@opengeni/events 0.2.5 → 0.2.7

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Cloudgeni-ai
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/index.js

@@ -17,10 +17,15 @@ function coalesceSessionEventDeltas(events) {
     }
     coalesced.push({
       ...run.first,
-      payload: {
-        text: run.text,
+      payload: run.first.type === "sandbox.command.output.delta" ? {
+        chunk: run.text,
         coalescedUntil: run.lastSequence,
-        ...run.first.type === "sandbox.command.output.delta" && run.sandboxName !== void 0 ? { name: run.sandboxName } : {}
+        ...run.sandboxStream !== void 0 ? { stream: run.sandboxStream } : {},
+        ...run.sandboxCommandId !== void 0 ? { commandId: run.sandboxCommandId } : {},
+        ...run.sandboxName !== void 0 ? { name: run.sandboxName } : {}
+      } : {
+        text: run.text,
+        coalescedUntil: run.lastSequence
       }
     });
     run = null;
@@ -31,8 +36,11 @@ function coalesceSessionEventDeltas(events) {
       coalesced.push(event);
       continue;
     }
-    const sandboxName = event.type === "sandbox.command.output.delta" ? sandboxDeltaName(event.payload) : void 0;
-    if (run && sameDeltaRun(run.first, event, run.sandboxName, sandboxName)) {
+    const isSandbox = event.type === "sandbox.command.output.delta";
+    const sandboxName = isSandbox ? sandboxDeltaName(event.payload) : void 0;
+    const sandboxStream = isSandbox ? sandboxDeltaString(event.payload, "stream") : void 0;
+    const sandboxCommandId = isSandbox ? sandboxDeltaString(event.payload, "commandId") : void 0;
+    if (run && sameDeltaRun(run.first, event, run.sandboxName, sandboxName) && run.sandboxStream === sandboxStream && run.sandboxCommandId === sandboxCommandId) {
       run.text += deltaText(event);
       run.lastSequence = event.sequence;
       continue;
@@ -42,7 +50,9 @@ function coalesceSessionEventDeltas(events) {
       first: event,
       lastSequence: event.sequence,
       text: deltaText(event),
-      sandboxName
+      sandboxName,
+      sandboxStream,
+      sandboxCommandId
     };
   }
   flush();
@@ -66,7 +76,12 @@ function deltaText(event) {
   }
   const payload = asRecord(event.payload);
   if (event.type === "sandbox.command.output.delta") {
-    return typeof payload.text === "string" ? payload.text : typeof payload.output === "string" ? payload.output : "";
+    for (const key of ["chunk", "text", "output"]) {
+      if (typeof payload[key] === "string") {
+        return payload[key];
+      }
+    }
+    return "";
   }
   return typeof payload.text === "string" ? payload.text : "";
 }
@@ -88,6 +103,10 @@ function sandboxDeltaName(payload) {
   const name = asRecord(payload).name;
   return typeof name === "string" ? name : void 0;
 }
+function sandboxDeltaString(payload, key) {
+  const value = asRecord(payload)[key];
+  return typeof value === "string" ? value : void 0;
+}
 function asRecord(value) {
   return value && typeof value === "object" ? value : {};
 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/coalesce.ts","../src/nats-jwt.ts"],"sourcesContent":["import type { SessionBusMessage, SessionEvent } from \"@opengeni/contracts\";\nimport { appendSessionEvents, sessionSubject, type AppendEventInput, type Database } from \"@opengeni/db\";\nimport { connect, JSONCodec, type ConnectionOptions, type Msg, type NatsConnection, type Subscription } from \"nats\";\n\nconst codec = JSONCodec<SessionBusMessage | SessionEvent>();\n\nexport type EventLogger = {\n  debug?: (message: string, attributes?: Record<string, unknown>) => void;\n  warn?: (message: string, attributes?: Record<string, unknown>) => void;\n};\n\nexport type EventBusOptions = {\n  logger?: EventLogger;\n};\n\nconst silentLogger: Required<EventLogger> = {\n  debug: () => {},\n  warn: () => {},\n};\n\nexport { coalesceSessionEventDeltas } from \"./coalesce\";\n\n/**\n * Reconnect + keepalive defaults applied to EVERY long-lived NATS connection\n * this package opens (the event bus AND the standalone auth-callout responder).\n *\n * The production outage these guard against: an in-cluster NATS broker pod\n * restart. nats.js's stock policy gives up after ~10 attempts (~20s) and the\n * client goes permanently CONNECTION_CLOSED — which takes the whole control\n * plane down with it: every session-create publishes events to NATS, and the\n * API-hosted auth-callout responder dies so BYO agents get \"authorization\n * violation\". Recovery then required a MANUAL api+worker restart. With these\n * options the client retries forever and auto-recovers the moment the broker\n * returns. Factored into one source of truth so the call sites never drift.\n *\n *  - `reconnect` + `maxReconnectAttempts: -1` — never give up (infinite retry).\n *  - `reconnectTimeWait` (2s base) + `reconnectJitter`/`reconnectJitterTLS`\n *    (up to 1s) — a fleet of api/worker pods doesn't thundering-herd the broker\n *    on recovery.\n *  - `waitOnFirstConnect` — a broker briefly unavailable at boot must not\n *    hard-fail the process; the client keeps trying instead of throwing.\n *  - `pingInterval`/`maxPingOut` — promptly detect a silently-dead socket so the\n *    reconnect machinery actually engages instead of hanging on a zombie.\n */\nconst RECONNECT_OPTIONS = {\n  reconnect: true,\n  maxReconnectAttempts: -1,\n  reconnectTimeWait: 2_000,\n  reconnectJitter: 1_000,\n  reconnectJitterTLS: 1_000,\n  waitOnFirstConnect: true,\n  pingInterval: 20_000,\n  maxPingOut: 3,\n} satisfies ConnectionOptions;\n\n/**\n * The single source of truth for a long-lived connection's resilience: merge the\n * reconnect/keepalive defaults UNDER the caller's connection options (servers +\n * optional auth/name). Every long-lived `connect()` in this package goes through\n * here so the two call sites can never diverge.\n */\nfunction withReconnectDefaults(options: ConnectionOptions): ConnectionOptions {\n  return { ...RECONNECT_OPTIONS, ...options };\n}\n\n/** How long a best-effort publish waits on `flush()` before giving up (see `publish`). */\nconst PUBLISH_FLUSH_TIMEOUT_MS = 2_000;\n\n/**\n * Await `nc.flush()` but never longer than `timeoutMs`. With infinite reconnect a\n * `flush()` issued while the broker is down does NOT reject — it pends until the\n * broker returns, which can be minutes. Racing it against a timer keeps a long\n * outage from stalling an in-flight turn; the published message stays buffered\n * and is delivered on reconnect regardless. A flush rejection (connection fully\n * CLOSED) is swallowed here so the timeout race never leaks an unhandled\n * rejection — the caller's publish path is what logs the drop.\n */\nasync function flushWithTimeout(nc: NatsConnection, timeoutMs: number): Promise<void> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<void>((resolve) => {\n    timer = setTimeout(resolve, timeoutMs);\n  });\n  try {\n    await Promise.race([nc.flush().catch(() => undefined), timeout]);\n  } finally {\n    if (timer) {\n      clearTimeout(timer);\n    }\n  }\n}\n\n/**\n * Drain a long-lived connection's status async-iterator to the log so a future\n * broker outage is OBSERVABLE (disconnect → reconnecting → reconnect → update).\n * Fire-and-forget for the connection's lifetime; the loop ends when the\n * connection closes. `label` distinguishes the event-bus connection from the\n * auth-callout responder in the logs.\n */\nfunction logConnectionStatus(\n  nc: NatsConnection,\n  label: string,\n  logger: EventLogger = silentLogger,\n  onStatus?: (type: string) => void,\n): void {\n  void (async () => {\n    try {\n      for await (const status of nc.status()) {\n        onStatus?.(status.type);\n        const attributes = { label, status: status.type, data: status.data };\n        if (isWarnNatsStatus(status.type)) {\n          (logger.warn ?? silentLogger.warn)(\"NATS connection status\", attributes);\n        } else {\n          (logger.debug ?? silentLogger.debug)(\"NATS connection status\", attributes);\n        }\n      }\n    } catch {\n      // The status iterator simply ends when the connection closes; never let it\n      // throw out of this background loop.\n    }\n  })();\n}\n\nfunction isWarnNatsStatus(type: string): boolean {\n  return type === \"disconnect\" || type === \"error\" || type === \"staleConnection\";\n}\n\nexport {\n  decodeAuthRequest,\n  mintAuthResponse,\n  mintUserJwt,\n  workspaceAgentPermissions,\n  type DecodedAuthRequest,\n  type MintAuthResponseInput,\n  type MintUserJwtInput,\n  type NatsPermission,\n  type NatsPermissions,\n} from \"./nats-jwt\";\n\n// Re-export the raw NATS primitives a consumer needs to open a direct connection or\n// generate nkeys (the auth-callout responder's standalone connection, the\n// agent-simulating integration tests). This keeps `nats` an internal dependency of\n// this leaf — callers in the bun workspace reach it through @opengeni/events rather\n// than depending on `nats` directly.\nexport { connect, nkeys, type NatsConnection } from \"nats\";\n\n/**\n * A raw request/reply reply — just the response bytes. Mirrors the subset of the\n * NATS `Msg` shape a binary request/reply caller needs (`NatsControlRpc` consumes\n * exactly this). Kept minimal so the events package does not leak the `nats` `Msg`\n * type into the agent-loop-free runtime leaf.\n */\nexport type RequestReply = { data: Uint8Array };\n\n/**\n * The minimal request/reply connection the selfhosted control plane consumes\n * (structurally identical to `@opengeni/runtime`'s `NatsRequestConnection`). The\n * API/worker hand this accessor to `NatsControlRpc` so the control transport rides\n * the SAME managed NATS connection the event bus already owns — a NATS connection\n * natively supports both pub/sub and request/reply, so there is NEVER a second\n * connection.\n */\nexport interface RequestConnection {\n  request(subject: string, payload: Uint8Array, opts: { timeout: number }): Promise<RequestReply>;\n}\n\n/**\n * A handler answering a request/reply on a subscribed subject: given the request\n * bytes (+ the concrete subject the message landed on, for `agent.<ws>.<id>.rpc`\n * style wildcard routing), return the response bytes to reply with. A thrown error\n * leaves the request unanswered (the caller's request times out / sees no\n * responder), which the control plane maps to `agent_offline` / reconnecting.\n */\nexport type RequestHandler = (request: Uint8Array, subject: string) => Promise<Uint8Array> | Uint8Array;\n\nexport type EventBus = {\n  publish: (workspaceId: string, sessionId: string, events: SessionEvent[]) => Promise<void>;\n  subscribe: (workspaceId: string, sessionId: string, onEvents: (events: SessionEvent[]) => void | Promise<void>) => Promise<() => void>;\n  /**\n   * Issue a binary request/reply on a subject over the bus's NATS connection\n   * (the selfhosted control plane: `agent.<ws>.<id>.rpc`). A new usage of what was\n   * a one-way bus — same connection, native NATS request/reply. Rejects on a\n   * no-responder (NATS 503) or a request timeout; the caller (`NatsControlRpc`)\n   * maps those to `agent_offline` / `agent_reconnecting`, never a NotFound.\n   */\n  request: (subject: string, payload: Uint8Array, opts: { timeoutMs: number }) => Promise<RequestReply>;\n  /**\n   * Subscribe-and-reply on a subject (the responder side — the enrolled agent, or\n   * a test stand-in for it): for every request on `subject`, call `handler` and\n   * `respond` with its bytes over the SAME connection. Returns an unsubscribe fn.\n   * A subject may be a NATS wildcard (e.g. `agent.*.*.rpc`).\n   */\n  subscribeRequests: (subject: string, handler: RequestHandler) => () => void;\n  /**\n   * Subscribe to the agent EVENT plane (the one-way fire-and-forget heartbeats +\n   * going-offline the agent PUBLISHES on `agent.<ws>.<id>.events`, NOT a\n   * request/reply). The M10 metrics-ingestion consumer subscribes the wildcard\n   * `agent.*.*.events` and gets each raw payload plus its concrete subject (so it\n   * can extract `<ws>`/`<id>` for the per-enrollment upsert). Returns an\n   * unsubscribe fn. Decoding the AgentEvent is the caller's concern (this leaf\n   * does not depend on `@opengeni/agent-proto`).\n   */\n  subscribeAgentEvents: (\n    subject: string,\n    handler: (payload: Uint8Array, subject: string) => void | Promise<void>,\n  ) => () => void;\n  /**\n   * The `RequestConnection` accessor the selfhosted `NatsControlRpc` consumes —\n   * the SAME managed connection (pub/sub + request/reply share it). The control\n   * plane injects this so the transport never opens a second connection.\n   */\n  getRequestConnection: () => RequestConnection;\n  isConnected?: () => boolean;\n  close: () => Promise<void>;\n};\n\n/**\n * Connect the event bus + control-plane request/reply over ONE managed NATS\n * connection. `auth` is the PRIVILEGED control-plane login (M-AUTH): when the\n * server runs with auth_callout, the api/worker authenticates as a static account\n * user permitted to request `agent.*.rpc` + receive its inbox replies. When `auth`\n * is omitted the connection is anonymous (local dev / a NATS without auth_callout)\n * — the existing behavior, unchanged.\n */\nexport async function createNatsEventBus(\n  natsUrl: string,\n  auth?: { user: string; pass: string },\n  options: EventBusOptions = {},\n): Promise<EventBus> {\n  const connectOptions: ConnectionOptions = { servers: natsUrl };\n  if (auth) {\n    connectOptions.user = auth.user;\n    connectOptions.pass = auth.pass;\n  }\n  const nc = await connect(withReconnectDefaults(connectOptions));\n  let connected = true;\n  logConnectionStatus(nc, \"event-bus\", options.logger, (type) => {\n    if (type === \"disconnect\" || type === \"reconnecting\" || type === \"staleConnection\" || type === \"error\") {\n      connected = false;\n    } else if (type === \"connect\" || type === \"reconnect\") {\n      connected = true;\n    }\n  });\n  const requestConnection: RequestConnection = {\n    request: async (subject, payload, opts) => requestReply(nc, subject, payload, opts.timeout),\n  };\n  return {\n    publish: async (workspaceId, sessionId, events) => {\n      if (events.length === 0) {\n        return;\n      }\n      // Best-effort LIVE fan-out. These events are ALREADY durably appended to\n      // the DB before we get here (they carry a DB-assigned `sequence`), and\n      // every consumer reconciles from that durable log — the server SSE stream\n      // replays + gap-backfills via `listSessionEvents`, and the SDK client\n      // reconnects and replays from the durable events endpoint. So a publish\n      // that fails during a broker blip only delays LIVE delivery (healed by the\n      // next successful publish's gap-backfill, or a stream reconnect); it must\n      // never throw the in-flight turn to death.\n      try {\n        nc.publish(sessionSubject(workspaceId, sessionId), codec.encode({ workspaceId, sessionId, events }));\n      } catch (error) {\n        // `publish()` throws synchronously only when the connection is fully\n        // CLOSED (with infinite reconnect, effectively never outside shutdown).\n        (options.logger?.warn ?? silentLogger.warn)(\"NATS live publish dropped; events are durable in the DB and reconcile on stream replay\", {\n          workspaceId,\n          sessionId,\n          error: error instanceof Error ? error.message : String(error),\n        });\n        return;\n      }\n      await flushWithTimeout(nc, PUBLISH_FLUSH_TIMEOUT_MS);\n    },\n    subscribe: async (workspaceId, sessionId, onEvents) => subscribeSession(nc, workspaceId, sessionId, onEvents),\n    request: async (subject, payload, opts) => requestReply(nc, subject, payload, opts.timeoutMs),\n    subscribeRequests: (subject, handler) => subscribeRequests(nc, subject, handler),\n    subscribeAgentEvents: (subject, handler) => subscribeAgentEvents(nc, subject, handler),\n    getRequestConnection: () => requestConnection,\n    isConnected: () => connected && !nc.isClosed() && !nc.isDraining(),\n    close: async () => {\n      await nc.drain();\n    },\n  };\n}\n\n/**\n * A standalone NATS connection answering request/reply on ONE subject — the\n * transport primitive the auth-callout responder uses. It is DELIBERATELY a\n * SEPARATE connection from the event bus: the callout responder authenticates as\n * the callout account's `auth_users` user (a username/password or token in the\n * `AUTH` account), which is a DIFFERENT identity from the control-plane's\n * privileged account that the event bus + `NatsControlRpc` ride. One connection\n * per identity; never multiplex the two.\n *\n * `request`/`reply` here is the RAW NATS request/reply (`$SYS.REQ.USER.AUTH`): the\n * server publishes an authorization request with a reply inbox; the handler returns\n * the signed authorization-response bytes which we `respond` on that inbox.\n */\nexport interface ResponderConnection {\n  /** Subscribe-and-reply on `subject`; returns an async close that drains. */\n  close: () => Promise<void>;\n}\n\n/** Connection auth for a standalone NATS connection (the callout responder). */\nexport type NatsConnectAuth =\n  | { kind: \"user-password\"; user: string; pass: string }\n  | { kind: \"token\"; token: string }\n  | { kind: \"anonymous\" };\n\n/**\n * Open a standalone NATS connection and subscribe `subject`, replying to every\n * request with `handler(requestBytes, subject)`. Used by the auth-callout\n * responder to serve `$SYS.REQ.USER.AUTH` as the callout auth user. Returns a\n * handle whose `close()` drains the connection. A handler that throws leaves the\n * request UNANSWERED — for auth-callout that means the server denies the\n * connection on its own timeout, which is the correct fail-closed behavior (a\n * responder bug must never accidentally grant access).\n */\nexport async function createResponderConnection(\n  natsUrl: string,\n  auth: NatsConnectAuth,\n  subject: string,\n  handler: RequestHandler,\n  options: { name?: string; logger?: EventLogger } = {},\n): Promise<ResponderConnection> {\n  const connectOptions: ConnectionOptions = { servers: natsUrl };\n  if (options.name) {\n    connectOptions.name = options.name;\n  }\n  if (auth.kind === \"user-password\") {\n    connectOptions.user = auth.user;\n    connectOptions.pass = auth.pass;\n  } else if (auth.kind === \"token\") {\n    connectOptions.token = auth.token;\n  }\n  const nc = await connect(withReconnectDefaults(connectOptions));\n  logConnectionStatus(nc, options.name ? `auth-callout:${options.name}` : \"auth-callout\", options.logger);\n  const sub: Subscription = nc.subscribe(subject);\n  void (async () => {\n    for await (const msg of sub) {\n      if (!msg.reply) {\n        continue;\n      }\n      try {\n        const reply = await handler(msg.data, msg.subject);\n        msg.respond(reply);\n      } catch {\n        // Leave UNANSWERED — fail-closed. The server denies the connect attempt\n        // on its callout timeout; a responder error never grants access.\n      }\n    }\n  })();\n  return {\n    close: async () => {\n      sub.unsubscribe();\n      await nc.drain();\n    },\n  };\n}\n\nexport async function appendAndPublishEvents(db: Database, bus: EventBus, workspaceId: string, sessionId: string, events: AppendEventInput[]): Promise<SessionEvent[]> {\n  const appended = await appendSessionEvents(db, workspaceId, sessionId, events);\n  // The DB append above is the durable system of record; the publish is only a\n  // best-effort LIVE fan-out. Guard it so NO EventBus implementation can throw an\n  // in-flight agent turn to death on a transient NATS disconnect — consumers\n  // reconcile any missed live events from the durable log via the events/stream\n  // endpoint (DB replay + gap-backfill). The managed `createNatsEventBus` bus\n  // already swallows internally, so this catch is the belt-and-suspenders guard\n  // for any other bus impl (and a fully CLOSED connection during shutdown).\n  try {\n    await bus.publish(workspaceId, sessionId, appended);\n  } catch (error) {\n    console.warn(\n      `[events] live publish failed for ${workspaceId}/${sessionId}; ${appended.length} event(s) are durable and reconcile on stream replay`,\n      error,\n    );\n  }\n  return appended;\n}\n\nfunction subscribeSession(nc: NatsConnection, workspaceId: string, sessionId: string, onEvents: (events: SessionEvent[]) => void | Promise<void>): () => void {\n  const sub: Subscription = nc.subscribe(sessionSubject(workspaceId, sessionId));\n  void (async () => {\n    for await (const msg of sub) {\n      const decoded = codec.decode(msg.data) as SessionBusMessage | SessionEvent;\n      const events = \"events\" in decoded ? decoded.events : [decoded];\n      await onEvents(events);\n    }\n  })();\n  return () => {\n    sub.unsubscribe();\n  };\n}\n\n/**\n * A binary request/reply over the managed connection. Returns ONLY the reply\n * bytes (the `RequestReply` shape) — the request/reply error semantics (a\n * no-responder NATS 503, a request timeout) propagate as the rejected promise so\n * the caller owns the mapping. The reply is delivered via the connection's\n * built-in mux inbox; no extra subscription is created here.\n */\nasync function requestReply(nc: NatsConnection, subject: string, payload: Uint8Array, timeout: number): Promise<RequestReply> {\n  const msg: Msg = await nc.request(subject, payload, { timeout });\n  return { data: msg.data };\n}\n\n/**\n * Subscribe to `subject` and reply to every request with the handler's bytes,\n * over the SAME connection. The responder side of request/reply: each delivered\n * `Msg` carries a `reply` inbox; `msg.respond(bytes)` publishes the answer there.\n * A handler that throws (or a message with no `reply` subject) is left unanswered\n * — the requester then sees a timeout, never a malformed reply.\n */\nfunction subscribeRequests(nc: NatsConnection, subject: string, handler: RequestHandler): () => void {\n  const sub: Subscription = nc.subscribe(subject);\n  void (async () => {\n    for await (const msg of sub) {\n      // A request always carries a reply inbox; a plain publish to this subject\n      // (no reply) is ignored — request/reply is the only contract here.\n      if (!msg.reply) {\n        continue;\n      }\n      try {\n        const reply = await handler(msg.data, msg.subject);\n        msg.respond(reply);\n      } catch {\n        // Leave the request unanswered: the requester's request times out, which\n        // the selfhosted control plane reads as a transient blip (reconnecting),\n        // never a malformed reply. The responder stays subscribed for the next op.\n      }\n    }\n  })();\n  return () => {\n    sub.unsubscribe();\n  };\n}\n\n/**\n * Subscribe to the one-way agent event plane: deliver each published payload (the\n * agent's `AgentEvent` heartbeat / going-offline, NOT a request/reply) to the\n * handler with its concrete subject. A plain `nc.subscribe` (no reply); a handler\n * that throws is swallowed so one bad event never tears down the subscription\n * (ingestion is best-effort — a metrics gap is never fatal).\n */\nfunction subscribeAgentEvents(\n  nc: NatsConnection,\n  subject: string,\n  handler: (payload: Uint8Array, subject: string) => void | Promise<void>,\n): () => void {\n  const sub: Subscription = nc.subscribe(subject);\n  void (async () => {\n    for await (const msg of sub) {\n      try {\n        await handler(msg.data, msg.subject);\n      } catch {\n        // Swallow: best-effort ingestion. The subscription stays live for the\n        // next event.\n      }\n    }\n  })();\n  return () => {\n    sub.unsubscribe();\n  };\n}\n\nexport function formatSse(event: SessionEvent): string {\n  return [\n    `id: ${event.sequence}`,\n    `event: ${event.type}`,\n    `data: ${JSON.stringify(event)}`,\n    \"\",\n    \"\",\n  ].join(\"\\n\");\n}\n","import type { SessionEvent } from \"@opengeni/contracts\";\n\nconst COALESCIBLE_DELTA_TYPES = new Set([\n  \"agent.message.delta\",\n  \"agent.reasoning.delta\",\n  \"sandbox.command.output.delta\",\n]);\n\ntype DeltaRun = {\n  first: SessionEvent;\n  lastSequence: number;\n  text: string;\n  sandboxName: string | undefined;\n};\n\nexport function coalesceSessionEventDeltas(events: SessionEvent[]): SessionEvent[] {\n  const coalesced: SessionEvent[] = [];\n  let run: DeltaRun | null = null;\n\n  const flush = () => {\n    if (!run) {\n      return;\n    }\n    coalesced.push({\n      ...run.first,\n      payload: {\n        text: run.text,\n        coalescedUntil: run.lastSequence,\n        ...(run.first.type === \"sandbox.command.output.delta\" && run.sandboxName !== undefined\n          ? { name: run.sandboxName }\n          : {}),\n      },\n    });\n    run = null;\n  };\n\n  for (const event of events) {\n    if (!isCoalescibleDelta(event)) {\n      flush();\n      coalesced.push(event);\n      continue;\n    }\n\n    const sandboxName = event.type === \"sandbox.command.output.delta\" ? sandboxDeltaName(event.payload) : undefined;\n    if (run && sameDeltaRun(run.first, event, run.sandboxName, sandboxName)) {\n      run.text += deltaText(event);\n      run.lastSequence = event.sequence;\n      continue;\n    }\n\n    flush();\n    run = {\n      first: event,\n      lastSequence: event.sequence,\n      text: deltaText(event),\n      sandboxName,\n    };\n  }\n\n  flush();\n  return coalesced;\n}\n\nfunction isCoalescibleDelta(event: SessionEvent): boolean {\n  return COALESCIBLE_DELTA_TYPES.has(event.type);\n}\n\nfunction sameDeltaRun(\n  first: SessionEvent,\n  next: SessionEvent,\n  firstSandboxName: string | undefined,\n  nextSandboxName: string | undefined,\n): boolean {\n  if (first.type !== next.type) {\n    return false;\n  }\n  if ((first.turnId ?? null) !== (next.turnId ?? null)) {\n    return false;\n  }\n  return first.type !== \"sandbox.command.output.delta\" || firstSandboxName === nextSandboxName;\n}\n\nfunction deltaText(event: SessionEvent): string {\n  if (event.type === \"agent.reasoning.delta\") {\n    return reasoningText(event.payload);\n  }\n  const payload = asRecord(event.payload);\n  if (event.type === \"sandbox.command.output.delta\") {\n    return typeof payload.text === \"string\" ? payload.text : typeof payload.output === \"string\" ? payload.output : \"\";\n  }\n  return typeof payload.text === \"string\" ? payload.text : \"\";\n}\n\nfunction reasoningText(payload: unknown): string {\n  const record = asRecord(payload);\n  if (typeof record.text === \"string\") {\n    return record.text;\n  }\n  const content = asRecord(asRecord(record.item).rawItem).content;\n  if (!Array.isArray(content)) {\n    return \"\";\n  }\n  return content\n    .map((part) => {\n      const text = asRecord(part).text;\n      return typeof text === \"string\" ? text : \"\";\n    })\n    .join(\"\");\n}\n\nfunction sandboxDeltaName(payload: unknown): string | undefined {\n  const name = asRecord(payload).name;\n  return typeof name === \"string\" ? name : undefined;\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === \"object\" ? value as Record<string, unknown> : {};\n}\n","// packages/events/src/nats-jwt.ts — NATS JWT v2 signing for the auth-callout\n// responder (bring-your-own-compute M-AUTH; dossier §10.1 NATS Accounts per\n// workspace + §17 the isolation smoke).\n//\n// This is the cryptographic core of the auth-callout tenancy boundary. When an\n// external agent connects to NATS presenting its `oge_` enrollment bearer as the\n// connect auth-token, nats-server (configured with `auth_callout`) issues an\n// authorization request on `$SYS.REQ.USER.AUTH`. Our responder (auth-callout.ts)\n// validates the bearer and answers with a SIGNED authorization-response JWT that\n// embeds a SIGNED user JWT scoping the connection to publish/subscribe ONLY\n// `agent.<workspaceId>.>` (+ the reply `_INBOX.>`). That per-subject permission\n// set IS the per-workspace isolation: workspace A's agent literally cannot\n// pub/sub workspace B's subjects (§19 the NATS-Accounts-misconfig leak risk is\n// closed at the JWT-permission layer, not just by subject naming).\n//\n// WHY HAND-ROLL THE JWT ENCODING (vs a dep): the NATS JWT v2 wire format is small,\n// stable, and fully specified (ADR-26 + nats-io/jwt): a base64url header\n// `{\"typ\":\"JWT\",\"alg\":\"ed25519-nkey\"}`, base64url JSON claims whose `jti` is the\n// base32(SHA-512/256(claims-with-blank-jti)), and an ed25519 nkey signature over\n// `header.payload`. nkeys (re-exported by the `nats` package we already depend on)\n// gives us the ed25519 sign primitive; Node `crypto` gives SHA-512/256. So we own\n// the encoding in a few well-tested functions rather than pull an alpha\n// `@nats-io/jwt` (0.0.x) whose nkeys-version compat is uncertain. No `xkey`\n// encryption is used (the bearer is already an authenticated identity claim and\n// the wire is TLS — encryption is an optional ADR-26 hardening, off here).\n//\n// SECURITY: the account SIGNING SEED never leaves this process and is NEVER logged.\n// Callers pass it as a `string` seed; we `fromSeed` it once per sign. The bearer\n// the responder validates is HMAC-verified elsewhere (verifyEnrollmentBearer); this\n// module only mints the scoped NATS credential once identity is proven.\n\nimport { createHash } from \"node:crypto\";\nimport { nkeys } from \"nats\";\n\n/** The NATS JWT v2 header — constant for every token we mint (ADR-26 / nats-io/jwt:\n *  `TokenTypeJwt=\"JWT\"`, `AlgorithmNkey=\"ed25519-nkey\"`). */\nconst JWT_HEADER = { typ: \"JWT\", alg: \"ed25519-nkey\" } as const;\n\n/** NATS user-claim `nats.type` discriminator + `nats.version` for v2 claims. */\nconst USER_CLAIM_TYPE = \"user\";\nconst AUTH_RESPONSE_CLAIM_TYPE = \"authorization_response\";\nconst NATS_CLAIM_VERSION = 2;\n\n/** A NATS permission set: subject allow/deny lists (ADR-26 `pub`/`sub` →\n *  `allow`/`deny`). An empty/undefined list means \"no explicit grant\" — combined\n *  with the agent scope below, the connection can ONLY reach what `allow` lists. */\nexport interface NatsPermission {\n  allow?: string[];\n  deny?: string[];\n}\n\n/** The pub/sub permissions embedded in a user JWT. */\nexport interface NatsPermissions {\n  pub: NatsPermission;\n  sub: NatsPermission;\n}\n\n/**\n * The minimal nkey keypair surface this module needs — exactly what\n * `nkeys.fromSeed(seed)` returns. Declared structurally so the module does not\n * leak the `nats` nkeys type through its public signature.\n */\ninterface NkeyPair {\n  getPublicKey(): string;\n  sign(input: Uint8Array): Uint8Array;\n}\n\n/** base64url (RawURLEncoding — no padding), matching nats-io/jwt's `serialize`. */\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  return Buffer.from(bytes).toString(\"base64url\");\n}\n\n/** RFC 4648 base32 (standard alphabet, NO padding) — the encoding nats-io/jwt\n *  uses for the `jti` hash. Node has no built-in base32, so a tiny encoder. */\nconst BASE32_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZ234567\";\nfunction base32NoPadding(bytes: Uint8Array): string {\n  let bits = 0;\n  let value = 0;\n  let out = \"\";\n  for (const byte of bytes) {\n    value = (value << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      bits -= 5;\n      out += BASE32_ALPHABET[(value >>> bits) & 31];\n    }\n  }\n  if (bits > 0) {\n    out += BASE32_ALPHABET[(value << (5 - bits)) & 31];\n  }\n  return out;\n}\n\n/**\n * Compute the canonical NATS `jti`: base32(NoPadding, std-alphabet) of the\n * SHA-512/256 of the claims object SERIALIZED WITH AN EMPTY `jti` (nats-io/jwt's\n * `hash`). nats-server recomputes + verifies this on decode, so it must match\n * byte-for-byte. We serialize the SAME object we will sign, only with `jti:\"\"`.\n */\nfunction computeJti(claimsWithBlankJti: object): string {\n  const json = JSON.stringify(claimsWithBlankJti);\n  const digest = createHash(\"sha512-256\").update(json, \"utf8\").digest();\n  return base32NoPadding(digest);\n}\n\n/**\n * Encode + sign a NATS v2 JWT. The `claims` MUST already carry `iss`/`sub`/`iat`\n * (+ optional `aud`/`exp`) and a `nats` block; this function fills `jti` (the\n * canonical hash), serializes `header.payload`, signs that with `signingKey`, and\n * appends the base64url signature. Returns the compact `header.payload.signature`.\n */\nfunction encodeJwt(claims: Record<string, unknown>, signingKey: NkeyPair): string {\n  // jti is the hash of the claims with jti blanked — set it blank, hash, then set.\n  const withBlankJti = { ...claims, jti: \"\" };\n  const jti = computeJti(withBlankJti);\n  const finalClaims = { ...claims, jti };\n\n  const header = base64UrlEncode(Buffer.from(JSON.stringify(JWT_HEADER), \"utf8\"));\n  const payload = base64UrlEncode(Buffer.from(JSON.stringify(finalClaims), \"utf8\"));\n  const signingInput = `${header}.${payload}`;\n  const signature = signingKey.sign(Buffer.from(signingInput, \"utf8\"));\n  return `${signingInput}.${base64UrlEncode(signature)}`;\n}\n\n/**\n * Input to mint a workspace-scoped NATS user JWT for an enrolled agent.\n *   - `userPublicKey` — the `user_nkey` from the authorization request; it MUST be\n *     the `sub` of the user JWT (nats-server rejects a mismatch).\n *   - `accountSeed` — the callout account SIGNING seed (`SA...`); both the user JWT\n *     `iss` (its public key) and the signature come from it. NEVER logged.\n *   - `name` — a human label for the user (the agent id), for server logs.\n *   - `permissions` — the pub/sub allow/deny lists (the workspace scope).\n *   - `expiresAtSeconds` — optional absolute `exp` (unix seconds). When set the\n *     server will expire the connection's credential; we tie it to the bearer's\n *     remaining life so a revoked/expired enrollment cannot outlive its bearer.\n */\nexport interface MintUserJwtInput {\n  userPublicKey: string;\n  accountSeed: string;\n  name: string;\n  permissions: NatsPermissions;\n  /** The target account NAME (the `auth_callout.account`) the user binds to; the\n   *  embedded user JWT's `aud` in server-config mode. */\n  audienceAccount: string;\n  expiresAtSeconds?: number;\n}\n\n/**\n * Mint a signed NATS user JWT scoped by `permissions`. In auth-callout SERVER\n * mode the user JWT is signed by the callout ISSUER ACCOUNT key, and its `iss` is\n * that account's public key. The returned JWT is embedded as `nats.jwt` in the\n * authorization response.\n */\nexport function mintUserJwt(input: MintUserJwtInput): string {\n  const accountKey = nkeys.fromSeed(Buffer.from(input.accountSeed)) as unknown as NkeyPair;\n  const accountPublicKey = accountKey.getPublicKey();\n  const nowSeconds = Math.floor(Date.now() / 1000);\n\n  const natsBlock: Record<string, unknown> = {\n    type: USER_CLAIM_TYPE,\n    version: NATS_CLAIM_VERSION,\n    pub: input.permissions.pub,\n    sub: input.permissions.sub,\n    // Unlimited subscriptions / data / payload (the workspace subject scope, NOT\n    // a connection-resource quota, is the boundary here).\n    subs: -1,\n    data: -1,\n    payload: -1,\n  };\n\n  const claims: Record<string, unknown> = {\n    jti: \"\",\n    iat: nowSeconds,\n    iss: accountPublicKey,\n    name: input.name,\n    sub: input.userPublicKey,\n    // SERVER-config-mode placement: nats-server reads the embedded user JWT's `aud`\n    // as the target account NAME (the configured `auth_callout.account`). This is\n    // how the authenticated user binds to that account; the workspace isolation is\n    // then carried by the pub/sub permissions below.\n    aud: input.audienceAccount,\n    nats: natsBlock,\n  };\n  if (typeof input.expiresAtSeconds === \"number\") {\n    claims.exp = input.expiresAtSeconds;\n  }\n  return encodeJwt(claims, accountKey);\n}\n\n/**\n * Input to mint the authorization RESPONSE JWT the responder publishes back on the\n * request's reply subject (ADR-26 §3).\n *   - `userPublicKey` — the request's `user_nkey`; the response `sub`.\n *   - `serverId` — the request's `nats.server_id.id` (the server's public key); the\n *     response `aud`.\n *   - `accountSeed` — the callout account signing seed; signs the response and is\n *     its `iss` (public key). NEVER logged.\n *   - `userJwt` — the embedded signed user JWT (omit on a denial).\n *   - `error` — a human-readable denial message (omit on success). When present the\n *     server denies the connection.\n */\nexport interface MintAuthResponseInput {\n  userPublicKey: string;\n  serverId: string;\n  accountSeed: string;\n  userJwt?: string;\n  error?: string;\n}\n\n/**\n * Mint the signed authorization-response JWT. On success it carries the embedded\n * user JWT (`nats.jwt`); on denial it carries `nats.error` and NO user JWT, which\n * makes nats-server refuse the connection. Signed by the callout account key (its\n * public key is `iss`); `sub` is the user_nkey, `aud` is the server id.\n */\nexport function mintAuthResponse(input: MintAuthResponseInput): string {\n  const accountKey = nkeys.fromSeed(Buffer.from(input.accountSeed)) as unknown as NkeyPair;\n  const accountPublicKey = accountKey.getPublicKey();\n  const nowSeconds = Math.floor(Date.now() / 1000);\n\n  const natsBlock: Record<string, unknown> = {\n    type: AUTH_RESPONSE_CLAIM_TYPE,\n    version: NATS_CLAIM_VERSION,\n  };\n  if (input.userJwt) {\n    natsBlock.jwt = input.userJwt;\n  }\n  if (input.error) {\n    natsBlock.error = input.error;\n  }\n\n  const claims: Record<string, unknown> = {\n    jti: \"\",\n    iat: nowSeconds,\n    iss: accountPublicKey,\n    // The response `aud` MUST be the SERVER public key in server-config mode\n    // (nats-server validates \"Audience must be a server public key\"). The\n    // authenticated user is placed into the configured `auth_callout.account` (the\n    // SAME account the responder + the privileged control plane connect into), so\n    // `agent.<ws>.<id>.rpc` request/reply routes; the workspace isolation is carried\n    // entirely by the user JWT's pub/sub subject permissions (NOT by cross-account\n    // placement, which server-config-mode nats does not support — nats-io#4335).\n    aud: input.serverId,\n    sub: input.userPublicKey,\n    nats: natsBlock,\n  };\n  return encodeJwt(claims, accountKey);\n}\n\n/**\n * The fields the responder needs out of the authorization REQUEST JWT (ADR-26 §2).\n * The request is itself a NATS JWT (`header.payload.signature`) the server signs;\n * we only DECODE it (the server proves its own identity by the connection, and the\n * embedded `auth_token` is independently HMAC-verified), so we read the payload\n * without re-verifying the server signature.\n */\nexport interface DecodedAuthRequest {\n  /** The public user nkey the response user JWT MUST be `sub`-scoped to. */\n  userNkey: string;\n  /** The server's public id — the response `aud`. */\n  serverId: string;\n  /** The connect `auth_token` the client presented (our `oge_` bearer), if any. */\n  authToken: string | undefined;\n  /** The connect username, if any (unused today; present for completeness). */\n  user: string | undefined;\n}\n\n/**\n * Decode the authorization-request JWT payload (the middle base64url segment). The\n * request shape (ADR-26 §2): `nats.user_nkey`, `nats.server_id.id`, and the\n * presented connect options under `nats.connect_opts` (`auth_token` / `user`).\n * Returns null on a malformed token so the caller can deny cleanly.\n */\nexport function decodeAuthRequest(token: string): DecodedAuthRequest | null {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) {\n    return null;\n  }\n  let payload: unknown;\n  try {\n    payload = JSON.parse(Buffer.from(parts[1]!, \"base64url\").toString(\"utf8\"));\n  } catch {\n    return null;\n  }\n  if (typeof payload !== \"object\" || payload === null) {\n    return null;\n  }\n  const nats = (payload as { nats?: unknown }).nats;\n  if (typeof nats !== \"object\" || nats === null) {\n    return null;\n  }\n  const natsObj = nats as {\n    user_nkey?: unknown;\n    server_id?: { id?: unknown } | unknown;\n    connect_opts?: { auth_token?: unknown; user?: unknown } | unknown;\n  };\n  const userNkey = typeof natsObj.user_nkey === \"string\" ? natsObj.user_nkey : null;\n  if (!userNkey) {\n    return null;\n  }\n  const serverIdRaw =\n    typeof natsObj.server_id === \"object\" && natsObj.server_id !== null\n      ? (natsObj.server_id as { id?: unknown }).id\n      : undefined;\n  const serverId = typeof serverIdRaw === \"string\" ? serverIdRaw : \"\";\n  const connectOpts =\n    typeof natsObj.connect_opts === \"object\" && natsObj.connect_opts !== null\n      ? (natsObj.connect_opts as { auth_token?: unknown; user?: unknown })\n      : {};\n  const authToken = typeof connectOpts.auth_token === \"string\" ? connectOpts.auth_token : undefined;\n  const user = typeof connectOpts.user === \"string\" ? connectOpts.user : undefined;\n  return { userNkey, serverId, authToken, user };\n}\n\n/**\n * Build the workspace-scoped permission set for an agent: it may publish + subscribe\n * ONLY `agent.<workspaceId>.>` (its own RPC/event/hello subtree) and the reply\n * `_INBOX.>` subtree (so request/reply round-trips work). Everything else is\n * implicitly denied (an allow-list with no other entries IS the deny-all-else).\n *\n * THE isolation assertion (§17): with `workspaceId=A`, the returned allow lists name\n * only `agent.A.>` — so a connection bearing this credential is rejected by\n * nats-server the instant it tries to pub/sub `agent.B.>`. This is the per-workspace\n * tenancy boundary, enforced cryptographically by the signed JWT, not by naming.\n */\nexport function workspaceAgentPermissions(workspaceId: string): NatsPermissions {\n  const agentScope = `agent.${workspaceId}.>`;\n  // The reply-inbox subtree must be reachable for request/reply (the control plane\n  // requests on agent.<ws>.<id>.rpc with a reply inbox; the agent responds there).\n  const inboxScope = \"_INBOX.>\";\n  return {\n    pub: { allow: [agentScope, inboxScope] },\n    sub: { allow: [agentScope, inboxScope] },\n  };\n}\n"],"mappings":";AACA,SAAS,qBAAqB,sBAA4D;AAC1F,SAAS,SAAS,iBAA2F;;;ACA7G,IAAM,0BAA0B,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF,CAAC;AASM,SAAS,2BAA2B,QAAwC;AACjF,QAAM,YAA4B,CAAC;AACnC,MAAI,MAAuB;AAE3B,QAAM,QAAQ,MAAM;AAClB,QAAI,CAAC,KAAK;AACR;AAAA,IACF;AACA,cAAU,KAAK;AAAA,MACb,GAAG,IAAI;AAAA,MACP,SAAS;AAAA,QACP,MAAM,IAAI;AAAA,QACV,gBAAgB,IAAI;AAAA,QACpB,GAAI,IAAI,MAAM,SAAS,kCAAkC,IAAI,gBAAgB,SACzE,EAAE,MAAM,IAAI,YAAY,IACxB,CAAC;AAAA,MACP;AAAA,IACF,CAAC;AACD,UAAM;AAAA,EACR;AAEA,aAAW,SAAS,QAAQ;AAC1B,QAAI,CAAC,mBAAmB,KAAK,GAAG;AAC9B,YAAM;AACN,gBAAU,KAAK,KAAK;AACpB;AAAA,IACF;AAEA,UAAM,cAAc,MAAM,SAAS,iCAAiC,iBAAiB,MAAM,OAAO,IAAI;AACtG,QAAI,OAAO,aAAa,IAAI,OAAO,OAAO,IAAI,aAAa,WAAW,GAAG;AACvE,UAAI,QAAQ,UAAU,KAAK;AAC3B,UAAI,eAAe,MAAM;AACzB;AAAA,IACF;AAEA,UAAM;AACN,UAAM;AAAA,MACJ,OAAO;AAAA,MACP,cAAc,MAAM;AAAA,MACpB,MAAM,UAAU,KAAK;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,QAAM;AACN,SAAO;AACT;AAEA,SAAS,mBAAmB,OAA8B;AACxD,SAAO,wBAAwB,IAAI,MAAM,IAAI;AAC/C;AAEA,SAAS,aACP,OACA,MACA,kBACA,iBACS;AACT,MAAI,MAAM,SAAS,KAAK,MAAM;AAC5B,WAAO;AAAA,EACT;AACA,OAAK,MAAM,UAAU,WAAW,KAAK,UAAU,OAAO;AACpD,WAAO;AAAA,EACT;AACA,SAAO,MAAM,SAAS,kCAAkC,qBAAqB;AAC/E;AAEA,SAAS,UAAU,OAA6B;AAC9C,MAAI,MAAM,SAAS,yBAAyB;AAC1C,WAAO,cAAc,MAAM,OAAO;AAAA,EACpC;AACA,QAAM,UAAU,SAAS,MAAM,OAAO;AACtC,MAAI,MAAM,SAAS,gCAAgC;AACjD,WAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO,OAAO,QAAQ,WAAW,WAAW,QAAQ,SAAS;AAAA,EACjH;AACA,SAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAC3D;AAEA,SAAS,cAAc,SAA0B;AAC/C,QAAM,SAAS,SAAS,OAAO;AAC/B,MAAI,OAAO,OAAO,SAAS,UAAU;AACnC,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,UAAU,SAAS,SAAS,OAAO,IAAI,EAAE,OAAO,EAAE;AACxD,MAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,WAAO;AAAA,EACT;AACA,SAAO,QACJ,IAAI,CAAC,SAAS;AACb,UAAM,OAAO,SAAS,IAAI,EAAE;AAC5B,WAAO,OAAO,SAAS,WAAW,OAAO;AAAA,EAC3C,CAAC,EACA,KAAK,EAAE;AACZ;AAEA,SAAS,iBAAiB,SAAsC;AAC9D,QAAM,OAAO,SAAS,OAAO,EAAE;AAC/B,SAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,WAAW,QAAmC,CAAC;AAClF;;;ACtFA,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AAItB,IAAM,aAAa,EAAE,KAAK,OAAO,KAAK,eAAe;AAGrD,IAAM,kBAAkB;AACxB,IAAM,2BAA2B;AACjC,IAAM,qBAAqB;AA2B3B,SAAS,gBAAgB,OAA2B;AAClD,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,WAAW;AAChD;AAIA,IAAM,kBAAkB;AACxB,SAAS,gBAAgB,OAA2B;AAClD,MAAI,OAAO;AACX,MAAI,QAAQ;AACZ,MAAI,MAAM;AACV,aAAW,QAAQ,OAAO;AACxB,YAAS,SAAS,IAAK;AACvB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,cAAQ;AACR,aAAO,gBAAiB,UAAU,OAAQ,EAAE;AAAA,IAC9C;AAAA,EACF;AACA,MAAI,OAAO,GAAG;AACZ,WAAO,gBAAiB,SAAU,IAAI,OAAS,EAAE;AAAA,EACnD;AACA,SAAO;AACT;AAQA,SAAS,WAAW,oBAAoC;AACtD,QAAM,OAAO,KAAK,UAAU,kBAAkB;AAC9C,QAAM,SAAS,WAAW,YAAY,EAAE,OAAO,MAAM,MAAM,EAAE,OAAO;AACpE,SAAO,gBAAgB,MAAM;AAC/B;AAQA,SAAS,UAAU,QAAiC,YAA8B;AAEhF,QAAM,eAAe,EAAE,GAAG,QAAQ,KAAK,GAAG;AAC1C,QAAM,MAAM,WAAW,YAAY;AACnC,QAAM,cAAc,EAAE,GAAG,QAAQ,IAAI;AAErC,QAAM,SAAS,gBAAgB,OAAO,KAAK,KAAK,UAAU,UAAU,GAAG,MAAM,CAAC;AAC9E,QAAM,UAAU,gBAAgB,OAAO,KAAK,KAAK,UAAU,WAAW,GAAG,MAAM,CAAC;AAChF,QAAM,eAAe,GAAG,MAAM,IAAI,OAAO;AACzC,QAAM,YAAY,WAAW,KAAK,OAAO,KAAK,cAAc,MAAM,CAAC;AACnE,SAAO,GAAG,YAAY,IAAI,gBAAgB,SAAS,CAAC;AACtD;AA+BO,SAAS,YAAY,OAAiC;AAC3D,QAAM,aAAa,MAAM,SAAS,OAAO,KAAK,MAAM,WAAW,CAAC;AAChE,QAAM,mBAAmB,WAAW,aAAa;AACjD,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAE/C,QAAM,YAAqC;AAAA,IACzC,MAAM;AAAA,IACN,SAAS;AAAA,IACT,KAAK,MAAM,YAAY;AAAA,IACvB,KAAK,MAAM,YAAY;AAAA;AAAA;AAAA,IAGvB,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAEA,QAAM,SAAkC;AAAA,IACtC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,KAAK,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,IAKX,KAAK,MAAM;AAAA,IACX,MAAM;AAAA,EACR;AACA,MAAI,OAAO,MAAM,qBAAqB,UAAU;AAC9C,WAAO,MAAM,MAAM;AAAA,EACrB;AACA,SAAO,UAAU,QAAQ,UAAU;AACrC;AA4BO,SAAS,iBAAiB,OAAsC;AACrE,QAAM,aAAa,MAAM,SAAS,OAAO,KAAK,MAAM,WAAW,CAAC;AAChE,QAAM,mBAAmB,WAAW,aAAa;AACjD,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAE/C,QAAM,YAAqC;AAAA,IACzC,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACA,MAAI,MAAM,SAAS;AACjB,cAAU,MAAM,MAAM;AAAA,EACxB;AACA,MAAI,MAAM,OAAO;AACf,cAAU,QAAQ,MAAM;AAAA,EAC1B;AAEA,QAAM,SAAkC;AAAA,IACtC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQL,KAAK,MAAM;AAAA,IACX,KAAK,MAAM;AAAA,IACX,MAAM;AAAA,EACR;AACA,SAAO,UAAU,QAAQ,UAAU;AACrC;AA0BO,SAAS,kBAAkB,OAA0C;AAC1E,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,MAAM,CAAC,GAAI,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EAC3E,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO;AAAA,EACT;AACA,QAAM,OAAQ,QAA+B;AAC7C,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,WAAO;AAAA,EACT;AACA,QAAM,UAAU;AAKhB,QAAM,WAAW,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY;AAC7E,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,QAAM,cACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,cAAc,OAC1D,QAAQ,UAA+B,KACxC;AACN,QAAM,WAAW,OAAO,gBAAgB,WAAW,cAAc;AACjE,QAAM,cACJ,OAAO,QAAQ,iBAAiB,YAAY,QAAQ,iBAAiB,OAChE,QAAQ,eACT,CAAC;AACP,QAAM,YAAY,OAAO,YAAY,eAAe,WAAW,YAAY,aAAa;AACxF,QAAM,OAAO,OAAO,YAAY,SAAS,WAAW,YAAY,OAAO;AACvE,SAAO,EAAE,UAAU,UAAU,WAAW,KAAK;AAC/C;AAaO,SAAS,0BAA0B,aAAsC;AAC9E,QAAM,aAAa,SAAS,WAAW;AAGvC,QAAM,aAAa;AACnB,SAAO;AAAA,IACL,KAAK,EAAE,OAAO,CAAC,YAAY,UAAU,EAAE;AAAA,IACvC,KAAK,EAAE,OAAO,CAAC,YAAY,UAAU,EAAE;AAAA,EACzC;AACF;;;AF/LA,SAAS,WAAAA,UAAS,SAAAC,cAAkC;AA3IpD,IAAM,QAAQ,UAA4C;AAW1D,IAAM,eAAsC;AAAA,EAC1C,OAAO,MAAM;AAAA,EAAC;AAAA,EACd,MAAM,MAAM;AAAA,EAAC;AACf;AA0BA,IAAM,oBAAoB;AAAA,EACxB,WAAW;AAAA,EACX,sBAAsB;AAAA,EACtB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,YAAY;AACd;AAQA,SAAS,sBAAsB,SAA+C;AAC5E,SAAO,EAAE,GAAG,mBAAmB,GAAG,QAAQ;AAC5C;AAGA,IAAM,2BAA2B;AAWjC,eAAe,iBAAiB,IAAoB,WAAkC;AACpF,MAAI;AACJ,QAAM,UAAU,IAAI,QAAc,CAAC,YAAY;AAC7C,YAAQ,WAAW,SAAS,SAAS;AAAA,EACvC,CAAC;AACD,MAAI;AACF,UAAM,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,MAAM,MAAS,GAAG,OAAO,CAAC;AAAA,EACjE,UAAE;AACA,QAAI,OAAO;AACT,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AASA,SAAS,oBACP,IACA,OACA,SAAsB,cACtB,UACM;AACN,QAAM,YAAY;AAChB,QAAI;AACF,uBAAiB,UAAU,GAAG,OAAO,GAAG;AACtC,mBAAW,OAAO,IAAI;AACtB,cAAM,aAAa,EAAE,OAAO,QAAQ,OAAO,MAAM,MAAM,OAAO,KAAK;AACnE,YAAI,iBAAiB,OAAO,IAAI,GAAG;AACjC,WAAC,OAAO,QAAQ,aAAa,MAAM,0BAA0B,UAAU;AAAA,QACzE,OAAO;AACL,WAAC,OAAO,SAAS,aAAa,OAAO,0BAA0B,UAAU;AAAA,QAC3E;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAGR;AAAA,EACF,GAAG;AACL;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,SAAO,SAAS,gBAAgB,SAAS,WAAW,SAAS;AAC/D;AAmGA,eAAsB,mBACpB,SACA,MACA,UAA2B,CAAC,GACT;AACnB,QAAM,iBAAoC,EAAE,SAAS,QAAQ;AAC7D,MAAI,MAAM;AACR,mBAAe,OAAO,KAAK;AAC3B,mBAAe,OAAO,KAAK;AAAA,EAC7B;AACA,QAAM,KAAK,MAAM,QAAQ,sBAAsB,cAAc,CAAC;AAC9D,MAAI,YAAY;AAChB,sBAAoB,IAAI,aAAa,QAAQ,QAAQ,CAAC,SAAS;AAC7D,QAAI,SAAS,gBAAgB,SAAS,kBAAkB,SAAS,qBAAqB,SAAS,SAAS;AACtG,kBAAY;AAAA,IACd,WAAW,SAAS,aAAa,SAAS,aAAa;AACrD,kBAAY;AAAA,IACd;AAAA,EACF,CAAC;AACD,QAAM,oBAAuC;AAAA,IAC3C,SAAS,OAAO,SAAS,SAAS,SAAS,aAAa,IAAI,SAAS,SAAS,KAAK,OAAO;AAAA,EAC5F;AACA,SAAO;AAAA,IACL,SAAS,OAAO,aAAa,WAAW,WAAW;AACjD,UAAI,OAAO,WAAW,GAAG;AACvB;AAAA,MACF;AASA,UAAI;AACF,WAAG,QAAQ,eAAe,aAAa,SAAS,GAAG,MAAM,OAAO,EAAE,aAAa,WAAW,OAAO,CAAC,CAAC;AAAA,MACrG,SAAS,OAAO;AAGd,SAAC,QAAQ,QAAQ,QAAQ,aAAa,MAAM,0FAA0F;AAAA,UACpI;AAAA,UACA;AAAA,UACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D,CAAC;AACD;AAAA,MACF;AACA,YAAM,iBAAiB,IAAI,wBAAwB;AAAA,IACrD;AAAA,IACA,WAAW,OAAO,aAAa,WAAW,aAAa,iBAAiB,IAAI,aAAa,WAAW,QAAQ;AAAA,IAC5G,SAAS,OAAO,SAAS,SAAS,SAAS,aAAa,IAAI,SAAS,SAAS,KAAK,SAAS;AAAA,IAC5F,mBAAmB,CAAC,SAAS,YAAY,kBAAkB,IAAI,SAAS,OAAO;AAAA,IAC/E,sBAAsB,CAAC,SAAS,YAAY,qBAAqB,IAAI,SAAS,OAAO;AAAA,IACrF,sBAAsB,MAAM;AAAA,IAC5B,aAAa,MAAM,aAAa,CAAC,GAAG,SAAS,KAAK,CAAC,GAAG,WAAW;AAAA,IACjE,OAAO,YAAY;AACjB,YAAM,GAAG,MAAM;AAAA,IACjB;AAAA,EACF;AACF;AAmCA,eAAsB,0BACpB,SACA,MACA,SACA,SACA,UAAmD,CAAC,GACtB;AAC9B,QAAM,iBAAoC,EAAE,SAAS,QAAQ;AAC7D,MAAI,QAAQ,MAAM;AAChB,mBAAe,OAAO,QAAQ;AAAA,EAChC;AACA,MAAI,KAAK,SAAS,iBAAiB;AACjC,mBAAe,OAAO,KAAK;AAC3B,mBAAe,OAAO,KAAK;AAAA,EAC7B,WAAW,KAAK,SAAS,SAAS;AAChC,mBAAe,QAAQ,KAAK;AAAA,EAC9B;AACA,QAAM,KAAK,MAAM,QAAQ,sBAAsB,cAAc,CAAC;AAC9D,sBAAoB,IAAI,QAAQ,OAAO,gBAAgB,QAAQ,IAAI,KAAK,gBAAgB,QAAQ,MAAM;AACtG,QAAM,MAAoB,GAAG,UAAU,OAAO;AAC9C,QAAM,YAAY;AAChB,qBAAiB,OAAO,KAAK;AAC3B,UAAI,CAAC,IAAI,OAAO;AACd;AAAA,MACF;AACA,UAAI;AACF,cAAM,QAAQ,MAAM,QAAQ,IAAI,MAAM,IAAI,OAAO;AACjD,YAAI,QAAQ,KAAK;AAAA,MACnB,QAAQ;AAAA,MAGR;AAAA,IACF;AAAA,EACF,GAAG;AACH,SAAO;AAAA,IACL,OAAO,YAAY;AACjB,UAAI,YAAY;AAChB,YAAM,GAAG,MAAM;AAAA,IACjB;AAAA,EACF;AACF;AAEA,eAAsB,uBAAuB,IAAc,KAAe,aAAqB,WAAmB,QAAqD;AACrK,QAAM,WAAW,MAAM,oBAAoB,IAAI,aAAa,WAAW,MAAM;AAQ7E,MAAI;AACF,UAAM,IAAI,QAAQ,aAAa,WAAW,QAAQ;AAAA,EACpD,SAAS,OAAO;AACd,YAAQ;AAAA,MACN,oCAAoC,WAAW,IAAI,SAAS,KAAK,SAAS,MAAM;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,IAAoB,aAAqB,WAAmB,UAAwE;AAC5J,QAAM,MAAoB,GAAG,UAAU,eAAe,aAAa,SAAS,CAAC;AAC7E,QAAM,YAAY;AAChB,qBAAiB,OAAO,KAAK;AAC3B,YAAM,UAAU,MAAM,OAAO,IAAI,IAAI;AACrC,YAAM,SAAS,YAAY,UAAU,QAAQ,SAAS,CAAC,OAAO;AAC9D,YAAM,SAAS,MAAM;AAAA,IACvB;AAAA,EACF,GAAG;AACH,SAAO,MAAM;AACX,QAAI,YAAY;AAAA,EAClB;AACF;AASA,eAAe,aAAa,IAAoB,SAAiB,SAAqB,SAAwC;AAC5H,QAAM,MAAW,MAAM,GAAG,QAAQ,SAAS,SAAS,EAAE,QAAQ,CAAC;AAC/D,SAAO,EAAE,MAAM,IAAI,KAAK;AAC1B;AASA,SAAS,kBAAkB,IAAoB,SAAiB,SAAqC;AACnG,QAAM,MAAoB,GAAG,UAAU,OAAO;AAC9C,QAAM,YAAY;AAChB,qBAAiB,OAAO,KAAK;AAG3B,UAAI,CAAC,IAAI,OAAO;AACd;AAAA,MACF;AACA,UAAI;AACF,cAAM,QAAQ,MAAM,QAAQ,IAAI,MAAM,IAAI,OAAO;AACjD,YAAI,QAAQ,KAAK;AAAA,MACnB,QAAQ;AAAA,MAIR;AAAA,IACF;AAAA,EACF,GAAG;AACH,SAAO,MAAM;AACX,QAAI,YAAY;AAAA,EAClB;AACF;AASA,SAAS,qBACP,IACA,SACA,SACY;AACZ,QAAM,MAAoB,GAAG,UAAU,OAAO;AAC9C,QAAM,YAAY;AAChB,qBAAiB,OAAO,KAAK;AAC3B,UAAI;AACF,cAAM,QAAQ,IAAI,MAAM,IAAI,OAAO;AAAA,MACrC,QAAQ;AAAA,MAGR;AAAA,IACF;AAAA,EACF,GAAG;AACH,SAAO,MAAM;AACX,QAAI,YAAY;AAAA,EAClB;AACF;AAEO,SAAS,UAAU,OAA6B;AACrD,SAAO;AAAA,IACL,OAAO,MAAM,QAAQ;AAAA,IACrB,UAAU,MAAM,IAAI;AAAA,IACpB,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA,IAC9B;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;","names":["connect","nkeys"]}
+{"version":3,"sources":["../src/index.ts","../src/coalesce.ts","../src/nats-jwt.ts"],"sourcesContent":["import type { SessionBusMessage, SessionEvent } from \"@opengeni/contracts\";\nimport { appendSessionEvents, sessionSubject, type AppendEventInput, type Database } from \"@opengeni/db\";\nimport { connect, JSONCodec, type ConnectionOptions, type Msg, type NatsConnection, type Subscription } from \"nats\";\n\nconst codec = JSONCodec<SessionBusMessage | SessionEvent>();\n\nexport type EventLogger = {\n  debug?: (message: string, attributes?: Record<string, unknown>) => void;\n  warn?: (message: string, attributes?: Record<string, unknown>) => void;\n};\n\nexport type EventBusOptions = {\n  logger?: EventLogger;\n};\n\nconst silentLogger: Required<EventLogger> = {\n  debug: () => {},\n  warn: () => {},\n};\n\nexport { coalesceSessionEventDeltas } from \"./coalesce\";\n\n/**\n * Reconnect + keepalive defaults applied to EVERY long-lived NATS connection\n * this package opens (the event bus AND the standalone auth-callout responder).\n *\n * The production outage these guard against: an in-cluster NATS broker pod\n * restart. nats.js's stock policy gives up after ~10 attempts (~20s) and the\n * client goes permanently CONNECTION_CLOSED — which takes the whole control\n * plane down with it: every session-create publishes events to NATS, and the\n * API-hosted auth-callout responder dies so BYO agents get \"authorization\n * violation\". Recovery then required a MANUAL api+worker restart. With these\n * options the client retries forever and auto-recovers the moment the broker\n * returns. Factored into one source of truth so the call sites never drift.\n *\n *  - `reconnect` + `maxReconnectAttempts: -1` — never give up (infinite retry).\n *  - `reconnectTimeWait` (2s base) + `reconnectJitter`/`reconnectJitterTLS`\n *    (up to 1s) — a fleet of api/worker pods doesn't thundering-herd the broker\n *    on recovery.\n *  - `waitOnFirstConnect` — a broker briefly unavailable at boot must not\n *    hard-fail the process; the client keeps trying instead of throwing.\n *  - `pingInterval`/`maxPingOut` — promptly detect a silently-dead socket so the\n *    reconnect machinery actually engages instead of hanging on a zombie.\n */\nconst RECONNECT_OPTIONS = {\n  reconnect: true,\n  maxReconnectAttempts: -1,\n  reconnectTimeWait: 2_000,\n  reconnectJitter: 1_000,\n  reconnectJitterTLS: 1_000,\n  waitOnFirstConnect: true,\n  pingInterval: 20_000,\n  maxPingOut: 3,\n} satisfies ConnectionOptions;\n\n/**\n * The single source of truth for a long-lived connection's resilience: merge the\n * reconnect/keepalive defaults UNDER the caller's connection options (servers +\n * optional auth/name). Every long-lived `connect()` in this package goes through\n * here so the two call sites can never diverge.\n */\nfunction withReconnectDefaults(options: ConnectionOptions): ConnectionOptions {\n  return { ...RECONNECT_OPTIONS, ...options };\n}\n\n/** How long a best-effort publish waits on `flush()` before giving up (see `publish`). */\nconst PUBLISH_FLUSH_TIMEOUT_MS = 2_000;\n\n/**\n * Await `nc.flush()` but never longer than `timeoutMs`. With infinite reconnect a\n * `flush()` issued while the broker is down does NOT reject — it pends until the\n * broker returns, which can be minutes. Racing it against a timer keeps a long\n * outage from stalling an in-flight turn; the published message stays buffered\n * and is delivered on reconnect regardless. A flush rejection (connection fully\n * CLOSED) is swallowed here so the timeout race never leaks an unhandled\n * rejection — the caller's publish path is what logs the drop.\n */\nasync function flushWithTimeout(nc: NatsConnection, timeoutMs: number): Promise<void> {\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  const timeout = new Promise<void>((resolve) => {\n    timer = setTimeout(resolve, timeoutMs);\n  });\n  try {\n    await Promise.race([nc.flush().catch(() => undefined), timeout]);\n  } finally {\n    if (timer) {\n      clearTimeout(timer);\n    }\n  }\n}\n\n/**\n * Drain a long-lived connection's status async-iterator to the log so a future\n * broker outage is OBSERVABLE (disconnect → reconnecting → reconnect → update).\n * Fire-and-forget for the connection's lifetime; the loop ends when the\n * connection closes. `label` distinguishes the event-bus connection from the\n * auth-callout responder in the logs.\n */\nfunction logConnectionStatus(\n  nc: NatsConnection,\n  label: string,\n  logger: EventLogger = silentLogger,\n  onStatus?: (type: string) => void,\n): void {\n  void (async () => {\n    try {\n      for await (const status of nc.status()) {\n        onStatus?.(status.type);\n        const attributes = { label, status: status.type, data: status.data };\n        if (isWarnNatsStatus(status.type)) {\n          (logger.warn ?? silentLogger.warn)(\"NATS connection status\", attributes);\n        } else {\n          (logger.debug ?? silentLogger.debug)(\"NATS connection status\", attributes);\n        }\n      }\n    } catch {\n      // The status iterator simply ends when the connection closes; never let it\n      // throw out of this background loop.\n    }\n  })();\n}\n\nfunction isWarnNatsStatus(type: string): boolean {\n  return type === \"disconnect\" || type === \"error\" || type === \"staleConnection\";\n}\n\nexport {\n  decodeAuthRequest,\n  mintAuthResponse,\n  mintUserJwt,\n  workspaceAgentPermissions,\n  type DecodedAuthRequest,\n  type MintAuthResponseInput,\n  type MintUserJwtInput,\n  type NatsPermission,\n  type NatsPermissions,\n} from \"./nats-jwt\";\n\n// Re-export the raw NATS primitives a consumer needs to open a direct connection or\n// generate nkeys (the auth-callout responder's standalone connection, the\n// agent-simulating integration tests). This keeps `nats` an internal dependency of\n// this leaf — callers in the bun workspace reach it through @opengeni/events rather\n// than depending on `nats` directly.\nexport { connect, nkeys, type NatsConnection } from \"nats\";\n\n/**\n * A raw request/reply reply — just the response bytes. Mirrors the subset of the\n * NATS `Msg` shape a binary request/reply caller needs (`NatsControlRpc` consumes\n * exactly this). Kept minimal so the events package does not leak the `nats` `Msg`\n * type into the agent-loop-free runtime leaf.\n */\nexport type RequestReply = { data: Uint8Array };\n\n/**\n * The minimal request/reply connection the selfhosted control plane consumes\n * (structurally identical to `@opengeni/runtime`'s `NatsRequestConnection`). The\n * API/worker hand this accessor to `NatsControlRpc` so the control transport rides\n * the SAME managed NATS connection the event bus already owns — a NATS connection\n * natively supports both pub/sub and request/reply, so there is NEVER a second\n * connection.\n */\nexport interface RequestConnection {\n  request(subject: string, payload: Uint8Array, opts: { timeout: number }): Promise<RequestReply>;\n}\n\n/**\n * A handler answering a request/reply on a subscribed subject: given the request\n * bytes (+ the concrete subject the message landed on, for `agent.<ws>.<id>.rpc`\n * style wildcard routing), return the response bytes to reply with. A thrown error\n * leaves the request unanswered (the caller's request times out / sees no\n * responder), which the control plane maps to `agent_offline` / reconnecting.\n */\nexport type RequestHandler = (request: Uint8Array, subject: string) => Promise<Uint8Array> | Uint8Array;\n\nexport type EventBus = {\n  publish: (workspaceId: string, sessionId: string, events: SessionEvent[]) => Promise<void>;\n  subscribe: (workspaceId: string, sessionId: string, onEvents: (events: SessionEvent[]) => void | Promise<void>) => Promise<() => void>;\n  /**\n   * Issue a binary request/reply on a subject over the bus's NATS connection\n   * (the selfhosted control plane: `agent.<ws>.<id>.rpc`). A new usage of what was\n   * a one-way bus — same connection, native NATS request/reply. Rejects on a\n   * no-responder (NATS 503) or a request timeout; the caller (`NatsControlRpc`)\n   * maps those to `agent_offline` / `agent_reconnecting`, never a NotFound.\n   */\n  request: (subject: string, payload: Uint8Array, opts: { timeoutMs: number }) => Promise<RequestReply>;\n  /**\n   * Subscribe-and-reply on a subject (the responder side — the enrolled agent, or\n   * a test stand-in for it): for every request on `subject`, call `handler` and\n   * `respond` with its bytes over the SAME connection. Returns an unsubscribe fn.\n   * A subject may be a NATS wildcard (e.g. `agent.*.*.rpc`).\n   */\n  subscribeRequests: (subject: string, handler: RequestHandler) => () => void;\n  /**\n   * Subscribe to the agent EVENT plane (the one-way fire-and-forget heartbeats +\n   * going-offline the agent PUBLISHES on `agent.<ws>.<id>.events`, NOT a\n   * request/reply). The M10 metrics-ingestion consumer subscribes the wildcard\n   * `agent.*.*.events` and gets each raw payload plus its concrete subject (so it\n   * can extract `<ws>`/`<id>` for the per-enrollment upsert). Returns an\n   * unsubscribe fn. Decoding the AgentEvent is the caller's concern (this leaf\n   * does not depend on `@opengeni/agent-proto`).\n   */\n  subscribeAgentEvents: (\n    subject: string,\n    handler: (payload: Uint8Array, subject: string) => void | Promise<void>,\n  ) => () => void;\n  /**\n   * The `RequestConnection` accessor the selfhosted `NatsControlRpc` consumes —\n   * the SAME managed connection (pub/sub + request/reply share it). The control\n   * plane injects this so the transport never opens a second connection.\n   */\n  getRequestConnection: () => RequestConnection;\n  isConnected?: () => boolean;\n  close: () => Promise<void>;\n};\n\n/**\n * Connect the event bus + control-plane request/reply over ONE managed NATS\n * connection. `auth` is the PRIVILEGED control-plane login (M-AUTH): when the\n * server runs with auth_callout, the api/worker authenticates as a static account\n * user permitted to request `agent.*.rpc` + receive its inbox replies. When `auth`\n * is omitted the connection is anonymous (local dev / a NATS without auth_callout)\n * — the existing behavior, unchanged.\n */\nexport async function createNatsEventBus(\n  natsUrl: string,\n  auth?: { user: string; pass: string },\n  options: EventBusOptions = {},\n): Promise<EventBus> {\n  const connectOptions: ConnectionOptions = { servers: natsUrl };\n  if (auth) {\n    connectOptions.user = auth.user;\n    connectOptions.pass = auth.pass;\n  }\n  const nc = await connect(withReconnectDefaults(connectOptions));\n  let connected = true;\n  logConnectionStatus(nc, \"event-bus\", options.logger, (type) => {\n    if (type === \"disconnect\" || type === \"reconnecting\" || type === \"staleConnection\" || type === \"error\") {\n      connected = false;\n    } else if (type === \"connect\" || type === \"reconnect\") {\n      connected = true;\n    }\n  });\n  const requestConnection: RequestConnection = {\n    request: async (subject, payload, opts) => requestReply(nc, subject, payload, opts.timeout),\n  };\n  return {\n    publish: async (workspaceId, sessionId, events) => {\n      if (events.length === 0) {\n        return;\n      }\n      // Best-effort LIVE fan-out. These events are ALREADY durably appended to\n      // the DB before we get here (they carry a DB-assigned `sequence`), and\n      // every consumer reconciles from that durable log — the server SSE stream\n      // replays + gap-backfills via `listSessionEvents`, and the SDK client\n      // reconnects and replays from the durable events endpoint. So a publish\n      // that fails during a broker blip only delays LIVE delivery (healed by the\n      // next successful publish's gap-backfill, or a stream reconnect); it must\n      // never throw the in-flight turn to death.\n      try {\n        nc.publish(sessionSubject(workspaceId, sessionId), codec.encode({ workspaceId, sessionId, events }));\n      } catch (error) {\n        // `publish()` throws synchronously only when the connection is fully\n        // CLOSED (with infinite reconnect, effectively never outside shutdown).\n        (options.logger?.warn ?? silentLogger.warn)(\"NATS live publish dropped; events are durable in the DB and reconcile on stream replay\", {\n          workspaceId,\n          sessionId,\n          error: error instanceof Error ? error.message : String(error),\n        });\n        return;\n      }\n      await flushWithTimeout(nc, PUBLISH_FLUSH_TIMEOUT_MS);\n    },\n    subscribe: async (workspaceId, sessionId, onEvents) => subscribeSession(nc, workspaceId, sessionId, onEvents),\n    request: async (subject, payload, opts) => requestReply(nc, subject, payload, opts.timeoutMs),\n    subscribeRequests: (subject, handler) => subscribeRequests(nc, subject, handler),\n    subscribeAgentEvents: (subject, handler) => subscribeAgentEvents(nc, subject, handler),\n    getRequestConnection: () => requestConnection,\n    isConnected: () => connected && !nc.isClosed() && !nc.isDraining(),\n    close: async () => {\n      await nc.drain();\n    },\n  };\n}\n\n/**\n * A standalone NATS connection answering request/reply on ONE subject — the\n * transport primitive the auth-callout responder uses. It is DELIBERATELY a\n * SEPARATE connection from the event bus: the callout responder authenticates as\n * the callout account's `auth_users` user (a username/password or token in the\n * `AUTH` account), which is a DIFFERENT identity from the control-plane's\n * privileged account that the event bus + `NatsControlRpc` ride. One connection\n * per identity; never multiplex the two.\n *\n * `request`/`reply` here is the RAW NATS request/reply (`$SYS.REQ.USER.AUTH`): the\n * server publishes an authorization request with a reply inbox; the handler returns\n * the signed authorization-response bytes which we `respond` on that inbox.\n */\nexport interface ResponderConnection {\n  /** Subscribe-and-reply on `subject`; returns an async close that drains. */\n  close: () => Promise<void>;\n}\n\n/** Connection auth for a standalone NATS connection (the callout responder). */\nexport type NatsConnectAuth =\n  | { kind: \"user-password\"; user: string; pass: string }\n  | { kind: \"token\"; token: string }\n  | { kind: \"anonymous\" };\n\n/**\n * Open a standalone NATS connection and subscribe `subject`, replying to every\n * request with `handler(requestBytes, subject)`. Used by the auth-callout\n * responder to serve `$SYS.REQ.USER.AUTH` as the callout auth user. Returns a\n * handle whose `close()` drains the connection. A handler that throws leaves the\n * request UNANSWERED — for auth-callout that means the server denies the\n * connection on its own timeout, which is the correct fail-closed behavior (a\n * responder bug must never accidentally grant access).\n */\nexport async function createResponderConnection(\n  natsUrl: string,\n  auth: NatsConnectAuth,\n  subject: string,\n  handler: RequestHandler,\n  options: { name?: string; logger?: EventLogger } = {},\n): Promise<ResponderConnection> {\n  const connectOptions: ConnectionOptions = { servers: natsUrl };\n  if (options.name) {\n    connectOptions.name = options.name;\n  }\n  if (auth.kind === \"user-password\") {\n    connectOptions.user = auth.user;\n    connectOptions.pass = auth.pass;\n  } else if (auth.kind === \"token\") {\n    connectOptions.token = auth.token;\n  }\n  const nc = await connect(withReconnectDefaults(connectOptions));\n  logConnectionStatus(nc, options.name ? `auth-callout:${options.name}` : \"auth-callout\", options.logger);\n  const sub: Subscription = nc.subscribe(subject);\n  void (async () => {\n    for await (const msg of sub) {\n      if (!msg.reply) {\n        continue;\n      }\n      try {\n        const reply = await handler(msg.data, msg.subject);\n        msg.respond(reply);\n      } catch {\n        // Leave UNANSWERED — fail-closed. The server denies the connect attempt\n        // on its callout timeout; a responder error never grants access.\n      }\n    }\n  })();\n  return {\n    close: async () => {\n      sub.unsubscribe();\n      await nc.drain();\n    },\n  };\n}\n\nexport async function appendAndPublishEvents(db: Database, bus: EventBus, workspaceId: string, sessionId: string, events: AppendEventInput[]): Promise<SessionEvent[]> {\n  const appended = await appendSessionEvents(db, workspaceId, sessionId, events);\n  // The DB append above is the durable system of record; the publish is only a\n  // best-effort LIVE fan-out. Guard it so NO EventBus implementation can throw an\n  // in-flight agent turn to death on a transient NATS disconnect — consumers\n  // reconcile any missed live events from the durable log via the events/stream\n  // endpoint (DB replay + gap-backfill). The managed `createNatsEventBus` bus\n  // already swallows internally, so this catch is the belt-and-suspenders guard\n  // for any other bus impl (and a fully CLOSED connection during shutdown).\n  try {\n    await bus.publish(workspaceId, sessionId, appended);\n  } catch (error) {\n    console.warn(\n      `[events] live publish failed for ${workspaceId}/${sessionId}; ${appended.length} event(s) are durable and reconcile on stream replay`,\n      error,\n    );\n  }\n  return appended;\n}\n\nfunction subscribeSession(nc: NatsConnection, workspaceId: string, sessionId: string, onEvents: (events: SessionEvent[]) => void | Promise<void>): () => void {\n  const sub: Subscription = nc.subscribe(sessionSubject(workspaceId, sessionId));\n  void (async () => {\n    for await (const msg of sub) {\n      const decoded = codec.decode(msg.data) as SessionBusMessage | SessionEvent;\n      const events = \"events\" in decoded ? decoded.events : [decoded];\n      await onEvents(events);\n    }\n  })();\n  return () => {\n    sub.unsubscribe();\n  };\n}\n\n/**\n * A binary request/reply over the managed connection. Returns ONLY the reply\n * bytes (the `RequestReply` shape) — the request/reply error semantics (a\n * no-responder NATS 503, a request timeout) propagate as the rejected promise so\n * the caller owns the mapping. The reply is delivered via the connection's\n * built-in mux inbox; no extra subscription is created here.\n */\nasync function requestReply(nc: NatsConnection, subject: string, payload: Uint8Array, timeout: number): Promise<RequestReply> {\n  const msg: Msg = await nc.request(subject, payload, { timeout });\n  return { data: msg.data };\n}\n\n/**\n * Subscribe to `subject` and reply to every request with the handler's bytes,\n * over the SAME connection. The responder side of request/reply: each delivered\n * `Msg` carries a `reply` inbox; `msg.respond(bytes)` publishes the answer there.\n * A handler that throws (or a message with no `reply` subject) is left unanswered\n * — the requester then sees a timeout, never a malformed reply.\n */\nfunction subscribeRequests(nc: NatsConnection, subject: string, handler: RequestHandler): () => void {\n  const sub: Subscription = nc.subscribe(subject);\n  void (async () => {\n    for await (const msg of sub) {\n      // A request always carries a reply inbox; a plain publish to this subject\n      // (no reply) is ignored — request/reply is the only contract here.\n      if (!msg.reply) {\n        continue;\n      }\n      try {\n        const reply = await handler(msg.data, msg.subject);\n        msg.respond(reply);\n      } catch {\n        // Leave the request unanswered: the requester's request times out, which\n        // the selfhosted control plane reads as a transient blip (reconnecting),\n        // never a malformed reply. The responder stays subscribed for the next op.\n      }\n    }\n  })();\n  return () => {\n    sub.unsubscribe();\n  };\n}\n\n/**\n * Subscribe to the one-way agent event plane: deliver each published payload (the\n * agent's `AgentEvent` heartbeat / going-offline, NOT a request/reply) to the\n * handler with its concrete subject. A plain `nc.subscribe` (no reply); a handler\n * that throws is swallowed so one bad event never tears down the subscription\n * (ingestion is best-effort — a metrics gap is never fatal).\n */\nfunction subscribeAgentEvents(\n  nc: NatsConnection,\n  subject: string,\n  handler: (payload: Uint8Array, subject: string) => void | Promise<void>,\n): () => void {\n  const sub: Subscription = nc.subscribe(subject);\n  void (async () => {\n    for await (const msg of sub) {\n      try {\n        await handler(msg.data, msg.subject);\n      } catch {\n        // Swallow: best-effort ingestion. The subscription stays live for the\n        // next event.\n      }\n    }\n  })();\n  return () => {\n    sub.unsubscribe();\n  };\n}\n\nexport function formatSse(event: SessionEvent): string {\n  return [\n    `id: ${event.sequence}`,\n    `event: ${event.type}`,\n    `data: ${JSON.stringify(event)}`,\n    \"\",\n    \"\",\n  ].join(\"\\n\");\n}\n","import type { SessionEvent } from \"@opengeni/contracts\";\n\nconst COALESCIBLE_DELTA_TYPES = new Set([\n  \"agent.message.delta\",\n  \"agent.reasoning.delta\",\n  \"sandbox.command.output.delta\",\n]);\n\ntype DeltaRun = {\n  first: SessionEvent;\n  lastSequence: number;\n  text: string;\n  sandboxName: string | undefined;\n  sandboxStream: string | undefined;\n  sandboxCommandId: string | undefined;\n};\n\nexport function coalesceSessionEventDeltas(events: SessionEvent[]): SessionEvent[] {\n  const coalesced: SessionEvent[] = [];\n  let run: DeltaRun | null = null;\n\n  const flush = () => {\n    if (!run) {\n      return;\n    }\n    coalesced.push({\n      ...run.first,\n      payload: run.first.type === \"sandbox.command.output.delta\"\n        // Sandbox output keeps its CANONICAL field (`chunk` — the terminal and\n        // projection read it) plus the stream/commandId identity of the run.\n        ? {\n            chunk: run.text,\n            coalescedUntil: run.lastSequence,\n            ...(run.sandboxStream !== undefined ? { stream: run.sandboxStream } : {}),\n            ...(run.sandboxCommandId !== undefined ? { commandId: run.sandboxCommandId } : {}),\n            ...(run.sandboxName !== undefined ? { name: run.sandboxName } : {}),\n          }\n        : {\n            text: run.text,\n            coalescedUntil: run.lastSequence,\n          },\n    });\n    run = null;\n  };\n\n  for (const event of events) {\n    if (!isCoalescibleDelta(event)) {\n      flush();\n      coalesced.push(event);\n      continue;\n    }\n\n    const isSandbox = event.type === \"sandbox.command.output.delta\";\n    const sandboxName = isSandbox ? sandboxDeltaName(event.payload) : undefined;\n    const sandboxStream = isSandbox ? sandboxDeltaString(event.payload, \"stream\") : undefined;\n    const sandboxCommandId = isSandbox ? sandboxDeltaString(event.payload, \"commandId\") : undefined;\n    if (\n      run\n      && sameDeltaRun(run.first, event, run.sandboxName, sandboxName)\n      && run.sandboxStream === sandboxStream\n      && run.sandboxCommandId === sandboxCommandId\n    ) {\n      run.text += deltaText(event);\n      run.lastSequence = event.sequence;\n      continue;\n    }\n\n    flush();\n    run = {\n      first: event,\n      lastSequence: event.sequence,\n      text: deltaText(event),\n      sandboxName,\n      sandboxStream,\n      sandboxCommandId,\n    };\n  }\n\n  flush();\n  return coalesced;\n}\n\nfunction isCoalescibleDelta(event: SessionEvent): boolean {\n  return COALESCIBLE_DELTA_TYPES.has(event.type);\n}\n\nfunction sameDeltaRun(\n  first: SessionEvent,\n  next: SessionEvent,\n  firstSandboxName: string | undefined,\n  nextSandboxName: string | undefined,\n): boolean {\n  if (first.type !== next.type) {\n    return false;\n  }\n  if ((first.turnId ?? null) !== (next.turnId ?? null)) {\n    return false;\n  }\n  return first.type !== \"sandbox.command.output.delta\" || firstSandboxName === nextSandboxName;\n}\n\nfunction deltaText(event: SessionEvent): string {\n  if (event.type === \"agent.reasoning.delta\") {\n    return reasoningText(event.payload);\n  }\n  const payload = asRecord(event.payload);\n  if (event.type === \"sandbox.command.output.delta\") {\n    // `chunk` is the canonical wire field (contracts SandboxCommandOutputDeltaPayload);\n    // text/output are tolerated legacy shapes.\n    for (const key of [\"chunk\", \"text\", \"output\"] as const) {\n      if (typeof payload[key] === \"string\") {\n        return payload[key] as string;\n      }\n    }\n    return \"\";\n  }\n  return typeof payload.text === \"string\" ? payload.text : \"\";\n}\n\nfunction reasoningText(payload: unknown): string {\n  const record = asRecord(payload);\n  if (typeof record.text === \"string\") {\n    return record.text;\n  }\n  const content = asRecord(asRecord(record.item).rawItem).content;\n  if (!Array.isArray(content)) {\n    return \"\";\n  }\n  return content\n    .map((part) => {\n      const text = asRecord(part).text;\n      return typeof text === \"string\" ? text : \"\";\n    })\n    .join(\"\");\n}\n\nfunction sandboxDeltaName(payload: unknown): string | undefined {\n  const name = asRecord(payload).name;\n  return typeof name === \"string\" ? name : undefined;\n}\n\nfunction sandboxDeltaString(payload: unknown, key: \"stream\" | \"commandId\"): string | undefined {\n  const value = asRecord(payload)[key];\n  return typeof value === \"string\" ? value : undefined;\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === \"object\" ? value as Record<string, unknown> : {};\n}\n","// packages/events/src/nats-jwt.ts — NATS JWT v2 signing for the auth-callout\n// responder (bring-your-own-compute M-AUTH; dossier §10.1 NATS Accounts per\n// workspace + §17 the isolation smoke).\n//\n// This is the cryptographic core of the auth-callout tenancy boundary. When an\n// external agent connects to NATS presenting its `oge_` enrollment bearer as the\n// connect auth-token, nats-server (configured with `auth_callout`) issues an\n// authorization request on `$SYS.REQ.USER.AUTH`. Our responder (auth-callout.ts)\n// validates the bearer and answers with a SIGNED authorization-response JWT that\n// embeds a SIGNED user JWT scoping the connection to publish/subscribe ONLY\n// `agent.<workspaceId>.>` (+ the reply `_INBOX.>`). That per-subject permission\n// set IS the per-workspace isolation: workspace A's agent literally cannot\n// pub/sub workspace B's subjects (§19 the NATS-Accounts-misconfig leak risk is\n// closed at the JWT-permission layer, not just by subject naming).\n//\n// WHY HAND-ROLL THE JWT ENCODING (vs a dep): the NATS JWT v2 wire format is small,\n// stable, and fully specified (ADR-26 + nats-io/jwt): a base64url header\n// `{\"typ\":\"JWT\",\"alg\":\"ed25519-nkey\"}`, base64url JSON claims whose `jti` is the\n// base32(SHA-512/256(claims-with-blank-jti)), and an ed25519 nkey signature over\n// `header.payload`. nkeys (re-exported by the `nats` package we already depend on)\n// gives us the ed25519 sign primitive; Node `crypto` gives SHA-512/256. So we own\n// the encoding in a few well-tested functions rather than pull an alpha\n// `@nats-io/jwt` (0.0.x) whose nkeys-version compat is uncertain. No `xkey`\n// encryption is used (the bearer is already an authenticated identity claim and\n// the wire is TLS — encryption is an optional ADR-26 hardening, off here).\n//\n// SECURITY: the account SIGNING SEED never leaves this process and is NEVER logged.\n// Callers pass it as a `string` seed; we `fromSeed` it once per sign. The bearer\n// the responder validates is HMAC-verified elsewhere (verifyEnrollmentBearer); this\n// module only mints the scoped NATS credential once identity is proven.\n\nimport { createHash } from \"node:crypto\";\nimport { nkeys } from \"nats\";\n\n/** The NATS JWT v2 header — constant for every token we mint (ADR-26 / nats-io/jwt:\n *  `TokenTypeJwt=\"JWT\"`, `AlgorithmNkey=\"ed25519-nkey\"`). */\nconst JWT_HEADER = { typ: \"JWT\", alg: \"ed25519-nkey\" } as const;\n\n/** NATS user-claim `nats.type` discriminator + `nats.version` for v2 claims. */\nconst USER_CLAIM_TYPE = \"user\";\nconst AUTH_RESPONSE_CLAIM_TYPE = \"authorization_response\";\nconst NATS_CLAIM_VERSION = 2;\n\n/** A NATS permission set: subject allow/deny lists (ADR-26 `pub`/`sub` →\n *  `allow`/`deny`). An empty/undefined list means \"no explicit grant\" — combined\n *  with the agent scope below, the connection can ONLY reach what `allow` lists. */\nexport interface NatsPermission {\n  allow?: string[];\n  deny?: string[];\n}\n\n/** The pub/sub permissions embedded in a user JWT. */\nexport interface NatsPermissions {\n  pub: NatsPermission;\n  sub: NatsPermission;\n}\n\n/**\n * The minimal nkey keypair surface this module needs — exactly what\n * `nkeys.fromSeed(seed)` returns. Declared structurally so the module does not\n * leak the `nats` nkeys type through its public signature.\n */\ninterface NkeyPair {\n  getPublicKey(): string;\n  sign(input: Uint8Array): Uint8Array;\n}\n\n/** base64url (RawURLEncoding — no padding), matching nats-io/jwt's `serialize`. */\nfunction base64UrlEncode(bytes: Uint8Array): string {\n  return Buffer.from(bytes).toString(\"base64url\");\n}\n\n/** RFC 4648 base32 (standard alphabet, NO padding) — the encoding nats-io/jwt\n *  uses for the `jti` hash. Node has no built-in base32, so a tiny encoder. */\nconst BASE32_ALPHABET = \"ABCDEFGHIJKLMNOPQRSTUVWXYZ234567\";\nfunction base32NoPadding(bytes: Uint8Array): string {\n  let bits = 0;\n  let value = 0;\n  let out = \"\";\n  for (const byte of bytes) {\n    value = (value << 8) | byte;\n    bits += 8;\n    while (bits >= 5) {\n      bits -= 5;\n      out += BASE32_ALPHABET[(value >>> bits) & 31];\n    }\n  }\n  if (bits > 0) {\n    out += BASE32_ALPHABET[(value << (5 - bits)) & 31];\n  }\n  return out;\n}\n\n/**\n * Compute the canonical NATS `jti`: base32(NoPadding, std-alphabet) of the\n * SHA-512/256 of the claims object SERIALIZED WITH AN EMPTY `jti` (nats-io/jwt's\n * `hash`). nats-server recomputes + verifies this on decode, so it must match\n * byte-for-byte. We serialize the SAME object we will sign, only with `jti:\"\"`.\n */\nfunction computeJti(claimsWithBlankJti: object): string {\n  const json = JSON.stringify(claimsWithBlankJti);\n  const digest = createHash(\"sha512-256\").update(json, \"utf8\").digest();\n  return base32NoPadding(digest);\n}\n\n/**\n * Encode + sign a NATS v2 JWT. The `claims` MUST already carry `iss`/`sub`/`iat`\n * (+ optional `aud`/`exp`) and a `nats` block; this function fills `jti` (the\n * canonical hash), serializes `header.payload`, signs that with `signingKey`, and\n * appends the base64url signature. Returns the compact `header.payload.signature`.\n */\nfunction encodeJwt(claims: Record<string, unknown>, signingKey: NkeyPair): string {\n  // jti is the hash of the claims with jti blanked — set it blank, hash, then set.\n  const withBlankJti = { ...claims, jti: \"\" };\n  const jti = computeJti(withBlankJti);\n  const finalClaims = { ...claims, jti };\n\n  const header = base64UrlEncode(Buffer.from(JSON.stringify(JWT_HEADER), \"utf8\"));\n  const payload = base64UrlEncode(Buffer.from(JSON.stringify(finalClaims), \"utf8\"));\n  const signingInput = `${header}.${payload}`;\n  const signature = signingKey.sign(Buffer.from(signingInput, \"utf8\"));\n  return `${signingInput}.${base64UrlEncode(signature)}`;\n}\n\n/**\n * Input to mint a workspace-scoped NATS user JWT for an enrolled agent.\n *   - `userPublicKey` — the `user_nkey` from the authorization request; it MUST be\n *     the `sub` of the user JWT (nats-server rejects a mismatch).\n *   - `accountSeed` — the callout account SIGNING seed (`SA...`); both the user JWT\n *     `iss` (its public key) and the signature come from it. NEVER logged.\n *   - `name` — a human label for the user (the agent id), for server logs.\n *   - `permissions` — the pub/sub allow/deny lists (the workspace scope).\n *   - `expiresAtSeconds` — optional absolute `exp` (unix seconds). When set the\n *     server will expire the connection's credential; we tie it to the bearer's\n *     remaining life so a revoked/expired enrollment cannot outlive its bearer.\n */\nexport interface MintUserJwtInput {\n  userPublicKey: string;\n  accountSeed: string;\n  name: string;\n  permissions: NatsPermissions;\n  /** The target account NAME (the `auth_callout.account`) the user binds to; the\n   *  embedded user JWT's `aud` in server-config mode. */\n  audienceAccount: string;\n  expiresAtSeconds?: number;\n}\n\n/**\n * Mint a signed NATS user JWT scoped by `permissions`. In auth-callout SERVER\n * mode the user JWT is signed by the callout ISSUER ACCOUNT key, and its `iss` is\n * that account's public key. The returned JWT is embedded as `nats.jwt` in the\n * authorization response.\n */\nexport function mintUserJwt(input: MintUserJwtInput): string {\n  const accountKey = nkeys.fromSeed(Buffer.from(input.accountSeed)) as unknown as NkeyPair;\n  const accountPublicKey = accountKey.getPublicKey();\n  const nowSeconds = Math.floor(Date.now() / 1000);\n\n  const natsBlock: Record<string, unknown> = {\n    type: USER_CLAIM_TYPE,\n    version: NATS_CLAIM_VERSION,\n    pub: input.permissions.pub,\n    sub: input.permissions.sub,\n    // Unlimited subscriptions / data / payload (the workspace subject scope, NOT\n    // a connection-resource quota, is the boundary here).\n    subs: -1,\n    data: -1,\n    payload: -1,\n  };\n\n  const claims: Record<string, unknown> = {\n    jti: \"\",\n    iat: nowSeconds,\n    iss: accountPublicKey,\n    name: input.name,\n    sub: input.userPublicKey,\n    // SERVER-config-mode placement: nats-server reads the embedded user JWT's `aud`\n    // as the target account NAME (the configured `auth_callout.account`). This is\n    // how the authenticated user binds to that account; the workspace isolation is\n    // then carried by the pub/sub permissions below.\n    aud: input.audienceAccount,\n    nats: natsBlock,\n  };\n  if (typeof input.expiresAtSeconds === \"number\") {\n    claims.exp = input.expiresAtSeconds;\n  }\n  return encodeJwt(claims, accountKey);\n}\n\n/**\n * Input to mint the authorization RESPONSE JWT the responder publishes back on the\n * request's reply subject (ADR-26 §3).\n *   - `userPublicKey` — the request's `user_nkey`; the response `sub`.\n *   - `serverId` — the request's `nats.server_id.id` (the server's public key); the\n *     response `aud`.\n *   - `accountSeed` — the callout account signing seed; signs the response and is\n *     its `iss` (public key). NEVER logged.\n *   - `userJwt` — the embedded signed user JWT (omit on a denial).\n *   - `error` — a human-readable denial message (omit on success). When present the\n *     server denies the connection.\n */\nexport interface MintAuthResponseInput {\n  userPublicKey: string;\n  serverId: string;\n  accountSeed: string;\n  userJwt?: string;\n  error?: string;\n}\n\n/**\n * Mint the signed authorization-response JWT. On success it carries the embedded\n * user JWT (`nats.jwt`); on denial it carries `nats.error` and NO user JWT, which\n * makes nats-server refuse the connection. Signed by the callout account key (its\n * public key is `iss`); `sub` is the user_nkey, `aud` is the server id.\n */\nexport function mintAuthResponse(input: MintAuthResponseInput): string {\n  const accountKey = nkeys.fromSeed(Buffer.from(input.accountSeed)) as unknown as NkeyPair;\n  const accountPublicKey = accountKey.getPublicKey();\n  const nowSeconds = Math.floor(Date.now() / 1000);\n\n  const natsBlock: Record<string, unknown> = {\n    type: AUTH_RESPONSE_CLAIM_TYPE,\n    version: NATS_CLAIM_VERSION,\n  };\n  if (input.userJwt) {\n    natsBlock.jwt = input.userJwt;\n  }\n  if (input.error) {\n    natsBlock.error = input.error;\n  }\n\n  const claims: Record<string, unknown> = {\n    jti: \"\",\n    iat: nowSeconds,\n    iss: accountPublicKey,\n    // The response `aud` MUST be the SERVER public key in server-config mode\n    // (nats-server validates \"Audience must be a server public key\"). The\n    // authenticated user is placed into the configured `auth_callout.account` (the\n    // SAME account the responder + the privileged control plane connect into), so\n    // `agent.<ws>.<id>.rpc` request/reply routes; the workspace isolation is carried\n    // entirely by the user JWT's pub/sub subject permissions (NOT by cross-account\n    // placement, which server-config-mode nats does not support — nats-io#4335).\n    aud: input.serverId,\n    sub: input.userPublicKey,\n    nats: natsBlock,\n  };\n  return encodeJwt(claims, accountKey);\n}\n\n/**\n * The fields the responder needs out of the authorization REQUEST JWT (ADR-26 §2).\n * The request is itself a NATS JWT (`header.payload.signature`) the server signs;\n * we only DECODE it (the server proves its own identity by the connection, and the\n * embedded `auth_token` is independently HMAC-verified), so we read the payload\n * without re-verifying the server signature.\n */\nexport interface DecodedAuthRequest {\n  /** The public user nkey the response user JWT MUST be `sub`-scoped to. */\n  userNkey: string;\n  /** The server's public id — the response `aud`. */\n  serverId: string;\n  /** The connect `auth_token` the client presented (our `oge_` bearer), if any. */\n  authToken: string | undefined;\n  /** The connect username, if any (unused today; present for completeness). */\n  user: string | undefined;\n}\n\n/**\n * Decode the authorization-request JWT payload (the middle base64url segment). The\n * request shape (ADR-26 §2): `nats.user_nkey`, `nats.server_id.id`, and the\n * presented connect options under `nats.connect_opts` (`auth_token` / `user`).\n * Returns null on a malformed token so the caller can deny cleanly.\n */\nexport function decodeAuthRequest(token: string): DecodedAuthRequest | null {\n  const parts = token.split(\".\");\n  if (parts.length !== 3) {\n    return null;\n  }\n  let payload: unknown;\n  try {\n    payload = JSON.parse(Buffer.from(parts[1]!, \"base64url\").toString(\"utf8\"));\n  } catch {\n    return null;\n  }\n  if (typeof payload !== \"object\" || payload === null) {\n    return null;\n  }\n  const nats = (payload as { nats?: unknown }).nats;\n  if (typeof nats !== \"object\" || nats === null) {\n    return null;\n  }\n  const natsObj = nats as {\n    user_nkey?: unknown;\n    server_id?: { id?: unknown } | unknown;\n    connect_opts?: { auth_token?: unknown; user?: unknown } | unknown;\n  };\n  const userNkey = typeof natsObj.user_nkey === \"string\" ? natsObj.user_nkey : null;\n  if (!userNkey) {\n    return null;\n  }\n  const serverIdRaw =\n    typeof natsObj.server_id === \"object\" && natsObj.server_id !== null\n      ? (natsObj.server_id as { id?: unknown }).id\n      : undefined;\n  const serverId = typeof serverIdRaw === \"string\" ? serverIdRaw : \"\";\n  const connectOpts =\n    typeof natsObj.connect_opts === \"object\" && natsObj.connect_opts !== null\n      ? (natsObj.connect_opts as { auth_token?: unknown; user?: unknown })\n      : {};\n  const authToken = typeof connectOpts.auth_token === \"string\" ? connectOpts.auth_token : undefined;\n  const user = typeof connectOpts.user === \"string\" ? connectOpts.user : undefined;\n  return { userNkey, serverId, authToken, user };\n}\n\n/**\n * Build the workspace-scoped permission set for an agent: it may publish + subscribe\n * ONLY `agent.<workspaceId>.>` (its own RPC/event/hello subtree) and the reply\n * `_INBOX.>` subtree (so request/reply round-trips work). Everything else is\n * implicitly denied (an allow-list with no other entries IS the deny-all-else).\n *\n * THE isolation assertion (§17): with `workspaceId=A`, the returned allow lists name\n * only `agent.A.>` — so a connection bearing this credential is rejected by\n * nats-server the instant it tries to pub/sub `agent.B.>`. This is the per-workspace\n * tenancy boundary, enforced cryptographically by the signed JWT, not by naming.\n */\nexport function workspaceAgentPermissions(workspaceId: string): NatsPermissions {\n  const agentScope = `agent.${workspaceId}.>`;\n  // The reply-inbox subtree must be reachable for request/reply (the control plane\n  // requests on agent.<ws>.<id>.rpc with a reply inbox; the agent responds there).\n  const inboxScope = \"_INBOX.>\";\n  return {\n    pub: { allow: [agentScope, inboxScope] },\n    sub: { allow: [agentScope, inboxScope] },\n  };\n}\n"],"mappings":";AACA,SAAS,qBAAqB,sBAA4D;AAC1F,SAAS,SAAS,iBAA2F;;;ACA7G,IAAM,0BAA0B,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAWM,SAAS,2BAA2B,QAAwC;AACjF,QAAM,YAA4B,CAAC;AACnC,MAAI,MAAuB;AAE3B,QAAM,QAAQ,MAAM;AAClB,QAAI,CAAC,KAAK;AACR;AAAA,IACF;AACA,cAAU,KAAK;AAAA,MACb,GAAG,IAAI;AAAA,MACP,SAAS,IAAI,MAAM,SAAS,iCAGxB;AAAA,QACE,OAAO,IAAI;AAAA,QACX,gBAAgB,IAAI;AAAA,QACpB,GAAI,IAAI,kBAAkB,SAAY,EAAE,QAAQ,IAAI,cAAc,IAAI,CAAC;AAAA,QACvE,GAAI,IAAI,qBAAqB,SAAY,EAAE,WAAW,IAAI,iBAAiB,IAAI,CAAC;AAAA,QAChF,GAAI,IAAI,gBAAgB,SAAY,EAAE,MAAM,IAAI,YAAY,IAAI,CAAC;AAAA,MACnE,IACA;AAAA,QACE,MAAM,IAAI;AAAA,QACV,gBAAgB,IAAI;AAAA,MACtB;AAAA,IACN,CAAC;AACD,UAAM;AAAA,EACR;AAEA,aAAW,SAAS,QAAQ;AAC1B,QAAI,CAAC,mBAAmB,KAAK,GAAG;AAC9B,YAAM;AACN,gBAAU,KAAK,KAAK;AACpB;AAAA,IACF;AAEA,UAAM,YAAY,MAAM,SAAS;AACjC,UAAM,cAAc,YAAY,iBAAiB,MAAM,OAAO,IAAI;AAClE,UAAM,gBAAgB,YAAY,mBAAmB,MAAM,SAAS,QAAQ,IAAI;AAChF,UAAM,mBAAmB,YAAY,mBAAmB,MAAM,SAAS,WAAW,IAAI;AACtF,QACE,OACG,aAAa,IAAI,OAAO,OAAO,IAAI,aAAa,WAAW,KAC3D,IAAI,kBAAkB,iBACtB,IAAI,qBAAqB,kBAC5B;AACA,UAAI,QAAQ,UAAU,KAAK;AAC3B,UAAI,eAAe,MAAM;AACzB;AAAA,IACF;AAEA,UAAM;AACN,UAAM;AAAA,MACJ,OAAO;AAAA,MACP,cAAc,MAAM;AAAA,MACpB,MAAM,UAAU,KAAK;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM;AACN,SAAO;AACT;AAEA,SAAS,mBAAmB,OAA8B;AACxD,SAAO,wBAAwB,IAAI,MAAM,IAAI;AAC/C;AAEA,SAAS,aACP,OACA,MACA,kBACA,iBACS;AACT,MAAI,MAAM,SAAS,KAAK,MAAM;AAC5B,WAAO;AAAA,EACT;AACA,OAAK,MAAM,UAAU,WAAW,KAAK,UAAU,OAAO;AACpD,WAAO;AAAA,EACT;AACA,SAAO,MAAM,SAAS,kCAAkC,qBAAqB;AAC/E;AAEA,SAAS,UAAU,OAA6B;AAC9C,MAAI,MAAM,SAAS,yBAAyB;AAC1C,WAAO,cAAc,MAAM,OAAO;AAAA,EACpC;AACA,QAAM,UAAU,SAAS,MAAM,OAAO;AACtC,MAAI,MAAM,SAAS,gCAAgC;AAGjD,eAAW,OAAO,CAAC,SAAS,QAAQ,QAAQ,GAAY;AACtD,UAAI,OAAO,QAAQ,GAAG,MAAM,UAAU;AACpC,eAAO,QAAQ,GAAG;AAAA,MACpB;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,SAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAC3D;AAEA,SAAS,cAAc,SAA0B;AAC/C,QAAM,SAAS,SAAS,OAAO;AAC/B,MAAI,OAAO,OAAO,SAAS,UAAU;AACnC,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,UAAU,SAAS,SAAS,OAAO,IAAI,EAAE,OAAO,EAAE;AACxD,MAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;AAC3B,WAAO;AAAA,EACT;AACA,SAAO,QACJ,IAAI,CAAC,SAAS;AACb,UAAM,OAAO,SAAS,IAAI,EAAE;AAC5B,WAAO,OAAO,SAAS,WAAW,OAAO;AAAA,EAC3C,CAAC,EACA,KAAK,EAAE;AACZ;AAEA,SAAS,iBAAiB,SAAsC;AAC9D,QAAM,OAAO,SAAS,OAAO,EAAE;AAC/B,SAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAEA,SAAS,mBAAmB,SAAkB,KAAiD;AAC7F,QAAM,QAAQ,SAAS,OAAO,EAAE,GAAG;AACnC,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,WAAW,QAAmC,CAAC;AAClF;;;ACrHA,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AAItB,IAAM,aAAa,EAAE,KAAK,OAAO,KAAK,eAAe;AAGrD,IAAM,kBAAkB;AACxB,IAAM,2BAA2B;AACjC,IAAM,qBAAqB;AA2B3B,SAAS,gBAAgB,OAA2B;AAClD,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,WAAW;AAChD;AAIA,IAAM,kBAAkB;AACxB,SAAS,gBAAgB,OAA2B;AAClD,MAAI,OAAO;AACX,MAAI,QAAQ;AACZ,MAAI,MAAM;AACV,aAAW,QAAQ,OAAO;AACxB,YAAS,SAAS,IAAK;AACvB,YAAQ;AACR,WAAO,QAAQ,GAAG;AAChB,cAAQ;AACR,aAAO,gBAAiB,UAAU,OAAQ,EAAE;AAAA,IAC9C;AAAA,EACF;AACA,MAAI,OAAO,GAAG;AACZ,WAAO,gBAAiB,SAAU,IAAI,OAAS,EAAE;AAAA,EACnD;AACA,SAAO;AACT;AAQA,SAAS,WAAW,oBAAoC;AACtD,QAAM,OAAO,KAAK,UAAU,kBAAkB;AAC9C,QAAM,SAAS,WAAW,YAAY,EAAE,OAAO,MAAM,MAAM,EAAE,OAAO;AACpE,SAAO,gBAAgB,MAAM;AAC/B;AAQA,SAAS,UAAU,QAAiC,YAA8B;AAEhF,QAAM,eAAe,EAAE,GAAG,QAAQ,KAAK,GAAG;AAC1C,QAAM,MAAM,WAAW,YAAY;AACnC,QAAM,cAAc,EAAE,GAAG,QAAQ,IAAI;AAErC,QAAM,SAAS,gBAAgB,OAAO,KAAK,KAAK,UAAU,UAAU,GAAG,MAAM,CAAC;AAC9E,QAAM,UAAU,gBAAgB,OAAO,KAAK,KAAK,UAAU,WAAW,GAAG,MAAM,CAAC;AAChF,QAAM,eAAe,GAAG,MAAM,IAAI,OAAO;AACzC,QAAM,YAAY,WAAW,KAAK,OAAO,KAAK,cAAc,MAAM,CAAC;AACnE,SAAO,GAAG,YAAY,IAAI,gBAAgB,SAAS,CAAC;AACtD;AA+BO,SAAS,YAAY,OAAiC;AAC3D,QAAM,aAAa,MAAM,SAAS,OAAO,KAAK,MAAM,WAAW,CAAC;AAChE,QAAM,mBAAmB,WAAW,aAAa;AACjD,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAE/C,QAAM,YAAqC;AAAA,IACzC,MAAM;AAAA,IACN,SAAS;AAAA,IACT,KAAK,MAAM,YAAY;AAAA,IACvB,KAAK,MAAM,YAAY;AAAA;AAAA;AAAA,IAGvB,MAAM;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAEA,QAAM,SAAkC;AAAA,IACtC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,MAAM,MAAM;AAAA,IACZ,KAAK,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,IAKX,KAAK,MAAM;AAAA,IACX,MAAM;AAAA,EACR;AACA,MAAI,OAAO,MAAM,qBAAqB,UAAU;AAC9C,WAAO,MAAM,MAAM;AAAA,EACrB;AACA,SAAO,UAAU,QAAQ,UAAU;AACrC;AA4BO,SAAS,iBAAiB,OAAsC;AACrE,QAAM,aAAa,MAAM,SAAS,OAAO,KAAK,MAAM,WAAW,CAAC;AAChE,QAAM,mBAAmB,WAAW,aAAa;AACjD,QAAM,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAE/C,QAAM,YAAqC;AAAA,IACzC,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACA,MAAI,MAAM,SAAS;AACjB,cAAU,MAAM,MAAM;AAAA,EACxB;AACA,MAAI,MAAM,OAAO;AACf,cAAU,QAAQ,MAAM;AAAA,EAC1B;AAEA,QAAM,SAAkC;AAAA,IACtC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQL,KAAK,MAAM;AAAA,IACX,KAAK,MAAM;AAAA,IACX,MAAM;AAAA,EACR;AACA,SAAO,UAAU,QAAQ,UAAU;AACrC;AA0BO,SAAS,kBAAkB,OAA0C;AAC1E,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,EACT;AACA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,OAAO,KAAK,MAAM,CAAC,GAAI,WAAW,EAAE,SAAS,MAAM,CAAC;AAAA,EAC3E,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,YAAY,YAAY,MAAM;AACnD,WAAO;AAAA,EACT;AACA,QAAM,OAAQ,QAA+B;AAC7C,MAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,WAAO;AAAA,EACT;AACA,QAAM,UAAU;AAKhB,QAAM,WAAW,OAAO,QAAQ,cAAc,WAAW,QAAQ,YAAY;AAC7E,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AACA,QAAM,cACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,cAAc,OAC1D,QAAQ,UAA+B,KACxC;AACN,QAAM,WAAW,OAAO,gBAAgB,WAAW,cAAc;AACjE,QAAM,cACJ,OAAO,QAAQ,iBAAiB,YAAY,QAAQ,iBAAiB,OAChE,QAAQ,eACT,CAAC;AACP,QAAM,YAAY,OAAO,YAAY,eAAe,WAAW,YAAY,aAAa;AACxF,QAAM,OAAO,OAAO,YAAY,SAAS,WAAW,YAAY,OAAO;AACvE,SAAO,EAAE,UAAU,UAAU,WAAW,KAAK;AAC/C;AAaO,SAAS,0BAA0B,aAAsC;AAC9E,QAAM,aAAa,SAAS,WAAW;AAGvC,QAAM,aAAa;AACnB,SAAO;AAAA,IACL,KAAK,EAAE,OAAO,CAAC,YAAY,UAAU,EAAE;AAAA,IACvC,KAAK,EAAE,OAAO,CAAC,YAAY,UAAU,EAAE;AAAA,EACzC;AACF;;;AF/LA,SAAS,WAAAA,UAAS,SAAAC,cAAkC;AA3IpD,IAAM,QAAQ,UAA4C;AAW1D,IAAM,eAAsC;AAAA,EAC1C,OAAO,MAAM;AAAA,EAAC;AAAA,EACd,MAAM,MAAM;AAAA,EAAC;AACf;AA0BA,IAAM,oBAAoB;AAAA,EACxB,WAAW;AAAA,EACX,sBAAsB;AAAA,EACtB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,YAAY;AACd;AAQA,SAAS,sBAAsB,SAA+C;AAC5E,SAAO,EAAE,GAAG,mBAAmB,GAAG,QAAQ;AAC5C;AAGA,IAAM,2BAA2B;AAWjC,eAAe,iBAAiB,IAAoB,WAAkC;AACpF,MAAI;AACJ,QAAM,UAAU,IAAI,QAAc,CAAC,YAAY;AAC7C,YAAQ,WAAW,SAAS,SAAS;AAAA,EACvC,CAAC;AACD,MAAI;AACF,UAAM,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,MAAM,MAAS,GAAG,OAAO,CAAC;AAAA,EACjE,UAAE;AACA,QAAI,OAAO;AACT,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AASA,SAAS,oBACP,IACA,OACA,SAAsB,cACtB,UACM;AACN,QAAM,YAAY;AAChB,QAAI;AACF,uBAAiB,UAAU,GAAG,OAAO,GAAG;AACtC,mBAAW,OAAO,IAAI;AACtB,cAAM,aAAa,EAAE,OAAO,QAAQ,OAAO,MAAM,MAAM,OAAO,KAAK;AACnE,YAAI,iBAAiB,OAAO,IAAI,GAAG;AACjC,WAAC,OAAO,QAAQ,aAAa,MAAM,0BAA0B,UAAU;AAAA,QACzE,OAAO;AACL,WAAC,OAAO,SAAS,aAAa,OAAO,0BAA0B,UAAU;AAAA,QAC3E;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAGR;AAAA,EACF,GAAG;AACL;AAEA,SAAS,iBAAiB,MAAuB;AAC/C,SAAO,SAAS,gBAAgB,SAAS,WAAW,SAAS;AAC/D;AAmGA,eAAsB,mBACpB,SACA,MACA,UAA2B,CAAC,GACT;AACnB,QAAM,iBAAoC,EAAE,SAAS,QAAQ;AAC7D,MAAI,MAAM;AACR,mBAAe,OAAO,KAAK;AAC3B,mBAAe,OAAO,KAAK;AAAA,EAC7B;AACA,QAAM,KAAK,MAAM,QAAQ,sBAAsB,cAAc,CAAC;AAC9D,MAAI,YAAY;AAChB,sBAAoB,IAAI,aAAa,QAAQ,QAAQ,CAAC,SAAS;AAC7D,QAAI,SAAS,gBAAgB,SAAS,kBAAkB,SAAS,qBAAqB,SAAS,SAAS;AACtG,kBAAY;AAAA,IACd,WAAW,SAAS,aAAa,SAAS,aAAa;AACrD,kBAAY;AAAA,IACd;AAAA,EACF,CAAC;AACD,QAAM,oBAAuC;AAAA,IAC3C,SAAS,OAAO,SAAS,SAAS,SAAS,aAAa,IAAI,SAAS,SAAS,KAAK,OAAO;AAAA,EAC5F;AACA,SAAO;AAAA,IACL,SAAS,OAAO,aAAa,WAAW,WAAW;AACjD,UAAI,OAAO,WAAW,GAAG;AACvB;AAAA,MACF;AASA,UAAI;AACF,WAAG,QAAQ,eAAe,aAAa,SAAS,GAAG,MAAM,OAAO,EAAE,aAAa,WAAW,OAAO,CAAC,CAAC;AAAA,MACrG,SAAS,OAAO;AAGd,SAAC,QAAQ,QAAQ,QAAQ,aAAa,MAAM,0FAA0F;AAAA,UACpI;AAAA,UACA;AAAA,UACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D,CAAC;AACD;AAAA,MACF;AACA,YAAM,iBAAiB,IAAI,wBAAwB;AAAA,IACrD;AAAA,IACA,WAAW,OAAO,aAAa,WAAW,aAAa,iBAAiB,IAAI,aAAa,WAAW,QAAQ;AAAA,IAC5G,SAAS,OAAO,SAAS,SAAS,SAAS,aAAa,IAAI,SAAS,SAAS,KAAK,SAAS;AAAA,IAC5F,mBAAmB,CAAC,SAAS,YAAY,kBAAkB,IAAI,SAAS,OAAO;AAAA,IAC/E,sBAAsB,CAAC,SAAS,YAAY,qBAAqB,IAAI,SAAS,OAAO;AAAA,IACrF,sBAAsB,MAAM;AAAA,IAC5B,aAAa,MAAM,aAAa,CAAC,GAAG,SAAS,KAAK,CAAC,GAAG,WAAW;AAAA,IACjE,OAAO,YAAY;AACjB,YAAM,GAAG,MAAM;AAAA,IACjB;AAAA,EACF;AACF;AAmCA,eAAsB,0BACpB,SACA,MACA,SACA,SACA,UAAmD,CAAC,GACtB;AAC9B,QAAM,iBAAoC,EAAE,SAAS,QAAQ;AAC7D,MAAI,QAAQ,MAAM;AAChB,mBAAe,OAAO,QAAQ;AAAA,EAChC;AACA,MAAI,KAAK,SAAS,iBAAiB;AACjC,mBAAe,OAAO,KAAK;AAC3B,mBAAe,OAAO,KAAK;AAAA,EAC7B,WAAW,KAAK,SAAS,SAAS;AAChC,mBAAe,QAAQ,KAAK;AAAA,EAC9B;AACA,QAAM,KAAK,MAAM,QAAQ,sBAAsB,cAAc,CAAC;AAC9D,sBAAoB,IAAI,QAAQ,OAAO,gBAAgB,QAAQ,IAAI,KAAK,gBAAgB,QAAQ,MAAM;AACtG,QAAM,MAAoB,GAAG,UAAU,OAAO;AAC9C,QAAM,YAAY;AAChB,qBAAiB,OAAO,KAAK;AAC3B,UAAI,CAAC,IAAI,OAAO;AACd;AAAA,MACF;AACA,UAAI;AACF,cAAM,QAAQ,MAAM,QAAQ,IAAI,MAAM,IAAI,OAAO;AACjD,YAAI,QAAQ,KAAK;AAAA,MACnB,QAAQ;AAAA,MAGR;AAAA,IACF;AAAA,EACF,GAAG;AACH,SAAO;AAAA,IACL,OAAO,YAAY;AACjB,UAAI,YAAY;AAChB,YAAM,GAAG,MAAM;AAAA,IACjB;AAAA,EACF;AACF;AAEA,eAAsB,uBAAuB,IAAc,KAAe,aAAqB,WAAmB,QAAqD;AACrK,QAAM,WAAW,MAAM,oBAAoB,IAAI,aAAa,WAAW,MAAM;AAQ7E,MAAI;AACF,UAAM,IAAI,QAAQ,aAAa,WAAW,QAAQ;AAAA,EACpD,SAAS,OAAO;AACd,YAAQ;AAAA,MACN,oCAAoC,WAAW,IAAI,SAAS,KAAK,SAAS,MAAM;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,IAAoB,aAAqB,WAAmB,UAAwE;AAC5J,QAAM,MAAoB,GAAG,UAAU,eAAe,aAAa,SAAS,CAAC;AAC7E,QAAM,YAAY;AAChB,qBAAiB,OAAO,KAAK;AAC3B,YAAM,UAAU,MAAM,OAAO,IAAI,IAAI;AACrC,YAAM,SAAS,YAAY,UAAU,QAAQ,SAAS,CAAC,OAAO;AAC9D,YAAM,SAAS,MAAM;AAAA,IACvB;AAAA,EACF,GAAG;AACH,SAAO,MAAM;AACX,QAAI,YAAY;AAAA,EAClB;AACF;AASA,eAAe,aAAa,IAAoB,SAAiB,SAAqB,SAAwC;AAC5H,QAAM,MAAW,MAAM,GAAG,QAAQ,SAAS,SAAS,EAAE,QAAQ,CAAC;AAC/D,SAAO,EAAE,MAAM,IAAI,KAAK;AAC1B;AASA,SAAS,kBAAkB,IAAoB,SAAiB,SAAqC;AACnG,QAAM,MAAoB,GAAG,UAAU,OAAO;AAC9C,QAAM,YAAY;AAChB,qBAAiB,OAAO,KAAK;AAG3B,UAAI,CAAC,IAAI,OAAO;AACd;AAAA,MACF;AACA,UAAI;AACF,cAAM,QAAQ,MAAM,QAAQ,IAAI,MAAM,IAAI,OAAO;AACjD,YAAI,QAAQ,KAAK;AAAA,MACnB,QAAQ;AAAA,MAIR;AAAA,IACF;AAAA,EACF,GAAG;AACH,SAAO,MAAM;AACX,QAAI,YAAY;AAAA,EAClB;AACF;AASA,SAAS,qBACP,IACA,SACA,SACY;AACZ,QAAM,MAAoB,GAAG,UAAU,OAAO;AAC9C,QAAM,YAAY;AAChB,qBAAiB,OAAO,KAAK;AAC3B,UAAI;AACF,cAAM,QAAQ,IAAI,MAAM,IAAI,OAAO;AAAA,MACrC,QAAQ;AAAA,MAGR;AAAA,IACF;AAAA,EACF,GAAG;AACH,SAAO,MAAM;AACX,QAAI,YAAY;AAAA,EAClB;AACF;AAEO,SAAS,UAAU,OAA6B;AACrD,SAAO;AAAA,IACL,OAAO,MAAM,QAAQ;AAAA,IACrB,UAAU,MAAM,IAAI;AAAA,IACpB,SAAS,KAAK,UAAU,KAAK,CAAC;AAAA,IAC9B;AAAA,IACA;AAAA,EACF,EAAE,KAAK,IAAI;AACb;","names":["connect","nkeys"]}

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@opengeni/events",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "type": "module",
+  "license": "Apache-2.0",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -21,17 +22,14 @@
   },
   "scripts": {
     "build": "tsup",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "bash ../../scripts/prepublish-guard"
   },
   "dependencies": {
-    "@opengeni/contracts": "^0.7.0",
-    "@opengeni/db": "^0.4.1",
+    "@opengeni/contracts": "^0.9.0",
+    "@opengeni/db": "^0.6.0",
     "nats": "^2.29.3"
   },
-  "devDependencies": {
-    "tsup": "^8.5.0",
-    "typescript": "^6.0.3"
-  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Cloudgeni-ai/opengeni.git",

package/src/coalesce.ts

@@ -11,6 +11,8 @@ type DeltaRun = {
   lastSequence: number;
   text: string;
   sandboxName: string | undefined;
+  sandboxStream: string | undefined;
+  sandboxCommandId: string | undefined;
 };
 
 export function coalesceSessionEventDeltas(events: SessionEvent[]): SessionEvent[] {
@@ -23,13 +25,20 @@ export function coalesceSessionEventDeltas(events: SessionEvent[]): SessionEvent
     }
     coalesced.push({
       ...run.first,
-      payload: {
-        text: run.text,
-        coalescedUntil: run.lastSequence,
-        ...(run.first.type === "sandbox.command.output.delta" && run.sandboxName !== undefined
-          ? { name: run.sandboxName }
-          : {}),
-      },
+      payload: run.first.type === "sandbox.command.output.delta"
+        // Sandbox output keeps its CANONICAL field (`chunk` — the terminal and
+        // projection read it) plus the stream/commandId identity of the run.
+        ? {
+            chunk: run.text,
+            coalescedUntil: run.lastSequence,
+            ...(run.sandboxStream !== undefined ? { stream: run.sandboxStream } : {}),
+            ...(run.sandboxCommandId !== undefined ? { commandId: run.sandboxCommandId } : {}),
+            ...(run.sandboxName !== undefined ? { name: run.sandboxName } : {}),
+          }
+        : {
+            text: run.text,
+            coalescedUntil: run.lastSequence,
+          },
     });
     run = null;
   };
@@ -41,8 +50,16 @@ export function coalesceSessionEventDeltas(events: SessionEvent[]): SessionEvent
       continue;
     }
 
-    const sandboxName = event.type === "sandbox.command.output.delta" ? sandboxDeltaName(event.payload) : undefined;
-    if (run && sameDeltaRun(run.first, event, run.sandboxName, sandboxName)) {
+    const isSandbox = event.type === "sandbox.command.output.delta";
+    const sandboxName = isSandbox ? sandboxDeltaName(event.payload) : undefined;
+    const sandboxStream = isSandbox ? sandboxDeltaString(event.payload, "stream") : undefined;
+    const sandboxCommandId = isSandbox ? sandboxDeltaString(event.payload, "commandId") : undefined;
+    if (
+      run
+      && sameDeltaRun(run.first, event, run.sandboxName, sandboxName)
+      && run.sandboxStream === sandboxStream
+      && run.sandboxCommandId === sandboxCommandId
+    ) {
       run.text += deltaText(event);
       run.lastSequence = event.sequence;
       continue;
@@ -54,6 +71,8 @@ export function coalesceSessionEventDeltas(events: SessionEvent[]): SessionEvent
       lastSequence: event.sequence,
       text: deltaText(event),
       sandboxName,
+      sandboxStream,
+      sandboxCommandId,
     };
   }
 
@@ -86,7 +105,14 @@ function deltaText(event: SessionEvent): string {
   }
   const payload = asRecord(event.payload);
   if (event.type === "sandbox.command.output.delta") {
-    return typeof payload.text === "string" ? payload.text : typeof payload.output === "string" ? payload.output : "";
+    // `chunk` is the canonical wire field (contracts SandboxCommandOutputDeltaPayload);
+    // text/output are tolerated legacy shapes.
+    for (const key of ["chunk", "text", "output"] as const) {
+      if (typeof payload[key] === "string") {
+        return payload[key] as string;
+      }
+    }
+    return "";
   }
   return typeof payload.text === "string" ? payload.text : "";
 }
@@ -113,6 +139,11 @@ function sandboxDeltaName(payload: unknown): string | undefined {
   return typeof name === "string" ? name : undefined;
 }
 
+function sandboxDeltaString(payload: unknown, key: "stream" | "commandId"): string | undefined {
+  const value = asRecord(payload)[key];
+  return typeof value === "string" ? value : undefined;
+}
+
 function asRecord(value: unknown): Record<string, unknown> {
   return value && typeof value === "object" ? value as Record<string, unknown> : {};
 }