@hugex/ai 3.4.2 → 3.4.4

package/README.md

@@ -102,6 +102,34 @@ These routes are served by the **agent backend** (typically a deployed tenant Wo
 | `/api/agent/flow/{flowId}/{sessionId}` | JWT / `access_token` query | Tenant chat UIs, Run panel |
 | `/api/ora/connect/{flowId}/{sessionId}` | Agent API key (`authorization` query/header) | Design assistant, tooling |
 
+### HTTP turn — `POST …/message`
+
+Backends that cannot hold a WebSocket run one turn per request and get the result in the response.
+Same routes as above with `/message` appended; `/api/ora/connect/...` takes the Worker's API key in `Authorization`.
+
+```sh
+curl -X POST "https://mtd.hugex.co/api/ora/connect/<flowId>/<uuid>/message" \
+  -H "Authorization: <API key>" -H "Content-Type: application/json" \
+  -d '{"message":"Extrae el paciente de esta captura.","images":[{"mimeType":"image/png","data":"<base64>"}]}'
+```
+
+Body (same attachment shape as the WebSocket `M:` frame):
+
+```ts
+{
+  message: string;                                            // required
+  images?: { mimeType: string; data: string }[];              // png | jpeg | webp | gif
+  documents?: { name: string; mimeType: string; data: string }[];
+  inputs?: Record<string, unknown>;                           // Start node inputs
+  userId?: string;                                            // anonymous session label
+}
+```
+
+- `data` is base64 without the `data:` prefix; a full `data:<mime>;base64,…` URL is accepted and stripped (its mime type fills a missing `mimeType`).
+- Limits: at most 4 images and 4 documents, 8 MB decoded each. Anything malformed or over the limit returns `400 { error }` before the run starts.
+- Attachments only reach the flow when the Start node has `allow_images` / `allow_documents`, and an AI node must list them in `attachments` (for example `["images"]`). Otherwise they are ignored, as in the chat.
+- Response: `{ answer, runId, path, outputs? }`. `outputs` is present when an Answer node maps structured output. Failed turns return `500 { error, runId, path }` and stopped turns `409 { error }`.
+
 ### Pattern 1 — same-origin chat
 
 Frontend and agent server share a domain. No `host` needed. Uses the global store (`useAgentStore`).

package/dist/index.js

@@ -1,8 +1,8 @@
-import{a as k,b as Wn,c as De,d as $e,e as $s,f as He,g as Ls,h as je,i as Fs}from"./chunk-BMZU5UOO.js";import"./chunk-3D77ZXDC.js";import{c as Gn}from"./chunk-62G7NURX.js";import"./chunk-AKJFVR6J.js";import"./chunk-EHOK5FW2.js";import"./chunk-3K4IMMLP.js";import{a as Ks,b as Hs,c as js,d as Ws,e as Gs}from"./chunk-GHMAKIZO.js";import{$ as _n,$a as vs,A as Xr,Aa as ss,B as zr,Ba as os,C as Vr,Ca as as,D as Jr,Da as is,E as Yr,Ea as cs,F as Br,Fa as ls,G as wn,Ga as us,H as Sn,Ha as ds,I as Rn,Ia as ps,J as En,Ja as fs,K as In,Ka as ms,L as be,La as gs,M as F,Ma as ys,N as xn,Na as hs,O as _e,Oa as ws,P as Ue,Pa as Ss,Q as ve,Qa as Rs,R as Oe,Ra as Es,S as Ce,Sa as Is,T as Pe,Ta as xs,U as J,Ua as Ts,V as Ne,Va as ks,W as Me,Wa as As,X as Tn,Xa as bs,Y as kn,Ya as Le,Z as An,Za as _s,_ as bn,_a as Us,a as I,aa as Un,ab as Os,b as ke,ba as vn,bb as Cs,c as Rr,ca as On,cb as Ps,d as P,da as Cn,db as Ns,e as Ae,ea as Pn,eb as Ms,f as Er,fa as Nn,fb as Ds,g as Ir,ga as Mn,gb as Fe,h as xr,ha as Dn,hb as Ke,i as Tr,ia as $n,j as kr,ja as Ln,k as Ar,ka as Fn,l as br,la as Hn,m as _r,ma as jn,n as Ur,na as qn,o as vr,oa as Xn,p as Or,pa as zn,q as Cr,qa as Vn,r as Pr,ra as Jn,s as Nr,sa as Yn,t as Mr,ta as Bn,u as Dr,ua as Zn,v as Hr,va as Qn,w as jr,wa as es,x as Wr,xa as ts,y as Gr,ya as rs,z as qr,za as ns}from"./chunk-G73VSMK7.js";import{A as yn,B as hn,a as L,b as wr,c as xe,d as Sr,e as Te,f as $r,g as Lr,h as Fr,i as Kr,j as Zr,k as Qr,l as en,m as tn,n as rn,o as nn,p as sn,q as on,r as an,s as cn,t as ln,u as un,v as dn,w as pn,x as fn,y as mn,z as gn}from"./chunk-LUS5CJY2.js";import{a as Kn}from"./chunk-HJPR76HF.js";import{a as ur}from"./chunk-RYHQGPX5.js";import{a as dr}from"./chunk-R6EKV3WR.js";import{a as mr}from"./chunk-6HY7QUMP.js";import{a as pr,b as fr}from"./chunk-V6JSMX5A.js";import{a as hr}from"./chunk-Q7QHJJGR.js";import{a as U,b as C,c as gr,d as yr}from"./chunk-YLDLDEUP.js";import{a as Ie}from"./chunk-U56YWPSI.js";import"./chunk-YHXUBVN2.js";import"./chunk-3TXHFKDN.js";import{Agent as rt}from"agents";import{nanoid as Gt}from"nanoid";async function Et(t){t.sql`CREATE TABLE IF NOT EXISTS messages (id TEXT PRIMARY KEY, role TEXT NOT NULL, type TEXT NOT NULL, content TEXT NOT NULL, ts INTEGER NOT NULL)`}async function We(t,e){t.sql`INSERT INTO messages (id, role, type, content, ts) VALUES (${e.id}, ${e.role}, ${e.type}, ${e.content}, ${e.ts})`}async function v(t){return t.sql`SELECT id, role, type, content, ts FROM messages ORDER BY ts ASC`}async function K(t){t.sql`DELETE FROM messages`}async function Ge(t){await Et(t)}function Y(t){return{"Content-Type":"application/json",Authorization:t.HX_API_KEY}}function H(t){return!!(t!=null&&t.HX_ORA_URL)&&!!(t!=null&&t.HX_API_KEY)}var It="anonymous:";function qe(t,e){return(t==null?void 0:t.trim())||`${It}${e}`}async function B(t,e){if(!H(t))return null;let n=await fetch(`${t.HX_ORA_URL}/internal/runs`,{method:"POST",headers:Y(t),body:JSON.stringify(e)});return n.ok?await n.json():(console.error("[oraTriggers] createRun failed",n.status,await n.text().catch(()=>"")),null)}async function N(t,e){if(!H(t))return{claimed:!0};let n=await fetch(`${t.HX_ORA_URL}/internal/runs/${encodeURIComponent(e)}/claim`,{method:"POST",headers:Y(t)});if(!n.ok){let r=await n.text().catch(()=>"");throw new Error(`claimRun ${e} failed with ${n.status}: ${r}`)}return await n.json()}async function j(t,e,n,r=3){if(!H(t))return!0;for(let s=1;s<=r;s++){try{let a=await fetch(`${t.HX_ORA_URL}/internal/runs/${encodeURIComponent(e)}/complete`,{method:"POST",headers:Y(t),body:JSON.stringify(n)});if(a.ok||a.status===409)return!0;if(a.status===404)return console.error(`[oraTriggers] completeRun ${e} rejected with 404`),!1;console.warn(`[oraTriggers] completeRun ${e} attempt ${s} failed with ${a.status}`)}catch(a){console.warn(`[oraTriggers] completeRun ${e} attempt ${s} threw`,a)}s<r&&await new Promise(a=>setTimeout(a,250*s))}return console.error(`[oraTriggers] completeRun ${e} exhausted ${r} attempts; hx-ora will time the run out`),!1}async function Xe(t,e){if(!H(t))return Promise.resolve();try{return await B(t,e)}catch(n){return console.error("[oraTriggers] recordRun failed",n),null}}var Z=Object.freeze({}),xt="__SYSTEM_";function Q(t){return t.startsWith(xt)}function Tt(t){let e={};for(let[n,r]of Object.entries(t))Q(n)||(e[n]=r);return Object.freeze(e)}function W(t){return(typeof t=="string"?t.trim():"")||"default"}async function ze(t,e,n){if(!e)return Z;let r=W(n);if(t.HX_ORA_URL&&t.HX_API_KEY)try{let a=new URL(`${t.HX_ORA_URL.replace(/\/$/,"")}/internal/secrets`);a.searchParams.set("org",r);let o=await fetch(a,{headers:{Authorization:t.HX_API_KEY}});if(o.ok){let i=await o.json();if(i.secrets)return Tt(i.secrets)}else console.warn(`[secrets] API failed with status ${o.status}, falling back to KV`)}catch(a){console.error("[secrets] API request failed, falling back to KV",a)}let s=t.ORA_SECRETS;if(!s)return Z;try{let a={};return await kt(s,`${e}:${r}:`,a),r==="default"&&await At(s,e,a),Object.freeze(a)}catch(a){return console.error("[secrets] failed to load tenant secrets from KV",{tenant:e,org:r,err:a}),Z}}async function kt(t,e,n){let r=await t.list({prefix:e,limit:1e3});r.list_complete===!1&&console.warn(`[secrets] prefix=${e} exceeded list page; truncating to first 1000 keys`);let s=r.keys.filter(o=>{let i=o.name.slice(e.length);return i.length>0&&!i.includes(":")&&!Q(i)}),a=await Promise.all(s.map(async o=>{let i=await t.get(o.name);return i!==null?[o.name.slice(e.length),i]:null}));for(let o of a){if(!o)continue;let[i,c]=o;i&&(n[i]=c)}}async function At(t,e,n){let r=`${e}:`,s=await t.list({prefix:r,limit:1e3});s.list_complete===!1&&console.warn(`[secrets] tenant=${e} legacy secrets exceeded list page; truncating to first 1000 keys`);let a=s.keys.filter(i=>{let c=i.name.slice(r.length);return c.length>0&&!c.includes(":")&&!Q(c)}),o=await Promise.all(a.map(async i=>{let c=i.name.slice(r.length);if(c in n)return null;let l=await t.get(i.name);return l!==null?[c,l]:null}));for(let i of o){if(!i)continue;let[c,l]=i;c&&(n[c]=l)}}function G(t){var s;let e=((s=t==null?void 0:t.flowData)==null?void 0:s.state)??(t==null?void 0:t.flowData),r=((e==null?void 0:e.nodes)??[]).find(a=>a.type==="startNode");return r==null?void 0:r.data}import{nanoid as Kt}from"nanoid";import{streamText as bt}from"ai";var _t={short:`Up to ${F("short")} markdown lines (one fact or bullet per line). Keep constraints, working agreements, and the outline of anything already settled.`,medium:`Up to ${F("medium")} markdown lines. Group bullets by whatever this session is about (actors, constraints, decisions, current plan/state, open work). Under-remembering is worse than a few extra lines.`,long:`Up to ${F("long")} markdown lines. Same as medium, with one-line context on a decision or plan block when later turns will need it.`},Ut=12,vt=400,Ve=700;function Ot(t,e=Ut){let n=t.filter(s=>s.role==="user"||s.role==="assistant").slice(-e),r=[];for(let s of n){let a=typeof s.content=="string"?s.content:JSON.stringify(s.content??""),o=s.role==="assistant"?Ve:vt,i=a.trim().replace(/\s+/g," ").slice(0,o);i&&r.push(`${s.role==="user"?"U":"A"}: ${i}`)}return r.join(`
-`)}function Ct(t){let e=t??{},n=e.promptTokens??e.inputTokens??0,r=e.completionTokens??e.outputTokens??0,s=e.totalTokens??n+r;return{promptTokens:n,completionTokens:r,totalTokens:s}}function Pt(t){var e;for(let n=t.length-1;n>=0;n--)if(((e=t[n])==null?void 0:e.role)==="assistant"&&typeof t[n].content=="string")return t[n].content;return""}function Nt(t){var s,a;let e=((s=t.flowData)==null?void 0:s.state)??t.flowData,n=(e==null?void 0:e.nodes)??[],r=[];for(let o of n){if(o.type!=="answerNode")continue;let i=(a=t.results)==null?void 0:a[o.id];i!=null&&r.push(typeof i=="string"?i:JSON.stringify(i))}return r.join(`
-`)}function Mt(t){var r;let e=["You maintain a KEYPOINT memory for one agent session so later turns can continue without re-asking.",`Hard limit: ${t.maxTokens} tokens.`,_t[t.length],"The session domain is unknown: personal, operational, technical, or mixed. Do not assume a personal-coaching frame.","Store facts that will still matter: who/what is in play, constraints and invariants, preferences, decisions, current state of the work, and the outline of anything the user accepted or asked to keep.","When something was confirmed (a plan, a process, a design, a sequence), keep a compact outline \u2014 enough to resume the next part \u2014 not the assistant\u2019s full wording.","Keep earlier facts unless the user superseded them. Merge, update, dedupe. Do not collapse memory to a single identity line plus one decision.","Never copy the conversation. Never write User:/Assistant:/U:/A: lines. Drop greetings, filler, and unanswered assistant questions.","If this turn added nothing durable, return the current memory unchanged.","If memory is empty and nothing durable happened, return exactly: (none)","Use the same language as the user. Return only the bullet list \u2014 no preamble."].join(" "),n=["Current keypoint memory:",'"""',t.previous.trim()||"(empty)",'"""',"","Recent session (for extraction only; do not transcribe):",'"""',((r=t.recentTurns)==null?void 0:r.trim())||"(none)",'"""',"","This turn:",`User said: ${t.userText.trim()||"(empty)"}`,t.assistantText.trim()?`Latest assistant reply (extract accepted plan/facts only): ${t.assistantText.trim().slice(0,Ve)}`:"",t.answers.trim()?`Answer outputs:
+import{a as k,b as ts,c as Le,d as Fe,e as Js,f as We,g as Ys,h as Ge,i as Bs}from"./chunk-BMZU5UOO.js";import"./chunk-3D77ZXDC.js";import{c as ns}from"./chunk-62G7NURX.js";import"./chunk-AKJFVR6J.js";import"./chunk-EHOK5FW2.js";import"./chunk-3K4IMMLP.js";import{a as Zs,b as Qs,c as eo,d as to,e as no}from"./chunk-GHMAKIZO.js";import{$ as jr,$a as Ks,A as or,Aa as ys,B as ar,Ba as hs,C as ir,Ca as ws,D as cr,Da as Ss,E as ur,Ea as Rs,F as lr,Fa as Es,G as Or,Ga as Ts,H as Pr,Ha as Is,I as vr,Ia as xs,J as Mr,Ja as As,K as Cr,Ka as ks,L as Ue,La as bs,M as j,Ma as _s,N as Nr,Na as Us,O as Oe,Oa as Os,P as Pe,Pa as Ps,Q as ve,Qa as vs,R as Me,Ra as Ms,S as Ce,Sa as Cs,T as Ne,Ta as Ns,U as Y,Ua as Ds,V as De,Va as $s,W as $e,Wa as Ls,X as Dr,Xa as Fs,Y as $r,Ya as je,Z as Lr,Za as js,_ as Fr,_a as Hs,a as T,aa as Hr,ab as Ws,b as be,ba as Kr,bb as Gs,c as Mn,ca as Wr,cb as Xs,d as M,da as Gr,db as qs,e as _e,ea as Xr,eb as zs,f as Cn,fa as qr,fb as Vs,g as Nn,ga as zr,gb as He,h as Dn,ha as Vr,hb as Ke,i as $n,ia as Jr,j as Ln,ja as Yr,k as Fn,ka as Br,l as jn,la as Qr,m as Hn,ma as es,n as Kn,na as rs,o as Wn,oa as ss,p as Gn,pa as os,q as Xn,qa as as,r as qn,ra as is,s as zn,sa as cs,t as Vn,ta as us,u as Jn,ua as ls,v as er,va as ds,w as tr,wa as ms,x as nr,xa as ps,y as rr,ya as fs,z as sr,za as gs}from"./chunk-G73VSMK7.js";import{A as _r,B as Ur,a as F,b as Pn,c as Ae,d as vn,e as ke,f as Yn,g as Bn,h as Zn,i as Qn,j as dr,k as mr,l as pr,m as fr,n as gr,o as yr,p as hr,q as wr,r as Sr,s as Rr,t as Er,u as Tr,v as Ir,w as xr,x as Ar,y as kr,z as br}from"./chunk-LUS5CJY2.js";import{a as Zr}from"./chunk-HJPR76HF.js";import{a as In}from"./chunk-RYHQGPX5.js";import{a as xn}from"./chunk-R6EKV3WR.js";import{a as bn}from"./chunk-6HY7QUMP.js";import{a as An,b as kn}from"./chunk-V6JSMX5A.js";import{a as On}from"./chunk-Q7QHJJGR.js";import{a as U,b as v,c as _n,d as Un}from"./chunk-YLDLDEUP.js";import{a as xe}from"./chunk-U56YWPSI.js";import"./chunk-YHXUBVN2.js";import"./chunk-3TXHFKDN.js";import{Agent as ut}from"agents";import{nanoid as nn}from"nanoid";async function _t(t){t.sql`CREATE TABLE IF NOT EXISTS messages (id TEXT PRIMARY KEY, role TEXT NOT NULL, type TEXT NOT NULL, content TEXT NOT NULL, ts INTEGER NOT NULL)`}async function Xe(t,e){t.sql`INSERT INTO messages (id, role, type, content, ts) VALUES (${e.id}, ${e.role}, ${e.type}, ${e.content}, ${e.ts})`}async function O(t){return t.sql`SELECT id, role, type, content, ts FROM messages ORDER BY ts ASC`}async function H(t){t.sql`DELETE FROM messages`}async function qe(t){await _t(t)}function B(t){return{"Content-Type":"application/json",Authorization:t.HX_API_KEY}}function K(t){return!!(t!=null&&t.HX_ORA_URL)&&!!(t!=null&&t.HX_API_KEY)}var Ut="anonymous:";function ze(t,e){return(t==null?void 0:t.trim())||`${Ut}${e}`}async function Z(t,e){if(!K(t))return null;let r=await fetch(`${t.HX_ORA_URL}/internal/runs`,{method:"POST",headers:B(t),body:JSON.stringify(e)});return r.ok?await r.json():(console.error("[oraTriggers] createRun failed",r.status,await r.text().catch(()=>"")),null)}async function C(t,e){if(!K(t))return{claimed:!0};let r=await fetch(`${t.HX_ORA_URL}/internal/runs/${encodeURIComponent(e)}/claim`,{method:"POST",headers:B(t)});if(!r.ok){let n=await r.text().catch(()=>"");throw new Error(`claimRun ${e} failed with ${r.status}: ${n}`)}return await r.json()}async function W(t,e,r,n=3){if(!K(t))return!0;for(let s=1;s<=n;s++){try{let a=await fetch(`${t.HX_ORA_URL}/internal/runs/${encodeURIComponent(e)}/complete`,{method:"POST",headers:B(t),body:JSON.stringify(r)});if(a.ok||a.status===409)return!0;if(a.status===404)return console.error(`[oraTriggers] completeRun ${e} rejected with 404`),!1;console.warn(`[oraTriggers] completeRun ${e} attempt ${s} failed with ${a.status}`)}catch(a){console.warn(`[oraTriggers] completeRun ${e} attempt ${s} threw`,a)}s<n&&await new Promise(a=>setTimeout(a,250*s))}return console.error(`[oraTriggers] completeRun ${e} exhausted ${n} attempts; hx-ora will time the run out`),!1}async function Ve(t,e){if(!K(t))return Promise.resolve();try{return await Z(t,e)}catch(r){return console.error("[oraTriggers] recordRun failed",r),null}}var Q=Object.freeze({}),Ot="__SYSTEM_";function ee(t){return t.startsWith(Ot)}function Pt(t){let e={};for(let[r,n]of Object.entries(t))ee(r)||(e[r]=n);return Object.freeze(e)}function G(t){return(typeof t=="string"?t.trim():"")||"default"}async function Je(t,e,r){if(!e)return Q;let n=G(r);if(t.HX_ORA_URL&&t.HX_API_KEY)try{let a=new URL(`${t.HX_ORA_URL.replace(/\/$/,"")}/internal/secrets`);a.searchParams.set("org",n);let o=await fetch(a,{headers:{Authorization:t.HX_API_KEY}});if(o.ok){let i=await o.json();if(i.secrets)return Pt(i.secrets)}else console.warn(`[secrets] API failed with status ${o.status}, falling back to KV`)}catch(a){console.error("[secrets] API request failed, falling back to KV",a)}let s=t.ORA_SECRETS;if(!s)return Q;try{let a={};return await vt(s,`${e}:${n}:`,a),n==="default"&&await Mt(s,e,a),Object.freeze(a)}catch(a){return console.error("[secrets] failed to load tenant secrets from KV",{tenant:e,org:n,err:a}),Q}}async function vt(t,e,r){let n=await t.list({prefix:e,limit:1e3});n.list_complete===!1&&console.warn(`[secrets] prefix=${e} exceeded list page; truncating to first 1000 keys`);let s=n.keys.filter(o=>{let i=o.name.slice(e.length);return i.length>0&&!i.includes(":")&&!ee(i)}),a=await Promise.all(s.map(async o=>{let i=await t.get(o.name);return i!==null?[o.name.slice(e.length),i]:null}));for(let o of a){if(!o)continue;let[i,c]=o;i&&(r[i]=c)}}async function Mt(t,e,r){let n=`${e}:`,s=await t.list({prefix:n,limit:1e3});s.list_complete===!1&&console.warn(`[secrets] tenant=${e} legacy secrets exceeded list page; truncating to first 1000 keys`);let a=s.keys.filter(i=>{let c=i.name.slice(n.length);return c.length>0&&!c.includes(":")&&!ee(c)}),o=await Promise.all(a.map(async i=>{let c=i.name.slice(n.length);if(c in r)return null;let u=await t.get(i.name);return u!==null?[c,u]:null}));for(let i of o){if(!i)continue;let[c,u]=i;c&&(r[c]=u)}}function X(t){var s;let e=((s=t==null?void 0:t.flowData)==null?void 0:s.state)??(t==null?void 0:t.flowData),n=((e==null?void 0:e.nodes)??[]).find(a=>a.type==="startNode");return n==null?void 0:n.data}import{nanoid as Zt}from"nanoid";import{streamText as Ct}from"ai";var Nt={short:`Up to ${j("short")} markdown lines (one fact or bullet per line). Keep constraints, working agreements, and the outline of anything already settled.`,medium:`Up to ${j("medium")} markdown lines. Group bullets by whatever this session is about (actors, constraints, decisions, current plan/state, open work). Under-remembering is worse than a few extra lines.`,long:`Up to ${j("long")} markdown lines. Same as medium, with one-line context on a decision or plan block when later turns will need it.`},Dt=12,$t=400,Ye=700;function Lt(t,e=Dt){let r=t.filter(s=>s.role==="user"||s.role==="assistant").slice(-e),n=[];for(let s of r){let a=typeof s.content=="string"?s.content:JSON.stringify(s.content??""),o=s.role==="assistant"?Ye:$t,i=a.trim().replace(/\s+/g," ").slice(0,o);i&&n.push(`${s.role==="user"?"U":"A"}: ${i}`)}return n.join(`
+`)}function Ft(t){let e=t??{},r=e.promptTokens??e.inputTokens??0,n=e.completionTokens??e.outputTokens??0,s=e.totalTokens??r+n;return{promptTokens:r,completionTokens:n,totalTokens:s}}function jt(t){var e;for(let r=t.length-1;r>=0;r--)if(((e=t[r])==null?void 0:e.role)==="assistant"&&typeof t[r].content=="string")return t[r].content;return""}function Ht(t){var s,a;let e=((s=t.flowData)==null?void 0:s.state)??t.flowData,r=(e==null?void 0:e.nodes)??[],n=[];for(let o of r){if(o.type!=="answerNode")continue;let i=(a=t.results)==null?void 0:a[o.id];i!=null&&n.push(typeof i=="string"?i:JSON.stringify(i))}return n.join(`
+`)}function Kt(t){var n;let e=["You maintain a KEYPOINT memory for one agent session so later turns can continue without re-asking.",`Hard limit: ${t.maxTokens} tokens.`,Nt[t.length],"The session domain is unknown: personal, operational, technical, or mixed. Do not assume a personal-coaching frame.","Store facts that will still matter: who/what is in play, constraints and invariants, preferences, decisions, current state of the work, and the outline of anything the user accepted or asked to keep.","When something was confirmed (a plan, a process, a design, a sequence), keep a compact outline \u2014 enough to resume the next part \u2014 not the assistant\u2019s full wording.","Keep earlier facts unless the user superseded them. Merge, update, dedupe. Do not collapse memory to a single identity line plus one decision.","Never copy the conversation. Never write User:/Assistant:/U:/A: lines. Drop greetings, filler, and unanswered assistant questions.","If this turn added nothing durable, return the current memory unchanged.","If memory is empty and nothing durable happened, return exactly: (none)","Use the same language as the user. Return only the bullet list \u2014 no preamble."].join(" "),r=["Current keypoint memory:",'"""',t.previous.trim()||"(empty)",'"""',"","Recent session (for extraction only; do not transcribe):",'"""',((n=t.recentTurns)==null?void 0:n.trim())||"(none)",'"""',"","This turn:",`User said: ${t.userText.trim()||"(empty)"}`,t.assistantText.trim()?`Latest assistant reply (extract accepted plan/facts only): ${t.assistantText.trim().slice(0,Ye)}`:"",t.answers.trim()?`Answer outputs:
 ${t.answers.trim()}`:""].filter(Boolean).join(`
-`);return{system:e,user:n}}function Dt(t){return Me(t.previous,Ne(t.userText),t.maxTokens)}async function $t(t){let e="",n;for await(let r of t.fullStream)r.type==="text-delta"&&(e+=r.text??r.delta??""),r.type==="error"&&(n=r.error instanceof Error?r.error.message:String(r.error??"stream error"));return{text:e.trim(),error:n}}async function Lt(t){if(t.fullStream&&typeof t.fullStream[Symbol.asyncIterator]=="function")return $t({fullStream:t.fullStream});try{return{text:((typeof t.text=="string"?t.text:await t.text)||"").trim()}}catch(e){return{text:"",error:e instanceof Error?e.message:String(e)}}}async function Je(t){var l;let e=G(t.engineState);if(!e)return{status:"skipped",reason:"start_node_missing"};if(!Ue(e))return{status:"skipped",reason:"memory_disabled"};let n=Oe(e),r=be(n),s=ve(e),a=J(t.previousContent||""),o=Pt(t.messages),i=Nt(t.engineState),c=u=>{let m=Dt({previous:a,userText:t.userText,maxTokens:r});return{status:"written",content:m,truncated:!1,modelId:s,fallback:!0,error:m?void 0:u}};try{let u=await He(s,t.sessionEnv,{maxOutputTokens:r});if(!u)throw new Error(`Memory model '${s}' not found in registry`);let m=Ce(n,(l=u.reasoning)==null?void 0:l.kind),{system:f,user:p}=Mt({previous:a,userText:t.userText,assistantText:o,answers:i,length:n,maxTokens:r,recentTurns:Ot(t.messages)}),g=Fe(u.reasoning),y=Ke(u.provider,{effort:g,exposeReasoning:!1,maxTokens:m}),w=bt({model:u.modelHandle,system:f,messages:[{role:"user",content:p}],...Le({...u.effectiveParams??{},maxOutputTokens:m}),...y?{providerOptions:y}:{}}),S=await Lt(w),R=Ct(await w.usage),b=J(S.text);if(Pe(b)&&(b=""),!b)return{...c(S.error||"Memory model returned empty text"),usage:R};let x=_e(b,r);return{status:"written",content:x.content,truncated:x.truncated,usage:R,modelId:s}}catch(u){let m=u instanceof Error?u.message:"Memory update failed";return console.error("Memory update failed:",u),c(m)}}async function Ye(t,e){var r,s;let n=(r=e==null?void 0:e.flowData)==null?void 0:r.flowId;if(!(t!=null&&t.HX_CORE_URL)||!n)return{engineState:e,refreshed:!1};try{let a=await C(n,t),o={...e,flowData:{...a,tenant:e.flowData.tenant,flowId:n,chatId:e.flowData.chatId}},i=a==null?void 0:a.stateVersion,c=typeof i=="number"&&i!==((s=e.flowData)==null?void 0:s.stateVersion);return{engineState:o,refreshed:c}}catch(a){return console.error(`[flowRefresh] fetch failed for flow ${n}:`,a),{engineState:e,refreshed:!1}}}function Ft(t,e){let n=[],r=s=>{if(s)for(let[a,o]of Object.entries(s))typeof o=="string"&&o.length>=8&&n.push({name:a,value:o})};return r(t),r(e),n.sort((s,a)=>a.value.length-s.value.length),n}function Be(t,e){let n=t;for(let r of e)n.includes(r.value)&&(n=n.split(r.value).join(`[redacted:${r.name}]`));return n}function ee(t,e){if(typeof t=="string")return Be(t,e);if(Array.isArray(t))return t.map(n=>ee(n,e));if(t!==null&&typeof t=="object"){let n={};for(let[r,s]of Object.entries(t))n[Be(r,e)]=ee(s,e);return n}return t}function te(t,e,n){let r=Ft(e,n);return r.length===0?t:ee(t,r)}function Ze(t,e){return!t||!t.HX_ORA_URL||!t.HX_API_KEY?Promise.resolve():fetch(`${t.HX_ORA_URL}/internal/sessions`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:t.HX_API_KEY},body:JSON.stringify(e)}).catch(n=>{console.error("[sessionIndex] failed to index session",n)})}var Qe=async(t,e)=>{fetch(`${e.DW_URL}/q/telemetry/event`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)}),`${JSON.stringify(t)}`};async function M(t,e){var a;let n=t.id||t.name||"",[r,s]=String(n).split("::");if(!r||!s)return null;try{let i=(a=(await U(r,e)).metadata)==null?void 0:a.tenant,l={flowData:{...await C(r,e),tenant:i,flowId:r,chatId:s},executedNodes:[],context:{}};return t.setState({...t.state,engineState:l}),l}catch(o){return console.error("Failed to initialize engine state:",o),null}}async function Ht(t,e,n){var r;if(e&&t.HX_CORE_URL&&t.HX_API_KEY)try{let s=await U(e,t),a=(r=s==null?void 0:s.metadata)==null?void 0:r.org;if(typeof a=="string"&&a.trim())return W(a)}catch(s){console.warn(`[secrets] could not read org for flow ${e}`,s)}return W(n)}async function D(t){var ae,ie,ce,le,ue,de,pe,fe,me,ge,ye;let{agent:e,env:n,ctx:r,payload:s,connection:a}=t,o=Date.now(),i=[],c=t.runId?De():void 0,l=async()=>await v(e),u=async d=>{await We(e,d)},m=async d=>{if(e.state.modelsCache&&e.state.modelsCache[d])return e.state.modelsCache[d];try{let{fetchOraModel:h}=await import("./oraApi-YIJGMXX7.js"),T=await h(d,n);return e.setState({...e.state,modelsCache:{...e.state.modelsCache||{},[d]:T}}),T}catch(h){throw console.error(`Error fetching model ${d}:`,h),h}},f={id:Kt(),role:"user",type:"text",content:s.text,images:s.images,ts:Date.now()};await u(f);let p={onChangeState:d=>{e.setState({...e.state,engineState:d})},onServerEvent:async d=>{var h;await((h=t.onServerEvent)==null?void 0:h.call(t,d)),i.push(d)},onTelemetry:async d=>{var _,he,we,Se,Re,Ee;let h=t.user,T=typeof(h==null?void 0:h.org)=="string"&&h.org.trim()?h.org.trim():"default";await Qe({...d,userId:t.resolveUserId(),tenant:((he=(_=e.state.engineState)==null?void 0:_.flowData)==null?void 0:he.tenant)||"",org:T,flowId:((Se=(we=e.state.engineState)==null?void 0:we.flowData)==null?void 0:Se.flowId)||"",sessionId:((Ee=(Re=e.state.engineState)==null?void 0:Re.flowData)==null?void 0:Ee.chatId)||""},n)},onError:d=>{var h;(h=t.onError)==null||h.call(t,d),e.setState({...e.state,error:d})},shouldStop:t.shouldStop},g=e.state.engineState?{...e.state.engineState}:null;if(g){let{engineState:d,refreshed:h}=await Ye(n,g);g=d,h&&e.setState({...e.state,engineState:g,modelsCache:{}})}else if(g=await M(e,n),!g){let d="Failed to initialize agent";return p.onError(d),{status:"failed",error:d,path:[]}}let y=t.user??void 0,w=(ae=g.flowData)==null?void 0:ae.tenant,S=await Ht(n,(ie=g.flowData)==null?void 0:ie.flowId,y==null?void 0:y.org),R=w?await ze(n,w,S):{};(ce=t.onSecretsLoaded)==null||ce.call(t,R),g={...g,context:{...g.context||{},user:y}},e.setState({...e.state,user:y,engineState:g});let b={env:n,ctx:r,conn:a,getMessages:l,setMessages:u,getOraModel:m,secrets:R,userAuth:t.userAuth,user:y,composioSessions:t.composioSessions,publicOrigin:t.publicOrigin,skillRefCache:t.skillRefCache,runId:t.runId,outputCollector:c,agentMemory:typeof((le=e.state.memory)==null?void 0:le.content)=="string"?e.state.memory.content:"",shouldStop:t.shouldStop,workerStack:(ue=g.flowData)!=null&&ue.flowId?[g.flowData.flowId]:[],workerCalls:{count:0}},x=await je(b,g,p)(s),E=e.state.engineState??g;if(x.status==="completed")try{let d=await Je({sessionEnv:b,engineState:E,previousContent:typeof((de=e.state.memory)==null?void 0:de.content)=="string"?e.state.memory.content:"",userText:s.text||"",messages:await l()});if(d.status==="skipped")await p.onServerEvent({type:"agent:memory",content:{skipped:!0,reason:d.reason},timestamp:Date.now()});else if(!d.content.trim())await p.onServerEvent({type:"agent:memory",content:{updated:!1,empty:!0,error:d.error,fallback:d.fallback},timestamp:Date.now()});else{let h={promptTokens:((pe=E.tokenUsage)==null?void 0:pe.promptTokens)??0,completionTokens:((fe=E.tokenUsage)==null?void 0:fe.completionTokens)??0,totalTokens:((me=E.tokenUsage)==null?void 0:me.totalTokens)??0};d.usage&&(h.promptTokens+=d.usage.promptTokens,h.completionTokens+=d.usage.completionTokens,h.totalTokens+=d.usage.totalTokens),E={...E,tokenUsage:h},e.setState({...e.state,engineState:E,memory:{content:d.content,updatedTs:Date.now(),...d.error?{lastError:d.error}:{},...d.fallback?{fallback:!0}:{}}}),await p.onTelemetry({type:"memory_update",payload:{model:d.modelId,truncated:d.truncated,usage:d.usage,fallback:d.fallback,error:d.error}}),await p.onServerEvent({type:"agent:memory",content:{updated:!0,truncated:d.truncated,fallback:d.fallback,error:d.error},timestamp:Date.now()})}}catch(d){let h=d instanceof Error?d.message:"Memory update failed";console.error("Memory update failed:",d),await p.onServerEvent({type:"agent:memory",content:{error:h},timestamp:Date.now()})}if(x.status==="completed"&&t.runId&&(c!=null&&c.hasOutputs())){let{flowId:d,chatId:h}=E.flowData??{};if(!d||!h)x={status:"failed",error:"Structured output persistence requires flowId and sessionId"};else try{await $e(n,{flowId:d,sessionId:h,runId:t.runId,createdAt:new Date(o).toISOString(),data:c.snapshotData(),answerNodeIds:c.answerNodeIds()});let T={...E.results||{}};for(let _ of c.answerNodeIds())T[_]={...T[_]||{},persisted:!0,runId:t.runId};E={...E,results:T},e.setState({...e.state,engineState:E})}catch(T){let _=T instanceof Error?T.message:"Structured output persistence failed";p.onError(_),await p.onServerEvent({type:"error:answer-output",content:{runId:t.runId,error:_},timestamp:Date.now()}),x={status:"failed",error:_}}}let{tenant:$,flowId:z,chatId:V}=E.flowData??{},wt=(ge=E.flowData)==null?void 0:ge.org;$&&z&&V&&r.waitUntil(Ze(n,{id:`${z}::${V}`,tenant:$,org:wt,flowId:z,sessionId:V,userId:t.resolveUserId(),title:(ye=s.text)==null?void 0:ye.slice(0,120),turnTs:o,events:i})),e.setState({...e.state,lastUpdated:new Date});let St=(E.executedNodes??[]).flatMap(d=>typeof(d==null?void 0:d.id)=="string"?[d.id]:[]),Rt=typeof x.error=="string"?te(x.error,R,t.userAuth):x.error,oe=c!=null&&c.hasOutputs()?te(c.snapshotData(),R,t.userAuth):void 0;return{status:x.status,error:Rt,engineState:E,path:St,...oe!==void 0?{outputs:oe}:{}}}import{nanoid as jt}from"nanoid";function Wt(t){let e=t.headers.get("X-User-Payload");if(!e)return null;try{let n=JSON.parse(e),r=typeof(n==null?void 0:n.email)=="string"?P(n.email):null;return r?{...n,email:r}:null}catch{return null}}async function et(t,e,n,r){var s;try{let a=await e.json(),o=a.message;if(!o||typeof o!="string")return new Response(JSON.stringify({error:"Invalid message"}),{status:400,headers:{"content-type":"application/json"}});let i=typeof a.userId=="string"?P(a.userId):null,c=Wt(e),l=c==null?void 0:c.email;c?t.setState({...t.state,user:c,injectedUserId:l}):i&&!((s=t.state.user)!=null&&s.email)&&t.setState({...t.state,injectedUserId:i});let u=()=>l??i??t.state.injectedUserId??void 0;t.skillRefCache||(t.skillRefCache=new Map);let m=a.inputs&&typeof a.inputs=="object"?a.inputs:void 0;if(!t.state.engineState&&!await M(t,n))return new Response(JSON.stringify({error:"Failed to initialize agent"}),{status:500,headers:{"content-type":"application/json"}});let f=`run-${jt(12)}`;await t.registerManualRun(f,o,u()),await N(n,f).catch(w=>{console.warn(`[AgentHTTP] could not mark manual run ${f} as running`,w)});let p;try{p=await D({agent:t,env:n,ctx:r,payload:{text:o,inputs:m},skillRefCache:t.skillRefCache,user:c??void 0,resolveUserId:u,runId:f,shouldStop:()=>t.isRunStopRequested(f)}),r.waitUntil(t.completeManualRun(f,p.status==="completed"?"succeeded":p.status==="stopped"?"skipped":"failed",p.error))}finally{await t.clearRunStopRequest(f)}if(p.status==="failed")return new Response(JSON.stringify({error:p.error||"Agent execution failed",runId:f,path:p.path??[]}),{status:500,headers:{"content-type":"application/json"}});if(p.status==="stopped")return new Response(JSON.stringify({error:p.error||"Stopped by user"}),{status:409,headers:{"content-type":"application/json"}});let y=(await v(t)).reverse().find(w=>w.role==="assistant");return new Response(JSON.stringify({answer:(y==null?void 0:y.content)||"",runId:f,path:p.path??[],...p.outputs!==void 0?{outputs:p.outputs}:{}}),{headers:{"content-type":"application/json"}})}catch(a){return new Response(JSON.stringify({error:a.message}),{status:500,headers:{"content-type":"application/json"}})}}async function tt(t){try{return await K(t),t.skillRefCache&&t.skillRefCache.clear(),t.setState({...t.state,error:"",engineState:void 0,modelsCache:{},lastUpdated:new Date}),new Response(JSON.stringify({success:!0,messages:[]}),{headers:{"content-type":"application/json"}})}catch(e){return new Response(JSON.stringify({error:e.message}),{status:500,headers:{"content-type":"application/json"}})}}var nt="trigger:nonce:",qt=900*1e3,re="run:stop:",st=class extends rt{initialState={user:void 0,injectedUserId:null,sessionId:null,lastUpdated:null,modelsCache:{},memory:void 0};constructor(e,n){super(e,n),this.requireStateValidation()}validateStateChange(e,n){if(n!=="server")throw new Error("Client state updates are forbidden")}requireStateValidation(){if(typeof rt.prototype.validateStateChange!="function")throw new Error("AgentDO requires agents >= 0.8.7 with validateStateChange; upgrade the tenant SDK")}resolveSessionUserId(){return this.state.injectedUserId??void 0}secrets=Object.freeze({});userAuth={};composioSessions={};skillRefCache=new Map;publicOrigin;async inspectPersistedSession(e){return e==="state"?{state:this.state}:e==="memory"?{memory:this.state.memory??null}:{messages:await v(this)}}async requestRunStop(e){return e!=null&&e.trim()?(await this.ctx.storage.put(`${re}${e}`,Date.now()),{accepted:!0}):{accepted:!1}}async isRunStopRequested(e){return!!await this.ctx.storage.get(`${re}${e}`)}async clearRunStopRequest(e){await this.ctx.storage.delete(`${re}${e}`)}async onRequest(e){this.requireStateValidation();let n=new URL(e.url);if(n.pathname.endsWith("/state"))return new Response(JSON.stringify(this.state),{headers:{"content-type":"application/json"}});if(n.pathname.endsWith("/history")){let r=await v(this);return new Response(JSON.stringify(r),{headers:{"content-type":"application/json"}})}return e.method==="POST"&&n.pathname.endsWith("/message")?et(this,e,this.env,this.ctx):e.method==="DELETE"&&n.pathname.endsWith("/clear")?tt(this):new Response("Ready to assist.")}async onConnect(e,n){var f,p,g,y,w;this.requireStateValidation();let[r,s]=e.server.split("::"),o=(f=(await U(r,this.env)).metadata)==null?void 0:f.tenant;this.userAuth={},this.composioSessions={},this.publicOrigin=void 0;let i=null;if(n.request){try{this.publicOrigin=new URL(n.request.url).origin}catch{}let S=n.request.headers.get("X-User-Payload");if(S)try{i=JSON.parse(S)}catch(R){console.warn("Failed to parse X-User-Payload",R)}}e.setState({...e.state,authorizedUser:i});let c=await C(r,this.env);this.setState({...this.state,user:i||null,sessionId:s,engineState:{flowData:{...c,tenant:o,flowId:r,chatId:s},executedNodes:[],context:i?{user:i}:{}}}),i||console.warn("[AgentDO] WebSocket connected without authenticated user \u2014 Composio manual auth requires login (access_token on socket URL)");let l=await v(this);k(e,I.SERVER_HISTORY,JSON.stringify({messages:l}));let m=(((p=c==null?void 0:c.state)==null?void 0:p.nodes)??(c==null?void 0:c.nodes)??[]).find(S=>S.type==="startNode");if(m){let S={allow_images:((g=m.data)==null?void 0:g.allow_images)??!1,allow_documents:((y=m.data)==null?void 0:y.allow_documents)??!1,greeting:(w=m.data)==null?void 0:w.greeting};k(e,I.SERVER_CONFIG,JSON.stringify(S))}}async onMessage(e,n){if(typeof n!="string")return;let r=n.indexOf(":");if(r===-1)return;let s=n.substring(0,r),a=n.substring(r+1);if(!s||!a)return;let i={[I.USER_MESSAGE]:c=>this.onUserMessage(e,c),[I.USER_CLEAR_HISTORY]:()=>this.onClearHistory(e),[I.USER_AUTH]:c=>this.onUserAuth(e,c),[I.USER_IDENTITY]:c=>this.onUserIdentity(e,c)}[s];i&&await i(a)}async onUserMessage(e,n){var i;let r=ke(n),s=((i=e.state)==null?void 0:i.authorizedUser)??void 0,a=()=>(s==null?void 0:s.email)??this.resolveSessionUserId(),o=`run-${Gt(12)}`;await this.registerManualRun(o,r.text,a()),await N(this.env,o).catch(c=>{console.warn(`[AgentDO] could not mark manual run ${o} as running`,c)});try{let c=await D({agent:this,env:this.env,ctx:this.ctx,payload:r,connection:e,userAuth:this.userAuth,composioSessions:this.composioSessions,publicOrigin:this.publicOrigin,skillRefCache:this.skillRefCache,user:s,resolveUserId:a,runId:o,shouldStop:()=>this.isRunStopRequested(o),onServerEvent:l=>{k(e,I.SERVER_EVENT,JSON.stringify(l))},onError:l=>{k(e,I.SERVER_ERROR,l)},onSecretsLoaded:l=>{this.secrets=l}});this.ctx.waitUntil(this.completeManualRun(o,c.status==="completed"?"succeeded":c.status==="stopped"?"skipped":"failed",c.error))}finally{await this.clearRunStopRequest(o)}}registerManualRun(e,n,r){var c;let{tenant:s,flowId:a,chatId:o}=((c=this.state.engineState)==null?void 0:c.flowData)??{};if(!s||!a||!o)return Promise.resolve();let i=qe(r||this.resolveSessionUserId(),o);return Xe(this.env,{id:e,tenant:s,flowId:a,userId:i,sessionId:o,label:n==null?void 0:n.slice(0,120)})}completeManualRun(e,n,r){return j(this.env,e,{status:n,error:r})}async enqueueTrigger(e){var s;if(!(e!=null&&e.runId)||!(e!=null&&e.flowId))return{queued:!1};if(e.nonce&&!await this.claimTriggerNonce(e.nonce))return console.warn(`[AgentDO] rejected replayed trigger nonce ${e.nonce}`),{queued:!1,duplicate:!0};let n=e.runAsUserId;return n&&!((s=this.state.user)!=null&&s.email)&&this.state.injectedUserId!==n&&this.setState({...this.state,injectedUserId:n}),{queued:!0,taskId:await this.queue("processTrigger",e)}}async claimTriggerNonce(e){let n=`${nt}${e}`;if(await this.ctx.storage.get(n))return!1;let r=Date.now();await this.ctx.storage.put(n,r);let a=[...(await this.ctx.storage.list({prefix:nt})).entries()].filter(([,o])=>r-o>qt).map(([o])=>o);return a.length>0&&await this.ctx.storage.delete(a),!0}async processTrigger(e){if(!(await N(this.env,e.runId)).claimed){console.warn(`[AgentDO] activation ${e.activationId} skipped \u2014 run ${e.runId} already claimed`);return}try{this.state.engineState||await M(this,this.env);let r=xe(G(this.state.engineState)),s=Te(r,e.inputs||{},e.label),a=await D({agent:this,env:this.env,ctx:this.ctx,payload:{text:s,inputs:e.inputs||{}},composioSessions:this.composioSessions,skillRefCache:this.skillRefCache,resolveUserId:()=>e.runAsUserId||this.resolveSessionUserId(),runId:e.runId,shouldStop:()=>this.isRunStopRequested(e.runId),onSecretsLoaded:o=>{this.secrets=o}});await j(this.env,e.runId,{status:a.status==="completed"?"succeeded":a.status==="stopped"?"skipped":"failed",error:a.error})}catch(r){let s=r instanceof Error?r.message:"Trigger execution failed";throw await j(this.env,e.runId,{status:"failed",error:s}),r}finally{await this.clearRunStopRequest(e.runId)}}async onUserIdentity(e,n){let r=P(n);if(!r){k(e,I.SERVER_ERROR,"Invalid identity payload");return}this.setState({...this.state,injectedUserId:r}),k(e,I.SERVER_EVENT,JSON.stringify({type:"info:identity",content:{set:!0}}))}async onUserAuth(e,n){let r=Ae(n);if(!r){k(e,I.SERVER_ERROR,"Invalid auth payload");return}let s=r.value.trim();s===""?delete this.userAuth[r.name]:this.userAuth[r.name]=r.value,k(e,I.SERVER_EVENT,JSON.stringify({type:"info:auth",content:{name:r.name,set:s!==""}}))}async onClearHistory(e){await K(this),this.userAuth={},this.composioSessions={},this.skillRefCache.clear(),this.setState({...this.state,error:"",engineState:this.state.engineState,memory:this.state.memory,modelsCache:{},lastUpdated:new Date}),e&&k(e,I.SERVER_HISTORY,JSON.stringify({messages:[]}))}async onStart(){`${JSON.stringify(this.state)}`,await Ge(this);let e=await v(this);`${JSON.stringify(e)}`}async onClose(e,n,r,s){console.log(`Session closed: ${this.state.sessionId} ${n} - ${r}`)}async onError(e){console.error("AgentDO encountered an error:",e)}};import{DurableObject as Xt}from"cloudflare:workers";var zt=720*60*60*1e3,ot=class extends Xt{cryptoKey;async load(){let e=await this.ctx.storage.get("state");if(!e)return null;await this.touch();try{let n=await crypto.subtle.decrypt({name:"AES-GCM",iv:e.iv},await this.key(),e.data);return{state:JSON.parse(new TextDecoder().decode(n)),updatedAt:e.updatedAt}}catch{return await this.ctx.storage.delete("state"),null}}async save(e,n){let r=await this.ctx.storage.get("state");if(r&&r.updatedAt>n)return;let s=crypto.getRandomValues(new Uint8Array(12)),a=await crypto.subtle.encrypt({name:"AES-GCM",iv:s},await this.key(),new TextEncoder().encode(JSON.stringify(e)));await this.ctx.storage.put("state",{iv:s.buffer,data:a,updatedAt:n}),await this.touch()}async invalidate(){await this.ctx.storage.delete("state")}async acquire(e,n){let r=await this.ctx.storage.get("lease");return r&&r.holder!==e&&r.until>Date.now()?!1:(await this.ctx.storage.put("lease",{holder:e,until:Date.now()+n}),!0)}async release(e){let n=await this.ctx.storage.get("lease");(n==null?void 0:n.holder)===e&&await this.ctx.storage.delete("lease")}async busy(){let e=await this.ctx.storage.get("lease");return!!e&&e.until>Date.now()}async alarm(){await this.ctx.storage.deleteAll()}async touch(){await this.ctx.storage.setAlarm(Date.now()+zt)}key(){return this.cryptoKey??=(async()=>{let e=Uint8Array.from(atob(this.env.WEB_SESSION_KEY??""),n=>n.charCodeAt(0));if(e.length!==32)throw new Error("WEB_SESSION_KEY must be 32 bytes in base64");return crypto.subtle.importKey("raw",e,"AES-GCM",!1,["encrypt","decrypt"])})(),this.cryptoKey}};function Vo(t){let e=t.state;if(!e)return null;let n=["startNode","answerNode"];for(let r of n)if(!e.nodes.some(a=>a.type===r))return!1;return e.nodes.find(r=>r.type==="startNode")}import{importSPKI as Vt,jwtVerify as Jt}from"jose";function q(t){let e={};if(!t)return e;let n=t.split(";");for(let r of n){let s=r.indexOf("=");if(s>-1){let a=r.slice(0,s).trim(),o=r.slice(s+1).trim();a&&(e[a]=decodeURIComponent(o))}}return e}function Yt(t){return(typeof t.email=="string"?t.email.trim():"")||null}async function O(t,e,n){let r=q(t.headers.get("cookie")),s=new URL(t.url),a=r.access_token||s.searchParams.get("access_token"),o=await Bt(e,a);if(o.ok){let i=o.payload,c=Yt(i);return c?{id:i.sub,email:c,name:i.name,first_name:i.given_name,last_name:i.family_name,tenant:i.tenant,org:typeof i.org=="string"?i.org:null,roles:i["ora-roles"],db_name:i.db_name||null,user_id:i.user_id||null}:null}return null}async function Bt(t,e){if(!e||typeof e!="string")return{ok:!1,payload:null,protectedHeader:null};if(!t.KC_RS256_PK)throw new Error("PK is not defined");let n=`-----BEGIN PUBLIC KEY-----
+`);return{system:e,user:r}}function Wt(t){return $e(t.previous,De(t.userText),t.maxTokens)}async function Gt(t){let e="",r;for await(let n of t.fullStream)n.type==="text-delta"&&(e+=n.text??n.delta??""),n.type==="error"&&(r=n.error instanceof Error?n.error.message:String(n.error??"stream error"));return{text:e.trim(),error:r}}async function Xt(t){if(t.fullStream&&typeof t.fullStream[Symbol.asyncIterator]=="function")return Gt({fullStream:t.fullStream});try{return{text:((typeof t.text=="string"?t.text:await t.text)||"").trim()}}catch(e){return{text:"",error:e instanceof Error?e.message:String(e)}}}async function Be(t){var u;let e=X(t.engineState);if(!e)return{status:"skipped",reason:"start_node_missing"};if(!Pe(e))return{status:"skipped",reason:"memory_disabled"};let r=Me(e),n=Ue(r),s=ve(e),a=Y(t.previousContent||""),o=jt(t.messages),i=Ht(t.engineState),c=l=>{let m=Wt({previous:a,userText:t.userText,maxTokens:n});return{status:"written",content:m,truncated:!1,modelId:s,fallback:!0,error:m?void 0:l}};try{let l=await We(s,t.sessionEnv,{maxOutputTokens:n});if(!l)throw new Error(`Memory model '${s}' not found in registry`);let m=Ce(r,(u=l.reasoning)==null?void 0:u.kind),{system:g,user:p}=Kt({previous:a,userText:t.userText,assistantText:o,answers:i,length:r,maxTokens:n,recentTurns:Lt(t.messages)}),y=He(l.reasoning),f=Ke(l.provider,{effort:y,exposeReasoning:!1,maxTokens:m}),h=Ct({model:l.modelHandle,system:g,messages:[{role:"user",content:p}],...je({...l.effectiveParams??{},maxOutputTokens:m}),...f?{providerOptions:f}:{}}),S=await Xt(h),R=Ft(await h.usage),I=Y(S.text);if(Ne(I)&&(I=""),!I)return{...c(S.error||"Memory model returned empty text"),usage:R};let x=Oe(I,n);return{status:"written",content:x.content,truncated:x.truncated,usage:R,modelId:s}}catch(l){let m=l instanceof Error?l.message:"Memory update failed";return console.error("Memory update failed:",l),c(m)}}async function Ze(t,e){var n,s;let r=(n=e==null?void 0:e.flowData)==null?void 0:n.flowId;if(!(t!=null&&t.HX_CORE_URL)||!r)return{engineState:e,refreshed:!1};try{let a=await v(r,t),o={...e,flowData:{...a,tenant:e.flowData.tenant,flowId:r,chatId:e.flowData.chatId}},i=a==null?void 0:a.stateVersion,c=typeof i=="number"&&i!==((s=e.flowData)==null?void 0:s.stateVersion);return{engineState:o,refreshed:c}}catch(a){return console.error(`[flowRefresh] fetch failed for flow ${r}:`,a),{engineState:e,refreshed:!1}}}function qt(t,e){let r=[],n=s=>{if(s)for(let[a,o]of Object.entries(s))typeof o=="string"&&o.length>=8&&r.push({name:a,value:o})};return n(t),n(e),r.sort((s,a)=>a.value.length-s.value.length),r}function Qe(t,e){let r=t;for(let n of e)r.includes(n.value)&&(r=r.split(n.value).join(`[redacted:${n.name}]`));return r}function te(t,e){if(typeof t=="string")return Qe(t,e);if(Array.isArray(t))return t.map(r=>te(r,e));if(t!==null&&typeof t=="object"){let r={};for(let[n,s]of Object.entries(t))r[Qe(n,e)]=te(s,e);return r}return t}function ne(t,e,r){let n=qt(e,r);return n.length===0?t:te(t,n)}function et(t,e){return!t||!t.HX_ORA_URL||!t.HX_API_KEY?Promise.resolve():fetch(`${t.HX_ORA_URL}/internal/sessions`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:t.HX_API_KEY},body:JSON.stringify(e)}).catch(r=>{console.error("[sessionIndex] failed to index session",r)})}var tt=async(t,e)=>{fetch(`${e.DW_URL}/q/telemetry/event`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(t)}),`${JSON.stringify(t)}`};var nt=["image/png","image/jpeg","image/webp","image/gif"];var zt=/^data:([^;,]*)((?:;[^;,]*)*?);base64,/i,Vt=/^[A-Za-z0-9+/]*={0,2}$/;function Jt(t){var n;let e=t,r;if(/^data:/i.test(e)){let s=zt.exec(e);if(!s)return{error:"must be base64 or a base64 data URL"};r=((n=s[1])==null?void 0:n.trim().toLowerCase())||void 0,e=e.slice(s[0].length)}return e=e.replace(/\s+/g,""),!e||e.length%4!==0||!Vt.test(e)?{error:"is not valid base64"}:{data:e,dataUrlMime:r}}function re(t){let e=t.endsWith("==")?2:t.endsWith("=")?1:0;return t.length/4*3-e}function st(t,e){if(typeof t.data!="string"||!t.data)return`${e}.data must be a non-empty string`;let r=Jt(t.data);if("error"in r)return`${e}.data ${r.error}`;let n=re(r.data);return n>8388608?`${e} is ${n} bytes; the limit is 8388608 bytes`:{...r,size:n}}function Yt(t){if(!Array.isArray(t))return"images must be an array of { mimeType, data }";if(t.length>4)return"images accepts at most 4 items";let e=[];for(let[r,n]of t.entries()){let s=`images[${r}]`;if(!n||typeof n!="object"||Array.isArray(n))return`${s} must be an object { mimeType, data }`;let a=n,o=st(a,s);if(typeof o=="string")return o;let c=(typeof a.mimeType=="string"?a.mimeType.trim().toLowerCase():"")||o.dataUrlMime||"";if(!nt.includes(c))return`${s}.mimeType must be one of ${nt.join(", ")}`;e.push({mimeType:c,data:o.data})}return e}function Bt(t){if(!Array.isArray(t))return"documents must be an array of { name, mimeType, data }";if(t.length>4)return"documents accepts at most 4 items";let e=[];for(let[r,n]of t.entries()){let s=`documents[${r}]`;if(!n||typeof n!="object"||Array.isArray(n))return`${s} must be an object { name, mimeType, data }`;let a=n,o=typeof a.name=="string"?a.name.trim():"";if(!o)return`${s}.name must be a non-empty string`;let i=st(a,s);if(typeof i=="string")return i;let u=(typeof a.mimeType=="string"?a.mimeType.trim():"")||i.dataUrlMime||"application/octet-stream";e.push({name:o,mimeType:u,data:i.data})}return e}function ot(t){let e,r;if(t.images!==void 0&&t.images!==null){let n=Yt(t.images);if(typeof n=="string")return{ok:!1,error:n};n.length&&(e=n)}if(t.documents!==void 0&&t.documents!==null){let n=Bt(t.documents);if(typeof n=="string")return{ok:!1,error:n};n.length&&(r=n)}return{ok:!0,...e?{images:e}:{},...r?{documents:r}:{}}}function at(t){return{images:(t.images??[]).map(e=>({mimeType:e.mimeType,bytes:re(e.data)})),documents:(t.documents??[]).map(e=>({mimeType:e.mimeType,bytes:re(e.data)}))}}function rt(t){return Array.isArray(t)&&t.some(e=>e&&typeof e=="object"&&typeof e.data=="string")}function N(t){if(!t||typeof t!="object")return t;let e={...t};if(t.context&&typeof t.context=="object"&&(e.context={...t.context},rt(e.context.user_images)&&(e.context.user_images=[])),t.results&&typeof t.results=="object"){let r={...t.results};for(let[n,s]of Object.entries(r))s&&typeof s=="object"&&rt(s.images)&&(r[n]={...s,images:[]});e.results=r}return e}async function D(t,e){var a;let r=t.id||t.name||"",[n,s]=String(r).split("::");if(!n||!s)return null;try{let i=(a=(await U(n,e)).metadata)==null?void 0:a.tenant,u={flowData:{...await v(n,e),tenant:i,flowId:n,chatId:s},executedNodes:[],context:{}};return t.setState({...t.state,engineState:u}),u}catch(o){return console.error("Failed to initialize engine state:",o),null}}async function Qt(t,e,r){var n;if(e&&t.HX_CORE_URL&&t.HX_API_KEY)try{let s=await U(e,t),a=(n=s==null?void 0:s.metadata)==null?void 0:n.org;if(typeof a=="string"&&a.trim())return G(a)}catch(s){console.warn(`[secrets] could not read org for flow ${e}`,s)}return G(r)}async function $(t){var ce,ue,le,de,me,pe,fe,ge,ye,he,we;let{agent:e,env:r,ctx:n,payload:s,connection:a}=t,o=Date.now(),i=[],c=t.runId?Le():void 0,u=async()=>await O(e),l=async d=>{await Xe(e,d)},m=async d=>{if(e.state.modelsCache&&e.state.modelsCache[d])return e.state.modelsCache[d];try{let{fetchOraModel:w}=await import("./oraApi-YIJGMXX7.js"),A=await w(d,r);return e.setState({...e.state,modelsCache:{...e.state.modelsCache||{},[d]:A}}),A}catch(w){throw console.error(`Error fetching model ${d}:`,w),w}},g={id:Zt(),role:"user",type:"text",content:s.text,images:s.images,ts:Date.now()};await l(g);let p={onChangeState:d=>{e.setState({...e.state,engineState:N(d)})},onServerEvent:async d=>{var w;await((w=t.onServerEvent)==null?void 0:w.call(t,d)),i.push(d.type==="info:flow"&&d.content?{...d,content:N(d.content)}:d)},onTelemetry:async d=>{var _,Se,Re,Ee,Te,Ie;let w=t.user,A=typeof(w==null?void 0:w.org)=="string"&&w.org.trim()?w.org.trim():"default";await tt({...d,userId:t.resolveUserId(),tenant:((Se=(_=e.state.engineState)==null?void 0:_.flowData)==null?void 0:Se.tenant)||"",org:A,flowId:((Ee=(Re=e.state.engineState)==null?void 0:Re.flowData)==null?void 0:Ee.flowId)||"",sessionId:((Ie=(Te=e.state.engineState)==null?void 0:Te.flowData)==null?void 0:Ie.chatId)||""},r)},onError:d=>{var w;(w=t.onError)==null||w.call(t,d),e.setState({...e.state,error:d})},shouldStop:t.shouldStop},y=e.state.engineState?{...e.state.engineState}:null;if(y){let{engineState:d,refreshed:w}=await Ze(r,y);y=d,w&&e.setState({...e.state,engineState:y,modelsCache:{}})}else if(y=await D(e,r),!y){let d="Failed to initialize agent";return p.onError(d),{status:"failed",error:d,path:[]}}let f=t.user??void 0,h=(ce=y.flowData)==null?void 0:ce.tenant,S=await Qt(r,(ue=y.flowData)==null?void 0:ue.flowId,f==null?void 0:f.org),R=h?await Je(r,h,S):{};(le=t.onSecretsLoaded)==null||le.call(t,R),y={...y,context:{...y.context||{},user:f}},e.setState({...e.state,user:f,engineState:y});let I={env:r,ctx:n,conn:a,getMessages:u,setMessages:l,getOraModel:m,secrets:R,userAuth:t.userAuth,user:f,composioSessions:t.composioSessions,publicOrigin:t.publicOrigin,skillRefCache:t.skillRefCache,runId:t.runId,outputCollector:c,agentMemory:typeof((de=e.state.memory)==null?void 0:de.content)=="string"?e.state.memory.content:"",shouldStop:t.shouldStop,workerStack:(me=y.flowData)!=null&&me.flowId?[y.flowData.flowId]:[],workerCalls:{count:0}},x=await Ge(I,y,p)(s),E=e.state.engineState??y;if(x.status==="completed")try{let d=await Be({sessionEnv:I,engineState:E,previousContent:typeof((pe=e.state.memory)==null?void 0:pe.content)=="string"?e.state.memory.content:"",userText:s.text||"",messages:await u()});if(d.status==="skipped")await p.onServerEvent({type:"agent:memory",content:{skipped:!0,reason:d.reason},timestamp:Date.now()});else if(!d.content.trim())await p.onServerEvent({type:"agent:memory",content:{updated:!1,empty:!0,error:d.error,fallback:d.fallback},timestamp:Date.now()});else{let w={promptTokens:((fe=E.tokenUsage)==null?void 0:fe.promptTokens)??0,completionTokens:((ge=E.tokenUsage)==null?void 0:ge.completionTokens)??0,totalTokens:((ye=E.tokenUsage)==null?void 0:ye.totalTokens)??0};d.usage&&(w.promptTokens+=d.usage.promptTokens,w.completionTokens+=d.usage.completionTokens,w.totalTokens+=d.usage.totalTokens),E={...E,tokenUsage:w},e.setState({...e.state,engineState:N(E),memory:{content:d.content,updatedTs:Date.now(),...d.error?{lastError:d.error}:{},...d.fallback?{fallback:!0}:{}}}),await p.onTelemetry({type:"memory_update",payload:{model:d.modelId,truncated:d.truncated,usage:d.usage,fallback:d.fallback,error:d.error}}),await p.onServerEvent({type:"agent:memory",content:{updated:!0,truncated:d.truncated,fallback:d.fallback,error:d.error},timestamp:Date.now()})}}catch(d){let w=d instanceof Error?d.message:"Memory update failed";console.error("Memory update failed:",d),await p.onServerEvent({type:"agent:memory",content:{error:w},timestamp:Date.now()})}if(x.status==="completed"&&t.runId&&(c!=null&&c.hasOutputs())){let{flowId:d,chatId:w}=E.flowData??{};if(!d||!w)x={status:"failed",error:"Structured output persistence requires flowId and sessionId"};else try{await Fe(r,{flowId:d,sessionId:w,runId:t.runId,createdAt:new Date(o).toISOString(),data:c.snapshotData(),answerNodeIds:c.answerNodeIds()});let A={...E.results||{}};for(let _ of c.answerNodeIds())A[_]={...A[_]||{},persisted:!0,runId:t.runId};E={...E,results:A},e.setState({...e.state,engineState:N(E)})}catch(A){let _=A instanceof Error?A.message:"Structured output persistence failed";p.onError(_),await p.onServerEvent({type:"error:answer-output",content:{runId:t.runId,error:_},timestamp:Date.now()}),x={status:"failed",error:_}}}let{tenant:L,flowId:V,chatId:J}=E.flowData??{},At=(he=E.flowData)==null?void 0:he.org;L&&V&&J&&n.waitUntil(et(r,{id:`${V}::${J}`,tenant:L,org:At,flowId:V,sessionId:J,userId:t.resolveUserId(),title:(we=s.text)==null?void 0:we.slice(0,120),turnTs:o,events:i})),e.setState({...e.state,lastUpdated:new Date});let kt=(E.executedNodes??[]).flatMap(d=>typeof(d==null?void 0:d.id)=="string"?[d.id]:[]),bt=typeof x.error=="string"?ne(x.error,R,t.userAuth):x.error,ie=c!=null&&c.hasOutputs()?ne(c.snapshotData(),R,t.userAuth):void 0;return{status:x.status,error:bt,engineState:E,path:kt,...ie!==void 0?{outputs:ie}:{}}}import{nanoid as en}from"nanoid";function tn(t){let e=t.headers.get("X-User-Payload");if(!e)return null;try{let r=JSON.parse(e),n=typeof(r==null?void 0:r.email)=="string"?M(r.email):null;return n?{...r,email:n}:null}catch{return null}}async function it(t,e,r,n){var s;try{let a=await e.json().catch(()=>null);if(!a||typeof a!="object"||Array.isArray(a))return new Response(JSON.stringify({error:"Body must be a JSON object"}),{status:400,headers:{"content-type":"application/json"}});let o=a.message;if(!o||typeof o!="string")return new Response(JSON.stringify({error:"Invalid message"}),{status:400,headers:{"content-type":"application/json"}});let i=ot(a);if(!i.ok)return new Response(JSON.stringify({error:`Invalid attachments: ${i.error}`}),{status:400,headers:{"content-type":"application/json"}});let{images:c,documents:u}=i;(c||u)&&console.log("[AgentHTTP] turn attachments",JSON.stringify(at({images:c,documents:u})));let l=typeof a.userId=="string"?M(a.userId):null,m=tn(e),g=m==null?void 0:m.email;m?t.setState({...t.state,user:m,injectedUserId:g}):l&&!((s=t.state.user)!=null&&s.email)&&t.setState({...t.state,injectedUserId:l});let p=()=>g??l??t.state.injectedUserId??void 0;t.skillRefCache||(t.skillRefCache=new Map);let y=a.inputs&&typeof a.inputs=="object"?a.inputs:void 0;if(!t.state.engineState&&!await D(t,r))return new Response(JSON.stringify({error:"Failed to initialize agent"}),{status:500,headers:{"content-type":"application/json"}});let f=`run-${en(12)}`;await t.registerManualRun(f,o,p()),await C(r,f).catch(I=>{console.warn(`[AgentHTTP] could not mark manual run ${f} as running`,I)});let h;try{h=await $({agent:t,env:r,ctx:n,payload:{text:o,...c?{images:c}:{},...u?{documents:u}:{},inputs:y},skillRefCache:t.skillRefCache,user:m??void 0,resolveUserId:p,runId:f,shouldStop:()=>t.isRunStopRequested(f)}),n.waitUntil(t.completeManualRun(f,h.status==="completed"?"succeeded":h.status==="stopped"?"skipped":"failed",h.error))}finally{await t.clearRunStopRequest(f)}if(h.status==="failed")return new Response(JSON.stringify({error:h.error||"Agent execution failed",runId:f,path:h.path??[]}),{status:500,headers:{"content-type":"application/json"}});if(h.status==="stopped")return new Response(JSON.stringify({error:h.error||"Stopped by user"}),{status:409,headers:{"content-type":"application/json"}});let R=(await O(t)).reverse().find(I=>I.role==="assistant");return new Response(JSON.stringify({answer:(R==null?void 0:R.content)||"",runId:f,path:h.path??[],...h.outputs!==void 0?{outputs:h.outputs}:{}}),{headers:{"content-type":"application/json"}})}catch(a){return new Response(JSON.stringify({error:a.message}),{status:500,headers:{"content-type":"application/json"}})}}async function ct(t){try{return await H(t),t.skillRefCache&&t.skillRefCache.clear(),t.setState({...t.state,error:"",engineState:void 0,modelsCache:{},lastUpdated:new Date}),new Response(JSON.stringify({success:!0,messages:[]}),{headers:{"content-type":"application/json"}})}catch(e){return new Response(JSON.stringify({error:e.message}),{status:500,headers:{"content-type":"application/json"}})}}var lt="trigger:nonce:",rn=900*1e3,se="run:stop:",dt=class extends ut{initialState={user:void 0,injectedUserId:null,sessionId:null,lastUpdated:null,modelsCache:{},memory:void 0};constructor(e,r){super(e,r),this.requireStateValidation()}validateStateChange(e,r){if(r!=="server")throw new Error("Client state updates are forbidden")}requireStateValidation(){if(typeof ut.prototype.validateStateChange!="function")throw new Error("AgentDO requires agents >= 0.8.7 with validateStateChange; upgrade the tenant SDK")}resolveSessionUserId(){return this.state.injectedUserId??void 0}secrets=Object.freeze({});userAuth={};composioSessions={};skillRefCache=new Map;publicOrigin;async inspectPersistedSession(e){return e==="state"?{state:this.state}:e==="memory"?{memory:this.state.memory??null}:{messages:await O(this)}}async requestRunStop(e){return e!=null&&e.trim()?(await this.ctx.storage.put(`${se}${e}`,Date.now()),{accepted:!0}):{accepted:!1}}async isRunStopRequested(e){return!!await this.ctx.storage.get(`${se}${e}`)}async clearRunStopRequest(e){await this.ctx.storage.delete(`${se}${e}`)}async onRequest(e){this.requireStateValidation();let r=new URL(e.url);if(r.pathname.endsWith("/state"))return new Response(JSON.stringify(this.state),{headers:{"content-type":"application/json"}});if(r.pathname.endsWith("/history")){let n=await O(this);return new Response(JSON.stringify(n),{headers:{"content-type":"application/json"}})}return e.method==="POST"&&r.pathname.endsWith("/message")?it(this,e,this.env,this.ctx):e.method==="DELETE"&&r.pathname.endsWith("/clear")?ct(this):new Response("Ready to assist.")}async onConnect(e,r){var g,p,y,f,h;this.requireStateValidation();let[n,s]=e.server.split("::"),o=(g=(await U(n,this.env)).metadata)==null?void 0:g.tenant;this.userAuth={},this.composioSessions={},this.publicOrigin=void 0;let i=null;if(r.request){try{this.publicOrigin=new URL(r.request.url).origin}catch{}let S=r.request.headers.get("X-User-Payload");if(S)try{i=JSON.parse(S)}catch(R){console.warn("Failed to parse X-User-Payload",R)}}e.setState({...e.state,authorizedUser:i});let c=await v(n,this.env);this.setState({...this.state,user:i||null,sessionId:s,engineState:{flowData:{...c,tenant:o,flowId:n,chatId:s},executedNodes:[],context:i?{user:i}:{}}}),i||console.warn("[AgentDO] WebSocket connected without authenticated user \u2014 Composio manual auth requires login (access_token on socket URL)");let u=await O(this);k(e,T.SERVER_HISTORY,JSON.stringify({messages:u}));let m=(((p=c==null?void 0:c.state)==null?void 0:p.nodes)??(c==null?void 0:c.nodes)??[]).find(S=>S.type==="startNode");if(m){let S={allow_images:((y=m.data)==null?void 0:y.allow_images)??!1,allow_documents:((f=m.data)==null?void 0:f.allow_documents)??!1,greeting:(h=m.data)==null?void 0:h.greeting};k(e,T.SERVER_CONFIG,JSON.stringify(S))}}async onMessage(e,r){if(typeof r!="string")return;let n=r.indexOf(":");if(n===-1)return;let s=r.substring(0,n),a=r.substring(n+1);if(!s||!a)return;let i={[T.USER_MESSAGE]:c=>this.onUserMessage(e,c),[T.USER_CLEAR_HISTORY]:()=>this.onClearHistory(e),[T.USER_AUTH]:c=>this.onUserAuth(e,c),[T.USER_IDENTITY]:c=>this.onUserIdentity(e,c)}[s];i&&await i(a)}async onUserMessage(e,r){var i;let n=be(r),s=((i=e.state)==null?void 0:i.authorizedUser)??void 0,a=()=>(s==null?void 0:s.email)??this.resolveSessionUserId(),o=`run-${nn(12)}`;await this.registerManualRun(o,n.text,a()),await C(this.env,o).catch(c=>{console.warn(`[AgentDO] could not mark manual run ${o} as running`,c)});try{let c=await $({agent:this,env:this.env,ctx:this.ctx,payload:n,connection:e,userAuth:this.userAuth,composioSessions:this.composioSessions,publicOrigin:this.publicOrigin,skillRefCache:this.skillRefCache,user:s,resolveUserId:a,runId:o,shouldStop:()=>this.isRunStopRequested(o),onServerEvent:u=>{k(e,T.SERVER_EVENT,JSON.stringify(u))},onError:u=>{k(e,T.SERVER_ERROR,u)},onSecretsLoaded:u=>{this.secrets=u}});this.ctx.waitUntil(this.completeManualRun(o,c.status==="completed"?"succeeded":c.status==="stopped"?"skipped":"failed",c.error))}finally{await this.clearRunStopRequest(o)}}registerManualRun(e,r,n){var c;let{tenant:s,flowId:a,chatId:o}=((c=this.state.engineState)==null?void 0:c.flowData)??{};if(!s||!a||!o)return Promise.resolve();let i=ze(n||this.resolveSessionUserId(),o);return Ve(this.env,{id:e,tenant:s,flowId:a,userId:i,sessionId:o,label:r==null?void 0:r.slice(0,120)})}completeManualRun(e,r,n){return W(this.env,e,{status:r,error:n})}async enqueueTrigger(e){var s;if(!(e!=null&&e.runId)||!(e!=null&&e.flowId))return{queued:!1};if(e.nonce&&!await this.claimTriggerNonce(e.nonce))return console.warn(`[AgentDO] rejected replayed trigger nonce ${e.nonce}`),{queued:!1,duplicate:!0};let r=e.runAsUserId;return r&&!((s=this.state.user)!=null&&s.email)&&this.state.injectedUserId!==r&&this.setState({...this.state,injectedUserId:r}),{queued:!0,taskId:await this.queue("processTrigger",e)}}async claimTriggerNonce(e){let r=`${lt}${e}`;if(await this.ctx.storage.get(r))return!1;let n=Date.now();await this.ctx.storage.put(r,n);let a=[...(await this.ctx.storage.list({prefix:lt})).entries()].filter(([,o])=>n-o>rn).map(([o])=>o);return a.length>0&&await this.ctx.storage.delete(a),!0}async processTrigger(e){if(!(await C(this.env,e.runId)).claimed){console.warn(`[AgentDO] activation ${e.activationId} skipped \u2014 run ${e.runId} already claimed`);return}try{this.state.engineState||await D(this,this.env);let n=Ae(X(this.state.engineState)),s=ke(n,e.inputs||{},e.label),a=await $({agent:this,env:this.env,ctx:this.ctx,payload:{text:s,inputs:e.inputs||{}},composioSessions:this.composioSessions,skillRefCache:this.skillRefCache,resolveUserId:()=>e.runAsUserId||this.resolveSessionUserId(),runId:e.runId,shouldStop:()=>this.isRunStopRequested(e.runId),onSecretsLoaded:o=>{this.secrets=o}});await W(this.env,e.runId,{status:a.status==="completed"?"succeeded":a.status==="stopped"?"skipped":"failed",error:a.error})}catch(n){let s=n instanceof Error?n.message:"Trigger execution failed";throw await W(this.env,e.runId,{status:"failed",error:s}),n}finally{await this.clearRunStopRequest(e.runId)}}async onUserIdentity(e,r){let n=M(r);if(!n){k(e,T.SERVER_ERROR,"Invalid identity payload");return}this.setState({...this.state,injectedUserId:n}),k(e,T.SERVER_EVENT,JSON.stringify({type:"info:identity",content:{set:!0}}))}async onUserAuth(e,r){let n=_e(r);if(!n){k(e,T.SERVER_ERROR,"Invalid auth payload");return}let s=n.value.trim();s===""?delete this.userAuth[n.name]:this.userAuth[n.name]=n.value,k(e,T.SERVER_EVENT,JSON.stringify({type:"info:auth",content:{name:n.name,set:s!==""}}))}async onClearHistory(e){await H(this),this.userAuth={},this.composioSessions={},this.skillRefCache.clear(),this.setState({...this.state,error:"",engineState:this.state.engineState,memory:this.state.memory,modelsCache:{},lastUpdated:new Date}),e&&k(e,T.SERVER_HISTORY,JSON.stringify({messages:[]}))}async onStart(){`${JSON.stringify(this.state)}`,await qe(this);let e=await O(this);`${JSON.stringify(e)}`}async onClose(e,r,n,s){console.log(`Session closed: ${this.state.sessionId} ${r} - ${n}`)}async onError(e){console.error("AgentDO encountered an error:",e)}};import{DurableObject as sn}from"cloudflare:workers";var on=720*60*60*1e3,mt=class extends sn{cryptoKey;async load(){let e=await this.ctx.storage.get("state");if(!e)return null;await this.touch();try{let r=await crypto.subtle.decrypt({name:"AES-GCM",iv:e.iv},await this.key(),e.data);return{state:JSON.parse(new TextDecoder().decode(r)),updatedAt:e.updatedAt}}catch{return await this.ctx.storage.delete("state"),null}}async save(e,r){let n=await this.ctx.storage.get("state");if(n&&n.updatedAt>r)return;let s=crypto.getRandomValues(new Uint8Array(12)),a=await crypto.subtle.encrypt({name:"AES-GCM",iv:s},await this.key(),new TextEncoder().encode(JSON.stringify(e)));await this.ctx.storage.put("state",{iv:s.buffer,data:a,updatedAt:r}),await this.touch()}async invalidate(){await this.ctx.storage.delete("state")}async acquire(e,r){let n=await this.ctx.storage.get("lease");return n&&n.holder!==e&&n.until>Date.now()?!1:(await this.ctx.storage.put("lease",{holder:e,until:Date.now()+r}),!0)}async release(e){let r=await this.ctx.storage.get("lease");(r==null?void 0:r.holder)===e&&await this.ctx.storage.delete("lease")}async busy(){let e=await this.ctx.storage.get("lease");return!!e&&e.until>Date.now()}async alarm(){await this.ctx.storage.deleteAll()}async touch(){await this.ctx.storage.setAlarm(Date.now()+on)}key(){return this.cryptoKey??=(async()=>{let e=Uint8Array.from(atob(this.env.WEB_SESSION_KEY??""),r=>r.charCodeAt(0));if(e.length!==32)throw new Error("WEB_SESSION_KEY must be 32 bytes in base64");return crypto.subtle.importKey("raw",e,"AES-GCM",!1,["encrypt","decrypt"])})(),this.cryptoKey}};function ua(t){let e=t.state;if(!e)return null;let r=["startNode","answerNode"];for(let n of r)if(!e.nodes.some(a=>a.type===n))return!1;return e.nodes.find(n=>n.type==="startNode")}import{importSPKI as an,jwtVerify as cn}from"jose";function q(t){let e={};if(!t)return e;let r=t.split(";");for(let n of r){let s=n.indexOf("=");if(s>-1){let a=n.slice(0,s).trim(),o=n.slice(s+1).trim();a&&(e[a]=decodeURIComponent(o))}}return e}function un(t){return(typeof t.email=="string"?t.email.trim():"")||null}async function P(t,e,r){let n=q(t.headers.get("cookie")),s=new URL(t.url),a=n.access_token||s.searchParams.get("access_token"),o=await ln(e,a);if(o.ok){let i=o.payload,c=un(i);return c?{id:i.sub,email:c,name:i.name,first_name:i.given_name,last_name:i.family_name,tenant:i.tenant,org:typeof i.org=="string"?i.org:null,roles:i["ora-roles"],db_name:i.db_name||null,user_id:i.user_id||null}:null}return null}async function ln(t,e){if(!e||typeof e!="string")return{ok:!1,payload:null,protectedHeader:null};if(!t.KC_RS256_PK)throw new Error("PK is not defined");let r=`-----BEGIN PUBLIC KEY-----
 ${t.KC_RS256_PK}
------END PUBLIC KEY-----`,r=await Vt(n,"RS256");try{let{payload:s,protectedHeader:a}=await Jt(e,r);return{ok:!0,payload:s,protectedHeader:a}}catch(s){return console.error("JWT verification failed:",s),{ok:!1,payload:null,protectedHeader:null}}}async function ea(t,e,n){let r=new URL(t.url);if(r.pathname==="/favicon.ico")return new Response(null,{status:204});if(r.pathname.startsWith("/.well-known/appspecific"))return new Response(null,{status:204})}import{getAgentByName as X}from"agents";import{getAgentByName as Zt}from"agents";async function at(t,e){let n=e.sessionId||e.runAsUserId,r=e.inputs||{},s=e.runId;if(!s){let c=await B(t,{tenant:e.tenant,flowId:e.flowId,userId:e.runAsUserId,sessionId:n,triggerId:e.triggerId,triggerKind:e.triggerKind,invocationMode:e.invocationMode,activationId:e.activationId,deliveryId:void 0,externalDeliveryId:e.externalDeliveryId,correlationKey:e.correlationKey,inputs:r,label:e.label});if(!c)return{status:"error",error:"Failed to register run"};if(!c.created&&c.run.status!=="queued")return{status:"deduped",runId:c.run.id};s=c.run.id}let a={...e,sessionId:n,runId:s,inputs:r},i=await(await Zt(t.AGENT,`${e.flowId}::${n}`)).enqueueTrigger(a);return i.duplicate?{status:"deduped",runId:s}:i.queued?{status:"queued",runId:s,activation:a,taskId:i.taskId}:{status:"error",error:"Failed to queue trigger"}}var ct="x-ora-signature",lt="x-ora-timestamp",ut="x-ora-nonce",dt="x-ora-tenant",oa=300,it=new TextEncoder;function Qt(t){return[...new Uint8Array(t)].map(e=>e.toString(16).padStart(2,"0")).join("")}function er(t){try{let e=new URL(t);return`${e.origin}${e.pathname.replace(/\/$/,"")}`}catch{return t.replace(/\/$/,"")}}function pt(t){return["v1",t.timestamp,t.nonce,t.tenant,er(t.destination),t.body].join(`
-`)}async function ft(t,e){let n=await crypto.subtle.importKey("raw",it.encode(t),{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return Qt(await crypto.subtle.sign("HMAC",n,it.encode(e)))}function tr(t,e){if(t.length!==e.length)return!1;let n=0;for(let r=0;r<t.length;r++)n|=t.charCodeAt(r)^e.charCodeAt(r);return n===0}async function aa(t){let e=String(t.timestamp??Math.floor(Date.now()/1e3)),n=await ft(t.secret,pt({timestamp:e,nonce:t.nonce,tenant:t.tenant,destination:t.destination,body:t.body}));return{"content-type":"application/json",[dt]:t.tenant,[lt]:e,[ut]:t.nonce,[ct]:`v1=${n}`}}async function mt(t){var l,u,m,f,p;if(!((l=t.secret)!=null&&l.trim()))return{ok:!1,error:"HX_API_KEY is not configured"};let e=(u=t.headers.get(dt))==null?void 0:u.trim(),n=(m=t.headers.get(lt))==null?void 0:m.trim(),r=(f=t.headers.get(ut))==null?void 0:f.trim(),s=(p=t.headers.get(ct))==null?void 0:p.trim();if(!e||!n||!r||!s)return{ok:!1,error:"missing signature headers"};if(!s.startsWith("v1="))return{ok:!1,error:"unsupported signature version"};let a=Number(n);if(!Number.isFinite(a))return{ok:!1,error:"invalid timestamp"};let o=Math.floor((t.now??Date.now())/1e3),i=t.toleranceSeconds??300;if(Math.abs(o-a)>i)return{ok:!1,error:"stale timestamp"};let c=await ft(t.secret.trim(),pt({timestamp:n,nonce:r,tenant:e,destination:t.url,body:t.body}));return tr(s.slice(3),c)?{ok:!0,tenant:e,nonce:r,timestamp:a}:{ok:!1,error:"signature mismatch"}}var A=(t,e=200)=>new Response(JSON.stringify(t),{status:e,headers:{"content-type":"application/json"}});async function gt(t,e,n){var l;if(new URL(t.url).pathname!=="/api/triggers/dispatch")return;if(t.method!=="POST")return A({error:"Method not allowed"},405);let s=await t.text(),a=await mt({secret:e.HX_API_KEY,body:s,url:t.url,headers:t.headers});if(!a.ok)return console.warn(`[triggers] rejected dispatch: ${a.error}`),A({error:"Invalid signature"},401);let o;try{o=JSON.parse(s)}catch{return A({error:"Invalid payload"},400)}if(!(o!=null&&o.runId)||!(o!=null&&o.flowId)||!(o!=null&&o.runAsUserId)||!(o!=null&&o.tenant)||!(o!=null&&o.activationId)||!(o!=null&&o.triggerId)||!(o!=null&&o.triggerKind)||!(o!=null&&o.invocationMode))return A({error:"activationId, triggerId, triggerKind, invocationMode, runId, flowId, runAsUserId and tenant are required"},400);if(o.tenant!==a.tenant)return A({error:"Tenant mismatch"},403);let i;try{i=await U(o.flowId,e)}catch{return A({error:"Flow not found"},404)}if(!((l=i==null?void 0:i.metadata)!=null&&l.tenant)||i.metadata.tenant!==o.tenant)return console.warn(`[triggers] flow ${o.flowId} does not belong to tenant ${o.tenant}`),A({error:"Tenant mismatch"},403);let c=await at(e,{...o,sessionId:o.sessionId||o.runAsUserId,nonce:a.nonce});return c.status==="error"?A({error:c.error},502):c.status==="deduped"?A({deduped:!0,runId:c.runId},200):A({accepted:!0,runId:c.runId,taskId:c.taskId},202)}var ne=/^[A-Za-z0-9_-]{1,64}$/;async function se(t,e,n,r,s,a=!1){let o=(f,p)=>({response:new Response(f,{status:p})});if(!/^[A-Za-z0-9_-]+$/.test(r))return o("Invalid flowId",400);if((!a||s)&&(!s||!ne.test(s)))return o("Invalid sessionId",400);let i;try{i=await U(r,e)}catch{return o("Flow not found",404)}let c=i==null?void 0:i.metadata;if(!c||!["active","activo"].includes(c.status))return o("Flow not found",404);if(!e.TENANT||c.tenant!==e.TENANT)return o("Forbidden",403);let l=await O(t,e,n),u=l&&typeof l=="object"?l:void 0;if(u&&u.tenant!==e.TENANT)return o("Forbidden",403);if(c.visibility==="public")return{user:u};if(!u){if(!a)return o("Unauthorized",401);let f=new URL(t.url),p=new URL("/login",f.origin);return p.searchParams.set("nextURL",`${f.pathname}${f.search}`),{response:Response.redirect(p.toString(),302)}}if((c.org||"default")!==(u.org||"default"))return o("Forbidden",403);let m=q(t.headers.get("cookie")).access_token||new URL(t.url).searchParams.get("access_token");if(!m)return o("Unauthorized",401);try{let f=await fetch(`${e.HX_CORE_URL}/flows/${encodeURIComponent(r)}`,{headers:{Authorization:m},cache:"no-store"});if(!f.ok||(await f.json()).id!==r)return o("Forbidden",403)}catch{return o("Forbidden",403)}return{user:u}}var rr=/^[A-Za-z0-9_-]+$/,nr=new Set(["state","messages","memory"]);async function sr(t,e){let n=new URL(t.url);if(!n.pathname.startsWith("/api/internal/sessions/"))return;let r=n.pathname.split("/");if(r[6]!=="runs"||r[8]!=="stop"||r.length!==9)return;if(t.method!=="POST")return new Response("Method not allowed",{status:405});if(!e.HX_API_KEY||t.headers.get("Authorization")!==e.HX_API_KEY)return new Response("Unauthorized",{status:401});let s=decodeURIComponent(r[4]||""),a=decodeURIComponent(r[5]||""),o=decodeURIComponent(r[7]||"");if(!s||!a||!o)return new Response("Not found",{status:404});try{let i=await X(e.AGENT,`${s}::${a}`);return Response.json(await i.requestRunStop(o))}catch(i){return console.error("[agents] failed to request run stop",i),Response.json({error:"Failed to stop run"},{status:502})}}async function or(t,e){let n=new URL(t.url);if(!n.pathname.startsWith("/api/internal/sessions/"))return;if(t.method!=="GET")return new Response("Method not allowed",{status:405});let r=t.headers.get("Authorization")||"";if(!e.HX_API_KEY||r!==e.HX_API_KEY)return new Response("Unauthorized",{status:401});let s=n.pathname.split("/"),a=decodeURIComponent(s[4]||""),o=decodeURIComponent(s[5]||""),i=s[6];if(!a||!o||!i||!nr.has(i))return new Response("Not found",{status:404});try{let l=await(await X(e.AGENT,`${a}::${o}`)).inspectPersistedSession(i);return Response.json(l)}catch(c){return console.error("[agents] failed to inspect persisted session",c),Response.json({error:"Failed to inspect persisted session"},{status:502})}}async function Ra(t,e,n){var i,c;let r=new URL(t.url),s=await gt(t,e,n);if(s instanceof Response)return s;let a=await sr(t,e);if(a instanceof Response)return a;let o=await or(t,e);if(o instanceof Response)return o;if(r.pathname.startsWith("/a/")){let l=r.pathname.split("/"),u=l[2],m=l[3];try{if(!u)return Response.redirect(new URL("/",r.origin).toString(),302);let f=await se(t,e,n,u,m,!0);if(f.response)return f.response;if(!m){let p=crypto.randomUUID(),g=new URL(`/a/${u}/${p}`,r.origin);return Response.redirect(g.toString(),302)}}catch(f){return console.error("Error accessing flow KV:",f),new Response("Flow error",{status:500})}}if(r.pathname.startsWith("/api/agent/flow/")){let l=r.pathname.split("/"),u=l[4],m=l[5];return yt(t,e,n,u,m)}if(r.pathname.startsWith("/api/ora/connect")){let l=r.pathname.split("/"),u=l[4],m=l[5];if(!u||!m)return new Response("Missing flowId or sessionId",{status:400});let f=t.headers.get("Authorization")||r.searchParams.get("authorization");if(!f)return new Response("Missing Authorization header",{status:401});try{let p=`${e.HX_CORE_URL}/p/v1/validation/key/agent/${u}`,y=await(await fetch(p,{method:"GET",headers:{Authorization:f}})).json();if(((i=y.payload)==null?void 0:i.flowId)!==u)return console.error("FlowId mismatch:",(c=y.payload)==null?void 0:c.flowId,"!==",u),new Response("Validation error",{status:403});let w=`${u}::${m}`,S=await O(t,e,n);if(!S){let $=new URL(t.url).searchParams.has("access_token");console.warn(`[agents] Unauthenticated agent socket upgrade (access_token query=${$}) \u2014 Composio connections from tool editor will not apply`)}let R=new Headers(t.headers);R.delete("X-User-Payload"),S&&R.set("X-User-Payload",JSON.stringify(S));let b=new Request(t,{headers:R});return(await X(e.AGENT,w)).fetch(b)}catch(p){return console.error("Error in /api/ora/connect:",p),new Response("Internal error",{status:500})}}}async function yt(t,e,n,r,s){let a=`${r}::${s}`;try{let o=await se(t,e,n,r,s);if(o.response)return o.response;let i=o.user,c=new Headers(t.headers);c.delete("X-User-Payload"),i&&c.set("X-User-Payload",JSON.stringify(i));let l=new Request(t,{headers:c});return(await X(e.AGENT,a)).fetch(l)}catch(o){return console.error("Error accessing agent:",o),new Response("Agent error",{status:500})}}var Ea=async(t,e,n,r)=>{if(!(r!=null&&r.flowId)||!rr.test(r.flowId)||!(r!=null&&r.sessionId)||!ne.test(r.sessionId))return new Response("Not found",{status:404});let s=new URL(`/api/agent/flow/${r.flowId}/${r.sessionId}`,t.url),a=new Headers;for(let[c,l]of t.headers.entries())c.toLowerCase().startsWith("x-")||a.append(c,l);let o={method:t.method,headers:a};t.body&&t.method!=="GET"&&t.method!=="HEAD"&&(o.body=t.body,o.duplex="half");let i=new Request(s.toString(),o);return yt(i,e,n,r.flowId,r.sessionId)};async function Ta(t,e,n){let r=new URL(t.url),s=t.method;if(!r.pathname.startsWith("/api/instances"))return;let a=await O(t,e,n);if(!a)return new Response("Unauthorized",{status:401});let o=e.HX_CORE_URL,i=e.HX_API_KEY;if(!o||!i)return console.error("Missing configuration: HX_CORE_URL or HX_API_KEY"),new Response("Internal Server Error",{status:500});let l=r.pathname.slice("/api/instances".length);l.startsWith("/")&&(l=l.slice(1)),l.endsWith("/")&&(l=l.slice(0,-1));let u="/ora/instances";l&&(u+=`/${l}`);let m=o.endsWith("/")?o.slice(0,-1):o,f=new URL(`${m}${u}`);r.searchParams.forEach((y,w)=>{f.searchParams.set(w,y)}),s==="GET"&&!l&&f.searchParams.set("filter_user_id",a.email);let p=new Headers;p.set("Authorization",i),p.set("Content-Type","application/json"),p.set("X-User-Payload",JSON.stringify(a));let g={method:s,headers:p};if(["POST","PATCH","PUT"].includes(s))try{g.body=await t.text()}catch(y){console.error("Error reading request body:",y)}try{let y=await fetch(f.toString(),g),w=await y.text();return new Response(w,{status:y.status,headers:{"Content-Type":"application/json"}})}catch(y){return console.error("Error proxying to flow instance backend:",y),new Response("Internal Server Error",{status:500})}}async function ba(t,e,n){let r=new URL(t.url);if(t.method==="POST"&&r.pathname==="/auth/login")try{let s=await t.formData(),a=s.get("username"),o=s.get("password"),i=s.get("nextURL")||"/";if(!a||!o)return new Response("Missing username or password",{status:400});let c=new URLSearchParams;c.append("username",a),c.append("password",o),c.append("grant_type","password"),c.append("client_id",e.KC_CLIENT_ID),c.append("client_secret",e.KC_CLIENT_SECRET);let l=await fetch(`${e.KC_BASE_URL}/protocol/openid-connect/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Cookie:"hxsecure=1"},body:c});if(!l.ok)return new Response("Unauthorized",{status:401});let u=await l.json(),m=new Response(null,{status:302,headers:{Location:i}}),p=r.protocol==="https:"?"; Secure":"",g=(y,w,S)=>{m.headers.append("Set-Cookie",`${y}=${w}; Path=/; HttpOnly${p}; SameSite=Lax; Max-Age=${S}`)};return u.access_token&&g("access_token",u.access_token,u.expires_in),u.refresh_token&&g("refresh_token",u.refresh_token,u.refresh_expires_in||3600*24*30),u.id_token&&g("id_token",u.id_token,u.expires_in),m}catch(s){return console.error("Auth error:",s),new Response("Internal Server Error",{status:500})}if(r.pathname==="/auth/logout"){let s=new Response(null,{status:302,headers:{Location:"/login"}}),a=o=>{s.headers.append("Set-Cookie",`${o}=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0`)};return a("access_token"),a("refresh_token"),a("id_token"),s}if(r.pathname.startsWith("/s/")){let s=await O(t,e,n);if(!s){let a=new URL("/login",r.origin);return a.searchParams.set("nextURL",`${r.pathname}${r.search}`),Response.redirect(a.toString(),302)}return{user:s}}}import{WorkerEntrypoint as ar}from"cloudflare:workers";import{getAgentByName as ir}from"agents";var cr=/^[A-Za-z0-9_-]+$/,lr=/^art-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,ht=class extends ar{async ask(e,n){var r,s,a,o;try{if(!e||typeof e!="string"||!cr.test(e))throw console.error("[ArtifactWorkerGateway] invalid flowId:",e),new Error("Artifact worker request failed");if(!n||typeof n.message!="string")throw console.error("[ArtifactWorkerGateway] invalid input: message is required"),new Error("Artifact worker request failed");let i;if(n.sessionId!==void 0){if(typeof n.sessionId!="string"||!lr.test(n.sessionId))throw console.error("[ArtifactWorkerGateway] invalid sessionId:",n.sessionId),new Error("Artifact worker request failed");i=n.sessionId}else i=`art-${crypto.randomUUID()}`;let c=(s=(r=this.ctx)==null?void 0:r.props)==null?void 0:s.slug,l=(o=(a=this.ctx)==null?void 0:a.props)==null?void 0:o.artifactUuid;if(!c||!l)throw console.error("[ArtifactWorkerGateway] missing slug or artifactUuid in gateway context props"),new Error("Artifact worker request failed");let u=this.env.ARTIFACT;if(!u)throw console.error("[ArtifactWorkerGateway] ARTIFACT binding not configured"),new Error("Artifact worker request failed");let m=u.idFromName(c),p=await u.get(m).allowsWorker({flowId:e,mode:"server",artifactUuid:l});if(!(p!=null&&p.ok))throw console.error(`[ArtifactWorkerGateway] grant check failed for flow ${e} on artifact ${c}`),new Error("Artifact worker request failed");let g=await ir(this.env.AGENT,`${e}::${i}`),y={message:n.message};n.inputs&&typeof n.inputs=="object"&&(y.inputs=n.inputs);let w=new Request("http://localhost/message",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(y)}),S=await g.fetch(w);if(!S.ok)throw console.error(`[ArtifactWorkerGateway] agent returned status ${S.status}`),new Error("Artifact worker request failed");let R=await S.json();return{text:typeof(R==null?void 0:R.answer)=="string"?R.answer:"",sessionId:i}}catch(i){throw(i==null?void 0:i.message)==="Artifact worker request failed"?i:(console.error("[ArtifactWorkerGateway] unexpected error in ask:",i),new Error("Artifact worker request failed"))}}};export{It as ANONYMOUS_RUN_USER_PREFIX,st as AgentDO,ht as ArtifactWorkerGateway,Ir as CLASSIFIER_DEFAULTS,xr as CLASSIFIER_RESERVED_HANDLES,Er as CLEF_MODELS,Or as CRAWL_DEFAULTS,Cr as CRAWL_LIMITS,Rn as DEFAULT_MEMORY_LENGTH,En as DEFAULT_MEMORY_MODEL,Xn as EVENT_PREVIEW_BYTES,qn as EXTRACT_MAX_CHARS,wr as FLOW_INPUT_NAME_RE,Fs as FlowExecutionStoppedError,Rs as GENERATION_PARAM_KEYS,Is as GENERATION_PRESETS,_n as ISSUE_SEVERITY,Rr as MAX_USER_IDENTITY_LENGTH,wn as MEMORY_LENGTH_MD_LINES,Sn as MEMORY_LENGTH_TOKENS,Ks as MODEL_REGISTRY_SNAPSHOT,Jr as NODE_CATALOG,L as NodeType,$r as OUT_VAR_NAME_RE,Es as PRESET_PARAM_KEYS,Ps as REASONING_EFFORT_LEVELS,js as TENANT_ONLY_NODES,jn as TOOL_REGISTRY_SNAPSHOT,ut as TRIGGER_NONCE_HEADER,ct as TRIGGER_SIGNATURE_HEADER,oa as TRIGGER_SIGNATURE_TOLERANCE_SECONDS,dt as TRIGGER_TENANT_HEADER,lt as TRIGGER_TIMESTAMP_HEADER,cn as VariableResolutionError,Hr as WEB_ACTIONS_DEFAULTS,jr as WEB_ACTIONS_LIMITS,qr as WEB_ACTION_EXTRACT_AS,Gr as WEB_ACTION_LOCATOR_KINDS,Wr as WEB_ACTION_OPS,Xr as WEB_ACTION_SELECT_MATCH,zt as WEB_SESSION_IDLE_TTL_MS,kr as WORKER_GRAPH_DEFS,Ar as WORKER_GRAPH_SCHEMA,br as WORKER_OP_SCHEMA,Fn as WORKER_TEMPLATES,ot as WebSessionDO,ks as applyPresetToOverrides,$n as applyWorkerOps,Ea as artifactAgentProxy,Jn as assertHttpUrl,Yn as assertPublicHttpUrl,Qn as budgetTimeout,fs as buildClefRequest,Pr as buildCrawlRequestBody,Ke as buildReasoningProviderOptions,en as buildScope,aa as buildSignedTriggerHeaders,Te as buildTriggerMessageText,fr as buildUrl,Mn as canonicalGraph,Yt as canonicalUserEmail,_e as capMemoryContent,N as claimRun,ws as classifierErrorResult,Tr as classifierHandle,Hn as classifierIdFromLabel,Cn as classifyIssues,is as classifySiteBlock,K as clearAllMessages,gs as clefTruncationWarning,ts as clipExtract,An as collectExternalRefs,Tn as collectNodeRefs,j as completeRun,ur as convertTempMessure,Nr as crawlRequestKey,B as createRun,Yr as defaultNodeData,xs as deriveParamSupport,Ln as detectInlineCredentials,as as detectSiteBlock,ps as detectWebSession,Dn as diffGraphs,at as dispatchTrigger,Pn as edgeId,yr as embedText,Kn as enabledComposioSlugs,Ge as ensureAgentTables,Et as ensureMessagesTable,ms as estimateClefTokens,xn as estimateTokens,dn as extractOutVarValues,gn as extractTemplateReferences,Ne as extractUserKeypoints,tn as findScopedSourceNode,Vr as firstTargetStep,yt as forwardToAgentFlow,v as getAllMessages,Zr as getAncestorNodeIds,Lr as getDefaultOutVars,Kr as getEffectiveOutVars,xe as getFlowInputDefs,Hs as getModelEntry,rn as getRefTail,Qr as getUpstreamOutVars,Ra as handleAgentsRoutes,ba as handleAuthRoutes,ea as handleCommonRoutes,Ta as handleIntancesRoutes,or as handlePersistedSessionInspection,sr as handleSessionRunControl,gt as handleTriggerRoutes,gr as hashText,M as initializeEngineState,Gs as inspectWebPage,Bn as installWebNavigationGuard,nn as isBinaryOutVar,sn as isJsonContentType,Ws as isNodeTypeAllowedForTenant,Ue as isStartMemoryEnabled,On as issueFingerprint,Gn as jsonSchemaToZod,Ie as logc,Pe as looksLikeTranscript,Ce as memoryGenerationMaxTokens,F as memoryMdLineLimit,be as memoryTokenLimit,Me as mergeKeypointMemory,I as messageTypes,bn as newExternalRefs,Nn as nextNodeId,es as normalizeActionError,er as normalizeDestination,bs as normalizeEffectiveParams,Sr as normalizeFlowInputs,$s as normalizeModelEntry,Ns as normalizeReasoning,Us as openAiReasoningParamSupport,_s as openAiStandardParamSupport,hs as parseClefResponse,q as parseCookies,In as parseMemoryLength,on as parsePayloadText,mn as parseTemplateExpression,Ae as parseUserAuth,ke as parseUserMessage,Ur as parseWorkerGraph,vr as parseWorkerOps,As as pickNodeOverrides,an as readFetchPayload,Ms as reasoningEffortLevels,Ds as reasoningExposable,Xe as recordRun,zn as redact,Zn as redactedHost,Ls as registerProvider,Wn as resolveAnswerMappings,He as resolveModelById,fn as resolveOutVarRef,un as resolveOutVarValue,Ts as resolvePreset,Fe as resolveReasoningEffort,pn as resolveReference,qe as resolveRunUserId,ns as resolveTarget,hn as resolveTemplate,kn as rewriteNodeDataRefs,yn as rewriteTemplateNodeRefs,D as runAgentTurn,ys as runClef,Dr as runCrawl,ls as runWebActionSteps,pr as safeParseJSON,J as sanitizeMemoryDocument,P as sanitizeUserIdentity,_r as schemaErrors,Ss as selectClefHistory,Qe as sendEvent,k as serverSend,We as setMessage,Mr as shapeCrawlOutput,ft as signTriggerMaterial,je as startEngine,Oe as startMemoryLength,ve as startMemoryModel,Cs as stripUnsupportedFromNodeData,ds as targetPresent,dr as tempTool,tr as timingSafeEqualHex,rs as toLocator,Le as toStreamTextSettings,os as trackWebActivity,pt as triggerSignatureMaterial,Vn as truncateForEvent,mr as twitter,vn as validateAuthoring,Br as validateClassifierData,Vo as validateFlowStart,Un as validateFlowStructure,Fr as validateOutVars,zr as validateWebActionsData,hr as vectorize,cs as vendorFromCookieNames,Bt as verifyToken,mt as verifyTriggerRequest,O as verifyUser,ln as walkPath,us as webSessionKey,ss as withinWebDeadline,Os as workersAiParamSupport,vs as xaiParamSupport};
+-----END PUBLIC KEY-----`,n=await an(r,"RS256");try{let{payload:s,protectedHeader:a}=await cn(e,n);return{ok:!0,payload:s,protectedHeader:a}}catch(s){return console.error("JWT verification failed:",s),{ok:!1,payload:null,protectedHeader:null}}}async function ga(t,e,r){let n=new URL(t.url);if(n.pathname==="/favicon.ico")return new Response(null,{status:204});if(n.pathname.startsWith("/.well-known/appspecific"))return new Response(null,{status:204})}import{getAgentByName as z}from"agents";import{getAgentByName as dn}from"agents";async function pt(t,e){let r=e.sessionId||e.runAsUserId,n=e.inputs||{},s=e.runId;if(!s){let c=await Z(t,{tenant:e.tenant,flowId:e.flowId,userId:e.runAsUserId,sessionId:r,triggerId:e.triggerId,triggerKind:e.triggerKind,invocationMode:e.invocationMode,activationId:e.activationId,deliveryId:void 0,externalDeliveryId:e.externalDeliveryId,correlationKey:e.correlationKey,inputs:n,label:e.label});if(!c)return{status:"error",error:"Failed to register run"};if(!c.created&&c.run.status!=="queued")return{status:"deduped",runId:c.run.id};s=c.run.id}let a={...e,sessionId:r,runId:s,inputs:n},i=await(await dn(t.AGENT,`${e.flowId}::${r}`)).enqueueTrigger(a);return i.duplicate?{status:"deduped",runId:s}:i.queued?{status:"queued",runId:s,activation:a,taskId:i.taskId}:{status:"error",error:"Failed to queue trigger"}}var gt="x-ora-signature",yt="x-ora-timestamp",ht="x-ora-nonce",wt="x-ora-tenant",Ra=300,ft=new TextEncoder;function mn(t){return[...new Uint8Array(t)].map(e=>e.toString(16).padStart(2,"0")).join("")}function pn(t){try{let e=new URL(t);return`${e.origin}${e.pathname.replace(/\/$/,"")}`}catch{return t.replace(/\/$/,"")}}function St(t){return["v1",t.timestamp,t.nonce,t.tenant,pn(t.destination),t.body].join(`
+`)}async function Rt(t,e){let r=await crypto.subtle.importKey("raw",ft.encode(t),{name:"HMAC",hash:"SHA-256"},!1,["sign"]);return mn(await crypto.subtle.sign("HMAC",r,ft.encode(e)))}function fn(t,e){if(t.length!==e.length)return!1;let r=0;for(let n=0;n<t.length;n++)r|=t.charCodeAt(n)^e.charCodeAt(n);return r===0}async function Ea(t){let e=String(t.timestamp??Math.floor(Date.now()/1e3)),r=await Rt(t.secret,St({timestamp:e,nonce:t.nonce,tenant:t.tenant,destination:t.destination,body:t.body}));return{"content-type":"application/json",[wt]:t.tenant,[yt]:e,[ht]:t.nonce,[gt]:`v1=${r}`}}async function Et(t){var u,l,m,g,p;if(!((u=t.secret)!=null&&u.trim()))return{ok:!1,error:"HX_API_KEY is not configured"};let e=(l=t.headers.get(wt))==null?void 0:l.trim(),r=(m=t.headers.get(yt))==null?void 0:m.trim(),n=(g=t.headers.get(ht))==null?void 0:g.trim(),s=(p=t.headers.get(gt))==null?void 0:p.trim();if(!e||!r||!n||!s)return{ok:!1,error:"missing signature headers"};if(!s.startsWith("v1="))return{ok:!1,error:"unsupported signature version"};let a=Number(r);if(!Number.isFinite(a))return{ok:!1,error:"invalid timestamp"};let o=Math.floor((t.now??Date.now())/1e3),i=t.toleranceSeconds??300;if(Math.abs(o-a)>i)return{ok:!1,error:"stale timestamp"};let c=await Rt(t.secret.trim(),St({timestamp:r,nonce:n,tenant:e,destination:t.url,body:t.body}));return fn(s.slice(3),c)?{ok:!0,tenant:e,nonce:n,timestamp:a}:{ok:!1,error:"signature mismatch"}}var b=(t,e=200)=>new Response(JSON.stringify(t),{status:e,headers:{"content-type":"application/json"}});async function Tt(t,e,r){var u;if(new URL(t.url).pathname!=="/api/triggers/dispatch")return;if(t.method!=="POST")return b({error:"Method not allowed"},405);let s=await t.text(),a=await Et({secret:e.HX_API_KEY,body:s,url:t.url,headers:t.headers});if(!a.ok)return console.warn(`[triggers] rejected dispatch: ${a.error}`),b({error:"Invalid signature"},401);let o;try{o=JSON.parse(s)}catch{return b({error:"Invalid payload"},400)}if(!(o!=null&&o.runId)||!(o!=null&&o.flowId)||!(o!=null&&o.runAsUserId)||!(o!=null&&o.tenant)||!(o!=null&&o.activationId)||!(o!=null&&o.triggerId)||!(o!=null&&o.triggerKind)||!(o!=null&&o.invocationMode))return b({error:"activationId, triggerId, triggerKind, invocationMode, runId, flowId, runAsUserId and tenant are required"},400);if(o.tenant!==a.tenant)return b({error:"Tenant mismatch"},403);let i;try{i=await U(o.flowId,e)}catch{return b({error:"Flow not found"},404)}if(!((u=i==null?void 0:i.metadata)!=null&&u.tenant)||i.metadata.tenant!==o.tenant)return console.warn(`[triggers] flow ${o.flowId} does not belong to tenant ${o.tenant}`),b({error:"Tenant mismatch"},403);let c=await pt(e,{...o,sessionId:o.sessionId||o.runAsUserId,nonce:a.nonce});return c.status==="error"?b({error:c.error},502):c.status==="deduped"?b({deduped:!0,runId:c.runId},200):b({accepted:!0,runId:c.runId,taskId:c.taskId},202)}var oe=/^[A-Za-z0-9_-]{1,64}$/;async function ae(t,e,r,n,s,a=!1){let o=(g,p)=>({response:new Response(g,{status:p})});if(!/^[A-Za-z0-9_-]+$/.test(n))return o("Invalid flowId",400);if((!a||s)&&(!s||!oe.test(s)))return o("Invalid sessionId",400);let i;try{i=await U(n,e)}catch{return o("Flow not found",404)}let c=i==null?void 0:i.metadata;if(!c||!["active","activo"].includes(c.status))return o("Flow not found",404);if(!e.TENANT||c.tenant!==e.TENANT)return o("Forbidden",403);let u=await P(t,e,r),l=u&&typeof u=="object"?u:void 0;if(l&&l.tenant!==e.TENANT)return o("Forbidden",403);if(c.visibility==="public")return{user:l};if(!l){if(!a)return o("Unauthorized",401);let g=new URL(t.url),p=new URL("/login",g.origin);return p.searchParams.set("nextURL",`${g.pathname}${g.search}`),{response:Response.redirect(p.toString(),302)}}if((c.org||"default")!==(l.org||"default"))return o("Forbidden",403);let m=q(t.headers.get("cookie")).access_token||new URL(t.url).searchParams.get("access_token");if(!m)return o("Unauthorized",401);try{let g=await fetch(`${e.HX_CORE_URL}/flows/${encodeURIComponent(n)}`,{headers:{Authorization:m},cache:"no-store"});if(!g.ok||(await g.json()).id!==n)return o("Forbidden",403)}catch{return o("Forbidden",403)}return{user:l}}var gn=/^[A-Za-z0-9_-]+$/,yn=new Set(["state","messages","memory"]);async function hn(t,e){let r=new URL(t.url);if(!r.pathname.startsWith("/api/internal/sessions/"))return;let n=r.pathname.split("/");if(n[6]!=="runs"||n[8]!=="stop"||n.length!==9)return;if(t.method!=="POST")return new Response("Method not allowed",{status:405});if(!e.HX_API_KEY||t.headers.get("Authorization")!==e.HX_API_KEY)return new Response("Unauthorized",{status:401});let s=decodeURIComponent(n[4]||""),a=decodeURIComponent(n[5]||""),o=decodeURIComponent(n[7]||"");if(!s||!a||!o)return new Response("Not found",{status:404});try{let i=await z(e.AGENT,`${s}::${a}`);return Response.json(await i.requestRunStop(o))}catch(i){return console.error("[agents] failed to request run stop",i),Response.json({error:"Failed to stop run"},{status:502})}}async function wn(t,e){let r=new URL(t.url);if(!r.pathname.startsWith("/api/internal/sessions/"))return;if(t.method!=="GET")return new Response("Method not allowed",{status:405});let n=t.headers.get("Authorization")||"";if(!e.HX_API_KEY||n!==e.HX_API_KEY)return new Response("Unauthorized",{status:401});let s=r.pathname.split("/"),a=decodeURIComponent(s[4]||""),o=decodeURIComponent(s[5]||""),i=s[6];if(!a||!o||!i||!yn.has(i))return new Response("Not found",{status:404});try{let u=await(await z(e.AGENT,`${a}::${o}`)).inspectPersistedSession(i);return Response.json(u)}catch(c){return console.error("[agents] failed to inspect persisted session",c),Response.json({error:"Failed to inspect persisted session"},{status:502})}}async function Na(t,e,r){var i,c;let n=new URL(t.url),s=await Tt(t,e,r);if(s instanceof Response)return s;let a=await hn(t,e);if(a instanceof Response)return a;let o=await wn(t,e);if(o instanceof Response)return o;if(n.pathname.startsWith("/a/")){let u=n.pathname.split("/"),l=u[2],m=u[3];try{if(!l)return Response.redirect(new URL("/",n.origin).toString(),302);let g=await ae(t,e,r,l,m,!0);if(g.response)return g.response;if(!m){let p=crypto.randomUUID(),y=new URL(`/a/${l}/${p}`,n.origin);return Response.redirect(y.toString(),302)}}catch(g){return console.error("Error accessing flow KV:",g),new Response("Flow error",{status:500})}}if(n.pathname.startsWith("/api/agent/flow/")){let u=n.pathname.split("/"),l=u[4],m=u[5];return It(t,e,r,l,m)}if(n.pathname.startsWith("/api/ora/connect")){let u=n.pathname.split("/"),l=u[4],m=u[5];if(!l||!m)return new Response("Missing flowId or sessionId",{status:400});let g=t.headers.get("Authorization")||n.searchParams.get("authorization");if(!g)return new Response("Missing Authorization header",{status:401});try{let p=`${e.HX_CORE_URL}/p/v1/validation/key/agent/${l}`,f=await(await fetch(p,{method:"GET",headers:{Authorization:g}})).json();if(((i=f.payload)==null?void 0:i.flowId)!==l)return console.error("FlowId mismatch:",(c=f.payload)==null?void 0:c.flowId,"!==",l),new Response("Validation error",{status:403});let h=`${l}::${m}`,S=await P(t,e,r);if(!S){let L=new URL(t.url).searchParams.has("access_token");console.warn(`[agents] Unauthenticated agent socket upgrade (access_token query=${L}) \u2014 Composio connections from tool editor will not apply`)}let R=new Headers(t.headers);R.delete("X-User-Payload"),S&&R.set("X-User-Payload",JSON.stringify(S));let I=new Request(t,{headers:R});return(await z(e.AGENT,h)).fetch(I)}catch(p){return console.error("Error in /api/ora/connect:",p),new Response("Internal error",{status:500})}}}async function It(t,e,r,n,s){let a=`${n}::${s}`;try{let o=await ae(t,e,r,n,s);if(o.response)return o.response;let i=o.user,c=new Headers(t.headers);c.delete("X-User-Payload"),i&&c.set("X-User-Payload",JSON.stringify(i));let u=new Request(t,{headers:c});return(await z(e.AGENT,a)).fetch(u)}catch(o){return console.error("Error accessing agent:",o),new Response("Agent error",{status:500})}}var Da=async(t,e,r,n)=>{if(!(n!=null&&n.flowId)||!gn.test(n.flowId)||!(n!=null&&n.sessionId)||!oe.test(n.sessionId))return new Response("Not found",{status:404});let s=new URL(`/api/agent/flow/${n.flowId}/${n.sessionId}`,t.url),a=new Headers;for(let[c,u]of t.headers.entries())c.toLowerCase().startsWith("x-")||a.append(c,u);let o={method:t.method,headers:a};t.body&&t.method!=="GET"&&t.method!=="HEAD"&&(o.body=t.body,o.duplex="half");let i=new Request(s.toString(),o);return It(i,e,r,n.flowId,n.sessionId)};async function Fa(t,e,r){let n=new URL(t.url),s=t.method;if(!n.pathname.startsWith("/api/instances"))return;let a=await P(t,e,r);if(!a)return new Response("Unauthorized",{status:401});let o=e.HX_CORE_URL,i=e.HX_API_KEY;if(!o||!i)return console.error("Missing configuration: HX_CORE_URL or HX_API_KEY"),new Response("Internal Server Error",{status:500});let u=n.pathname.slice("/api/instances".length);u.startsWith("/")&&(u=u.slice(1)),u.endsWith("/")&&(u=u.slice(0,-1));let l="/ora/instances";u&&(l+=`/${u}`);let m=o.endsWith("/")?o.slice(0,-1):o,g=new URL(`${m}${l}`);n.searchParams.forEach((f,h)=>{g.searchParams.set(h,f)}),s==="GET"&&!u&&g.searchParams.set("filter_user_id",a.email);let p=new Headers;p.set("Authorization",i),p.set("Content-Type","application/json"),p.set("X-User-Payload",JSON.stringify(a));let y={method:s,headers:p};if(["POST","PATCH","PUT"].includes(s))try{y.body=await t.text()}catch(f){console.error("Error reading request body:",f)}try{let f=await fetch(g.toString(),y),h=await f.text();return new Response(h,{status:f.status,headers:{"Content-Type":"application/json"}})}catch(f){return console.error("Error proxying to flow instance backend:",f),new Response("Internal Server Error",{status:500})}}async function Ka(t,e,r){let n=new URL(t.url);if(t.method==="POST"&&n.pathname==="/auth/login")try{let s=await t.formData(),a=s.get("username"),o=s.get("password"),i=s.get("nextURL")||"/";if(!a||!o)return new Response("Missing username or password",{status:400});let c=new URLSearchParams;c.append("username",a),c.append("password",o),c.append("grant_type","password"),c.append("client_id",e.KC_CLIENT_ID),c.append("client_secret",e.KC_CLIENT_SECRET);let u=await fetch(`${e.KC_BASE_URL}/protocol/openid-connect/token`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Cookie:"hxsecure=1"},body:c});if(!u.ok)return new Response("Unauthorized",{status:401});let l=await u.json(),m=new Response(null,{status:302,headers:{Location:i}}),p=n.protocol==="https:"?"; Secure":"",y=(f,h,S)=>{m.headers.append("Set-Cookie",`${f}=${h}; Path=/; HttpOnly${p}; SameSite=Lax; Max-Age=${S}`)};return l.access_token&&y("access_token",l.access_token,l.expires_in),l.refresh_token&&y("refresh_token",l.refresh_token,l.refresh_expires_in||3600*24*30),l.id_token&&y("id_token",l.id_token,l.expires_in),m}catch(s){return console.error("Auth error:",s),new Response("Internal Server Error",{status:500})}if(n.pathname==="/auth/logout"){let s=new Response(null,{status:302,headers:{Location:"/login"}}),a=o=>{s.headers.append("Set-Cookie",`${o}=; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=0`)};return a("access_token"),a("refresh_token"),a("id_token"),s}if(n.pathname.startsWith("/s/")){let s=await P(t,e,r);if(!s){let a=new URL("/login",n.origin);return a.searchParams.set("nextURL",`${n.pathname}${n.search}`),Response.redirect(a.toString(),302)}return{user:s}}}import{WorkerEntrypoint as Sn}from"cloudflare:workers";import{getAgentByName as Rn}from"agents";var En=/^[A-Za-z0-9_-]+$/,Tn=/^art-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,xt=class extends Sn{async ask(e,r){var n,s,a,o;try{if(!e||typeof e!="string"||!En.test(e))throw console.error("[ArtifactWorkerGateway] invalid flowId:",e),new Error("Artifact worker request failed");if(!r||typeof r.message!="string")throw console.error("[ArtifactWorkerGateway] invalid input: message is required"),new Error("Artifact worker request failed");let i;if(r.sessionId!==void 0){if(typeof r.sessionId!="string"||!Tn.test(r.sessionId))throw console.error("[ArtifactWorkerGateway] invalid sessionId:",r.sessionId),new Error("Artifact worker request failed");i=r.sessionId}else i=`art-${crypto.randomUUID()}`;let c=(s=(n=this.ctx)==null?void 0:n.props)==null?void 0:s.slug,u=(o=(a=this.ctx)==null?void 0:a.props)==null?void 0:o.artifactUuid;if(!c||!u)throw console.error("[ArtifactWorkerGateway] missing slug or artifactUuid in gateway context props"),new Error("Artifact worker request failed");let l=this.env.ARTIFACT;if(!l)throw console.error("[ArtifactWorkerGateway] ARTIFACT binding not configured"),new Error("Artifact worker request failed");let m=l.idFromName(c),p=await l.get(m).allowsWorker({flowId:e,mode:"server",artifactUuid:u});if(!(p!=null&&p.ok))throw console.error(`[ArtifactWorkerGateway] grant check failed for flow ${e} on artifact ${c}`),new Error("Artifact worker request failed");let y=await Rn(this.env.AGENT,`${e}::${i}`),f={message:r.message};r.inputs&&typeof r.inputs=="object"&&(f.inputs=r.inputs);let h=new Request("http://localhost/message",{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(f)}),S=await y.fetch(h);if(!S.ok)throw console.error(`[ArtifactWorkerGateway] agent returned status ${S.status}`),new Error("Artifact worker request failed");let R=await S.json();return{text:typeof(R==null?void 0:R.answer)=="string"?R.answer:"",sessionId:i}}catch(i){throw(i==null?void 0:i.message)==="Artifact worker request failed"?i:(console.error("[ArtifactWorkerGateway] unexpected error in ask:",i),new Error("Artifact worker request failed"))}}};export{Ut as ANONYMOUS_RUN_USER_PREFIX,dt as AgentDO,xt as ArtifactWorkerGateway,Nn as CLASSIFIER_DEFAULTS,Dn as CLASSIFIER_RESERVED_HANDLES,Cn as CLEF_MODELS,Gn as CRAWL_DEFAULTS,Xn as CRAWL_LIMITS,vr as DEFAULT_MEMORY_LENGTH,Mr as DEFAULT_MEMORY_MODEL,ss as EVENT_PREVIEW_BYTES,rs as EXTRACT_MAX_CHARS,Pn as FLOW_INPUT_NAME_RE,Bs as FlowExecutionStoppedError,vs as GENERATION_PARAM_KEYS,Cs as GENERATION_PRESETS,jr as ISSUE_SEVERITY,Mn as MAX_USER_IDENTITY_LENGTH,Or as MEMORY_LENGTH_MD_LINES,Pr as MEMORY_LENGTH_TOKENS,Zs as MODEL_REGISTRY_SNAPSHOT,cr as NODE_CATALOG,F as NodeType,Yn as OUT_VAR_NAME_RE,Ms as PRESET_PARAM_KEYS,Xs as REASONING_EFFORT_LEVELS,eo as TENANT_ONLY_NODES,es as TOOL_REGISTRY_SNAPSHOT,ht as TRIGGER_NONCE_HEADER,gt as TRIGGER_SIGNATURE_HEADER,Ra as TRIGGER_SIGNATURE_TOLERANCE_SECONDS,wt as TRIGGER_TENANT_HEADER,yt as TRIGGER_TIMESTAMP_HEADER,Rr as VariableResolutionError,er as WEB_ACTIONS_DEFAULTS,tr as WEB_ACTIONS_LIMITS,sr as WEB_ACTION_EXTRACT_AS,rr as WEB_ACTION_LOCATOR_KINDS,nr as WEB_ACTION_OPS,or as WEB_ACTION_SELECT_MATCH,on as WEB_SESSION_IDLE_TTL_MS,Ln as WORKER_GRAPH_DEFS,Fn as WORKER_GRAPH_SCHEMA,jn as WORKER_OP_SCHEMA,Br as WORKER_TEMPLATES,mt as WebSessionDO,$s as applyPresetToOverrides,Jr as applyWorkerOps,Da as artifactAgentProxy,is as assertHttpUrl,cs as assertPublicHttpUrl,ds as budgetTimeout,As as buildClefRequest,qn as buildCrawlRequestBody,Ke as buildReasoningProviderOptions,pr as buildScope,Ea as buildSignedTriggerHeaders,ke as buildTriggerMessageText,kn as buildUrl,zr as canonicalGraph,un as canonicalUserEmail,Oe as capMemoryContent,C as claimRun,Os as classifierErrorResult,$n as classifierHandle,Qr as classifierIdFromLabel,Gr as classifyIssues,Ss as classifySiteBlock,H as clearAllMessages,bs as clefTruncationWarning,ps as clipExtract,Lr as collectExternalRefs,Dr as collectNodeRefs,W as completeRun,In as convertTempMessure,zn as crawlRequestKey,Z as createRun,ur as defaultNodeData,Ns as deriveParamSupport,Yr as detectInlineCredentials,ws as detectSiteBlock,xs as detectWebSession,Vr as diffGraphs,pt as dispatchTrigger,Xr as edgeId,Un as embedText,Zr as enabledComposioSlugs,qe as ensureAgentTables,_t as ensureMessagesTable,ks as estimateClefTokens,Nr as estimateTokens,Ir as extractOutVarValues,br as extractTemplateReferences,De as extractUserKeypoints,fr as findScopedSourceNode,ir as firstTargetStep,It as forwardToAgentFlow,O as getAllMessages,dr as getAncestorNodeIds,Bn as getDefaultOutVars,Qn as getEffectiveOutVars,Ae as getFlowInputDefs,Qs as getModelEntry,gr as getRefTail,mr as getUpstreamOutVars,Na as handleAgentsRoutes,Ka as handleAuthRoutes,ga as handleCommonRoutes,Fa as handleIntancesRoutes,wn as handlePersistedSessionInspection,hn as handleSessionRunControl,Tt as handleTriggerRoutes,_n as hashText,D as initializeEngineState,no as inspectWebPage,us as installWebNavigationGuard,yr as isBinaryOutVar,hr as isJsonContentType,to as isNodeTypeAllowedForTenant,Pe as isStartMemoryEnabled,Wr as issueFingerprint,ns as jsonSchemaToZod,xe as logc,Ne as looksLikeTranscript,Ce as memoryGenerationMaxTokens,j as memoryMdLineLimit,Ue as memoryTokenLimit,$e as mergeKeypointMemory,T as messageTypes,Fr as newExternalRefs,qr as nextNodeId,ms as normalizeActionError,pn as normalizeDestination,Fs as normalizeEffectiveParams,vn as normalizeFlowInputs,Js as normalizeModelEntry,qs as normalizeReasoning,Hs as openAiReasoningParamSupport,js as openAiStandardParamSupport,Us as parseClefResponse,q as parseCookies,Cr as parseMemoryLength,wr as parsePayloadText,kr as parseTemplateExpression,_e as parseUserAuth,be as parseUserMessage,Kn as parseWorkerGraph,Wn as parseWorkerOps,Ls as pickNodeOverrides,Sr as readFetchPayload,zs as reasoningEffortLevels,Vs as reasoningExposable,Ve as recordRun,os as redact,ls as redactedHost,Ys as registerProvider,ts as resolveAnswerMappings,We as resolveModelById,Ar as resolveOutVarRef,Tr as resolveOutVarValue,Ds as resolvePreset,He as resolveReasoningEffort,xr as resolveReference,ze as resolveRunUserId,gs as resolveTarget,Ur as resolveTemplate,$r as rewriteNodeDataRefs,_r as rewriteTemplateNodeRefs,$ as runAgentTurn,_s as runClef,Jn as runCrawl,Es as runWebActionSteps,An as safeParseJSON,Y as sanitizeMemoryDocument,M as sanitizeUserIdentity,Hn as schemaErrors,Ps as selectClefHistory,tt as sendEvent,k as serverSend,Xe as setMessage,Vn as shapeCrawlOutput,Rt as signTriggerMaterial,Ge as startEngine,Me as startMemoryLength,ve as startMemoryModel,Gs as stripUnsupportedFromNodeData,Is as targetPresent,xn as tempTool,fn as timingSafeEqualHex,fs as toLocator,je as toStreamTextSettings,hs as trackWebActivity,St as triggerSignatureMaterial,as as truncateForEvent,bn as twitter,Kr as validateAuthoring,lr as validateClassifierData,ua as validateFlowStart,Hr as validateFlowStructure,Zn as validateOutVars,ar as validateWebActionsData,On as vectorize,Rs as vendorFromCookieNames,ln as verifyToken,Et as verifyTriggerRequest,P as verifyUser,Er as walkPath,Ts as webSessionKey,ys as withinWebDeadline,Ws as workersAiParamSupport,Ks as xaiParamSupport};

package/dist/server/core/turnAttachments.d.ts

@@ -0,0 +1,43 @@
+import type { UserMessagePayload } from '../../common/types/ws-message';
+type ImageAttachment = NonNullable<UserMessagePayload['images']>[number];
+type DocumentAttachment = NonNullable<UserMessagePayload['documents']>[number];
+export declare const HTTP_ALLOWED_IMAGE_MIME_TYPES: readonly ['image/png', 'image/jpeg', 'image/webp', 'image/gif'];
+export declare const HTTP_MAX_IMAGES = 4;
+export declare const HTTP_MAX_DOCUMENTS = 4;
+/** Decoded bytes per attachment. */
+export declare const HTTP_MAX_ATTACHMENT_BYTES: number;
+export type TurnAttachmentsResult = {
+    ok: true;
+    images?: ImageAttachment[];
+    documents?: DocumentAttachment[];
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Validates `images` and `documents` from an HTTP turn body into the `UserMessagePayload`
+ * shape the WebSocket `M:` frame already carries. Absent or null fields are omitted.
+ */
+export declare function parseTurnAttachments(body: Record<string, unknown>): TurnAttachmentsResult;
+/** Log-safe view of attachments: mime type and decoded size only, never the data. */
+export declare function summarizeTurnAttachments(payload: Pick<UserMessagePayload, 'images' | 'documents'>): {
+    images: {
+        mimeType: string;
+        bytes: number;
+    }[];
+    documents: {
+        mimeType: string;
+        bytes: number;
+    }[];
+};
+/**
+ * Copy of the engine state without image base64, for `agent.setState` and stored turn events.
+ * The Agent state is one SQLite row (~2 MB cap) and images would land there twice
+ * (`context.user_images` and the Start result). The running turn keeps its in-memory copy,
+ * so only later turns lose the bytes; Start refills both on every turn.
+ */
+export declare function withoutTurnImages<T extends {
+    context?: Record<string, any>;
+    results?: Record<string, any>;
+}>(state: T): T;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hugex/ai",
-  "version": "3.4.2",
+  "version": "3.4.4",
   "description": "Ora AI Agent Framework",
   "author": "a@hugex.co",
   "license": "SEE LICENSE IN LICENSE",