@desplega.ai/agent-swarm 1.113.0 → 1.114.0

package/dist/cli-0pygq9r1.js

@@ -0,0 +1,429 @@
+// node_modules/oauth4webapi/build/index.js
+var USER_AGENT;
+if (typeof navigator === "undefined" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) {
+  const NAME = "oauth4webapi";
+  const VERSION = "v3.8.5";
+  USER_AGENT = `${NAME}/${VERSION}`;
+}
+var ERR_INVALID_ARG_VALUE = "ERR_INVALID_ARG_VALUE";
+var ERR_INVALID_ARG_TYPE = "ERR_INVALID_ARG_TYPE";
+function CodedTypeError(message, code, cause) {
+  const err = new TypeError(message, { cause });
+  Object.assign(err, { code });
+  return err;
+}
+var allowInsecureRequests = Symbol();
+var clockSkew = Symbol();
+var clockTolerance = Symbol();
+var customFetch = Symbol();
+var modifyAssertion = Symbol();
+var jweDecrypt = Symbol();
+var jwksCache = Symbol();
+var encoder = new TextEncoder;
+var decoder = new TextDecoder;
+function buf(input) {
+  if (typeof input === "string") {
+    return encoder.encode(input);
+  }
+  return decoder.decode(input);
+}
+var encodeBase64Url;
+if (Uint8Array.prototype.toBase64) {
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    return input.toBase64({ alphabet: "base64url", omitPadding: true });
+  };
+} else {
+  const CHUNK_SIZE = 32768;
+  encodeBase64Url = (input) => {
+    if (input instanceof ArrayBuffer) {
+      input = new Uint8Array(input);
+    }
+    const arr = [];
+    for (let i = 0;i < input.byteLength; i += CHUNK_SIZE) {
+      arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+    }
+    return btoa(arr.join("")).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  };
+}
+var decodeBase64Url;
+if (Uint8Array.fromBase64) {
+  decodeBase64Url = (input) => {
+    try {
+      return Uint8Array.fromBase64(input, { alphabet: "base64url" });
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+} else {
+  decodeBase64Url = (input) => {
+    try {
+      const binary = atob(input.replace(/-/g, "+").replace(/_/g, "/").replace(/\s/g, ""));
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0;i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return bytes;
+    } catch (cause) {
+      throw CodedTypeError("The input to be decoded is not correctly encoded.", ERR_INVALID_ARG_VALUE, cause);
+    }
+  };
+}
+function b64u(input) {
+  if (typeof input === "string") {
+    return decodeBase64Url(input);
+  }
+  return encodeBase64Url(input);
+}
+
+class UnsupportedOperationError extends Error {
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    this.code = UNSUPPORTED_OPERATION;
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+
+class OperationProcessingError extends Error {
+  code;
+  constructor(message, options) {
+    super(message, options);
+    this.name = this.constructor.name;
+    if (options?.code) {
+      this.code = options?.code;
+    }
+    Error.captureStackTrace?.(this, this.constructor);
+  }
+}
+function OPE(message, code, cause) {
+  return new OperationProcessingError(message, { code, cause });
+}
+async function calculateJwkThumbprint(jwk) {
+  let components;
+  switch (jwk.kty) {
+    case "EC":
+      components = {
+        crv: jwk.crv,
+        kty: jwk.kty,
+        x: jwk.x,
+        y: jwk.y
+      };
+      break;
+    case "OKP":
+      components = {
+        crv: jwk.crv,
+        kty: jwk.kty,
+        x: jwk.x
+      };
+      break;
+    case "AKP":
+      components = {
+        alg: jwk.alg,
+        kty: jwk.kty,
+        pub: jwk.pub
+      };
+      break;
+    case "RSA":
+      components = {
+        e: jwk.e,
+        kty: jwk.kty,
+        n: jwk.n
+      };
+      break;
+    default:
+      throw new UnsupportedOperationError("unsupported JWK key type", { cause: jwk });
+  }
+  return b64u(await crypto.subtle.digest("SHA-256", buf(JSON.stringify(components))));
+}
+function assertCryptoKey(key, it) {
+  if (!(key instanceof CryptoKey)) {
+    throw CodedTypeError(`${it} must be a CryptoKey`, ERR_INVALID_ARG_TYPE);
+  }
+}
+function assertPrivateKey(key, it) {
+  assertCryptoKey(key, it);
+  if (key.type !== "private") {
+    throw CodedTypeError(`${it} must be a private CryptoKey`, ERR_INVALID_ARG_VALUE);
+  }
+}
+function assertPublicKey(key, it) {
+  assertCryptoKey(key, it);
+  if (key.type !== "public") {
+    throw CodedTypeError(`${it} must be a public CryptoKey`, ERR_INVALID_ARG_VALUE);
+  }
+}
+function assertString(input, it, code, cause) {
+  try {
+    if (typeof input !== "string") {
+      throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);
+    }
+    if (input.length === 0) {
+      throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);
+    }
+  } catch (err) {
+    if (code) {
+      throw OPE(err.message, code, cause);
+    }
+    throw err;
+  }
+}
+function randomBytes() {
+  return b64u(crypto.getRandomValues(new Uint8Array(32)));
+}
+function generateRandomCodeVerifier() {
+  return randomBytes();
+}
+function generateRandomState() {
+  return randomBytes();
+}
+async function calculatePKCECodeChallenge(codeVerifier) {
+  assertString(codeVerifier, "codeVerifier");
+  return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
+}
+function psAlg(key) {
+  switch (key.algorithm.hash.name) {
+    case "SHA-256":
+      return "PS256";
+    case "SHA-384":
+      return "PS384";
+    case "SHA-512":
+      return "PS512";
+    default:
+      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
+        cause: key
+      });
+  }
+}
+function rsAlg(key) {
+  switch (key.algorithm.hash.name) {
+    case "SHA-256":
+      return "RS256";
+    case "SHA-384":
+      return "RS384";
+    case "SHA-512":
+      return "RS512";
+    default:
+      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
+        cause: key
+      });
+  }
+}
+function esAlg(key) {
+  switch (key.algorithm.namedCurve) {
+    case "P-256":
+      return "ES256";
+    case "P-384":
+      return "ES384";
+    case "P-521":
+      return "ES512";
+    default:
+      throw new UnsupportedOperationError("unsupported EcKeyAlgorithm namedCurve", { cause: key });
+  }
+}
+function keyToJws(key) {
+  switch (key.algorithm.name) {
+    case "RSA-PSS":
+      return psAlg(key);
+    case "RSASSA-PKCS1-v1_5":
+      return rsAlg(key);
+    case "ECDSA":
+      return esAlg(key);
+    case "Ed25519":
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87":
+      return key.algorithm.name;
+    case "EdDSA":
+      return "Ed25519";
+    default:
+      throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
+  }
+}
+function getClockSkew(client) {
+  const skew = client?.[clockSkew];
+  return typeof skew === "number" && Number.isFinite(skew) ? skew : 0;
+}
+function epochTime() {
+  return Math.floor(Date.now() / 1000);
+}
+async function signJwt(header, payload, key) {
+  if (!key.usages.includes("sign")) {
+    throw CodedTypeError('CryptoKey instances used for signing assertions must include "sign" in their "usages"', ERR_INVALID_ARG_VALUE);
+  }
+  const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;
+  const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));
+  return `${input}.${signature}`;
+}
+var jwkCache;
+async function getSetPublicJwkCache(key, alg) {
+  const { kty, e, n, x, y, crv, pub } = await crypto.subtle.exportKey("jwk", key);
+  const jwk = { kty, e, n, x, y, crv, pub };
+  if (kty === "AKP")
+    jwk.alg = alg;
+  jwkCache.set(key, jwk);
+  return jwk;
+}
+async function publicJwk(key, alg) {
+  jwkCache ||= new WeakMap;
+  return jwkCache.get(key) || getSetPublicJwkCache(key, alg);
+}
+var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
+  try {
+    return new URL(url, base);
+  } catch {
+    return null;
+  }
+};
+class DPoPHandler {
+  #header;
+  #privateKey;
+  #publicKey;
+  #clockSkew;
+  #modifyAssertion;
+  #map;
+  #jkt;
+  constructor(client, keyPair, options) {
+    assertPrivateKey(keyPair?.privateKey, '"DPoP.privateKey"');
+    assertPublicKey(keyPair?.publicKey, '"DPoP.publicKey"');
+    if (!keyPair.publicKey.extractable) {
+      throw CodedTypeError('"DPoP.publicKey.extractable" must be true', ERR_INVALID_ARG_VALUE);
+    }
+    this.#modifyAssertion = options?.[modifyAssertion];
+    this.#clockSkew = getClockSkew(client);
+    this.#privateKey = keyPair.privateKey;
+    this.#publicKey = keyPair.publicKey;
+    branded.add(this);
+  }
+  #get(key) {
+    this.#map ||= new Map;
+    let item = this.#map.get(key);
+    if (item) {
+      this.#map.delete(key);
+      this.#map.set(key, item);
+    }
+    return item;
+  }
+  #set(key, val) {
+    this.#map ||= new Map;
+    this.#map.delete(key);
+    if (this.#map.size === 100) {
+      this.#map.delete(this.#map.keys().next().value);
+    }
+    this.#map.set(key, val);
+  }
+  async calculateThumbprint() {
+    if (!this.#jkt) {
+      const jwk = await crypto.subtle.exportKey("jwk", this.#publicKey);
+      this.#jkt ||= await calculateJwkThumbprint(jwk);
+    }
+    return this.#jkt;
+  }
+  async addProof(url, headers, htm, accessToken) {
+    const alg = keyToJws(this.#privateKey);
+    this.#header ||= {
+      alg,
+      typ: "dpop+jwt",
+      jwk: await publicJwk(this.#publicKey, alg)
+    };
+    const nonce = this.#get(url.origin);
+    const now = epochTime() + this.#clockSkew;
+    const payload = {
+      iat: now,
+      jti: randomBytes(),
+      htm,
+      nonce,
+      htu: `${url.origin}${url.pathname}`,
+      ath: accessToken ? b64u(await crypto.subtle.digest("SHA-256", buf(accessToken))) : undefined
+    };
+    this.#modifyAssertion?.(this.#header, payload);
+    headers.set("dpop", await signJwt(this.#header, payload, this.#privateKey));
+  }
+  cacheNonce(response, url) {
+    try {
+      const nonce = response.headers.get("dpop-nonce");
+      if (nonce) {
+        this.#set(url.origin, nonce);
+      }
+    } catch {}
+  }
+}
+var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
+var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
+var quotedMatch = '"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
+var quotedParamMatcher = "(" + tokenMatch + ")\\s*=\\s*" + quotedMatch;
+var paramMatcher = "(" + tokenMatch + ")\\s*=\\s*(" + tokenMatch + ")";
+var schemeRE = new RegExp("^[,\\s]*(" + tokenMatch + ")");
+var quotedParamRE = new RegExp("^[,\\s]*" + quotedParamMatcher + "[,\\s]*(.*)");
+var unquotedParamRE = new RegExp("^[,\\s]*" + paramMatcher + "[,\\s]*(.*)");
+var token68ParamRE = new RegExp("^(" + token68Match + ")(?:$|[,\\s])(.*)");
+var skipSubjectCheck = Symbol();
+var idTokenClaims = new WeakMap;
+var jwtRefs = new WeakMap;
+var branded = new WeakSet;
+var nopkce = Symbol();
+var expectNoNonce = Symbol();
+var skipAuthTimeCheck = Symbol();
+var UNSUPPORTED_OPERATION = "OAUTH_UNSUPPORTED_OPERATION";
+function checkRsaKeyAlgorithm(key) {
+  const { algorithm } = key;
+  if (typeof algorithm.modulusLength !== "number" || algorithm.modulusLength < 2048) {
+    throw new UnsupportedOperationError(`unsupported ${algorithm.name} modulusLength`, {
+      cause: key
+    });
+  }
+}
+function ecdsaHashName(key) {
+  const { algorithm } = key;
+  switch (algorithm.namedCurve) {
+    case "P-256":
+      return "SHA-256";
+    case "P-384":
+      return "SHA-384";
+    case "P-521":
+      return "SHA-512";
+    default:
+      throw new UnsupportedOperationError("unsupported ECDSA namedCurve", { cause: key });
+  }
+}
+function keyToSubtle(key) {
+  switch (key.algorithm.name) {
+    case "ECDSA":
+      return {
+        name: key.algorithm.name,
+        hash: ecdsaHashName(key)
+      };
+    case "RSA-PSS": {
+      checkRsaKeyAlgorithm(key);
+      switch (key.algorithm.hash.name) {
+        case "SHA-256":
+        case "SHA-384":
+        case "SHA-512":
+          return {
+            name: key.algorithm.name,
+            saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3
+          };
+        default:
+          throw new UnsupportedOperationError("unsupported RSA-PSS hash name", { cause: key });
+      }
+    }
+    case "RSASSA-PKCS1-v1_5":
+      checkRsaKeyAlgorithm(key);
+      return key.algorithm.name;
+    case "ML-DSA-44":
+    case "ML-DSA-65":
+    case "ML-DSA-87":
+    case "Ed25519":
+      return key.algorithm.name;
+  }
+  throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
+}
+var skipStateCheck = Symbol();
+var expectNoState = Symbol();
+var _nodiscoverycheck = Symbol();
+var _expectedIssuer = Symbol();
+
+export { generateRandomCodeVerifier, generateRandomState, calculatePKCECodeChallenge };

package/dist/{cli-h3k622d0.js → cli-113wmegp.js}

@@ -1,7 +1,10 @@
 import {
   getDb,
-  init_db
-} from "./cli-ncfgsqbd.js";
+  getKv,
+  incrKv,
+  init_db,
+  upsertKv
+} from "./cli-jzwtn8rm.js";
 
 // src/be/users.ts
 init_db();
@@ -51,6 +54,18 @@ function findUserByEmail(email) {
   }
   return null;
 }
+function findUsersByName(name) {
+  const trimmed = name.trim();
+  if (!trimmed)
+    return [];
+  const db = getDb();
+  const exact = db.prepare("SELECT * FROM users WHERE LOWER(name) = LOWER(?)").all(trimmed);
+  if (exact.length > 0)
+    return exact.map(rowToUser);
+  const firstToken = trimmed.split(/\s+/)[0] ?? trimmed;
+  const prefixed = db.prepare("SELECT * FROM users WHERE LOWER(name) LIKE LOWER(?) || '%'").all(firstToken);
+  return prefixed.map(rowToUser);
+}
 function getUserIdentities(userId) {
   return getDb().prepare("SELECT kind, externalId FROM user_external_ids WHERE userId = ? ORDER BY kind, externalId").all(userId);
 }
@@ -179,4 +194,76 @@ function fingerprintApiKey(rawKey) {
   return `op:${sha256Hex(rawKey).slice(0, 16)}`;
 }
 
-export { findUserById, findUserByExternalId, findUserByEmail, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, fingerprintApiKey };
+// src/be/identity.ts
+function resolveIdentity(kind, externalId) {
+  const user = findUserByExternalId(kind, externalId);
+  if (!user) {
+    return { status: "unknown", kind, externalId };
+  }
+  return {
+    status: "resolved",
+    kind,
+    externalId,
+    userId: user.id,
+    name: user.name,
+    email: user.email
+  };
+}
+function resolveIdentityByEmail(email) {
+  const user = findUserByEmail(email);
+  if (!user) {
+    return { status: "unknown", kind: "email", externalId: email };
+  }
+  return {
+    status: "resolved",
+    kind: "email",
+    externalId: email,
+    userId: user.id,
+    name: user.name,
+    email: user.email
+  };
+}
+function renderIdentity(resolution) {
+  const pair = `${resolution.kind}:${resolution.externalId}`;
+  if (resolution.status === "resolved") {
+    return `${resolution.name} (${pair})`;
+  }
+  return `${pair} (unknown user)`;
+}
+
+// src/be/unmapped-identities.ts
+init_db();
+var TTL_MS = 30 * 24 * 60 * 60 * 1000;
+function namespace(kind) {
+  return `integration:unmapped:${kind}`;
+}
+function recordUnmappedIdentity(kind, externalId, meta) {
+  const ns = namespace(kind);
+  const now = new Date().toISOString();
+  const expiresAt = Date.now() + TTL_MS;
+  const countKey = `${externalId}:count`;
+  const countBefore = getKv(ns, countKey);
+  upsertKv({
+    namespace: ns,
+    key: `${externalId}:meta`,
+    value: {
+      lastSeenAt: now,
+      sampleEventType: meta.sampleEventType,
+      sampleContext: meta.sampleContext.slice(0, 100)
+    },
+    valueType: "json",
+    expiresAt
+  });
+  const incremented = incrKv(ns, countKey, 1);
+  if (countBefore === null) {
+    upsertKv({
+      namespace: ns,
+      key: countKey,
+      value: Number(incremented.value),
+      valueType: "integer",
+      expiresAt
+    });
+  }
+}
+
+export { findUserById, findUserByExternalId, findUsersByName, getUserIdentities, listUserEvents, listUserTokens, recordIdentityEvent, findOrCreateUserByEmail, linkIdentity, unlinkIdentity, mintToken, revokeToken, resolveUserByToken, fingerprintApiKey, resolveIdentity, resolveIdentityByEmail, renderIdentity, recordUnmappedIdentity };

package/dist/{cli-7ga43spr.js → cli-1yjrbg1f.js}

@@ -14,7 +14,7 @@ import {
   string,
   union,
   unknown
-} from "./cli-anrj584m.js";
+} from "./cli-xz9aq0rf.js";
 
 // node_modules/@mistralai/mistralai/esm/lib/primitives.js
 function remap(inp, mappings) {

package/dist/{cli-r5g6ngtn.js → cli-2t4e4ayk.js}

@@ -17,7 +17,7 @@ import {
   init_templates1 as init_templates,
   normalizeDateRequired,
   resolveTemplate
-} from "./cli-ncfgsqbd.js";
+} from "./cli-jzwtn8rm.js";
 
 // src/be/db-queries/tracker.ts
 init_date_utils();

package/dist/{cli-y4ycrnjc.js → cli-312v3c41.js}

@@ -3,7 +3,7 @@ import {
   getAgentById,
   getInProgressTasksByContextKey,
   init_db
-} from "./cli-ncfgsqbd.js";
+} from "./cli-jzwtn8rm.js";
 
 // src/tasks/context-key.ts
 var SEPARATOR = ":";

package/dist/{cli-ceewqajw.js → cli-46b6kc7f.js}

@@ -1,12 +1,12 @@
+import {
+  resolveCodexPrompt
+} from "./cli-r94z9p1z.js";
 import {
   summarizeSession
-} from "./cli-6wscj9z0.js";
+} from "./cli-e7306swv.js";
 import {
   createSwarmEventHandler
 } from "./cli-07er7wrs.js";
-import {
-  resolveCodexPrompt
-} from "./cli-r94z9p1z.js";
 import {
   readPkgVersion
 } from "./cli-d6n0thxw.js";
@@ -14,7 +14,7 @@ import {
   buildRatingsFromLlm,
   fetchRetrievalsForTask,
   postRatings
-} from "./cli-dcfyyh3t.js";
+} from "./cli-ftyf58xj.js";
 import {
   CodexOAuthRefreshError,
   credentialsToAuthJson,