@loopingai/core 0.3.0 → 0.4.0

package/dist/a2a/verify.d.ts

@@ -1,47 +1,39 @@
 import { type JWTPayload } from "jose";
+import { type GatewayIdentity } from "@loopingai/a2a-protocol";
 /**
- * Default namespaced claim carrying the minimal caller identity.
+ * Verify the gateway identity JWT (the "B authenticates A" half of zero-trust).
  *
- * Overridable via {@link VerifyOptions.identityClaim} for a deployment that
- * isn't behind looping-gateway; the default is the Looping namespace so an
- * agent built on this package needs no configuration to interoperate.
- */
-export declare const IDENTITY_CLAIM = "https://loopingai.org/identity";
-/**
- * Default namespaced claim naming the **tenant** the gateway minted this token
- * for — which of the agents on this origin it authorizes the call to reach.
+ * The gateway signs a short-lived EdDSA JWT and sends it as a Bearer token on
+ * every A2A call. Per RFC 7515 §4.1.2 it embeds a `jku` header pointing at its
+ * public JWKS, so remote agents don't need a separately configured JWKS URL —
+ * they read `jku` straight from the token and verify the key from there.
+ *
+ * Security: the `jku` origin is validated against the allowed origins before
+ * fetching, preventing key-injection attacks (an attacker cannot point `jku` at
+ * their own JWKS and have it accepted).
  *
- * Several agents share one endpoint, so they also share an `aud`: the audience
- * proves the token was minted for *this deployment*, and can say nothing about
- * which agent on it. This claim is the only thing that can, which is why the
- * Worker refuses a token that omits it rather than falling back to a default.
- * Without it `tenant` would be an unauthenticated field in the request body,
- * and a token legitimately issued for one agent could be replayed against any
- * of its siblings.
+ * **This file is a guardian.** The four checks below — `jku` present → origin
+ * allowlist → `iss` origin equals `jku` origin → `jwtVerify` pinned to EdDSA —
+ * are the whole zero-trust contract, and they arrived here byte-identical from
+ * two independently-evolved agents. Do not weaken any of them, do not make any
+ * of them optional, and do not add a bypass for local development: run a local
+ * gateway instead.
  */
-export declare const TENANT_CLAIM = "https://loopingai.org/tenant";
 /**
- * The gateway-agent instance identity forwarded by the gateway — i.e. which
- * registered agent instance dispatched this call, not the human end user.
- * Mirrors `RemoteIdentity` in looping-gateway's `src/auth/agent-jwt.ts`.
+ * The wire contract — claim names, algorithm, identity shape — comes from
+ * `@loopingai/a2a-protocol`, which the gateway also depends on directly.
  *
- * Any end user travels unverified, inline in the message text; the gateway
- * deliberately excludes it from this signed claim so a remote agent cannot read
- * the full caller auth context. Every field is optional because the claim is
- * whatever the issuer put there — {@link GatewayIdentity.key} is the only one
- * anything downstream depends on, and a caller without it is rejected before a
- * DO is ever addressed.
+ * It used to be declared here and again in the gateway, each with a comment
+ * saying it must match the other, because the gateway is not an agent and must
+ * not import this package. That failed exactly as it always does: one side
+ * moved to the `loopingai.org` namespace while the other still minted
+ * `https://looping.ai/tenant`, verification read an empty tenant, and every
+ * request 401'd with both builds green.
+ *
+ * Re-exported below so nothing downstream of `@loopingai/core/a2a` has to know
+ * the split happened — an agent still imports these from here.
  */
-export interface GatewayIdentity {
-    /** Canonical instance key, e.g. `custom:7:analytics`. */
-    key?: string;
-    /** Registry name of the logical agent instance. */
-    name?: string;
-    /** Dispatch kind of the caller (`"custom"` for remote agents). */
-    kind?: string;
-    /** Workspace the calling agent instance belongs to. */
-    workspaceId?: number | null;
-}
+export { IDENTITY_CLAIM, TENANT_CLAIM, type GatewayIdentity } from "@loopingai/a2a-protocol";
 /** Thrown when a gateway token is missing or fails verification. */
 export declare class GatewayAuthError extends Error {
     constructor(message: string);

package/dist/a2a/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AAyBd;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,mCAAmC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,iCAAiC,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oEAAoE;AACpE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAcD,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAenE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IACT,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CA8CD"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AACd,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAEjC,oEAAoE;AACpE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAcD,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAenE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IACT,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAgDD"}

package/dist/a2a/verify.js

@@ -1,4 +1,5 @@
 import { createRemoteJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
+import { A2A_JWS_ALG, readIdentityClaim, readTenantClaim } from "@loopingai/a2a-protocol";
 /**
  * Verify the gateway identity JWT (the "B authenticates A" half of zero-trust).
  *
@@ -18,29 +19,21 @@ import { createRemoteJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from
  * of them optional, and do not add a bypass for local development: run a local
  * gateway instead.
  */
-/** Algorithm the gateway signs with — reject anything else. */
-const ALG = "EdDSA";
 /**
- * Default namespaced claim carrying the minimal caller identity.
+ * The wire contract — claim names, algorithm, identity shape — comes from
+ * `@loopingai/a2a-protocol`, which the gateway also depends on directly.
  *
- * Overridable via {@link VerifyOptions.identityClaim} for a deployment that
- * isn't behind looping-gateway; the default is the Looping namespace so an
- * agent built on this package needs no configuration to interoperate.
- */
-export const IDENTITY_CLAIM = "https://loopingai.org/identity";
-/**
- * Default namespaced claim naming the **tenant** the gateway minted this token
- * for — which of the agents on this origin it authorizes the call to reach.
+ * It used to be declared here and again in the gateway, each with a comment
+ * saying it must match the other, because the gateway is not an agent and must
+ * not import this package. That failed exactly as it always does: one side
+ * moved to the `loopingai.org` namespace while the other still minted
+ * `https://looping.ai/tenant`, verification read an empty tenant, and every
+ * request 401'd with both builds green.
  *
- * Several agents share one endpoint, so they also share an `aud`: the audience
- * proves the token was minted for *this deployment*, and can say nothing about
- * which agent on it. This claim is the only thing that can, which is why the
- * Worker refuses a token that omits it rather than falling back to a default.
- * Without it `tenant` would be an unauthenticated field in the request body,
- * and a token legitimately issued for one agent could be replayed against any
- * of its siblings.
+ * Re-exported below so nothing downstream of `@loopingai/core/a2a` has to know
+ * the split happened — an agent still imports these from here.
  */
-export const TENANT_CLAIM = "https://loopingai.org/tenant";
+export { IDENTITY_CLAIM, TENANT_CLAIM } from "@loopingai/a2a-protocol";
 /** Thrown when a gateway token is missing or fails verification. */
 export class GatewayAuthError extends Error {
     constructor(message) {
@@ -125,15 +118,17 @@ export async function verifyGatewayToken(token, opts) {
         const { payload } = await jwtVerify(token, jwksFor(jku), {
             issuer: allowedOrigins,
             audience: opts.audience,
-            algorithms: [ALG]
+            algorithms: [A2A_JWS_ALG]
         });
-        const claim = opts.identityClaim ?? IDENTITY_CLAIM;
-        const identity = payload[claim] ?? {};
-        const tenant = payload[opts.tenantClaim ?? TENANT_CLAIM];
+        // Read through the protocol package's readers rather than indexing the
+        // payload here: they are where "an absent or malformed claim yields an
+        // empty value, never a default" has its single implementation, and the
+        // emptiness is load-bearing — `createA2AWorker` compares the tenant against
+        // the one the request body addressed, and `""` matches none of them.
         return {
             payload,
-            identity,
-            tenant: typeof tenant === "string" ? tenant : ""
+            identity: readIdentityClaim(payload, opts.identityClaim),
+            tenant: readTenantClaim(payload, opts.tenantClaim)
         };
     }
     catch (err) {

package/dist/a2a/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,qBAAqB,EACrB,SAAS,EAEV,MAAM,MAAM,CAAC;AAEd;;;;;;;;;;;;;;;;;;GAkBG;AAEH,+DAA+D;AAC/D,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAyB3D,oEAAoE;AACpE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAC3E,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiB;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,MAAM,MAAM,OAAO,EAAE,CACzD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,IAAmB;IAMnB,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAqB,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gBAAgB,CACxB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,yCAAyC,CAClE,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,gCAAgC,SAAS,GAAG,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;YACvD,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,GAAG,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC;QACnD,MAAM,QAAQ,GAAI,OAAO,CAAC,KAAK,CAAiC,IAAI,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC;QACzD,OAAO;YACL,OAAO;YACP,QAAQ;YACR,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACjD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,MAAM,IAAI,gBAAgB,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,qBAAqB,EACrB,SAAS,EAEV,MAAM,MAAM,CAAC;AACd,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,eAAe,EAEhB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,cAAc,EACd,YAAY,EAEb,MAAM,yBAAyB,CAAC;AAEjC,oEAAoE;AACpE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAC3E,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiB;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,MAAM,MAAM,OAAO,EAAE,CACzD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,IAAmB;IAMnB,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAqB,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gBAAgB,CACxB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,yCAAyC,CAClE,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,gCAAgC,SAAS,GAAG,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;YACvD,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,WAAW,CAAC;SAC1B,CAAC,CAAC;QACH,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,4EAA4E;QAC5E,qEAAqE;QACrE,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC;YACxD,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC;SACnD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,MAAM,IAAI,gBAAgB,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/agent/index.d.ts

@@ -1,11 +1,22 @@
 /**
  * `@loopingai/core/agent` — the primitives a loop is built from.
  *
- * Core ships no loop. `turn.ts` / `loop.ts` are the agent's, because how a round
- * ends is the one thing every agent genuinely differs on. What core owns is
- * everything both predecessor loops needed identically: the session, the model
- * pair with its fallback, the budget, and the control-tool abstraction that
- * turns "the model called something that ends the round" into a checked value.
+ * The session, the model pair with its fallback, the budget, and the
+ * control-tool abstraction that turns "the model called something that ends the
+ * round" into a checked value. Everything both predecessor loops needed
+ * identically, and nothing about how a round is shaped.
+ *
+ * This subpath ships **no loop** — that is what makes it importable by one. A
+ * loop module needs these primitives without also pulling in a Durable Object
+ * base class and drizzle, which is why `LoopingAgent` lives in
+ * `@loopingai/core/host` and the delegating round loop in
+ * `@loopingai/core/round`.
+ *
+ * Core as a whole *does* now ship a loop, opt-in, in `/round`. The rule it
+ * still keeps is narrower and better: **core ships no prompt copy and no
+ * policy** — see `AGENTS.md`, "The line core does not cross". An agent that
+ * wants a different round shape imports none of `/round` and builds it from
+ * exactly what is here.
  */
 export { newTurnBudget, stepAllowance, type TurnBudget } from "./budget.js";
 export { createModelRuntime, type GatewayMetadata, type ModelOverrides, type ModelPair, type ModelRuntime, type ModelRuntimeDeps } from "./model.js";

package/dist/agent/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAClB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACf,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAClB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACf,MAAM,kBAAkB,CAAC"}

package/dist/agent/index.js

@@ -1,11 +1,22 @@
 /**
  * `@loopingai/core/agent` — the primitives a loop is built from.
  *
- * Core ships no loop. `turn.ts` / `loop.ts` are the agent's, because how a round
- * ends is the one thing every agent genuinely differs on. What core owns is
- * everything both predecessor loops needed identically: the session, the model
- * pair with its fallback, the budget, and the control-tool abstraction that
- * turns "the model called something that ends the round" into a checked value.
+ * The session, the model pair with its fallback, the budget, and the
+ * control-tool abstraction that turns "the model called something that ends the
+ * round" into a checked value. Everything both predecessor loops needed
+ * identically, and nothing about how a round is shaped.
+ *
+ * This subpath ships **no loop** — that is what makes it importable by one. A
+ * loop module needs these primitives without also pulling in a Durable Object
+ * base class and drizzle, which is why `LoopingAgent` lives in
+ * `@loopingai/core/host` and the delegating round loop in
+ * `@loopingai/core/round`.
+ *
+ * Core as a whole *does* now ship a loop, opt-in, in `/round`. The rule it
+ * still keeps is narrower and better: **core ships no prompt copy and no
+ * policy** — see `AGENTS.md`, "The line core does not cross". An agent that
+ * wants a different round shape imports none of `/round` and builds it from
+ * exactly what is here.
  */
 export { newTurnBudget, stepAllowance } from "./budget.js";
 export { createModelRuntime } from "./model.js";

package/dist/agent/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAmB,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAMnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EAIpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,eAAe,EAEhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAEnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EAGf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACf,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAmB,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAMnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EAIpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,eAAe,EAEhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAEnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EAGf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACf,MAAM,kBAAkB,CAAC"}

package/dist/config.d.ts

@@ -13,11 +13,29 @@
  */
 /** Model ids and per-call generation settings. */
 export interface ModelConfig {
-    /** Workers AI model for the tool loop. Must support function calling. */
+    /**
+     * Workers AI model for the tool loop. Must support function calling.
+     *
+     * **Required — core ships no default.** Which model an agent runs on is the
+     * single most consequential thing about it: it sets the cost of every turn,
+     * the tool-calling reliability the whole control-tool design rests on, and the
+     * failure modes the fallback exists to escape. A default here would be core
+     * making that choice on a consumer's behalf, silently, and being wrong for
+     * most of them — the same reason core ships no prompt copy.
+     *
+     * It is also the value most likely to age badly. A model id baked into a
+     * published package survives every deprecation until someone bumps the
+     * package; one written in the agent that uses it is read by whoever owns the
+     * bill.
+     */
     chatModelId: string;
     /**
-     * Tried when the primary throws. Should be a *different vendor and family* —
-     * a same-family fallback shares the failure mode you are falling back from.
+     * Tried when the primary throws. **Required — core ships no default.**
+     *
+     * Should be a *different vendor and family* — a same-family fallback shares
+     * the failure mode you are falling back from, which makes it a retry wearing
+     * a costume. Core cannot pick this for you precisely because it depends on
+     * what you chose as primary.
      */
     fallbackChatModelId: string;
     /** AI Gateway slug; `"default"` auto-provisions on first request. */
@@ -117,15 +135,39 @@ export interface CoreConfig {
     maxSubtasks: number;
     session: SessionConfig;
 }
+/** The two ids an agent must choose for itself. Core has no opinion. */
+export type RequiredModelIds = Pick<ModelConfig, "chatModelId" | "fallbackChatModelId">;
+/**
+ * The baseline, which is everything core *does* still have an opinion about.
+ *
+ * Note what is missing: the model pair. This type is `CoreConfig` minus those
+ * two ids precisely so that no value of it can supply them — a default nobody
+ * declared is how an agent ends up billing a model its author never chose.
+ */
+export type CoreConfigBaseline = Omit<CoreConfig, "model"> & {
+    model: Omit<ModelConfig, keyof RequiredModelIds>;
+};
 /**
  * A working baseline. Every value is overridable; none is a ceiling. These are
  * the values both predecessor agents converged on in production, so they are a
  * reasonable place to start rather than an opinion about your domain.
+ *
+ * **It carries no model ids.** See {@link ModelConfig.chatModelId}.
+ */
+export declare const DEFAULT_CORE_CONFIG: CoreConfigBaseline;
+/**
+ * One level of optionality per nested group — enough for a config this shallow.
+ *
+ * `model` is the exception, and deliberately not optional: an agent must name
+ * its own primary and fallback. That is a compile error rather than a runtime
+ * one, so the omission is found while writing the agent rather than on the first
+ * request it serves.
  */
-export declare const DEFAULT_CORE_CONFIG: CoreConfig;
-/** One level of optionality per nested group — enough for a config this shallow. */
 export type CoreConfigOverrides = {
-    [K in keyof CoreConfig]?: CoreConfig[K] extends object ? Partial<CoreConfig[K]> : CoreConfig[K];
+    [K in Exclude<keyof CoreConfig, "model">]?: CoreConfig[K] extends object ? Partial<CoreConfig[K]> : CoreConfig[K];
+} & {
+    /** Required: the two model ids, plus any generation setting you want changed. */
+    model: RequiredModelIds & Partial<Omit<ModelConfig, keyof RequiredModelIds>>;
 };
 export declare class ConfigError extends Error {
     constructor(message: string);
@@ -138,5 +180,5 @@ export declare class ConfigError extends Error {
  * not call it per-request: the point of resolving is that every module downstream
  * reads the same object.
  */
-export declare function resolveConfig(overrides?: CoreConfigOverrides): CoreConfig;
+export declare function resolveConfig(overrides: CoreConfigOverrides): CoreConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,eAAe,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CAC5C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,iEAAiE;IACjE,eAAe,EAAE,WAAW,CAAC;IAC7B;;;;OAIG;IACH,cAAc,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAoBjC,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,mBAAmB,GAAG;KAC/B,CAAC,IAAI,MAAM,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,MAAM,GAClD,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GACtB,UAAU,CAAC,CAAC,CAAC;CAClB,CAAC;AAEF,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,GAAE,mBAAwB,GAAG,UAAU,CA2C7E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;;;;OAcG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,eAAe,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CAC5C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,iEAAiE;IACjE,eAAe,EAAE,WAAW,CAAC;IAC7B;;;;OAIG;IACH,cAAc,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,WAAW,EACX,aAAa,GAAG,qBAAqB,CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG;IAC3D,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,gBAAgB,CAAC,CAAC;CAClD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,kBAoBjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG;KAC/B,CAAC,IAAI,OAAO,CAAC,MAAM,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,MAAM,GACpE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GACtB,UAAU,CAAC,CAAC,CAAC;CAClB,GAAG;IACF,iFAAiF;IACjF,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC;CAC9E,CAAC;AAEF,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,mBAAmB,GAAG,UAAU,CAsExE"}

package/dist/config.js

@@ -15,11 +15,13 @@
  * A working baseline. Every value is overridable; none is a ceiling. These are
  * the values both predecessor agents converged on in production, so they are a
  * reasonable place to start rather than an opinion about your domain.
+ *
+ * **It carries no model ids.** See {@link ModelConfig.chatModelId}.
  */
 export const DEFAULT_CORE_CONFIG = {
     model: {
-        chatModelId: "@cf/zai-org/glm-5.2",
-        fallbackChatModelId: "@cf/moonshotai/kimi-k2.7-code",
+        // Not a model: an AI Gateway slug, and `"default"` is Cloudflare's own
+        // auto-provision behaviour rather than a choice core is making for anyone.
         aiGatewayId: "default",
         maxOutputTokens: 16_384,
         reasoningEffort: "medium"
@@ -50,7 +52,7 @@ export class ConfigError extends Error {
  * not call it per-request: the point of resolving is that every module downstream
  * reads the same object.
  */
-export function resolveConfig(overrides = {}) {
+export function resolveConfig(overrides) {
     const config = {
         model: { ...DEFAULT_CORE_CONFIG.model, ...overrides.model },
         mainAgentLimits: {
@@ -70,6 +72,26 @@ export function resolveConfig(overrides = {}) {
             throw new ConfigError(`${name} must be a positive number, got ${value}`);
         }
     };
+    // The type already requires both ids; this catches the JavaScript consumer,
+    // the `as CoreConfigOverrides` cast, and the empty string — which typechecks
+    // and then reaches Workers AI as a model that does not exist, failing on the
+    // first generation with a binding error that names nothing useful.
+    const modelId = (value, name) => {
+        if (typeof value !== "string" || value.trim() === "") {
+            throw new ConfigError(`model.${name} is required and must be a non-empty model id — core ` +
+                `ships no default, because which model an agent runs on is the agent's ` +
+                `most consequential choice and cannot be made on its behalf`);
+        }
+    };
+    modelId(config.model.chatModelId, "chatModelId");
+    modelId(config.model.fallbackChatModelId, "fallbackChatModelId");
+    // A fallback identical to the primary is a retry wearing a costume: it shares
+    // the outage, the rate limit and the deprecation you are falling back from.
+    if (config.model.chatModelId === config.model.fallbackChatModelId) {
+        throw new ConfigError(`model.fallbackChatModelId must differ from model.chatModelId (both are ` +
+            `'${config.model.chatModelId}') — a same-model fallback shares every ` +
+            `failure mode you are falling back from`);
+    }
     positive(config.mainAgentLimits.maxTurns, "mainAgentLimits.maxTurns");
     positive(config.mainAgentLimits.maxWallMs, "mainAgentLimits.maxWallMs");
     positive(config.subagentLimits.maxTurns, "subagentLimits.maxTurns");

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgHH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,KAAK,EAAE;QACL,WAAW,EAAE,qBAAqB;QAClC,mBAAmB,EAAE,+BAA+B;QACpD,WAAW,EAAE,SAAS;QACtB,eAAe,EAAE,MAAM;QACvB,eAAe,EAAE,QAAQ;KAC1B;IACD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE;IACzD,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE;IACxD,gBAAgB,EAAE,CAAC;IACnB,WAAW,EAAE,CAAC;IACd,OAAO,EAAE;QACP,eAAe,EAAE,IAAI;QACrB,kBAAkB,EAAE,MAAM;QAC1B,iBAAiB,EAAE,KAAK;QACxB,iBAAiB,EACf,8EAA8E;YAC9E,sEAAsE;KACzE;CACF,CAAC;AASF,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,YAAiC,EAAE;IAC/D,MAAM,MAAM,GAAe;QACzB,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE;QAC3D,eAAe,EAAE;YACf,GAAG,mBAAmB,CAAC,eAAe;YACtC,GAAG,SAAS,CAAC,eAAe;SAC7B;QACD,cAAc,EAAE;YACd,GAAG,mBAAmB,CAAC,cAAc;YACrC,GAAG,SAAS,CAAC,cAAc;SAC5B;QACD,gBAAgB,EACd,SAAS,CAAC,gBAAgB,IAAI,mBAAmB,CAAC,gBAAgB;QACpE,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,mBAAmB,CAAC,WAAW;QACrE,OAAO,EAAE,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;KAClE,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,IAAY,EAAQ,EAAE;QACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,mCAAmC,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC;IAEF,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IACtE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACxE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IACpE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACtE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACtD,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAEhE,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,QAAQ,GACZ,MAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACvE,IAAI,QAAQ,GAAG,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CACnB,gFAAgF,QAAQ,IAAI;YAC1F,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAmJH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAuB;IACrD,KAAK,EAAE;QACL,uEAAuE;QACvE,2EAA2E;QAC3E,WAAW,EAAE,SAAS;QACtB,eAAe,EAAE,MAAM;QACvB,eAAe,EAAE,QAAQ;KAC1B;IACD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE;IACzD,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE;IACxD,gBAAgB,EAAE,CAAC;IACnB,WAAW,EAAE,CAAC;IACd,OAAO,EAAE;QACP,eAAe,EAAE,IAAI;QACrB,kBAAkB,EAAE,MAAM;QAC1B,iBAAiB,EAAE,KAAK;QACxB,iBAAiB,EACf,8EAA8E;YAC9E,sEAAsE;KACzE;CACF,CAAC;AAmBF,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,SAA8B;IAC1D,MAAM,MAAM,GAAe;QACzB,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE;QAC3D,eAAe,EAAE;YACf,GAAG,mBAAmB,CAAC,eAAe;YACtC,GAAG,SAAS,CAAC,eAAe;SAC7B;QACD,cAAc,EAAE;YACd,GAAG,mBAAmB,CAAC,cAAc;YACrC,GAAG,SAAS,CAAC,cAAc;SAC5B;QACD,gBAAgB,EACd,SAAS,CAAC,gBAAgB,IAAI,mBAAmB,CAAC,gBAAgB;QACpE,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,mBAAmB,CAAC,WAAW;QACrE,OAAO,EAAE,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;KAClE,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,IAAY,EAAQ,EAAE;QACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,mCAAmC,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,IAAY,EAAQ,EAAE;QACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,WAAW,CACnB,SAAS,IAAI,uDAAuD;gBAClE,wEAAwE;gBACxE,4DAA4D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAEjE,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAClE,MAAM,IAAI,WAAW,CACnB,yEAAyE;YACvE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,0CAA0C;YACtE,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IACtE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACxE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IACpE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACtE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACtD,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAEhE,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,QAAQ,GACZ,MAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACvE,IAAI,QAAQ,GAAG,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CACnB,gFAAgF,QAAQ,IAAI;YAC1F,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/db/models/tasks.d.ts

@@ -68,8 +68,16 @@ export declare function makeTasks(db: DB): {
      * it. That closes the window between a workflow's terminal build and its
      * callback — the read-check-write is synchronous here, so a `CancelTask`
      * landing mid-delivery makes this return `false` and the notify never fires.
-     * Writing `canceled` onto a live row stays allowed: that is how the a2a-js
-     * handler's own cancel branch records the cancellation.
+     *
+     * The reverse direction is guarded too: writing `canceled` over an already
+     * `completed`/`failed` row is refused, mirroring {@link cancel}'s own source
+     * guard. Without it, a cancellation landing between the Workflow's `complete`
+     * and `notify` steps — separate, independently-retried steps — could flip
+     * storage to canceled while `deliver()` still posts the cached completed
+     * task it already built, the exact race this guard exists to close. Writing
+     * `canceled` onto a `submitted`/`working` row, or re-writing it onto an
+     * already-`canceled` one, stays allowed: that is how the a2a-js handler's own
+     * cancel branch records the cancellation.
      */
     save(task: Task): boolean;
     /**
@@ -81,9 +89,15 @@ export declare function makeTasks(db: DB): {
      */
     markWorking(taskId: string): "ok" | "canceled";
     /**
-     * Flip the task to `canceled` and return it. Terminal: once this lands,
-     * {@link save} refuses every non-canceled write, so no completed or failed
-     * callback can be built from this row afterwards.
+     * Flip the task to `canceled` and return it, or `null` if the row is not
+     * eligible — unknown, or already past `submitted`/`working`. Guarding the
+     * source state (not just the destination, as {@link save} does) matters
+     * because `complete`/`notify` are separate Workflow steps: without this, a
+     * cancellation landing between them would flip an already-`completed` or
+     * `failed` row to `canceled` right as `deliver()` posts the terminal
+     * callback it had already built, silently rewriting a delivered result.
+     * Terminal: once this lands, {@link save} refuses every non-canceled write,
+     * so no completed or failed callback can be built from this row afterwards.
      */
     cancel(taskId: string): PlainTask | null;
     /** Delete all tasks older than 30 days (called by the maintenance cron). */

package/dist/db/models/tasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../../src/db/models/tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAMnC,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CAE7C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,EAAE;IAiC5B;;;;OAIG;iBACU;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,SAAS;IAwBb,6EAA6E;gBACjE,MAAM,GAAG,SAAS,GAAG,IAAI;IAIrC;;;OAGG;gBACS,aAAa,GAAG;QAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAiCrE;;;;;;;;;;;OAWG;eACQ,IAAI,GAAG,OAAO;IAazB;;;;;;OAMG;wBACiB,MAAM,GAAG,IAAI,GAAG,UAAU;IAe9C;;;;OAIG;mBACY,MAAM,GAAG,SAAS,GAAG,IAAI;IAaxC,4EAA4E;eACjE,IAAI;EAKlB"}
+{"version":3,"file":"tasks.d.ts","sourceRoot":"","sources":["../../../src/db/models/tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnE,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AAMnC,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,SAAS,CAE7C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,EAAE;IAiC5B;;;;OAIG;iBACU;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,SAAS;IAwBb,6EAA6E;gBACjE,MAAM,GAAG,SAAS,GAAG,IAAI;IAIrC;;;OAGG;gBACS,aAAa,GAAG;QAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;IAiCrE;;;;;;;;;;;;;;;;;;;OAmBG;eACQ,IAAI,GAAG,OAAO;IA0BzB;;;;;;OAMG;wBACiB,MAAM,GAAG,IAAI,GAAG,UAAU;IAe9C;;;;;;;;;;OAUG;mBACY,MAAM,GAAG,SAAS,GAAG,IAAI;IAoBxC,4EAA4E;eACjE,IAAI;EAKlB"}

package/dist/db/models/tasks.js

@@ -133,14 +133,33 @@ export function makeTasks(db) {
          * it. That closes the window between a workflow's terminal build and its
          * callback — the read-check-write is synchronous here, so a `CancelTask`
          * landing mid-delivery makes this return `false` and the notify never fires.
-         * Writing `canceled` onto a live row stays allowed: that is how the a2a-js
-         * handler's own cancel branch records the cancellation.
+         *
+         * The reverse direction is guarded too: writing `canceled` over an already
+         * `completed`/`failed` row is refused, mirroring {@link cancel}'s own source
+         * guard. Without it, a cancellation landing between the Workflow's `complete`
+         * and `notify` steps — separate, independently-retried steps — could flip
+         * storage to canceled while `deliver()` still posts the cached completed
+         * task it already built, the exact race this guard exists to close. Writing
+         * `canceled` onto a `submitted`/`working` row, or re-writing it onto an
+         * already-`canceled` one, stays allowed: that is how the a2a-js handler's own
+         * cancel branch records the cancellation.
          */
         save(task) {
             const existing = readOne(task.id);
-            if (existing !== null &&
-                stateOf(existing) === TaskState.TASK_STATE_CANCELED &&
-                stateOf(task) !== TaskState.TASK_STATE_CANCELED) {
+            if (existing === null) {
+                upsert(task);
+                return true;
+            }
+            const existingState = stateOf(existing);
+            const incomingState = stateOf(task);
+            if (existingState === TaskState.TASK_STATE_CANCELED &&
+                incomingState !== TaskState.TASK_STATE_CANCELED) {
+                return false;
+            }
+            if (incomingState === TaskState.TASK_STATE_CANCELED &&
+                existingState !== TaskState.TASK_STATE_SUBMITTED &&
+                existingState !== TaskState.TASK_STATE_WORKING &&
+                existingState !== TaskState.TASK_STATE_CANCELED) {
                 return false;
             }
             upsert(task);
@@ -171,14 +190,25 @@ export function makeTasks(db) {
             return "ok";
         },
         /**
-         * Flip the task to `canceled` and return it. Terminal: once this lands,
-         * {@link save} refuses every non-canceled write, so no completed or failed
-         * callback can be built from this row afterwards.
+         * Flip the task to `canceled` and return it, or `null` if the row is not
+         * eligible — unknown, or already past `submitted`/`working`. Guarding the
+         * source state (not just the destination, as {@link save} does) matters
+         * because `complete`/`notify` are separate Workflow steps: without this, a
+         * cancellation landing between them would flip an already-`completed` or
+         * `failed` row to `canceled` right as `deliver()` posts the terminal
+         * callback it had already built, silently rewriting a delivered result.
+         * Terminal: once this lands, {@link save} refuses every non-canceled write,
+         * so no completed or failed callback can be built from this row afterwards.
          */
         cancel(taskId) {
             const task = readOne(taskId);
             if (!task)
                 return null;
+            const state = stateOf(task);
+            if (state !== TaskState.TASK_STATE_SUBMITTED &&
+                state !== TaskState.TASK_STATE_WORKING) {
+                return null;
+            }
             task.status = {
                 ...task.status,
                 state: TaskState.TASK_STATE_CANCELED,

package/dist/db/models/tasks.js.map

@@ -1 +1 @@
-{"version":3,"file":"tasks.js","sourceRoot":"","sources":["../../../src/db/models/tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAY,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,cAAc,EAAkB,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,SAAS,MAAM;IACb,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAU;IAChC,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC,sBAAsB,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CAAC,EAAM;IAC9B,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,KAAK,GAAG,CAAC,GAAyB,EAAa,EAAE,CACrD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAc,CAAC;IAEvD,MAAM,SAAS,GAAG,CAAC,IAAU,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5E,MAAM,OAAO,GAAG,CAAC,MAAc,EAAoB,EAAE;QACnD,MAAM,GAAG,GAAG,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACrC,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,IAAU,EAAQ,EAAE;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,4EAA4E;QAC5E,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC;YACzB,SAAS,EAAE,GAAG;SACf,CAAC;QACF,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;aACnB,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;aACxE,kBAAkB,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aAChE,GAAG,EAAE,CAAC;IACX,CAAC,CAAC;IAEF,OAAO;QACL;;;;WAIG;QACH,KAAK,CAAC,KAIL;YACC,MAAM,QAAQ,GAAG,EAAE;iBAChB,MAAM,EAAE;iBACR,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;iBACjD,GAAG,EAAE,CAAC;YACT,IAAI,QAAQ;gBAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;YAErC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;iBACnB,MAAM,CAAC;gBACN,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACxC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC;gBACzB,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6EAA6E;QAC7E,GAAG,CAAC,MAAc;YAChB,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAED;;;WAGG;QACH,IAAI,CAAC,KAAoB;YACvB,MAAM,OAAO,GAAU,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAE/D,MAAM,IAAI,GAAG,EAAE;iBACZ,MAAM,EAAE;iBACR,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,KAAK,CAAC;iBACZ,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;iBACpC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;iBAClB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;iBACpB,GAAG,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,EAAE;iBACb,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;iBAC1B,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,KAAK,CAAC;iBACZ,GAAG,EAAE,CAAC;YAET,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;gBACpD,SAAS,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC;aAC7B,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;WAWG;QACH,IAAI,CAAC,IAAU;YACb,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClC,IACE,QAAQ,KAAK,IAAI;gBACjB,OAAO,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,mBAAmB;gBACnD,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,mBAAmB,EAC/C,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;;;WAMG;QACH,WAAW,CAAC,MAAc;YACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,mBAAmB;gBAAE,OAAO,UAAU,CAAC;YACvE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAClE,IAAI,CAAC,MAAM,GAAG;gBACZ,GAAG,IAAI,CAAC,MAAM;gBACd,KAAK,EAAE,SAAS,CAAC,kBAAkB;gBACnC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;gBAC7B,SAAS,EAAE,MAAM,EAAE;aACpB,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;WAIG;QACH,MAAM,CAAC,MAAc;YACnB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,IAAI,CAAC,MAAM,GAAG;gBACZ,GAAG,IAAI,CAAC,MAAM;gBACd,KAAK,EAAE,SAAS,CAAC,mBAAmB;gBACpC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;gBAC7B,SAAS,EAAE,MAAM,EAAE;aACpB,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4EAA4E;QAC5E,OAAO;YACL,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACrD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,IAAe,EAAE,KAAoB;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACnC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/D,OAAO,EACL,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;KACvE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"tasks.js","sourceRoot":"","sources":["../../../src/db/models/tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAY,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,cAAc,EAAkB,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAG3C,SAAS,MAAM;IACb,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAkBD;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CAAC,IAAU;IAChC,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC,sBAAsB,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CAAC,EAAM;IAC9B,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,KAAK,GAAG,CAAC,GAAyB,EAAa,EAAE,CACrD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAc,CAAC;IAEvD,MAAM,SAAS,GAAG,CAAC,IAAU,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAE5E,MAAM,OAAO,GAAG,CAAC,MAAc,EAAoB,EAAE;QACnD,MAAM,GAAG,GAAG,EAAE;aACX,MAAM,EAAE;aACR,IAAI,CAAC,WAAW,CAAC;aACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACrC,GAAG,EAAE,CAAC;QACT,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,IAAU,EAAQ,EAAE;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,4EAA4E;QAC5E,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC;YACzB,SAAS,EAAE,GAAG;SACf,CAAC;QACF,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;aACnB,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;aACxE,kBAAkB,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;aAChE,GAAG,EAAE,CAAC;IACX,CAAC,CAAC;IAEF,OAAO;QACL;;;;WAIG;QACH,KAAK,CAAC,KAIL;YACC,MAAM,QAAQ,GAAG,EAAE;iBAChB,MAAM,EAAE;iBACR,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;iBACjD,GAAG,EAAE,CAAC;YACT,IAAI,QAAQ;gBAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC;YAErC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;iBACnB,MAAM,CAAC;gBACN,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACxC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC;gBACzB,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6EAA6E;QAC7E,GAAG,CAAC,MAAc;YAChB,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAED;;;WAGG;QACH,IAAI,CAAC,KAAoB;YACvB,MAAM,OAAO,GAAU,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAE/D,MAAM,IAAI,GAAG,EAAE;iBACZ,MAAM,EAAE;iBACR,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,KAAK,CAAC;iBACZ,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;iBACpC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;iBAClB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;iBACpB,GAAG,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,EAAE;iBACb,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;iBAC1B,IAAI,CAAC,WAAW,CAAC;iBACjB,KAAK,CAAC,KAAK,CAAC;iBACZ,GAAG,EAAE,CAAC;YAET,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;gBACpD,SAAS,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC;aAC7B,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;;;;;;;;;WAmBG;QACH,IAAI,CAAC,IAAU;YACb,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACpC,IACE,aAAa,KAAK,SAAS,CAAC,mBAAmB;gBAC/C,aAAa,KAAK,SAAS,CAAC,mBAAmB,EAC/C,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IACE,aAAa,KAAK,SAAS,CAAC,mBAAmB;gBAC/C,aAAa,KAAK,SAAS,CAAC,oBAAoB;gBAChD,aAAa,KAAK,SAAS,CAAC,kBAAkB;gBAC9C,aAAa,KAAK,SAAS,CAAC,mBAAmB,EAC/C,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;;;WAMG;QACH,WAAW,CAAC,MAAc;YACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,mBAAmB;gBAAE,OAAO,UAAU,CAAC;YACvE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,oBAAoB;gBAAE,OAAO,IAAI,CAAC;YAClE,IAAI,CAAC,MAAM,GAAG;gBACZ,GAAG,IAAI,CAAC,MAAM;gBACd,KAAK,EAAE,SAAS,CAAC,kBAAkB;gBACnC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;gBAC7B,SAAS,EAAE,MAAM,EAAE;aACpB,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;;;;;;;WAUG;QACH,MAAM,CAAC,MAAc;YACnB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,IACE,KAAK,KAAK,SAAS,CAAC,oBAAoB;gBACxC,KAAK,KAAK,SAAS,CAAC,kBAAkB,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,MAAM,GAAG;gBACZ,GAAG,IAAI,CAAC,MAAM;gBACd,KAAK,EAAE,SAAS,CAAC,mBAAmB;gBACpC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;gBAC7B,SAAS,EAAE,MAAM,EAAE;aACpB,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,4EAA4E;QAC5E,OAAO;YACL,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACrD,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,IAAe,EAAE,KAAoB;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACnC,OAAO;QACL,GAAG,IAAI;QACP,SAAS,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/D,OAAO,EACL,KAAK,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC;KACvE,CAAC;AACJ,CAAC"}