@axiom-lattice/gateway 8.3.0 → 9.0.0

package/dist/{A2AAuthService-7UGQ7GMW.mjs → A2AAuthService-UKN53ZGP.mjs}

@@ -2,11 +2,11 @@ import {
   A2AAuthError,
   A2AAuthService,
   parseEnvKeys
-} from "./chunk-GPHOYR3X.mjs";
+} from "./chunk-LCM4OQTI.mjs";
 import "./chunk-NFEGQTCC.mjs";
 export {
   A2AAuthError,
   A2AAuthService,
   parseEnvKeys
 };
-//# sourceMappingURL=A2AAuthService-7UGQ7GMW.mjs.map
+//# sourceMappingURL=A2AAuthService-UKN53ZGP.mjs.map

package/dist/{a2a-BHBLACJV.mjs → a2a-YLKZE5JG.mjs}

@@ -3,15 +3,17 @@ import {
   refreshStoreKeyMap,
   registerA2ARoutes,
   setA2AAuthService,
-  setA2AKeyStore
-} from "./chunk-HYYLYIMH.mjs";
-import "./chunk-GPHOYR3X.mjs";
+  setA2AKeyStore,
+  setA2AProjectAccess
+} from "./chunk-NYYSBNDG.mjs";
+import "./chunk-LCM4OQTI.mjs";
 import "./chunk-NFEGQTCC.mjs";
 export {
   broadcastA2AKeyChanged,
   refreshStoreKeyMap,
   registerA2ARoutes,
   setA2AAuthService,
-  setA2AKeyStore
+  setA2AKeyStore,
+  setA2AProjectAccess
 };
-//# sourceMappingURL=a2a-BHBLACJV.mjs.map
+//# sourceMappingURL=a2a-YLKZE5JG.mjs.map

package/dist/{a2a-standard-VL5I7B4W.mjs → a2a-standard-MD7WNDTP.mjs}

@@ -1,7 +1,8 @@
 import {
   buildAgentCardForAssistant,
-  deriveAgentSkills
-} from "./chunk-W3YH4S6G.mjs";
+  deriveAgentSkills,
+  resolveRequestBaseUrl
+} from "./chunk-SIMEG2JT.mjs";
 import {
   formatFileRefsSection,
   getRunCancelRouter,
@@ -9,19 +10,19 @@ import {
   saveProjectFile,
   wakeRunTaskQueue
 } from "./chunk-2SR4F3ZD.mjs";
+import {
+  getRateLimitService
+} from "./chunk-A7YNAU5L.mjs";
 import {
   A2AAuthError
-} from "./chunk-GPHOYR3X.mjs";
+} from "./chunk-LCM4OQTI.mjs";
 import "./chunk-NFEGQTCC.mjs";
 
 // src/routes/a2a-standard.ts
-import { v4 as uuidv42 } from "uuid";
 import {
   A2AError as A2AError3,
-  DefaultExecutionEventBus as DefaultExecutionEventBus2,
   DefaultRequestHandler,
-  JsonRpcTransportHandler,
-  RequestContext
+  JsonRpcTransportHandler
 } from "@a2a-js/sdk/server";
 import { AgentCard as AgentCardV1 } from "@a2a-js/sdk-v1";
 import {
@@ -1388,6 +1389,8 @@ var A2ATaskStoreAdapter = class {
     if (!item || !this.isInScope(item)) return void 0;
     const pageSize = 100;
     let selected;
+    let latestCompleted;
+    let authoritative;
     for (let offset = 0; ; offset += pageSize) {
       const activities = await this.workItemStore.list({
         tenantId: this.scope.tenantId,
@@ -1409,6 +1412,12 @@ var A2ATaskStoreAdapter = class {
           id: activity.id
         };
         if (!selected || this.isLaterSnapshot(candidate, selected)) selected = candidate;
+        if (candidate.task.status?.state === "completed" && (!latestCompleted || this.isLaterSnapshot(candidate, latestCompleted))) {
+          latestCompleted = candidate;
+        }
+        if (candidate.task.status?.state === "completed" && candidate.task.metadata?.resultArtifactSource === "agent_output" && (!authoritative || this.isLaterSnapshot(candidate, authoritative))) {
+          authoritative = candidate;
+        }
       }
       if (activities.length < pageSize) break;
     }
@@ -1428,8 +1437,13 @@ var A2ATaskStoreAdapter = class {
       ...contextThreadId === void 0 ? {} : { threadId: contextThreadId },
       ...interruption && typeof interruption === "object" ? { interruption } : {}
     };
-    const nonResultArtifacts = (snapshot.artifacts ?? []).filter((artifact) => artifact.name !== "result");
-    const artifacts = item.status === "completed" && item.result?.trim() ? [...nonResultArtifacts, {
+    const artifactSnapshot = item.status === "completed" ? latestCompleted?.task ?? snapshot : snapshot;
+    const nonResultArtifacts = (artifactSnapshot.artifacts ?? []).filter((artifact) => artifact.name !== "result");
+    const latestResult = (artifactSnapshot.artifacts ?? []).filter((artifact) => artifact.name === "result").at(-1);
+    const markedResult = (authoritative?.task.artifacts ?? []).filter((artifact) => artifact.name === "result").at(-1);
+    const markedResultMatchesLatest = item.status === "completed" && latestCompleted !== void 0 && latestResult !== void 0 && markedResult !== void 0 && extractText(latestResult.parts) === extractText(markedResult.parts);
+    const authoritativeSnapshotResult = item.status === "completed" && markedResultMatchesLatest ? latestResult : void 0;
+    const artifacts = item.status !== "completed" ? nonResultArtifacts : authoritativeSnapshotResult ? [...nonResultArtifacts, authoritativeSnapshotResult] : item.result?.trim() ? [...nonResultArtifacts, {
       artifactId: `${item.id}:result`,
       name: "result",
       parts: [{ kind: "text", text: item.result }]
@@ -2157,14 +2171,28 @@ var AxiomAgentExecutor = class {
     }
     const canonicalResult = canonical?.artifacts?.find((artifact) => artifact.name === "result");
     const canonicalText = canonicalResult ? extractText2(canonicalResult.parts).trim() : "";
-    const resultText = canonicalText || outputText;
+    const agentOutputText = outputText.trim();
+    const resultText = agentOutputText || canonicalText || "(no output)";
     const resultArtifact = {
       artifactId: uuidv4(),
       name: "result",
       parts: [{ kind: "text", text: resultText }]
     };
+    const baseTask = this.taskFor(
+      ctx,
+      threadId,
+      projection.inputFiles,
+      projection.dependencies,
+      projection
+    );
     const completed = {
-      ...this.taskFor(ctx, threadId, projection.inputFiles, projection.dependencies, projection),
+      ...baseTask,
+      ...agentOutputText ? {
+        metadata: {
+          ...baseTask.metadata ?? {},
+          resultArtifactSource: "agent_output"
+        }
+      } : {},
       artifacts: [...existing?.artifacts ?? [], resultArtifact],
       status: { state: "completed", timestamp: isoNow() }
     };
@@ -3117,15 +3145,6 @@ function getHeader(value) {
   if (Array.isArray(value)) return value[0];
   return value;
 }
-function getSessionUser(request) {
-  return request.user;
-}
-function buildBaseUrl(request) {
-  const protocol = getHeader(request.headers["x-forwarded-proto"]) ?? request.protocol;
-  const forwardedHost = getHeader(request.headers["x-forwarded-host"]);
-  const host = forwardedHost ? forwardedHost.split(",")[0].trim() : request.host;
-  return `${protocol}://${host}`;
-}
 function makeFileIngestor(tenantId, maxFileBytes) {
   return new A2AFileIngestor({
     saveProjectFile: (params) => saveProjectFile({ tenantId, ...params }),
@@ -3317,6 +3336,12 @@ var SSE_HEADERS = {
 };
 function registerA2AStandardRoutes(app, deps) {
   const authService = deps.authService;
+  const rateLimits = deps.rateLimits ?? getRateLimitService();
+  const enforceRateLimit = async (request, reply, dimensions, requestId) => {
+    const decision = await rateLimits.consume("a2a.jsonrpc", dimensions);
+    if (decision.allowed) return null;
+    return reply.header("Retry-After", String(decision.retryAfterSeconds)).status(429).send(jsonRpcError(requestId, -32005, "Rate limited"));
+  };
   const resolveTasks = deps.getTaskStoreLattice ?? (() => getStoreLattice("default", "task").store);
   const resolveTaskWorkItems = deps.getTaskWorkItemStore ?? (() => getStoreLattice("default", "taskWorkItem").store);
   const getAssistantStore = deps.getAssistantStore ?? (() => getStoreLattice("default", "assistant").store);
@@ -3592,7 +3617,7 @@ function registerA2AStandardRoutes(app, deps) {
     reply.status(200).send(
       buildAgentCardForAssistant({
         assistant,
-        baseUrl: buildBaseUrl(request),
+        baseUrl: resolveRequestBaseUrl(request),
         pushNotifications: hasPushStore(),
         ...officialAlias ? { jsonRpcPath: `/a2a/${assistant.id}` } : {}
       })
@@ -3608,6 +3633,13 @@ function registerA2AStandardRoutes(app, deps) {
   );
   const handleJsonRpc = async (request, reply) => {
     const requestId = extractRequestId(request.body);
+    const preAuthBlocked = await enforceRateLimit(
+      request,
+      reply,
+      { ip: request.ip },
+      requestId
+    );
+    if (preAuthBlocked) return;
     const auth = await authService.authenticate(
       getHeader(request.headers.authorization) ?? getHeader(request.headers["x-api-key"])
     );
@@ -3636,6 +3668,13 @@ function registerA2AStandardRoutes(app, deps) {
       reply.status(500).send(jsonRpcError(requestId, -32603, "Internal error"));
       return;
     }
+    const blocked = await enforceRateLimit(
+      request,
+      reply,
+      { key: auth.apiKey },
+      requestId
+    );
+    if (blocked) return;
     const tenantId = auth.tenantId ?? "default";
     const scope = {
       tenantId,
@@ -3671,7 +3710,7 @@ function registerA2AStandardRoutes(app, deps) {
       }
       const extendedCard = buildAgentCardForAssistant({
         assistant,
-        baseUrl: buildBaseUrl(request),
+        baseUrl: resolveRequestBaseUrl(request),
         pushNotifications: hasPushStore(),
         ...request.url.split("?")[0].startsWith("/a2a/") ? { jsonRpcPath: `/a2a/${assistant.id}` } : {}
       });
@@ -3734,7 +3773,7 @@ function registerA2AStandardRoutes(app, deps) {
     }
     const card = buildAgentCardForAssistant({
       assistant,
-      baseUrl: buildBaseUrl(request),
+      baseUrl: resolveRequestBaseUrl(request),
       pushNotifications: pushStore !== void 0,
       ...request.url.split("?")[0].startsWith("/a2a/") ? { jsonRpcPath: `/a2a/${assistant.id}` } : {}
     });
@@ -3815,110 +3854,9 @@ data: ${JSON.stringify(errorResponse)}
     "/a2a/:assistantId",
     handleJsonRpc
   );
-  app.post(
-    "/api/a2a/agents/:assistantId/test-call",
-    async (request, reply) => {
-      const user = getSessionUser(request);
-      if (!user?.tenantId) {
-        reply.status(401).send({ success: false, error: "Unauthorized" });
-        return;
-      }
-      const tenantId = user.tenantId;
-      const body = request.body ?? {};
-      const { projectId, message } = body;
-      if (!projectId) {
-        reply.status(400).send({ error: "projectId is required" });
-        return;
-      }
-      if (!message || !message.trim()) {
-        reply.status(400).send({ error: "message is required" });
-        return;
-      }
-      const assistant = await getAssistantStore().getAssistantById(
-        tenantId,
-        request.params.assistantId
-      );
-      if (!assistant) {
-        reply.status(404).send({ error: "Assistant not found" });
-        return;
-      }
-      const project = await getProjectStore().getProjectById(
-        tenantId,
-        projectId
-      );
-      if (!project || project.tenantId !== tenantId) {
-        reply.status(403).send({ error: "Project not found" });
-        return;
-      }
-      const scope = {
-        tenantId,
-        projectId,
-        workspaceId: project.workspaceId,
-        assistantId: assistant.id
-      };
-      const ingestor = makeFileIngestor(scope.tenantId, deps.maxFileBytes);
-      const internalTasks = resolveTasks();
-      const workItems = resolveTaskWorkItems();
-      const taskStore = taskStoreFor(scope, internalTasks, workItems);
-      const executor = new AxiomAgentExecutor({
-        scope,
-        assistant,
-        taskStore,
-        ingestor,
-        runService: runServiceFor(scope),
-        blocking: true,
-        getInterrupts: (threadId) => stateResolver.getInterrupts(threadId, assistant.id, scope)
-      });
-      const taskId = uuidv42();
-      const contextId = uuidv42();
-      const userMessage = {
-        kind: "message",
-        messageId: uuidv42(),
-        role: "user",
-        parts: [{ kind: "text", text: message }]
-      };
-      const requestContext = new RequestContext(userMessage, taskId, contextId);
-      const bus = new DefaultExecutionEventBus2();
-      reply.hijack();
-      reply.raw.writeHead(200, SSE_HEADERS);
-      const sendEvent = (event, data) => {
-        reply.raw.write(`event: ${event}
-data: ${JSON.stringify(data)}
-
-`);
-      };
-      bus.on("event", (event) => {
-        sendEvent(event.kind, event);
-      });
-      try {
-        await executor.execute(requestContext, bus);
-      } catch (err) {
-        request.log.error({ err }, "a2a:test-call:execution");
-        try {
-          await taskStore.save({
-            kind: "task",
-            id: taskId,
-            contextId,
-            status: { state: "failed", timestamp: (/* @__PURE__ */ new Date()).toISOString() }
-          });
-        } catch (saveError) {
-          request.log.error({ err: saveError }, "a2a:test-call:settle");
-        }
-        sendEvent("status-update", {
-          kind: "status-update",
-          taskId,
-          contextId,
-          status: { state: "failed", timestamp: (/* @__PURE__ */ new Date()).toISOString() },
-          final: true
-        });
-      } finally {
-        reply.raw.end();
-      }
-    }
-  );
   const v1CardFor = (request, assistant, pushNotifications) => buildAgentCardForAssistantV1({
     assistant,
-    baseUrl: buildBaseUrl(request),
+    baseUrl: resolveRequestBaseUrl(request),
     pushNotifications
   });
   const authenticateV1 = async (request) => {
@@ -3968,12 +3906,26 @@ data: ${JSON.stringify(data)}
         reply.header("A2A-Version", "1.0").send(versionNotSupportedError(requestId, requestedVersion));
         return;
       }
+      const preAuthBlocked = await enforceRateLimit(
+        request,
+        reply,
+        { ip: request.ip },
+        requestId
+      );
+      if (preAuthBlocked) return;
       const auth = await authenticateV1(request);
       if (!auth.ok) {
         reply.status(auth.status).send(jsonRpcError(requestId, authErrorToRpcCode(auth.status), auth.message));
         return;
       }
       const rawMethod = asString4(requestBody.method);
+      const blocked = await enforceRateLimit(
+        request,
+        reply,
+        { key: auth.auth.apiKey },
+        requestId
+      );
+      if (blocked) return;
       const tenantId = auth.auth.tenantId ?? "default";
       const scope = {
         tenantId,
@@ -4089,7 +4041,7 @@ data: ${JSON.stringify(data)}
       }
       const card = buildAgentCardForAssistant({
         assistant: auth.assistant,
-        baseUrl: buildBaseUrl(request),
+        baseUrl: resolveRequestBaseUrl(request),
         pushNotifications: pushStore !== void 0,
         jsonRpcPath: `/a2a/v1/${auth.assistant.id}`
       });
@@ -4185,4 +4137,4 @@ data: ${JSON.stringify(errorResponse)}
 export {
   registerA2AStandardRoutes
 };
-//# sourceMappingURL=a2a-standard-VL5I7B4W.mjs.map
+//# sourceMappingURL=a2a-standard-MD7WNDTP.mjs.map