@sentry/junior 0.183.0 → 0.184.0

package/dist/app.js

@@ -1,15 +1,15 @@
 import {
   processConversationWork
-} from "./chunk-3HJ4F4L7.js";
+} from "./chunk-4RONS3WR.js";
 import {
   bindSpawnAgent
-} from "./chunk-VOV3SCM3.js";
+} from "./chunk-QABCY33S.js";
 import {
   createAgentInvocationWorker,
   enqueueAgentInvocation,
   listPendingAgentInvocationMailboxAppends,
   routeAgentInvocationWork
-} from "./chunk-IO6KFXYE.js";
+} from "./chunk-BT53RIGJ.js";
 import {
   GET as GET2,
   GET2 as GET3,
@@ -36,7 +36,7 @@ import {
   startSlackProcessingReaction,
   stripLeadingBotMention,
   wakePausedTurn
-} from "./chunk-T5MTGX2E.js";
+} from "./chunk-ACPDVEJO.js";
 import "./chunk-FA6POGLH.js";
 import {
   GET,
@@ -53,8 +53,8 @@ import {
   resolveSlackConversationContext,
   routeApiTurnWork,
   webActorFromEmail
-} from "./chunk-AYW7J6K4.js";
-import "./chunk-4WGFWHWP.js";
+} from "./chunk-UBOIHNTH.js";
+import "./chunk-LCP4EDKR.js";
 import {
   buildDeliveredTurnStatePatch,
   completeAuthPauseTurn,
@@ -65,7 +65,7 @@ import {
   getTurnUserSlackMessageTs,
   persistAuthPauseTurnState,
   requireTurnFailureEventId
-} from "./chunk-WOKJRLM2.js";
+} from "./chunk-M5YWNMTE.js";
 import {
   claimDispatchMailboxAppend,
   confirmDispatchMailboxAppend,
@@ -85,7 +85,7 @@ import {
   recordTaskExecution,
   resolveTurnSessionRouting,
   scheduleSessionCompletedPluginTasks
-} from "./chunk-W5JMPEBO.js";
+} from "./chunk-6WGC3SO4.js";
 import {
   ConversationTurnLifecycleService
 } from "./chunk-M3QYTBQ6.js";
@@ -97,17 +97,17 @@ import {
   persistThreadRuntimeState,
   persistThreadState,
   persistThreadStateById
-} from "./chunk-PLZT45VC.js";
+} from "./chunk-E57WPXWY.js";
 import "./chunk-UTL3MHPC.js";
 import {
   createVercelPluginTaskCallback,
   queueCallback,
   registerVercelPluginTaskDevConsumer
-} from "./chunk-V64JCZUV.js";
+} from "./chunk-UF6BUA5W.js";
 import {
   validatePluginEgressCredentialHooks,
   validatePluginRegistrations
-} from "./chunk-3L7CWDQQ.js";
+} from "./chunk-HUXFMDBZ.js";
 import {
   defineJuniorPlugins,
   pluginCatalogConfigFromEnv,
@@ -155,11 +155,11 @@ import {
   unpublishedArtifactHeaders,
   verifySlackSignature,
   withNormalizedThreadId
-} from "./chunk-QZV76CM4.js";
+} from "./chunk-JNO2GUDS.js";
 import {
   AuthorizationFlowDisabledError,
   PluginCredentialFailureError
-} from "./chunk-35PM4YY5.js";
+} from "./chunk-K7VDC2QW.js";
 import "./chunk-6Y5B5PEX.js";
 import "./chunk-DIB4GX3G.js";
 import {
@@ -168,7 +168,7 @@ import {
   deleteMcpAuthSessionsForUserProvider,
   deleteMcpServerSessionId,
   deleteMcpStoredOAuthCredentials
-} from "./chunk-2EPYYVJC.js";
+} from "./chunk-FKEZZMXS.js";
 import {
   RetryableDeliveryError
 } from "./chunk-RF6J3DIO.js";
@@ -176,7 +176,7 @@ import {
   formatProviderLabel,
   postSlackMessage,
   startOAuthFlow
-} from "./chunk-QI5JW5AG.js";
+} from "./chunk-JM2COLGC.js";
 import {
   getExperimentalFeatures,
   isExperimentalFeatureEnabled,
@@ -197,10 +197,10 @@ import {
   scheduledRunId,
   scheduledRunSchema,
   withScheduledTaskLock
-} from "./chunk-R767Y7QV.js";
+} from "./chunk-HIPUIPJM.js";
 import {
   parseSlackThreadId
-} from "./chunk-SQHFVIMZ.js";
+} from "./chunk-YKX6MTLU.js";
 import {
   CONVERSATION_WORK_STALE_ENQUEUE_MS,
   appendAndEnqueueInboundMessage,
@@ -215,7 +215,7 @@ import {
   removeActiveConversation,
   requestConversationWork,
   stopConversationWork
-} from "./chunk-HUK5XIZL.js";
+} from "./chunk-Z3QAXJR7.js";
 import {
   ConversationTurnBoundaryError,
   CooperativeTurnYieldError,
@@ -233,7 +233,7 @@ import {
   markTurnCompleted,
   markTurnFailed,
   startActiveTurn
-} from "./chunk-56XONJPF.js";
+} from "./chunk-JA43DV4Y.js";
 import {
   abandonTurnRecord,
   appendThreadContextMessages,
@@ -269,11 +269,11 @@ import {
   trimTrailingAssistantMessages,
   turnHasReply,
   upsertConversationMessage
-} from "./chunk-24OJZ5OU.js";
+} from "./chunk-2ZQPVX7C.js";
 import {
   getSandboxResourceConfig,
   setSandboxResourceConfig
-} from "./chunk-37IQ6DGU.js";
+} from "./chunk-MAPJFUMV.js";
 import "./chunk-PDO5BLNM.js";
 import "./chunk-UIE3R5XU.js";
 import {
@@ -292,7 +292,7 @@ import {
 import "./chunk-7H2VZTWN.js";
 import {
   getTurnRequestDeadline
-} from "./chunk-FJMTMGBC.js";
+} from "./chunk-MLSQX2EX.js";
 import {
   SlackActionError,
   bindEventTaskCredentialSubject,
@@ -318,7 +318,7 @@ import {
   verifyEventTaskCredentialSubject,
   verifyScheduledTaskCredentialSubject,
   verifySlackDirectCredentialSubject
-} from "./chunk-AHMWPFIW.js";
+} from "./chunk-4CNDGK25.js";
 import "./chunk-3Y47VMHV.js";
 import {
   contextProvenance,
@@ -331,7 +331,7 @@ import {
   requireSlackDestination,
   withConversationEventLock,
   withConversationMutationLock
-} from "./chunk-AX3UDIMA.js";
+} from "./chunk-IZDYYYGP.js";
 import {
   juniorAgentBindings,
   juniorAgentInvocations,
@@ -339,13 +339,13 @@ import {
   juniorConversations,
   juniorSchedulerRuns,
   juniorSchedulerTasks
-} from "./chunk-6UXDTPEN.js";
-import "./chunk-X52ESOBP.js";
+} from "./chunk-BCHYQS4B.js";
+import "./chunk-SHJK75Z2.js";
 import {
   acquireActiveLock,
   getStateAdapter,
   withActiveLock
-} from "./chunk-G2B2XZQW.js";
+} from "./chunk-DUKIDPF6.js";
 import {
   juniorDestinations
 } from "./chunk-VFUK3X5B.js";
@@ -366,13 +366,13 @@ import {
   modelIdForProfile,
   setProfiles,
   setSlackReactionConfig
-} from "./chunk-LMNMMESF.js";
-import "./chunk-2ADFGSUS.js";
-import "./chunk-KTXOGLNE.js";
+} from "./chunk-6UDPINOX.js";
+import "./chunk-BHYRYYLY.js";
+import "./chunk-WQFEWULF.js";
 import {
   pluginCatalogRuntime
-} from "./chunk-E3OBGRHN.js";
-import "./chunk-EENQGEIP.js";
+} from "./chunk-PJPRXO2T.js";
+import "./chunk-LHXIZLFF.js";
 import {
   credentialContextForActor
 } from "./chunk-CEMMLV5L.js";
@@ -407,13 +407,13 @@ import {
   withContext,
   withLogContext,
   withSpan
-} from "./chunk-LZBPGX5A.js";
+} from "./chunk-3S7ULUWW.js";
 import {
   continueTrace
 } from "./chunk-PEQXYSSE.js";
 import {
   JUNIOR_VERSION
-} from "./chunk-W46NIB5H.js";
+} from "./chunk-6VOYP4M6.js";
 
 // src/app.ts
 import { createRequire } from "module";
@@ -698,10 +698,10 @@ async function readDispatchTurnResult(dispatch2) {
   const session = storedSession ?? summary;
   const dispatchOutcome = summary?.dispatchOutcome ?? storedSession?.dispatchOutcome;
   const resultMessageTs = summary?.resultMessageId ?? storedSession?.resultMessageId;
-  const errorMessage = storedSession?.errorMessage;
+  const errorMessage3 = storedSession?.errorMessage;
   if (dispatchOutcome) {
     return {
-      ...errorMessage ? { errorMessage } : void 0,
+      ...errorMessage3 ? { errorMessage: errorMessage3 } : void 0,
       outcome: dispatchOutcome,
       ...resultMessageTs ? { resultMessageTs } : void 0
     };
@@ -1274,13 +1274,13 @@ async function skipMissedRun(db, args) {
     return void 0;
   }
   const duplicateOf = await findStaleRecoveryCanonicalTask(db, current);
-  const errorMessage = duplicateOf ? `Duplicate stale scheduled task was skipped without dispatch. Canonical task: ${duplicateOf.id}.` : "Scheduled occurrence was more than 24 hours late and was skipped without dispatch.";
+  const errorMessage3 = duplicateOf ? `Duplicate stale scheduled task was skipped without dispatch. Canonical task: ${duplicateOf.id}.` : "Scheduled occurrence was more than 24 hours late and was skipped without dispatch.";
   const skipped = {
     id: scheduledRunId(current.id, args.scheduledForMs),
     attempt: 1,
     claimedAtMs: args.nowMs,
     completedAtMs: args.nowMs,
-    errorMessage,
+    errorMessage: errorMessage3,
     scheduledForMs: args.scheduledForMs,
     status: "skipped",
     taskId: current.id
@@ -1299,12 +1299,12 @@ async function skipMissedRun(db, args) {
       nextRunAtMs,
       runNowAtMs: isRunNow ? void 0 : current.runNowAtMs,
       status,
-      statusReason: status === "deleted" ? errorMessage : void 0,
+      statusReason: status === "deleted" ? errorMessage3 : void 0,
       updatedAtMs: args.nowMs
     },
     current
   );
-  return { errorMessage, run: skipped, task: current };
+  return { errorMessage: errorMessage3, run: skipped, task: current };
 }
 async function claimDueScheduledRun(db, args) {
   const skippedRuns = [];
@@ -7147,7 +7147,7 @@ function createSlackDispatchTurnRunner(options) {
       isSubscribedContext: true
     });
     let outcome;
-    let errorMessage;
+    let errorMessage3;
     let resultMessageTs;
     const routing = buildDispatchRoutingContext(dispatch2);
     await options.executeSlackTurn(thread, message, {
@@ -7173,13 +7173,13 @@ function createSlackDispatchTurnRunner(options) {
       },
       onTurnOutcome: (result) => {
         outcome = result.outcome;
-        errorMessage = result.errorMessage;
+        errorMessage3 = result.errorMessage;
       },
       shouldYield: hooks.shouldYield,
       skipBackfill: true
     });
     return {
-      ...errorMessage ? { errorMessage } : void 0,
+      ...errorMessage3 ? { errorMessage: errorMessage3 } : void 0,
       ...outcome ? { outcome } : void 0,
       ...resultMessageTs ? { resultMessageTs } : void 0
     };
@@ -7411,7 +7411,7 @@ async function failTurnBestEffort(args) {
     );
   }
 }
-async function persistFailedReplyState(turn, errorMessage = "Paused agent run failed while continuing") {
+async function persistFailedReplyState(turn, errorMessage3 = "Paused agent run failed while continuing") {
   const currentState = await getPersistedThreadState(turn.conversationId);
   const conversation = coerceThreadConversationState(currentState);
   await hydrateConversationMessages({
@@ -7428,7 +7428,7 @@ async function persistFailedReplyState(turn, errorMessage = "Paused agent run fa
   });
   await failTurnBestEffort({
     turn,
-    errorMessage
+    errorMessage: errorMessage3
   });
   await persistThreadStateById(turn.conversationId, {
     conversation
@@ -8189,7 +8189,7 @@ async function stopApiConversationTurn(args) {
   return result;
 }
 
-// src/chat/api-turns/adapter-conversations.ts
+// src/api/acp/conversations.ts
 var EVENT_PAGE_SIZE = 50;
 function actorFromUser(user) {
   return webActorFromEmail(
@@ -8227,7 +8227,7 @@ async function latestEventCursor(eventStore, conversationId) {
   const page = await eventStore.query(conversationId, { limit: 1 });
   return page.events.at(-1)?.seq ?? 0;
 }
-function createAdapterConversations(options) {
+function createAcpConversations(options) {
   return {
     async cancel({ conversationId, user }) {
       if (!await hasConversationAccess(conversationId, user)) {
@@ -8340,8 +8340,1928 @@ function createAdapterConversations(options) {
   };
 }
 
+// src/api/acp/route.ts
+import { createHash as createHash4 } from "crypto";
+import * as acp4 from "@agentclientprotocol/sdk";
+
+// src/api/acp/auth.ts
+import {
+  createHash as createHash3,
+  randomBytes,
+  randomUUID as randomUUID2,
+  timingSafeEqual as timingSafeEqual3
+} from "crypto";
+import * as acp3 from "@agentclientprotocol/sdk";
+import { userSchema as userSchema2 } from "@sentry/junior-plugin-api";
+import { z as z7 } from "zod";
+
+// src/api/acp/state.ts
+import { setTimeout as wait } from "timers/promises";
+var MUTATION_LOCK_TTL_MS = 1e4;
+async function withLock(state, key, run, options = {}) {
+  const ttlMs = options.ttlMs ?? MUTATION_LOCK_TTL_MS;
+  const startedAtMs = Date.now();
+  let lock;
+  while (true) {
+    lock = await state.acquireLock(key, ttlMs);
+    if (lock) break;
+    if (Date.now() - startedAtMs >= (options.waitMs ?? 0)) {
+      return { acquired: false };
+    }
+    await wait(options.retryMs ?? 25, void 0, { ref: false });
+  }
+  const heartbeat = options.keepAlive ? setInterval(
+    () => void state.extendLock(lock, ttlMs).catch(() => void 0),
+    Math.floor(ttlMs / 3)
+  ) : void 0;
+  heartbeat?.unref();
+  try {
+    return { acquired: true, value: await run(lock) };
+  } finally {
+    if (heartbeat) clearInterval(heartbeat);
+    await state.releaseLock(lock);
+  }
+}
+async function fenceLock(state, lock, ttlMs = MUTATION_LOCK_TTL_MS) {
+  if (!await state.extendLock(lock, ttlMs)) {
+    throw new Error(
+      `ACP lock ownership was lost before write for ${lock.threadId}`
+    );
+  }
+}
+
+// src/api/acp/transport.ts
+import { createHash as createHash2, randomUUID } from "crypto";
+import * as acp2 from "@agentclientprotocol/sdk";
+import { userSchema } from "@sentry/junior-plugin-api";
+import { z as z6 } from "zod";
+
+// src/api/acp/schema.ts
+import * as acp from "@agentclientprotocol/sdk";
+import { z as z5 } from "zod";
+var ACP_SESSION_ID_PATTERN = /^local:acp:[a-f0-9]{32}$/;
+var metaSchema = z5.record(z5.string(), z5.unknown()).nullable();
+var jsonRpcIdSchema = z5.union([z5.string(), z5.number().finite(), z5.null()]);
+var SESSION_HEADER_METHODS = /* @__PURE__ */ new Set([
+  acp.methods.agent.session.cancel,
+  acp.methods.agent.session.close,
+  acp.methods.agent.session.load,
+  acp.methods.agent.session.prompt,
+  acp.methods.agent.session.resume,
+  acp.methods.agent.session.setConfigOption,
+  acp.methods.agent.session.setMode
+]);
+var acpConnectionIdSchema = z5.string().uuid();
+var acpSessionIdSchema = z5.string().regex(ACP_SESSION_ID_PATTERN);
+var acpCallSchema = z5.object({
+  id: jsonRpcIdSchema.optional(),
+  jsonrpc: z5.literal("2.0"),
+  method: z5.string().min(1),
+  params: z5.unknown().optional()
+}).strict();
+var jsonRpcErrorSchema = z5.object({
+  code: z5.number().int(),
+  data: z5.unknown().optional(),
+  message: z5.string()
+}).strict();
+var acpResponseSchema = z5.union([
+  z5.object({
+    id: jsonRpcIdSchema,
+    jsonrpc: z5.literal("2.0"),
+    result: z5.unknown()
+  }).strict(),
+  z5.object({
+    error: jsonRpcErrorSchema,
+    id: jsonRpcIdSchema,
+    jsonrpc: z5.literal("2.0")
+  }).strict()
+]);
+var acpInboundMessageSchema = z5.union([
+  acpCallSchema,
+  acpResponseSchema
+]);
+var implementationSchema = z5.object({
+  _meta: metaSchema.optional(),
+  name: z5.string().min(1),
+  title: z5.string().nullable().optional(),
+  version: z5.string()
+}).strict();
+var initializeParamsSchema = z5.object({
+  _meta: metaSchema.optional(),
+  clientCapabilities: z5.record(z5.string(), z5.unknown()).optional(),
+  clientInfo: implementationSchema.nullable().optional(),
+  protocolVersion: z5.number().int().min(0).max(65535)
+}).strict();
+var authenticateParamsSchema = z5.object({
+  _meta: metaSchema.optional(),
+  methodId: z5.string().min(1)
+}).strict();
+var newSessionParamsSchema = z5.object({
+  _meta: metaSchema.optional(),
+  additionalDirectories: z5.array(z5.string()).optional(),
+  cwd: z5.string().min(1),
+  mcpServers: z5.array(z5.unknown())
+}).strict();
+var loadSessionParamsSchema = newSessionParamsSchema.extend({
+  sessionId: acpSessionIdSchema
+});
+var annotationsSchema = z5.object({
+  _meta: metaSchema.optional(),
+  audience: z5.array(z5.enum(["assistant", "user"])).nullable().optional(),
+  lastModified: z5.string().nullable().optional(),
+  priority: z5.number().finite().nullable().optional()
+}).strict();
+var textContentBlockSchema = z5.object({
+  _meta: metaSchema.optional(),
+  annotations: annotationsSchema.nullable().optional(),
+  text: z5.string(),
+  type: z5.literal("text")
+}).strict();
+var promptParamsSchema = z5.object({
+  _meta: metaSchema.optional(),
+  prompt: z5.array(textContentBlockSchema),
+  sessionId: acpSessionIdSchema
+}).strict();
+var cancelParamsSchema = z5.object({
+  _meta: metaSchema.optional(),
+  sessionId: acpSessionIdSchema
+}).strict();
+
+// src/api/acp/sleep.ts
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) {
+      reject(signal.reason);
+      return;
+    }
+    const timeoutId = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timeoutId);
+      reject(signal.reason);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+// src/api/acp/transport.ts
+var ACP_STATE_TTL_MS = 24 * 60 * 60 * 1e3;
+var ACP_SSE_LEASE_TTL_MS = 6e4;
+var ACP_SSE_LEASE_RENEW_INTERVAL_MS = 2e4;
+var EVENT_POLL_INTERVAL_MS = 100;
+var LOCK_WAIT_MS = 5e3;
+var MAX_STREAM_ITEMS = 1024;
+var MUTATION_LOCK_OPTIONS = {
+  keepAlive: true,
+  ttlMs: MUTATION_LOCK_TTL_MS,
+  waitMs: LOCK_WAIT_MS
+};
+var SSE_KEEP_ALIVE_MS = 15e3;
+var SSE_MAINTENANCE_INTERVAL_MS = 1e3;
+var jsonRpcIdSchema2 = z6.union([z6.string(), z6.number().finite(), z6.null()]);
+var acpConnectionSchema = z6.object({
+  credentialHash: z6.string().length(64),
+  nonce: z6.string().min(1),
+  user: userSchema.optional()
+}).strict();
+var acpStreamRouteSchema = z6.object({
+  connectionId: z6.string().min(1),
+  sessionId: z6.string().min(1).optional()
+}).strict();
+var acpPromptStreamOutputSchema = z6.object({
+  afterSeq: z6.number().int().nonnegative(),
+  kind: z6.literal("prompt"),
+  messageId: z6.string().min(1),
+  requestId: jsonRpcIdSchema2,
+  turnId: z6.string().min(1)
+}).strict();
+var acpStreamOutputSchema = z6.discriminatedUnion("kind", [
+  z6.object({
+    kind: z6.literal("message"),
+    message: acpInboundMessageSchema
+  }).strict(),
+  z6.object({ kind: z6.literal("replay") }).strict(),
+  acpPromptStreamOutputSchema
+]);
+var storedAcpStreamItemSchema = z6.object({
+  id: z6.string().min(1),
+  output: acpStreamOutputSchema
+}).strict();
+var acpRequestReceiptSchema = z6.object({
+  deliveryKey: z6.string().min(1).optional(),
+  outputs: z6.array(acpStreamOutputSchema),
+  sessionId: z6.string().min(1).optional()
+}).strict();
+var acpStreamCursorSchema = z6.object({ itemId: z6.string().min(1) }).strict();
+function stableHex(value) {
+  return createHash2("sha256").update(value).digest("hex").slice(0, 32);
+}
+function connectionKey(connectionId) {
+  return `junior:acp:v1:connection:${connectionId}`;
+}
+function receiptKey(connectionId, requestKey2) {
+  return `${connectionKey(connectionId)}:request:${requestKey2}`;
+}
+function receiptLockKey(connectionId, requestKey2) {
+  return `${receiptKey(connectionId, requestKey2)}:lock`;
+}
+function connectionLockKey(connectionId) {
+  return `${connectionKey(connectionId)}:lock`;
+}
+function streamKey(route) {
+  const suffix = route.sessionId ? `session:${stableHex(route.sessionId)}` : "connection";
+  return `${connectionKey(route.connectionId)}:stream:${suffix}`;
+}
+function streamListKey(route) {
+  return `${streamKey(route)}:items`;
+}
+function streamCursorKey(route) {
+  return `${streamKey(route)}:cursor`;
+}
+function streamLockKey(route) {
+  return `${streamKey(route)}:subscriber`;
+}
+function streamAppendLockKey(route) {
+  return `${streamKey(route)}:append`;
+}
+function requestStreamItemId(requestKey2, index) {
+  return `acp-item:${stableHex(`${requestKey2}:${index}`)}`;
+}
+function parseStreamItem(value) {
+  return storedAcpStreamItemSchema.parse(value);
+}
+function parseReceipt(value) {
+  return acpRequestReceiptSchema.parse(value);
+}
+async function readStreamItems(state, route) {
+  return (await state.getList(streamListKey(route))).map(parseStreamItem);
+}
+async function readStreamCursor(state, route) {
+  const value = await state.get(streamCursorKey(route));
+  return value === null || value === void 0 ? void 0 : acpStreamCursorSchema.parse(value).itemId;
+}
+async function connectionIsLive(state, connectionId) {
+  return Boolean(await readAcpConnection(state, connectionId));
+}
+async function createAcpConnection(state, credentialHash2) {
+  const connectionId = randomUUID();
+  const connection = acpConnectionSchema.parse({
+    credentialHash: credentialHash2,
+    nonce: randomUUID()
+  });
+  await state.set(connectionKey(connectionId), connection, ACP_STATE_TTL_MS);
+  return { connection, connectionId };
+}
+async function readAcpConnection(state, connectionId) {
+  const value = await state.get(connectionKey(connectionId));
+  return value === null || value === void 0 ? void 0 : acpConnectionSchema.parse(value);
+}
+async function deleteAcpConnection(state, connectionId) {
+  const result = await withLock(
+    state,
+    connectionLockKey(connectionId),
+    async (lock) => {
+      await fenceLock(state, lock, MUTATION_LOCK_TTL_MS);
+      await state.delete(connectionKey(connectionId));
+      await fenceLock(state, lock, MUTATION_LOCK_TTL_MS);
+      await state.delete(streamCursorKey({ connectionId }));
+    },
+    MUTATION_LOCK_OPTIONS
+  );
+  if (!result.acquired) {
+    throw new Error("Timed out acquiring ACP connection control");
+  }
+}
+async function bindAcpConnectionUser(args) {
+  const result = await withLock(
+    args.state,
+    connectionLockKey(args.connectionId),
+    async (lock) => {
+      const connection = await readAcpConnection(args.state, args.connectionId);
+      if (!connection || connection.credentialHash !== args.credentialHash) {
+        return "expired";
+      }
+      if (connection.user && connection.user.id !== args.user.id) {
+        return "conflict";
+      }
+      await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+      await args.state.set(
+        connectionKey(args.connectionId),
+        acpConnectionSchema.parse({ ...connection, user: args.user }),
+        ACP_STATE_TTL_MS
+      );
+      return "completed";
+    },
+    MUTATION_LOCK_OPTIONS
+  );
+  if (!result.acquired) {
+    throw new Error("Timed out acquiring ACP connection control");
+  }
+  return result.value;
+}
+async function prepareStreamAppend(args) {
+  const existing = await readStreamItems(args.state, args.route);
+  const cursor = await readStreamCursor(args.state, args.route);
+  const cursorIndex = cursor ? existing.findIndex((item) => item.id === cursor) : -1;
+  const pending = existing.slice(cursorIndex >= 0 ? cursorIndex + 1 : 0);
+  const presentIds = /* @__PURE__ */ new Set();
+  const pendingIds = /* @__PURE__ */ new Set();
+  for (const id of args.ids) {
+    const matches = (item) => item.id === id || item.id.startsWith(`${id}:delivery:`);
+    if (existing.some(matches)) presentIds.add(id);
+    if (pending.some(matches)) pendingIds.add(id);
+  }
+  const retainedIds = pendingIds.size === 0 ? /* @__PURE__ */ new Set() : presentIds;
+  const missingCount = args.ids.length - retainedIds.size;
+  if (missingCount > MAX_STREAM_ITEMS) throw new AcpStreamFullError();
+  if (missingCount === 0 || existing.length + missingCount <= MAX_STREAM_ITEMS) {
+    return {
+      existingIds: new Set(existing.map((item) => item.id)),
+      retainedIds
+    };
+  }
+  if (existing.length === 0 || cursorIndex !== existing.length - 1) {
+    throw new AcpStreamFullError();
+  }
+  await fenceLock(args.state, args.lock, MUTATION_LOCK_TTL_MS);
+  await args.state.delete(streamListKey(args.route));
+  await args.state.delete(streamCursorKey(args.route));
+  return { existingIds: /* @__PURE__ */ new Set(), retainedIds: /* @__PURE__ */ new Set() };
+}
+async function appendStreamOutputWithLock(args) {
+  const route = acpStreamRouteSchema.parse(args.route);
+  const output = acpStreamOutputSchema.parse(args.output);
+  let id = args.id;
+  for (let delivery = 1; args.existingIds.has(id); delivery += 1) {
+    id = `${args.id}:delivery:${delivery}`;
+  }
+  await fenceLock(args.state, args.lock, MUTATION_LOCK_TTL_MS);
+  if (output.kind !== "message" && !route.sessionId) {
+    throw new Error(`ACP ${output.kind} output requires a session stream`);
+  }
+  await args.state.appendToList(
+    streamListKey(route),
+    { id, output },
+    { ttlMs: ACP_STATE_TTL_MS }
+  );
+  args.existingIds.add(id);
+}
+var AcpStreamFullError = class extends Error {
+  constructor() {
+    super("ACP stream has too much undelivered output");
+    this.name = "AcpStreamFullError";
+  }
+};
+async function streamSessionReplay(args) {
+  const messages = await args.conversations.readMessages(args.sessionId);
+  for (const message of messages) {
+    if (args.signal.aborted) return false;
+    const emitted = await args.emit({
+      jsonrpc: "2.0",
+      method: acp2.methods.client.session.update,
+      params: {
+        sessionId: args.sessionId,
+        update: {
+          sessionUpdate: message.role === "user" ? "user_message_chunk" : "agent_message_chunk",
+          content: { type: "text", text: message.text },
+          messageId: message.id
+        }
+      }
+    });
+    if (!emitted) return false;
+  }
+  return true;
+}
+async function queueReceipt(args) {
+  const receipt = parseReceipt(args.receipt);
+  const deliveryKey = receipt.deliveryKey ?? args.requestKey;
+  const route = { connectionId: args.connectionId };
+  if (receipt.sessionId) route.sessionId = receipt.sessionId;
+  const ids = receipt.outputs.map(
+    (_, index) => requestStreamItemId(deliveryKey, index)
+  );
+  const appendAll = async (lock) => {
+    const prepared = await prepareStreamAppend({
+      ids,
+      lock,
+      route,
+      state: args.state
+    });
+    for (const [index, output] of receipt.outputs.entries()) {
+      const id = ids[index];
+      if (!id || prepared.retainedIds.has(id)) continue;
+      await appendStreamOutputWithLock({
+        existingIds: prepared.existingIds,
+        id,
+        lock,
+        output,
+        route,
+        state: args.state
+      });
+    }
+  };
+  if (args.stream) {
+    if (streamAppendLockKey(args.stream.route) !== streamAppendLockKey(route)) {
+      throw new Error("Reserved ACP output changed streams");
+    }
+    await appendAll(args.stream.lock);
+    return;
+  }
+  const result = await withLock(
+    args.state,
+    streamAppendLockKey(route),
+    appendAll,
+    MUTATION_LOCK_OPTIONS
+  );
+  if (!result.acquired) {
+    throw new Error("Timed out acquiring ACP stream append control");
+  }
+}
+async function completeAcpRequest(args) {
+  try {
+    const result = await withLock(
+      args.state,
+      receiptLockKey(args.connectionId, args.requestKey),
+      async (lock) => {
+        if (!await readAcpConnection(args.state, args.connectionId)) {
+          return "expired";
+        }
+        const receipt = parseReceipt(args.receipt);
+        await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+        await args.state.set(
+          receiptKey(args.connectionId, args.requestKey),
+          receipt,
+          ACP_STATE_TTL_MS
+        );
+        await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+        await queueReceipt({
+          connectionId: args.connectionId,
+          receipt,
+          requestKey: args.requestKey,
+          state: args.state
+        });
+        return "completed";
+      },
+      MUTATION_LOCK_OPTIONS
+    );
+    if (!result.acquired) {
+      throw new Error("Timed out acquiring ACP request completion control");
+    }
+    return result.value;
+  } catch (error) {
+    if (error instanceof AcpStreamFullError) return "full";
+    throw error;
+  }
+}
+async function acceptAcpRequest(args) {
+  try {
+    const result = await withLock(
+      args.state,
+      receiptLockKey(args.connectionId, args.requestKey),
+      async (lock) => {
+        if (!await readAcpConnection(args.state, args.connectionId)) {
+          return "expired";
+        }
+        const stored = await args.state.get(
+          receiptKey(args.connectionId, args.requestKey)
+        );
+        const receipt = stored === null || stored === void 0 ? void 0 : parseReceipt(stored);
+        if (!receipt) {
+          const createAndQueue = async (stream2) => {
+            const created = parseReceipt(await args.createReceipt());
+            await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+            await args.state.set(
+              receiptKey(args.connectionId, args.requestKey),
+              created,
+              ACP_STATE_TTL_MS
+            );
+            await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+            const queue = {
+              connectionId: args.connectionId,
+              receipt: created,
+              requestKey: args.requestKey,
+              state: args.state
+            };
+            if (stream2) queue.stream = stream2;
+            await queueReceipt(queue);
+          };
+          if (!args.reserveRoute) {
+            if (!await readAcpConnection(args.state, args.connectionId)) {
+              return "expired";
+            }
+            await createAndQueue();
+            return "accepted";
+          }
+          const route = acpStreamRouteSchema.parse(args.reserveRoute);
+          const stream = await withLock(
+            args.state,
+            streamAppendLockKey(route),
+            async (streamLock) => {
+              await prepareStreamAppend({
+                ids: [requestStreamItemId(args.requestKey, 0)],
+                lock: streamLock,
+                route,
+                state: args.state
+              });
+              if (!await readAcpConnection(args.state, args.connectionId)) {
+                return "expired";
+              }
+              await createAndQueue({ lock: streamLock, route });
+              return "accepted";
+            },
+            MUTATION_LOCK_OPTIONS
+          );
+          if (!stream.acquired) {
+            throw new Error("Timed out acquiring ACP stream append control");
+          }
+          return stream.value;
+        }
+        await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+        await queueReceipt({
+          connectionId: args.connectionId,
+          receipt,
+          requestKey: args.requestKey,
+          state: args.state
+        });
+        return "accepted";
+      },
+      MUTATION_LOCK_OPTIONS
+    );
+    return result.acquired ? result.value : "busy";
+  } catch (error) {
+    if (error instanceof AcpStreamFullError) return "full";
+    throw error;
+  }
+}
+function resultMessage(requestId, result) {
+  return { jsonrpc: "2.0", id: requestId, result };
+}
+function errorMessage(requestId, error) {
+  return {
+    jsonrpc: "2.0",
+    id: requestId,
+    error: error.toErrorResponse()
+  };
+}
+async function streamPrompt(args) {
+  let cursor = args.output.afterSeq;
+  const sentMessageIds = /* @__PURE__ */ new Set();
+  while (!args.signal.aborted) {
+    if (!await connectionIsLive(args.state, args.connectionId)) return false;
+    const page = await args.conversations.readTurn({
+      afterCursor: cursor,
+      conversationId: args.sessionId,
+      messageId: args.output.messageId,
+      turnId: args.output.turnId
+    });
+    cursor = page.cursor;
+    if (page.messages.length === 0 && !page.terminal) {
+      await sleep(EVENT_POLL_INTERVAL_MS, args.signal);
+      continue;
+    }
+    for (const message of page.messages) {
+      if (sentMessageIds.has(message.id)) continue;
+      sentMessageIds.add(message.id);
+      if (!await args.emit({
+        jsonrpc: "2.0",
+        method: acp2.methods.client.session.update,
+        params: {
+          sessionId: args.sessionId,
+          update: {
+            sessionUpdate: "agent_message_chunk",
+            content: { type: "text", text: message.text },
+            messageId: message.id
+          }
+        }
+      })) {
+        return false;
+      }
+    }
+    if (page.terminal?.status === "completed") {
+      return await args.emit(
+        resultMessage(args.output.requestId, {
+          stopReason: page.terminal.outcome === "cancelled" ? "cancelled" : "end_turn"
+        })
+      );
+    }
+    if (page.terminal?.status === "failed") {
+      return await args.emit(
+        errorMessage(
+          args.output.requestId,
+          acp2.RequestError.internalError(
+            { failureCode: page.terminal.failureCode },
+            "Junior Turn failed"
+          )
+        )
+      );
+    }
+  }
+  return false;
+}
+function serializeSseMessage(message) {
+  return new TextEncoder().encode(`data: ${JSON.stringify(message)}
+
+`);
+}
+function serializeSseKeepAlive() {
+  return new TextEncoder().encode(":\n\n");
+}
+async function openAcpSse(args) {
+  const route = acpStreamRouteSchema.parse(args.route);
+  const lock = await args.state.acquireLock(
+    streamLockKey(route),
+    ACP_SSE_LEASE_TTL_MS
+  );
+  if (!lock) {
+    return new Response("ACP SSE stream already connected", { status: 409 });
+  }
+  return new Response(createSseBody({ ...args, lock, route }), {
+    status: 200,
+    headers: {
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+      "Content-Type": "text/event-stream"
+    }
+  });
+}
+function createSseBody(args) {
+  const abort = new AbortController();
+  let cleaned = false;
+  let heartbeat;
+  let keepAlive;
+  let leaseExpiresAt = args.lock.expiresAt;
+  let nextMaintenanceAtMs = 0;
+  let retainingLease;
+  let closeBody;
+  const correlation = {
+    connectionId: args.route.connectionId
+  };
+  if (args.route.sessionId) correlation.conversationId = args.route.sessionId;
+  if (args.userId) correlation.userId = args.userId;
+  const cleanup = async () => {
+    if (cleaned) return;
+    cleaned = true;
+    abort.abort();
+    closeBody?.();
+    if (keepAlive) clearInterval(keepAlive);
+    if (heartbeat) clearInterval(heartbeat);
+    args.requestSignal.removeEventListener("abort", onRequestAbort);
+    try {
+      await args.state.releaseLock(args.lock);
+    } catch (error) {
+      args.onError?.(error, "acp.sse.lock_cleanup.exception", correlation);
+    }
+  };
+  const onRequestAbort = () => void cleanup();
+  const retainLease = async () => {
+    if (retainingLease) return await retainingLease;
+    retainingLease = (async () => {
+      let extended;
+      try {
+        extended = await args.state.extendLock(args.lock, ACP_SSE_LEASE_TTL_MS);
+      } catch (error) {
+        if (Date.now() < leaseExpiresAt) return;
+        throw new Error("ACP SSE stream lease could not be renewed", {
+          cause: error
+        });
+      }
+      if (!extended) {
+        throw new Error("ACP SSE stream lease expired");
+      }
+      leaseExpiresAt = Date.now() + ACP_SSE_LEASE_TTL_MS;
+    })();
+    try {
+      await retainingLease;
+    } finally {
+      retainingLease = void 0;
+    }
+  };
+  return new ReadableStream({
+    start(controller) {
+      let failureCaptured = false;
+      closeBody = () => {
+        try {
+          controller.close();
+        } catch {
+        }
+      };
+      const fail = (error) => {
+        if (cleaned) return;
+        const failure = error instanceof Error ? error : new Error("ACP SSE stream failed", { cause: error });
+        if (!failureCaptured) {
+          failureCaptured = true;
+          args.onError?.(failure, "acp.sse.exception", correlation);
+        }
+        abort.abort(failure);
+        try {
+          controller.error(failure);
+        } catch {
+        }
+        void cleanup();
+      };
+      args.requestSignal.addEventListener("abort", onRequestAbort, {
+        once: true
+      });
+      if (args.requestSignal.aborted) {
+        void cleanup();
+        return;
+      }
+      keepAlive = setInterval(() => {
+        if (cleaned || (controller.desiredSize ?? 0) <= 0) return;
+        try {
+          controller.enqueue(serializeSseKeepAlive());
+        } catch (error) {
+          fail(error);
+        }
+      }, SSE_KEEP_ALIVE_MS);
+      keepAlive.unref?.();
+      heartbeat = setInterval(() => {
+        if (cleaned) return;
+        void retainLease().catch(fail);
+      }, ACP_SSE_LEASE_RENEW_INTERVAL_MS);
+      heartbeat.unref?.();
+      const emit = async (message) => {
+        while (!abort.signal.aborted && (controller.desiredSize ?? 0) <= 0) {
+          await sleep(EVENT_POLL_INTERVAL_MS, abort.signal);
+        }
+        if (abort.signal.aborted || !await connectionIsLive(args.state, args.route.connectionId)) {
+          abort.abort();
+          return false;
+        }
+        await retainLease();
+        controller.enqueue(serializeSseMessage(message));
+        return true;
+      };
+      const pump = async () => {
+        let cursor = await readStreamCursor(args.state, args.route);
+        while (!abort.signal.aborted) {
+          if (!await connectionIsLive(args.state, args.route.connectionId)) {
+            return;
+          }
+          if (args.maintain && Date.now() >= nextMaintenanceAtMs) {
+            nextMaintenanceAtMs = Date.now() + SSE_MAINTENANCE_INTERVAL_MS;
+            await args.maintain();
+          }
+          const items = await readStreamItems(args.state, args.route);
+          const cursorIndex = cursor ? items.findIndex((item) => item.id === cursor) : -1;
+          const pending = items.slice(cursorIndex >= 0 ? cursorIndex + 1 : 0);
+          if (pending.length === 0) {
+            await sleep(EVENT_POLL_INTERVAL_MS, abort.signal);
+            continue;
+          }
+          for (const item of pending) {
+            if (abort.signal.aborted) return;
+            await retainLease();
+            await args.state.set(
+              streamCursorKey(args.route),
+              acpStreamCursorSchema.parse({ itemId: item.id }),
+              ACP_STATE_TTL_MS
+            );
+            cursor = item.id;
+            let delivered;
+            if (item.output.kind === "message") {
+              delivered = await emit(item.output.message);
+            } else {
+              const sessionId = args.route.sessionId;
+              if (!sessionId) {
+                throw new Error(
+                  `ACP ${item.output.kind} output requires a session stream`
+                );
+              }
+              delivered = item.output.kind === "replay" ? await streamSessionReplay({
+                conversations: args.conversations,
+                emit,
+                sessionId,
+                signal: abort.signal
+              }) : await streamPrompt({
+                conversations: args.conversations,
+                connectionId: args.route.connectionId,
+                emit,
+                output: item.output,
+                sessionId,
+                signal: abort.signal,
+                state: args.state
+              });
+            }
+            if (!delivered || abort.signal.aborted) return;
+          }
+        }
+      };
+      void pump().catch((error) => {
+        if (!cleaned && !args.requestSignal.aborted) fail(error);
+      }).finally(cleanup);
+    },
+    async cancel() {
+      await cleanup();
+    }
+  });
+}
+
+// src/api/acp/auth.ts
+var ACP_AUTHORIZATION_TTL_MS = 10 * 60 * 1e3;
+var ACP_CONNECTION_COOKIE = "junior_acp_connection";
+var LOCK_WAIT_MS2 = 5e3;
+var jsonRpcIdSchema3 = z7.union([z7.string(), z7.number().finite(), z7.null()]);
+var acpAuthorizationSchema = z7.object({
+  connectionId: z7.string().uuid(),
+  credentialHash: z7.string().length(64),
+  elicitationId: z7.string().uuid(),
+  expiresAtMs: z7.number().int().positive(),
+  requestId: jsonRpcIdSchema3,
+  requestKey: z7.string().min(1),
+  userCodeHash: z7.string().length(64)
+}).strict();
+var acpAuthorizationPointerSchema = z7.object({
+  expiresAtMs: z7.number().int().positive(),
+  transactionId: z7.string().uuid()
+}).strict();
+var ACP_AUTH_METHOD_ID = "junior";
+var ACP_AUTH_METHOD = {
+  id: ACP_AUTH_METHOD_ID,
+  name: "Sign in to Junior",
+  description: "Sign in with the Google account allowed by this Junior app."
+};
+function authorizationKey(transactionId) {
+  return `junior:acp:v1:authorization:${transactionId}`;
+}
+function authorizationLockKey(transactionId) {
+  return `${authorizationKey(transactionId)}:lock`;
+}
+function authorizationPointerKey(connectionId) {
+  return `junior:acp:v1:connection:${connectionId}:authorization`;
+}
+function authorizationPointerLockKey(connectionId) {
+  return `${authorizationPointerKey(connectionId)}:lock`;
+}
+function credentialHash(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+function createUserCode() {
+  const value = randomBytes(6).toString("hex").toUpperCase();
+  return `${value.slice(0, 4)}-${value.slice(4, 8)}-${value.slice(8, 12)}`;
+}
+function userCodeHash(value) {
+  return credentialHash(value.trim().replaceAll("-", "").toUpperCase());
+}
+function userCodeMatches(value, expectedHash) {
+  const actual = Buffer.from(userCodeHash(value), "hex");
+  const expected = Buffer.from(expectedHash, "hex");
+  return actual.length === expected.length && timingSafeEqual3(actual, expected);
+}
+function cookieValue(request) {
+  const header = request.headers.get("cookie");
+  if (!header) return void 0;
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator <= 0) continue;
+    if (part.slice(0, separator).trim() !== ACP_CONNECTION_COOKIE) continue;
+    const value = part.slice(separator + 1).trim();
+    if (value) return value;
+  }
+  return void 0;
+}
+function cookieAttributes(request) {
+  return [
+    "Path=/api/acp",
+    "HttpOnly",
+    "SameSite=Strict",
+    ...new URL(request.url).protocol === "https:" ? ["Secure"] : []
+  ].join("; ");
+}
+function createAcpConnectionCredential(request) {
+  const credential = randomBytes(32).toString("base64url");
+  return {
+    cookie: `${ACP_CONNECTION_COOKIE}=${credential}; ${cookieAttributes(request)}; Max-Age=86400`,
+    credentialHash: credentialHash(credential)
+  };
+}
+function hasAcpConnectionCredential(request, expectedHash) {
+  const credential = cookieValue(request);
+  if (!credential) return false;
+  const actual = Buffer.from(credentialHash(credential), "hex");
+  const expected = Buffer.from(expectedHash, "hex");
+  return actual.length === expected.length && timingSafeEqual3(actual, expected);
+}
+function authorizationBaseURL(request, configured) {
+  const value = configured?.trim();
+  let origin;
+  if (value) {
+    origin = /^https?:\/\//.test(value) ? value : `https://${value}`;
+  } else {
+    const requestURL = new URL(request.url);
+    const hostname = requestURL.hostname.replace(/^\[|\]$/g, "");
+    if (!["localhost", "127.0.0.1", "::1"].includes(hostname)) {
+      throw acp3.RequestError.internalError(
+        void 0,
+        "Junior ACP sign-in requires a configured public base URL"
+      );
+    }
+    origin = requestURL.origin;
+  }
+  const url = new URL(origin);
+  url.pathname = "/";
+  url.search = "";
+  url.hash = "";
+  return url;
+}
+async function readAuthorization(state, transactionId) {
+  const value = await state.get(authorizationKey(transactionId));
+  return value === null || value === void 0 ? void 0 : acpAuthorizationSchema.parse(value);
+}
+async function readAuthorizationPointer(state, connectionId) {
+  const value = await state.get(authorizationPointerKey(connectionId));
+  return value === null || value === void 0 ? void 0 : acpAuthorizationPointerSchema.parse(value);
+}
+async function deleteAuthorizationPointer(state, connectionId, transactionId) {
+  const result = await withLock(
+    state,
+    authorizationPointerLockKey(connectionId),
+    async (lock) => {
+      const pointer = await readAuthorizationPointer(state, connectionId);
+      if (pointer?.transactionId !== transactionId) return;
+      await fenceLock(state, lock, MUTATION_LOCK_TTL_MS);
+      await state.delete(authorizationPointerKey(connectionId));
+    },
+    {
+      keepAlive: true,
+      ttlMs: MUTATION_LOCK_TTL_MS,
+      waitMs: LOCK_WAIT_MS2
+    }
+  );
+  if (!result.acquired) {
+    throw new Error("Timed out acquiring ACP authorization pointer control");
+  }
+}
+async function deleteAuthorization(state, authorization, transactionId) {
+  await deleteAuthorizationPointer(
+    state,
+    authorization.connectionId,
+    transactionId
+  );
+  await state.delete(authorizationKey(transactionId));
+}
+function completionReceipt(authorization, response) {
+  return {
+    deliveryKey: `${authorization.requestKey}:authorization-complete`,
+    outputs: [
+      {
+        kind: "message",
+        message: {
+          jsonrpc: "2.0",
+          method: acp3.methods.client.elicitation.complete,
+          params: { elicitationId: authorization.elicitationId }
+        }
+      },
+      { kind: "message", message: response }
+    ]
+  };
+}
+function resultMessage2(requestId) {
+  return { jsonrpc: "2.0", id: requestId, result: {} };
+}
+function cancelledMessage(requestId, message = "Junior sign-in was cancelled") {
+  return {
+    jsonrpc: "2.0",
+    id: requestId,
+    error: acp3.RequestError.requestCancelled(
+      void 0,
+      message
+    ).toErrorResponse()
+  };
+}
+async function beginAcpAuthorization(args) {
+  const url = authorizationBaseURL(args.request, args.baseURL);
+  const result = await withLock(
+    args.state,
+    authorizationPointerLockKey(args.connectionId),
+    async (lock) => {
+      const pointer = await readAuthorizationPointer(
+        args.state,
+        args.connectionId
+      );
+      if (pointer) {
+        const pending = await readAuthorization(
+          args.state,
+          pointer.transactionId
+        );
+        if (pending?.connectionId === args.connectionId) {
+          throw acp3.RequestError.invalidRequest(
+            void 0,
+            "Junior sign-in is already in progress"
+          );
+        }
+        await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+        await args.state.delete(authorizationPointerKey(args.connectionId));
+      }
+      const transactionId2 = randomUUID2();
+      const userCode2 = createUserCode();
+      const authorization = acpAuthorizationSchema.parse({
+        connectionId: args.connectionId,
+        credentialHash: args.credentialHash,
+        elicitationId: transactionId2,
+        expiresAtMs: Date.now() + ACP_AUTHORIZATION_TTL_MS,
+        requestId: args.requestId,
+        requestKey: args.requestKey,
+        userCodeHash: userCodeHash(userCode2)
+      });
+      await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+      await args.state.set(
+        authorizationKey(transactionId2),
+        authorization,
+        ACP_STATE_TTL_MS
+      );
+      await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+      await args.state.set(
+        authorizationPointerKey(args.connectionId),
+        { expiresAtMs: authorization.expiresAtMs, transactionId: transactionId2 },
+        ACP_STATE_TTL_MS
+      );
+      return { transactionId: transactionId2, userCode: userCode2 };
+    },
+    {
+      keepAlive: true,
+      ttlMs: MUTATION_LOCK_TTL_MS,
+      waitMs: LOCK_WAIT_MS2
+    }
+  );
+  if (!result.acquired) {
+    throw new Error("Timed out acquiring ACP authorization pointer control");
+  }
+  const { transactionId, userCode } = result.value;
+  url.pathname = `/_junior/acp/auth/${transactionId}`;
+  const params = {
+    mode: "url",
+    message: `Sign in to Junior in your browser. Enter verification code ${userCode}.`,
+    elicitationId: transactionId,
+    requestId: args.requestId,
+    url: url.toString()
+  };
+  return {
+    deliveryKey: `${args.requestKey}:authorization-start`,
+    outputs: [
+      {
+        kind: "message",
+        message: {
+          jsonrpc: "2.0",
+          id: transactionId,
+          method: acp3.methods.client.elicitation.create,
+          params
+        }
+      }
+    ]
+  };
+}
+async function finishAuthorization(args) {
+  const result = await completeAcpRequest({
+    connectionId: args.authorization.connectionId,
+    receipt: completionReceipt(args.authorization, args.response),
+    requestKey: args.authorization.requestKey,
+    state: args.state
+  });
+  return result === "full" ? "busy" : result;
+}
+async function completeAcpAuthorization(args) {
+  const result = await withLock(
+    args.state,
+    authorizationLockKey(args.transactionId),
+    async (lock) => {
+      const authorization = await readAuthorization(
+        args.state,
+        args.transactionId
+      );
+      if (!authorization) {
+        return "expired";
+      }
+      if (authorization.expiresAtMs <= Date.now()) {
+        const completion2 = await finishAuthorization({
+          authorization,
+          response: cancelledMessage(
+            authorization.requestId,
+            "Junior sign-in request expired"
+          ),
+          state: args.state
+        });
+        if (completion2 === "busy") return completion2;
+        await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+        await deleteAuthorization(
+          args.state,
+          authorization,
+          args.transactionId
+        );
+        return "expired";
+      }
+      if (!userCodeMatches(args.userCode, authorization.userCodeHash)) {
+        return "invalid";
+      }
+      const binding = await bindAcpConnectionUser({
+        connectionId: authorization.connectionId,
+        credentialHash: authorization.credentialHash,
+        state: args.state,
+        user: userSchema2.parse(args.user)
+      });
+      if (binding !== "completed") {
+        const completion2 = await finishAuthorization({
+          authorization,
+          response: cancelledMessage(
+            authorization.requestId,
+            "Junior sign-in could not bind this connection"
+          ),
+          state: args.state
+        });
+        if (completion2 !== "completed") return completion2;
+        await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+        await deleteAuthorization(
+          args.state,
+          authorization,
+          args.transactionId
+        );
+        return binding;
+      }
+      const completion = await finishAuthorization({
+        authorization,
+        response: resultMessage2(authorization.requestId),
+        state: args.state
+      });
+      if (completion !== "completed") return completion;
+      await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+      await deleteAuthorization(args.state, authorization, args.transactionId);
+      return "completed";
+    },
+    {
+      keepAlive: true,
+      ttlMs: MUTATION_LOCK_TTL_MS,
+      waitMs: LOCK_WAIT_MS2
+    }
+  );
+  if (!result.acquired) {
+    throw new Error("Timed out acquiring ACP authorization control");
+  }
+  return result.value;
+}
+async function handleAcpAuthorizationResponse(args) {
+  if (typeof args.response.id !== "string") return "ignored";
+  const parsedId = z7.string().uuid().safeParse(args.response.id);
+  if (!parsedId.success) return "ignored";
+  const authorization = await readAuthorization(args.state, parsedId.data);
+  if (!authorization || authorization.connectionId !== args.connectionId) {
+    return "ignored";
+  }
+  const action = "result" in args.response && typeof args.response.result === "object" && args.response.result !== null && "action" in args.response.result && typeof args.response.result.action === "string" ? args.response.result.action : void 0;
+  if (action === "accept") return "accepted";
+  const result = await withLock(
+    args.state,
+    authorizationLockKey(parsedId.data),
+    async (lock) => {
+      const current = await readAuthorization(args.state, parsedId.data);
+      if (!current || current.connectionId !== args.connectionId) return false;
+      const completion = await finishAuthorization({
+        authorization: current,
+        response: cancelledMessage(current.requestId),
+        state: args.state
+      });
+      if (completion === "busy") return false;
+      await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+      await deleteAuthorization(args.state, current, parsedId.data);
+      return true;
+    },
+    {
+      keepAlive: true,
+      ttlMs: MUTATION_LOCK_TTL_MS,
+      waitMs: LOCK_WAIT_MS2
+    }
+  );
+  if (!result.acquired) {
+    throw new Error("Timed out acquiring ACP authorization control");
+  }
+  return result.value ? "cancelled" : "ignored";
+}
+async function expireAcpAuthorization(args) {
+  const pointer = await readAuthorizationPointer(args.state, args.connectionId);
+  if (!pointer || pointer.expiresAtMs > Date.now()) return false;
+  const result = await withLock(
+    args.state,
+    authorizationLockKey(pointer.transactionId),
+    async (lock) => {
+      const authorization = await readAuthorization(
+        args.state,
+        pointer.transactionId
+      );
+      if (!authorization || authorization.connectionId !== args.connectionId) {
+        await deleteAuthorizationPointer(
+          args.state,
+          args.connectionId,
+          pointer.transactionId
+        );
+        return false;
+      }
+      if (authorization.expiresAtMs > Date.now()) return false;
+      const completion = await finishAuthorization({
+        authorization,
+        response: cancelledMessage(
+          authorization.requestId,
+          "Junior sign-in request expired"
+        ),
+        state: args.state
+      });
+      if (completion === "busy") return false;
+      await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
+      await deleteAuthorization(
+        args.state,
+        authorization,
+        pointer.transactionId
+      );
+      return true;
+    },
+    {
+      keepAlive: true,
+      ttlMs: MUTATION_LOCK_TTL_MS,
+      waitMs: LOCK_WAIT_MS2
+    }
+  );
+  if (!result.acquired) return false;
+  return result.value;
+}
+
+// src/api/acp/route.ts
+var ACP_CONNECTION_ID_HEADER = "Acp-Connection-Id";
+var ACP_SESSION_ID_HEADER = "Acp-Session-Id";
+var ACP_CONVERSATION_PREFIX = "local:acp:";
+var ACP_EVENT_STREAM_MIME_TYPE = "text/event-stream";
+var ACP_JSON_MIME_TYPE = "application/json";
+var MAX_PROMPT_TEXT_LENGTH = 32e3;
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function authenticatedAcpUser(connection) {
+  return connection.user;
+}
+function supportsUrlElicitation(params) {
+  const parsed = initializeParamsSchema.safeParse(params);
+  if (!parsed.success) return false;
+  const elicitation = parsed.data.clientCapabilities?.elicitation;
+  return isRecord2(elicitation) && isRecord2(elicitation.url);
+}
+function parseParams(schema, params) {
+  const parsed = schema.safeParse(params);
+  if (parsed.success) return parsed.data;
+  const firstPath = parsed.error.issues[0]?.path[0];
+  throw acp4.RequestError.invalidParams({
+    field: typeof firstPath === "string" || typeof firstPath === "number" ? String(firstPath) : "params"
+  });
+}
+function rejectUnsupportedMcpServers(mcpServers) {
+  if (mcpServers.length > 0) {
+    throw acp4.RequestError.invalidParams(
+      { field: "mcpServers" },
+      "Junior does not accept client MCP servers"
+    );
+  }
+}
+function promptText(prompt) {
+  if (prompt.length === 0) {
+    throw acp4.RequestError.invalidParams(
+      { field: "prompt" },
+      "Junior accepts one or more text blocks only"
+    );
+  }
+  const blocks = [];
+  for (const block of prompt) {
+    if (!block.text.trim()) {
+      throw acp4.RequestError.invalidParams(
+        { field: "prompt" },
+        "Junior accepts non-empty text blocks only"
+      );
+    }
+    blocks.push(block.text);
+  }
+  const text = blocks.join("\n");
+  if (text.length > MAX_PROMPT_TEXT_LENGTH) {
+    throw acp4.RequestError.invalidParams(
+      { field: "prompt" },
+      `Junior accepts at most ${MAX_PROMPT_TEXT_LENGTH} prompt characters`
+    );
+  }
+  return text;
+}
+function stableHex2(value, length = 32) {
+  return createHash4("sha256").update(value).digest("hex").slice(0, length);
+}
+function canonicalJson(value) {
+  if (Array.isArray(value)) return value.map(canonicalJson);
+  if (!isRecord2(value)) return value;
+  return Object.fromEntries(
+    Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, child]) => [key, canonicalJson(child)])
+  );
+}
+function requestKey(call) {
+  const id = call.id === null ? "null" : `${typeof call.id}:${stableHex2(String(call.id))}`;
+  const payload = JSON.stringify(
+    canonicalJson({ method: call.method, params: call.params ?? null })
+  );
+  return `${id}:${stableHex2(payload)}`;
+}
+function sessionIdFromCall(call) {
+  if (!call) return void 0;
+  const schema = call.method === acp4.methods.agent.session.load ? loadSessionParamsSchema : call.method === acp4.methods.agent.session.prompt ? promptParamsSchema : call.method === acp4.methods.agent.session.cancel ? cancelParamsSchema : void 0;
+  if (!schema) return void 0;
+  const parsed = schema.safeParse(call.params);
+  return parsed.success ? parsed.data.sessionId : void 0;
+}
+function determineRoute(connectionId, call, headerSessionId) {
+  const paramsSessionId = sessionIdFromCall(call);
+  if (SESSION_HEADER_METHODS.has(call.method) && !headerSessionId) {
+    return textResponse("Missing Acp-Session-Id", 400);
+  }
+  if (headerSessionId !== void 0 && paramsSessionId !== void 0 && headerSessionId !== paramsSessionId) {
+    return textResponse("Mismatched Acp-Session-Id", 400);
+  }
+  return {
+    connectionId,
+    ...headerSessionId ? { sessionId: headerSessionId } : paramsSessionId ? { sessionId: paramsSessionId } : {}
+  };
+}
+function resultMessage3(requestId, result) {
+  return { jsonrpc: "2.0", id: requestId, result };
+}
+function errorMessage2(requestId, error) {
+  return {
+    jsonrpc: "2.0",
+    id: requestId,
+    error: error.toErrorResponse()
+  };
+}
+function textResponse(body, status) {
+  return new Response(body, {
+    status,
+    headers: { "Content-Type": "text/plain" }
+  });
+}
+function jsonResponse(value, status, headers) {
+  return new Response(JSON.stringify(value), {
+    status,
+    headers: { "Content-Type": ACP_JSON_MIME_TYPE, ...headers }
+  });
+}
+function emptyResponse(status) {
+  return new Response(null, { status });
+}
+async function createSession(args) {
+  const params = parseParams(
+    newSessionParamsSchema,
+    args.call.params
+  );
+  rejectUnsupportedMcpServers(params.mcpServers);
+  const sessionId = `${ACP_CONVERSATION_PREFIX}${stableHex2(
+    `${args.connection.nonce}:${args.requestKey}`
+  )}`;
+  await args.conversations.create({
+    conversationId: sessionId,
+    user: args.user
+  });
+  return sessionId;
+}
+async function acceptPrompt(args) {
+  const params = parseParams(
+    promptParamsSchema,
+    args.call.params
+  );
+  const admission = await args.conversations.prompt({
+    conversationId: params.sessionId,
+    idempotencyKey: `${args.connection.nonce}:${args.requestKey}`,
+    text: promptText(params.prompt),
+    user: args.user
+  });
+  if (admission.status === "not_found") {
+    throw acp4.RequestError.resourceNotFound(params.sessionId);
+  }
+  if (admission.status === "active") {
+    throw acp4.RequestError.invalidParams(
+      { field: "sessionId" },
+      "This ACP session already has an active prompt"
+    );
+  }
+  return {
+    output: {
+      afterSeq: admission.afterCursor,
+      kind: "prompt",
+      messageId: admission.messageId,
+      requestId: args.requestId,
+      turnId: admission.turnId
+    },
+    sessionId: params.sessionId
+  };
+}
+async function createRequestReceipt(args) {
+  if (args.call.method === acp4.methods.agent.session.new) {
+    const sessionId = await createSession(args);
+    return {
+      outputs: [
+        {
+          kind: "message",
+          message: resultMessage3(args.call.id, { sessionId })
+        }
+      ]
+    };
+  }
+  if (args.call.method === acp4.methods.agent.session.load) {
+    const params = parseParams(
+      loadSessionParamsSchema,
+      args.call.params
+    );
+    rejectUnsupportedMcpServers(params.mcpServers);
+    if (!await args.conversations.hasAccess({
+      conversationId: params.sessionId,
+      user: args.user
+    })) {
+      throw acp4.RequestError.resourceNotFound(params.sessionId);
+    }
+    return {
+      sessionId: params.sessionId,
+      outputs: [
+        { kind: "replay" },
+        { kind: "message", message: resultMessage3(args.call.id, {}) }
+      ]
+    };
+  }
+  if (args.call.method === acp4.methods.agent.session.prompt) {
+    const prompt = await acceptPrompt({
+      ...args,
+      requestId: args.call.id
+    });
+    return {
+      outputs: [prompt.output],
+      sessionId: prompt.sessionId
+    };
+  }
+  throw acp4.RequestError.methodNotFound(args.call.method);
+}
+async function handleCancelNotification(args) {
+  const params = parseParams(
+    cancelParamsSchema,
+    args.call.params
+  );
+  const result = await args.conversations.cancel({
+    conversationId: params.sessionId,
+    user: args.user
+  });
+  if (result === "not_found") {
+    throw acp4.RequestError.resourceNotFound(params.sessionId);
+  }
+}
+async function requireConnection(args) {
+  const value = await readAcpConnection(args.state, args.connectionId);
+  if (!value || !hasAcpConnectionCredential(args.request, value.credentialHash)) {
+    return void 0;
+  }
+  return value;
+}
+function isJsonContentType(contentType) {
+  return contentType?.split(";", 1)[0]?.trim().toLowerCase() === ACP_JSON_MIME_TYPE;
+}
+async function handleInitialize(args) {
+  const requestId = args.call.id;
+  if (requestId === void 0) {
+    return textResponse("Initialize request must include an ID", 400);
+  }
+  try {
+    parseParams(initializeParamsSchema, args.call.params);
+    if (!supportsUrlElicitation(args.call.params)) {
+      throw acp4.RequestError.invalidParams(
+        { field: "clientCapabilities.elicitation.url" },
+        "Remote Junior authentication requires URL elicitation support"
+      );
+    }
+    const credential = createAcpConnectionCredential(args.request);
+    const result = {
+      protocolVersion: acp4.PROTOCOL_VERSION,
+      agentCapabilities: {
+        loadSession: true,
+        promptCapabilities: {
+          image: false,
+          audio: false,
+          embeddedContext: false
+        }
+      },
+      authMethods: args.browserAuthAvailable ? [ACP_AUTH_METHOD] : [],
+      agentInfo: { name: "junior", version: args.version }
+    };
+    const connection = await createAcpConnection(
+      args.state,
+      credential.credentialHash
+    );
+    return jsonResponse(resultMessage3(requestId, result), 200, {
+      [ACP_CONNECTION_ID_HEADER]: connection.connectionId,
+      "Set-Cookie": credential.cookie
+    });
+  } catch (error) {
+    if (!(error instanceof acp4.RequestError)) throw error;
+    return jsonResponse(errorMessage2(requestId, error), 200);
+  }
+}
+async function handleConnectedPost(args) {
+  const requestId = args.call.id;
+  if (requestId === void 0) {
+    if (args.authenticated && args.call.method === acp4.methods.agent.session.cancel) {
+      try {
+        await handleCancelNotification({
+          call: args.call,
+          conversations: args.options.conversations,
+          user: args.authenticated
+        });
+      } catch (error) {
+        if (!(error instanceof acp4.RequestError)) throw error;
+      }
+    }
+    return emptyResponse(202);
+  }
+  const identifiedCall = { ...args.call, id: requestId };
+  const identifiedRequestKey = requestKey(identifiedCall);
+  const acceptance = {
+    connectionId: args.connectionId,
+    requestKey: identifiedRequestKey,
+    state: args.state,
+    createReceipt: async () => {
+      try {
+        if (identifiedCall.method === acp4.methods.agent.authenticate) {
+          const params = parseParams(
+            authenticateParamsSchema,
+            identifiedCall.params
+          );
+          if (params.methodId !== ACP_AUTH_METHOD_ID) {
+            throw acp4.RequestError.invalidParams(
+              { field: "methodId" },
+              "Junior did not advertise this authentication method"
+            );
+          }
+          if (args.authenticated) {
+            return {
+              outputs: [
+                {
+                  kind: "message",
+                  message: resultMessage3(requestId, {})
+                }
+              ]
+            };
+          }
+          if (!args.options.browserAuth) {
+            throw acp4.RequestError.internalError(
+              void 0,
+              "Junior ACP authentication requires an enabled dashboard"
+            );
+          }
+          return await beginAcpAuthorization({
+            baseURL: args.options.browserAuth.baseURL,
+            connectionId: args.connectionId,
+            credentialHash: args.connection.credentialHash,
+            request: args.request,
+            requestId,
+            requestKey: identifiedRequestKey,
+            state: args.state
+          });
+        }
+        if (!args.authenticated) {
+          throw acp4.RequestError.authRequired();
+        }
+        return await createRequestReceipt({
+          call: identifiedCall,
+          connection: args.connection,
+          conversations: args.options.conversations,
+          requestKey: identifiedRequestKey,
+          user: args.authenticated
+        });
+      } catch (error) {
+        if (!(error instanceof acp4.RequestError)) throw error;
+        const receipt = {
+          outputs: [
+            {
+              kind: "message",
+              message: errorMessage2(requestId, error)
+            }
+          ]
+        };
+        if (args.route.sessionId) receipt.sessionId = args.route.sessionId;
+        return receipt;
+      }
+    }
+  };
+  if (identifiedCall.method === acp4.methods.agent.session.prompt) {
+    acceptance.reserveRoute = args.route;
+  }
+  const status = await acceptAcpRequest(acceptance);
+  if (status === "busy") {
+    return textResponse("ACP request is already being accepted", 503);
+  }
+  if (status === "expired") {
+    return textResponse("Unknown Acp-Connection-Id", 404);
+  }
+  if (status === "full") {
+    return textResponse("ACP stream has too much undelivered output", 503);
+  }
+  return emptyResponse(202);
+}
+async function handleConnectedResponse(args) {
+  await handleAcpAuthorizationResponse({
+    connectionId: args.connectionId,
+    response: args.response,
+    state: args.state
+  });
+  return emptyResponse(202);
+}
+function createAcpHttpHandler(options) {
+  const state = options.state;
+  return async (request) => {
+    let authenticated;
+    let call;
+    let connectionId;
+    let sessionId;
+    try {
+      if (request.headers.has("Authorization")) {
+        return new Response("Unauthorized", { status: 401 });
+      }
+      const connectionHeader = request.headers.get(ACP_CONNECTION_ID_HEADER);
+      if (connectionHeader !== null) {
+        const parsed = acpConnectionIdSchema.safeParse(connectionHeader);
+        if (!parsed.success) {
+          return textResponse("Invalid Acp-Connection-Id", 400);
+        }
+        connectionId = parsed.data;
+      }
+      const sessionHeader = request.headers.get(ACP_SESSION_ID_HEADER);
+      if (sessionHeader !== null) {
+        const parsed = acpSessionIdSchema.safeParse(sessionHeader);
+        if (!parsed.success) {
+          return textResponse("Invalid Acp-Session-Id", 400);
+        }
+        sessionId = parsed.data;
+      }
+      if (request.method === "POST") {
+        if (!isJsonContentType(request.headers.get("Content-Type"))) {
+          return textResponse("Unsupported Media Type", 415);
+        }
+        let value;
+        try {
+          value = await request.json();
+        } catch {
+          return textResponse("Invalid JSON", 400);
+        }
+        if (Array.isArray(value)) {
+          return textResponse(
+            "Batch JSON-RPC requests are not implemented",
+            501
+          );
+        }
+        const parsedMessage = acpInboundMessageSchema.safeParse(value);
+        if (!parsedMessage.success) {
+          return textResponse("Invalid JSON-RPC message", 400);
+        }
+        const message = parsedMessage.data;
+        if ("method" in message && message.method === acp4.methods.agent.initialize) {
+          call = message;
+          if (connectionId) {
+            return textResponse(
+              "Initialize not allowed on existing connection",
+              400
+            );
+          }
+          return await handleInitialize({
+            browserAuthAvailable: options.browserAuth !== void 0,
+            call,
+            request,
+            state,
+            version: options.version
+          });
+        }
+        if (!connectionId) {
+          return textResponse("Missing Acp-Connection-Id", 400);
+        }
+        const connection2 = await requireConnection({
+          connectionId,
+          request,
+          state
+        });
+        if (!connection2) {
+          return textResponse("Unauthorized", 401);
+        }
+        authenticated = authenticatedAcpUser(connection2);
+        if (!("method" in message)) {
+          return await handleConnectedResponse({
+            connectionId,
+            response: message,
+            state
+          });
+        }
+        call = message;
+        const route = determineRoute(connectionId, call, sessionId);
+        if (route instanceof Response) return route;
+        return await handleConnectedPost({
+          authenticated,
+          call,
+          connection: connection2,
+          connectionId,
+          options,
+          request,
+          route,
+          state
+        });
+      }
+      if (!connectionId) {
+        return textResponse("Missing Acp-Connection-Id", 400);
+      }
+      const connection = await requireConnection({
+        connectionId,
+        request,
+        state
+      });
+      if (!connection) {
+        return textResponse("Unauthorized", 401);
+      }
+      authenticated = authenticatedAcpUser(connection);
+      if (request.method === "GET") {
+        if (request.headers.get("Upgrade")?.toLowerCase() === "websocket") {
+          return textResponse("WebSocket upgrade is not implemented", 426);
+        }
+        const accept = request.headers.get("Accept")?.toLowerCase();
+        if (!accept?.includes(ACP_EVENT_STREAM_MIME_TYPE)) {
+          return textResponse("Not Acceptable", 406);
+        }
+        const route = { connectionId };
+        if (sessionId) route.sessionId = sessionId;
+        const stream = {
+          conversations: options.conversations,
+          onError: options.onError,
+          requestSignal: request.signal,
+          route,
+          state
+        };
+        if (!sessionId) {
+          stream.maintain = async () => {
+            await expireAcpAuthorization({
+              connectionId: route.connectionId,
+              state
+            });
+          };
+        }
+        if (authenticated) stream.userId = authenticated.id;
+        return await openAcpSse(stream);
+      }
+      if (request.method === "DELETE") {
+        await deleteAcpConnection(state, connectionId);
+        return emptyResponse(202);
+      }
+      return textResponse("Method Not Allowed", 405);
+    } catch (error) {
+      const conversationId = sessionIdFromCall(call) ?? sessionId;
+      const context = {};
+      if (authenticated) context.userId = authenticated.id;
+      if (connectionId) context.connectionId = connectionId;
+      if (conversationId) context.conversationId = conversationId;
+      options.onError?.(error, "acp.transport.exception", context);
+      return textResponse("ACP transport failed", 500);
+    }
+  };
+}
+
+// src/api/acp/authorization-page.ts
+var ACP_AUTHORIZATION_PATH = "/_junior/acp/auth/:transactionId";
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#039;");
+}
+function renderResult(agentName, result) {
+  const content = {
+    blocked: {
+      status: 403,
+      title: "Request blocked",
+      message: "Open the sign-in link again and confirm the connection."
+    },
+    busy: {
+      status: 503,
+      title: "Your ACP client has pending output",
+      message: "Reconnect the client, then confirm this connection again."
+    },
+    completed: {
+      status: 200,
+      title: `${agentName} is connected`,
+      message: "You can close this window and return to your ACP client."
+    },
+    conflict: {
+      status: 409,
+      title: "This connection uses another account",
+      message: "Start a new connection in your ACP client and sign in again."
+    },
+    expired: {
+      status: 410,
+      title: "This sign-in request expired",
+      message: "Return to your ACP client and start sign-in again."
+    },
+    invalid: {
+      status: 403,
+      title: "Verification code did not match",
+      message: "Return to your ACP client and enter the code shown there."
+    }
+  }[result];
+  return new Response(
+    `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${escapeHtml(content.title)}</title>
+</head>
+<body style="margin:0;background:#000;color:#fff;font-family:ui-sans-serif,system-ui,sans-serif">
+  <main style="min-height:100vh;display:grid;place-items:center;padding:2rem">
+    <section style="max-width:32rem;border-left:4px solid #a78bfa;padding-left:1rem">
+      <h1 style="margin:0 0 .75rem;font-size:2rem">${escapeHtml(content.title)}</h1>
+      <p style="margin:0;color:#b8b8b8;line-height:1.5">${escapeHtml(content.message)}</p>
+    </section>
+  </main>
+</body>
+</html>`,
+    {
+      status: content.status,
+      headers: {
+        "cache-control": "no-store",
+        "content-security-policy": "frame-ancestors 'none'; form-action 'self'",
+        "content-type": "text/html; charset=utf-8",
+        "x-frame-options": "DENY"
+      }
+    }
+  );
+}
+function renderConfirmation(agentName) {
+  return new Response(
+    `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Connect ${escapeHtml(agentName)}</title>
+</head>
+<body style="margin:0;background:#000;color:#fff;font-family:ui-sans-serif,system-ui,sans-serif">
+  <main style="min-height:100vh;display:grid;place-items:center;padding:2rem">
+    <section style="max-width:32rem;border-left:4px solid #a78bfa;padding-left:1rem">
+      <h1 style="margin:0 0 .75rem;font-size:2rem">Connect ${escapeHtml(agentName)}</h1>
+      <p style="margin:0 0 1rem;color:#b8b8b8;line-height:1.5">Only continue if you started sign-in from your ACP client. Enter the verification code shown by the client.</p>
+      <form method="post">
+        <label style="display:block;margin:0 0 1rem">Verification code<br><input name="code" required autocomplete="one-time-code" inputmode="text" style="box-sizing:border-box;margin-top:.5rem;padding:.625rem;width:100%"></label>
+        <button type="submit" style="border:0;border-radius:.375rem;background:#a78bfa;color:#000;cursor:pointer;font:inherit;font-weight:700;padding:.625rem 1rem">Connect</button>
+      </form>
+    </section>
+  </main>
+</body>
+</html>`,
+    {
+      headers: {
+        "cache-control": "no-store",
+        "content-security-policy": "frame-ancestors 'none'; form-action 'self'",
+        "content-type": "text/html; charset=utf-8",
+        "x-frame-options": "DENY"
+      }
+    }
+  );
+}
+function requestHasSameOrigin(request) {
+  const origin = request.headers.get("origin");
+  if (!origin) return false;
+  try {
+    return new URL(origin).origin === new URL(request.url).origin;
+  } catch {
+    return false;
+  }
+}
+function transactionIdFromRequest(request) {
+  const transactionId = new URL(request.url).pathname.split("/").at(-1);
+  return transactionId && UUID_PATTERN.test(transactionId) ? transactionId : void 0;
+}
+async function handleAcpAuthorizationPage(args) {
+  const transactionId = transactionIdFromRequest(args.request);
+  if (!transactionId) return renderResult(args.agentName, "expired");
+  if (args.request.method === "GET") {
+    return renderConfirmation(args.agentName);
+  }
+  if (args.request.method !== "POST" || !requestHasSameOrigin(args.request)) {
+    return renderResult(args.agentName, "blocked");
+  }
+  let userCode;
+  try {
+    const value = (await args.request.formData()).get("code");
+    userCode = typeof value === "string" ? value : void 0;
+  } catch {
+  }
+  if (!userCode?.trim()) return renderResult(args.agentName, "invalid");
+  const result = await completeAcpAuthorization({
+    state: args.state,
+    transactionId,
+    user: args.user,
+    userCode
+  });
+  return renderResult(args.agentName, result);
+}
+
 // src/app.ts
-function resolveAdapterBaseURL(dashboard) {
+function resolveAcpBaseURL(dashboard) {
   const configured = dashboard?.baseURL?.trim() || process.env.JUNIOR_BASE_URL?.trim();
   if (configured) return configured;
   const vercelURL = process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim() || process.env.VERCEL_URL?.trim();
@@ -8652,11 +10572,11 @@ function validateDashboardRouteOwnership(args) {
 function mountRoutes(app, routes) {
   for (const route of routes) {
     const handler = (c) => route.handler(c.req.raw);
-    const methods = typeof route.method === "string" ? [route.method] : route.method ?? ["ALL"];
-    const explicitMethods = methods.filter(
+    const methods5 = typeof route.method === "string" ? [route.method] : route.method ?? ["ALL"];
+    const explicitMethods = methods5.filter(
       (method) => method !== "ALL"
     );
-    if (methods.includes("ALL")) {
+    if (methods5.includes("ALL")) {
       app.all(route.path, handler);
     } else if (explicitMethods.length > 0) {
       app.on(explicitMethods, route.path, handler);
@@ -8801,37 +10721,41 @@ async function createApp(options) {
     });
     return conversationWorkOptions;
   };
-  let adapterRoutes = [];
-  let authenticatedRoutes = [];
-  try {
-    const adapterOutputs = await Promise.all(
-      (options?.adapters ?? []).map(async (adapter) => {
-        const work = getConversationWorkOptions();
-        const state = work.state ?? getStateAdapter();
-        return await adapter({
-          agentName: botConfig.userName,
-          baseURL: resolveAdapterBaseURL(dashboard),
-          conversations: createAdapterConversations({
-            conversationStore: work.conversationStore,
-            eventStore: getConversationEventStore(),
-            queue: work.queue ?? getVercelConversationWorkQueue(),
-            state
-          }),
-          reportError: (error, event, attributes) => void logException(error, event, attributes),
-          state,
-          version: JUNIOR_VERSION
-        });
-      })
-    );
-    adapterRoutes = adapterOutputs.flatMap((output) => output.routes ?? []);
-    authenticatedRoutes = adapterOutputs.flatMap(
-      (output) => output.authenticatedRoutes ?? []
-    );
-    if (authenticatedRoutes.length > 0 && (!dashboard || dashboard.disabled)) {
-      throw new Error(
-        "createApp() adapters with authenticated routes require an enabled dashboard"
-      );
+  let acpRuntime;
+  const getAcpRuntime = () => {
+    if (acpRuntime) return acpRuntime;
+    const work = getConversationWorkOptions();
+    const state = work.state ?? getStateAdapter();
+    acpRuntime = {
+      handleRequest: createAcpHttpHandler({
+        ...dashboard && !dashboard.disabled ? { browserAuth: { baseURL: resolveAcpBaseURL(dashboard) } } : void 0,
+        conversations: createAcpConversations({
+          conversationStore: work.conversationStore,
+          eventStore: getConversationEventStore(),
+          queue: work.queue ?? getVercelConversationWorkQueue(),
+          state
+        }),
+        onError: (error, event, attributes) => void logException(error, event, { ...attributes, platform: "acp" }),
+        state,
+        version: JUNIOR_VERSION
+      }),
+      state
+    };
+    return acpRuntime;
+  };
+  const authenticatedRoutes = dashboard && !dashboard.disabled ? [
+    {
+      handler: (request, user) => handleAcpAuthorizationPage({
+        agentName: botConfig.userName,
+        request,
+        state: getAcpRuntime().state,
+        user
+      }),
+      method: ["GET", "POST"],
+      path: ACP_AUTHORIZATION_PATH
     }
+  ] : [];
+  try {
     validateDashboardRouteOwnership({
       authenticatedRoutes,
       dashboard,
@@ -8856,8 +10780,12 @@ async function createApp(options) {
       next
     );
   });
+  app.on(
+    ["GET", "POST", "DELETE"],
+    "/api/acp",
+    (c) => getAcpRuntime().handleRequest(c.req.raw)
+  );
   mountRoutes(app, pluginRoutes);
-  mountRoutes(app, adapterRoutes);
   mountRoutes(
     app,
     await createDashboardRouteRegistrations({