@mcp-abap-adt/llm-agent-server 26.0.0 → 27.0.1

package/README.md

@@ -9,7 +9,7 @@ Runnable distribution of SmartAgent (CLI + HTTP server). **Binary-only.**
 
 Importing from `@mcp-abap-adt/llm-agent-server` as a library is not supported as of 12.0.1. Composition surface lives elsewhere:
 
-- `@mcp-abap-adt/llm-agent-libs` — `SmartAgentBuilder`, `SessionManager`, `makeLlm`, `InMemoryMetrics`, etc.
+- `@mcp-abap-adt/llm-agent-libs` — `SmartAgentBuilder`, `SessionManager`, `LlmAdapter`, `InMemoryMetrics`, etc.
 - `@mcp-abap-adt/llm-agent-mcp` — `MCPClientWrapper`, `McpClientAdapter`, connection strategies.
 - `@mcp-abap-adt/llm-agent-rag` — `makeRag`, `resolveEmbedder`, prefetch helpers.
 - `@mcp-abap-adt/llm-agent` — interfaces and DTOs (`IMetrics`, `IRag`, `Message`, etc.).
@@ -25,6 +25,64 @@ Importing from `@mcp-abap-adt/llm-agent-server` as a library is not supported as
 See the repo docs for architecture, pipeline configuration and deployment:
 [`docs/ARCHITECTURE.md`](https://github.com/fr0ster/llm-agent/blob/main/docs/ARCHITECTURE.md), [`docs/PIPELINES.md`](https://github.com/fr0ster/llm-agent/blob/main/docs/PIPELINES.md), [`docs/DEPLOYMENT.md`](https://github.com/fr0ster/llm-agent/blob/main/docs/DEPLOYMENT.md).
 
+## Credentials
+
+**TL;DR** — a config file carries no secrets, only names. Each section that authenticates may say
+`credentialRef: <REF>`; the binary reads that account from the environment by one naming rule. Omit the
+ref and the section uses its role's default.
+
+### The naming rule
+
+| Set in the environment | You get |
+|---|---|
+| `<REF>_API_KEY` | an API key — OpenAI, Anthropic, DeepSeek, an OpenAI embedder, Qdrant |
+| `<REF>_SERVICE_KEY` | a SAP AI Core service key (the JSON) — the token **and** the API base URL both come from it |
+| `<REF>_USER` + `<REF>_PASSWORD` | a login — pg-vector, HANA |
+
+- Set **one** of the three per ref. Two at once is refused as ambiguous; `<REF>_USER` without
+  `<REF>_PASSWORD` (or the reverse) is refused.
+- A **named** ref must resolve. `credentialRef: OPENAI` with no `OPENAI_*` variable set fails at
+  startup, naming `OPENAI`. A ref holding the wrong kind fails, naming the kind wanted and the kind found.
+- The same ref named in several sections is **one** credential — one rate-limit bucket.
+
+### Defaults, when a section names no ref
+
+| Section | Default ref | A single-account deployment sets |
+|---|---|---|
+| each `llm:` entry | `LLM` | `LLM_API_KEY`, or `LLM_SERVICE_KEY` for SAP AI Core |
+| `rag.store`, a qdrant `skillPlugins.store` | `RAG_STORE` | `RAG_STORE_API_KEY` (Qdrant) or `RAG_STORE_USER` + `RAG_STORE_PASSWORD` |
+| `rag.embedder` | `RAG_EMBEDDER` | `RAG_EMBEDDER_API_KEY`, or `RAG_EMBEDDER_SERVICE_KEY` for SAP AI Core |
+
+**The skill store shares `RAG_STORE` with `rag.store`.** A qdrant `skillPlugins.store` with no
+`credentialRef` reads the `RAG_STORE` default too, so the two share its one credential kind:
+
+- A pg-vector or HANA `rag.store` on `RAG_STORE_USER` + `RAG_STORE_PASSWORD`, beside a qdrant skill
+  store you meant to run **anonymously**, fails at startup: the skill store finds a login where it
+  wants an API key (wrong kind). "Anonymous" applies only when the default is unset.
+- Fix it by naming the ref explicitly on the pg/HANA store — `rag.store.credentialRef: PG` with
+  `PG_USER` + `PG_PASSWORD` — and leaving `RAG_STORE_*` unset, so the skill store stays anonymous.
+- If the skill store has a key of its own, name that instead: `skillPlugins.store.credentialRef: SKILLS`
+  with `SKILLS_API_KEY`. A named ref must resolve, so this does not work for an anonymous store.
+
+A default is read only when the target needs a credential. Where a target can work without one (a Qdrant
+without auth, a pg-vector connection that needs no login), an unset default means anonymous.
+
+### Ollama and other targets that send nothing
+
+- An **Ollama LLM** gets a credential only from a `credentialRef` that names one — never the `LLM`
+  default, which usually holds a hosted provider's key.
+- An **Ollama embedder**, an **in-memory store** and an embedder **`factory`** send nothing from the
+  binary, so naming a ref for them is refused.
+
+### Coming from `AICORE_SERVICE_KEY` or `apiKey: ${…}`
+
+- The binary no longer reads `AICORE_SERVICE_KEY`. Set `LLM_SERVICE_KEY` instead (and
+  `RAG_EMBEDDER_SERVICE_KEY` for a SAP AI Core embedder) — or keep the variable and name it:
+  `credentialRef: AICORE` reads `AICORE_SERVICE_KEY`.
+- `apiKey: ${DEEPSEEK_API_KEY}` is refused in YAML. Delete the line and set `LLM_API_KEY`, or write
+  `credentialRef: DEEPSEEK`, which reads `DEEPSEEK_API_KEY`.
+- SAP AI Core's API base URL is never written in YAML: it travels inside `<REF>_SERVICE_KEY`.
+
 ## License
 
 **GNU General Public License v3.0 only** (`GPL-3.0-only`) — see

package/dist/composition/build-skill-host.d.ts

@@ -0,0 +1,13 @@
+import { type BuildAgentDeps, buildSkillHostFromConfig } from '@mcp-abap-adt/llm-agent-server-libs';
+import type { Lookup } from './lookup.js';
+/**
+ * `BuildAgentDeps.buildSkillHost`: the skill store's account. §8 item 4 has a
+ * qdrant skill store's `credentialRef` resolved through the same `credentialFor`
+ * as every other ref — a named ref must resolve to an api key; an omitted one
+ * reads the store default and, finding no entry, stays anonymous — and the
+ * credential reaches the library's factory as `storeCredential` (B11), merged
+ * into the deps `SmartServer` passes. An in-memory skill store sends nothing and
+ * reads no entry.
+ */
+export declare function createBuildSkillHost(lookup: Lookup, impl?: typeof buildSkillHostFromConfig): NonNullable<BuildAgentDeps['buildSkillHost']>;
+//# sourceMappingURL=build-skill-host.d.ts.map

package/dist/composition/build-skill-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-skill-host.d.ts","sourceRoot":"","sources":["../../src/composition/build-skill-host.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,cAAc,EAEnB,wBAAwB,EAEzB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,OAAO,wBAAmD,GAC/D,WAAW,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAgB/C"}

package/dist/composition/build-skill-host.js

@@ -0,0 +1,20 @@
+import { buildSkillHostFromConfig, } from '@mcp-abap-adt/llm-agent-server-libs';
+import { DEFAULT_STORE_REF } from './credential-for.js';
+/**
+ * `BuildAgentDeps.buildSkillHost`: the skill store's account. §8 item 4 has a
+ * qdrant skill store's `credentialRef` resolved through the same `credentialFor`
+ * as every other ref — a named ref must resolve to an api key; an omitted one
+ * reads the store default and, finding no entry, stays anonymous — and the
+ * credential reaches the library's factory as `storeCredential` (B11), merged
+ * into the deps `SmartServer` passes. An in-memory skill store sends nothing and
+ * reads no entry.
+ */
+export function createBuildSkillHost(lookup, impl = buildSkillHostFromConfig) {
+    return async (cfg, deps) => {
+        if (cfg.store.type !== 'qdrant')
+            return impl(cfg, deps);
+        const { credential } = lookup(cfg.store.credentialRef, DEFAULT_STORE_REF, 'skill store (qdrant)').optional('api-key');
+        return impl(cfg, credential ? { ...deps, storeCredential: credential } : deps);
+    };
+}
+//# sourceMappingURL=build-skill-host.js.map

package/dist/composition/build-skill-host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-skill-host.js","sourceRoot":"","sources":["../../src/composition/build-skill-host.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,wBAAwB,GAEzB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,OAAwC,wBAAwB;IAEhE,OAAO,KAAK,EACV,GAAuB,EACvB,IAAwB,EACG,EAAE;QAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAC3B,GAAG,CAAC,KAAK,CAAC,aAAa,EACvB,iBAAiB,EACjB,sBAAsB,CACvB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtB,OAAO,IAAI,CACT,GAAG,EACH,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/composition/credential-for.d.ts

@@ -0,0 +1,48 @@
+import type { IApiKeyCredential, IBearerCredential, ISecretLoginCredential } from '@mcp-abap-adt/interfaces-auth';
+export type AnyCredential = IApiKeyCredential | IBearerCredential | ISecretLoginCredential;
+export type CredentialEntry = {
+    /** Absent means this target needs none. Any of the three kinds is admissible:
+     *  a store entry holds a secret-login, an LLM entry an api key or a bearer. */
+    credential?: AnyCredential;
+    /** SAP AI Core only; it travels with the credential from the same service key. */
+    apiBaseUrl?: string;
+};
+export type CredentialFor = (ref: string) => CredentialEntry | undefined;
+/**
+ * What a section with no `credentialRef` resolves to — one per ROLE, because an
+ * entry holds one credential and a store's kind need not match an embedder's
+ * (§8 item 4). The root's choice, not a provider's. A deployment where they are
+ * one account names that account explicitly in each section.
+ */
+export declare const DEFAULT_LLM_REF = "LLM";
+export declare const DEFAULT_STORE_REF = "RAG_STORE";
+export declare const DEFAULT_EMBEDDER_REF = "RAG_EMBEDDER";
+/**
+ * A function, not a map literal, so nothing is read or parsed until a ref asks —
+ * and memoized, so the same ref always hands back the SAME credential object.
+ * That identity is load-bearing: the 429 gate keys a quota bucket on it
+ * (§4.6.5), so a fresh object per lookup would quietly stop the gate gating.
+ */
+export declare function memoizeCredentials(buildEntry: (ref: string) => CredentialEntry | undefined): CredentialFor;
+/**
+ * The shipped app's registry (§8 item 4): a ref names a family of environment
+ * variables.
+ *   <REF>_API_KEY                → an api-key credential
+ *   <REF>_SERVICE_KEY            → a SAP AI Core service key: bearer + apiBaseUrl
+ *   <REF>_USER + <REF>_PASSWORD  → a secret-login credential
+ * None set → no entry. More than one set → refused: an entry holds ONE
+ * credential. A rule rather than a switch, so it serves every deployment; a
+ * consumer with its own composition root passes its own `buildEntry` to
+ * `memoizeCredentials`.
+ */
+export declare function envCredentialEntries(env: NodeJS.ProcessEnv): (ref: string) => CredentialEntry | undefined;
+/**
+ * Before v27 the shipped app read one fixed variable, `AICORE_SERVICE_KEY`; now
+ * a ref names the family (`LLM_SERVICE_KEY` for the default LLM). A deployment
+ * that upgraded without renaming it fails with "got none", which does not say
+ * why. Given only for THAT failure — the default LLM ref resolving to nothing —
+ * because `AICORE_SERVICE_KEY` is still a valid variable for `credentialRef:
+ * AICORE`, and a hint beside any other failure would be false.
+ */
+export declare function legacyEnvHint(env: NodeJS.ProcessEnv, failure: unknown): string | undefined;
+//# sourceMappingURL=credential-for.d.ts.map

package/dist/composition/credential-for.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-for.d.ts","sourceRoot":"","sources":["../../src/composition/credential-for.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,iBAAiB,GACjB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,eAAe,GAAG;IAC5B;mFAC+E;IAC/E,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,eAAe,QAAQ,CAAC;AACrC,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAC7C,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAEnD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,GACvD,aAAa,CAQf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,CAAC,GAAG,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAuC9C;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,OAAO,EAAE,OAAO,GACf,MAAM,GAAG,SAAS,CAWpB"}

package/dist/composition/credential-for.js

@@ -0,0 +1,95 @@
+import { staticApiKey, staticLogin } from '@mcp-abap-adt/llm-agent';
+import { serviceKeyCredential } from '@mcp-abap-adt/sap-aicore-auth';
+/**
+ * What a section with no `credentialRef` resolves to — one per ROLE, because an
+ * entry holds one credential and a store's kind need not match an embedder's
+ * (§8 item 4). The root's choice, not a provider's. A deployment where they are
+ * one account names that account explicitly in each section.
+ */
+export const DEFAULT_LLM_REF = 'LLM';
+export const DEFAULT_STORE_REF = 'RAG_STORE';
+export const DEFAULT_EMBEDDER_REF = 'RAG_EMBEDDER';
+/**
+ * A function, not a map literal, so nothing is read or parsed until a ref asks —
+ * and memoized, so the same ref always hands back the SAME credential object.
+ * That identity is load-bearing: the 429 gate keys a quota bucket on it
+ * (§4.6.5), so a fresh object per lookup would quietly stop the gate gating.
+ */
+export function memoizeCredentials(buildEntry) {
+    const entries = new Map();
+    return (ref) => {
+        if (entries.has(ref))
+            return entries.get(ref);
+        const entry = buildEntry(ref);
+        entries.set(ref, entry);
+        return entry;
+    };
+}
+/**
+ * The shipped app's registry (§8 item 4): a ref names a family of environment
+ * variables.
+ *   <REF>_API_KEY                → an api-key credential
+ *   <REF>_SERVICE_KEY            → a SAP AI Core service key: bearer + apiBaseUrl
+ *   <REF>_USER + <REF>_PASSWORD  → a secret-login credential
+ * None set → no entry. More than one set → refused: an entry holds ONE
+ * credential. A rule rather than a switch, so it serves every deployment; a
+ * consumer with its own composition root passes its own `buildEntry` to
+ * `memoizeCredentials`.
+ */
+export function envCredentialEntries(env) {
+    return (ref) => {
+        const apiKey = env[`${ref}_API_KEY`];
+        const serviceKey = env[`${ref}_SERVICE_KEY`];
+        const user = env[`${ref}_USER`];
+        const password = env[`${ref}_PASSWORD`];
+        const set = [
+            apiKey ? `${ref}_API_KEY` : undefined,
+            serviceKey ? `${ref}_SERVICE_KEY` : undefined,
+            user || password ? `${ref}_USER/${ref}_PASSWORD` : undefined,
+        ].filter((s) => s !== undefined);
+        if (set.length > 1) {
+            throw new Error(`credentialRef '${ref}' is ambiguous: ${set.join(' and ')} are all set, ` +
+                'but an entry holds one credential');
+        }
+        if (apiKey)
+            return { credential: staticApiKey(apiKey) };
+        if (serviceKey) {
+            const k = serviceKeyCredential(serviceKey);
+            let apiBaseUrl;
+            try {
+                apiBaseUrl = k.apiBaseUrl;
+            }
+            catch (err) {
+                // The parser cannot know which variable held the key; this rule does.
+                throw new Error(`${ref}_SERVICE_KEY: ${err.message}`);
+            }
+            return { credential: k.credential, apiBaseUrl };
+        }
+        if (user || password) {
+            if (!user || !password) {
+                throw new Error(`credentialRef '${ref}' needs both ${ref}_USER and ${ref}_PASSWORD`);
+            }
+            return { credential: staticLogin(user, password) };
+        }
+        return undefined;
+    };
+}
+/**
+ * Before v27 the shipped app read one fixed variable, `AICORE_SERVICE_KEY`; now
+ * a ref names the family (`LLM_SERVICE_KEY` for the default LLM). A deployment
+ * that upgraded without renaming it fails with "got none", which does not say
+ * why. Given only for THAT failure — the default LLM ref resolving to nothing —
+ * because `AICORE_SERVICE_KEY` is still a valid variable for `credentialRef:
+ * AICORE`, and a hint beside any other failure would be false.
+ */
+export function legacyEnvHint(env, failure) {
+    const message = failure instanceof Error ? failure.message : String(failure);
+    const llmRefMissing = message.startsWith(`credentialRef '${DEFAULT_LLM_REF}' must hold`) &&
+        message.endsWith('got none');
+    if (!llmRefMissing || !env.AICORE_SERVICE_KEY)
+        return undefined;
+    return (`AICORE_SERVICE_KEY is set, but the default LLM reads ${DEFAULT_LLM_REF}_SERVICE_KEY ` +
+        `since v27 — rename it, or name it with credentialRef: AICORE ` +
+        '(see docs/MIGRATION-v27.md, item 4).');
+}
+//# sourceMappingURL=credential-for.js.map

package/dist/composition/credential-for.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-for.js","sourceRoot":"","sources":["../../src/composition/credential-for.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAiBrE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAwD;IAExD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuC,CAAC;IAC/D,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAsB;IAEtB,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG;YACV,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS;YACrC,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS;YAC7C,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS;SAC7D,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,mBAAmB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB;gBACvE,mCAAmC,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM;YAAE,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;YAC5B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sEAAsE;gBACtE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,gBAAgB,GAAG,aAAa,GAAG,WAAW,CACpE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAsB,EACtB,OAAgB;IAEhB,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7E,MAAM,aAAa,GACjB,OAAO,CAAC,UAAU,CAAC,kBAAkB,eAAe,aAAa,CAAC;QAClE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/B,IAAI,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,CACL,wDAAwD,eAAe,eAAe;QACtF,+DAA+D;QAC/D,sCAAsC,CACvC,CAAC;AACJ,CAAC"}

package/dist/composition/index.d.ts

@@ -0,0 +1,14 @@
+import type { BuildAgentDeps } from '@mcp-abap-adt/llm-agent-server-libs';
+export { legacyEnvHint } from './credential-for.js';
+export { createModelResolver } from './model-resolver.js';
+export type CompositionDeps = Pick<BuildAgentDeps, 'makeLlm' | 'resolveEmbedder' | 'makeRag'> & {
+    buildSkillHost: NonNullable<BuildAgentDeps['buildSkillHost']>;
+};
+/**
+ * The three construction seams the library no longer defaults (§4.6.3, §4.6.4)
+ * and the skill-store wrapper, over ONE memoized registry, so an account named
+ * by an LLM, a store, an embedder and a skill store is one credential object and
+ * one quota bucket (§4.6.5).
+ */
+export declare function buildCompositionDeps(env?: NodeJS.ProcessEnv): CompositionDeps;
+//# sourceMappingURL=index.d.ts.map

package/dist/composition/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/composition/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAQ1E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,MAAM,eAAe,GAAG,IAAI,CAChC,cAAc,EACd,SAAS,GAAG,iBAAiB,GAAG,SAAS,CAC1C,GAAG;IACF,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAAC;CAC/D,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,eAAe,CAQjB"}

package/dist/composition/index.js

@@ -0,0 +1,24 @@
+import { createBuildSkillHost } from './build-skill-host.js';
+import { envCredentialEntries, memoizeCredentials } from './credential-for.js';
+import { createLookup } from './lookup.js';
+import { createMakeLlm } from './make-llm.js';
+import { createMakeRag } from './make-rag.js';
+import { createResolveEmbedder } from './resolve-embedder.js';
+export { legacyEnvHint } from './credential-for.js';
+export { createModelResolver } from './model-resolver.js';
+/**
+ * The three construction seams the library no longer defaults (§4.6.3, §4.6.4)
+ * and the skill-store wrapper, over ONE memoized registry, so an account named
+ * by an LLM, a store, an embedder and a skill store is one credential object and
+ * one quota bucket (§4.6.5).
+ */
+export function buildCompositionDeps(env = process.env) {
+    const lookup = createLookup(memoizeCredentials(envCredentialEntries(env)));
+    return {
+        makeLlm: createMakeLlm(lookup),
+        resolveEmbedder: createResolveEmbedder(lookup),
+        makeRag: createMakeRag(lookup),
+        buildSkillHost: createBuildSkillHost(lookup),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/composition/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/composition/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAS1D;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,YAAY,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO;QACL,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;QAC9B,eAAe,EAAE,qBAAqB,CAAC,MAAM,CAAC;QAC9C,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;QAC9B,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/dist/composition/lookup.d.ts

@@ -0,0 +1,28 @@
+import type { AnyCredential, CredentialFor } from './credential-for.js';
+export type CredentialKind = AnyCredential['kind'];
+type OfKind<K extends CredentialKind> = Extract<AnyCredential, {
+    kind: K;
+}>;
+export interface ResolvedRef {
+    /** A target that cannot work without one. */
+    require<K extends CredentialKind>(kind: K): OfKind<K>;
+    /** A target that can work without one — but only when none was asked for. */
+    optional<K extends CredentialKind>(kind: K): {
+        credential?: OfKind<K>;
+    };
+    requireApiBaseUrl(): string;
+    /** A target that sends nothing: naming a ref for it is a mistake worth reporting. */
+    refuseAny(): void;
+}
+export type Lookup = (ref: string | undefined, roleDefault: string, target: string) => ResolvedRef;
+/**
+ * The lookup that makes "optional" mean what it says (§4.6.4): a ref may be
+ * OMITTED, but a ref that was NAMED must resolve and hold the right kind — the
+ * difference between a deployment that chose anonymous access and one with a
+ * typo in it. The role default is read only when a target asks for a
+ * credential (§8 item 4), so a target that takes none (an in-memory store, an
+ * Ollama embedder) never parses the default entry.
+ */
+export declare function createLookup(credentialFor: CredentialFor): Lookup;
+export {};
+//# sourceMappingURL=lookup.d.ts.map

package/dist/composition/lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup.d.ts","sourceRoot":"","sources":["../../src/composition/lookup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EAEb,aAAa,EACd,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;AACnD,KAAK,MAAM,CAAC,CAAC,SAAS,cAAc,IAAI,OAAO,CAAC,aAAa,EAAE;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC,CAAC;AAE5E,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,OAAO,CAAC,CAAC,SAAS,cAAc,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACtD,6EAA6E;IAC7E,QAAQ,CAAC,CAAC,SAAS,cAAc,EAAE,IAAI,EAAE,CAAC,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;KAAE,CAAC;IACxE,iBAAiB,IAAI,MAAM,CAAC;IAC5B,qFAAqF;IACrF,SAAS,IAAI,IAAI,CAAC;CACnB;AAED,MAAM,MAAM,MAAM,GAAG,CACnB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,KACX,WAAW,CAAC;AAEjB;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,aAAa,EAAE,aAAa,GAAG,MAAM,CAwDjE"}

package/dist/composition/lookup.js

@@ -0,0 +1,57 @@
+/**
+ * The lookup that makes "optional" mean what it says (§4.6.4): a ref may be
+ * OMITTED, but a ref that was NAMED must resolve and hold the right kind — the
+ * difference between a deployment that chose anonymous access and one with a
+ * typo in it. The role default is read only when a target asks for a
+ * credential (§8 item 4), so a target that takes none (an in-memory store, an
+ * Ollama embedder) never parses the default entry.
+ */
+export function createLookup(credentialFor) {
+    return (ref, roleDefault, target) => {
+        const named = ref !== undefined;
+        const key = ref ?? roleDefault;
+        const namedEntry = named ? credentialFor(key) : undefined;
+        if (named && !namedEntry) {
+            throw new Error(`credentialRef '${key}' for ${target} has no entry configured`);
+        }
+        const entry = () => named ? namedEntry : credentialFor(key);
+        const wrongKind = (kind, got) => {
+            throw new Error(`credentialRef '${key}' must hold a ${kind} credential for ${target}, ` +
+                `got ${got?.credential?.kind ?? 'none'}`);
+        };
+        return {
+            require(kind) {
+                const e = entry();
+                const c = e?.credential;
+                if (c?.kind !== kind)
+                    return wrongKind(kind, e);
+                return c;
+            },
+            optional(kind) {
+                const e = entry();
+                const c = e?.credential;
+                if (!c) {
+                    if (named)
+                        return wrongKind(kind, e); // named, resolved, empty
+                    return {}; // omitted and empty: anonymous, on purpose
+                }
+                if (c.kind !== kind)
+                    return wrongKind(kind, e); // never "ignore it"
+                return { credential: c };
+            },
+            requireApiBaseUrl() {
+                const e = entry();
+                if (!e?.apiBaseUrl) {
+                    throw new Error(`credentialRef '${key}' must carry an apiBaseUrl for ${target}`);
+                }
+                return e.apiBaseUrl;
+            },
+            refuseAny() {
+                if (named) {
+                    throw new Error(`${target} takes no credential, so credentialRef '${key}' cannot apply`);
+                }
+            },
+        };
+    };
+}
+//# sourceMappingURL=lookup.js.map

package/dist/composition/lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lookup.js","sourceRoot":"","sources":["../../src/composition/lookup.ts"],"names":[],"mappings":"AAyBA;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,aAA4B;IACvD,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,GAAG,KAAK,SAAS,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,IAAI,WAAW,CAAC;QAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,IAAI,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,SAAS,MAAM,0BAA0B,CAC/D,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,GAAgC,EAAE,CAC9C,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,CAChB,IAAY,EACZ,GAAgC,EACzB,EAAE;YACT,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,iBAAiB,IAAI,mBAAmB,MAAM,IAAI;gBACrE,OAAO,GAAG,EAAE,UAAU,EAAE,IAAI,IAAI,MAAM,EAAE,CAC3C,CAAC;QACJ,CAAC,CAAC;QACF,OAAO;YACL,OAAO,CAA2B,IAAO;gBACvC,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;gBACxB,IAAI,CAAC,EAAE,IAAI,KAAK,IAAI;oBAAE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAChD,OAAO,CAAc,CAAC;YACxB,CAAC;YACD,QAAQ,CAA2B,IAAO;gBACxC,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;gBAClB,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;gBACxB,IAAI,CAAC,CAAC,EAAE,CAAC;oBACP,IAAI,KAAK;wBAAE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,yBAAyB;oBAC/D,OAAO,EAAE,CAAC,CAAC,2CAA2C;gBACxD,CAAC;gBACD,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;oBAAE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,oBAAoB;gBACpE,OAAO,EAAE,UAAU,EAAE,CAAc,EAAE,CAAC;YACxC,CAAC;YACD,iBAAiB;gBACf,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;gBAClB,IAAI,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,kCAAkC,MAAM,EAAE,CAChE,CAAC;gBACJ,CAAC;gBACD,OAAO,CAAC,CAAC,UAAU,CAAC;YACtB,CAAC;YACD,SAAS;gBACP,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,2CAA2C,GAAG,gBAAgB,CACxE,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/composition/make-llm.d.ts

@@ -0,0 +1,37 @@
+import { type AnthropicConfig } from '@mcp-abap-adt/anthropic-llm';
+import { type DeepSeekConfig } from '@mcp-abap-adt/deepseek-llm';
+import type { ILlm, LLMProvider } from '@mcp-abap-adt/llm-agent';
+import type { SmartServerLlmConfig } from '@mcp-abap-adt/llm-agent-server-libs';
+import { type OllamaConfig } from '@mcp-abap-adt/ollama-llm';
+import { type OpenAIConfig } from '@mcp-abap-adt/openai-llm';
+import type { SapCoreAIConfig } from '@mcp-abap-adt/sap-aicore-llm';
+import type { Lookup } from './lookup.js';
+type ProviderInstance = LLMProvider & {
+    readonly model: string;
+};
+type SapCoreAICtor = new (cfg: SapCoreAIConfig) => ProviderInstance;
+/** The five constructors, injectable so a test records what each receives. */
+export interface LlmProviderCtors {
+    openai: new (cfg: OpenAIConfig) => ProviderInstance;
+    anthropic: new (cfg: AnthropicConfig) => ProviderInstance;
+    deepseek: new (cfg: DeepSeekConfig) => ProviderInstance;
+    ollama: new (cfg: OllamaConfig) => ProviderInstance;
+    /**
+     * A loader, not the constructor: `@mcp-abap-adt/sap-aicore-llm` pulls
+     * `@sap-ai-sdk/orchestration`, which installs process `uncaughtException`
+     * listeners at import time. Imported statically, every deployment would survive
+     * uncaught exceptions; loaded here, only one that selects `sap-ai-sdk` pays.
+     */
+    'sap-ai-sdk': () => Promise<SapCoreAICtor>;
+}
+export declare const SHIPPED_LLM_PROVIDERS: LlmProviderCtors;
+/**
+ * `BuildAgentDeps.makeLlm` (§8 item 4). Every provider config is built from NAMED
+ * fields — nothing spreads `cfg` — so `credentialRef` cannot ride along into a
+ * provider (§4.6.4). The knobs the library's `makeLlm` used to forward are
+ * forwarded here: without `temperature` the server's main (0.7) and classifier
+ * (0.1) roles would collapse onto one provider default.
+ */
+export declare function createMakeLlm(lookup: Lookup, ctors?: LlmProviderCtors): (cfg: SmartServerLlmConfig) => Promise<ILlm>;
+export {};
+//# sourceMappingURL=make-llm.d.ts.map

package/dist/composition/make-llm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"make-llm.d.ts","sourceRoot":"","sources":["../../src/composition/make-llm.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,eAAe,EAErB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,0BAA0B,CAAC;AAC7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,KAAK,gBAAgB,GAAG,WAAW,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,KAAK,aAAa,GAAG,KAAK,GAAG,EAAE,eAAe,KAAK,gBAAgB,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,KAAK,GAAG,EAAE,YAAY,KAAK,gBAAgB,CAAC;IACpD,SAAS,EAAE,KAAK,GAAG,EAAE,eAAe,KAAK,gBAAgB,CAAC;IAC1D,QAAQ,EAAE,KAAK,GAAG,EAAE,cAAc,KAAK,gBAAgB,CAAC;IACxD,MAAM,EAAE,KAAK,GAAG,EAAE,YAAY,KAAK,gBAAgB,CAAC;IACpD;;;;;OAKG;IACH,YAAY,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;CAC5C;AAED,eAAO,MAAM,qBAAqB,EAAE,gBAOnC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,gBAAwC,GAC9C,CAAC,GAAG,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CA8D9C"}

package/dist/composition/make-llm.js

@@ -0,0 +1,79 @@
+import { AnthropicProvider, } from '@mcp-abap-adt/anthropic-llm';
+import { DeepSeekProvider, } from '@mcp-abap-adt/deepseek-llm';
+import { LlmAdapter, LlmProviderBridge } from '@mcp-abap-adt/llm-agent-libs';
+import { OllamaProvider } from '@mcp-abap-adt/ollama-llm';
+import { OpenAIProvider } from '@mcp-abap-adt/openai-llm';
+import { DEFAULT_LLM_REF } from './credential-for.js';
+export const SHIPPED_LLM_PROVIDERS = {
+    openai: OpenAIProvider,
+    anthropic: AnthropicProvider,
+    deepseek: DeepSeekProvider,
+    ollama: OllamaProvider,
+    'sap-ai-sdk': async () => (await import('@mcp-abap-adt/sap-aicore-llm')).SapCoreAIProvider,
+};
+/**
+ * `BuildAgentDeps.makeLlm` (§8 item 4). Every provider config is built from NAMED
+ * fields — nothing spreads `cfg` — so `credentialRef` cannot ride along into a
+ * provider (§4.6.4). The knobs the library's `makeLlm` used to forward are
+ * forwarded here: without `temperature` the server's main (0.7) and classifier
+ * (0.1) roles would collapse onto one provider default.
+ */
+export function createMakeLlm(lookup, ctors = SHIPPED_LLM_PROVIDERS) {
+    return async (cfg) => {
+        const entry = lookup(cfg.credentialRef, DEFAULT_LLM_REF, cfg.provider ?? 'llm');
+        const knobs = {
+            model: cfg.model,
+            temperature: cfg.temperature,
+            maxTokens: cfg.maxTokens,
+            whenThrottled: cfg.whenThrottled,
+        };
+        const provider = await (async () => {
+            switch (cfg.provider) {
+                case 'openai':
+                    return new ctors.openai({
+                        ...knobs,
+                        baseURL: cfg.url,
+                        credential: entry.require('api-key'),
+                    });
+                case 'anthropic':
+                    return new ctors.anthropic({
+                        ...knobs,
+                        baseURL: cfg.url,
+                        credential: entry.require('api-key'),
+                    });
+                case 'deepseek':
+                    return new ctors.deepseek({
+                        ...knobs,
+                        baseURL: cfg.url,
+                        credential: entry.require('api-key'),
+                    });
+                case 'ollama':
+                    // Optional, and only from a ref that NAMES one: the LLM role default
+                    // usually holds a hosted provider's key, and sending it to a local
+                    // Ollama (or whatever sits at cfg.url) would hand a secret to a target
+                    // nobody authorized for it.
+                    return new ctors.ollama({
+                        ...knobs,
+                        baseURL: cfg.url,
+                        ...(cfg.credentialRef === undefined
+                            ? {}
+                            : entry.optional('api-key')),
+                    });
+                case 'sap-ai-sdk':
+                    return new (await ctors['sap-ai-sdk']())({
+                        ...knobs,
+                        credential: entry.require('bearer'),
+                        apiBaseUrl: entry.requireApiBaseUrl(),
+                    });
+                default:
+                    throw new Error(`unknown llm provider '${String(cfg.provider)}'`);
+            }
+        })();
+        return new LlmAdapter(new LlmProviderBridge(provider), {
+            model: provider.model,
+            getModels: () => provider.getModels?.() ?? Promise.resolve([]),
+            getEmbeddingModels: () => provider.getEmbeddingModels?.() ?? Promise.resolve([]),
+        });
+    };
+}
+//# sourceMappingURL=make-llm.js.map

package/dist/composition/make-llm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"make-llm.js","sourceRoot":"","sources":["../../src/composition/make-llm.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAE7E,OAAO,EAAqB,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAqB,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAsBtD,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACrD,MAAM,EAAE,cAAc;IACtB,SAAS,EAAE,iBAAiB;IAC5B,QAAQ,EAAE,gBAAgB;IAC1B,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,KAAK,IAAI,EAAE,CACvB,CAAC,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC,CAAC,iBAAiB;CACnE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,QAA0B,qBAAqB;IAE/C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,KAAK,GAAG,MAAM,CAClB,GAAG,CAAC,aAAa,EACjB,eAAe,EACf,GAAG,CAAC,QAAQ,IAAI,KAAK,CACtB,CAAC;QACF,MAAM,KAAK,GAAG;YACZ,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,aAAa,EAAE,GAAG,CAAC,aAAa;SACjC,CAAC;QACF,MAAM,QAAQ,GAAqB,MAAM,CAAC,KAAK,IAAI,EAAE;YACnD,QAAQ,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACrB,KAAK,QAAQ;oBACX,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;wBACtB,GAAG,KAAK;wBACR,OAAO,EAAE,GAAG,CAAC,GAAG;wBAChB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;qBACrC,CAAC,CAAC;gBACL,KAAK,WAAW;oBACd,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC;wBACzB,GAAG,KAAK;wBACR,OAAO,EAAE,GAAG,CAAC,GAAG;wBAChB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;qBACrC,CAAC,CAAC;gBACL,KAAK,UAAU;oBACb,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC;wBACxB,GAAG,KAAK;wBACR,OAAO,EAAE,GAAG,CAAC,GAAG;wBAChB,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;qBACrC,CAAC,CAAC;gBACL,KAAK,QAAQ;oBACX,qEAAqE;oBACrE,mEAAmE;oBACnE,uEAAuE;oBACvE,4BAA4B;oBAC5B,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC;wBACtB,GAAG,KAAK;wBACR,OAAO,EAAE,GAAG,CAAC,GAAG;wBAChB,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS;4BACjC,CAAC,CAAC,EAAE;4BACJ,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;qBAC/B,CAAC,CAAC;gBACL,KAAK,YAAY;oBACf,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;wBACvC,GAAG,KAAK;wBACR,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;wBACnC,UAAU,EAAE,KAAK,CAAC,iBAAiB,EAAE;qBACtC,CAAC,CAAC;gBACL;oBACE,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtE,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE;YACrD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,kBAAkB,EAAE,GAAG,EAAE,CACvB,QAAQ,CAAC,kBAAkB,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/composition/make-rag.d.ts

@@ -0,0 +1,14 @@
+import { type IRag } from '@mcp-abap-adt/llm-agent';
+import { makeRag as libMakeRag } from '@mcp-abap-adt/llm-agent-rag';
+import { type MakeRagInput } from '@mcp-abap-adt/llm-agent-server-libs';
+import type { Lookup } from './lookup.js';
+/**
+ * `BuildAgentDeps.makeRag` (§8 item 4): the serializable store section plus,
+ * where the store needs one, a resolved embedder — and this body is the
+ * conversion into the library's typed `RagResolution` (§4.6.4). The pair's
+ * discriminant is nested (`store.type`), which does not narrow the pair, so
+ * B10's `isInMemoryInput` narrows the whole input before `embedder` is known
+ * to be present.
+ */
+export declare function createMakeRag(lookup: Lookup, impl?: typeof libMakeRag): (input: MakeRagInput) => Promise<IRag>;
+//# sourceMappingURL=make-rag.d.ts.map

package/dist/composition/make-rag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"make-rag.d.ts","sourceRoot":"","sources":["../../src/composition/make-rag.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAEL,KAAK,YAAY,EAClB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,OAAO,UAAuB,GACnC,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAsCxC"}

package/dist/composition/make-rag.js

@@ -0,0 +1,52 @@
+import { InMemoryRag } from '@mcp-abap-adt/llm-agent';
+import { makeRag as libMakeRag } from '@mcp-abap-adt/llm-agent-rag';
+import { isInMemoryInput, } from '@mcp-abap-adt/llm-agent-server-libs';
+import { DEFAULT_STORE_REF } from './credential-for.js';
+/**
+ * `BuildAgentDeps.makeRag` (§8 item 4): the serializable store section plus,
+ * where the store needs one, a resolved embedder — and this body is the
+ * conversion into the library's typed `RagResolution` (§4.6.4). The pair's
+ * discriminant is nested (`store.type`), which does not narrow the pair, so
+ * B10's `isInMemoryInput` narrows the whole input before `embedder` is known
+ * to be present.
+ */
+export function createMakeRag(lookup, impl = libMakeRag) {
+    return async (input) => {
+        if (isInMemoryInput(input)) {
+            const { credentialRef, ...address } = input.store;
+            lookup(credentialRef, DEFAULT_STORE_REF, 'in-memory').refuseAny();
+            return input.embedder
+                ? impl({ ...address, embedder: input.embedder })
+                : // keyword-only: no namespace, as on main; preprocessors/enrichers are
+                    // not YAML fields, so nothing a file configured is lost (§4.6.4)
+                    new InMemoryRag({ dedupThreshold: address.dedupThreshold });
+        }
+        const { embedder, store } = input;
+        switch (store.type) {
+            case 'qdrant': {
+                const { credentialRef, ...address } = store;
+                const entry = lookup(credentialRef, DEFAULT_STORE_REF, 'qdrant');
+                return impl({ ...address, embedder, ...entry.optional('api-key') });
+            }
+            case 'pg-vector': {
+                const { credentialRef, ...address } = store;
+                const entry = lookup(credentialRef, DEFAULT_STORE_REF, 'pg-vector');
+                return impl({
+                    ...address,
+                    embedder,
+                    ...entry.optional('secret-login'),
+                });
+            }
+            case 'hana-vector': {
+                const { credentialRef, ...address } = store;
+                const entry = lookup(credentialRef, DEFAULT_STORE_REF, 'hana-vector');
+                return impl({
+                    ...address,
+                    embedder,
+                    credential: entry.require('secret-login'),
+                });
+            }
+        }
+    };
+}
+//# sourceMappingURL=make-rag.js.map

package/dist/composition/make-rag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"make-rag.js","sourceRoot":"","sources":["../../src/composition/make-rag.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAa,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,eAAe,GAEhB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,OAA0B,UAAU;IAEpC,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC;YAClD,MAAM,CAAC,aAAa,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC;YAClE,OAAO,KAAK,CAAC,QAAQ;gBACnB,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAChD,CAAC,CAAC,sEAAsE;oBACtE,iEAAiE;oBACjE,IAAI,WAAW,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QAClC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;gBAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC;gBACjE,OAAO,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;gBAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;oBACV,GAAG,OAAO;oBACV,QAAQ;oBACR,GAAG,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YACD,KAAK,aAAa,CAAC,CAAC,CAAC;gBACnB,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;gBAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC;oBACV,GAAG,OAAO;oBACV,QAAQ;oBACR,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;iBAC1C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}