@evomap/evolver-proxy 2.0.0-beta.1 → 2.0.0-beta.10

package/dist/daemon/proxyDaemon.d.ts

@@ -56,6 +56,8 @@ export interface ProxyDaemonDeps {
         dir: string;
         env?: NodeJS.ProcessEnv;
     };
+    /** V1 collaboration task operations are synchronous; tests may shorten the Hub timeout. */
+    collaborationOperationTimeoutMs?: number;
 }
 export interface ProxyTickReport {
     outbound: OutboundResult;
@@ -118,6 +120,7 @@ export declare class ProxyDaemon {
     private readonly reuseResultReporter;
     private readonly validator;
     private readonly atp;
+    private readonly collaborationFacade;
     private ipc;
     private readonly now;
     private readonly random;
@@ -148,6 +151,7 @@ export declare class ProxyDaemon {
     private recordTickError;
     /** 启动: 锁 + IPC 监听 + 初次 hello. 返回 IPC 端口. */
     start(): Promise<number>;
+    private listenIpc;
     /** 单轮: core pump/TTL/wake + proxy 出站 + hub 入站 + 到点心跳. */
     tick(): Promise<ProxyTickReport>;
     /** 下一轮建议延时: inbound 背压/idle 与 outbound pending cadence 取更快者. */

package/dist/daemon/proxyDaemon.js

@@ -1,15 +1,17 @@
 import { dirname, join } from 'node:path';
-import { mailbox, hub as hubNs, shadow as shadow_, assetstore } from '@evomap/evolver-core';
+import { mailbox, hub as hubNs, shadow as shadow_, assetstore, util } from '@evomap/evolver-core';
 import { SyncEngine, SYNC_INTERVALS } from '../sync/engine.js';
 import { LifecycleManager } from '../lifecycle/manager.js';
 import { executeForceUpdate } from '../selfUpdate/executor.js';
 import { reportPendingSelfUpdateLastUpdate, reportSelfUpdateLastUpdate } from '../selfUpdate/lastUpdate.js';
 import { backfillProxyTraceUploads } from '../llm/traceBackfill.js';
 import { hubAuthFailureHint } from './selectHub.js';
+import { CollaborationFacade } from './collaborationFacade.js';
 export const DEFAULT_IPC_PORT = 19820;
 const MAX_TIMER_DELAY_MS = 2_147_483_647;
 const MAX_PROXY_TICK_ERROR_LENGTH = 2_000;
 const MAX_HEARTBEAT_TICK_ERROR_LENGTH = 1_000;
+const MAX_EPHEMERAL_IPC_LISTEN_ATTEMPTS = 5;
 /**
  * ProxyDaemon(M6-4) 装配层: 把 core(MailboxStore/Dispatcher/MailboxDaemon/IpcServer) +
  * HubBindings(M6-1) + SyncEngine(M6-2) + LifecycleManager(M6-3) 拼成系统级 proxy.
@@ -28,6 +30,7 @@ export class ProxyDaemon {
     reuseResultReporter;
     validator;
     atp;
+    collaborationFacade;
     ipc;
     now;
     random;
@@ -93,9 +96,20 @@ export class ProxyDaemon {
             pumpHandlers: ['core'], // proxy 出站归 SyncEngine, 不在此双 claim
             ...(deps.lockPath ? { lockPath: deps.lockPath } : {}),
         });
+        this.collaborationFacade = new CollaborationFacade({
+            store: this.store,
+            hub: hubToUse,
+            now: this.now,
+            notifyOutbound: () => this.notifyNewOutbound(),
+            ...(deps.runtimeNamespace ? { runtimeNamespace: deps.runtimeNamespace } : {}),
+            ...(deps.collaborationOperationTimeoutMs !== undefined ? { operationTimeoutMs: deps.collaborationOperationTimeoutMs } : {}),
+        });
         this.sync = new SyncEngine({
             store: this.store, hub: hubToUse, proxyHandler, now: this.now,
             ...(deps.runtimeNamespace ? { runtimeNamespace: deps.runtimeNamespace } : {}),
+            onOutboundSucceeded: (envelope, result) => this.collaborationFacade.handleOutboundSucceeded(envelope, result),
+            onOutboundTerminal: (envelope, error) => this.collaborationFacade.handleOutboundTerminal(envelope, error),
+            normalizeInboundEnvelope: (envelope) => this.collaborationFacade.normalizeInboundEnvelope(envelope),
             ...(deps.traceBackfill ? { onOutboundFlushed: () => { this.drainProxyTraceBackfill(); } } : {}),
         });
         this.lifecycle = new LifecycleManager({
@@ -151,7 +165,7 @@ export class ProxyDaemon {
                 ...(this.deps.onIpcAuthFailure ? { onAuthFailure: this.deps.onIpcAuthFailure } : {}),
                 extraRoutes: [(ctx) => this.handleProxyRoute(ctx)],
             });
-            const port = await this.ipc.listen(this.deps.ipcPort ?? DEFAULT_IPC_PORT);
+            const port = await this.listenIpc(this.ipc);
             try {
                 this.deps.onIpcListen?.(port);
             }
@@ -175,6 +189,22 @@ export class ProxyDaemon {
             throw err;
         }
     }
+    async listenIpc(ipc) {
+        const requestedPort = this.deps.ipcPort ?? DEFAULT_IPC_PORT;
+        if (requestedPort !== 0)
+            return ipc.listen(requestedPort);
+        for (let attempt = 0; attempt < MAX_EPHEMERAL_IPC_LISTEN_ATTEMPTS; attempt += 1) {
+            const assignedPort = await ipc.listen(0);
+            if (!util.isFetchForbiddenPort(assignedPort))
+                return assignedPort;
+            // The outer start() cleanup owns the final listener when retries are exhausted.
+            if (attempt === MAX_EPHEMERAL_IPC_LISTEN_ATTEMPTS - 1) {
+                throw new Error('proxy_ipc_safe_port_unavailable');
+            }
+            await ipc.close();
+        }
+        throw new Error('proxy_ipc_safe_port_unavailable');
+    }
     /** 单轮: core pump/TTL/wake + proxy 出站 + hub 入站 + 到点心跳. */
     async tick() {
         const errors = [];
@@ -555,6 +585,8 @@ export class ProxyDaemon {
         return Number.isFinite(n) && n > 0 ? n : null;
     }
     async handleProxyRoute(ctx) {
+        if (await this.collaborationFacade.handle(ctx))
+            return true;
         const handledAtp = await this.handleAtpRoute(ctx);
         if (handledAtp)
             return true;
@@ -711,6 +743,60 @@ export class ProxyDaemon {
             ctx.json(200, { ...distill, queued: submission !== null, submission });
             return true;
         }
+        if (ctx.route === 'POST /agent/search') {
+            const body = asRecord(await ctx.readJson());
+            const directory = this.deps.hub.agentDirectory ?? hubNs.unsupportedAgentDirectoryCapability();
+            const parsed = parseAgentSearchRequest(body);
+            if (!parsed.ok) {
+                respondAgentDirectory(ctx, parsed);
+                return true;
+            }
+            const result = await directory.search(parsed.value);
+            respondAgentDirectory(ctx, result);
+            return true;
+        }
+        if (ctx.route === 'POST /agent/profile') {
+            const body = asRecord(await ctx.readJson());
+            const directory = this.deps.hub.agentDirectory ?? hubNs.unsupportedAgentDirectoryCapability();
+            let agentId;
+            let timeoutMs;
+            try {
+                agentId = hubNs.normalizeAgentId(typeof body['agent_id'] === 'string' ? body['agent_id'] : '');
+                timeoutMs = hubNs.normalizeAgentDirectoryTimeout(typeof body['timeout_ms'] === 'number' ? body['timeout_ms'] : undefined);
+            }
+            catch (error) {
+                respondAgentDirectory(ctx, invalidAgentDirectoryRequest(error));
+                return true;
+            }
+            const result = await directory.getProfile(agentId, { timeoutMs });
+            respondAgentDirectory(ctx, result);
+            return true;
+        }
+        if (ctx.route === 'POST /agent/discover') {
+            const body = asRecord(await ctx.readJson());
+            const directory = this.deps.hub.agentDirectory ?? hubNs.unsupportedAgentDirectoryCapability();
+            let request;
+            try {
+                request = hubNs.normalizeAgentTaskDiscoveryRequest({
+                    title: typeof body['title'] === 'string' ? body['title'] : '',
+                    ...(typeof body['description'] === 'string' ? { description: body['description'] } : {}),
+                    ...(Array.isArray(body['signals']) ? { signals: body['signals'] } : {}),
+                    ...(typeof body['availability'] === 'string' ? { availability: body['availability'] } : {}),
+                    ...(typeof body['sort'] === 'string' ? { sort: body['sort'] } : {}),
+                    ...(typeof body['order'] === 'string' ? { order: body['order'] } : {}),
+                    ...(typeof body['cursor'] === 'string' ? { cursor: body['cursor'] } : {}),
+                    ...(typeof body['limit'] === 'number' ? { limit: body['limit'] } : {}),
+                    ...(typeof body['timeout_ms'] === 'number' ? { timeoutMs: body['timeout_ms'] } : {}),
+                });
+            }
+            catch (error) {
+                respondAgentDirectory(ctx, invalidAgentDirectoryRequest(error));
+                return true;
+            }
+            const result = await directory.discoverForTask(request);
+            respondAgentDirectory(ctx, result);
+            return true;
+        }
     }
     async searchAssets(query) {
         const limit = Math.max(1, Math.min(Number(query.limit ?? 5), 25));
@@ -862,6 +948,48 @@ function assetKind(value) {
 function asRecord(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
 }
+function respondAgentDirectory(ctx, result) {
+    if (result.ok) {
+        ctx.json(200, result);
+        return;
+    }
+    const status = {
+        invalid_request: 400,
+        permission_denied: 403,
+        capability_unavailable: 501,
+        invalid_response: 502,
+        hub_unavailable: 503,
+        timeout: 504,
+    }[result.error.code];
+    ctx.json(status, result);
+}
+function parseAgentSearchRequest(body) {
+    try {
+        return { ok: true, value: hubNs.normalizeAgentSearchRequest({
+                ...(typeof body['query'] === 'string' ? { query: body['query'] } : {}),
+                ...(Array.isArray(body['signals']) ? { signals: body['signals'] } : {}),
+                ...(typeof body['availability'] === 'string' ? { availability: body['availability'] } : {}),
+                ...(typeof body['sort'] === 'string' ? { sort: body['sort'] } : {}),
+                ...(typeof body['order'] === 'string' ? { order: body['order'] } : {}),
+                ...(typeof body['cursor'] === 'string' ? { cursor: body['cursor'] } : {}),
+                ...(typeof body['limit'] === 'number' ? { limit: body['limit'] } : {}),
+                ...(typeof body['timeout_ms'] === 'number' ? { timeoutMs: body['timeout_ms'] } : {}),
+            }) };
+    }
+    catch (error) {
+        return invalidAgentDirectoryRequest(error);
+    }
+}
+function invalidAgentDirectoryRequest(error) {
+    return {
+        ok: false,
+        error: {
+            code: 'invalid_request',
+            retryable: false,
+            message: error instanceof Error ? error.message.slice(0, 120) : 'invalid_request',
+        },
+    };
+}
 function stringBody(body, key) {
     const v = body[key];
     return typeof v === 'string' && v.length > 0 ? v : undefined;

package/dist/daemon/selectHub.js

@@ -1,3 +1,4 @@
+import { resolveHubUrl as resolvePublicHubUrl } from '@evomap/evolver-adapter-public';
 /** 据 EVOMAP_HUB_MODE 选 hub 实现(public|private). 缺省 public. bin 据此挂对应 adapter. */
 export function resolveHubMode(env) {
     const m = (env['EVOMAP_HUB_MODE'] ?? 'public').toLowerCase();
@@ -6,7 +7,22 @@ export function resolveHubMode(env) {
     return m;
 }
 export function resolveHubUrl(env) {
-    return env['EVOMAP_HUB_URL'] ?? 'https://dev.evomap.ai';
+    if ((env['EVOMAP_HUB_MODE'] ?? 'public').toLowerCase() === 'private')
+        return resolvePrivateHubUrl(env);
+    return resolvePublicHubUrl(env);
+}
+function resolvePrivateHubUrl(env) {
+    return trimmed(env['EVOMAP_HUB_URL'])
+        ?? trimmed(env['A2A_HUB_URL'])
+        ?? trimmed(env['EVOLVER_DEFAULT_HUB_URL'])
+        ?? resolvePublicHubUrl({});
+}
+function trimmed(value) {
+    const v = value?.trim();
+    if (!v)
+        return undefined;
+    const normalized = v.replace(/\/+$/, '');
+    return normalized || undefined;
 }
 /**
  * Actionable hint for a hub AUTH failure (401/403), tailored to the hub's error code so it does NOT misdirect

package/dist/index.d.ts

@@ -5,4 +5,5 @@ export * from './daemon/proxyDaemon.js';
 export * from './lifecycle/deployGuard.js';
 export * from './router/index.js';
 export * from './llm/index.js';
-export * from './selfUpdate/index.js';
+export * from './selfUpdate/index.js';
+export * from './private/adapterLoader.js';

package/dist/index.js

@@ -5,4 +5,5 @@ export * from './daemon/proxyDaemon.js';
 export * from './lifecycle/deployGuard.js';
 export * from './router/index.js';
 export * from './llm/index.js';
-export * from './selfUpdate/index.js';
+export * from './selfUpdate/index.js';
+export * from './private/adapterLoader.js';

package/dist/lifecycle/legacyNodeId.d.ts

@@ -12,31 +12,29 @@ export interface LegacyNodeIdCandidateOptions {
  * Legacy node_id file locations, in priority order. Mirror of v1
  * `_loadPersistedNodeId`:
  *
- *  0. `<EVOMAP_DIR>/node_id` — the explicit dir the CLI recipe / ATP / proxy
+ *  0. `<EVOMAP_HOME>/node_id` — when an explicit identity home is configured, it
+ *     must precede every state-root candidate. The legacy node_secret resolver uses
+ *     the same priority, keeping both credentials on one identity in split layouts.
+ *  1. `<EVOMAP_DIR>/node_id` — the explicit dir the CLI recipe / ATP / proxy
  *     anti-abuse code write under (`recipeHomeCandidates` puts EVOMAP_DIR ahead
  *     of EVOLVER_HOME/EVOMAP_HOME). `resolveEvomapHome` never consults EVOMAP_DIR,
  *     so a deployment that pivots on it would otherwise send no node_id on hello
- *     and let the hub mint a duplicate. Probed FIRST and ADDITIVELY (the
- *     EVOLVER_HOME/EVOMAP_HOME candidates below are kept), so setting EVOMAP_DIR
- *     never hides an id that lives under one of the home overrides. Deduped.
- *  1. `<evomapHome>/node_id` — the override-aware home file. `resolveEvomapHome()`
- *     honours EVOLVER_HOME (matching v1 `getEvomapDir`) and ADDITIONALLY
- *     EVOMAP_HOME after dropping blank/relative overrides. It wins first so a
- *     home relocated via EVOLVER_HOME reads the file the v1 writer put there —
- *     the lesson of v1 #120, which routed the reader through the same helper as
- *     the writer.
- *  2. `~/.evomap/node_id` — the UNCONDITIONAL v1 location. v1's writer pivots on
+ *     and let the hub mint a duplicate. It remains first when EVOMAP_HOME is not
+ *     configured, preserving the existing EVOMAP_DIR-only contract. Deduped.
+ *  2. `<EVOLVER_HOME>/node_id` — the state-home compatibility candidate, kept
+ *     after the identity roots so readers still walk every dir a writer may have used.
+ *  3. `~/.evomap/node_id` — the UNCONDITIONAL v1 location. v1's writer pivots on
  *     `getEvomapDir` = `EVOLVER_HOME || ~/.evomap` and ignores EVOMAP_HOME
  *     entirely, so unless EVOLVER_HOME was set a v1 file always physically lands
  *     here. We probe it explicitly so a v2 install that sets only EVOMAP_HOME
  *     (which steers candidate 1 away from `~/.evomap`) still recovers the v1
  *     identity instead of letting the hub mint a duplicate orphan node. Deduped
  *     against candidate 1 for the common no-override case where they coincide.
- *  3. `<proxy package>/.evomap_node_id` — the install-root file the writer falls
+ *  4. `<proxy package>/.evomap_node_id` — the install-root file the writer falls
  *     back to when `~/.evomap/` isn't writable (read-only $HOME in
  *     containers / restricted CI). Kept first for parity with the old v2
  *     candidate.
- *  4. `<outer package/workspace root>/.evomap_node_id` — the v1/outer install
+ *  5. `<outer package/workspace root>/.evomap_node_id` — the v1/outer install
  *     root fallback. In v2's multi-package layout the proxy code lives below
  *     `packages/evolver-proxy`, so only checking the proxy package root misses
  *     a file written at the install/workspace root.

package/dist/lifecycle/legacyNodeId.js

@@ -17,11 +17,23 @@ function cleanAbsolutePath(value) {
         return undefined;
     return isAbsolute(trimmed) ? trimmed : undefined;
 }
-function resolveEvomapHome(opts, fallbackHomeDir) {
-    return cleanAbsolutePath(opts.evomapHomeDir)
-        ?? cleanAbsolutePath(process.env['EVOLVER_HOME'])
-        ?? cleanAbsolutePath(process.env['EVOMAP_HOME'])
-        ?? (fallbackHomeDir === undefined ? undefined : join(fallbackHomeDir, '.evomap'));
+// Identity homes in probe order (#555 T2): the explicit test/caller override wins outright; otherwise
+// EVOMAP_HOME (THE identity home) outranks EVOLVER_HOME (the state root) so the evox agentDir split
+// (`--evomap-home <agentDir>/evomap` + `--home <agentDir>/evolver`) reads node files from the evomap dir.
+// legacyNodeIdCandidates() splices that explicit identity home ahead of EVOMAP_DIR so node_id and
+// node_secret cannot come from different halves of the split layout. Both homes stay in the candidate union,
+// so single-home setups resolve exactly as before.
+function identityHomeCandidates(opts, fallbackHomeDir) {
+    const fromOpts = cleanAbsolutePath(opts.evomapHomeDir);
+    if (fromOpts !== undefined)
+        return [fromOpts];
+    const homes = [
+        cleanAbsolutePath(process.env['EVOMAP_HOME']),
+        cleanAbsolutePath(process.env['EVOLVER_HOME']),
+    ].filter((value) => value !== undefined);
+    if (homes.length > 0)
+        return homes;
+    return fallbackHomeDir === undefined ? [] : [join(fallbackHomeDir, '.evomap')];
 }
 function packageNameAt(dir) {
     const pkgPath = join(dir, 'package.json');
@@ -59,31 +71,29 @@ function installRootNodeIdCandidates(moduleDir) {
  * Legacy node_id file locations, in priority order. Mirror of v1
  * `_loadPersistedNodeId`:
  *
- *  0. `<EVOMAP_DIR>/node_id` — the explicit dir the CLI recipe / ATP / proxy
+ *  0. `<EVOMAP_HOME>/node_id` — when an explicit identity home is configured, it
+ *     must precede every state-root candidate. The legacy node_secret resolver uses
+ *     the same priority, keeping both credentials on one identity in split layouts.
+ *  1. `<EVOMAP_DIR>/node_id` — the explicit dir the CLI recipe / ATP / proxy
  *     anti-abuse code write under (`recipeHomeCandidates` puts EVOMAP_DIR ahead
  *     of EVOLVER_HOME/EVOMAP_HOME). `resolveEvomapHome` never consults EVOMAP_DIR,
  *     so a deployment that pivots on it would otherwise send no node_id on hello
- *     and let the hub mint a duplicate. Probed FIRST and ADDITIVELY (the
- *     EVOLVER_HOME/EVOMAP_HOME candidates below are kept), so setting EVOMAP_DIR
- *     never hides an id that lives under one of the home overrides. Deduped.
- *  1. `<evomapHome>/node_id` — the override-aware home file. `resolveEvomapHome()`
- *     honours EVOLVER_HOME (matching v1 `getEvomapDir`) and ADDITIONALLY
- *     EVOMAP_HOME after dropping blank/relative overrides. It wins first so a
- *     home relocated via EVOLVER_HOME reads the file the v1 writer put there —
- *     the lesson of v1 #120, which routed the reader through the same helper as
- *     the writer.
- *  2. `~/.evomap/node_id` — the UNCONDITIONAL v1 location. v1's writer pivots on
+ *     and let the hub mint a duplicate. It remains first when EVOMAP_HOME is not
+ *     configured, preserving the existing EVOMAP_DIR-only contract. Deduped.
+ *  2. `<EVOLVER_HOME>/node_id` — the state-home compatibility candidate, kept
+ *     after the identity roots so readers still walk every dir a writer may have used.
+ *  3. `~/.evomap/node_id` — the UNCONDITIONAL v1 location. v1's writer pivots on
  *     `getEvomapDir` = `EVOLVER_HOME || ~/.evomap` and ignores EVOMAP_HOME
  *     entirely, so unless EVOLVER_HOME was set a v1 file always physically lands
  *     here. We probe it explicitly so a v2 install that sets only EVOMAP_HOME
  *     (which steers candidate 1 away from `~/.evomap`) still recovers the v1
  *     identity instead of letting the hub mint a duplicate orphan node. Deduped
  *     against candidate 1 for the common no-override case where they coincide.
- *  3. `<proxy package>/.evomap_node_id` — the install-root file the writer falls
+ *  4. `<proxy package>/.evomap_node_id` — the install-root file the writer falls
  *     back to when `~/.evomap/` isn't writable (read-only $HOME in
  *     containers / restricted CI). Kept first for parity with the old v2
  *     candidate.
- *  4. `<outer package/workspace root>/.evomap_node_id` — the v1/outer install
+ *  5. `<outer package/workspace root>/.evomap_node_id` — the v1/outer install
  *     root fallback. In v2's multi-package layout the proxy code lives below
  *     `packages/evolver-proxy`, so only checking the proxy package root misses
  *     a file written at the install/workspace root.
@@ -97,12 +107,17 @@ function installRootNodeIdCandidates(moduleDir) {
 export function legacyNodeIdCandidates(opts = {}) {
     const home = cleanAbsolutePath(opts.homeDir) ?? cleanAbsolutePath(homedir());
     const moduleDir = opts.moduleDir ?? _moduleDir;
-    const evomapHome = resolveEvomapHome(opts, home);
+    const evomapHomes = identityHomeCandidates(opts, home);
+    const identityHome = cleanAbsolutePath(opts.evomapHomeDir)
+        ?? cleanAbsolutePath(process.env['EVOMAP_HOME']);
     const evomapDir = cleanAbsolutePath(opts.evomapDir) ?? cleanAbsolutePath(process.env['EVOMAP_DIR']);
     return [
         ...new Set([
+            ...(identityHome === undefined ? [] : [join(identityHome, 'node_id')]),
             ...(evomapDir === undefined ? [] : [join(evomapDir, 'node_id')]),
-            ...(evomapHome === undefined ? [] : [join(evomapHome, 'node_id')]),
+            ...evomapHomes
+                .filter((dir) => dir !== identityHome)
+                .map((dir) => join(dir, 'node_id')),
             ...(home === undefined ? [] : [join(home, '.evomap', 'node_id')]),
             ...installRootNodeIdCandidates(moduleDir),
         ]),

package/dist/llm/traceControl.js

@@ -1,7 +1,7 @@
 import { verify } from 'node:crypto';
 export const DEFAULT_TRACE_CONFIG_SIGNING_PUBLIC_KEY = [
     '-----BEGIN PUBLIC KEY-----',
-    'MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA7kJvWUP3HC4FJPQtkh74',
+    'MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA7kJvWUP3HC4FJPQtkh74', // gitleaks:allow -- public verification key, not a credential.
     'y75h9Rzc2NSZC9e4fiIWdax4iv+yWeMeIHGNsMr7YI8Ws7ck1BimJWt026gwRW8I',
     'c2A7h97oZQ0Z0zFcjEZ8FpYFSu++Yz/dGrARAV7uCQg289jvo89F5fWNdX2k+lTH',
     'hBoBm0G71vkiAYlbQEjq1xm1WzYf8CVXmbr+J1z+ydQf9jczcFL79u3eQZhIPs3R',

package/dist/private/accountAssetCompatibility.d.ts

@@ -0,0 +1,28 @@
+import type { hub } from '@evomap/evolver-core';
+import { type AccountAssetListOptions, type AccountAssetListResult } from '@evomap/evolver-adapter-public';
+export interface PrivateAccountAssetHub {
+    listAccountAssets(opts: AccountAssetListOptions): Promise<AccountAssetListResult>;
+}
+interface PrivateCompatibilityResponse {
+    status: number;
+    json(): Promise<unknown>;
+}
+export type PrivateCompatibilityFetch = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body?: string;
+}) => Promise<PrivateCompatibilityResponse>;
+interface PrivateAccountAssetCompatibilityOptions {
+    baseUrl: string;
+    auth: hub.AuthProvider;
+    senderId: () => string | undefined;
+    env: Record<string, string | undefined>;
+    fetchFn?: PrivateCompatibilityFetch;
+}
+/**
+ * Older official private adapters predate account inventory listing. Keep the
+ * compatibility wire at the private composition edge, and never replace a
+ * future adapter's native implementation.
+ */
+export declare function withPrivateAccountAssetCompatibility<T extends object>(hubCapability: T, opts: PrivateAccountAssetCompatibilityOptions): T & PrivateAccountAssetHub;
+export {};

package/dist/private/accountAssetCompatibility.js

@@ -0,0 +1,196 @@
+import { AuthError, HubClientError, HubUnreachableError, } from '@evomap/evolver-adapter-public';
+const PRIVATE_PUBLISHED_ASSETS_PATH = '/a2a/assets/published-by-me';
+const PRIVATE_PUBLISHED_MAX_PAGE_SIZE = 500;
+const PRIVATE_CURSOR_MAX_LENGTH = 4096;
+/**
+ * Older official private adapters predate account inventory listing. Keep the
+ * compatibility wire at the private composition edge, and never replace a
+ * future adapter's native implementation.
+ */
+export function withPrivateAccountAssetCompatibility(hubCapability, opts) {
+    const candidate = hubCapability;
+    if (typeof candidate['listAccountAssets'] === 'function') {
+        return hubCapability;
+    }
+    if (candidate['listAccountAssets'] !== undefined) {
+        throw new Error('private Hub adapter exposes an invalid account asset sync capability');
+    }
+    const client = new PrivateAccountAssetCompatibility(opts);
+    try {
+        Object.defineProperty(hubCapability, 'listAccountAssets', {
+            configurable: false,
+            enumerable: false,
+            writable: false,
+            value: (listOpts) => client.list(listOpts),
+        });
+    }
+    catch {
+        throw new Error('private Hub adapter cannot be extended with account asset sync compatibility');
+    }
+    return hubCapability;
+}
+class PrivateAccountAssetCompatibility {
+    opts;
+    baseUrl;
+    fetchFn;
+    constructor(opts) {
+        this.opts = opts;
+        this.baseUrl = normalizePrivateHubBaseUrl(opts.baseUrl, opts.env);
+        this.fetchFn = opts.fetchFn ?? globalPrivateCompatibilityFetch;
+    }
+    async list(opts) {
+        assertAccountAssetListOptions(opts);
+        if (opts.scope === 'purchased') {
+            // Private Hub has no marketplace/purchase ledger. An empty inventory is
+            // distinct from published assets and avoids importing arbitrary recall hits.
+            if (opts.cursor)
+                throw new HubClientError(400, { code: 'private_marketplace_cursor_unsupported' });
+            return { assets: [], count: 0, hasMore: false };
+        }
+        const limit = Math.min(opts.limit ?? 100, PRIVATE_PUBLISHED_MAX_PAGE_SIZE);
+        const query = new URLSearchParams({ limit: String(limit) });
+        const senderId = this.opts.senderId()?.trim();
+        if (senderId)
+            query.set('sender_id', senderId);
+        if (opts.cursor)
+            query.set('cursor', opts.cursor);
+        if (opts.type)
+            query.set('type', opts.type);
+        if (opts.status && opts.status !== 'all')
+            query.set('status', opts.status);
+        const signed = await this.opts.auth.authenticate({ method: 'GET', path: PRIVATE_PUBLISHED_ASSETS_PATH });
+        const headers = accountAssetHeaders(signed);
+        const url = `${this.baseUrl}${PRIVATE_PUBLISHED_ASSETS_PATH}?${query.toString()}`;
+        assertPrivateCompatibilityUrlSecure(url, this.opts.env);
+        let response;
+        try {
+            response = await this.fetchFn(url, { method: 'GET', headers });
+        }
+        catch (error) {
+            if (error instanceof AuthError || error instanceof HubClientError || error instanceof HubUnreachableError)
+                throw error;
+            throw new HubUnreachableError('Private Hub account asset request failed before a response arrived', {
+                context: `GET ${PRIVATE_PUBLISHED_ASSETS_PATH}`,
+            });
+        }
+        const body = await parseCompatibilityResponse(response);
+        if (response.status === 401 || response.status === 403)
+            throw new AuthError(response.status, body);
+        if (response.status >= 400 && response.status < 500)
+            throw new HubClientError(response.status, body);
+        if (response.status >= 500)
+            throw new Error(`private hub ${response.status} ${PRIVATE_PUBLISHED_ASSETS_PATH}`);
+        return parsePublishedPage(body, limit);
+    }
+}
+function assertAccountAssetListOptions(opts) {
+    if (!opts || (opts.scope !== 'purchased' && opts.scope !== 'published')) {
+        throw new HubClientError(400, { code: 'invalid_account_asset_scope' });
+    }
+    if (opts.limit !== undefined && (!Number.isSafeInteger(opts.limit) || opts.limit <= 0)) {
+        throw new HubClientError(400, { code: 'invalid_account_asset_limit' });
+    }
+    if (opts.cursor !== undefined && (!opts.cursor.trim() || opts.cursor.length > PRIVATE_CURSOR_MAX_LENGTH)) {
+        throw new HubClientError(400, { code: 'invalid_account_asset_cursor' });
+    }
+    if (opts.type !== undefined && opts.type !== 'Gene' && opts.type !== 'Capsule') {
+        throw new HubClientError(400, { code: 'invalid_account_asset_type' });
+    }
+    if (opts.status !== undefined && opts.status !== 'draft' && opts.status !== 'promoted' && opts.status !== 'all') {
+        throw new HubClientError(400, { code: 'invalid_account_asset_status' });
+    }
+}
+function accountAssetHeaders(signed) {
+    const headers = { accept: 'application/json', ...signed.headers };
+    const hasAuthorization = Object.keys(headers).some((key) => key.toLowerCase() === 'authorization');
+    const bodyNodeSecret = signed.bodyFields?.['node_secret'];
+    if (!hasAuthorization && typeof bodyNodeSecret === 'string' && bodyNodeSecret) {
+        headers['authorization'] = `Bearer ${bodyNodeSecret}`;
+    }
+    return headers;
+}
+async function parseCompatibilityResponse(response) {
+    if (!Number.isInteger(response.status) || response.status < 100 || response.status > 599) {
+        throw new HubUnreachableError('Private Hub account asset response has an invalid HTTP status', {
+            context: `GET ${PRIVATE_PUBLISHED_ASSETS_PATH}`,
+        });
+    }
+    try {
+        const parsed = await response.json();
+        const record = asRecord(parsed);
+        if (record)
+            return record;
+    }
+    catch {
+        // The normalized error below intentionally excludes response data.
+    }
+    throw new HubUnreachableError('Private Hub account asset response is not a JSON object', {
+        status: response.status,
+        context: `GET ${PRIVATE_PUBLISHED_ASSETS_PATH}`,
+    });
+}
+function parsePublishedPage(body, limit) {
+    const payload = asRecord(body['payload']) ?? body;
+    const assets = payload['assets'];
+    const hasMore = payload['has_more'] ?? payload['hasMore'];
+    const rawCursor = payload['next_cursor'] ?? payload['nextCursor'];
+    const count = payload['count'];
+    if (!Array.isArray(assets) || assets.length > limit || typeof hasMore !== 'boolean') {
+        throw malformedPublishedPage();
+    }
+    if (count !== undefined && (!Number.isSafeInteger(count) || count < 0)) {
+        throw malformedPublishedPage();
+    }
+    const nextCursor = rawCursor === null || rawCursor === undefined ? undefined : rawCursor;
+    if (nextCursor !== undefined && (typeof nextCursor !== 'string' || !nextCursor.trim() || nextCursor.length > PRIVATE_CURSOR_MAX_LENGTH)) {
+        throw malformedPublishedPage();
+    }
+    if (hasMore && nextCursor === undefined)
+        throw malformedPublishedPage();
+    return {
+        assets: assets,
+        ...(count !== undefined ? { count: count } : {}),
+        hasMore,
+        ...(nextCursor !== undefined ? { nextCursor } : {}),
+    };
+}
+function malformedPublishedPage() {
+    return new HubUnreachableError('Private Hub returned a malformed published asset page', {
+        context: `GET ${PRIVATE_PUBLISHED_ASSETS_PATH}`,
+    });
+}
+function normalizePrivateHubBaseUrl(raw, env) {
+    const normalized = raw.trim().replace(/\/+$/, '');
+    assertPrivateCompatibilityUrlSecure(normalized, env);
+    const parsed = new URL(normalized);
+    if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+        throw new Error('Private Hub URL must not contain credentials, query parameters, or a fragment');
+    }
+    return normalized;
+}
+function assertPrivateCompatibilityUrlSecure(url, env) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error('Private Hub URL is invalid');
+    }
+    if (parsed.protocol === 'https:')
+        return;
+    if (parsed.protocol === 'http:' && env['EVOLVER_PRIVATE_ALLOW_INSECURE'] === '1')
+        return;
+    throw new Error('Private Hub URL must use https');
+}
+const globalPrivateCompatibilityFetch = async (url, init) => {
+    const response = await fetch(url, {
+        method: init.method,
+        headers: init.headers,
+        ...(init.body ? { body: init.body } : {}),
+        redirect: 'error',
+    });
+    return { status: response.status, json: () => response.json() };
+};
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}