@desplega.ai/agent-swarm 1.131.1 → 1.134.0

package/dist/{cli-wz9115x0.js → cli-gtafvdy0.js}

@@ -1,25 +1,25 @@
 import {
   createSwarmEventHandler
 } from "./cli-07er7wrs.js";
-import {
-  readPkgVersion
-} from "./cli-d6n0thxw.js";
-import {
-  checkToolLoop
-} from "./cli-yv9dttkh.js";
 import {
   CONTEXT_FORMULA,
   clampContextPercent,
   computeContextUsedUnified,
   getContextWindowSize
 } from "./cli-cw70hymf.js";
+import {
+  readPkgVersion
+} from "./cli-f64gdfxc.js";
+import {
+  checkToolLoop
+} from "./cli-yv9dttkh.js";
 import {
   Anthropic
-} from "./cli-gz9sbyk3.js";
+} from "./cli-jepmgn7r.js";
 import {
   init_secret_scrubber,
   scrubSecrets
-} from "./cli-4j2mrzag.js";
+} from "./cli-mkq1rk7b.js";
 
 // src/providers/claude-managed-adapter.ts
 init_secret_scrubber();

package/dist/{cli-q5dzzak0.js → cli-gy07xk4s.js}

@@ -1,10 +1,10 @@
 import {
   __commonJS,
   __require
-} from "./cli-p9swy5t3.js";
+} from "./cli-pq2ee5ja.js";
 
 // node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/execAsync.js
-var require_execAsync = __commonJS((exports) => {
+var require_execAsync = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.execAsync = undefined;
   var child_process = __require("child_process");

package/dist/{cli-sy7jk3tx.js → cli-h0djenzm.js}

@@ -1,10 +1,10 @@
 import {
   PermissionVerbSchema
-} from "./cli-bqw0mt1n.js";
+} from "./cli-k46t4664.js";
 import {
   getDb,
   init_db
-} from "./cli-50vbt00w.js";
+} from "./cli-m07313tr.js";
 
 // src/be/rbac-roles.ts
 init_db();

package/dist/{cli-nrkkknat.js → cli-h37gbjbf.js}

@@ -7,12 +7,12 @@ import {
   init_date_utils,
   init_db,
   normalizeDateRequired
-} from "./cli-50vbt00w.js";
+} from "./cli-m07313tr.js";
 import {
   init_secret_scrubber,
   registerVolatileSecret,
   scrubSecrets
-} from "./cli-4j2mrzag.js";
+} from "./cli-mkq1rk7b.js";
 
 // src/be/db-queries/oauth.ts
 init_crypto();
@@ -447,17 +447,6 @@ function b64u(input) {
   }
   return encodeBase64Url(input);
 }
-
-class UnsupportedOperationError extends Error {
-  code;
-  constructor(message, options) {
-    super(message, options);
-    this.name = this.constructor.name;
-    this.code = UNSUPPORTED_OPERATION;
-    Error.captureStackTrace?.(this, this.constructor);
-  }
-}
-
 class OperationProcessingError extends Error {
   code;
   constructor(message, options) {
@@ -472,60 +461,6 @@ class OperationProcessingError extends Error {
 function OPE(message, code, cause) {
   return new OperationProcessingError(message, { code, cause });
 }
-async function calculateJwkThumbprint(jwk) {
-  let components;
-  switch (jwk.kty) {
-    case "EC":
-      components = {
-        crv: jwk.crv,
-        kty: jwk.kty,
-        x: jwk.x,
-        y: jwk.y
-      };
-      break;
-    case "OKP":
-      components = {
-        crv: jwk.crv,
-        kty: jwk.kty,
-        x: jwk.x
-      };
-      break;
-    case "AKP":
-      components = {
-        alg: jwk.alg,
-        kty: jwk.kty,
-        pub: jwk.pub
-      };
-      break;
-    case "RSA":
-      components = {
-        e: jwk.e,
-        kty: jwk.kty,
-        n: jwk.n
-      };
-      break;
-    default:
-      throw new UnsupportedOperationError("unsupported JWK key type", { cause: jwk });
-  }
-  return b64u(await crypto.subtle.digest("SHA-256", buf(JSON.stringify(components))));
-}
-function assertCryptoKey(key, it) {
-  if (!(key instanceof CryptoKey)) {
-    throw CodedTypeError(`${it} must be a CryptoKey`, ERR_INVALID_ARG_TYPE);
-  }
-}
-function assertPrivateKey(key, it) {
-  assertCryptoKey(key, it);
-  if (key.type !== "private") {
-    throw CodedTypeError(`${it} must be a private CryptoKey`, ERR_INVALID_ARG_VALUE);
-  }
-}
-function assertPublicKey(key, it) {
-  assertCryptoKey(key, it);
-  if (key.type !== "public") {
-    throw CodedTypeError(`${it} must be a public CryptoKey`, ERR_INVALID_ARG_VALUE);
-  }
-}
 function assertString(input, it, code, cause) {
   try {
     if (typeof input !== "string") {
@@ -554,93 +489,6 @@ async function calculatePKCECodeChallenge(codeVerifier) {
   assertString(codeVerifier, "codeVerifier");
   return b64u(await crypto.subtle.digest("SHA-256", buf(codeVerifier)));
 }
-function psAlg(key) {
-  switch (key.algorithm.hash.name) {
-    case "SHA-256":
-      return "PS256";
-    case "SHA-384":
-      return "PS384";
-    case "SHA-512":
-      return "PS512";
-    default:
-      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
-        cause: key
-      });
-  }
-}
-function rsAlg(key) {
-  switch (key.algorithm.hash.name) {
-    case "SHA-256":
-      return "RS256";
-    case "SHA-384":
-      return "RS384";
-    case "SHA-512":
-      return "RS512";
-    default:
-      throw new UnsupportedOperationError("unsupported RsaHashedKeyAlgorithm hash name", {
-        cause: key
-      });
-  }
-}
-function esAlg(key) {
-  switch (key.algorithm.namedCurve) {
-    case "P-256":
-      return "ES256";
-    case "P-384":
-      return "ES384";
-    case "P-521":
-      return "ES512";
-    default:
-      throw new UnsupportedOperationError("unsupported EcKeyAlgorithm namedCurve", { cause: key });
-  }
-}
-function keyToJws(key) {
-  switch (key.algorithm.name) {
-    case "RSA-PSS":
-      return psAlg(key);
-    case "RSASSA-PKCS1-v1_5":
-      return rsAlg(key);
-    case "ECDSA":
-      return esAlg(key);
-    case "Ed25519":
-    case "ML-DSA-44":
-    case "ML-DSA-65":
-    case "ML-DSA-87":
-      return key.algorithm.name;
-    case "EdDSA":
-      return "Ed25519";
-    default:
-      throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
-  }
-}
-function getClockSkew(client) {
-  const skew = client?.[clockSkew];
-  return typeof skew === "number" && Number.isFinite(skew) ? skew : 0;
-}
-function epochTime() {
-  return Math.floor(Date.now() / 1000);
-}
-async function signJwt(header, payload, key) {
-  if (!key.usages.includes("sign")) {
-    throw CodedTypeError('CryptoKey instances used for signing assertions must include "sign" in their "usages"', ERR_INVALID_ARG_VALUE);
-  }
-  const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;
-  const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));
-  return `${input}.${signature}`;
-}
-var jwkCache;
-async function getSetPublicJwkCache(key, alg) {
-  const { kty, e, n, x, y, crv, pub } = await crypto.subtle.exportKey("jwk", key);
-  const jwk = { kty, e, n, x, y, crv, pub };
-  if (kty === "AKP")
-    jwk.alg = alg;
-  jwkCache.set(key, jwk);
-  return jwk;
-}
-async function publicJwk(key, alg) {
-  jwkCache ||= new WeakMap;
-  return jwkCache.get(key) || getSetPublicJwkCache(key, alg);
-}
 var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) => {
   try {
     return new URL(url, base);
@@ -648,79 +496,6 @@ var URLParse = URL.parse ? (url, base) => URL.parse(url, base) : (url, base) =>
     return null;
   }
 };
-class DPoPHandler {
-  #header;
-  #privateKey;
-  #publicKey;
-  #clockSkew;
-  #modifyAssertion;
-  #map;
-  #jkt;
-  constructor(client, keyPair, options) {
-    assertPrivateKey(keyPair?.privateKey, '"DPoP.privateKey"');
-    assertPublicKey(keyPair?.publicKey, '"DPoP.publicKey"');
-    if (!keyPair.publicKey.extractable) {
-      throw CodedTypeError('"DPoP.publicKey.extractable" must be true', ERR_INVALID_ARG_VALUE);
-    }
-    this.#modifyAssertion = options?.[modifyAssertion];
-    this.#clockSkew = getClockSkew(client);
-    this.#privateKey = keyPair.privateKey;
-    this.#publicKey = keyPair.publicKey;
-    branded.add(this);
-  }
-  #get(key) {
-    this.#map ||= new Map;
-    let item = this.#map.get(key);
-    if (item) {
-      this.#map.delete(key);
-      this.#map.set(key, item);
-    }
-    return item;
-  }
-  #set(key, val) {
-    this.#map ||= new Map;
-    this.#map.delete(key);
-    if (this.#map.size === 100) {
-      this.#map.delete(this.#map.keys().next().value);
-    }
-    this.#map.set(key, val);
-  }
-  async calculateThumbprint() {
-    if (!this.#jkt) {
-      const jwk = await crypto.subtle.exportKey("jwk", this.#publicKey);
-      this.#jkt ||= await calculateJwkThumbprint(jwk);
-    }
-    return this.#jkt;
-  }
-  async addProof(url, headers, htm, accessToken) {
-    const alg = keyToJws(this.#privateKey);
-    this.#header ||= {
-      alg,
-      typ: "dpop+jwt",
-      jwk: await publicJwk(this.#publicKey, alg)
-    };
-    const nonce = this.#get(url.origin);
-    const now = epochTime() + this.#clockSkew;
-    const payload = {
-      iat: now,
-      jti: randomBytes(),
-      htm,
-      nonce,
-      htu: `${url.origin}${url.pathname}`,
-      ath: accessToken ? b64u(await crypto.subtle.digest("SHA-256", buf(accessToken))) : undefined
-    };
-    this.#modifyAssertion?.(this.#header, payload);
-    headers.set("dpop", await signJwt(this.#header, payload, this.#privateKey));
-  }
-  cacheNonce(response, url) {
-    try {
-      const nonce = response.headers.get("dpop-nonce");
-      if (nonce) {
-        this.#set(url.origin, nonce);
-      }
-    } catch {}
-  }
-}
 var tokenMatch = "[a-zA-Z0-9!#$%&\\'\\*\\+\\-\\.\\^_`\\|~]+";
 var token68Match = "[a-zA-Z0-9\\-\\._\\~\\+\\/]+={0,2}";
 var quotedMatch = '"((?:[^"\\\\]|\\\\[\\s\\S])*)"';
@@ -737,60 +512,6 @@ var branded = new WeakSet;
 var nopkce = Symbol();
 var expectNoNonce = Symbol();
 var skipAuthTimeCheck = Symbol();
-var UNSUPPORTED_OPERATION = "OAUTH_UNSUPPORTED_OPERATION";
-function checkRsaKeyAlgorithm(key) {
-  const { algorithm } = key;
-  if (typeof algorithm.modulusLength !== "number" || algorithm.modulusLength < 2048) {
-    throw new UnsupportedOperationError(`unsupported ${algorithm.name} modulusLength`, {
-      cause: key
-    });
-  }
-}
-function ecdsaHashName(key) {
-  const { algorithm } = key;
-  switch (algorithm.namedCurve) {
-    case "P-256":
-      return "SHA-256";
-    case "P-384":
-      return "SHA-384";
-    case "P-521":
-      return "SHA-512";
-    default:
-      throw new UnsupportedOperationError("unsupported ECDSA namedCurve", { cause: key });
-  }
-}
-function keyToSubtle(key) {
-  switch (key.algorithm.name) {
-    case "ECDSA":
-      return {
-        name: key.algorithm.name,
-        hash: ecdsaHashName(key)
-      };
-    case "RSA-PSS": {
-      checkRsaKeyAlgorithm(key);
-      switch (key.algorithm.hash.name) {
-        case "SHA-256":
-        case "SHA-384":
-        case "SHA-512":
-          return {
-            name: key.algorithm.name,
-            saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3
-          };
-        default:
-          throw new UnsupportedOperationError("unsupported RSA-PSS hash name", { cause: key });
-      }
-    }
-    case "RSASSA-PKCS1-v1_5":
-      checkRsaKeyAlgorithm(key);
-      return key.algorithm.name;
-    case "ML-DSA-44":
-    case "ML-DSA-65":
-    case "ML-DSA-87":
-    case "Ed25519":
-      return key.algorithm.name;
-  }
-  throw new UnsupportedOperationError("unsupported CryptoKey algorithm name", { cause: key });
-}
 var skipStateCheck = Symbol();
 var expectNoState = Symbol();
 var _nodiscoverycheck = Symbol();