1,7 @@
+// Dialect-agnostic shapes for the agent audit/undo trail — mirrors `types/events.ts`'s
+// relationship to `cms_domain_events`/`cms_jobs`, but for `cms_agent_change_sets`/
+// `cms_agent_operations`. One `AgentChangeSet` row per agent turn (not per mutation — a
+// pure Q&A turn still costs tokens and is still worth an audit/cost row), with zero or more
+// `AgentOperation` children recording the mutating tool calls that turn made.
+export {};
+//# sourceMappingURL=agent-change-sets.js.map

package/dist/lib/types/agent-change-sets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-change-sets.js","sourceRoot":"","sources":["../../../src/lib/types/agent-change-sets.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,mFAAmF;AACnF,wFAAwF;AACxF,4FAA4F;AAC5F,8EAA8E"}

package/dist/lib/types/agent-stream.d.ts

@@ -0,0 +1,60 @@
+import type { AIMessage } from '../ai/interfaces/ai-provider.js';
+/** One event in an agent turn's response stream. */
+export type AgentStreamEvent = {
+    type: 'text';
+    delta: string;
+} | {
+    type: 'toolCall';
+    toolCallId: string;
+    name: string;
+    arguments: Record<string, unknown>;
+} | {
+    type: 'toolResult';
+    toolCallId: string;
+    name: string;
+    success: boolean;
+    data?: unknown;
+    /** Present when `success` is false — a message safe to show the model/user. */
+    error?: string;
+} | {
+    type: 'usage';
+    promptTokens: number;
+    completionTokens: number;
+} | {
+    type: 'error';
+    message: string;
+} | {
+    type: 'done';
+    /**
+     * `'awaiting_workspace_tool'` means the model requested one or more
+     * `execution: 'workspace'` tool calls this round — those can only be executed by
+     * the browser (they touch a live, possibly-unsaved editor draft), so the server
+     * stopped short of resolving them. `pendingWorkspaceCalls` lists exactly which
+     * ones need a result before the turn can continue; the caller resolves them
+     * locally, appends `tool` messages, and re-POSTs to resume — see
+     * `server/api/routes/agent-chat.ts` and `AgentChat.svelte`.
+     */
+    finishReason: 'stop' | 'tool_calls' | 'length' | 'error' | 'awaiting_workspace_tool';
+    /**
+     * The complete running conversation, including every intermediate
+     * `assistant`(toolCalls)/`tool` message this turn produced — not just the final
+     * user-visible text. `/api/agent/chat` is stateless per call, so the caller is
+     * expected to resend this wholesale as `messages` on the next turn rather than
+     * reconstructing it client-side (easy to get subtly wrong — see the history bug
+     * this replaced).
+     */
+    messages: AIMessage[];
+    /** Only present when `finishReason === 'awaiting_workspace_tool'`. */
+    pendingWorkspaceCalls?: {
+        toolCallId: string;
+        name: string;
+        arguments: Record<string, unknown>;
+    }[];
+    /**
+     * Stamped by `agent-chat.ts` (not `runAgentTurn`, which has no DB access) on every
+     * `done` event so a resume request can echo it back and the audit trail's
+     * `cms_agent_change_sets` row stays the same across a paused turn's multiple legs.
+     */
+    changeSetId?: string | null;
+};
+//# sourceMappingURL=agent-stream.d.ts.map

package/dist/lib/types/agent-stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-stream.d.ts","sourceRoot":"","sources":["../../../src/lib/types/agent-stream.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE9D,oDAAoD;AACpD,MAAM,MAAM,gBAAgB,GACzB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC1F;IACA,IAAI,EAAE,YAAY,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;CACd,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClC;IACA,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,GAAG,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,yBAAyB,CAAC;IACrF;;;;;;;OAOG;IACH,QAAQ,EAAE,SAAS,EAAE,CAAC;IACtB,sEAAsE;IACtE,qBAAqB,CAAC,EAAE;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,EAAE,CAAC;IACJ;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC"}

package/dist/lib/types/agent-stream.js

@@ -0,0 +1,12 @@
+// types/agent-stream.ts
+//
+// Browser-facing stream contract for an agent turn — what an SSE/NDJSON chat
+// endpoint actually sends over the wire. Deliberately close to `AIProviderAdapter`'s `AIStreamEvent`
+// (ai/interfaces/ai-provider.ts) since most events pass through unchanged — this type
+// adds the one thing the provider boundary doesn't have: the *result* of a tool call
+// the runtime executed, which the browser needs to render (and which the model needs
+// fed back as a `tool` message for the next round trip).
+//
+// Client-safe: no DB handles, no provider SDKs, just the wire shape.
+export {};
+//# sourceMappingURL=agent-stream.js.map

package/dist/lib/types/agent-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-stream.js","sourceRoot":"","sources":["../../../src/lib/types/agent-stream.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,EAAE;AACF,6EAA6E;AAC7E,qGAAqG;AACrG,sFAAsF;AACtF,qFAAqF;AACrF,qFAAqF;AACrF,yDAAyD;AACzD,EAAE;AACF,qEAAqE"}

package/dist/lib/types/agent-tools.d.ts

@@ -0,0 +1,65 @@
+import type { z } from 'zod';
+import type { Capability } from './capabilities.js';
+import type { CMSInstances } from '../hooks.js';
+import type { LocalAPIContext } from '../local-api/index.js';
+/**
+ * Where a tool's `execute` actually runs.
+ *
+ * - `server`: runs entirely in this process against the database — the vast
+ *   majority of tools (read, patch, publish, ...).
+ * - `workspace`: must round-trip to a live editor tab holding the in-progress
+ *   draft (e.g. "apply this change to what's currently open, unsaved, in the
+ *   browser"). `run-agent-turn.ts` never calls `execute` for a tool declared
+ *   this way — it pauses the turn instead (`AgentStreamEvent`'s
+ *   `awaiting_workspace_tool` finish reason) and the caller resolves it
+ *   client-side against a `DocumentWorkspace` (types/document-workspace.ts),
+ *   then resumes. Only advertised at all when `resolveAgentTools` is given a
+ *   `documentContext` (mcp/tools.ts) — see `ai/content-workspace-tools.ts` for
+ *   the two tools that currently use this mode.
+ */
+export type AgentToolExecutionMode = 'server' | 'workspace';
+/**
+ * Serializable description of a tool — the part an LLM/UI needs to know a
+ * tool exists and how to call it, without knowing how to run it.
+ */
+export interface AgentToolDefinition<TInput = unknown> {
+    /** Unique, namespaced by package to avoid collisions (e.g. `content_patch_fields`). */
+    name: string;
+    description: string;
+    /**
+     * Whether invoking this tool can change stored data. A coarse, cheap-to-display
+     * hint for approval flows and audit — not itself an authorization mechanism
+     * (`requiredCapabilities` is what's actually enforced).
+     */
+    mutates: boolean;
+    /**
+     * Capabilities required to see AND to invoke this tool — checked at both
+     * advertisement (don't list a tool the caller can't use) and execution
+     * (don't trust the advertisement check alone). A tool hidden from an
+     * unauthorized caller must also reject direct invocation.
+     */
+    requiredCapabilities: Capability[];
+    execution: AgentToolExecutionMode;
+    /** zod schema for the tool's arguments — single source of truth for validation. */
+    inputSchema: z.ZodType<TInput>;
+}
+/** Outcome of a single tool call. */
+export interface AgentToolResult {
+    success: boolean;
+    data?: unknown;
+    /** Present when `success` is false — a message safe to show the model/user. */
+    error?: string;
+}
+/** Everything an `execute` function needs to act on behalf of the calling request. */
+export interface AgentToolExecutionContext {
+    aphexCMS: CMSInstances;
+    context: LocalAPIContext;
+}
+/**
+ * Runs a tool call. Receives services via `ctx` at call time rather than
+ * static import, so a module defining an executor never has a heavy/server
+ * import at its top level — safe to sit alongside a definition in a plugin
+ * part that's also referenced from client-shared code.
+ */
+export type AgentToolExecutor<TInput = unknown> = (input: TInput, ctx: AgentToolExecutionContext) => Promise<AgentToolResult>;
+//# sourceMappingURL=agent-tools.d.ts.map

package/dist/lib/types/agent-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-tools.d.ts","sourceRoot":"","sources":["../../../src/lib/types/agent-tools.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,mBAAmB,CAAC,MAAM,GAAG,OAAO;IACpD,uFAAuF;IACvF,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,oBAAoB,EAAE,UAAU,EAAE,CAAC;IACnC,SAAS,EAAE,sBAAsB,CAAC;IAClC,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,qCAAqC;AACrC,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,sFAAsF;AACtF,MAAM,WAAW,yBAAyB;IACzC,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,eAAe,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,CAAC,MAAM,GAAG,OAAO,IAAI,CACjD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,yBAAyB,KAC1B,OAAO,CAAC,eAAe,CAAC,CAAC"}

package/dist/lib/types/agent-tools.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent-tools.js.map

package/dist/lib/types/agent-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-tools.js","sourceRoot":"","sources":["../../../src/lib/types/agent-tools.ts"],"names":[],"mappings":""}

package/dist/lib/types/config.d.ts

@@ -4,6 +4,7 @@ import type { CacheAdapter } from '../cache/index.js';
 import type { DatabaseAdapter } from '../db/index.js';
 import type { StorageAdapter } from '../storage/interfaces/index.js';
 import type { EmailAdapter } from '../email/index.js';
+import type { AIProviderAdapter } from '../ai/index.js';
 import type { GraphQLConfig } from '../graphql/index.js';
 import type { AphexEnv } from '../server/api/index.js';
 import type { SchemaType } from './schemas.js';
@@ -25,6 +26,24 @@ export interface CMSConfig {
     plugins?: CMSPlugin[];
     storage?: StorageAdapter | null;
     email?: EmailAdapter | null;
+    /** Model backend for the in-admin agent. Omit to leave the agent panel disabled. */
+    aiProvider?: AIProviderAdapter | null;
+    /**
+     * Default provider-specific model id used by `/api/agent/chat`, e.g.
+     * `claude-sonnet-4-5` (Anthropic) or `gpt-4.1` (OpenAI/OpenRouter). A request may
+     * override it per-call. Required when `aiProvider` is set — the route 501s without it.
+     */
+    agentModel?: string;
+    /**
+     * System prompt injected ahead of every `/api/agent/chat` turn (fresh per request — never
+     * persisted into the conversation itself, so changing this takes effect immediately for
+     * open conversations too). Overrides the built-in default (`ai/default-system-prompt.ts`),
+     * which only covers behavioral guardrails (draft-first, confirm before broad changes) —
+     * schema/tool knowledge is already self-describing via the `describe_cms` tool, so it
+     * doesn't need to be repeated here. Useful for an agency giving a client's deployment its
+     * own tone or house rules.
+     */
+    agentSystemPrompt?: string;
     customization?: {
         branding?: {
             title?: string;

package/dist/lib/types/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/lib/types/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B,MAAM,WAAW,SAAS;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE;YACV,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,KAAK,CAAC,EAAE;YACP,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC/B,CAAC;KACF,CAAC;IACF;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACxD;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACN,QAAQ,EAAE,YAAY,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QACN;;;WAGG;QACH,QAAQ,CAAC,EAAE,aAAa,CAAC;QACzB;;;;;;WAMG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,mDAAmD;QACnD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kFAAkF;QAClF,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;WAIG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;WAOG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,qFAAqF;QACrF,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,EAAE,IAAI,CAAC;YAAC,GAAG,EAAE,GAAG,CAAA;SAAE,KAAK,kBAAkB,CAAC;KAC7E,CAAC;IACF,QAAQ,CAAC,EAAE;QACV;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;;WAMG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;CACpC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/lib/types/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,YAAY,EAAE,aAAa,EAAE,CAAC;AAE9B,MAAM,WAAW,SAAS;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,oFAAoF;IACpF,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE;YACV,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,KAAK,CAAC,EAAE;YACP,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAChC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC/B,CAAC;KACF,CAAC;IACF;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;IACxD;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QACN,QAAQ,EAAE,YAAY,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QACN;;;WAGG;QACH,QAAQ,CAAC,EAAE,aAAa,CAAC;QACzB;;;;;;WAMG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,mDAAmD;QACnD,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kFAAkF;QAClF,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;WAIG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;WAOG;QACH,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,qFAAqF;QACrF,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,EAAE,IAAI,CAAC;YAAC,GAAG,EAAE,GAAG,CAAA;SAAE,KAAK,kBAAkB,CAAC;KAC7E,CAAC;IACF,QAAQ,CAAC,EAAE;QACV;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;;WAMG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;CACpC"}

package/dist/lib/types/document-workspace.d.ts

@@ -0,0 +1,53 @@
+/** A change to apply to the open document's in-memory draft. Extensible — a future
+ * operation kind (e.g. replaying a multiplayer remote op) is a new variant here, routed
+ * through the same `apply()`/`validate()`/CAS-save pipeline, not a new bridge. */
+export type DocumentWorkspaceOperation = {
+    type: 'patchFields';
+    /** Shallow-merged onto the current draft, same semantics as a manual field edit and as
+     * `CollectionAPI.update`'s own merge — whole-value replacement per top-level field key. */
+    fields: Record<string, unknown>;
+};
+/** Who's driving a batch of operations. `'agent'` is the only real source today; the type
+ * stays an open string so a future source (e.g. a multiplayer sync layer) doesn't require
+ * changing this type — just adding a caller. */
+export type DocumentWorkspaceBatchSource = 'agent' | (string & {});
+export interface DocumentWorkspaceSnapshot {
+    documentId: string | null;
+    collection: string;
+    data: Record<string, unknown>;
+    status: 'new' | 'draft' | 'published' | 'unpublished';
+    revision: number | null;
+}
+export interface DocumentWorkspaceValidationResult {
+    isValid: boolean;
+    errors: {
+        field: string;
+        errors: string[];
+    }[];
+}
+export interface DocumentWorkspaceSaveResult {
+    success: boolean;
+    revision?: number;
+    /** True when the write was rejected by the CAS revision check — the caller should treat
+     * this distinctly from a generic failure (matches the existing 409 handling in
+     * `DocumentEditor.svelte`'s manual save/publish/restore paths). */
+    conflict?: boolean;
+    error?: string;
+}
+export interface DocumentWorkspace {
+    getSnapshot(): DocumentWorkspaceSnapshot;
+    getSelection(): {
+        fieldName: string | null;
+    };
+    /** Mutates the in-memory draft only — never persists. */
+    apply(operation: DocumentWorkspaceOperation): void;
+    validate(): Promise<DocumentWorkspaceValidationResult>;
+    flushSave(expectedRevision: number | undefined): Promise<DocumentWorkspaceSaveResult>;
+    publish(expectedRevision: number | undefined): Promise<DocumentWorkspaceSaveResult>;
+    /** Suppresses the editor's own autosave debounce until `endBatch()` — so a burst of
+     * `apply()` calls (e.g. one agent turn's patches) doesn't produce one CAS write per
+     * patch. Exactly one `flushSave` should follow before/at `endBatch()`. */
+    beginBatch(source: DocumentWorkspaceBatchSource): void;
+    endBatch(): void;
+}
+//# sourceMappingURL=document-workspace.d.ts.map

package/dist/lib/types/document-workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-workspace.d.ts","sourceRoot":"","sources":["../../../src/lib/types/document-workspace.ts"],"names":[],"mappings":"AAcA;;kFAEkF;AAClF,MAAM,MAAM,0BAA0B,GAAG;IACxC,IAAI,EAAE,aAAa,CAAC;IACpB;+FAC2F;IAC3F,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC;AAEF;;gDAEgD;AAChD,MAAM,MAAM,4BAA4B,GAAG,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEnE,MAAM,WAAW,yBAAyB;IACzC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,KAAK,GAAG,OAAO,GAAG,WAAW,GAAG,aAAa,CAAC;IACtD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,iCAAiC;IACjD,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,2BAA2B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;uEAEmE;IACnE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IACjC,WAAW,IAAI,yBAAyB,CAAC;IACzC,YAAY,IAAI;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC7C,yDAAyD;IACzD,KAAK,CAAC,SAAS,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACnD,QAAQ,IAAI,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACvD,SAAS,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACtF,OAAO,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpF;;8EAE0E;IAC1E,UAAU,CAAC,MAAM,EAAE,4BAA4B,GAAG,IAAI,CAAC;IACvD,QAAQ,IAAI,IAAI,CAAC;CACjB"}

package/dist/lib/types/document-workspace.js

@@ -0,0 +1,15 @@
+// types/document-workspace.ts
+//
+// A live handle onto a document currently open (and possibly unsaved) in an editor tab —
+// not an AI-specific type. The agent's `content_patch_fields`/`content_save_draft` tools
+// (ai/content-workspace-tools.ts) are its first consumer, not its only intended one: a
+// future multiplayer feature would need the exact same primitives (apply an incoming
+// operation to the live draft, batch/suppress autosave while a burst of operations lands,
+// find which document sessions are open in this tab). `apply()`'s operation type and
+// `beginBatch()`'s source are both open unions for that reason — a new consumer is a new
+// union member, not a redesign of this interface.
+//
+// Client-safe: no server imports. Implemented by `DocumentEditor.svelte`, registered into
+// `document-workspace-registry.svelte.ts` while mounted.
+export {};
+//# sourceMappingURL=document-workspace.js.map

package/dist/lib/types/document-workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"document-workspace.js","sourceRoot":"","sources":["../../../src/lib/types/document-workspace.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,yFAAyF;AACzF,yFAAyF;AACzF,uFAAuF;AACvF,qFAAqF;AACrF,0FAA0F;AAC1F,qFAAqF;AACrF,yFAAyF;AACzF,kDAAkD;AAClD,EAAE;AACF,0FAA0F;AAC1F,yDAAyD"}

package/dist/lib/types/document.d.ts

@@ -10,6 +10,10 @@ export interface Document {
     draftData: any;
     publishedData: any;
     publishedHash: string | null;
+    /** Monotonic draft revision, incremented on every draft write. Used as the
+     *  compare-and-swap guard on `updateDocDraft`/`publishDoc`/`unpublishDoc` —
+     *  callers pass the revision they last read as `expectedRevision`. */
+    revision: number;
     createdBy: string | AuthUser | null;
     updatedBy: string | null;
     publishedAt: Date | null;
@@ -26,6 +30,7 @@ export interface NewDocument {
     draftData?: any;
     publishedData?: any;
     publishedHash?: string | null;
+    revision?: number;
     createdBy?: string | null;
     updatedBy?: string | null;
     publishedAt?: Date | null;

package/dist/lib/types/document.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../../src/lib/types/document.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,WAAW,GAAG,aAAa,GAAG,IAAI,CAAC;IACrD,SAAS,EAAE,GAAG,CAAC;IACf,aAAa,EAAE,GAAG,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,WAAW,GAAG,aAAa,GAAG,IAAI,CAAC;IACtD,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB"}
+{"version":3,"file":"document.d.ts","sourceRoot":"","sources":["../../../src/lib/types/document.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C;;GAEG;AACH,MAAM,WAAW,QAAQ;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,WAAW,GAAG,aAAa,GAAG,IAAI,CAAC;IACrD,SAAS,EAAE,GAAG,CAAC;IACf,aAAa,EAAE,GAAG,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;0EAEsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC3B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,WAAW,GAAG,aAAa,GAAG,IAAI,CAAC;IACtD,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,aAAa,CAAC,EAAE,GAAG,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB"}

package/dist/lib/types/index.d.ts

@@ -7,8 +7,10 @@ export * from './user.js';
 export * from './sidebar.js';
 export * from './organization.js';
 export * from './capabilities.js';
+export * from './agent-tools.js';
 export * from './filters.js';
 export * from './instance.js';
 export * from './version.js';
 export * from './events.js';
+export * from './agent-change-sets.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC"}

package/dist/lib/types/index.js

@@ -7,8 +7,10 @@ export * from './user.js';
 export * from './sidebar.js';
 export * from './organization.js';
 export * from './capabilities.js';
+export * from './agent-tools.js';
 export * from './filters.js';
 export * from './instance.js';
 export * from './version.js';
 export * from './events.js';
+export * from './agent-change-sets.js';
 //# sourceMappingURL=index.js.map

package/dist/lib/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,QAAQ,CAAC;AACvB,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,QAAQ,CAAC;AACvB,cAAc,WAAW,CAAC;AAC1B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC"}

package/dist/lib/types/schemas.js

@@ -1,4 +1,4 @@
 export function isBlockArray(field) {
-    return field.of.some((ref) => ref.type === 'block');
+    return (field.of ?? []).some((ref) => ref.type === 'block');
 }
 //# sourceMappingURL=schemas.js.map

package/dist/lib/types/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/lib/types/schemas.ts"],"names":[],"mappings":"AA2QA,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC7C,OAAO,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/lib/types/schemas.ts"],"names":[],"mappings":"AA2QA,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC7C,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;AAC7D,CAAC"}

package/dist/lib/utils/fetch-remote-file.d.ts

@@ -0,0 +1,11 @@
+export declare const MAX_REMOTE_FILE_BYTES: number;
+export interface RemoteFile {
+    buffer: Buffer;
+    contentType: string | null;
+}
+/** Fetch a URL with SSRF guards: http(s)-only, private/link-local/multicast IPs blocked and the
+ * validated address pinned for the actual connection (re-checked and re-pinned on every redirect
+ * hop), a request timeout, and a streamed size cap (not just a Content-Length check, since that
+ * header can lie). */
+export declare function fetchRemoteFile(url: string): Promise<RemoteFile>;
+//# sourceMappingURL=fetch-remote-file.d.ts.map

package/dist/lib/utils/fetch-remote-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-remote-file.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/fetch-remote-file.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AA6EtD,MAAM,WAAW,UAAU;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;sBAGsB;AACtB,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAuEtE"}

package/dist/lib/utils/fetch-remote-file.js

@@ -0,0 +1,169 @@
+// Fetches a remote file for the `upload_asset` agent tool's `url` input. The caller (an LLM)
+// can be steered by content it merely *read* (a document field, a scraped page) — an indirect
+// prompt-injection vector — so this is a genuine SSRF surface, not just a convenience fetch.
+//
+// Every redirect hop re-resolves and re-checks the hostname; a naive "check the input URL once"
+// implementation is bypassable by redirecting to a private address only after the first check
+// passes. More importantly, the resolved IP is *pinned* for the actual connection via a custom
+// `undici` dispatcher — resolving with `dns.lookup()` to validate, then handing the plain
+// hostname to `fetch()` and letting it resolve again to connect, reopens the same hole via DNS
+// rebinding (a short-TTL record that answers differently a few hundred ms apart): the address
+// that gets validated and the address that gets connected to must be the exact same one.
+import { lookup } from 'node:dns/promises';
+import net from 'node:net';
+import { Agent, fetch as undiciFetch } from 'undici';
+export const MAX_REMOTE_FILE_BYTES = 10 * 1024 * 1024; // matches the API's global JSON body cap
+const FETCH_TIMEOUT_MS = 10_000;
+const MAX_REDIRECTS = 5;
+const TRANSIENT_RETRY_DELAY_MS = 300;
+const TRANSIENT_STATUSES = new Set([502, 503, 504]);
+// A bare request with no headers reads as bot traffic to a lot of image CDNs (including
+// Unsplash's), which will deprioritize or outright reject it — sending a normal-looking
+// User-Agent/Accept pair alone clears up a meaningful share of otherwise-transient failures.
+const REQUEST_HEADERS = {
+    'User-Agent': 'AphexCMS-Agent-Fetch/1.0 (+asset upload tool)',
+    Accept: 'image/*,*/*;q=0.8'
+};
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function isPrivateOrReservedIp(ip) {
+    if (net.isIPv4(ip)) {
+        const octets = ip.split('.').map(Number);
+        const a = octets[0] ?? -1;
+        const b = octets[1] ?? -1;
+        if (a === 10 || a === 127 || a === 0)
+            return true;
+        if (a === 169 && b === 254)
+            return true; // link-local — includes cloud metadata endpoints
+        if (a === 172 && b >= 16 && b <= 31)
+            return true;
+        if (a === 192 && b === 168)
+            return true;
+        if (a === 100 && b >= 64 && b <= 127)
+            return true; // CGNAT
+        if (a >= 224)
+            return true; // multicast (224-239) + reserved/broadcast (240-255)
+        return false;
+    }
+    if (net.isIPv6(ip)) {
+        const lower = ip.toLowerCase();
+        if (lower === '::1' || lower === '::')
+            return true;
+        if (lower.startsWith('fe80:') || lower.startsWith('fc') || lower.startsWith('fd'))
+            return true;
+        if (lower.startsWith('ff'))
+            return true; // multicast
+        if (lower.startsWith('::ffff:'))
+            return isPrivateOrReservedIp(lower.slice(7));
+        return false;
+    }
+    return true; // unrecognized address shape — fail closed
+}
+async function resolvePinnedHost(hostname) {
+    if (hostname.toLowerCase() === 'localhost') {
+        throw new Error('URL host is not allowed.');
+    }
+    const records = await lookup(hostname, { all: true });
+    if (records.length === 0)
+        throw new Error('Could not resolve host.');
+    for (const { address } of records) {
+        if (isPrivateOrReservedIp(address)) {
+            throw new Error('URL resolves to a private/internal address, which is not allowed.');
+        }
+    }
+    const chosen = records[0];
+    return { address: chosen.address, family: chosen.family === 6 ? 6 : 4 };
+}
+/** A dispatcher whose DNS step is short-circuited to the one address we already validated —
+ * whatever hostname undici asks it to resolve, it hands back this exact IP, so the socket that
+ * actually opens is guaranteed to be the one that passed `isPrivateOrReservedIp`. The hostname
+ * itself still flows through normally for the Host header and TLS SNI/cert validation. */
+function pinnedDispatcher(host) {
+    return new Agent({
+        connect: {
+            lookup: (_hostname, options, callback) => {
+                const result = { address: host.address, family: host.family };
+                callback(null, options.all ? [result] : result.address);
+            }
+        }
+    });
+}
+/** Fetch a URL with SSRF guards: http(s)-only, private/link-local/multicast IPs blocked and the
+ * validated address pinned for the actual connection (re-checked and re-pinned on every redirect
+ * hop), a request timeout, and a streamed size cap (not just a Content-Length check, since that
+ * header can lie). */
+export async function fetchRemoteFile(url) {
+    let current = url;
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+        const parsed = new URL(current);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            throw new Error('Only http/https URLs are allowed.');
+        }
+        const pinnedHost = await resolvePinnedHost(parsed.hostname);
+        let res;
+        // One retry, only for a transient upstream 5xx (502/503/504) — not for 4xx (a bad URL
+        // won't fix itself) and not for a network-level exception (already a distinct failure
+        // mode, handled by the catch below without a retry).
+        for (let attempt = 0; attempt < 2; attempt++) {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+            try {
+                res = await undiciFetch(current, {
+                    redirect: 'manual',
+                    signal: controller.signal,
+                    dispatcher: pinnedDispatcher(pinnedHost),
+                    headers: REQUEST_HEADERS
+                });
+            }
+            catch (err) {
+                throw new Error(`Fetch failed: ${err instanceof Error ? err.message : 'network error'}`);
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+            if (attempt === 0 && TRANSIENT_STATUSES.has(res.status)) {
+                await sleep(TRANSIENT_RETRY_DELAY_MS);
+                continue;
+            }
+            break;
+        }
+        res = res;
+        if (res.status >= 300 && res.status < 400) {
+            const location = res.headers.get('location');
+            if (!location)
+                throw new Error('Redirect response missing a Location header.');
+            current = new URL(location, current).toString();
+            continue;
+        }
+        if (!res.ok) {
+            const transientNote = TRANSIENT_STATUSES.has(res.status)
+                ? ' (upstream temporarily unavailable, retried once)'
+                : '';
+            throw new Error(`Fetch failed with status ${res.status}.${transientNote}`);
+        }
+        const contentLength = res.headers.get('content-length');
+        if (contentLength && Number(contentLength) > MAX_REMOTE_FILE_BYTES) {
+            throw new Error(`File too large (max ${MAX_REMOTE_FILE_BYTES / (1024 * 1024)}MB).`);
+        }
+        if (!res.body)
+            throw new Error('Response had no body.');
+        const reader = res.body.getReader();
+        const chunks = [];
+        let total = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > MAX_REMOTE_FILE_BYTES) {
+                await reader.cancel();
+                throw new Error(`File too large (max ${MAX_REMOTE_FILE_BYTES / (1024 * 1024)}MB).`);
+            }
+            chunks.push(value);
+        }
+        return { buffer: Buffer.concat(chunks), contentType: res.headers.get('content-type') };
+    }
+    throw new Error('Too many redirects.');
+}
+//# sourceMappingURL=fetch-remote-file.js.map