@axiom-lattice/gateway 6.1.0 → 8.0.0

package/dist/{open-MDC4VCR7.mjs → open-7ED27I5B.mjs}

@@ -5,15 +5,10 @@ import {
 import {
   buildTenantOpenPlugins,
   mergeOpenCatalog
-} from "./chunk-FGSFOXIX.mjs";
+} from "./chunk-L6MBEEII.mjs";
 import {
   OpenRateLimiter
 } from "./chunk-GXZFO3VU.mjs";
-import {
-  deleteSession,
-  getSession,
-  registerSession
-} from "./chunk-K32XEQLH.mjs";
 import {
   collectExposedPluginUiResources
 } from "./chunk-3XIIQ6EK.mjs";
@@ -23,24 +18,23 @@ import {
   ValidationError,
   openLattice
 } from "./chunk-HVIKCUOF.mjs";
-import "./chunk-MWWLJMYN.mjs";
+import "./chunk-XUWD4VKY.mjs";
 import "./chunk-EXPERMZR.mjs";
 import "./chunk-NFEGQTCC.mjs";
 
 // src/routes/open.ts
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
-import { getStoreLattice } from "@axiom-lattice/core";
+import { getReplicaId, getStoreLattice } from "@axiom-lattice/core";
+import { REPLICA_HEADER } from "@axiom-lattice/protocols";
 
 // src/services/open/openMcpServer.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { randomUUID } from "crypto";
 var OPEN_MCP_SERVER_INFO = {
   name: "axiom-open",
   version: "0.1.0"
 };
 async function buildSessionServer(options) {
-  const { credential, catalog, invoke, uiResources } = options;
+  const { catalog, invoke, uiResources } = options;
   const server = new McpServer(OPEN_MCP_SERVER_INFO, {
     capabilities: {
       // The SDK has no `extensions` field; MCP App hosts discover the UI
@@ -91,21 +85,8 @@ async function buildSessionServer(options) {
     );
   }
   const transport = new StreamableHTTPServerTransport({
-    sessionIdGenerator: () => {
-      const sessionId = randomUUID();
-      void registerSession(
-        sessionId,
-        { credentialId: credential.credentialId, kind: credential.kind },
-        { server, transport }
-      );
-      return sessionId;
-    },
-    enableJsonResponse: true,
-    onsessionclosed: (closedId) => {
-      void import("./mcpTransportRegistry-VXUVJKBC.mjs").then(
-        ({ deleteSession: deleteSession2 }) => deleteSession2(closedId)
-      );
-    }
+    sessionIdGenerator: void 0,
+    enableJsonResponse: true
   });
   return { server, transport, tools: catalog };
 }
@@ -116,11 +97,6 @@ function extractBearer(request) {
   if (!header?.startsWith("Bearer ")) return void 0;
   return header.slice("Bearer ".length).trim() || void 0;
 }
-function readSessionId(request) {
-  const raw = request.headers["mcp-session-id"];
-  const value = Array.isArray(raw) ? raw[0] : raw;
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
 function emptyTenantPlugins() {
   return {
     tools: [],
@@ -157,25 +133,12 @@ function registerOpenRoutes(app, deps = {}) {
     }
   })();
   const rateLimiter = deps.rateLimiter ?? new OpenRateLimiter();
-  app.post("/open/mcp", async (request, reply) => {
-    const context = await openAuth.resolve(extractBearer(request));
-    if (!context) {
-      return reply.status(401).send({ error: "AUTH_FAILED" });
-    }
-    const body = request.body;
-    const sessionId = readSessionId(request);
-    if (sessionId) {
-      const session = await getSession(sessionId);
-      if (!session || session.credential.credentialId !== context.credentialId) {
-        return reply.status(404).send({ error: "SESSION_NOT_FOUND" });
-      }
-      reply.hijack();
-      await session.transport.handleRequest(request.raw, reply.raw, body);
-      return;
-    }
-    if (!isInitializeRequest(body)) {
-      return reply.status(400).send({ error: "SESSION_REQUIRED" });
-    }
+  const markReplica = (reply) => {
+    const replica = getReplicaId();
+    reply.header(REPLICA_HEADER, replica);
+    reply.raw.setHeader(REPLICA_HEADER, replica);
+  };
+  const buildServerFor = async (context, log) => {
     const grants = grantsSource(context);
     const catalog = await openLattice.catalogFor(grants, { tenantId: context.tenantId });
     const globalToolNames = new Set(catalog.map((t) => t.toolName));
@@ -184,13 +147,13 @@ function registerOpenRoutes(app, deps = {}) {
     try {
       tenant = await buildTenant(context.tenantId, grants, globalToolNames);
       if (tenant.degraded) {
-        request.log.warn(
+        log.warn(
           { tenantId: context.tenantId },
           "open mcp: tenant plugin catalog degraded; serving global tools only"
         );
       }
     } catch (error) {
-      request.log.warn(
+      log.warn(
         { tenantId: context.tenantId, err: error },
         "open mcp: tenant plugin catalog unavailable; serving global tools only"
       );
@@ -289,40 +252,40 @@ function registerOpenRoutes(app, deps = {}) {
         }
       }
     });
-    await built.server.connect(built.transport);
-    reply.hijack();
-    await built.transport.handleRequest(request.raw, reply.raw, body);
-  });
-  app.get("/open/mcp", async (request, reply) => {
-    const sessionId = readSessionId(request);
-    if (!sessionId) {
-      reply.header("Allow", "GET, POST, DELETE");
-      return reply.status(405).send();
-    }
+    return built;
+  };
+  const handleOpenMcpPost = async (request, reply) => {
+    markReplica(reply);
     const context = await openAuth.resolve(extractBearer(request));
     if (!context) {
       return reply.status(401).send({ error: "AUTH_FAILED" });
     }
-    const session = await getSession(sessionId);
-    if (!session || session.credential.credentialId !== context.credentialId) {
-      return reply.status(404).send({ error: "SESSION_NOT_FOUND" });
-    }
+    const built = await buildServerFor(context, request.log);
+    await built.server.connect(built.transport);
     reply.hijack();
-    await session.transport.handleRequest(request.raw, reply.raw);
-  });
-  app.delete(
-    "/open/mcp",
-    async (request, reply) => {
-      const sessionId = readSessionId(request);
-      if (!sessionId) {
-        return reply.status(400).send({ error: "SESSION_REQUIRED" });
-      }
-      await deleteSession(sessionId);
-      return reply.status(204).send();
-    }
-  );
+    const close = () => {
+      void built.transport.close().catch(() => void 0);
+      void built.server.close().catch(() => void 0);
+    };
+    reply.raw.once("close", close);
+    await built.transport.handleRequest(request.raw, reply.raw, request.body);
+  };
+  const methodNotAllowed = async (_request, reply) => {
+    reply.header("Allow", "POST");
+    return reply.status(405).send({ error: "METHOD_NOT_ALLOWED" });
+  };
+  app.post("/open/mcp", handleOpenMcpPost);
+  app.post("/mcp", handleOpenMcpPost);
+  app.post("/mcp/", handleOpenMcpPost);
+  app.get("/mcp", methodNotAllowed);
+  app.get("/mcp/", methodNotAllowed);
+  app.get("/open/mcp", methodNotAllowed);
+  app.get("/open/mcp/", methodNotAllowed);
+  app.delete("/open/mcp", methodNotAllowed);
+  app.delete("/mcp", methodNotAllowed);
+  app.delete("/mcp/", methodNotAllowed);
 }
 export {
   registerOpenRoutes
 };
-//# sourceMappingURL=open-MDC4VCR7.mjs.map
+//# sourceMappingURL=open-7ED27I5B.mjs.map

package/dist/open-7ED27I5B.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/routes/open.ts","../src/services/open/openMcpServer.ts"],"sourcesContent":["/**\n * Open API surface routes: GET/POST/DELETE /open/mcp.\n *\n * The route is a thin shell — credential resolution (OpenAuthService),\n * catalog filtering and invocation (OpenLattice), and stateless MCP server\n * construction live in services/open/*. The transport writes the response\n * itself, so the reply is hijacked (same precedent as the Project Room SSE\n * route).\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport { getReplicaId, getStoreLattice } from \"@axiom-lattice/core\";\nimport { REPLICA_HEADER, type A2AApiKeyStore, type OpenAuditStore, type OpenGrant, type ProjectStore } from \"@axiom-lattice/protocols\";\nimport { OpenCredentialService } from \"../services/open/openCredentialService\";\nimport { OpenAuditService } from \"../services/open/openAuditService\";\nimport { OpenRateLimiter } from \"../services/open/openRateLimiter\";\nimport type { OpenCredential } from \"../services/open/openCredentialService\";\nimport {\n  openLattice,\n  ActionNotFoundError,\n  GrantDeniedError,\n  ValidationError,\n} from \"../services/open/openLattice\";\nimport { buildSessionServer } from \"../services/open/openMcpServer\";\nimport { collectExposedPluginUiResources } from \"../services/open/registerExposedPlugins\";\nimport {\n  buildTenantOpenPlugins,\n  mergeOpenCatalog,\n  type TenantOpenPlugins,\n} from \"../services/open/tenantOpenPlugins\";\n\nexport interface OpenRouteDeps {\n  openAuth?: OpenCredentialService;\n  grantsSource?: (ctx: OpenCredential) => OpenGrant[];\n  audit?: OpenAuditService;\n  rateLimiter?: OpenRateLimiter;\n  /**\n   * Test seam: build the credential's tenant sandbox plugin bundle. Defaults to\n   * {@link buildTenantOpenPlugins} with the global catalog's tool names reserved\n   * so a tenant tool can never shadow a global/built-in one.\n   */\n  tenantPlugins?: (\n    tenantId: string,\n    grants: OpenGrant[],\n    reservedToolNames: ReadonlySet<string>,\n  ) => Promise<TenantOpenPlugins>;\n}\n\nfunction extractBearer(request: FastifyRequest): string | undefined {\n  const header = request.headers.authorization;\n  if (!header?.startsWith(\"Bearer \")) return undefined;\n  return header.slice(\"Bearer \".length).trim() || undefined;\n}\n\n/**\n * Degraded tenant plugin bundle used when the sandbox catalog cannot be read.\n *\n * A catalog read failure must not 500 the session: the MCP server still builds\n * and serves the global tools. `invoke` is unreachable through normal routing\n * (`hasTool` is always false, so calls route to OpenLattice) but returns an\n * error result if it is ever reached.\n */\nfunction emptyTenantPlugins(): TenantOpenPlugins {\n  return {\n    tools: [],\n    uiResources: new Map(),\n    hasTool: () => false,\n    degraded: true,\n    invoke: async (toolName) => ({\n      content: [\n        { type: \"text\", text: `Tenant plugin catalog unavailable for ${toolName}` },\n      ],\n      isError: true,\n    }),\n  };\n}\n\n/** JSON-RPC error codes used on the Open surface. */\nconst RPC_ERROR = {\n  GRANT_DENIED: -32001,\n  ACTION_NOT_FOUND: -32002,\n  VALIDATION_FAILED: -32003,\n  EXECUTION_ERROR: -32004,\n  RATE_LIMITED: -32005,\n} as const;\n\nexport function registerOpenRoutes(\n  app: FastifyInstance,\n  deps: OpenRouteDeps = {},\n): void {\n  const openAuth =\n    deps.openAuth ??\n    new OpenCredentialService(\n      getStoreLattice(\"default\", \"a2aApiKey\").store as A2AApiKeyStore,\n      getStoreLattice(\"default\", \"project\").store as ProjectStore,\n    );\n  const grantsSource =\n    deps.grantsSource ?? ((ctx: OpenCredential) => ctx.grants);\n  const audit =\n    deps.audit ??\n    (() => {\n      try {\n        const store = getStoreLattice(\"default\", \"openAudit\").store as OpenAuditStore;\n        return new OpenAuditService(store);\n      } catch {\n        return undefined;\n      }\n    })();\n\n  const rateLimiter = deps.rateLimiter ?? new OpenRateLimiter();\n\n  const markReplica = (reply: FastifyReply): void => {\n    const replica = getReplicaId();\n    reply.header(REPLICA_HEADER, replica);\n    reply.raw.setHeader(REPLICA_HEADER, replica);\n  };\n\n  const buildServerFor = async (\n    context: OpenCredential,\n    log: FastifyRequest[\"log\"],\n  ) => {\n    const grants = grantsSource(context);\n    const catalog = await openLattice.catalogFor(grants, { tenantId: context.tenantId });\n    // Tenant sandbox plugins are volume-resident and outside the OpenLattice\n    // registry; merge their grant-filtered tools/UI alongside the globals.\n    // Global/built-in tool names are reserved so a tenant plugin of the same\n    // type (kb/sandbox/agent) can neither crash `registerTool` with a duplicate\n    // nor capture the invoke routing for a global tool.\n    const globalToolNames = new Set(catalog.map((t) => t.toolName));\n    const buildTenant =\n      deps.tenantPlugins ??\n      ((tenantId, tenantGrants, reservedToolNames) =>\n        buildTenantOpenPlugins(tenantId, tenantGrants, { reservedToolNames }));\n    let tenant: TenantOpenPlugins;\n    try {\n      tenant = await buildTenant(context.tenantId, grants, globalToolNames);\n      if (tenant.degraded) {\n        // The catalog's common failure mode is a diagnostic, not a throw\n        // (`ensureLoaded` returns error-level diagnostics). Surface it and\n        // serve global tools only.\n        log.warn(\n          { tenantId: context.tenantId },\n          \"open mcp: tenant plugin catalog degraded; serving global tools only\",\n        );\n      }\n    } catch (error) {\n      // Sandbox catalogs are volume-resident and can be transiently\n      // unavailable; degrade to globals-only rather than failing the whole\n      // session so external hosts can still connect. `err` keeps the stack.\n      log.warn(\n        { tenantId: context.tenantId, err: error },\n        \"open mcp: tenant plugin catalog unavailable; serving global tools only\",\n      );\n      tenant = emptyTenantPlugins();\n    }\n    const mergedCatalog = mergeOpenCatalog(catalog, tenant.tools);\n    const uiResources = new Map([\n      ...collectExposedPluginUiResources(grants),\n      ...tenant.uiResources,\n    ]);\n    const built = await buildSessionServer({\n      credential: { credentialId: context.credentialId, kind: context.kind },\n      grants,\n      catalog: mergedCatalog,\n      uiResources,\n      invoke: async (toolName, args) => {\n        const startedAt = Date.now();\n        const sep = toolName.indexOf(\"_\");\n        const auditDomain = sep > 0 ? toolName.slice(0, sep) : toolName;\n        const auditAction = sep > 0 ? toolName.slice(sep + 1) : \"\";\n\n        const decision = rateLimiter.check(context.credentialId, auditDomain);\n        if (!decision.allowed) {\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode: \"RATE_LIMITED\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(\n              `RATE_LIMITED: retry after ${decision.retryAfterMs ?? 1000}ms`,\n            ),\n            { rpcCode: RPC_ERROR.RATE_LIMITED },\n          );\n        }\n\n        try {\n          const isTenantRoute = tenant.hasTool(toolName) && !globalToolNames.has(toolName);\n          const runConfig: Record<string, unknown> = {\n            sandboxName: context.sandboxName,\n            credentialId: context.credentialId,\n            depth: context.depth,\n          };\n          const result = isTenantRoute\n            ? await tenant.invoke(toolName, args, {\n                tenantId: context.tenantId,\n                projectId: context.projectId,\n                workspaceId: context.workspaceId,\n                runConfig,\n              })\n            : await openLattice.invoke(\n                grants,\n                {\n                  tenantId: context.tenantId,\n                  projectId: context.projectId,\n                  workspaceId: context.workspaceId,\n                  runConfig,\n                },\n                toolName,\n                args,\n              );\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: result.isError ? \"error\" : \"ok\",\n            ...(result.isError ? { errorCode: \"EXECUTION_ERROR\" } : {}),\n            durationMs: Date.now() - startedAt,\n          });\n          return result;\n        } catch (err) {\n          const code =\n            err instanceof GrantDeniedError\n              ? RPC_ERROR.GRANT_DENIED\n              : err instanceof ActionNotFoundError\n                ? RPC_ERROR.ACTION_NOT_FOUND\n                : err instanceof ValidationError\n                  ? RPC_ERROR.VALIDATION_FAILED\n                  : RPC_ERROR.EXECUTION_ERROR;\n          await audit?.record({\n            tenantId: context.tenantId,\n            credentialId: context.credentialId,\n            credentialKind: context.kind,\n            projectId: context.projectId,\n            domain: auditDomain,\n            action: auditAction,\n            args,\n            status: \"error\",\n            errorCode:\n              err instanceof GrantDeniedError\n                ? \"GRANT_DENIED\"\n                : err instanceof ActionNotFoundError\n                  ? \"ACTION_NOT_FOUND\"\n                  : err instanceof ValidationError\n                    ? \"VALIDATION_FAILED\"\n                    : \"EXECUTION_ERROR\",\n            durationMs: Date.now() - startedAt,\n          });\n          throw Object.assign(\n            new Error(err instanceof Error ? err.message : String(err)),\n            { rpcCode: code },\n          );\n        }\n      },\n    });\n    return built;\n  };\n\n  const handleOpenMcpPost = async (\n    request: FastifyRequest,\n    reply: FastifyReply,\n  ) => {\n    markReplica(reply);\n    const context = await openAuth.resolve(extractBearer(request));\n    if (!context) {\n      return reply.status(401).send({ error: \"AUTH_FAILED\" });\n    }\n\n    const built = await buildServerFor(context, request.log);\n    await built.server.connect(built.transport);\n    reply.hijack();\n    const close = (): void => {\n      void built.transport.close().catch(() => undefined);\n      void built.server.close().catch(() => undefined);\n    };\n    reply.raw.once(\"close\", close);\n    await built.transport.handleRequest(request.raw, reply.raw, request.body);\n  };\n\n  const methodNotAllowed = async (\n    _request: FastifyRequest,\n    reply: FastifyReply,\n  ) => {\n    reply.header(\"Allow\", \"POST\");\n    return reply.status(405).send({ error: \"METHOD_NOT_ALLOWED\" });\n  };\n\n  app.post(\"/open/mcp\", handleOpenMcpPost);\n  // Canonical MCP surface aliases the unified Open MCP server.\n  app.post(\"/mcp\", handleOpenMcpPost);\n  app.post(\"/mcp/\", handleOpenMcpPost);\n  app.get(\"/mcp\", methodNotAllowed);\n  app.get(\"/mcp/\", methodNotAllowed);\n\n  // Stateless Streamable HTTP has no server→client GET stream or session\n  // DELETE. A 404 is not a recognized \"not supported\" signal: the official\n  // client transport tolerates 405 (`Allow` set) and continues.\n  app.get(\"/open/mcp\", methodNotAllowed);\n  app.get(\"/open/mcp/\", methodNotAllowed);\n  app.delete(\"/open/mcp\", methodNotAllowed);\n  app.delete(\"/mcp\", methodNotAllowed);\n  app.delete(\"/mcp/\", methodNotAllowed);\n\n}\n","/**\n * Builds a stateless MCP server instance whose tool list is the\n * credential-filtered OpenLattice catalog. A fresh instance is built per HTTP\n * request so no server/session state is shared between replicas.\n *\n * The transport uses `sessionIdGenerator: undefined`: it never issues\n * `Mcp-Session-Id`, and every request is self-contained. Credential-scoped\n * tool lists therefore stay per-request without a session registry.\n *\n * Every tool executor routes through the OpenLattice invoke kernel, so\n * authorization is re-checked on each invocation (default-deny, live grants).\n */\n\nimport { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { StreamableHTTPServerTransport } from \"@modelcontextprotocol/sdk/server/streamableHttp.js\";\nimport type { McpUiCsp, OpenGrant } from \"@axiom-lattice/protocols\";\nimport type { OpenToolDescriptor } from \"./openLattice\";\n\nexport const OPEN_MCP_SERVER_INFO = {\n  name: \"axiom-open\",\n  version: \"0.1.0\",\n} as const;\n\n/**\n * A `ui://` HTML resource served by the session. `read` is invoked per\n * `resources/read`, so the caller can fetch plugin UI lazily.\n */\nexport interface OpenUiResource {\n  /** MIME for the resource; defaults to \"text/html;profile=mcp-app\". */\n  mimeType?: string;\n  csp?: McpUiCsp;\n  read: () => Promise<{ html: string; csp?: McpUiCsp }>;\n}\n\nexport interface BuiltSession {\n  server: McpServer;\n  transport: StreamableHTTPServerTransport;\n  tools: OpenToolDescriptor[];\n}\n\n/**\n * Builds (but does not connect) a stateless MCP server. The caller MUST\n * connect it to a transport (`await built.server.connect(built.transport)`)\n * before handling a request — otherwise the transport has no onmessage\n * handler and the request is swallowed. Deferring connect is what lets tests\n * attach the server to an `InMemoryTransport`.\n */\nexport async function buildSessionServer(options: {\n  credential: { credentialId: string; kind: string };\n  grants: OpenGrant[];\n  catalog: OpenToolDescriptor[];\n  invoke: (\n    toolName: string,\n    args: unknown,\n  ) => Promise<{\n    content: Array<{ type: \"text\"; text: string }>;\n    isError?: boolean;\n  }>;\n  uiResources?: Map<string, OpenUiResource>;\n}): Promise<BuiltSession> {\n  const { catalog, invoke, uiResources } = options;\n  const server = new McpServer(OPEN_MCP_SERVER_INFO, {\n    capabilities: {\n      // The SDK has no `extensions` field; MCP App hosts discover the UI\n      // extension through `experimental`.\n      experimental: { \"io.modelcontextprotocol/ui\": {} },\n    },\n  });\n  for (const tool of catalog) {\n    server.registerTool(\n      tool.toolName,\n      {\n        description: tool.description,\n        inputSchema: tool.schema,\n        annotations: {\n          readOnlyHint: tool.annotations.readOnlyHint,\n          destructiveHint: tool.annotations.destructiveHint,\n        },\n        ...(tool.ui ? { _meta: { ui: { resourceUri: tool.ui.resourceUri } } } : {}),\n      },\n      async (args: unknown) => {\n        const result = await invoke(tool.toolName, args);\n        return { content: result.content, isError: result.isError };\n      },\n    );\n  }\n  for (const [uri, res] of uiResources ?? []) {\n    const mimeType = res.mimeType ?? \"text/html;profile=mcp-app\";\n    server.registerResource(\n      `mcp-app:${uri}`,\n      uri,\n      {\n        mimeType,\n        ...(res.csp ? { _meta: { ui: { csp: res.csp } } } : {}),\n      },\n      async (u) => {\n        const { html, csp } = await res.read();\n        return {\n          contents: [\n            {\n              uri: u.href,\n              mimeType,\n              text: html,\n              ...(csp ? { _meta: { ui: { csp } } } : {}),\n            },\n          ],\n        };\n      },\n    );\n  }\n  const transport = new StreamableHTTPServerTransport({\n    sessionIdGenerator: undefined,\n    enableJsonResponse: true,\n  });\n  return { server, transport, tools: catalog };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAWA,SAAS,cAAc,uBAAuB;AAC9C,SAAS,sBAAmG;;;ACC5G,SAAS,iBAAiB;AAC1B,SAAS,qCAAqC;AAIvC,IAAM,uBAAuB;AAAA,EAClC,MAAM;AAAA,EACN,SAAS;AACX;AA0BA,eAAsB,mBAAmB,SAYf;AACxB,QAAM,EAAE,SAAS,QAAQ,YAAY,IAAI;AACzC,QAAM,SAAS,IAAI,UAAU,sBAAsB;AAAA,IACjD,cAAc;AAAA;AAAA;AAAA,MAGZ,cAAc,EAAE,8BAA8B,CAAC,EAAE;AAAA,IACnD;AAAA,EACF,CAAC;AACD,aAAW,QAAQ,SAAS;AAC1B,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,QACE,aAAa,KAAK;AAAA,QAClB,aAAa,KAAK;AAAA,QAClB,aAAa;AAAA,UACX,cAAc,KAAK,YAAY;AAAA,UAC/B,iBAAiB,KAAK,YAAY;AAAA,QACpC;AAAA,QACA,GAAI,KAAK,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,KAAK,GAAG,YAAY,EAAE,EAAE,IAAI,CAAC;AAAA,MAC3E;AAAA,MACA,OAAO,SAAkB;AACvB,cAAM,SAAS,MAAM,OAAO,KAAK,UAAU,IAAI;AAC/C,eAAO,EAAE,SAAS,OAAO,SAAS,SAAS,OAAO,QAAQ;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,KAAK,GAAG,KAAK,eAAe,CAAC,GAAG;AAC1C,UAAM,WAAW,IAAI,YAAY;AACjC,WAAO;AAAA,MACL,WAAW,GAAG;AAAA,MACd;AAAA,MACA;AAAA,QACE;AAAA,QACA,GAAI,IAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,MACvD;AAAA,MACA,OAAO,MAAM;AACX,cAAM,EAAE,MAAM,IAAI,IAAI,MAAM,IAAI,KAAK;AACrC,eAAO;AAAA,UACL,UAAU;AAAA,YACR;AAAA,cACE,KAAK,EAAE;AAAA,cACP;AAAA,cACA,MAAM;AAAA,cACN,GAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,YAC1C;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,IAAI,8BAA8B;AAAA,IAClD,oBAAoB;AAAA,IACpB,oBAAoB;AAAA,EACtB,CAAC;AACD,SAAO,EAAE,QAAQ,WAAW,OAAO,QAAQ;AAC7C;;;ADnEA,SAAS,cAAc,SAA6C;AAClE,QAAM,SAAS,QAAQ,QAAQ;AAC/B,MAAI,CAAC,QAAQ,WAAW,SAAS,EAAG,QAAO;AAC3C,SAAO,OAAO,MAAM,UAAU,MAAM,EAAE,KAAK,KAAK;AAClD;AAUA,SAAS,qBAAwC;AAC/C,SAAO;AAAA,IACL,OAAO,CAAC;AAAA,IACR,aAAa,oBAAI,IAAI;AAAA,IACrB,SAAS,MAAM;AAAA,IACf,UAAU;AAAA,IACV,QAAQ,OAAO,cAAc;AAAA,MAC3B,SAAS;AAAA,QACP,EAAE,MAAM,QAAQ,MAAM,yCAAyC,QAAQ,GAAG;AAAA,MAC5E;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAGA,IAAM,YAAY;AAAA,EAChB,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,cAAc;AAChB;AAEO,SAAS,mBACd,KACA,OAAsB,CAAC,GACjB;AACN,QAAM,WACJ,KAAK,YACL,IAAI;AAAA,IACF,gBAAgB,WAAW,WAAW,EAAE;AAAA,IACxC,gBAAgB,WAAW,SAAS,EAAE;AAAA,EACxC;AACF,QAAM,eACJ,KAAK,iBAAiB,CAAC,QAAwB,IAAI;AACrD,QAAM,QACJ,KAAK,UACJ,MAAM;AACL,QAAI;AACF,YAAM,QAAQ,gBAAgB,WAAW,WAAW,EAAE;AACtD,aAAO,IAAI,iBAAiB,KAAK;AAAA,IACnC,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,GAAG;AAEL,QAAM,cAAc,KAAK,eAAe,IAAI,gBAAgB;AAE5D,QAAM,cAAc,CAAC,UAA8B;AACjD,UAAM,UAAU,aAAa;AAC7B,UAAM,OAAO,gBAAgB,OAAO;AACpC,UAAM,IAAI,UAAU,gBAAgB,OAAO;AAAA,EAC7C;AAEA,QAAM,iBAAiB,OACrB,SACA,QACG;AACH,UAAM,SAAS,aAAa,OAAO;AACnC,UAAM,UAAU,MAAM,YAAY,WAAW,QAAQ,EAAE,UAAU,QAAQ,SAAS,CAAC;AAMnF,UAAM,kBAAkB,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AAC9D,UAAM,cACJ,KAAK,kBACJ,CAAC,UAAU,cAAc,sBACxB,uBAAuB,UAAU,cAAc,EAAE,kBAAkB,CAAC;AACxE,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,YAAY,QAAQ,UAAU,QAAQ,eAAe;AACpE,UAAI,OAAO,UAAU;AAInB,YAAI;AAAA,UACF,EAAE,UAAU,QAAQ,SAAS;AAAA,UAC7B;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AAId,UAAI;AAAA,QACF,EAAE,UAAU,QAAQ,UAAU,KAAK,MAAM;AAAA,QACzC;AAAA,MACF;AACA,eAAS,mBAAmB;AAAA,IAC9B;AACA,UAAM,gBAAgB,iBAAiB,SAAS,OAAO,KAAK;AAC5D,UAAM,cAAc,IAAI,IAAI;AAAA,MAC1B,GAAG,gCAAgC,MAAM;AAAA,MACzC,GAAG,OAAO;AAAA,IACZ,CAAC;AACD,UAAM,QAAQ,MAAM,mBAAmB;AAAA,MACrC,YAAY,EAAE,cAAc,QAAQ,cAAc,MAAM,QAAQ,KAAK;AAAA,MACrE;AAAA,MACA,SAAS;AAAA,MACT;AAAA,MACA,QAAQ,OAAO,UAAU,SAAS;AAChC,cAAM,YAAY,KAAK,IAAI;AAC3B,cAAM,MAAM,SAAS,QAAQ,GAAG;AAChC,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,GAAG,GAAG,IAAI;AACvD,cAAM,cAAc,MAAM,IAAI,SAAS,MAAM,MAAM,CAAC,IAAI;AAExD,cAAM,WAAW,YAAY,MAAM,QAAQ,cAAc,WAAW;AACpE,YAAI,CAAC,SAAS,SAAS;AACrB,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WAAW;AAAA,YACX,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI;AAAA,cACF,6BAA6B,SAAS,gBAAgB,GAAI;AAAA,YAC5D;AAAA,YACA,EAAE,SAAS,UAAU,aAAa;AAAA,UACpC;AAAA,QACF;AAEA,YAAI;AACF,gBAAM,gBAAgB,OAAO,QAAQ,QAAQ,KAAK,CAAC,gBAAgB,IAAI,QAAQ;AAC/E,gBAAM,YAAqC;AAAA,YACzC,aAAa,QAAQ;AAAA,YACrB,cAAc,QAAQ;AAAA,YACtB,OAAO,QAAQ;AAAA,UACjB;AACA,gBAAM,SAAS,gBACX,MAAM,OAAO,OAAO,UAAU,MAAM;AAAA,YAClC,UAAU,QAAQ;AAAA,YAClB,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB;AAAA,UACF,CAAC,IACD,MAAM,YAAY;AAAA,YAChB;AAAA,YACA;AAAA,cACE,UAAU,QAAQ;AAAA,cAClB,WAAW,QAAQ;AAAA,cACnB,aAAa,QAAQ;AAAA,cACrB;AAAA,YACF;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACJ,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ,OAAO,UAAU,UAAU;AAAA,YACnC,GAAI,OAAO,UAAU,EAAE,WAAW,kBAAkB,IAAI,CAAC;AAAA,YACzD,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,iBAAO;AAAA,QACT,SAAS,KAAK;AACZ,gBAAM,OACJ,eAAe,mBACX,UAAU,eACV,eAAe,sBACb,UAAU,mBACV,eAAe,kBACb,UAAU,oBACV,UAAU;AACpB,gBAAM,OAAO,OAAO;AAAA,YAClB,UAAU,QAAQ;AAAA,YAClB,cAAc,QAAQ;AAAA,YACtB,gBAAgB,QAAQ;AAAA,YACxB,WAAW,QAAQ;AAAA,YACnB,QAAQ;AAAA,YACR,QAAQ;AAAA,YACR;AAAA,YACA,QAAQ;AAAA,YACR,WACE,eAAe,mBACX,iBACA,eAAe,sBACb,qBACA,eAAe,kBACb,sBACA;AAAA,YACV,YAAY,KAAK,IAAI,IAAI;AAAA,UAC3B,CAAC;AACD,gBAAM,OAAO;AAAA,YACX,IAAI,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,YAC1D,EAAE,SAAS,KAAK;AAAA,UAClB;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AAEA,QAAM,oBAAoB,OACxB,SACA,UACG;AACH,gBAAY,KAAK;AACjB,UAAM,UAAU,MAAM,SAAS,QAAQ,cAAc,OAAO,CAAC;AAC7D,QAAI,CAAC,SAAS;AACZ,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,cAAc,CAAC;AAAA,IACxD;AAEA,UAAM,QAAQ,MAAM,eAAe,SAAS,QAAQ,GAAG;AACvD,UAAM,MAAM,OAAO,QAAQ,MAAM,SAAS;AAC1C,UAAM,OAAO;AACb,UAAM,QAAQ,MAAY;AACxB,WAAK,MAAM,UAAU,MAAM,EAAE,MAAM,MAAM,MAAS;AAClD,WAAK,MAAM,OAAO,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,IACjD;AACA,UAAM,IAAI,KAAK,SAAS,KAAK;AAC7B,UAAM,MAAM,UAAU,cAAc,QAAQ,KAAK,MAAM,KAAK,QAAQ,IAAI;AAAA,EAC1E;AAEA,QAAM,mBAAmB,OACvB,UACA,UACG;AACH,UAAM,OAAO,SAAS,MAAM;AAC5B,WAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,EAC/D;AAEA,MAAI,KAAK,aAAa,iBAAiB;AAEvC,MAAI,KAAK,QAAQ,iBAAiB;AAClC,MAAI,KAAK,SAAS,iBAAiB;AACnC,MAAI,IAAI,QAAQ,gBAAgB;AAChC,MAAI,IAAI,SAAS,gBAAgB;AAKjC,MAAI,IAAI,aAAa,gBAAgB;AACrC,MAAI,IAAI,cAAc,gBAAgB;AACtC,MAAI,OAAO,aAAa,gBAAgB;AACxC,MAAI,OAAO,QAAQ,gBAAgB;AACnC,MAAI,OAAO,SAAS,gBAAgB;AAEtC;","names":[]}

package/dist/{open-exposure-OX5NKWDG.mjs → open-exposure-I3DN2X4E.mjs}

@@ -1,14 +1,14 @@
 import {
   buildAgentCardForAssistant
-} from "./chunk-QUT2DS4R.mjs";
+} from "./chunk-W3YH4S6G.mjs";
 import {
   buildTenantOpenPlugins,
   mergeOpenCatalog
-} from "./chunk-FGSFOXIX.mjs";
+} from "./chunk-L6MBEEII.mjs";
 import {
   openLattice
 } from "./chunk-HVIKCUOF.mjs";
-import "./chunk-MWWLJMYN.mjs";
+import "./chunk-XUWD4VKY.mjs";
 import "./chunk-NFEGQTCC.mjs";
 
 // src/routes/open-exposure.ts
@@ -57,6 +57,12 @@ function registerOpenExposureRoutes(app, deps = {}) {
       }));
       const agentGrant = grants.find((g) => g.domain === "agent");
       const assistantStore = getStoreLattice("default", "assistant").store;
+      let pushNotifications = false;
+      try {
+        pushNotifications = Boolean(getStoreLattice("default", "store").store);
+      } catch {
+        pushNotifications = false;
+      }
       const agents = [];
       for (const assistantId of agentGrant?.items ?? []) {
         const assistant = await assistantStore.getAssistantById(
@@ -68,7 +74,13 @@ function registerOpenExposureRoutes(app, deps = {}) {
           assistantId,
           cardUrl: `${baseUrl}/api/a2a/agents/${assistantId}/.well-known/agent-card.json`,
           jsonrpcUrl: `${baseUrl}/api/a2a/agents/${assistantId}/jsonrpc`,
-          card: buildAgentCardForAssistant({ assistant, baseUrl })
+          v1CardUrl: `${baseUrl}/a2a/v1/${assistantId}/.well-known/agent-card.json`,
+          v1JsonrpcUrl: `${baseUrl}/a2a/v1/${assistantId}`,
+          card: buildAgentCardForAssistant({
+            assistant,
+            baseUrl,
+            pushNotifications
+          })
         });
       }
       return reply.status(200).send({
@@ -94,4 +106,4 @@ function registerOpenExposureRoutes(app, deps = {}) {
 export {
   registerOpenExposureRoutes
 };
-//# sourceMappingURL=open-exposure-OX5NKWDG.mjs.map
+//# sourceMappingURL=open-exposure-I3DN2X4E.mjs.map

package/dist/{open-exposure-OX5NKWDG.mjs.map → open-exposure-I3DN2X4E.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/routes/open-exposure.ts"],"sourcesContent":["/**\n * Key exposure endpoint: what a given API key exposes to external callers —\n * the MCP tools (per grants) and the A2A agent cards (for granted agents).\n * Console-session guarded and tenant-scoped.\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport { getStoreLattice } from \"@axiom-lattice/core\";\nimport type {\n  A2AApiKeyStore,\n  AssistantStore,\n  OpenGrant,\n} from \"@axiom-lattice/protocols\";\nimport { effectiveGrants } from \"@axiom-lattice/protocols\";\nimport {\n  openLattice,\n  type OpenToolDescriptor,\n} from \"../services/open/openLattice\";\nimport {\n  buildTenantOpenPlugins,\n  mergeOpenCatalog,\n  type TenantOpenPluginDeps,\n} from \"../services/open/tenantOpenPlugins\";\nimport { buildAgentCardForAssistant } from \"../services/a2a/A2AAgentCardBuilder\";\n\ninterface RequestWithUser extends FastifyRequest {\n  user?: { id: string; tenantId?: string };\n}\n\n/** Overridable seams for the exposure route (tests / embedding). */\nexport interface OpenExposureDeps {\n  /** Tenant sandbox plugin catalog seams; defaults to the live sandbox catalog. */\n  tenantPluginDeps?: TenantOpenPluginDeps;\n}\n\nexport function registerOpenExposureRoutes(\n  app: FastifyInstance,\n  deps: OpenExposureDeps = {},\n): void {\n  app.get<{ Params: { id: string } }>(\n    \"/api/keys/:id/exposure\",\n    async (\n      request: FastifyRequest<{ Params: { id: string } }>,\n      reply: FastifyReply,\n    ) => {\n      const tenantId = (request as RequestWithUser).user?.tenantId;\n      if (!tenantId) {\n        return reply.status(401).send({ success: false, error: \"Unauthorized\" });\n      }\n\n      const keyStore = getStoreLattice(\"default\", \"a2aApiKey\")\n        .store as A2AApiKeyStore;\n      const record = await keyStore.findById(request.params.id);\n      if (!record || record.tenantId !== tenantId) {\n        return reply.status(404).send({ success: false, error: \"Key not found\" });\n      }\n\n      const grants: OpenGrant[] = effectiveGrants(record);\n      // Include the port: request.hostname strips it, request.headers.host keeps it.\n      const forwardedHost = request.headers[\"x-forwarded-host\"];\n      const host =\n        (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ??\n        (Array.isArray(request.headers.host) ? request.headers.host[0] : request.headers.host) ??\n        request.hostname;\n      const baseUrl = `${request.protocol}://${host}`;\n\n      // MCP surface: the credential-filtered tool catalog.\n      const globalCatalog = await openLattice.catalogFor(grants, { tenantId });\n\n      // Tenant sandbox plugins live in per-tenant volumes, outside the\n      // OpenLattice registry, so the globals are merged with the credential's\n      // grant-filtered tenant tools (global wins) to mirror the actual Open MCP\n      // session. A missing/unavailable sandbox catalog degrades to globals.\n      let tenantTools: OpenToolDescriptor[] = [];\n      let tenantCatalogDegraded = false;\n      try {\n        const tenant = await buildTenantOpenPlugins(tenantId, grants, {\n          ...deps.tenantPluginDeps,\n          reservedToolNames: new Set(globalCatalog.map((t) => t.toolName)),\n        });\n        tenantTools = tenant.tools;\n        tenantCatalogDegraded = tenant.degraded;\n      } catch (error) {\n        tenantCatalogDegraded = true;\n        request.log.warn(\n          { tenantId, err: error },\n          \"key exposure: tenant plugin catalog unavailable\",\n        );\n      }\n\n      const tools = mergeOpenCatalog(globalCatalog, tenantTools).map((t) => ({\n        domain: t.domain,\n        toolName: t.toolName,\n        description: t.description,\n        annotations: t.annotations,\n        hasUi: Boolean(t.ui),\n      }));\n\n      // A2A surface: one card per granted agent.\n      const agentGrant = grants.find((g) => g.domain === \"agent\");\n      const assistantStore = getStoreLattice(\"default\", \"assistant\")\n        .store as AssistantStore;\n      const agents: Array<{\n        assistantId: string;\n        cardUrl: string;\n        jsonrpcUrl: string;\n        card: unknown;\n      }> = [];\n      for (const assistantId of agentGrant?.items ?? []) {\n        const assistant = await assistantStore.getAssistantById(\n          tenantId,\n          assistantId,\n        );\n        if (!assistant) continue;\n        agents.push({\n          assistantId,\n          cardUrl: `${baseUrl}/api/a2a/agents/${assistantId}/.well-known/agent-card.json`,\n          jsonrpcUrl: `${baseUrl}/api/a2a/agents/${assistantId}/jsonrpc`,\n          card: buildAgentCardForAssistant({ assistant, baseUrl }),\n        });\n      }\n\n      return reply.status(200).send({\n        success: true,\n        data: {\n          tenantId,\n          projectId: record.projectId,\n          grants,\n          mcp: {\n            endpoint: `${baseUrl}/open/mcp`,\n            tools,\n            // Surfaced so the console can distinguish \"no tenant tools granted\"\n            // from \"tenant catalog unreadable\"; the live Open session degrades\n            // to globals-only either way.\n            tenantCatalogDegraded,\n          },\n          a2a: { agents },\n        },\n      });\n    },\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;AAOA,SAAS,uBAAuB;AAMhC,SAAS,uBAAuB;AAsBzB,SAAS,2BACd,KACA,OAAyB,CAAC,GACpB;AACN,MAAI;AAAA,IACF;AAAA,IACA,OACE,SACA,UACG;AACH,YAAM,WAAY,QAA4B,MAAM;AACpD,UAAI,CAAC,UAAU;AACb,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,eAAe,CAAC;AAAA,MACzE;AAEA,YAAM,WAAW,gBAAgB,WAAW,WAAW,EACpD;AACH,YAAM,SAAS,MAAM,SAAS,SAAS,QAAQ,OAAO,EAAE;AACxD,UAAI,CAAC,UAAU,OAAO,aAAa,UAAU;AAC3C,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,gBAAgB,CAAC;AAAA,MAC1E;AAEA,YAAM,SAAsB,gBAAgB,MAAM;AAElD,YAAM,gBAAgB,QAAQ,QAAQ,kBAAkB;AACxD,YAAM,QACH,MAAM,QAAQ,aAAa,IAAI,cAAc,CAAC,IAAI,mBAClD,MAAM,QAAQ,QAAQ,QAAQ,IAAI,IAAI,QAAQ,QAAQ,KAAK,CAAC,IAAI,QAAQ,QAAQ,SACjF,QAAQ;AACV,YAAM,UAAU,GAAG,QAAQ,QAAQ,MAAM,IAAI;AAG7C,YAAM,gBAAgB,MAAM,YAAY,WAAW,QAAQ,EAAE,SAAS,CAAC;AAMvE,UAAI,cAAoC,CAAC;AACzC,UAAI,wBAAwB;AAC5B,UAAI;AACF,cAAM,SAAS,MAAM,uBAAuB,UAAU,QAAQ;AAAA,UAC5D,GAAG,KAAK;AAAA,UACR,mBAAmB,IAAI,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AAAA,QACjE,CAAC;AACD,sBAAc,OAAO;AACrB,gCAAwB,OAAO;AAAA,MACjC,SAAS,OAAO;AACd,gCAAwB;AACxB,gBAAQ,IAAI;AAAA,UACV,EAAE,UAAU,KAAK,MAAM;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AAEA,YAAM,QAAQ,iBAAiB,eAAe,WAAW,EAAE,IAAI,CAAC,OAAO;AAAA,QACrE,QAAQ,EAAE;AAAA,QACV,UAAU,EAAE;AAAA,QACZ,aAAa,EAAE;AAAA,QACf,aAAa,EAAE;AAAA,QACf,OAAO,QAAQ,EAAE,EAAE;AAAA,MACrB,EAAE;AAGF,YAAM,aAAa,OAAO,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO;AAC1D,YAAM,iBAAiB,gBAAgB,WAAW,WAAW,EAC1D;AACH,YAAM,SAKD,CAAC;AACN,iBAAW,eAAe,YAAY,SAAS,CAAC,GAAG;AACjD,cAAM,YAAY,MAAM,eAAe;AAAA,UACrC;AAAA,UACA;AAAA,QACF;AACA,YAAI,CAAC,UAAW;AAChB,eAAO,KAAK;AAAA,UACV;AAAA,UACA,SAAS,GAAG,OAAO,mBAAmB,WAAW;AAAA,UACjD,YAAY,GAAG,OAAO,mBAAmB,WAAW;AAAA,UACpD,MAAM,2BAA2B,EAAE,WAAW,QAAQ,CAAC;AAAA,QACzD,CAAC;AAAA,MACH;AAEA,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,QAC5B,SAAS;AAAA,QACT,MAAM;AAAA,UACJ;AAAA,UACA,WAAW,OAAO;AAAA,UAClB;AAAA,UACA,KAAK;AAAA,YACH,UAAU,GAAG,OAAO;AAAA,YACpB;AAAA;AAAA;AAAA;AAAA,YAIA;AAAA,UACF;AAAA,UACA,KAAK,EAAE,OAAO;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/routes/open-exposure.ts"],"sourcesContent":["/**\n * Key exposure endpoint: what a given API key exposes to external callers —\n * the MCP tools (per grants) and the A2A agent cards (for granted agents).\n * Console-session guarded and tenant-scoped.\n */\n\nimport type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport { getStoreLattice } from \"@axiom-lattice/core\";\nimport type {\n  A2AApiKeyStore,\n  AssistantStore,\n  OpenGrant,\n} from \"@axiom-lattice/protocols\";\nimport { effectiveGrants } from \"@axiom-lattice/protocols\";\nimport {\n  openLattice,\n  type OpenToolDescriptor,\n} from \"../services/open/openLattice\";\nimport {\n  buildTenantOpenPlugins,\n  mergeOpenCatalog,\n  type TenantOpenPluginDeps,\n} from \"../services/open/tenantOpenPlugins\";\nimport { buildAgentCardForAssistant } from \"../services/a2a/A2AAgentCardBuilder\";\n\ninterface RequestWithUser extends FastifyRequest {\n  user?: { id: string; tenantId?: string };\n}\n\n/** Overridable seams for the exposure route (tests / embedding). */\nexport interface OpenExposureDeps {\n  /** Tenant sandbox plugin catalog seams; defaults to the live sandbox catalog. */\n  tenantPluginDeps?: TenantOpenPluginDeps;\n}\n\nexport function registerOpenExposureRoutes(\n  app: FastifyInstance,\n  deps: OpenExposureDeps = {},\n): void {\n  app.get<{ Params: { id: string } }>(\n    \"/api/keys/:id/exposure\",\n    async (\n      request: FastifyRequest<{ Params: { id: string } }>,\n      reply: FastifyReply,\n    ) => {\n      const tenantId = (request as RequestWithUser).user?.tenantId;\n      if (!tenantId) {\n        return reply.status(401).send({ success: false, error: \"Unauthorized\" });\n      }\n\n      const keyStore = getStoreLattice(\"default\", \"a2aApiKey\")\n        .store as A2AApiKeyStore;\n      const record = await keyStore.findById(request.params.id);\n      if (!record || record.tenantId !== tenantId) {\n        return reply.status(404).send({ success: false, error: \"Key not found\" });\n      }\n\n      const grants: OpenGrant[] = effectiveGrants(record);\n      // Include the port: request.hostname strips it, request.headers.host keeps it.\n      const forwardedHost = request.headers[\"x-forwarded-host\"];\n      const host =\n        (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ??\n        (Array.isArray(request.headers.host) ? request.headers.host[0] : request.headers.host) ??\n        request.hostname;\n      const baseUrl = `${request.protocol}://${host}`;\n\n      // MCP surface: the credential-filtered tool catalog.\n      const globalCatalog = await openLattice.catalogFor(grants, { tenantId });\n\n      // Tenant sandbox plugins live in per-tenant volumes, outside the\n      // OpenLattice registry, so the globals are merged with the credential's\n      // grant-filtered tenant tools (global wins) to mirror the actual Open MCP\n      // session. A missing/unavailable sandbox catalog degrades to globals.\n      let tenantTools: OpenToolDescriptor[] = [];\n      let tenantCatalogDegraded = false;\n      try {\n        const tenant = await buildTenantOpenPlugins(tenantId, grants, {\n          ...deps.tenantPluginDeps,\n          reservedToolNames: new Set(globalCatalog.map((t) => t.toolName)),\n        });\n        tenantTools = tenant.tools;\n        tenantCatalogDegraded = tenant.degraded;\n      } catch (error) {\n        tenantCatalogDegraded = true;\n        request.log.warn(\n          { tenantId, err: error },\n          \"key exposure: tenant plugin catalog unavailable\",\n        );\n      }\n\n      const tools = mergeOpenCatalog(globalCatalog, tenantTools).map((t) => ({\n        domain: t.domain,\n        toolName: t.toolName,\n        description: t.description,\n        annotations: t.annotations,\n        hasUi: Boolean(t.ui),\n      }));\n\n      // A2A surface: one card per granted agent.\n      const agentGrant = grants.find((g) => g.domain === \"agent\");\n      const assistantStore = getStoreLattice(\"default\", \"assistant\")\n        .store as AssistantStore;\n      let pushNotifications = false;\n      try {\n        pushNotifications = Boolean(getStoreLattice(\"default\", \"store\").store);\n      } catch {\n        pushNotifications = false;\n      }\n      const agents: Array<{\n        assistantId: string;\n        cardUrl: string;\n        jsonrpcUrl: string;\n        v1CardUrl: string;\n        v1JsonrpcUrl: string;\n        card: unknown;\n      }> = [];\n      for (const assistantId of agentGrant?.items ?? []) {\n        const assistant = await assistantStore.getAssistantById(\n          tenantId,\n          assistantId,\n        );\n        if (!assistant) continue;\n        agents.push({\n          assistantId,\n          cardUrl: `${baseUrl}/api/a2a/agents/${assistantId}/.well-known/agent-card.json`,\n          jsonrpcUrl: `${baseUrl}/api/a2a/agents/${assistantId}/jsonrpc`,\n          v1CardUrl: `${baseUrl}/a2a/v1/${assistantId}/.well-known/agent-card.json`,\n          v1JsonrpcUrl: `${baseUrl}/a2a/v1/${assistantId}`,\n          card: buildAgentCardForAssistant({\n            assistant,\n            baseUrl,\n            pushNotifications,\n          }),\n        });\n      }\n\n      return reply.status(200).send({\n        success: true,\n        data: {\n          tenantId,\n          projectId: record.projectId,\n          grants,\n          mcp: {\n            endpoint: `${baseUrl}/open/mcp`,\n            tools,\n            // Surfaced so the console can distinguish \"no tenant tools granted\"\n            // from \"tenant catalog unreadable\"; the live Open session degrades\n            // to globals-only either way.\n            tenantCatalogDegraded,\n          },\n          a2a: { agents },\n        },\n      });\n    },\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;AAOA,SAAS,uBAAuB;AAMhC,SAAS,uBAAuB;AAsBzB,SAAS,2BACd,KACA,OAAyB,CAAC,GACpB;AACN,MAAI;AAAA,IACF;AAAA,IACA,OACE,SACA,UACG;AACH,YAAM,WAAY,QAA4B,MAAM;AACpD,UAAI,CAAC,UAAU;AACb,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,eAAe,CAAC;AAAA,MACzE;AAEA,YAAM,WAAW,gBAAgB,WAAW,WAAW,EACpD;AACH,YAAM,SAAS,MAAM,SAAS,SAAS,QAAQ,OAAO,EAAE;AACxD,UAAI,CAAC,UAAU,OAAO,aAAa,UAAU;AAC3C,eAAO,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,SAAS,OAAO,OAAO,gBAAgB,CAAC;AAAA,MAC1E;AAEA,YAAM,SAAsB,gBAAgB,MAAM;AAElD,YAAM,gBAAgB,QAAQ,QAAQ,kBAAkB;AACxD,YAAM,QACH,MAAM,QAAQ,aAAa,IAAI,cAAc,CAAC,IAAI,mBAClD,MAAM,QAAQ,QAAQ,QAAQ,IAAI,IAAI,QAAQ,QAAQ,KAAK,CAAC,IAAI,QAAQ,QAAQ,SACjF,QAAQ;AACV,YAAM,UAAU,GAAG,QAAQ,QAAQ,MAAM,IAAI;AAG7C,YAAM,gBAAgB,MAAM,YAAY,WAAW,QAAQ,EAAE,SAAS,CAAC;AAMvE,UAAI,cAAoC,CAAC;AACzC,UAAI,wBAAwB;AAC5B,UAAI;AACF,cAAM,SAAS,MAAM,uBAAuB,UAAU,QAAQ;AAAA,UAC5D,GAAG,KAAK;AAAA,UACR,mBAAmB,IAAI,IAAI,cAAc,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;AAAA,QACjE,CAAC;AACD,sBAAc,OAAO;AACrB,gCAAwB,OAAO;AAAA,MACjC,SAAS,OAAO;AACd,gCAAwB;AACxB,gBAAQ,IAAI;AAAA,UACV,EAAE,UAAU,KAAK,MAAM;AAAA,UACvB;AAAA,QACF;AAAA,MACF;AAEA,YAAM,QAAQ,iBAAiB,eAAe,WAAW,EAAE,IAAI,CAAC,OAAO;AAAA,QACrE,QAAQ,EAAE;AAAA,QACV,UAAU,EAAE;AAAA,QACZ,aAAa,EAAE;AAAA,QACf,aAAa,EAAE;AAAA,QACf,OAAO,QAAQ,EAAE,EAAE;AAAA,MACrB,EAAE;AAGF,YAAM,aAAa,OAAO,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO;AAC1D,YAAM,iBAAiB,gBAAgB,WAAW,WAAW,EAC1D;AACH,UAAI,oBAAoB;AACxB,UAAI;AACF,4BAAoB,QAAQ,gBAAgB,WAAW,OAAO,EAAE,KAAK;AAAA,MACvE,QAAQ;AACN,4BAAoB;AAAA,MACtB;AACA,YAAM,SAOD,CAAC;AACN,iBAAW,eAAe,YAAY,SAAS,CAAC,GAAG;AACjD,cAAM,YAAY,MAAM,eAAe;AAAA,UACrC;AAAA,UACA;AAAA,QACF;AACA,YAAI,CAAC,UAAW;AAChB,eAAO,KAAK;AAAA,UACV;AAAA,UACA,SAAS,GAAG,OAAO,mBAAmB,WAAW;AAAA,UACjD,YAAY,GAAG,OAAO,mBAAmB,WAAW;AAAA,UACpD,WAAW,GAAG,OAAO,WAAW,WAAW;AAAA,UAC3C,cAAc,GAAG,OAAO,WAAW,WAAW;AAAA,UAC9C,MAAM,2BAA2B;AAAA,YAC/B;AAAA,YACA;AAAA,YACA;AAAA,UACF,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAEA,aAAO,MAAM,OAAO,GAAG,EAAE,KAAK;AAAA,QAC5B,SAAS;AAAA,QACT,MAAM;AAAA,UACJ;AAAA,UACA,WAAW,OAAO;AAAA,UAClB;AAAA,UACA,KAAK;AAAA,YACH,UAAU,GAAG,OAAO;AAAA,YACpB;AAAA;AAAA;AAAA;AAAA,YAIA;AAAA,UACF;AAAA,UACA,KAAK,EAAE,OAAO;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}

package/dist/{open-files-FS5AN6Q6.mjs → open-files-V3R2BFTV.mjs}

@@ -1,6 +1,3 @@
-import {
-  resolveContextSandbox
-} from "./chunk-PAKR5N7U.mjs";
 import {
   OpenAuditService,
   OpenCredentialService
@@ -8,6 +5,9 @@ import {
 import {
   openLattice
 } from "./chunk-HVIKCUOF.mjs";
+import {
+  resolveContextSandbox
+} from "./chunk-PAKR5N7U.mjs";
 import "./chunk-EXPERMZR.mjs";
 import "./chunk-NFEGQTCC.mjs";
 
@@ -143,4 +143,4 @@ function registerOpenFilesRoutes(app, deps = {}) {
 export {
   registerOpenFilesRoutes
 };
-//# sourceMappingURL=open-files-FS5AN6Q6.mjs.map
+//# sourceMappingURL=open-files-V3R2BFTV.mjs.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axiom-lattice/gateway",
-  "version": "6.1.0",
+  "version": "8.0.0",
   "main": "dist/index.js",
   "files": [
     "dist"
@@ -20,6 +20,7 @@
   "description": "API Gateway for LangGraph agent-based applications",
   "dependencies": {
     "@a2a-js/sdk": "^0.3.13",
+    "@a2a-js/sdk-v1": "npm:@a2a-js/sdk@1.3.0",
     "@fastify/cors": "^11.0.0",
     "@fastify/http-proxy": "^9.5.0",
     "@fastify/multipart": "^9.4.0",
@@ -31,8 +32,13 @@
     "@fastify/websocket": "^11.0.1",
     "@langchain/core": "1.1.30",
     "@langchain/langgraph": "1.0.4",
+    "@langfuse/langchain": "^6.0.2",
+    "@langfuse/otel": "^6.0.2",
     "@larksuiteoapi/node-sdk": "^1.47.0",
     "@modelcontextprotocol/sdk": "1.25.3",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/sdk-trace-base": "2.6.1",
+    "@opentelemetry/sdk-trace-node": "2.6.1",
     "@supabase/supabase-js": "^2.49.1",
     "@wecom/aibot-node-sdk": "^1.0.7",
     "bcryptjs": "^3.0.3",
@@ -49,11 +55,11 @@
     "uuid": "^9.0.1",
     "web-push": "^3.6.7",
     "zod": "3.25.76",
-    "@axiom-lattice/cli-a2a": "0.2.23",
-    "@axiom-lattice/core": "8.1.0",
-    "@axiom-lattice/pg-stores": "3.3.13",
-    "@axiom-lattice/protocols": "4.11.0",
-    "@axiom-lattice/queue-redis": "1.1.23"
+    "@axiom-lattice/cli-a2a": "0.2.25",
+    "@axiom-lattice/core": "10.0.0",
+    "@axiom-lattice/pg-stores": "4.0.0",
+    "@axiom-lattice/protocols": "6.0.0",
+    "@axiom-lattice/queue-redis": "1.1.25"
   },
   "devDependencies": {
     "@types/bcrypt": "^6.0.0",
@@ -76,8 +82,9 @@
     "tsconfig-paths": "^4.2.0",
     "tsup": "^8.5.0",
     "typescript": "^5.8.2",
-    "@axiom-lattice/open-mcp-client": "0.1.0",
-    "@axiom-lattice/react-sdk": "6.1.0"
+    "ws": "^8.19.0",
+    "@axiom-lattice/open-mcp-client": "0.2.0",
+    "@axiom-lattice/react-sdk": "8.0.0"
   },
   "scripts": {
     "build": "tsup src/index.ts --format cjs,esm --dts --clean --sourcemap && pnpm copy:embed-assets",

package/dist/WechatChannelAdapter-7WHE5UGY.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/channels/wechat/WechatChannelAdapter.ts","../src/channels/wechat/context-store.ts"],"sourcesContent":["import { z } from \"zod\";\nimport type {\n  ChannelAdapter,\n  InboundMessage,\n  OutboundMessage,\n  ReplyTarget,\n  ChannelInstallation,\n} from \"@axiom-lattice/protocols\";\nimport type { WechatChannelInstallationConfig } from \"@axiom-lattice/protocols\";\nimport { getUpdates, sendMessage } from \"./wechat-client\";\nimport { setContextToken, getContextToken, deleteContextToken } from \"./context-store\";\nimport { Logger } from \"../../logger/Logger\";\n\nconst logger = new Logger({ serviceName: \"lattice/gateway/wechat\" });\n\nconst wechatConfigSchema = z.object({\n  botToken: z.string(),\n  uin: z.string().optional(),\n});\n\nconst MAX_RECONNECT_DELAY_MS = 30_000;\nconst BASE_RECONNECT_DELAY_MS = 1_000;\nconst HEARTBEAT_INTERVAL_MS = 60_000;\nconst CHANNEL_VERSION = \"1.0.2\";\n\n// ─── Message type constants ───────────────────────────────────────────────\n\nconst MSG_TYPE_USER = 1;\nconst MSG_ITEM_TEXT = 1;\n\n// ─── Polling connection state ─────────────────────────────────────────────\n\ninterface PollingState {\n  installationId: string;\n  abortController: AbortController;\n  lastActivity: number;\n  heartbeatTimer: NodeJS.Timeout;\n}\n\nconst activeConnections = new Map<string, PollingState>();\n\n// ─── Message dedup ────────────────────────────────────────────────────────\n\nconst seenClientIds = new Set<string>();\n\nfunction addToDedup(clientId: string): boolean {\n  if (!clientId || seenClientIds.has(clientId)) return false;\n  seenClientIds.add(clientId);\n  if (seenClientIds.size > 1000) {\n    const first = seenClientIds.values().next().value;\n    if (first !== undefined) seenClientIds.delete(first);\n  }\n  return true;\n}\n\n// ─── Text extraction from iLink message ───────────────────────────────────\n\nfunction extractText(msg: { item_list?: Array<{ type?: number; text_item?: { text?: string } }> }): string | null {\n  if (!msg.item_list?.length) return null;\n  for (const item of msg.item_list) {\n    if (item.type === MSG_ITEM_TEXT && item.text_item?.text) {\n      return item.text_item.text;\n    }\n  }\n  return null;\n}\n\n// ─── Adapter ──────────────────────────────────────────────────────────────\n\nexport const wechatChannelAdapter: ChannelAdapter<WechatChannelInstallationConfig> = {\n  channel: \"wechat\",\n\n  configSchema: wechatConfigSchema,\n\n  async receive(\n    rawPayload: unknown,\n    installation: ChannelInstallation<WechatChannelInstallationConfig>,\n  ): Promise<InboundMessage | null> {\n    const msg = rawPayload as {\n      from_user_id?: string;\n      client_id?: string;\n      message_type?: number;\n      item_list?: Array<{ type?: number; text_item?: { text?: string } }>;\n      context_token?: string;\n    };\n\n    // Only process user messages (type 1), skip bot echoes (type 2)\n    if (msg.message_type !== MSG_TYPE_USER) return null;\n\n    const senderId = msg.from_user_id;\n    if (!senderId) return null;\n\n    const text = extractText(msg);\n    if (!text) return null;\n\n    // Cache context token for reply\n    if (msg.context_token) {\n      setContextToken(installation.id, senderId, msg.context_token);\n    }\n\n    return {\n      channel: \"wechat\",\n      channelInstallationId: installation.id,\n      tenantId: installation.tenantId,\n      sender: {\n        id: senderId,\n        displayName: senderId.split(\"@\")[0],\n      },\n      content: {\n        text,\n      },\n      conversation: {\n        id: senderId,\n        type: \"direct\",\n      },\n      replyTarget: {\n        adapterChannel: \"wechat\",\n        channelInstallationId: installation.id,\n        rawTarget: { senderId },\n      },\n    };\n  },\n\n  async sendReply(\n    replyTarget: ReplyTarget,\n    message: OutboundMessage,\n    installation: ChannelInstallation<WechatChannelInstallationConfig>,\n  ): Promise<void> {\n    const senderId = replyTarget.rawTarget.senderId as string;\n    const contextToken = getContextToken(installation.id, senderId);\n\n    if (!contextToken) {\n      logger.warn(\"WeChat context token expired, cannot send reply\", {\n        installationId: installation.id,\n        senderId,\n      });\n      deleteContextToken(installation.id, senderId);\n      return;\n    }\n\n    const { botToken } = installation.config;\n    await sendMessage(botToken, senderId, message.text, contextToken);\n  },\n\n  resolveThreadId(message: InboundMessage, binding: unknown): string {\n    const date = new Date().toISOString().split(\"T\")[0];\n    const agentId = (binding as { agentId: string }).agentId;\n    return `wechat:dm:${message.sender.id}:${agentId}:${date}`;\n  },\n\n  async connect(\n    installation: ChannelInstallation<WechatChannelInstallationConfig>,\n    deps?: unknown,\n  ): Promise<void> {\n    const { id: installationId, tenantId, config } = installation;\n\n    if (!config.botToken) {\n      logger.warn(\"WeChat installation missing botToken, skipping\", { installationId });\n      return;\n    }\n\n    if (activeConnections.has(installationId)) {\n      logger.warn(\"WeChat polling already running for installation, skipping\", { installationId });\n      return;\n    }\n\n    logger.info(\"WeChat polling starting\", { installationId, tenantId });\n\n    const abortController = new AbortController();\n\n    const heartbeatTimer = setInterval(() => {\n      const state2 = activeConnections.get(installationId);\n      if (!state2) {\n        clearInterval(heartbeatTimer);\n        return;\n      }\n      const elapsed = Date.now() - state2.lastActivity;\n      if (elapsed > HEARTBEAT_INTERVAL_MS * 2) {\n        logger.error(\"WeChat polling heartbeat lost — no activity\", {\n          installationId,\n          elapsedMs: elapsed,\n        });\n        state2.abortController.abort();\n      }\n    }, HEARTBEAT_INTERVAL_MS);\n\n    const state: PollingState = {\n      installationId,\n      abortController,\n      lastActivity: Date.now(),\n      heartbeatTimer,\n    };\n    activeConnections.set(installationId, state);\n\n    const router = (deps as { router?: { dispatch(msg: InboundMessage): Promise<unknown> } })?.router;\n\n    let syncBuffer = \"\";\n    let reconnectDelay = BASE_RECONNECT_DELAY_MS;\n\n    const scheduleNextPoll = (): void => {\n      poll().catch((err) => {\n        logger.error(\"WeChat poll iteration crashed\", {\n          installationId,\n          error: err instanceof Error ? err.message : String(err),\n        });\n        const currentState = activeConnections.get(installationId);\n        if (currentState && !currentState.abortController.signal.aborted) {\n          setTimeout(scheduleNextPoll, reconnectDelay);\n        }\n      });\n    };\n\n    const poll = async (): Promise<void> => {\n      const currentState = activeConnections.get(installationId);\n      if (!currentState || currentState.abortController.signal.aborted) {\n        logger.info(\"WeChat polling aborted\", { installationId });\n        return;\n      }\n\n      try {\n        const result = await getUpdates(\n          config.botToken,\n          syncBuffer,\n          currentState.abortController.signal,\n        );\n        syncBuffer = result.syncBuffer;\n        reconnectDelay = BASE_RECONNECT_DELAY_MS;\n        currentState.lastActivity = Date.now();\n\n        if (result.msgs.length > 0) {\n          logger.info(\"WeChat poll received messages\", {\n            installationId,\n            count: result.msgs.length,\n          });\n        }\n\n        for (const rawMsg of result.msgs) {\n          // Only user messages, skip bot echoes and non-text\n          if (rawMsg.message_type !== MSG_TYPE_USER) continue;\n\n          const text = extractText(rawMsg);\n          if (!text) continue;\n\n          if (!addToDedup((rawMsg as { client_id?: string }).client_id ?? \"\")) continue;\n\n          const inbound = await wechatChannelAdapter.receive(\n            rawMsg,\n            installation as ChannelInstallation<WechatChannelInstallationConfig>,\n          );\n          if (inbound && router) {\n            const dispatchResult = await router.dispatch(inbound);\n            if (!(dispatchResult as { success?: boolean }).success) {\n              logger.warn(\"WeChat dispatch failed\", {\n                installationId,\n                error: (dispatchResult as { error?: { message?: string } }).error?.message,\n              });\n            }\n          }\n        }\n      } catch (err) {\n        if (err instanceof Error && err.name === \"AbortError\") {\n          logger.info(\"WeChat poll aborted by signal\", { installationId });\n          return;\n        }\n\n        logger.error(\"WeChat poll error\", {\n          installationId,\n          error: err instanceof Error ? err.message : String(err),\n        });\n        await new Promise((resolve) => setTimeout(resolve, reconnectDelay));\n        reconnectDelay = Math.min(reconnectDelay * 2, MAX_RECONNECT_DELAY_MS);\n      }\n\n      scheduleNextPoll();\n    };\n\n    scheduleNextPoll();\n    logger.info(\"WeChat polling started\", { installationId });\n  },\n\n  async disconnect(installationId: string): Promise<void> {\n    const state = activeConnections.get(installationId);\n    if (!state) {\n      logger.warn(\"WeChat polling not running, nothing to disconnect\", { installationId });\n      return;\n    }\n\n    logger.info(\"WeChat polling disconnecting\", { installationId });\n    state.abortController.abort();\n    clearInterval(state.heartbeatTimer);\n    activeConnections.delete(installationId);\n    logger.info(\"WeChat polling disconnected\", { installationId });\n  },\n};\n","interface ContextTokenEntry {\n  token: string;\n  installationId: string;\n  senderId: string;\n  updatedAt: number;\n}\n\nconst TOKEN_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours\nconst store = new Map<string, ContextTokenEntry>();\nconst timers = new Map<string, NodeJS.Timeout>();\n\nfunction makeKey(installationId: string, senderId: string): string {\n  return `${installationId}::${senderId}`;\n}\n\nexport function getContextToken(installationId: string, senderId: string): string | undefined {\n  const key = makeKey(installationId, senderId);\n  const entry = store.get(key);\n  if (!entry) return undefined;\n  if (Date.now() - entry.updatedAt > TOKEN_TTL_MS) {\n    deleteContextToken(installationId, senderId);\n    return undefined;\n  }\n  return entry.token;\n}\n\nexport function setContextToken(installationId: string, senderId: string, token: string): void {\n  const key = makeKey(installationId, senderId);\n\n  const existingTimer = timers.get(key);\n  if (existingTimer) clearTimeout(existingTimer);\n\n  store.set(key, { token, installationId, senderId, updatedAt: Date.now() });\n\n  const timer = setTimeout(() => {\n    store.delete(key);\n    timers.delete(key);\n  }, TOKEN_TTL_MS);\n  timers.set(key, timer);\n}\n\nexport function deleteContextToken(installationId: string, senderId: string): void {\n  const key = makeKey(installationId, senderId);\n  store.delete(key);\n  const timer = timers.get(key);\n  if (timer) {\n    clearTimeout(timer);\n    timers.delete(key);\n  }\n}\n\nexport function getContextTokenStoreSize(): number {\n  return store.size;\n}\n"],"mappings":";;;;;;;;AAAA,SAAS,SAAS;;;ACOlB,IAAM,eAAe,KAAK,KAAK,KAAK;AACpC,IAAM,QAAQ,oBAAI,IAA+B;AACjD,IAAM,SAAS,oBAAI,IAA4B;AAE/C,SAAS,QAAQ,gBAAwB,UAA0B;AACjE,SAAO,GAAG,cAAc,KAAK,QAAQ;AACvC;AAEO,SAAS,gBAAgB,gBAAwB,UAAsC;AAC5F,QAAM,MAAM,QAAQ,gBAAgB,QAAQ;AAC5C,QAAM,QAAQ,MAAM,IAAI,GAAG;AAC3B,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,KAAK,IAAI,IAAI,MAAM,YAAY,cAAc;AAC/C,uBAAmB,gBAAgB,QAAQ;AAC3C,WAAO;AAAA,EACT;AACA,SAAO,MAAM;AACf;AAEO,SAAS,gBAAgB,gBAAwB,UAAkB,OAAqB;AAC7F,QAAM,MAAM,QAAQ,gBAAgB,QAAQ;AAE5C,QAAM,gBAAgB,OAAO,IAAI,GAAG;AACpC,MAAI,cAAe,cAAa,aAAa;AAE7C,QAAM,IAAI,KAAK,EAAE,OAAO,gBAAgB,UAAU,WAAW,KAAK,IAAI,EAAE,CAAC;AAEzE,QAAM,QAAQ,WAAW,MAAM;AAC7B,UAAM,OAAO,GAAG;AAChB,WAAO,OAAO,GAAG;AAAA,EACnB,GAAG,YAAY;AACf,SAAO,IAAI,KAAK,KAAK;AACvB;AAEO,SAAS,mBAAmB,gBAAwB,UAAwB;AACjF,QAAM,MAAM,QAAQ,gBAAgB,QAAQ;AAC5C,QAAM,OAAO,GAAG;AAChB,QAAM,QAAQ,OAAO,IAAI,GAAG;AAC5B,MAAI,OAAO;AACT,iBAAa,KAAK;AAClB,WAAO,OAAO,GAAG;AAAA,EACnB;AACF;;;ADpCA,IAAM,SAAS,IAAI,OAAO,EAAE,aAAa,yBAAyB,CAAC;AAEnE,IAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,UAAU,EAAE,OAAO;AAAA,EACnB,KAAK,EAAE,OAAO,EAAE,SAAS;AAC3B,CAAC;AAED,IAAM,yBAAyB;AAC/B,IAAM,0BAA0B;AAChC,IAAM,wBAAwB;AAK9B,IAAM,gBAAgB;AACtB,IAAM,gBAAgB;AAWtB,IAAM,oBAAoB,oBAAI,IAA0B;AAIxD,IAAM,gBAAgB,oBAAI,IAAY;AAEtC,SAAS,WAAW,UAA2B;AAC7C,MAAI,CAAC,YAAY,cAAc,IAAI,QAAQ,EAAG,QAAO;AACrD,gBAAc,IAAI,QAAQ;AAC1B,MAAI,cAAc,OAAO,KAAM;AAC7B,UAAM,QAAQ,cAAc,OAAO,EAAE,KAAK,EAAE;AAC5C,QAAI,UAAU,OAAW,eAAc,OAAO,KAAK;AAAA,EACrD;AACA,SAAO;AACT;AAIA,SAAS,YAAY,KAA6F;AAChH,MAAI,CAAC,IAAI,WAAW,OAAQ,QAAO;AACnC,aAAW,QAAQ,IAAI,WAAW;AAChC,QAAI,KAAK,SAAS,iBAAiB,KAAK,WAAW,MAAM;AACvD,aAAO,KAAK,UAAU;AAAA,IACxB;AAAA,EACF;AACA,SAAO;AACT;AAIO,IAAM,uBAAwE;AAAA,EACnF,SAAS;AAAA,EAET,cAAc;AAAA,EAEd,MAAM,QACJ,YACA,cACgC;AAChC,UAAM,MAAM;AASZ,QAAI,IAAI,iBAAiB,cAAe,QAAO;AAE/C,UAAM,WAAW,IAAI;AACrB,QAAI,CAAC,SAAU,QAAO;AAEtB,UAAM,OAAO,YAAY,GAAG;AAC5B,QAAI,CAAC,KAAM,QAAO;AAGlB,QAAI,IAAI,eAAe;AACrB,sBAAgB,aAAa,IAAI,UAAU,IAAI,aAAa;AAAA,IAC9D;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,uBAAuB,aAAa;AAAA,MACpC,UAAU,aAAa;AAAA,MACvB,QAAQ;AAAA,QACN,IAAI;AAAA,QACJ,aAAa,SAAS,MAAM,GAAG,EAAE,CAAC;AAAA,MACpC;AAAA,MACA,SAAS;AAAA,QACP;AAAA,MACF;AAAA,MACA,cAAc;AAAA,QACZ,IAAI;AAAA,QACJ,MAAM;AAAA,MACR;AAAA,MACA,aAAa;AAAA,QACX,gBAAgB;AAAA,QAChB,uBAAuB,aAAa;AAAA,QACpC,WAAW,EAAE,SAAS;AAAA,MACxB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,UACJ,aACA,SACA,cACe;AACf,UAAM,WAAW,YAAY,UAAU;AACvC,UAAM,eAAe,gBAAgB,aAAa,IAAI,QAAQ;AAE9D,QAAI,CAAC,cAAc;AACjB,aAAO,KAAK,mDAAmD;AAAA,QAC7D,gBAAgB,aAAa;AAAA,QAC7B;AAAA,MACF,CAAC;AACD,yBAAmB,aAAa,IAAI,QAAQ;AAC5C;AAAA,IACF;AAEA,UAAM,EAAE,SAAS,IAAI,aAAa;AAClC,UAAM,YAAY,UAAU,UAAU,QAAQ,MAAM,YAAY;AAAA,EAClE;AAAA,EAEA,gBAAgB,SAAyB,SAA0B;AACjE,UAAM,QAAO,oBAAI,KAAK,GAAE,YAAY,EAAE,MAAM,GAAG,EAAE,CAAC;AAClD,UAAM,UAAW,QAAgC;AACjD,WAAO,aAAa,QAAQ,OAAO,EAAE,IAAI,OAAO,IAAI,IAAI;AAAA,EAC1D;AAAA,EAEA,MAAM,QACJ,cACA,MACe;AACf,UAAM,EAAE,IAAI,gBAAgB,UAAU,OAAO,IAAI;AAEjD,QAAI,CAAC,OAAO,UAAU;AACpB,aAAO,KAAK,kDAAkD,EAAE,eAAe,CAAC;AAChF;AAAA,IACF;AAEA,QAAI,kBAAkB,IAAI,cAAc,GAAG;AACzC,aAAO,KAAK,6DAA6D,EAAE,eAAe,CAAC;AAC3F;AAAA,IACF;AAEA,WAAO,KAAK,2BAA2B,EAAE,gBAAgB,SAAS,CAAC;AAEnE,UAAM,kBAAkB,IAAI,gBAAgB;AAE5C,UAAM,iBAAiB,YAAY,MAAM;AACvC,YAAM,SAAS,kBAAkB,IAAI,cAAc;AACnD,UAAI,CAAC,QAAQ;AACX,sBAAc,cAAc;AAC5B;AAAA,MACF;AACA,YAAM,UAAU,KAAK,IAAI,IAAI,OAAO;AACpC,UAAI,UAAU,wBAAwB,GAAG;AACvC,eAAO,MAAM,oDAA+C;AAAA,UAC1D;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AACD,eAAO,gBAAgB,MAAM;AAAA,MAC/B;AAAA,IACF,GAAG,qBAAqB;AAExB,UAAM,QAAsB;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,cAAc,KAAK,IAAI;AAAA,MACvB;AAAA,IACF;AACA,sBAAkB,IAAI,gBAAgB,KAAK;AAE3C,UAAM,SAAU,MAA2E;AAE3F,QAAI,aAAa;AACjB,QAAI,iBAAiB;AAErB,UAAM,mBAAmB,MAAY;AACnC,WAAK,EAAE,MAAM,CAAC,QAAQ;AACpB,eAAO,MAAM,iCAAiC;AAAA,UAC5C;AAAA,UACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QACxD,CAAC;AACD,cAAM,eAAe,kBAAkB,IAAI,cAAc;AACzD,YAAI,gBAAgB,CAAC,aAAa,gBAAgB,OAAO,SAAS;AAChE,qBAAW,kBAAkB,cAAc;AAAA,QAC7C;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,OAAO,YAA2B;AACtC,YAAM,eAAe,kBAAkB,IAAI,cAAc;AACzD,UAAI,CAAC,gBAAgB,aAAa,gBAAgB,OAAO,SAAS;AAChE,eAAO,KAAK,0BAA0B,EAAE,eAAe,CAAC;AACxD;AAAA,MACF;AAEA,UAAI;AACF,cAAM,SAAS,MAAM;AAAA,UACnB,OAAO;AAAA,UACP;AAAA,UACA,aAAa,gBAAgB;AAAA,QAC/B;AACA,qBAAa,OAAO;AACpB,yBAAiB;AACjB,qBAAa,eAAe,KAAK,IAAI;AAErC,YAAI,OAAO,KAAK,SAAS,GAAG;AAC1B,iBAAO,KAAK,iCAAiC;AAAA,YAC3C;AAAA,YACA,OAAO,OAAO,KAAK;AAAA,UACrB,CAAC;AAAA,QACH;AAEA,mBAAW,UAAU,OAAO,MAAM;AAEhC,cAAI,OAAO,iBAAiB,cAAe;AAE3C,gBAAM,OAAO,YAAY,MAAM;AAC/B,cAAI,CAAC,KAAM;AAEX,cAAI,CAAC,WAAY,OAAkC,aAAa,EAAE,EAAG;AAErE,gBAAM,UAAU,MAAM,qBAAqB;AAAA,YACzC;AAAA,YACA;AAAA,UACF;AACA,cAAI,WAAW,QAAQ;AACrB,kBAAM,iBAAiB,MAAM,OAAO,SAAS,OAAO;AACpD,gBAAI,CAAE,eAAyC,SAAS;AACtD,qBAAO,KAAK,0BAA0B;AAAA,gBACpC;AAAA,gBACA,OAAQ,eAAoD,OAAO;AAAA,cACrE,CAAC;AAAA,YACH;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,SAAS,IAAI,SAAS,cAAc;AACrD,iBAAO,KAAK,iCAAiC,EAAE,eAAe,CAAC;AAC/D;AAAA,QACF;AAEA,eAAO,MAAM,qBAAqB;AAAA,UAChC;AAAA,UACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QACxD,CAAC;AACD,cAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,cAAc,CAAC;AAClE,yBAAiB,KAAK,IAAI,iBAAiB,GAAG,sBAAsB;AAAA,MACtE;AAEA,uBAAiB;AAAA,IACnB;AAEA,qBAAiB;AACjB,WAAO,KAAK,0BAA0B,EAAE,eAAe,CAAC;AAAA,EAC1D;AAAA,EAEA,MAAM,WAAW,gBAAuC;AACtD,UAAM,QAAQ,kBAAkB,IAAI,cAAc;AAClD,QAAI,CAAC,OAAO;AACV,aAAO,KAAK,qDAAqD,EAAE,eAAe,CAAC;AACnF;AAAA,IACF;AAEA,WAAO,KAAK,gCAAgC,EAAE,eAAe,CAAC;AAC9D,UAAM,gBAAgB,MAAM;AAC5B,kBAAc,MAAM,cAAc;AAClC,sBAAkB,OAAO,cAAc;AACvC,WAAO,KAAK,+BAA+B,EAAE,eAAe,CAAC;AAAA,EAC/D;AACF;","names":[]}