@axiom-lattice/gateway 4.2.0 → 4.2.1

package/dist/chunk-GF4GGTWJ.mjs

@@ -0,0 +1,164 @@
+// src/services/open/openLattice.ts
+import { z } from "zod";
+var GrantDeniedError = class extends Error {
+  constructor(toolName) {
+    super(`GRANT_DENIED: no grant covers ${toolName}`);
+    this.code = "GRANT_DENIED";
+    this.name = "GrantDeniedError";
+  }
+};
+var ValidationError = class extends Error {
+  constructor(detail) {
+    super(`VALIDATION_FAILED: ${detail}`);
+    this.code = "VALIDATION_FAILED";
+    this.name = "ValidationError";
+  }
+};
+var ActionNotFoundError = class extends Error {
+  constructor(toolName) {
+    super(`ACTION_NOT_FOUND: ${toolName}`);
+    this.code = "ACTION_NOT_FOUND";
+    this.name = "ActionNotFoundError";
+  }
+};
+function effectiveToolName(domain, action) {
+  return action.toolName ?? `${domain}_${action.name}`;
+}
+function grantCoversAction(grants, domain, action) {
+  return grants.some(
+    (g) => g.domain === domain && (!g.items || g.items.length === 0 || g.items.includes(action))
+  );
+}
+var OpenLattice = class {
+  constructor() {
+    this.providers = /* @__PURE__ */ new Map();
+  }
+  /** Register a provider; domain+action collisions are rejected. */
+  register(declaration) {
+    const existing = this.providers.get(declaration.domain);
+    if (existing) {
+      throw new Error(
+        `Open provider domain already registered: ${declaration.domain}`
+      );
+    }
+    const actions = /* @__PURE__ */ new Map();
+    for (const action of declaration.actions) {
+      actions.set(action.name, action);
+    }
+    this.providers.set(declaration.domain, { declaration, actions });
+  }
+  /** Tool descriptors visible under the given grants (default-deny). */
+  async catalogFor(grants, ctx) {
+    const catalog = [];
+    for (const [domain, entry] of this.providers) {
+      for (const [actionName, action] of entry.actions) {
+        if (!grantCoversAction(grants, domain, actionName)) continue;
+        catalog.push({
+          toolName: effectiveToolName(domain, action),
+          domain,
+          action: actionName,
+          description: action.description,
+          schema: action.schema,
+          annotations: action.annotations
+        });
+      }
+      if (entry.declaration.instanceActions) {
+        const instances = await entry.declaration.instanceActions(grants, ctx);
+        for (const action of instances) {
+          catalog.push({
+            toolName: effectiveToolName(domain, action),
+            domain,
+            action: action.name,
+            description: action.description,
+            schema: action.schema,
+            annotations: action.annotations
+          });
+        }
+      }
+    }
+    return catalog;
+  }
+  /**
+   * Full grantable catalog (unfiltered by grants) for the management picker.
+   * Instance domains (agent) return an empty item list — the catalog service
+   * fills their per-tenant instances.
+   */
+  describeCatalog() {
+    const domains = [];
+    for (const [domain, entry] of this.providers) {
+      const declaration = entry.declaration;
+      const items = [];
+      if ((declaration.itemKind ?? "action") === "action") {
+        for (const [actionName, action] of entry.actions) {
+          items.push({
+            id: actionName,
+            toolName: `${domain}_${actionName}`,
+            label: action.label ?? actionName,
+            description: action.description,
+            annotations: action.annotations
+          });
+        }
+      }
+      domains.push({
+        domain,
+        label: declaration.label ?? domain,
+        source: declaration.source ?? "builtin",
+        scopeKind: declaration.scopeKind ?? "tenant",
+        itemKind: declaration.itemKind ?? "action",
+        items
+      });
+    }
+    return domains;
+  }
+  async resolveAction(grants, toolName, ctx) {
+    for (const [domain, entry] of this.providers) {
+      for (const [actionName, action] of entry.actions) {
+        if (effectiveToolName(domain, action) === toolName) {
+          return { domain, entry, action, actionName };
+        }
+      }
+      if (entry.declaration.instanceActions) {
+        const instances = await entry.declaration.instanceActions(grants, ctx);
+        for (const action of instances) {
+          if (effectiveToolName(domain, action) === toolName) {
+            return { domain, entry, action, actionName: action.name };
+          }
+        }
+      }
+    }
+    return null;
+  }
+  /** Whether the given grants cover a tool (`{domain}_{action}`). */
+  isAllowed(grants, toolName) {
+    const sep = toolName.indexOf("_");
+    const domain = sep > 0 ? toolName.slice(0, sep) : toolName;
+    const action = sep > 0 ? toolName.slice(sep + 1) : "";
+    return grantCoversAction(grants, domain, action);
+  }
+  /** The single credential-driven execution path. */
+  async invoke(grants, ctx, toolName, args) {
+    const resolved = await this.resolveAction(grants, toolName, { tenantId: ctx.tenantId });
+    if (!resolved) {
+      throw new ActionNotFoundError(toolName);
+    }
+    if (!grantCoversAction(grants, resolved.domain, resolved.actionName)) {
+      throw new GrantDeniedError(toolName);
+    }
+    const resolvedSchema = resolved.action.schema;
+    const parsed = "safeParse" in resolvedSchema ? resolvedSchema.safeParse(args) : z.object(resolvedSchema).safeParse(args);
+    if (!parsed.success) {
+      throw new ValidationError(parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; "));
+    }
+    return resolved.entry.declaration.execute(resolved.actionName, parsed.data, ctx);
+  }
+};
+var openLattice = new OpenLattice();
+
+export {
+  GrantDeniedError,
+  ValidationError,
+  ActionNotFoundError,
+  OpenLattice,
+  openLattice
+};
+//# sourceMappingURL=chunk-GF4GGTWJ.mjs.map

package/dist/chunk-GF4GGTWJ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/open/openLattice.ts"],"sourcesContent":["/**\n * OpenLattice — the registry + invocation kernel for the Open API surface.\n *\n * Every credential-driven execution flows through exactly one path:\n *   catalogFor(grants)  → what the credential may see\n *   invoke(grants, ...) → authorize → validate → execute → result\n *\n * Built-in providers (kb, sandbox, agent) and plugin-exposed tools all\n * register the same OpenProviderDeclaration contract.\n */\n\nimport { z } from \"zod\";\nimport type {\n  OpenCapabilitySource,\n  OpenCatalogDomain,\n  OpenCatalogItem,\n  OpenExecutionContext,\n  OpenExecutionResult,\n  OpenGrant,\n} from \"@axiom-lattice/protocols\";\n\nexport interface OpenActionDeclaration {\n  name: string;\n  /** Explicit MCP tool name override (defaults to `{domain}_{name}`). */\n  toolName?: string;\n  /** Friendly display label (falls back to the action name). */\n  label?: string;\n  description: string;\n  schema: z.ZodRawShape | z.ZodTypeAny;\n  annotations: { readOnlyHint: boolean; destructiveHint: boolean };\n}\n\n/** Request-scoped context available while deriving the catalog. */\nexport interface OpenCatalogContext {\n  tenantId?: string;\n}\n\nexport interface OpenProviderDeclaration {\n  domain: string;\n  /** Human label for the management catalog (defaults to domain). */\n  label?: string;\n  /** Catalog provenance (defaults to \"builtin\"). */\n  source?: OpenCapabilitySource;\n  /** \"action\" (kb/plugins) or \"instance\" (agent); defaults to \"action\". */\n  itemKind?: \"action\" | \"instance\";\n  /** Display-only scope hint (defaults to \"tenant\"). */\n  scopeKind?: \"tenant\" | \"workspace\" | \"project\";\n  actions: OpenActionDeclaration[];\n  /**\n   * Dynamic actions derived from the credential's grants — used by instance\n   * domains (e.g. agent: one tool per granted assistant).\n   */\n  instanceActions?: (grants: OpenGrant[], ctx?: OpenCatalogContext) => OpenActionDeclaration[] | Promise<OpenActionDeclaration[]>;\n  execute: (\n    action: string,\n    args: unknown,\n    ctx: OpenExecutionContext,\n  ) => Promise<OpenExecutionResult>;\n}\n\nexport interface OpenToolDescriptor {\n  /** MCP tool name, \"{domain}_{action}\". */\n  toolName: string;\n  domain: string;\n  action: string;\n  description: string;\n  schema: z.ZodRawShape | z.ZodTypeAny;\n  annotations: { readOnlyHint: boolean; destructiveHint: boolean };\n}\n\n/** Thrown when a credential has no grant covering the requested action. */\nexport class GrantDeniedError extends Error {\n  readonly code = \"GRANT_DENIED\";\n  constructor(toolName: string) {\n    super(`GRANT_DENIED: no grant covers ${toolName}`);\n    this.name = \"GrantDeniedError\";\n  }\n}\n\n/** Thrown when args fail the action's zod schema. */\nexport class ValidationError extends Error {\n  readonly code = \"VALIDATION_FAILED\";\n  constructor(detail: string) {\n    super(`VALIDATION_FAILED: ${detail}`);\n    this.name = \"ValidationError\";\n  }\n}\n\n/** Thrown for a toolName with no registered provider/action. */\nexport class ActionNotFoundError extends Error {\n  readonly code = \"ACTION_NOT_FOUND\";\n  constructor(toolName: string) {\n    super(`ACTION_NOT_FOUND: ${toolName}`);\n    this.name = \"ActionNotFoundError\";\n  }\n}\n\ninterface RegisteredProvider {\n  declaration: OpenProviderDeclaration;\n  actions: Map<string, OpenActionDeclaration>;\n}\n\n/** Effective MCP tool name: explicit override, else `{domain}_{name}`. */\nfunction effectiveToolName(domain: string, action: OpenActionDeclaration): string {\n  return action.toolName ?? `${domain}_${action.name}`;\n}\n\nfunction grantCoversAction(\n  grants: OpenGrant[],\n  domain: string,\n  action: string,\n): boolean {\n  return grants.some(\n    (g) => g.domain === domain && (!g.items || g.items.length === 0 || g.items.includes(action)),\n  );\n}\n\nexport class OpenLattice {\n  private providers = new Map<string, RegisteredProvider>();\n\n  /** Register a provider; domain+action collisions are rejected. */\n  register(declaration: OpenProviderDeclaration): void {\n    const existing = this.providers.get(declaration.domain);\n    if (existing) {\n      throw new Error(\n        `Open provider domain already registered: ${declaration.domain}`,\n      );\n    }\n    const actions = new Map<string, OpenActionDeclaration>();\n    for (const action of declaration.actions) {\n      actions.set(action.name, action);\n    }\n    this.providers.set(declaration.domain, { declaration, actions });\n  }\n\n  /** Tool descriptors visible under the given grants (default-deny). */\n  async catalogFor(grants: OpenGrant[], ctx?: OpenCatalogContext): Promise<OpenToolDescriptor[]> {\n    const catalog: OpenToolDescriptor[] = [];\n    for (const [domain, entry] of this.providers) {\n      // Static actions.\n      for (const [actionName, action] of entry.actions) {\n        if (!grantCoversAction(grants, domain, actionName)) continue;\n        catalog.push({\n          toolName: effectiveToolName(domain, action),\n          domain,\n          action: actionName,\n          description: action.description,\n          schema: action.schema,\n          annotations: action.annotations,\n        });\n      }\n      // Instance-derived actions (e.g. agent: one tool per granted assistant).\n      if (entry.declaration.instanceActions) {\n        const instances = await entry.declaration.instanceActions(grants, ctx);\n        for (const action of instances) {\n          catalog.push({\n            toolName: effectiveToolName(domain, action),\n            domain,\n            action: action.name,\n            description: action.description,\n            schema: action.schema,\n            annotations: action.annotations,\n          });\n        }\n      }\n    }\n    return catalog;\n  }\n\n  /**\n   * Full grantable catalog (unfiltered by grants) for the management picker.\n   * Instance domains (agent) return an empty item list — the catalog service\n   * fills their per-tenant instances.\n   */\n  describeCatalog(): OpenCatalogDomain[] {\n    const domains: OpenCatalogDomain[] = [];\n    for (const [domain, entry] of this.providers) {\n      const declaration = entry.declaration;\n      const items: OpenCatalogItem[] = [];\n      if ((declaration.itemKind ?? \"action\") === \"action\") {\n        for (const [actionName, action] of entry.actions) {\n          items.push({\n            id: actionName,\n            toolName: `${domain}_${actionName}`,\n            label: action.label ?? actionName,\n            description: action.description,\n            annotations: action.annotations,\n          });\n        }\n      }\n      domains.push({\n        domain,\n        label: declaration.label ?? domain,\n        source: declaration.source ?? \"builtin\",\n        scopeKind: declaration.scopeKind ?? \"tenant\",\n        itemKind: declaration.itemKind ?? \"action\",\n        items,\n      });\n    }\n    return domains;\n  }\n\n  private async resolveAction(\n    grants: OpenGrant[],\n    toolName: string,\n    ctx?: OpenCatalogContext,\n  ): Promise<{\n    domain: string;\n    entry: RegisteredProvider;\n    action: OpenActionDeclaration;\n    /** Grant-matching id: the action name (assistant id for agent instances). */\n    actionName: string;\n  } | null> {\n    for (const [domain, entry] of this.providers) {\n      for (const [actionName, action] of entry.actions) {\n        if (effectiveToolName(domain, action) === toolName) {\n          return { domain, entry, action, actionName };\n        }\n      }\n      if (entry.declaration.instanceActions) {\n        const instances = await entry.declaration.instanceActions(grants, ctx);\n        for (const action of instances) {\n          if (effectiveToolName(domain, action) === toolName) {\n            return { domain, entry, action, actionName: action.name };\n          }\n        }\n      }\n    }\n    return null;\n  }\n\n  /** Whether the given grants cover a tool (`{domain}_{action}`). */\n  isAllowed(grants: OpenGrant[], toolName: string): boolean {\n    const sep = toolName.indexOf(\"_\");\n    const domain = sep > 0 ? toolName.slice(0, sep) : toolName;\n    const action = sep > 0 ? toolName.slice(sep + 1) : \"\";\n    return grantCoversAction(grants, domain, action);\n  }\n\n  /** The single credential-driven execution path. */\n  async invoke(\n    grants: OpenGrant[],\n    ctx: OpenExecutionContext,\n    toolName: string,\n    args: unknown,\n  ): Promise<OpenExecutionResult> {\n    const resolved = await this.resolveAction(grants, toolName, { tenantId: ctx.tenantId });\n    if (!resolved) {\n      throw new ActionNotFoundError(toolName);\n    }\n    if (!grantCoversAction(grants, resolved.domain, resolved.actionName)) {\n      throw new GrantDeniedError(toolName);\n    }\n    const resolvedSchema = resolved.action.schema;\n    const parsed = (\n      \"safeParse\" in resolvedSchema\n        ? (resolvedSchema as z.ZodTypeAny).safeParse(args)\n        : z.object(resolvedSchema as z.ZodRawShape).safeParse(args)\n    );\n    if (!parsed.success) {\n      throw new ValidationError(parsed.error.issues.map((i) => `${i.path.join(\".\")}: ${i.message}`).join(\"; \"));\n    }\n    return resolved.entry.declaration.execute(resolved.actionName, parsed.data, ctx);\n  }\n}\n\n/** Process-wide singleton for the gateway's Open surface. */\nexport const openLattice = new OpenLattice();\n"],"mappings":";AAWA,SAAS,SAAS;AA4DX,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAE1C,YAAY,UAAkB;AAC5B,UAAM,iCAAiC,QAAQ,EAAE;AAFnD,SAAS,OAAO;AAGd,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,kBAAN,cAA8B,MAAM;AAAA,EAEzC,YAAY,QAAgB;AAC1B,UAAM,sBAAsB,MAAM,EAAE;AAFtC,SAAS,OAAO;AAGd,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EAE7C,YAAY,UAAkB;AAC5B,UAAM,qBAAqB,QAAQ,EAAE;AAFvC,SAAS,OAAO;AAGd,SAAK,OAAO;AAAA,EACd;AACF;AAQA,SAAS,kBAAkB,QAAgB,QAAuC;AAChF,SAAO,OAAO,YAAY,GAAG,MAAM,IAAI,OAAO,IAAI;AACpD;AAEA,SAAS,kBACP,QACA,QACA,QACS;AACT,SAAO,OAAO;AAAA,IACZ,CAAC,MAAM,EAAE,WAAW,WAAW,CAAC,EAAE,SAAS,EAAE,MAAM,WAAW,KAAK,EAAE,MAAM,SAAS,MAAM;AAAA,EAC5F;AACF;AAEO,IAAM,cAAN,MAAkB;AAAA,EAAlB;AACL,SAAQ,YAAY,oBAAI,IAAgC;AAAA;AAAA;AAAA,EAGxD,SAAS,aAA4C;AACnD,UAAM,WAAW,KAAK,UAAU,IAAI,YAAY,MAAM;AACtD,QAAI,UAAU;AACZ,YAAM,IAAI;AAAA,QACR,4CAA4C,YAAY,MAAM;AAAA,MAChE;AAAA,IACF;AACA,UAAM,UAAU,oBAAI,IAAmC;AACvD,eAAW,UAAU,YAAY,SAAS;AACxC,cAAQ,IAAI,OAAO,MAAM,MAAM;AAAA,IACjC;AACA,SAAK,UAAU,IAAI,YAAY,QAAQ,EAAE,aAAa,QAAQ,CAAC;AAAA,EACjE;AAAA;AAAA,EAGA,MAAM,WAAW,QAAqB,KAAyD;AAC7F,UAAM,UAAgC,CAAC;AACvC,eAAW,CAAC,QAAQ,KAAK,KAAK,KAAK,WAAW;AAE5C,iBAAW,CAAC,YAAY,MAAM,KAAK,MAAM,SAAS;AAChD,YAAI,CAAC,kBAAkB,QAAQ,QAAQ,UAAU,EAAG;AACpD,gBAAQ,KAAK;AAAA,UACX,UAAU,kBAAkB,QAAQ,MAAM;AAAA,UAC1C;AAAA,UACA,QAAQ;AAAA,UACR,aAAa,OAAO;AAAA,UACpB,QAAQ,OAAO;AAAA,UACf,aAAa,OAAO;AAAA,QACtB,CAAC;AAAA,MACH;AAEA,UAAI,MAAM,YAAY,iBAAiB;AACrC,cAAM,YAAY,MAAM,MAAM,YAAY,gBAAgB,QAAQ,GAAG;AACrE,mBAAW,UAAU,WAAW;AAC9B,kBAAQ,KAAK;AAAA,YACX,UAAU,kBAAkB,QAAQ,MAAM;AAAA,YAC1C;AAAA,YACA,QAAQ,OAAO;AAAA,YACf,aAAa,OAAO;AAAA,YACpB,QAAQ,OAAO;AAAA,YACf,aAAa,OAAO;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAAuC;AACrC,UAAM,UAA+B,CAAC;AACtC,eAAW,CAAC,QAAQ,KAAK,KAAK,KAAK,WAAW;AAC5C,YAAM,cAAc,MAAM;AAC1B,YAAM,QAA2B,CAAC;AAClC,WAAK,YAAY,YAAY,cAAc,UAAU;AACnD,mBAAW,CAAC,YAAY,MAAM,KAAK,MAAM,SAAS;AAChD,gBAAM,KAAK;AAAA,YACT,IAAI;AAAA,YACJ,UAAU,GAAG,MAAM,IAAI,UAAU;AAAA,YACjC,OAAO,OAAO,SAAS;AAAA,YACvB,aAAa,OAAO;AAAA,YACpB,aAAa,OAAO;AAAA,UACtB,CAAC;AAAA,QACH;AAAA,MACF;AACA,cAAQ,KAAK;AAAA,QACX;AAAA,QACA,OAAO,YAAY,SAAS;AAAA,QAC5B,QAAQ,YAAY,UAAU;AAAA,QAC9B,WAAW,YAAY,aAAa;AAAA,QACpC,UAAU,YAAY,YAAY;AAAA,QAClC;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,cACZ,QACA,UACA,KAOQ;AACR,eAAW,CAAC,QAAQ,KAAK,KAAK,KAAK,WAAW;AAC5C,iBAAW,CAAC,YAAY,MAAM,KAAK,MAAM,SAAS;AAChD,YAAI,kBAAkB,QAAQ,MAAM,MAAM,UAAU;AAClD,iBAAO,EAAE,QAAQ,OAAO,QAAQ,WAAW;AAAA,QAC7C;AAAA,MACF;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,cAAM,YAAY,MAAM,MAAM,YAAY,gBAAgB,QAAQ,GAAG;AACrE,mBAAW,UAAU,WAAW;AAC9B,cAAI,kBAAkB,QAAQ,MAAM,MAAM,UAAU;AAClD,mBAAO,EAAE,QAAQ,OAAO,QAAQ,YAAY,OAAO,KAAK;AAAA,UAC1D;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,UAAU,QAAqB,UAA2B;AACxD,UAAM,MAAM,SAAS,QAAQ,GAAG;AAChC,UAAM,SAAS,MAAM,IAAI,SAAS,MAAM,GAAG,GAAG,IAAI;AAClD,UAAM,SAAS,MAAM,IAAI,SAAS,MAAM,MAAM,CAAC,IAAI;AACnD,WAAO,kBAAkB,QAAQ,QAAQ,MAAM;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,OACJ,QACA,KACA,UACA,MAC8B;AAC9B,UAAM,WAAW,MAAM,KAAK,cAAc,QAAQ,UAAU,EAAE,UAAU,IAAI,SAAS,CAAC;AACtF,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,oBAAoB,QAAQ;AAAA,IACxC;AACA,QAAI,CAAC,kBAAkB,QAAQ,SAAS,QAAQ,SAAS,UAAU,GAAG;AACpE,YAAM,IAAI,iBAAiB,QAAQ;AAAA,IACrC;AACA,UAAM,iBAAiB,SAAS,OAAO;AACvC,UAAM,SACJ,eAAe,iBACV,eAAgC,UAAU,IAAI,IAC/C,EAAE,OAAO,cAA+B,EAAE,UAAU,IAAI;AAE9D,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI,gBAAgB,OAAO,MAAM,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IAC1G;AACA,WAAO,SAAS,MAAM,YAAY,QAAQ,SAAS,YAAY,OAAO,MAAM,GAAG;AAAA,EACjF;AACF;AAGO,IAAM,cAAc,IAAI,YAAY;","names":[]}

package/dist/{chunk-2HOCF46L.mjs → chunk-GPHOYR3X.mjs}

@@ -1,4 +1,5 @@
 // src/services/a2a/A2AAuthService.ts
+import { effectiveGrants } from "@axiom-lattice/protocols";
 var A2AAuthError = class extends Error {
   constructor(message, statusCode) {
     super(message);
@@ -72,20 +73,26 @@ var A2AAuthService = class {
     const merged = new Map([...this.envKeyMap, ...storeMap]);
     const entry = merged.get(token);
     if (!entry) return { authenticated: false };
+    const hasExplicitGrants = Array.isArray(entry.grants) && entry.grants.length > 0;
+    const agentGrant = effectiveGrants(entry).find((g) => g.domain === "agent");
+    const assistantIds = hasExplicitGrants ? agentGrant?.items ?? [] : entry.assistantIds;
     return {
       authenticated: true,
       apiKey: token,
       tenantId: entry.tenantId,
       projectId: entry.projectId,
-      assistantIds: entry.assistantIds,
+      assistantIds,
       source: header && BEARER_SCHEME_RE.test(header) ? "bearer" : "x-api-key"
     };
   }
   /**
-   * Assert that the given assistant is reachable under the provided auth context:
-   * authenticated, within the key's assistant whitelist, same tenant, and exposed.
+   * Assert that the given assistant is reachable under the provided auth
+   * context: authenticated, same tenant, and within the key's whitelist.
+   *
+   * Authorization is unified on the API key — the agent no longer carries an
+   * exposure flag; the key's assistant whitelist / grants is the single source.
    */
-  async assertExposedAgent(auth, assistantId) {
+  async assertAgentAccess(auth, assistantId) {
     if (!auth.authenticated || !auth.tenantId) {
       throw new A2AAuthError("Unauthorized", 401);
     }
@@ -94,12 +101,9 @@ var A2AAuthService = class {
       throw new A2AAuthError("Agent not found", 404);
     }
     const whitelist = auth.assistantIds;
-    if (whitelist && whitelist.length > 0 && !whitelist.includes(assistantId)) {
+    if (whitelist !== void 0 && !whitelist.includes(assistantId)) {
       throw new A2AAuthError("Agent not allowed for this key", 403);
     }
-    if (assistant.graphDefinition?.a2aExposure?.enabled !== true) {
-      throw new A2AAuthError("Agent not exposed", 404);
-    }
     return assistant;
   }
   /**
@@ -107,7 +111,7 @@ var A2AAuthService = class {
    * in the tenant and every assistant belongs to the same tenant.
    */
   async createKeyScoped(input) {
-    const { tenantId, projectId, assistantIds, label } = input;
+    const { tenantId, projectId, assistantIds, grants, label } = input;
     if (!projectId) {
       throw new A2AAuthError("projectId is required", 400);
     }
@@ -123,7 +127,25 @@ var A2AAuthService = class {
         }
       }
     }
-    return this.keyStore.create({ tenantId, projectId, assistantIds, label });
+    return this.keyStore.create({ tenantId, projectId, assistantIds, grants, label });
+  }
+  async updateKeyScoped(id, tenantId, input) {
+    const { projectId, assistantIds, grants, label } = input;
+    if (projectId) {
+      const project = await this.projectStore.getProjectById(tenantId, projectId);
+      if (!project || project.tenantId !== tenantId) {
+        throw new A2AAuthError("Project not found", 400);
+      }
+    }
+    if (assistantIds && assistantIds.length > 0) {
+      for (const aId of assistantIds) {
+        const assistant = await this.assistantStore.getAssistantById(tenantId, aId);
+        if (!assistant || assistant.tenantId !== tenantId) {
+          throw new A2AAuthError("Assistant not found", 400);
+        }
+      }
+    }
+    return this.keyStore.update(id, { label, projectId, assistantIds, grants });
   }
   extractToken(header) {
     if (!header) return void 0;
@@ -140,4 +162,4 @@ export {
   parseEnvKeys,
   A2AAuthService
 };
-//# sourceMappingURL=chunk-2HOCF46L.mjs.map
+//# sourceMappingURL=chunk-GPHOYR3X.mjs.map

package/dist/chunk-GPHOYR3X.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/a2a/A2AAuthService.ts"],"sourcesContent":["import { effectiveGrants } from \"@axiom-lattice/protocols\";\nimport type {\n  A2AApiKeyEntry,\n  A2AApiKeyRecord,\n  A2AApiKeyStore,\n  A2AAuthContext,\n  Assistant,\n  AssistantStore,\n  ProjectStore,\n  OpenGrant,\n} from \"@axiom-lattice/protocols\";\n\n/**\n * Error thrown by {@link A2AAuthService} for authz/authn failures.\n * Carries an HTTP status code for the route layer to surface.\n */\nexport class A2AAuthError extends Error {\n  public readonly statusCode: number;\n\n  constructor(message: string, statusCode: number) {\n    super(message);\n    this.name = \"A2AAuthError\";\n    this.statusCode = statusCode;\n  }\n}\n\n/**\n * Dependencies injected into {@link A2AAuthService} so stores can be mocked in tests.\n */\nexport interface A2AAuthServiceDeps {\n  keyStore: A2AApiKeyStore;\n  assistantStore: AssistantStore;\n  projectStore: ProjectStore;\n  envKeyMap?: Map<string, A2AApiKeyEntry>;\n  /**\n   * When true, requests with no key are allowed through when no keys are\n   * configured (dev mode). Defaults to false — JSON-RPC stays locked until a\n   * key is configured or this opt-in is explicitly enabled.\n   */\n  allowUnauthenticated?: boolean;\n}\n\nexport interface UpdateKeyScopedInput {\n  label?: string;\n  projectId?: string;\n  assistantIds?: string[];\n  grants?: OpenGrant[];\n}\n\n/** Input for creating an API key scoped to a tenant + project. */\nexport interface CreateKeyScopedInput {\n  tenantId: string;\n  projectId?: string;\n  assistantIds?: string[];\n  /** Open-door grants (validated minimally; unknown domains simply never match). */\n  grants?: OpenGrant[];\n  label?: string;\n}\n\nconst DEFAULT_TENANT_ENV = \"A2A_DEFAULT_TENANT_ID\";\nconst DEFAULT_TENANT_ID = \"a2a-default-tenant\";\nconst DEFAULT_PROJECT_ENV = \"A2A_DEFAULT_PROJECT_ID\";\n\n/** Matches an HTTP `Authorization` Bearer scheme, case-insensitively (`bearer`/`Bearer`). */\nconst BEARER_SCHEME_RE = /^Bearer\\s+/i;\n\n/**\n * Parse an `A2A_API_KEYS=\"key:tenant:project,...\"` env string into a lookup map.\n * Entries missing a key, tenant, or project segment are skipped.\n */\nexport function parseEnvKeys(env: string): Map<string, A2AApiKeyEntry> {\n  const map = new Map<string, A2AApiKeyEntry>();\n\n  if (!env) return map;\n\n  for (const entry of env.split(\",\")) {\n    const trimmed = entry.trim();\n    if (!trimmed) continue;\n\n    const parts = trimmed.split(\":\");\n    const key = parts[0]?.trim();\n    const tenantId = parts[1]?.trim();\n    const projectId = parts[2]?.trim();\n    if (!key || !tenantId || !projectId) continue;\n\n    map.set(key, { key, tenantId, projectId });\n  }\n\n  return map;\n}\n\n/**\n * Resolve the dev-mode default tenant/project when no keys are configured.\n */\nfunction devModeDefaults(): { tenantId: string; projectId?: string } {\n  const tenantId = process.env[DEFAULT_TENANT_ENV] || DEFAULT_TENANT_ID;\n  const projectId = process.env[DEFAULT_PROJECT_ENV] || undefined;\n  return { tenantId, projectId };\n}\n\n/**\n * Authenticates A2A requests against the key store + env key map,\n * enforces assistant whitelist / exposure, and validates key scope on creation.\n */\nexport class A2AAuthService {\n  private readonly keyStore: A2AApiKeyStore;\n  private readonly assistantStore: AssistantStore;\n  private readonly projectStore: ProjectStore;\n  private readonly envKeyMap: Map<string, A2AApiKeyEntry>;\n  /** Lazily-populated store key map; reloaded via {@link refresh} after keys CRUD. */\n  private storeKeyMapCache: Map<string, A2AApiKeyEntry> | null = null;\n  private readonly allowUnauthenticated: boolean;\n\n  constructor(deps: A2AAuthServiceDeps) {\n    this.keyStore = deps.keyStore;\n    this.assistantStore = deps.assistantStore;\n    this.projectStore = deps.projectStore;\n    this.envKeyMap = deps.envKeyMap ?? new Map();\n    this.allowUnauthenticated = deps.allowUnauthenticated ?? false;\n  }\n\n  /**\n   * Reload the cached store key map. Call once at startup and after any keys\n   * CRUD mutation so {@link authenticate} does not hit the store on every request.\n   */\n  async refresh(): Promise<void> {\n    this.storeKeyMapCache = await this.keyStore.loadIntoMap();\n  }\n\n  /** Return the cached store key map, loading it on first use. */\n  private async getStoreKeyMap(): Promise<Map<string, A2AApiKeyEntry>> {\n    if (this.storeKeyMapCache === null) {\n      await this.refresh();\n    }\n    return this.storeKeyMapCache ?? new Map<string, A2AApiKeyEntry>();\n  }\n\n  /**\n   * Authenticate an incoming request header (authorization or x-api-key value).\n   * Returns an auth context; `authenticated: false` means the caller must reject.\n   */\n  async authenticate(header: string | undefined): Promise<A2AAuthContext> {\n    const storeMap = await this.getStoreKeyMap();\n    const noAuthRequired = storeMap.size === 0 && this.envKeyMap.size === 0;\n\n    const token = this.extractToken(header);\n\n    if (!token) {\n      if (noAuthRequired && this.allowUnauthenticated) {\n        const { tenantId, projectId } = devModeDefaults();\n        return { authenticated: true, tenantId, projectId };\n      }\n      return { authenticated: false };\n    }\n\n    // Store keys take priority; env keys serve as fallback.\n    const merged = new Map<string, A2AApiKeyEntry>([...this.envKeyMap, ...storeMap]);\n    const entry = merged.get(token);\n\n    if (!entry) return { authenticated: false };\n\n    // Unified key management: the agent whitelist comes from the key's grants\n    // when present, else the legacy assistantIds.\n    //\n    // - explicit grants: agent access only if an agent-domain grant exists\n    //   (missing agent grant => empty whitelist => no agents);\n    // - bare agent grant (no items) => undefined => legacy \"all agents\";\n    // - no grants: fall back to legacy assistantIds (undefined => all agents).\n    const hasExplicitGrants = Array.isArray(entry.grants) && entry.grants.length > 0;\n    const agentGrant = effectiveGrants(entry).find((g) => g.domain === \"agent\");\n    const assistantIds = hasExplicitGrants\n      ? (agentGrant?.items ?? [])\n      : entry.assistantIds;\n\n    return {\n      authenticated: true,\n      apiKey: token,\n      tenantId: entry.tenantId,\n      projectId: entry.projectId,\n      assistantIds,\n      source: header && BEARER_SCHEME_RE.test(header) ? \"bearer\" : \"x-api-key\",\n    };\n  }\n\n  /**\n   * Assert that the given assistant is reachable under the provided auth\n   * context: authenticated, same tenant, and within the key's whitelist.\n   *\n   * Authorization is unified on the API key — the agent no longer carries an\n   * exposure flag; the key's assistant whitelist / grants is the single source.\n   */\n  async assertAgentAccess(auth: A2AAuthContext, assistantId: string): Promise<Assistant> {\n    if (!auth.authenticated || !auth.tenantId) {\n      throw new A2AAuthError(\"Unauthorized\", 401);\n    }\n\n    const assistant = await this.assistantStore.getAssistantById(auth.tenantId, assistantId);\n    if (!assistant || assistant.tenantId !== auth.tenantId) {\n      throw new A2AAuthError(\"Agent not found\", 404);\n    }\n\n    // undefined = legacy \"all agents\"; [] = explicitly none; list = whitelist.\n    const whitelist = auth.assistantIds;\n    if (whitelist !== undefined && !whitelist.includes(assistantId)) {\n      throw new A2AAuthError(\"Agent not allowed for this key\", 403);\n    }\n\n    return assistant;\n  }\n\n  /**\n   * Create an API key scoped to a tenant + project, validating the project exists\n   * in the tenant and every assistant belongs to the same tenant.\n   */\n  async createKeyScoped(input: CreateKeyScopedInput): Promise<A2AApiKeyRecord> {\n    const { tenantId, projectId, assistantIds, grants, label } = input;\n\n    if (!projectId) {\n      throw new A2AAuthError(\"projectId is required\", 400);\n    }\n\n    const project = await this.projectStore.getProjectById(tenantId, projectId);\n    if (!project || project.tenantId !== tenantId) {\n      throw new A2AAuthError(\"Project not found\", 400);\n    }\n\n    if (assistantIds && assistantIds.length > 0) {\n      for (const id of assistantIds) {\n        const assistant = await this.assistantStore.getAssistantById(tenantId, id);\n        if (!assistant || assistant.tenantId !== tenantId) {\n          throw new A2AAuthError(\"Assistant not found\", 400);\n        }\n      }\n    }\n\n    return this.keyStore.create({ tenantId, projectId, assistantIds, grants, label });\n  }\n\n  async updateKeyScoped(\n    id: string,\n    tenantId: string,\n    input: UpdateKeyScopedInput,\n  ): Promise<A2AApiKeyRecord> {\n    const { projectId, assistantIds, grants, label } = input;\n    if (projectId) {\n      const project = await this.projectStore.getProjectById(tenantId, projectId);\n      if (!project || project.tenantId !== tenantId) {\n        throw new A2AAuthError(\"Project not found\", 400);\n      }\n    }\n    if (assistantIds && assistantIds.length > 0) {\n      for (const aId of assistantIds) {\n        const assistant = await this.assistantStore.getAssistantById(tenantId, aId);\n        if (!assistant || assistant.tenantId !== tenantId) {\n          throw new A2AAuthError(\"Assistant not found\", 400);\n        }\n      }\n    }\n    return this.keyStore.update(id, { label, projectId, assistantIds, grants });\n  }\n\n  private extractToken(header: string | undefined): string | undefined {\n    if (!header) return undefined;\n    const match = BEARER_SCHEME_RE.exec(header);\n    if (match) {\n      return header.substring(match[0].length);\n    }\n    return header;\n  }\n}\n"],"mappings":";AAAA,SAAS,uBAAuB;AAgBzB,IAAM,eAAN,cAA2B,MAAM;AAAA,EAGtC,YAAY,SAAiB,YAAoB;AAC/C,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAmCA,IAAM,qBAAqB;AAC3B,IAAM,oBAAoB;AAC1B,IAAM,sBAAsB;AAG5B,IAAM,mBAAmB;AAMlB,SAAS,aAAa,KAA0C;AACrE,QAAM,MAAM,oBAAI,IAA4B;AAE5C,MAAI,CAAC,IAAK,QAAO;AAEjB,aAAW,SAAS,IAAI,MAAM,GAAG,GAAG;AAClC,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AAEd,UAAM,QAAQ,QAAQ,MAAM,GAAG;AAC/B,UAAM,MAAM,MAAM,CAAC,GAAG,KAAK;AAC3B,UAAM,WAAW,MAAM,CAAC,GAAG,KAAK;AAChC,UAAM,YAAY,MAAM,CAAC,GAAG,KAAK;AACjC,QAAI,CAAC,OAAO,CAAC,YAAY,CAAC,UAAW;AAErC,QAAI,IAAI,KAAK,EAAE,KAAK,UAAU,UAAU,CAAC;AAAA,EAC3C;AAEA,SAAO;AACT;AAKA,SAAS,kBAA4D;AACnE,QAAM,WAAW,QAAQ,IAAI,kBAAkB,KAAK;AACpD,QAAM,YAAY,QAAQ,IAAI,mBAAmB,KAAK;AACtD,SAAO,EAAE,UAAU,UAAU;AAC/B;AAMO,IAAM,iBAAN,MAAqB;AAAA,EAS1B,YAAY,MAA0B;AAHtC;AAAA,SAAQ,mBAAuD;AAI7D,SAAK,WAAW,KAAK;AACrB,SAAK,iBAAiB,KAAK;AAC3B,SAAK,eAAe,KAAK;AACzB,SAAK,YAAY,KAAK,aAAa,oBAAI,IAAI;AAC3C,SAAK,uBAAuB,KAAK,wBAAwB;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,UAAyB;AAC7B,SAAK,mBAAmB,MAAM,KAAK,SAAS,YAAY;AAAA,EAC1D;AAAA;AAAA,EAGA,MAAc,iBAAuD;AACnE,QAAI,KAAK,qBAAqB,MAAM;AAClC,YAAM,KAAK,QAAQ;AAAA,IACrB;AACA,WAAO,KAAK,oBAAoB,oBAAI,IAA4B;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa,QAAqD;AACtE,UAAM,WAAW,MAAM,KAAK,eAAe;AAC3C,UAAM,iBAAiB,SAAS,SAAS,KAAK,KAAK,UAAU,SAAS;AAEtE,UAAM,QAAQ,KAAK,aAAa,MAAM;AAEtC,QAAI,CAAC,OAAO;AACV,UAAI,kBAAkB,KAAK,sBAAsB;AAC/C,cAAM,EAAE,UAAU,UAAU,IAAI,gBAAgB;AAChD,eAAO,EAAE,eAAe,MAAM,UAAU,UAAU;AAAA,MACpD;AACA,aAAO,EAAE,eAAe,MAAM;AAAA,IAChC;AAGA,UAAM,SAAS,IAAI,IAA4B,CAAC,GAAG,KAAK,WAAW,GAAG,QAAQ,CAAC;AAC/E,UAAM,QAAQ,OAAO,IAAI,KAAK;AAE9B,QAAI,CAAC,MAAO,QAAO,EAAE,eAAe,MAAM;AAS1C,UAAM,oBAAoB,MAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,OAAO,SAAS;AAC/E,UAAM,aAAa,gBAAgB,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO;AAC1E,UAAM,eAAe,oBAChB,YAAY,SAAS,CAAC,IACvB,MAAM;AAEV,WAAO;AAAA,MACL,eAAe;AAAA,MACf,QAAQ;AAAA,MACR,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,QAAQ,UAAU,iBAAiB,KAAK,MAAM,IAAI,WAAW;AAAA,IAC/D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,kBAAkB,MAAsB,aAAyC;AACrF,QAAI,CAAC,KAAK,iBAAiB,CAAC,KAAK,UAAU;AACzC,YAAM,IAAI,aAAa,gBAAgB,GAAG;AAAA,IAC5C;AAEA,UAAM,YAAY,MAAM,KAAK,eAAe,iBAAiB,KAAK,UAAU,WAAW;AACvF,QAAI,CAAC,aAAa,UAAU,aAAa,KAAK,UAAU;AACtD,YAAM,IAAI,aAAa,mBAAmB,GAAG;AAAA,IAC/C;AAGA,UAAM,YAAY,KAAK;AACvB,QAAI,cAAc,UAAa,CAAC,UAAU,SAAS,WAAW,GAAG;AAC/D,YAAM,IAAI,aAAa,kCAAkC,GAAG;AAAA,IAC9D;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,OAAuD;AAC3E,UAAM,EAAE,UAAU,WAAW,cAAc,QAAQ,MAAM,IAAI;AAE7D,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,aAAa,yBAAyB,GAAG;AAAA,IACrD;AAEA,UAAM,UAAU,MAAM,KAAK,aAAa,eAAe,UAAU,SAAS;AAC1E,QAAI,CAAC,WAAW,QAAQ,aAAa,UAAU;AAC7C,YAAM,IAAI,aAAa,qBAAqB,GAAG;AAAA,IACjD;AAEA,QAAI,gBAAgB,aAAa,SAAS,GAAG;AAC3C,iBAAW,MAAM,cAAc;AAC7B,cAAM,YAAY,MAAM,KAAK,eAAe,iBAAiB,UAAU,EAAE;AACzE,YAAI,CAAC,aAAa,UAAU,aAAa,UAAU;AACjD,gBAAM,IAAI,aAAa,uBAAuB,GAAG;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AAEA,WAAO,KAAK,SAAS,OAAO,EAAE,UAAU,WAAW,cAAc,QAAQ,MAAM,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,gBACJ,IACA,UACA,OAC0B;AAC1B,UAAM,EAAE,WAAW,cAAc,QAAQ,MAAM,IAAI;AACnD,QAAI,WAAW;AACb,YAAM,UAAU,MAAM,KAAK,aAAa,eAAe,UAAU,SAAS;AAC1E,UAAI,CAAC,WAAW,QAAQ,aAAa,UAAU;AAC7C,cAAM,IAAI,aAAa,qBAAqB,GAAG;AAAA,MACjD;AAAA,IACF;AACA,QAAI,gBAAgB,aAAa,SAAS,GAAG;AAC3C,iBAAW,OAAO,cAAc;AAC9B,cAAM,YAAY,MAAM,KAAK,eAAe,iBAAiB,UAAU,GAAG;AAC1E,YAAI,CAAC,aAAa,UAAU,aAAa,UAAU;AACjD,gBAAM,IAAI,aAAa,uBAAuB,GAAG;AAAA,QACnD;AAAA,MACF;AAAA,IACF;AACA,WAAO,KAAK,SAAS,OAAO,IAAI,EAAE,OAAO,WAAW,cAAc,OAAO,CAAC;AAAA,EAC5E;AAAA,EAEQ,aAAa,QAAgD;AACnE,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,QAAQ,iBAAiB,KAAK,MAAM;AAC1C,QAAI,OAAO;AACT,aAAO,OAAO,UAAU,MAAM,CAAC,EAAE,MAAM;AAAA,IACzC;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/chunk-NFEGQTCC.mjs

@@ -0,0 +1,27 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+export {
+  __esm,
+  __export,
+  __toCommonJS
+};
+//# sourceMappingURL=chunk-NFEGQTCC.mjs.map

package/dist/chunk-PWHUWFXL.mjs

@@ -0,0 +1,173 @@
+// src/services/collection_service.ts
+import { v4 as uuidv4 } from "uuid";
+import { Document } from "@langchain/core/documents";
+import {
+  collectionLatticeManager,
+  embeddingsLatticeManager,
+  getOrCreateCollectionVectorStore,
+  getCollectionEntryCount,
+  listCollectionEntries,
+  removeCollectionVectorStore
+} from "@axiom-lattice/core";
+function getTenantId(request) {
+  return request.user?.tenantId || request.headers["x-tenant-id"] || "default";
+}
+var CollectionService = class {
+  // ─── Collection CRUD ──────────────────────────────────────────
+  async getAllCollections(request) {
+    const tenantId = getTenantId(request);
+    const collections = await collectionLatticeManager.getAllCollections(tenantId);
+    for (const c of collections) {
+      try {
+        c._entryCount = await getCollectionEntryCount(c.name, c.embeddingKey, c.tenantId);
+      } catch {
+        c._entryCount = 0;
+      }
+    }
+    return collections;
+  }
+  async getCollectionByName(request, name) {
+    const tenantId = getTenantId(request);
+    return collectionLatticeManager.getCollection(tenantId, name);
+  }
+  async createCollection(request, data) {
+    const tenantId = getTenantId(request);
+    const collection = await collectionLatticeManager.registerCollection(tenantId, data);
+    try {
+      await getOrCreateCollectionVectorStore(data.name, data.embeddingKey, tenantId);
+    } catch (err) {
+      console.warn(`[CollectionService] Failed to init vector store for ${data.name}:`, err);
+    }
+    return collection;
+  }
+  async updateCollection(request, name, updates) {
+    const tenantId = getTenantId(request);
+    return collectionLatticeManager.updateCollection(tenantId, name, updates);
+  }
+  async deleteCollection(request, name) {
+    const tenantId = getTenantId(request);
+    await removeCollectionVectorStore(name, tenantId);
+    return collectionLatticeManager.removeCollection(tenantId, name);
+  }
+  // ─── Entry CRUD ───────────────────────────────────────────────
+  async getEntries(request, collectionName) {
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const docs = await listCollectionEntries(collectionName, collection.embeddingKey, collection.tenantId);
+    return docs.map((doc) => ({
+      id: doc.metadata._id || "",
+      content: doc.pageContent,
+      metadata: Object.fromEntries(
+        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
+      )
+    }));
+  }
+  async createEntry(request, collectionName, data) {
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const vectorStore = await getOrCreateCollectionVectorStore(
+      collectionName,
+      collection.embeddingKey,
+      collection.tenantId
+    );
+    const entryId = uuidv4();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const doc = new Document({
+      pageContent: data.content,
+      metadata: {
+        _id: entryId,
+        _created_at: now,
+        _updated_at: now,
+        ...data.metadata || {}
+      }
+    });
+    await vectorStore.addDocuments([doc]);
+    return { id: entryId, content: data.content, metadata: data.metadata || {} };
+  }
+  async getEntry(request, collectionName, entryId) {
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const docs = await listCollectionEntries(collectionName, collection.embeddingKey, collection.tenantId);
+    const doc = docs.find((d) => d.metadata._id === entryId);
+    if (!doc) return null;
+    return {
+      id: entryId,
+      content: doc.pageContent,
+      metadata: Object.fromEntries(
+        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
+      )
+    };
+  }
+  async updateEntry(request, collectionName, entryId, data) {
+    const existing = await this.getEntry(request, collectionName, entryId);
+    if (!existing) return null;
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const vectorStore = await getOrCreateCollectionVectorStore(
+      collectionName,
+      collection.embeddingKey,
+      collection.tenantId
+    );
+    try {
+      await vectorStore.delete({ filter: { _id: entryId } });
+    } catch {
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const mergedMetadata = { ...existing.metadata, ...data.metadata || {} };
+    const doc = new Document({
+      pageContent: data.content ?? existing.content,
+      metadata: { _id: entryId, _created_at: now, _updated_at: now, ...mergedMetadata }
+    });
+    await vectorStore.addDocuments([doc]);
+    return { id: entryId, content: data.content ?? existing.content, metadata: mergedMetadata };
+  }
+  async deleteEntry(request, collectionName, entryId) {
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const vectorStore = await getOrCreateCollectionVectorStore(
+      collectionName,
+      collection.embeddingKey,
+      collection.tenantId
+    );
+    try {
+      await vectorStore.delete({ filter: { _id: entryId } });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  async searchEntries(request, collectionName, params) {
+    const collection = await this.getCollectionByName(request, collectionName);
+    if (!collection) throw new Error(`Collection "${collectionName}" not found`);
+    const vectorStore = await getOrCreateCollectionVectorStore(
+      collectionName,
+      collection.embeddingKey,
+      collection.tenantId
+    );
+    let embeddings;
+    try {
+      embeddings = embeddingsLatticeManager.getEmbeddingsClient(collection.embeddingKey);
+    } catch {
+      embeddings = embeddingsLatticeManager.getEmbeddingsClient("default");
+    }
+    const queryVector = await embeddings.embedQuery(params.query);
+    const results = await vectorStore.similaritySearchVectorWithScore(
+      queryVector,
+      params.top_k || 5,
+      params.filter
+    );
+    return results.map(([doc, score]) => ({
+      id: doc.metadata._id || uuidv4(),
+      content: doc.pageContent,
+      metadata: Object.fromEntries(
+        Object.entries(doc.metadata).filter(([k]) => !k.startsWith("_"))
+      ),
+      score
+    }));
+  }
+};
+
+export {
+  CollectionService
+};
+//# sourceMappingURL=chunk-PWHUWFXL.mjs.map

package/dist/chunk-PWHUWFXL.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/collection_service.ts"],"sourcesContent":["/**\n * CollectionService\n *\n * Business logic layer for collection management and entry operations.\n * Uses CollectionLatticeManager for registration, VectorStoreLatticeManager for storage,\n * and EmbeddingsLatticeManager for vector embedding.\n * All vector store operations are tenant-isolated.\n */\n\nimport { v4 as uuidv4 } from \"uuid\";\nimport { Document } from \"@langchain/core/documents\";\nimport {\n  collectionLatticeManager,\n  embeddingsLatticeManager,\n  getOrCreateCollectionVectorStore,\n  getCollectionEntryCount,\n  listCollectionEntries,\n  removeCollectionVectorStore,\n} from \"@axiom-lattice/core\";\nimport type {\n  Collection,\n  CreateCollectionRequest,\n  UpdateCollectionRequest,\n} from \"@axiom-lattice/protocols\";\nimport { FastifyRequest } from \"fastify\";\n\nfunction getTenantId(request: FastifyRequest): string {\n  return (\n    (request as any).user?.tenantId ||\n    (request.headers[\"x-tenant-id\"] as string) ||\n    \"default\"\n  );\n}\n\nexport interface EntryResponse {\n  id: string;\n  content: string;\n  metadata: Record<string, unknown>;\n  score?: number;\n}\n\nexport class CollectionService {\n  // ─── Collection CRUD ──────────────────────────────────────────\n\n  async getAllCollections(request: FastifyRequest): Promise<Collection[]> {\n    const tenantId = getTenantId(request);\n    const collections = await collectionLatticeManager.getAllCollections(tenantId);\n\n    for (const c of collections) {\n      try {\n        (c as any)._entryCount = await getCollectionEntryCount(c.name, c.embeddingKey, c.tenantId);\n      } catch {\n        (c as any)._entryCount = 0;\n      }\n    }\n\n    return collections;\n  }\n\n  async getCollectionByName(\n    request: FastifyRequest,\n    name: string\n  ): Promise<Collection | null> {\n    const tenantId = getTenantId(request);\n    return collectionLatticeManager.getCollection(tenantId, name);\n  }\n\n  async createCollection(\n    request: FastifyRequest,\n    data: CreateCollectionRequest\n  ): Promise<Collection> {\n    const tenantId = getTenantId(request);\n    const collection = await collectionLatticeManager.registerCollection(tenantId, data);\n\n    try {\n      await getOrCreateCollectionVectorStore(data.name, data.embeddingKey, tenantId);\n    } catch (err) {\n      console.warn(`[CollectionService] Failed to init vector store for ${data.name}:`, err);\n    }\n\n    return collection;\n  }\n\n  async updateCollection(\n    request: FastifyRequest,\n    name: string,\n    updates: UpdateCollectionRequest\n  ): Promise<Collection | null> {\n    const tenantId = getTenantId(request);\n    return collectionLatticeManager.updateCollection(tenantId, name, updates);\n  }\n\n  async deleteCollection(\n    request: FastifyRequest,\n    name: string\n  ): Promise<boolean> {\n    const tenantId = getTenantId(request);\n    await removeCollectionVectorStore(name, tenantId);\n    return collectionLatticeManager.removeCollection(tenantId, name);\n  }\n\n  // ─── Entry CRUD ───────────────────────────────────────────────\n\n  async getEntries(\n    request: FastifyRequest,\n    collectionName: string\n  ): Promise<EntryResponse[]> {\n    const collection = await this.getCollectionByName(request, collectionName);\n    if (!collection) throw new Error(`Collection \"${collectionName}\" not found`);\n\n    const docs = await listCollectionEntries(collectionName, collection.embeddingKey, collection.tenantId);\n\n    return docs.map((doc: Document) => ({\n      id: (doc.metadata._id as string) || \"\",\n      content: doc.pageContent,\n      metadata: Object.fromEntries(\n        Object.entries(doc.metadata).filter(([k]) => !k.startsWith(\"_\"))\n      ),\n    }));\n  }\n\n  async createEntry(\n    request: FastifyRequest,\n    collectionName: string,\n    data: { content: string; metadata?: Record<string, unknown> }\n  ): Promise<EntryResponse> {\n    const collection = await this.getCollectionByName(request, collectionName);\n    if (!collection) throw new Error(`Collection \"${collectionName}\" not found`);\n\n    const vectorStore = await getOrCreateCollectionVectorStore(\n      collectionName, collection.embeddingKey, collection.tenantId\n    );\n\n    const entryId = uuidv4();\n    const now = new Date().toISOString();\n    const doc = new Document({\n      pageContent: data.content,\n      metadata: {\n        _id: entryId,\n        _created_at: now,\n        _updated_at: now,\n        ...(data.metadata || {}),\n      },\n    });\n\n    await vectorStore.addDocuments([doc]);\n\n    return { id: entryId, content: data.content, metadata: data.metadata || {} };\n  }\n\n  async getEntry(\n    request: FastifyRequest,\n    collectionName: string,\n    entryId: string\n  ): Promise<EntryResponse | null> {\n    const collection = await this.getCollectionByName(request, collectionName);\n    if (!collection) throw new Error(`Collection \"${collectionName}\" not found`);\n\n    const docs = await listCollectionEntries(collectionName, collection.embeddingKey, collection.tenantId);\n    const doc = docs.find((d: Document) => d.metadata._id === entryId);\n    if (!doc) return null;\n    return {\n      id: entryId,\n      content: doc.pageContent,\n      metadata: Object.fromEntries(\n        Object.entries(doc.metadata).filter(([k]) => !k.startsWith(\"_\"))\n      ),\n    };\n  }\n\n  async updateEntry(\n    request: FastifyRequest,\n    collectionName: string,\n    entryId: string,\n    data: { content?: string; metadata?: Record<string, unknown> }\n  ): Promise<EntryResponse | null> {\n    const existing = await this.getEntry(request, collectionName, entryId);\n    if (!existing) return null;\n\n    const collection = await this.getCollectionByName(request, collectionName);\n    if (!collection) throw new Error(`Collection \"${collectionName}\" not found`);\n\n    const vectorStore = await getOrCreateCollectionVectorStore(\n      collectionName, collection.embeddingKey, collection.tenantId\n    );\n\n    try {\n      await vectorStore.delete({ filter: { _id: entryId } } as any);\n    } catch {\n      // best effort\n    }\n\n    const now = new Date().toISOString();\n    const mergedMetadata = { ...existing.metadata, ...(data.metadata || {}) };\n    const doc = new Document({\n      pageContent: data.content ?? existing.content,\n      metadata: { _id: entryId, _created_at: now, _updated_at: now, ...mergedMetadata },\n    });\n\n    await vectorStore.addDocuments([doc]);\n\n    return { id: entryId, content: data.content ?? existing.content, metadata: mergedMetadata };\n  }\n\n  async deleteEntry(\n    request: FastifyRequest,\n    collectionName: string,\n    entryId: string\n  ): Promise<boolean> {\n    const collection = await this.getCollectionByName(request, collectionName);\n    if (!collection) throw new Error(`Collection \"${collectionName}\" not found`);\n\n    const vectorStore = await getOrCreateCollectionVectorStore(\n      collectionName, collection.embeddingKey, collection.tenantId\n    );\n\n    try {\n      await vectorStore.delete({ filter: { _id: entryId } } as any);\n      return true;\n    } catch {\n      return false;\n    }\n  }\n\n  async searchEntries(\n    request: FastifyRequest,\n    collectionName: string,\n    params: { query: string; filter?: Record<string, unknown>; top_k?: number }\n  ): Promise<EntryResponse[]> {\n    const collection = await this.getCollectionByName(request, collectionName);\n    if (!collection) throw new Error(`Collection \"${collectionName}\" not found`);\n\n    const vectorStore = await getOrCreateCollectionVectorStore(\n      collectionName, collection.embeddingKey, collection.tenantId\n    );\n\n    let embeddings;\n    try {\n      embeddings = embeddingsLatticeManager.getEmbeddingsClient(collection.embeddingKey);\n    } catch {\n      embeddings = embeddingsLatticeManager.getEmbeddingsClient(\"default\");\n    }\n\n    const queryVector = await embeddings.embedQuery(params.query);\n    const results = await vectorStore.similaritySearchVectorWithScore(\n      queryVector, params.top_k || 5, params.filter as any\n    );\n\n    return results.map(([doc, score]: [Document, number]) => ({\n      id: (doc.metadata._id as string) || uuidv4(),\n      content: doc.pageContent,\n      metadata: Object.fromEntries(\n        Object.entries(doc.metadata).filter(([k]) => !k.startsWith(\"_\"))\n      ),\n      score,\n    }));\n  }\n}\n"],"mappings":";AASA,SAAS,MAAM,cAAc;AAC7B,SAAS,gBAAgB;AACzB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP,SAAS,YAAY,SAAiC;AACpD,SACG,QAAgB,MAAM,YACtB,QAAQ,QAAQ,aAAa,KAC9B;AAEJ;AASO,IAAM,oBAAN,MAAwB;AAAA;AAAA,EAG7B,MAAM,kBAAkB,SAAgD;AACtE,UAAM,WAAW,YAAY,OAAO;AACpC,UAAM,cAAc,MAAM,yBAAyB,kBAAkB,QAAQ;AAE7E,eAAW,KAAK,aAAa;AAC3B,UAAI;AACF,QAAC,EAAU,cAAc,MAAM,wBAAwB,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ;AAAA,MAC3F,QAAQ;AACN,QAAC,EAAU,cAAc;AAAA,MAC3B;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBACJ,SACA,MAC4B;AAC5B,UAAM,WAAW,YAAY,OAAO;AACpC,WAAO,yBAAyB,cAAc,UAAU,IAAI;AAAA,EAC9D;AAAA,EAEA,MAAM,iBACJ,SACA,MACqB;AACrB,UAAM,WAAW,YAAY,OAAO;AACpC,UAAM,aAAa,MAAM,yBAAyB,mBAAmB,UAAU,IAAI;AAEnF,QAAI;AACF,YAAM,iCAAiC,KAAK,MAAM,KAAK,cAAc,QAAQ;AAAA,IAC/E,SAAS,KAAK;AACZ,cAAQ,KAAK,uDAAuD,KAAK,IAAI,KAAK,GAAG;AAAA,IACvF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBACJ,SACA,MACA,SAC4B;AAC5B,UAAM,WAAW,YAAY,OAAO;AACpC,WAAO,yBAAyB,iBAAiB,UAAU,MAAM,OAAO;AAAA,EAC1E;AAAA,EAEA,MAAM,iBACJ,SACA,MACkB;AAClB,UAAM,WAAW,YAAY,OAAO;AACpC,UAAM,4BAA4B,MAAM,QAAQ;AAChD,WAAO,yBAAyB,iBAAiB,UAAU,IAAI;AAAA,EACjE;AAAA;AAAA,EAIA,MAAM,WACJ,SACA,gBAC0B;AAC1B,UAAM,aAAa,MAAM,KAAK,oBAAoB,SAAS,cAAc;AACzE,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,eAAe,cAAc,aAAa;AAE3E,UAAM,OAAO,MAAM,sBAAsB,gBAAgB,WAAW,cAAc,WAAW,QAAQ;AAErG,WAAO,KAAK,IAAI,CAAC,SAAmB;AAAA,MAClC,IAAK,IAAI,SAAS,OAAkB;AAAA,MACpC,SAAS,IAAI;AAAA,MACb,UAAU,OAAO;AAAA,QACf,OAAO,QAAQ,IAAI,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAAA,MACjE;AAAA,IACF,EAAE;AAAA,EACJ;AAAA,EAEA,MAAM,YACJ,SACA,gBACA,MACwB;AACxB,UAAM,aAAa,MAAM,KAAK,oBAAoB,SAAS,cAAc;AACzE,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,eAAe,cAAc,aAAa;AAE3E,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MAAgB,WAAW;AAAA,MAAc,WAAW;AAAA,IACtD;AAEA,UAAM,UAAU,OAAO;AACvB,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,MAAM,IAAI,SAAS;AAAA,MACvB,aAAa,KAAK;AAAA,MAClB,UAAU;AAAA,QACR,KAAK;AAAA,QACL,aAAa;AAAA,QACb,aAAa;AAAA,QACb,GAAI,KAAK,YAAY,CAAC;AAAA,MACxB;AAAA,IACF,CAAC;AAED,UAAM,YAAY,aAAa,CAAC,GAAG,CAAC;AAEpC,WAAO,EAAE,IAAI,SAAS,SAAS,KAAK,SAAS,UAAU,KAAK,YAAY,CAAC,EAAE;AAAA,EAC7E;AAAA,EAEA,MAAM,SACJ,SACA,gBACA,SAC+B;AAC/B,UAAM,aAAa,MAAM,KAAK,oBAAoB,SAAS,cAAc;AACzE,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,eAAe,cAAc,aAAa;AAE3E,UAAM,OAAO,MAAM,sBAAsB,gBAAgB,WAAW,cAAc,WAAW,QAAQ;AACrG,UAAM,MAAM,KAAK,KAAK,CAAC,MAAgB,EAAE,SAAS,QAAQ,OAAO;AACjE,QAAI,CAAC,IAAK,QAAO;AACjB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,IAAI;AAAA,MACb,UAAU,OAAO;AAAA,QACf,OAAO,QAAQ,IAAI,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAAA,MACjE;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,YACJ,SACA,gBACA,SACA,MAC+B;AAC/B,UAAM,WAAW,MAAM,KAAK,SAAS,SAAS,gBAAgB,OAAO;AACrE,QAAI,CAAC,SAAU,QAAO;AAEtB,UAAM,aAAa,MAAM,KAAK,oBAAoB,SAAS,cAAc;AACzE,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,eAAe,cAAc,aAAa;AAE3E,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MAAgB,WAAW;AAAA,MAAc,WAAW;AAAA,IACtD;AAEA,QAAI;AACF,YAAM,YAAY,OAAO,EAAE,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAQ;AAAA,IAC9D,QAAQ;AAAA,IAER;AAEA,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,iBAAiB,EAAE,GAAG,SAAS,UAAU,GAAI,KAAK,YAAY,CAAC,EAAG;AACxE,UAAM,MAAM,IAAI,SAAS;AAAA,MACvB,aAAa,KAAK,WAAW,SAAS;AAAA,MACtC,UAAU,EAAE,KAAK,SAAS,aAAa,KAAK,aAAa,KAAK,GAAG,eAAe;AAAA,IAClF,CAAC;AAED,UAAM,YAAY,aAAa,CAAC,GAAG,CAAC;AAEpC,WAAO,EAAE,IAAI,SAAS,SAAS,KAAK,WAAW,SAAS,SAAS,UAAU,eAAe;AAAA,EAC5F;AAAA,EAEA,MAAM,YACJ,SACA,gBACA,SACkB;AAClB,UAAM,aAAa,MAAM,KAAK,oBAAoB,SAAS,cAAc;AACzE,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,eAAe,cAAc,aAAa;AAE3E,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MAAgB,WAAW;AAAA,MAAc,WAAW;AAAA,IACtD;AAEA,QAAI;AACF,YAAM,YAAY,OAAO,EAAE,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAQ;AAC5D,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,MAAM,cACJ,SACA,gBACA,QAC0B;AAC1B,UAAM,aAAa,MAAM,KAAK,oBAAoB,SAAS,cAAc;AACzE,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,eAAe,cAAc,aAAa;AAE3E,UAAM,cAAc,MAAM;AAAA,MACxB;AAAA,MAAgB,WAAW;AAAA,MAAc,WAAW;AAAA,IACtD;AAEA,QAAI;AACJ,QAAI;AACF,mBAAa,yBAAyB,oBAAoB,WAAW,YAAY;AAAA,IACnF,QAAQ;AACN,mBAAa,yBAAyB,oBAAoB,SAAS;AAAA,IACrE;AAEA,UAAM,cAAc,MAAM,WAAW,WAAW,OAAO,KAAK;AAC5D,UAAM,UAAU,MAAM,YAAY;AAAA,MAChC;AAAA,MAAa,OAAO,SAAS;AAAA,MAAG,OAAO;AAAA,IACzC;AAEA,WAAO,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,OAA2B;AAAA,MACxD,IAAK,IAAI,SAAS,OAAkB,OAAO;AAAA,MAC3C,SAAS,IAAI;AAAA,MACb,UAAU,OAAO;AAAA,QACf,OAAO,QAAQ,IAAI,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAAA,MACjE;AAAA,MACA;AAAA,IACF,EAAE;AAAA,EACJ;AACF;","names":[]}

package/dist/chunk-QUT2DS4R.mjs

@@ -0,0 +1,50 @@
+// src/services/a2a/A2AAgentCardBuilder.ts
+function deriveAgentSkills(assistant) {
+  const enabled = assistant.graphDefinition?.middleware?.filter((m) => m.enabled) ?? [];
+  return enabled.map((m) => ({
+    id: m.type || m.id,
+    name: m.name || m.type || m.id,
+    description: m.description || "",
+    tags: [],
+    examples: []
+  }));
+}
+function buildAgentCardForAssistant(params) {
+  const { assistant, baseUrl } = params;
+  const jsonRpcUrl = `${baseUrl}/api/a2a/agents/${assistant.id}/jsonrpc`;
+  return {
+    name: assistant.name,
+    description: assistant.description ?? "",
+    url: jsonRpcUrl,
+    protocolVersion: "0.3.0",
+    version: "1.0.0",
+    defaultInputModes: ["text"],
+    defaultOutputModes: ["text"],
+    capabilities: {
+      streaming: true,
+      pushNotifications: false,
+      stateTransitionHistory: true
+    },
+    skills: deriveAgentSkills(assistant),
+    additionalInterfaces: [{ transport: "JSONRPC", url: jsonRpcUrl }],
+    securitySchemes: {
+      bearer: {
+        type: "http",
+        scheme: "Bearer",
+        description: "API key sent as an Authorization Bearer token"
+      },
+      apiKeyHeader: {
+        type: "apiKey",
+        in: "header",
+        name: "x-api-key",
+        description: "API key sent via the x-api-key header"
+      }
+    },
+    security: [{ bearer: [] }, { apiKeyHeader: [] }]
+  };
+}
+
+export {
+  buildAgentCardForAssistant
+};
+//# sourceMappingURL=chunk-QUT2DS4R.mjs.map

package/dist/chunk-QUT2DS4R.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/a2a/A2AAgentCardBuilder.ts"],"sourcesContent":["import type { AgentCard, A2ASkill, AgentMiddlewareConfig } from \"@axiom-lattice/protocols\";\n\n/** Minimal assistant shape needed to derive a card from its own definition. */\nexport interface CardAssistant {\n  id: string;\n  name: string;\n  description?: string;\n  graphDefinition?: {\n    middleware?: AgentMiddlewareConfig[];\n  } | null;\n}\n\n/**\n * Parameters for building a per-assistant A2A AgentCard.\n */\nexport interface BuildAgentCardParams {\n  assistant: CardAssistant;\n  /** Gateway origin, e.g. \"https://gw.example.com\". */\n  baseUrl: string;\n}\n\n/**\n * Derive the card's advertised skills from the agent's own definition: every\n * enabled middleware contributes a skill (id = middleware type, name/description\n * from its config). No manual `a2aExposure` declaration — the card reflects\n * what the agent is actually built from.\n */\nexport function deriveAgentSkills(assistant: CardAssistant): A2ASkill[] {\n  const enabled = assistant.graphDefinition?.middleware?.filter((m) => m.enabled) ?? [];\n  return enabled.map((m) => ({\n    id: m.type || m.id,\n    name: m.name || m.type || m.id,\n    description: m.description || \"\",\n    tags: [],\n    examples: [],\n  }));\n}\n\n/**\n * Build an A2A 0.3 AgentCard (discovery document) for a single assistant.\n *\n * `url` points at the assistant's JSON-RPC endpoint (also advertised via\n * `additionalInterfaces`). Skills are derived from the agent definition;\n * input/output modes default to text.\n */\nexport function buildAgentCardForAssistant(params: BuildAgentCardParams): AgentCard {\n  const { assistant, baseUrl } = params;\n  const jsonRpcUrl = `${baseUrl}/api/a2a/agents/${assistant.id}/jsonrpc`;\n\n  return {\n    name: assistant.name,\n    description: assistant.description ?? \"\",\n    url: jsonRpcUrl,\n    protocolVersion: \"0.3.0\",\n    version: \"1.0.0\",\n    defaultInputModes: [\"text\"],\n    defaultOutputModes: [\"text\"],\n    capabilities: {\n      streaming: true,\n      pushNotifications: false,\n      stateTransitionHistory: true,\n    },\n    skills: deriveAgentSkills(assistant),\n    additionalInterfaces: [{ transport: \"JSONRPC\", url: jsonRpcUrl }],\n    securitySchemes: {\n      bearer: {\n        type: \"http\",\n        scheme: \"Bearer\",\n        description: \"API key sent as an Authorization Bearer token\",\n      },\n      apiKeyHeader: {\n        type: \"apiKey\",\n        in: \"header\",\n        name: \"x-api-key\",\n        description: \"API key sent via the x-api-key header\",\n      },\n    },\n    security: [{ bearer: [] }, { apiKeyHeader: [] }],\n  };\n}\n"],"mappings":";AA2BO,SAAS,kBAAkB,WAAsC;AACtE,QAAM,UAAU,UAAU,iBAAiB,YAAY,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,CAAC;AACpF,SAAO,QAAQ,IAAI,CAAC,OAAO;AAAA,IACzB,IAAI,EAAE,QAAQ,EAAE;AAAA,IAChB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE;AAAA,IAC5B,aAAa,EAAE,eAAe;AAAA,IAC9B,MAAM,CAAC;AAAA,IACP,UAAU,CAAC;AAAA,EACb,EAAE;AACJ;AASO,SAAS,2BAA2B,QAAyC;AAClF,QAAM,EAAE,WAAW,QAAQ,IAAI;AAC/B,QAAM,aAAa,GAAG,OAAO,mBAAmB,UAAU,EAAE;AAE5D,SAAO;AAAA,IACL,MAAM,UAAU;AAAA,IAChB,aAAa,UAAU,eAAe;AAAA,IACtC,KAAK;AAAA,IACL,iBAAiB;AAAA,IACjB,SAAS;AAAA,IACT,mBAAmB,CAAC,MAAM;AAAA,IAC1B,oBAAoB,CAAC,MAAM;AAAA,IAC3B,cAAc;AAAA,MACZ,WAAW;AAAA,MACX,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,IAC1B;AAAA,IACA,QAAQ,kBAAkB,SAAS;AAAA,IACnC,sBAAsB,CAAC,EAAE,WAAW,WAAW,KAAK,WAAW,CAAC;AAAA,IAChE,iBAAiB;AAAA,MACf,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,UAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;AAAA,EACjD;AACF;","names":[]}