@open-mercato/ai-assistant 0.5.1-develop.3036.f02c281f23 → 0.5.1-develop.3045.b4b3320cc2

package/dist/modules/ai_assistant/api/ai/chat/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/ai_assistant/api/ai/chat/route.ts"],
+  "sourcesContent": ["import { NextResponse, type NextRequest } from 'next/server'\nimport type { UIMessage } from 'ai'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { loadAgentRegistry } from '../../../lib/agent-registry'\nimport { checkAgentPolicy, type AgentPolicyDenyCode } from '../../../lib/agent-policy'\nimport { runAiAgentText } from '../../../lib/agent-runtime'\nimport { AgentPolicyError } from '../../../lib/agent-tools'\n\nconst MAX_MESSAGES = 100\n\nconst agentIdPattern = /^[a-z0-9_]+\\.[a-z0-9_]+$/\n\nconst chatMessageSchema = z.object({\n  role: z.enum(['user', 'assistant', 'system']),\n  content: z.string(),\n})\n\nconst pageContextSchema = z\n  .object({\n    pageId: z.string().nullable().optional(),\n    entityType: z.string().nullable().optional(),\n    recordId: z.string().nullable().optional(),\n  })\n  .passthrough()\n\nconst chatRequestSchema = z.object({\n  messages: z\n    .array(chatMessageSchema)\n    .min(1, 'messages must contain at least one message')\n    .max(MAX_MESSAGES, `messages must contain at most ${MAX_MESSAGES} entries`),\n  attachmentIds: z.array(z.string()).optional(),\n  debug: z.boolean().optional(),\n  pageContext: pageContextSchema.optional(),\n  /**\n   * Optional stable conversation id forwarded from `<AiChat>`. Bridged into\n   * the Step 5.6 `prepareMutation` idempotency hash so repeated turns within\n   * the same chat collapse onto the same pending action. Additive; omitted\n   * bodies continue to work as before.\n   */\n  conversationId: z.string().min(1).max(128).optional(),\n})\n\nexport type AiChatRequest = z.infer<typeof chatRequestSchema>\n\nconst agentQuerySchema = z.object({\n  agent: z\n    .string()\n    .regex(agentIdPattern, 'agent must match \"<module>.<agent>\" (lowercase, digits, underscores only)'),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'AI Assistant',\n  summary: 'AI agent dispatcher',\n  methods: {\n    POST: {\n      operationId: 'aiAssistantChatAgent',\n      summary: 'Stream a chat turn for a registered AI agent',\n      description:\n        'Dispatches a chat turn to the focused AI agent identified by `?agent=<module>.<agent>`. ' +\n        'Enforces agent-level `requiredFeatures`, tool whitelisting, read-only / mutationPolicy, ' +\n        'execution-mode compatibility, and attachment media-type policy. The streaming response ' +\n        'body uses an AI SDK-compatible `text/event-stream` transport.',\n      query: agentQuerySchema,\n      requestBody: {\n        contentType: 'application/json',\n        description: 'Chat turn payload. `messages` is required; `attachmentIds`, `debug`, and `pageContext` are optional.',\n        schema: chatRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Streaming text/event-stream response compatible with AI SDK chat transports.', mediaType: 'text/event-stream' },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query param, malformed payload, or message count above the cap.' },\n        { status: 401, description: 'Unauthenticated caller.' },\n        { status: 403, description: 'Caller lacks agent-level or tool-level required features.' },\n        { status: 404, description: 'Unknown agent id.' },\n        { status: 409, description: 'Agent/tool/execution-mode policy violation.' },\n        { status: 500, description: 'Internal runtime failure.' },\n      ],\n    },\n  },\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['ai_assistant.view'] },\n}\n\nfunction jsonError(\n  status: number,\n  message: string,\n  code: string,\n  extra?: Record<string, unknown>,\n): NextResponse {\n  return NextResponse.json({ error: message, code, ...(extra ?? {}) }, { status })\n}\n\nfunction statusForDenyCode(code: AgentPolicyDenyCode): number {\n  switch (code) {\n    case 'agent_unknown':\n      return 404\n    case 'agent_features_denied':\n    case 'tool_features_denied':\n      return 403\n    case 'tool_not_whitelisted':\n    case 'tool_unknown':\n    case 'mutation_blocked_by_readonly':\n    case 'mutation_blocked_by_policy':\n    case 'execution_mode_not_supported':\n      return 409\n    case 'attachment_type_not_accepted':\n      return 400\n    default:\n      return 409\n  }\n}\n\nexport async function POST(req: NextRequest): Promise<Response> {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return jsonError(401, 'Unauthorized', 'unauthenticated')\n  }\n\n  const requestUrl = new URL(req.url)\n  const queryResult = agentQuerySchema.safeParse({\n    agent: requestUrl.searchParams.get('agent') ?? undefined,\n  })\n  if (!queryResult.success) {\n    return jsonError(400, 'Invalid or missing \"agent\" query parameter.', 'validation_error', {\n      issues: queryResult.error.issues,\n    })\n  }\n  const agentId = queryResult.data.agent\n\n  let parsedBody: unknown\n  try {\n    parsedBody = await req.json()\n  } catch {\n    return jsonError(400, 'Request body must be valid JSON.', 'validation_error')\n  }\n\n  const bodyResult = chatRequestSchema.safeParse(parsedBody)\n  if (!bodyResult.success) {\n    return jsonError(400, 'Invalid request body.', 'validation_error', {\n      issues: bodyResult.error.issues,\n    })\n  }\n\n  try {\n    await loadAgentRegistry()\n\n    const container = await createRequestContainer()\n    const rbacService = container.resolve<RbacService>('rbacService')\n    const acl = await rbacService.loadAcl(auth.sub, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n    })\n\n    const decision = checkAgentPolicy({\n      agentId,\n      authContext: {\n        userFeatures: acl.features,\n        isSuperAdmin: acl.isSuperAdmin,\n      },\n      requestedExecutionMode: 'chat',\n      // TODO(step-3.7): resolve attachmentIds -> media types via attachment-bridge\n      // once the attachment-to-model conversion bridge lands. Until then the\n      // policy gate skips attachment-type validation because media types are\n      // not known at dispatch time.\n      attachmentMediaTypes: undefined,\n    })\n\n    if (!decision.ok) {\n      return jsonError(statusForDenyCode(decision.code), decision.message, decision.code)\n    }\n\n    return await runAiAgentText({\n      agentId,\n      messages: bodyResult.data.messages as unknown as UIMessage[],\n      attachmentIds: bodyResult.data.attachmentIds,\n      pageContext: bodyResult.data.pageContext,\n      debug: bodyResult.data.debug,\n      conversationId: bodyResult.data.conversationId ?? null,\n      authContext: {\n        tenantId: auth.tenantId ?? null,\n        organizationId: auth.orgId ?? null,\n        userId: auth.sub,\n        features: acl.features,\n        isSuperAdmin: acl.isSuperAdmin,\n      },\n      container,\n    })\n  } catch (error) {\n    if (error instanceof AgentPolicyError) {\n      return jsonError(statusForDenyCode(error.code), error.message, error.code)\n    }\n    console.error('[AI Chat Agent] Dispatch failure:', error)\n    return jsonError(\n      500,\n      error instanceof Error ? error.message : 'Agent dispatch failed.',\n      'internal_error',\n    )\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAsC;AAE/C,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,yBAAyB;AAClC,SAAS,wBAAkD;AAC3D,SAAS,sBAAsB;AAC/B,SAAS,wBAAwB;AAEjC,MAAM,eAAe;AAErB,MAAM,iBAAiB;AAEvB,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,MAAM,EAAE,KAAK,CAAC,QAAQ,aAAa,QAAQ,CAAC;AAAA,EAC5C,SAAS,EAAE,OAAO;AACpB,CAAC;AAED,MAAM,oBAAoB,EACvB,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC3C,CAAC,EACA,YAAY;AAEf,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,UAAU,EACP,MAAM,iBAAiB,EACvB,IAAI,GAAG,4CAA4C,EACnD,IAAI,cAAc,iCAAiC,YAAY,UAAU;AAAA,EAC5E,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC5C,OAAO,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC5B,aAAa,kBAAkB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOxC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACtD,CAAC;AAID,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EACJ,OAAO,EACP,MAAM,gBAAgB,2EAA2E;AACtG,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,aAAa;AAAA,MACb,SAAS;AAAA,MACT,aACE;AAAA,MAIF,OAAO;AAAA,MACP,aAAa;AAAA,QACX,aAAa;AAAA,QACb,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gFAAgF,WAAW,oBAAoB;AAAA,MAC7I;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0EAA0E;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,4DAA4D;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,SAAS,UACP,QACA,SACA,MACA,OACc;AACd,SAAO,aAAa,KAAK,EAAE,OAAO,SAAS,MAAM,GAAI,SAAS,CAAC,EAAG,GAAG,EAAE,OAAO,CAAC;AACjF;AAEA,SAAS,kBAAkB,MAAmC;AAC5D,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,eAAsB,KAAK,KAAqC;AAC9D,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,UAAU,KAAK,gBAAgB,iBAAiB;AAAA,EACzD;AAEA,QAAM,aAAa,IAAI,IAAI,IAAI,GAAG;AAClC,QAAM,cAAc,iBAAiB,UAAU;AAAA,IAC7C,OAAO,WAAW,aAAa,IAAI,OAAO,KAAK;AAAA,EACjD,CAAC;AACD,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,UAAU,KAAK,+CAA+C,oBAAoB;AAAA,MACvF,QAAQ,YAAY,MAAM;AAAA,IAC5B,CAAC;AAAA,EACH;AACA,QAAM,UAAU,YAAY,KAAK;AAEjC,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,IAAI,KAAK;AAAA,EAC9B,QAAQ;AACN,WAAO,UAAU,KAAK,oCAAoC,kBAAkB;AAAA,EAC9E;AAEA,QAAM,aAAa,kBAAkB,UAAU,UAAU;AACzD,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,UAAU,KAAK,yBAAyB,oBAAoB;AAAA,MACjE,QAAQ,WAAW,MAAM;AAAA,IAC3B,CAAC;AAAA,EACH;AAEA,MAAI;AACF,UAAM,kBAAkB;AAExB,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,cAAc,UAAU,QAAqB,aAAa;AAChE,UAAM,MAAM,MAAM,YAAY,QAAQ,KAAK,KAAK;AAAA,MAC9C,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAED,UAAM,WAAW,iBAAiB;AAAA,MAChC;AAAA,MACA,aAAa;AAAA,QACX,cAAc,IAAI;AAAA,QAClB,cAAc,IAAI;AAAA,MACpB;AAAA,MACA,wBAAwB;AAAA;AAAA;AAAA;AAAA;AAAA,MAKxB,sBAAsB;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO,UAAU,kBAAkB,SAAS,IAAI,GAAG,SAAS,SAAS,SAAS,IAAI;AAAA,IACpF;AAEA,WAAO,MAAM,eAAe;AAAA,MAC1B;AAAA,MACA,UAAU,WAAW,KAAK;AAAA,MAC1B,eAAe,WAAW,KAAK;AAAA,MAC/B,aAAa,WAAW,KAAK;AAAA,MAC7B,OAAO,WAAW,KAAK;AAAA,MACvB,gBAAgB,WAAW,KAAK,kBAAkB;AAAA,MAClD,aAAa;AAAA,QACX,UAAU,KAAK,YAAY;AAAA,QAC3B,gBAAgB,KAAK,SAAS;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb,UAAU,IAAI;AAAA,QACd,cAAc,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,kBAAkB;AACrC,aAAO,UAAU,kBAAkB,MAAM,IAAI,GAAG,MAAM,SAAS,MAAM,IAAI;AAAA,IAC3E;AACA,YAAQ,MAAM,qCAAqC,KAAK;AACxD,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/ai_assistant/api/ai/run-object/route.js

@@ -0,0 +1,167 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { loadAgentRegistry } from "../../../lib/agent-registry.js";
+import { checkAgentPolicy } from "../../../lib/agent-policy.js";
+import { runAiAgentObject } from "../../../lib/agent-runtime.js";
+import { AgentPolicyError } from "../../../lib/agent-tools.js";
+const MAX_MESSAGES = 100;
+const agentIdPattern = /^[a-z0-9_]+\.[a-z0-9_]+$/;
+const agentIdSchema = z.string().regex(agentIdPattern, 'agent must match "<module>.<agent>" (lowercase, digits, underscores only)');
+const chatMessageSchema = z.object({
+  role: z.enum(["user", "assistant", "system"]),
+  content: z.string()
+});
+const pageContextSchema = z.object({
+  pageId: z.string().optional(),
+  entityType: z.string().optional(),
+  recordId: z.string().optional()
+}).passthrough();
+const runObjectRequestSchema = z.object({
+  agent: agentIdSchema,
+  messages: z.array(chatMessageSchema).min(1, "messages must contain at least one message").max(MAX_MESSAGES, `messages must contain at most ${MAX_MESSAGES} entries`),
+  attachmentIds: z.array(z.string()).optional(),
+  pageContext: pageContextSchema.optional(),
+  modelOverride: z.string().optional()
+});
+const openApi = {
+  tag: "AI Assistant",
+  summary: "Run an AI agent in structured-output (object) mode",
+  methods: {
+    POST: {
+      operationId: "aiAssistantRunObject",
+      summary: "Run an object-mode AI agent and return the generated object",
+      description: 'Invokes `runAiAgentObject` server-side for the registered AI agent identified by `agent` (matching "<module>.<agent>"). Enforces the same `requiredFeatures`, tool whitelisting, mutationPolicy, and attachment media-type policy as the chat dispatcher, but additionally requires the agent to declare `executionMode: "object"`. Returns the generated object in a single JSON response (no streaming).',
+      requestBody: {
+        contentType: "application/json",
+        description: "Object-mode dispatch payload. `agent` and `messages` are required; `attachmentIds`, `pageContext`, and `modelOverride` are optional.",
+        schema: runObjectRequestSchema
+      },
+      responses: [
+        {
+          status: 200,
+          description: "Object-mode run completed; response body contains `{ object, usage?, finishReason? }`.",
+          mediaType: "application/json"
+        }
+      ],
+      errors: [
+        { status: 400, description: "Malformed payload or message cap exceeded." },
+        { status: 401, description: "Unauthenticated caller." },
+        { status: 403, description: "Caller lacks agent-level or tool-level required features." },
+        { status: 404, description: "Unknown agent id." },
+        { status: 409, description: "Agent/tool/execution-mode policy violation." },
+        { status: 422, description: "Agent does not support object-mode execution." },
+        { status: 500, description: "Internal runtime failure." }
+      ]
+    }
+  }
+};
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["ai_assistant.view"] }
+};
+function jsonError(status, message, code, extra) {
+  return NextResponse.json({ error: message, code, ...extra ?? {} }, { status });
+}
+function statusForDenyCode(code) {
+  switch (code) {
+    case "agent_unknown":
+      return 404;
+    case "agent_features_denied":
+    case "tool_features_denied":
+      return 403;
+    case "execution_mode_not_supported":
+      return 422;
+    case "tool_not_whitelisted":
+    case "tool_unknown":
+    case "mutation_blocked_by_readonly":
+    case "mutation_blocked_by_policy":
+      return 409;
+    case "attachment_type_not_accepted":
+      return 400;
+    default:
+      return 409;
+  }
+}
+async function POST(req) {
+  const auth = await getAuthFromRequest(req);
+  if (!auth) {
+    return jsonError(401, "Unauthorized", "unauthenticated");
+  }
+  let parsedBody;
+  try {
+    parsedBody = await req.json();
+  } catch {
+    return jsonError(400, "Request body must be valid JSON.", "validation_error");
+  }
+  const bodyResult = runObjectRequestSchema.safeParse(parsedBody);
+  if (!bodyResult.success) {
+    return jsonError(400, "Invalid request body.", "validation_error", {
+      issues: bodyResult.error.issues
+    });
+  }
+  try {
+    await loadAgentRegistry();
+    const container = await createRequestContainer();
+    const rbacService = container.resolve("rbacService");
+    const acl = await rbacService.loadAcl(auth.sub, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId
+    });
+    const decision = checkAgentPolicy({
+      agentId: bodyResult.data.agent,
+      authContext: {
+        userFeatures: acl.features,
+        isSuperAdmin: acl.isSuperAdmin
+      },
+      requestedExecutionMode: "object",
+      attachmentMediaTypes: void 0
+    });
+    if (!decision.ok) {
+      return jsonError(statusForDenyCode(decision.code), decision.message, decision.code);
+    }
+    const result = await runAiAgentObject({
+      agentId: bodyResult.data.agent,
+      input: bodyResult.data.messages,
+      attachmentIds: bodyResult.data.attachmentIds,
+      pageContext: bodyResult.data.pageContext,
+      modelOverride: bodyResult.data.modelOverride,
+      authContext: {
+        tenantId: auth.tenantId ?? null,
+        organizationId: auth.orgId ?? null,
+        userId: auth.sub,
+        features: acl.features,
+        isSuperAdmin: acl.isSuperAdmin
+      },
+      container
+    });
+    if (result.mode !== "generate") {
+      return jsonError(
+        422,
+        "Streaming object-mode is not supported by the run-object HTTP route; agent must use generate mode.",
+        "execution_mode_not_supported"
+      );
+    }
+    return NextResponse.json({
+      object: result.object,
+      finishReason: result.finishReason,
+      usage: result.usage
+    });
+  } catch (error) {
+    if (error instanceof AgentPolicyError) {
+      return jsonError(statusForDenyCode(error.code), error.message, error.code);
+    }
+    console.error("[AI Run Object] Dispatch failure:", error);
+    return jsonError(
+      500,
+      error instanceof Error ? error.message : "Agent object dispatch failed.",
+      "internal_error"
+    );
+  }
+}
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/ai_assistant/api/ai/run-object/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/ai_assistant/api/ai/run-object/route.ts"],
+  "sourcesContent": ["import { NextResponse, type NextRequest } from 'next/server'\nimport type { UIMessage } from 'ai'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { loadAgentRegistry } from '../../../lib/agent-registry'\nimport { checkAgentPolicy, type AgentPolicyDenyCode } from '../../../lib/agent-policy'\nimport { runAiAgentObject } from '../../../lib/agent-runtime'\nimport { AgentPolicyError } from '../../../lib/agent-tools'\n\nconst MAX_MESSAGES = 100\n\nconst agentIdPattern = /^[a-z0-9_]+\\.[a-z0-9_]+$/\n\nconst agentIdSchema = z\n  .string()\n  .regex(agentIdPattern, 'agent must match \"<module>.<agent>\" (lowercase, digits, underscores only)')\n\nconst chatMessageSchema = z.object({\n  role: z.enum(['user', 'assistant', 'system']),\n  content: z.string(),\n})\n\nconst pageContextSchema = z\n  .object({\n    pageId: z.string().optional(),\n    entityType: z.string().optional(),\n    recordId: z.string().optional(),\n  })\n  .passthrough()\n\nconst runObjectRequestSchema = z.object({\n  agent: agentIdSchema,\n  messages: z\n    .array(chatMessageSchema)\n    .min(1, 'messages must contain at least one message')\n    .max(MAX_MESSAGES, `messages must contain at most ${MAX_MESSAGES} entries`),\n  attachmentIds: z.array(z.string()).optional(),\n  pageContext: pageContextSchema.optional(),\n  modelOverride: z.string().optional(),\n})\n\nexport type AiRunObjectRequest = z.infer<typeof runObjectRequestSchema>\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'AI Assistant',\n  summary: 'Run an AI agent in structured-output (object) mode',\n  methods: {\n    POST: {\n      operationId: 'aiAssistantRunObject',\n      summary: 'Run an object-mode AI agent and return the generated object',\n      description:\n        'Invokes `runAiAgentObject` server-side for the registered AI agent identified by `agent` ' +\n        '(matching \"<module>.<agent>\"). Enforces the same `requiredFeatures`, tool whitelisting, ' +\n        'mutationPolicy, and attachment media-type policy as the chat dispatcher, but additionally ' +\n        'requires the agent to declare `executionMode: \"object\"`. Returns the generated object in ' +\n        'a single JSON response (no streaming).',\n      requestBody: {\n        contentType: 'application/json',\n        description:\n          'Object-mode dispatch payload. `agent` and `messages` are required; `attachmentIds`, `pageContext`, and `modelOverride` are optional.',\n        schema: runObjectRequestSchema,\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Object-mode run completed; response body contains `{ object, usage?, finishReason? }`.',\n          mediaType: 'application/json',\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Malformed payload or message cap exceeded.' },\n        { status: 401, description: 'Unauthenticated caller.' },\n        { status: 403, description: 'Caller lacks agent-level or tool-level required features.' },\n        { status: 404, description: 'Unknown agent id.' },\n        { status: 409, description: 'Agent/tool/execution-mode policy violation.' },\n        { status: 422, description: 'Agent does not support object-mode execution.' },\n        { status: 500, description: 'Internal runtime failure.' },\n      ],\n    },\n  },\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['ai_assistant.view'] },\n}\n\nfunction jsonError(\n  status: number,\n  message: string,\n  code: string,\n  extra?: Record<string, unknown>,\n): NextResponse {\n  return NextResponse.json({ error: message, code, ...(extra ?? {}) }, { status })\n}\n\nfunction statusForDenyCode(code: AgentPolicyDenyCode): number {\n  switch (code) {\n    case 'agent_unknown':\n      return 404\n    case 'agent_features_denied':\n    case 'tool_features_denied':\n      return 403\n    case 'execution_mode_not_supported':\n      return 422\n    case 'tool_not_whitelisted':\n    case 'tool_unknown':\n    case 'mutation_blocked_by_readonly':\n    case 'mutation_blocked_by_policy':\n      return 409\n    case 'attachment_type_not_accepted':\n      return 400\n    default:\n      return 409\n  }\n}\n\nexport async function POST(req: NextRequest): Promise<Response> {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return jsonError(401, 'Unauthorized', 'unauthenticated')\n  }\n\n  let parsedBody: unknown\n  try {\n    parsedBody = await req.json()\n  } catch {\n    return jsonError(400, 'Request body must be valid JSON.', 'validation_error')\n  }\n\n  const bodyResult = runObjectRequestSchema.safeParse(parsedBody)\n  if (!bodyResult.success) {\n    return jsonError(400, 'Invalid request body.', 'validation_error', {\n      issues: bodyResult.error.issues,\n    })\n  }\n\n  try {\n    await loadAgentRegistry()\n\n    const container = await createRequestContainer()\n    const rbacService = container.resolve<RbacService>('rbacService')\n    const acl = await rbacService.loadAcl(auth.sub, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n    })\n\n    const decision = checkAgentPolicy({\n      agentId: bodyResult.data.agent,\n      authContext: {\n        userFeatures: acl.features,\n        isSuperAdmin: acl.isSuperAdmin,\n      },\n      requestedExecutionMode: 'object',\n      attachmentMediaTypes: undefined,\n    })\n\n    if (!decision.ok) {\n      return jsonError(statusForDenyCode(decision.code), decision.message, decision.code)\n    }\n\n    const result = await runAiAgentObject({\n      agentId: bodyResult.data.agent,\n      input: bodyResult.data.messages as unknown as UIMessage[],\n      attachmentIds: bodyResult.data.attachmentIds,\n      pageContext: bodyResult.data.pageContext,\n      modelOverride: bodyResult.data.modelOverride,\n      authContext: {\n        tenantId: auth.tenantId ?? null,\n        organizationId: auth.orgId ?? null,\n        userId: auth.sub,\n        features: acl.features,\n        isSuperAdmin: acl.isSuperAdmin,\n      },\n      container,\n    })\n\n    if (result.mode !== 'generate') {\n      return jsonError(\n        422,\n        'Streaming object-mode is not supported by the run-object HTTP route; agent must use generate mode.',\n        'execution_mode_not_supported',\n      )\n    }\n\n    return NextResponse.json({\n      object: result.object,\n      finishReason: result.finishReason,\n      usage: result.usage,\n    })\n  } catch (error) {\n    if (error instanceof AgentPolicyError) {\n      return jsonError(statusForDenyCode(error.code), error.message, error.code)\n    }\n    console.error('[AI Run Object] Dispatch failure:', error)\n    return jsonError(\n      500,\n      error instanceof Error ? error.message : 'Agent object dispatch failed.',\n      'internal_error',\n    )\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAsC;AAE/C,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,yBAAyB;AAClC,SAAS,wBAAkD;AAC3D,SAAS,wBAAwB;AACjC,SAAS,wBAAwB;AAEjC,MAAM,eAAe;AAErB,MAAM,iBAAiB;AAEvB,MAAM,gBAAgB,EACnB,OAAO,EACP,MAAM,gBAAgB,2EAA2E;AAEpG,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,MAAM,EAAE,KAAK,CAAC,QAAQ,aAAa,QAAQ,CAAC;AAAA,EAC5C,SAAS,EAAE,OAAO;AACpB,CAAC;AAED,MAAM,oBAAoB,EACvB,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAChC,CAAC,EACA,YAAY;AAEf,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,OAAO;AAAA,EACP,UAAU,EACP,MAAM,iBAAiB,EACvB,IAAI,GAAG,4CAA4C,EACnD,IAAI,cAAc,iCAAiC,YAAY,UAAU;AAAA,EAC5E,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC5C,aAAa,kBAAkB,SAAS;AAAA,EACxC,eAAe,EAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAIM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,aAAa;AAAA,MACb,SAAS;AAAA,MACT,aACE;AAAA,MAKF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,aACE;AAAA,QACF,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,WAAW;AAAA,QACb;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,0BAA0B;AAAA,QACtD,EAAE,QAAQ,KAAK,aAAa,4DAA4D;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,8CAA8C;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,mBAAmB,EAAE;AACpE;AAEA,SAAS,UACP,QACA,SACA,MACA,OACc;AACd,SAAO,aAAa,KAAK,EAAE,OAAO,SAAS,MAAM,GAAI,SAAS,CAAC,EAAG,GAAG,EAAE,OAAO,CAAC;AACjF;AAEA,SAAS,kBAAkB,MAAmC;AAC5D,UAAQ,MAAM;AAAA,IACZ,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,eAAsB,KAAK,KAAqC;AAC9D,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,UAAU,KAAK,gBAAgB,iBAAiB;AAAA,EACzD;AAEA,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,IAAI,KAAK;AAAA,EAC9B,QAAQ;AACN,WAAO,UAAU,KAAK,oCAAoC,kBAAkB;AAAA,EAC9E;AAEA,QAAM,aAAa,uBAAuB,UAAU,UAAU;AAC9D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,UAAU,KAAK,yBAAyB,oBAAoB;AAAA,MACjE,QAAQ,WAAW,MAAM;AAAA,IAC3B,CAAC;AAAA,EACH;AAEA,MAAI;AACF,UAAM,kBAAkB;AAExB,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,cAAc,UAAU,QAAqB,aAAa;AAChE,UAAM,MAAM,MAAM,YAAY,QAAQ,KAAK,KAAK;AAAA,MAC9C,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAED,UAAM,WAAW,iBAAiB;AAAA,MAChC,SAAS,WAAW,KAAK;AAAA,MACzB,aAAa;AAAA,QACX,cAAc,IAAI;AAAA,QAClB,cAAc,IAAI;AAAA,MACpB;AAAA,MACA,wBAAwB;AAAA,MACxB,sBAAsB;AAAA,IACxB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO,UAAU,kBAAkB,SAAS,IAAI,GAAG,SAAS,SAAS,SAAS,IAAI;AAAA,IACpF;AAEA,UAAM,SAAS,MAAM,iBAAiB;AAAA,MACpC,SAAS,WAAW,KAAK;AAAA,MACzB,OAAO,WAAW,KAAK;AAAA,MACvB,eAAe,WAAW,KAAK;AAAA,MAC/B,aAAa,WAAW,KAAK;AAAA,MAC7B,eAAe,WAAW,KAAK;AAAA,MAC/B,aAAa;AAAA,QACX,UAAU,KAAK,YAAY;AAAA,QAC3B,gBAAgB,KAAK,SAAS;AAAA,QAC9B,QAAQ,KAAK;AAAA,QACb,UAAU,IAAI;AAAA,QACd,cAAc,IAAI;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,OAAO,SAAS,YAAY;AAC9B,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ,OAAO;AAAA,MACf,cAAc,OAAO;AAAA,MACrB,OAAO,OAAO;AAAA,IAChB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,kBAAkB;AACrC,aAAO,UAAU,kBAAkB,MAAM,IAAI,GAAG,MAAM,SAAS,MAAM,IAAI;AAAA,IAC3E;AACA,YAAQ,MAAM,qCAAqC,KAAK;AACxD,WAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}