@t4h/agent-runtime 0.2.0 → 0.4.0

package/README.md

@@ -78,12 +78,42 @@ depois, de qualquer réplica, e só para quem perguntou.
 | `EVENTS_HMAC_SECRETS` | `fonte=segredo,…`, ao menos uma | sem: aceita sem assinatura |
 | `EVENTS_PORT` / `EVENTS_WAKE_DEBOUNCE_MS` | | 8080 / 10000 |
 | `GATEWAY_URL`, `KEYCLOAK_ISSUER` | obrigatórios | sem `GATEWAY_URL`: `wiring` local |
-| `AGENT_<ID>_CLIENT_SECRET` | um por agente (hífen vira `_`) | |
+| `AGENTS_CLIENT_ID`, `AGENTS_CLIENT_SECRET` | obrigatórios: o client do círculo no Keycloak, um para todos os agentes | |
 | `GATEWAY_DEV_TOKEN` | proibido | token fixo no lugar do Keycloak |
-| `ANTHROPIC_API_KEY` | obrigatório (ou `CLAUDE_CODE_USE_BEDROCK`/`_VERTEX`) | |
+| `ANTHROPIC_ORGANIZATION_ID`, `ANTHROPIC_FEDERATION_RULE_ID`, `ANTHROPIC_SERVICE_ACCOUNT_ID` (`ANTHROPIC_WORKSPACE_ID`) | credencial do modelo por federação (ou `ANTHROPIC_API_KEY`) | no GitHub Actions, a identidade é o OIDC do job |
+| `ANTHROPIC_IDENTITY_SOURCE` / `ANTHROPIC_KEYCLOAK_SCOPE` / `ANTHROPIC_OIDC_AUDIENCE` | | `keycloak` (`github-actions` no Actions) / `aud-claude-console-agents` / `https://api.anthropic.com` |
 | `AGENTS_ASK_WAIT_MS` | | 20000, abaixo de `PROVIDER_CALL_TIMEOUT_MS` (30000) |
 | `PORT`, `GATEWAY_JWKS_URL`, `GATEWAY_ISSUER`, `SERVICE_AUDIENCE`, mTLS | como em `loadProviderEnv()` | sem passaporte: sem conector |
 
+## Agentes como principais do gateway (0.4)
+
+Um client do Keycloak por **círculo**, não por agente. O runtime pega um token para o
+repositório inteiro (`AGENTS_CLIENT_ID`/`AGENTS_CLIENT_SECRET`) e nomeia o agente em cada
+chamada no header `X-T4H-Agent: <id>`. No gateway, cada agente é um principal registrado
+(`agent_register`), com e-mail, roles (`agent_set_roles`) e grants diretos próprios, e o
+acesso dele é limitado às roles do client do círculo, o teto. O gateway recusa o header
+vindo de outro client e recusa o client do círculo sem o header.
+
+Da 0.3 para a 0.4: `AGENT_<ID>_CLIENT_SECRET` e `identity.clientId` saíram (o boot recusa o
+segredo antigo); o escopo padrão da federação virou `aud-claude-console-agents`. Precisa do
+gateway com principais de agente.
+
+## Credencial do modelo sem API key (0.3)
+
+Com os IDs de Workload Identity Federation da Anthropic no ambiente, o runtime troca um JWT
+por um token curto da API e o entrega ao Claude Code de cada execução
+(`ANTHROPIC_AUTH_TOKEN`). A troca é feita uma vez, no runtime, e não em cada processo: o JWT
+tem `jti` de uso único, e cada troca pede um JWT novo.
+
+- **Aplicação (`keycloak`):** o client do círculo (`AGENTS_CLIENT_ID`) faz
+  `client_credentials` no escopo `aud-claude-console-agents`. É a mesma identidade com que
+  os agentes usam o gateway; o custo por agente fica no runtime.
+- **CI dos evals (`github-actions`):** o token OIDC do job (`permissions: id-token: write`),
+  sem segredo no repositório. É o padrão quando `ACTIONS_ID_TOKEN_REQUEST_URL` existe.
+- `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, profile ou Bedrock/Vertex continuam valendo
+  (o Claude Code resolve sozinho). Uma API key junto com os IDs da federação falha no boot,
+  porque a key venceria em silêncio.
+
 ## Da 0.1 para a 0.2
 
 - O conector (proto, handlers, catálogo) e o wiring do gateway saíram do template e

package/dist/brain.d.ts

@@ -14,6 +14,7 @@
  */
 import { type McpServerConfig } from '@anthropic-ai/claude-agent-sdk';
 import type { LoadedAgent } from './manifest.js';
+import { type ModelAuth } from './model-auth.js';
 import type { PolicyGate } from './policy.js';
 import type { ResolvedSkills } from './plugins.js';
 import type { RuntimeTools } from './runtime-tools.js';
@@ -41,8 +42,15 @@ export interface Brain {
 }
 export declare class ClaudeBrain implements Brain {
     private readonly opts;
+    private readonly modelAuth;
+    /**
+     * `modelAuth`: de onde vem a credencial do modelo. Padrão: do ambiente
+     * (`modelAuthFromEnv`), o que cobre a federação pelo Keycloak na aplicação e pelo OIDC do
+     * GitHub nos evals da CI. `null`: deixa o Claude Code resolver sozinho.
+     */
     constructor(opts?: {
         debug?: boolean;
+        modelAuth?: ModelAuth | null;
     });
     run(task: BrainTask): Promise<BrainResult>;
 }

package/dist/brain.js

@@ -13,13 +13,21 @@
  * Os testes usam um Brain roteirizado que chama o mesmo portão, sem modelo.
  */
 import { query } from '@anthropic-ai/claude-agent-sdk';
+import { childEnv, modelAuthFromEnv } from './model-auth.js';
 function isErrorResponse(r) {
     return typeof r === 'object' && r !== null && r.isError === true;
 }
 export class ClaudeBrain {
     opts;
+    modelAuth;
+    /**
+     * `modelAuth`: de onde vem a credencial do modelo. Padrão: do ambiente
+     * (`modelAuthFromEnv`), o que cobre a federação pelo Keycloak na aplicação e pelo OIDC do
+     * GitHub nos evals da CI. `null`: deixa o Claude Code resolver sozinho.
+     */
     constructor(opts = {}) {
         this.opts = opts;
+        this.modelAuth = opts.modelAuth === undefined ? modelAuthFromEnv() : (opts.modelAuth ?? undefined);
     }
     async run(task) {
         const { gate } = task;
@@ -53,6 +61,8 @@ export class ClaudeBrain {
             return d.allow ? { behavior: 'allow', updatedInput: input } : { behavior: 'deny', message: d.message };
         };
         const m = task.agent.manifest;
+        // Token curto do modelo, trocado pelo runtime (federação); sem ele, o Claude Code resolve.
+        const auth = this.modelAuth ? await this.modelAuth.env(task.agent) : undefined;
         let text = '';
         let costUsd = 0;
         let turns = 0;
@@ -80,6 +90,7 @@ export class ClaudeBrain {
                 ...(task.budgetUsd ? { maxBudgetUsd: task.budgetUsd } : {}),
                 persistSession: false,
                 abortController,
+                ...(auth ? { env: childEnv(process.env, auth) } : {}),
                 ...(this.opts.debug ? { stderr: (s) => process.stderr.write(s) } : {}),
             },
         });

package/dist/brain.js.map

@@ -1 +1 @@
-{"version":3,"file":"brain.js","sourceRoot":"","sources":["../src/brain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAkE,MAAM,gCAAgC,CAAC;AA+BvH,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA2B,CAAC,OAAO,KAAK,IAAI,CAAC;AAC9F,CAAC;AAED,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,OAA4B,EAAE;QAA9B,SAAI,GAAJ,IAAI,CAA0B;IAAG,CAAC;IAE/D,KAAK,CAAC,GAAG,CAAC,IAAe;QACvB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAErF,MAAM,UAAU,GAAiB,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAC1D,IAAI,KAAK,CAAC,eAAe,KAAK,YAAY;gBAAE,OAAO,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC;YAC1C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAA4B,EAAE,EAAE,CAAC,CAAC;YACrG,OAAO;gBACL,kBAAkB,EAAE;oBAClB,aAAa,EAAE,YAAY;oBAC3B,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;oBAC9C,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC5D;aACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,WAAW,GAAiB,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,IAAI,KAAK,CAAC,eAAe,KAAK,aAAa,EAAE,CAAC;gBAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAClG,CAAC;iBAAM,IAAI,KAAK,CAAC,eAAe,KAAK,oBAAoB,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,mFAAmF;QACnF,MAAM,UAAU,GAAG,KAAK,EACtB,QAAgB,EAChB,KAA8B,EAC9B,CAAwB,EACG,EAAE;YAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACxF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzG,CAAC,CAAC;QAEF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9B,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAyB,CAAC;QAE9B,MAAM,CAAC,GAAG,KAAK,CAAC;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACjD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1G,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;gBACnE,eAAe,EAAE,IAAI;gBACrB,cAAc,EAAE,EAAE;gBAClB,cAAc,EAAE,SAAS;gBACzB,UAAU;gBACV,KAAK,EAAE;oBACL,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;oBACrC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;oBACvC,kBAAkB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;iBAC/C;gBACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,cAAc,EAAE,KAAK;gBACrB,eAAe;gBACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E;SACF,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC;gBAC7B,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;gBACtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;oBAAE,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC;;oBAC5C,KAAK,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/D,CAAC;CACF"}
+{"version":3,"file":"brain.js","sourceRoot":"","sources":["../src/brain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,KAAK,EAAkE,MAAM,gCAAgC,CAAC;AAEvH,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAkB,MAAM,iBAAiB,CAAC;AA8B7E,SAAS,eAAe,CAAC,CAAU;IACjC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAA2B,CAAC,OAAO,KAAK,IAAI,CAAC;AAC9F,CAAC;AAED,MAAM,OAAO,WAAW;IAQO;IAPZ,SAAS,CAAwB;IAElD;;;;OAIG;IACH,YAA6B,OAA0D,EAAE;QAA5D,SAAI,GAAJ,IAAI,CAAwD;QACvF,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;IACrG,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAe;QACvB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;QACtB,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAErF,MAAM,UAAU,GAAiB,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAC1D,IAAI,KAAK,CAAC,eAAe,KAAK,YAAY;gBAAE,OAAO,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC;YAC1C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAA4B,EAAE,EAAE,CAAC,CAAC;YACrG,OAAO;gBACL,kBAAkB,EAAE;oBAClB,aAAa,EAAE,YAAY;oBAC3B,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;oBAC9C,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC5D;aACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,WAAW,GAAiB,KAAK,EAAE,KAAK,EAAE,EAAE;YAChD,IAAI,KAAK,CAAC,eAAe,KAAK,aAAa,EAAE,CAAC;gBAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;YAClG,CAAC;iBAAM,IAAI,KAAK,CAAC,eAAe,KAAK,oBAAoB,EAAE,CAAC;gBAC1D,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,mFAAmF;QACnF,MAAM,UAAU,GAAG,KAAK,EACtB,QAAgB,EAChB,KAA8B,EAC9B,CAAwB,EACG,EAAE;YAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACxF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACzG,CAAC,CAAC;QAEF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9B,2FAA2F;QAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAyB,CAAC;QAE9B,MAAM,CAAC,GAAG,KAAK,CAAC;YACd,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;gBACjD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1G,UAAU,EAAE,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE;gBACnE,eAAe,EAAE,IAAI;gBACrB,cAAc,EAAE,EAAE;gBAClB,cAAc,EAAE,SAAS;gBACzB,UAAU;gBACV,KAAK,EAAE;oBACL,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;oBACrC,WAAW,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;oBACvC,kBAAkB,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;iBAC/C;gBACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,cAAc,EAAE,KAAK;gBACrB,eAAe;gBACf,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E;SACF,CAAC,CAAC;QAEH,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1B,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC;gBAC7B,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC;gBACtB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;oBAAE,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC;;oBAC5C,KAAK,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;YAChC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/D,CAAC;CACF"}

package/dist/env.d.ts

@@ -4,12 +4,13 @@
  * na primeira rodada.
  *
  * Em produção (`NODE_ENV=production`) não há atalho: Postgres de verdade, eventos
- * assinados, identidade própria de cada agente no Keycloak, chave do modelo e o conector
+ * assinados, o client do círculo no Keycloak, credencial do modelo e o conector
  * com mTLS. Fora de produção, o que faltar cai no modo local (PGlite, eventos sem
  * assinatura, sem conector, `wiring` de stub no lugar do gateway).
  */
 import { type ProviderEnv } from '@t4h/mcp-provider-sdk';
 import type { LoadedAgent } from './manifest.js';
+import { type ModelAuthConfig } from './model-auth.js';
 export interface AgentEnv {
     nodeEnv: string;
     isProduction: boolean;
@@ -30,8 +31,15 @@ export interface AgentEnv {
         /** Só fora de produção: token fixo no lugar do client_credentials. */
         devToken?: string;
         keycloakIssuer?: string;
-        /** `AGENT_<ID>_CLIENT_SECRET` de cada agente, pelo id do agente. */
-        clientSecrets: Map<string, string>;
+        /**
+         * O client do círculo no Keycloak (`AGENTS_CLIENT_ID`/`AGENTS_CLIENT_SECRET`): um para
+         * todos os agentes do repositório. Cada agente é nomeado no header `X-T4H-Agent` e é
+         * um principal registrado no gateway, com e-mail, roles e grants próprios.
+         */
+        client?: {
+            id: string;
+            secret: string;
+        };
     };
     /** Ambiente do conector gRPC (`loadProviderEnv`). Ausente fora de produção sem passaporte configurado. */
     connector?: ProviderEnv;
@@ -40,6 +48,8 @@ export interface AgentEnv {
      * chamada (`requireCallBinding` do SDK de providers). Desligado por padrão, como no SDK.
      */
     requireCallBinding: boolean;
+    /** Credencial do modelo: nativa do Claude Code ou federação feita pelo runtime. */
+    model: ModelAuthConfig;
     /** Quanto `agent_ask` espera a resposta antes de devolver `running`. */
     askWaitMs: number;
     debug: boolean;
@@ -47,8 +57,6 @@ export interface AgentEnv {
 /** Padrão do gateway para cortar a chamada ao provider (`PROVIDER_CALL_TIMEOUT_MS`). */
 export declare const GATEWAY_CALL_TIMEOUT_MS = 30000;
 export declare const DEFAULT_WAKE_DEBOUNCE_MS = 10000;
-/** `AGENT_<ID>_CLIENT_SECRET`: hífen vira `_`, tudo em maiúsculas. */
-export declare function agentSecretVar(agentId: string): string;
 /**
  * Lê e valida o ambiente para estes agentes. Junta todos os problemas numa mensagem só
  * (quem sobe o processo corrige tudo de uma vez) e lança.

package/dist/env.js

@@ -4,17 +4,18 @@
  * na primeira rodada.
  *
  * Em produção (`NODE_ENV=production`) não há atalho: Postgres de verdade, eventos
- * assinados, identidade própria de cada agente no Keycloak, chave do modelo e o conector
+ * assinados, o client do círculo no Keycloak, credencial do modelo e o conector
  * com mTLS. Fora de produção, o que faltar cai no modo local (PGlite, eventos sem
  * assinatura, sem conector, `wiring` de stub no lugar do gateway).
  */
 import { loadProviderEnv, optionalEnv } from '@t4h/mcp-provider-sdk';
+import { readModelAuth } from './model-auth.js';
 import { parseEventSecrets } from './signature.js';
 /** Padrão do gateway para cortar a chamada ao provider (`PROVIDER_CALL_TIMEOUT_MS`). */
 export const GATEWAY_CALL_TIMEOUT_MS = 30_000;
 export const DEFAULT_WAKE_DEBOUNCE_MS = 10_000;
-/** `AGENT_<ID>_CLIENT_SECRET`: hífen vira `_`, tudo em maiúsculas. */
-export function agentSecretVar(agentId) {
+/** O nome da 0.3 (um client por agente), recusado no boot para não ser ignorado em silêncio. */
+function legacyAgentSecretVar(agentId) {
     return `AGENT_${agentId.toUpperCase().replace(/-/g, '_')}_CLIENT_SECRET`;
 }
 function intEnv(name, fallback, env, problems, min = 0) {
@@ -64,46 +65,43 @@ export function loadAgentEnv(agents, env = process.env) {
     if (askWaitMs >= gatewayTimeout) {
         problems.push(`AGENTS_ASK_WAIT_MS (${askWaitMs}) tem de ficar abaixo do timeout do gateway para o provider (${gatewayTimeout} ms)`);
     }
-    // ── gateway (identidade de cada agente) ─────────────────────────────────────────
+    // ── gateway (o client do círculo; cada agente nomeado no header) ────────────────
     const gatewayUrl = optionalEnv('GATEWAY_URL', env);
     const devToken = optionalEnv('GATEWAY_DEV_TOKEN', env);
     const keycloakIssuer = optionalEnv('KEYCLOAK_ISSUER', env);
-    const clientSecrets = new Map();
-    const missingSecrets = [];
-    for (const a of agents) {
-        const name = agentSecretVar(a.manifest.id);
-        const value = optionalEnv(name, env);
-        if (value)
-            clientSecrets.set(a.manifest.id, value);
-        else
-            missingSecrets.push(name);
+    const clientId = optionalEnv('AGENTS_CLIENT_ID', env);
+    const clientSecret = optionalEnv('AGENTS_CLIENT_SECRET', env);
+    const legacy = agents.map((a) => legacyAgentSecretVar(a.manifest.id)).filter((k) => optionalEnv(k, env));
+    if (legacy.length) {
+        problems.push(`${legacy.join(', ')} não existe mais: um client por círculo (AGENTS_CLIENT_ID e AGENTS_CLIENT_SECRET), e cada agente registrado no gateway`);
     }
+    const missingClient = [!keycloakIssuer && 'KEYCLOAK_ISSUER', !clientId && 'AGENTS_CLIENT_ID', !clientSecret && 'AGENTS_CLIENT_SECRET'].filter(Boolean);
     let gateway;
     if (isProduction) {
         if (!gatewayUrl)
             problems.push('GATEWAY_URL é obrigatório em produção');
         if (devToken)
-            problems.push('GATEWAY_DEV_TOKEN é proibido em produção: cada agente usa a própria identidade');
-        if (!keycloakIssuer)
-            problems.push('KEYCLOAK_ISSUER é obrigatório em produção');
-        if (missingSecrets.length)
-            problems.push(`falta o segredo do client de cada agente: ${missingSecrets.join(', ')}`);
+            problems.push('GATEWAY_DEV_TOKEN é proibido em produção: os agentes usam o client do círculo');
+        if (missingClient.length)
+            problems.push(`${missingClient.join(', ')} obrigatório em produção (o client do círculo no Keycloak)`);
     }
-    else if (gatewayUrl && !devToken && (!keycloakIssuer || missingSecrets.length)) {
-        problems.push(`com GATEWAY_URL, defina GATEWAY_DEV_TOKEN ou KEYCLOAK_ISSUER e ${missingSecrets.join(', ') || 'os segredos dos agentes'}`);
+    else if (gatewayUrl && !devToken && missingClient.length) {
+        problems.push(`com GATEWAY_URL, defina GATEWAY_DEV_TOKEN ou ${missingClient.join(', ')}`);
     }
     if (gatewayUrl) {
         gateway = {
             url: gatewayUrl,
             ...(devToken && !isProduction ? { devToken } : {}),
             ...(keycloakIssuer ? { keycloakIssuer } : {}),
-            clientSecrets,
+            ...(clientId && clientSecret ? { client: { id: clientId, secret: clientSecret } } : {}),
         };
     }
     // ── modelo ──────────────────────────────────────────────────────────────────────
-    const hasModel = Boolean(optionalEnv('ANTHROPIC_API_KEY', env) || optionalEnv('CLAUDE_CODE_USE_BEDROCK', env) || optionalEnv('CLAUDE_CODE_USE_VERTEX', env));
-    if (isProduction && !hasModel)
-        problems.push('ANTHROPIC_API_KEY (ou CLAUDE_CODE_USE_BEDROCK / CLAUDE_CODE_USE_VERTEX) é obrigatório em produção');
+    const model = readModelAuth(env);
+    problems.push(...model.problems);
+    if (isProduction && model.config.mode === 'none' && !model.problems.length) {
+        problems.push('credencial do modelo é obrigatória em produção: federação (ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_SERVICE_ACCOUNT_ID) ou ANTHROPIC_API_KEY');
+    }
     // ── conector gRPC ───────────────────────────────────────────────────────────────
     // Em produção, sempre (e o SDK já exige mTLS). Fora dela, só se o passaporte estiver
     // configurado; configurado pela metade, falha como em produção.
@@ -127,6 +125,7 @@ export function loadAgentEnv(agents, env = process.env) {
         ...(gateway ? { gateway } : {}),
         ...(connector ? { connector } : {}),
         requireCallBinding: optionalEnv('PROVIDER_REQUIRE_CALL_BINDING', env) === '1',
+        model: model.config,
         askWaitMs,
         debug: optionalEnv('AGENT_DEBUG', env) === '1',
     };

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AAEvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAqCnD,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,SAAS,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,gBAAgB,CAAC;AAC3E,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,QAAgB,EAAE,GAAsB,EAAE,QAAkB,EAAE,GAAG,GAAG,CAAC;IACjG,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAqB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACtF,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IAC9C,MAAM,YAAY,GAAG,OAAO,KAAK,YAAY,CAAC;IAC9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,mFAAmF;IACnF,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACnF,IAAI,YAAY,IAAI,CAAC,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;SACvH,IAAI,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAE7I,mFAAmF;IACnF,IAAI,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,0EAA0E;IAC1E,IAAI,WAAW,CAAC,oBAAoB,EAAE,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC3I,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACzH,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAElG,mFAAmF;IACnF,MAAM,cAAc,GAAG,MAAM,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,SAAS,gEAAgE,cAAc,MAAM,CAAC,CAAC;IACtI,CAAC;IAED,mFAAmF;IACnF,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK;YAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;;YAC9C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,OAA4B,CAAC;IACjC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,UAAU;YAAE,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACxE,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAC9G,IAAI,CAAC,cAAc;YAAE,QAAQ,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAChF,IAAI,cAAc,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,6CAA6C,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrH,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QACjF,QAAQ,CAAC,IAAI,CAAC,kEAAkE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,yBAAyB,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,GAAG;YACR,GAAG,EAAE,UAAU;YACf,GAAG,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,aAAa;SACd,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7J,IAAI,YAAY,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,mGAAmG,CAAC,CAAC;IAElJ,mFAAmF;IACnF,qFAAqF;IACrF,gEAAgE;IAChE,IAAI,SAAkC,CAAC;IACvC,IAAI,YAAY,IAAI,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAAE,CAAC;QACvG,IAAI,CAAC;YACH,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,aAAc,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oBAAoB,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO;QACL,OAAO;QACP,YAAY;QACZ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE;QACvF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,kBAAkB,EAAE,WAAW,CAAC,+BAA+B,EAAE,GAAG,CAAC,KAAK,GAAG;QAC7E,SAAS;QACT,KAAK,EAAE,WAAW,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,GAAG;KAC/C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAoB,MAAM,uBAAuB,CAAC;AAEvF,OAAO,EAAE,aAAa,EAAwB,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AA2CnD,wFAAwF;AACxF,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,gGAAgG;AAChG,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO,SAAS,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,gBAAgB,CAAC;AAC3E,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,QAAgB,EAAE,GAAsB,EAAE,QAAkB,EAAE,GAAG,GAAG,CAAC;IACjG,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,GAAG,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAqB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACtF,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IAC9C,MAAM,YAAY,GAAG,OAAO,KAAK,YAAY,CAAC;IAC9C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,mFAAmF;IACnF,MAAM,WAAW,GAAG,WAAW,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACnF,IAAI,YAAY,IAAI,CAAC,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;SACvH,IAAI,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAE7I,mFAAmF;IACnF,IAAI,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,GAAG,iBAAiB,CAAC,WAAW,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,0EAA0E;IAC1E,IAAI,WAAW,CAAC,oBAAoB,EAAE,GAAG,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAC3I,IAAI,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,QAAQ,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACzH,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAElG,mFAAmF;IACnF,MAAM,cAAc,GAAG,MAAM,CAAC,0BAA0B,EAAE,uBAAuB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrG,MAAM,SAAS,GAAG,MAAM,CAAC,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACzE,IAAI,SAAS,IAAI,cAAc,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,SAAS,gEAAgE,cAAc,MAAM,CAAC,CAAC;IACtI,CAAC;IAED,mFAAmF;IACnF,MAAM,UAAU,GAAG,WAAW,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,WAAW,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACzG,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,wHAAwH,CAAC,CAAC;IAC9J,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,CAAC,cAAc,IAAI,iBAAiB,EAAE,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAC,YAAY,IAAI,sBAAsB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvJ,IAAI,OAA4B,CAAC;IACjC,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,UAAU;YAAE,QAAQ,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACxE,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAC7G,IAAI,aAAa,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IACnI,CAAC;SAAM,IAAI,UAAU,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,gDAAgD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,GAAG;YACR,GAAG,EAAE,UAAU;YACf,GAAG,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3E,QAAQ,CAAC,IAAI,CAAC,wKAAwK,CAAC,CAAC;IAC1L,CAAC;IAED,mFAAmF;IACnF,qFAAqF;IACrF,gEAAgE;IAChE,IAAI,SAAkC,CAAC;IACvC,IAAI,YAAY,IAAI,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC,IAAI,WAAW,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAAE,CAAC;QACvG,IAAI,CAAC;YACH,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,aAAc,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oBAAoB,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED,OAAO;QACL,OAAO;QACP,YAAY;QACZ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE;QACvF,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,kBAAkB,EAAE,WAAW,CAAC,+BAA+B,EAAE,GAAG,CAAC,KAAK,GAAG;QAC7E,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,SAAS;QACT,KAAK,EAAE,WAAW,CAAC,aAAa,EAAE,GAAG,CAAC,KAAK,GAAG;KAC/C,CAAC;AACJ,CAAC"}

package/dist/gateway.d.ts

@@ -1,13 +1,18 @@
 /**
- * O agente usa os sistemas da T4H só pelo MCP Gateway, com a própria identidade.
+ * O agente usa os sistemas só pelo MCP Gateway, com a própria identidade.
  *
- * O agente é um colaborador virtual: identidade e permissões próprias. Para os sistemas, é
- * mais um e-mail: um client do Keycloak com service account (client_credentials) cujo
- * usuário tem o e-mail de agente, criado por Segurança. O gateway já decide tudo pelo
- * e-mail e pelos papéis do token; os grants do agente são pedidos e liberados como os de
- * uma pessoa. Nada disso é configurado aqui.
+ * O agente é um colaborador virtual: um principal registrado no gateway, com e-mail,
+ * roles e grants próprios. Quem se autentica no Keycloak é o client do círculo
+ * (client_credentials), um para todos os agentes do repositório, e cada chamada nomeia o
+ * agente no header `X-T4H-Agent`. O gateway audita no nome do agente e limita os grants
+ * dele ao teto do círculo (as roles do client). Nada disso é configurado aqui.
  */
 import type { McpHttpServerConfig } from '@anthropic-ai/claude-agent-sdk';
+/**
+ * Header em que o client do círculo nomeia o agente que age. O gateway só aceita o header
+ * do client registrado como host daquele agente, e a chamada sai no nome do agente.
+ */
+export declare const AGENT_HEADER = "x-t4h-agent";
 export interface TokenSource {
     token(): Promise<string>;
 }
@@ -19,14 +24,18 @@ export declare class StaticTokenSource implements TokenSource {
 }
 /** Token curto do Keycloak, renovado um minuto antes de vencer. */
 export declare class ClientCredentialsTokenSource implements TokenSource {
+    /** `cache: false`: um token novo a cada chamada (para quem precisa de `jti` novo). */
     private readonly cfg;
     private readonly fetchImpl;
     private cached?;
-    constructor(cfg: {
+    constructor(
+    /** `cache: false`: um token novo a cada chamada (para quem precisa de `jti` novo). */
+    cfg: {
         issuer: string;
         clientId: string;
         clientSecret: string;
         scope?: string;
+        cache?: boolean;
     }, fetchImpl?: typeof fetch);
     token(): Promise<string>;
 }
@@ -41,13 +50,18 @@ export declare class GatewayError extends Error {
 }
 /** Cliente JSON-RPC do `POST /mcp/:subservice` (o gateway é stateless, sem sessão). */
 export declare class GatewayClient {
+    /** `agentId`: o agente em nome de quem o client do círculo age (header `X-T4H-Agent`). */
     private readonly cfg;
     private readonly fetchImpl;
     private seq;
-    constructor(cfg: {
+    constructor(
+    /** `agentId`: o agente em nome de quem o client do círculo age (header `X-T4H-Agent`). */
+    cfg: {
         url: string;
         tokens: TokenSource;
+        agentId?: string;
     }, fetchImpl?: typeof fetch);
+    private agentHeader;
     endpoint(subservice: string): string;
     /** Config de MCP remoto para o Claude Agent SDK, um por conector, com o token do agente. */
     mcpServers(subservices: string[], tokens?: TokenSource): Promise<Record<string, McpHttpServerConfig>>;

package/dist/gateway.js

@@ -1,3 +1,8 @@
+/**
+ * Header em que o client do círculo nomeia o agente que age. O gateway só aceita o header
+ * do client registrado como host daquele agente, e a chamada sai no nome do agente.
+ */
+export const AGENT_HEADER = 'x-t4h-agent';
 /** Fallback de desenvolvimento: o gateway em modo dev aceita HS256 com DEV_JWT_SECRET. */
 export class StaticTokenSource {
     value;
@@ -13,13 +18,15 @@ export class ClientCredentialsTokenSource {
     cfg;
     fetchImpl;
     cached;
-    constructor(cfg, fetchImpl = fetch) {
+    constructor(
+    /** `cache: false`: um token novo a cada chamada (para quem precisa de `jti` novo). */
+    cfg, fetchImpl = fetch) {
         this.cfg = cfg;
         this.fetchImpl = fetchImpl;
     }
     async token() {
         const now = Date.now();
-        if (this.cached && this.cached.exp - 60_000 > now)
+        if (this.cfg.cache !== false && this.cached && this.cached.exp - 60_000 > now)
             return this.cached.value;
         const body = new URLSearchParams({
             grant_type: 'client_credentials',
@@ -52,22 +59,27 @@ export class GatewayClient {
     cfg;
     fetchImpl;
     seq = 0;
-    constructor(cfg, fetchImpl = fetch) {
+    constructor(
+    /** `agentId`: o agente em nome de quem o client do círculo age (header `X-T4H-Agent`). */
+    cfg, fetchImpl = fetch) {
         this.cfg = cfg;
         this.fetchImpl = fetchImpl;
     }
+    agentHeader() {
+        return this.cfg.agentId ? { [AGENT_HEADER]: this.cfg.agentId } : {};
+    }
     endpoint(subservice) {
         return `${this.cfg.url.replace(/\/$/, '')}/mcp/${subservice}`;
     }
     /** Config de MCP remoto para o Claude Agent SDK, um por conector, com o token do agente. */
     async mcpServers(subservices, tokens = this.cfg.tokens) {
         const token = await tokens.token();
-        return Object.fromEntries(subservices.map((s) => [s, { type: 'http', url: this.endpoint(s), headers: { authorization: `Bearer ${token}` }, alwaysLoad: true }]));
+        return Object.fromEntries(subservices.map((s) => [s, { type: 'http', url: this.endpoint(s), headers: { authorization: `Bearer ${token}`, ...this.agentHeader() }, alwaysLoad: true }]));
     }
     async rpc(subservice, method, params, tokens = this.cfg.tokens) {
         const res = await this.fetchImpl(this.endpoint(subservice), {
             method: 'POST',
-            headers: { 'content-type': 'application/json', authorization: `Bearer ${await tokens.token()}` },
+            headers: { 'content-type': 'application/json', authorization: `Bearer ${await tokens.token()}`, ...this.agentHeader() },
             body: JSON.stringify({ jsonrpc: '2.0', id: ++this.seq, method, params }),
         });
         if (res.status === 401 || res.status === 403)

package/dist/gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAeA,0FAA0F;AAC1F,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAC9C,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,4BAA4B;IAIpB;IACA;IAJX,MAAM,CAAkC;IAEhD,YACmB,GAA+E,EAC/E,YAA0B,KAAK;QAD/B,QAAG,GAAH,GAAG,CAA4E;QAC/E,cAAS,GAAT,SAAS,CAAsB;IAC/C,CAAC;IAEJ,KAAK,CAAC,KAAK;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5E,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;YACpC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,EAAE;YACtG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,GAAG,CAAC,QAAQ,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiD,CAAC;QAChF,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF;AAQD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAGnB;IAFlB,YACE,OAAe,EACC,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,OAAO,aAAa;IAIL;IACA;IAJX,GAAG,GAAG,CAAC,CAAC;IAEhB,YACmB,GAAyC,EACzC,YAA0B,KAAK;QAD/B,QAAG,GAAH,GAAG,CAAsC;QACzC,cAAS,GAAT,SAAS,CAAsB;IAC/C,CAAC;IAEJ,QAAQ,CAAC,UAAkB;QACzB,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,UAAU,EAAE,CAAC;IAChE,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,UAAU,CAAC,WAAqB,EAAE,SAAsB,IAAI,CAAC,GAAG,CAAC,MAAM;QAC3E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,WAAW,CACvB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CACtI,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,UAAkB,EAAE,MAAc,EAAE,MAAe,EAAE,SAAsB,IAAI,CAAC,GAAG,CAAC,MAAM;QACrG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE;YAChG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;SACzE,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,mCAAmC,UAAU,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAClI,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8D,CAAC;QAC7F,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,MAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,MAAoB;QACtD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAA2B,UAAU,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACvB,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,IAAY,EAAE,IAA6B;QAC5E,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAwE,UAAU,EAAE,YAAY,EAAE;YACxH,IAAI;YACJ,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACvE,CAAC;CACF"}
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAWA;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC;AAM1C,0FAA0F;AAC1F,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,KAAa;QAAb,UAAK,GAAL,KAAK,CAAQ;IAAG,CAAC;IAC9C,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;CACF;AAED,mEAAmE;AACnE,MAAM,OAAO,4BAA4B;IAKpB;IACA;IALX,MAAM,CAAkC;IAEhD;IACE,sFAAsF;IACrE,GAAgG,EAChG,YAA0B,KAAK;QAD/B,QAAG,GAAH,GAAG,CAA6F;QAChG,cAAS,GAAT,SAAS,CAAsB;IAC/C,CAAC;IAEJ,KAAK,CAAC,KAAK;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,MAAM,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QACxG,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ;YAC5B,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY;YACpC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gCAAgC,EAAE;YACtG,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI;SACL,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,GAAG,CAAC,QAAQ,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAClH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiD,CAAC;QAChF,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF;AAQD,MAAM,OAAO,YAAa,SAAQ,KAAK;IAGnB;IAFlB,YACE,OAAe,EACC,IAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAS;QAG7B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,uFAAuF;AACvF,MAAM,OAAO,aAAa;IAKL;IACA;IALX,GAAG,GAAG,CAAC,CAAC;IAEhB;IACE,0FAA0F;IACzE,GAA2D,EAC3D,YAA0B,KAAK;QAD/B,QAAG,GAAH,GAAG,CAAwD;QAC3D,cAAS,GAAT,SAAS,CAAsB;IAC/C,CAAC;IAEI,WAAW;QACjB,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,QAAQ,CAAC,UAAkB;QACzB,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,UAAU,EAAE,CAAC;IAChE,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,UAAU,CAAC,WAAqB,EAAE,SAAsB,IAAI,CAAC,GAAG,CAAC,MAAM;QAC3E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACnC,OAAO,MAAM,CAAC,WAAW,CACvB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAC7J,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,UAAkB,EAAE,MAAc,EAAE,MAAe,EAAE,SAAsB,IAAI,CAAC,GAAG,CAAC,MAAM;QACrG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE;YACvH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;SACzE,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,YAAY,CAAC,mCAAmC,UAAU,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAClI,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8D,CAAC;QAC7F,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,MAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,MAAoB;QACtD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAA2B,UAAU,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IACvB,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,IAAY,EAAE,IAA6B;QAC5E,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAwE,UAAU,EAAE,YAAY,EAAE;YACxH,IAAI;YACJ,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACvE,CAAC;CACF"}

package/dist/index.d.ts

@@ -11,7 +11,7 @@ export type { ActionRow, ActionMode, ActionStatus, ItemRow, EventRow, Conversati
 export { pgSql, pgliteSql, sqlFromUrl } from './store/sql.js';
 export type { Sql, Queryable } from './store/sql.js';
 export { ShortTermMemory, stableStringify } from './short-term.js';
-export { GatewayClient, GatewayError, ClientCredentialsTokenSource, StaticTokenSource, } from './gateway.js';
+export { GatewayClient, GatewayError, AGENT_HEADER, ClientCredentialsTokenSource, StaticTokenSource, } from './gateway.js';
 export type { TokenSource, GatewayTool } from './gateway.js';
 export { ClaudeBrain } from './brain.js';
 export type { Brain, BrainTask, BrainResult } from './brain.js';
@@ -30,7 +30,7 @@ export { AGENTS_SERVICE_FQN, agentsProtoPath, agentsConnectorHandlers } from './
 export type { AgentsConnectorOptions } from './connector.js';
 export { agentsCatalog, agentsCatalogPath, AGENTS_SLUG_PATTERN } from './catalog.js';
 export type { AgentsCatalogOptions } from './catalog.js';
-export { loadAgentEnv, agentSecretVar, GATEWAY_CALL_TIMEOUT_MS, DEFAULT_WAKE_DEBOUNCE_MS } from './env.js';
+export { loadAgentEnv, GATEWAY_CALL_TIMEOUT_MS, DEFAULT_WAKE_DEBOUNCE_MS } from './env.js';
 export type { AgentEnv } from './env.js';
 export { gatewayWiring } from './wiring.js';
 export type { Wiring } from './wiring.js';
@@ -42,3 +42,5 @@ export { loadEvalCases, runEvalCase, runEvals, subsetMatch } from './evals.js';
 export type { EvalCase, EvalResult } from './evals.js';
 export { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk';
 export type { McpServerConfig } from '@anthropic-ai/claude-agent-sdk';
+export { AnthropicFederationTokenSource, githubActionsIdentity, modelAuthFromEnv, readModelAuth, childEnv, DEFAULT_KEYCLOAK_SCOPE, DEFAULT_GITHUB_AUDIENCE, } from './model-auth.js';
+export type { ModelAuth, ModelAuthConfig, FederationIds } from './model-auth.js';

package/dist/index.js

@@ -5,7 +5,7 @@ export { PolicyGate, evaluateBreaker, qualifiedToolName, sdkToolName, idempotenc
 export { LongTermStore, CONVERSATION_ROUTINE } from './store/long-term.js';
 export { pgSql, pgliteSql, sqlFromUrl } from './store/sql.js';
 export { ShortTermMemory, stableStringify } from './short-term.js';
-export { GatewayClient, GatewayError, ClientCredentialsTokenSource, StaticTokenSource, } from './gateway.js';
+export { GatewayClient, GatewayError, AGENT_HEADER, ClientCredentialsTokenSource, StaticTokenSource, } from './gateway.js';
 export { ClaudeBrain } from './brain.js';
 export { RuntimeTools } from './runtime-tools.js';
 export { resolveSkills } from './plugins.js';
@@ -17,11 +17,12 @@ export { parseEventSecrets, signEvent, verifyEventSignature, SOURCE_HEADER, SIGN
 export { AGENTS_SERVICE_FQN, agentsProtoPath, agentsConnectorHandlers } from './connector.js';
 export { agentsCatalog, agentsCatalogPath, AGENTS_SLUG_PATTERN } from './catalog.js';
 // Ambiente, ligação ao gateway e boot do processo.
-export { loadAgentEnv, agentSecretVar, GATEWAY_CALL_TIMEOUT_MS, DEFAULT_WAKE_DEBOUNCE_MS } from './env.js';
+export { loadAgentEnv, GATEWAY_CALL_TIMEOUT_MS, DEFAULT_WAKE_DEBOUNCE_MS } from './env.js';
 export { gatewayWiring } from './wiring.js';
 export { startAgents } from './start.js';
 export { consoleNotifier, MemoryNotifier } from './notifier.js';
 export { loadEvalCases, runEvalCase, runEvals, subsetMatch } from './evals.js';
 // Para servir conectores em processo (stubs locais, evals) sem depender do SDK direto.
 export { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk';
+export { AnthropicFederationTokenSource, githubActionsIdentity, modelAuthFromEnv, readModelAuth, childEnv, DEFAULT_KEYCLOAK_SCOPE, DEFAULT_GITHUB_AUDIENCE, } from './model-auth.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGtH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGlG,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGnE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1H,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EACL,aAAa,EACb,YAAY,EACZ,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEtF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAGpJ,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,uFAAuF;AACvF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE9F,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGrF,mDAAmD;AACnD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAE3G,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGhE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG/E,uFAAuF;AACvF,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGtH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGlG,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGnE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1H,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEnE,OAAO,EACL,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEtF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEnD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAGpJ,OAAO,EACL,iBAAiB,EACjB,SAAS,EACT,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,uFAAuF;AACvF,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE9F,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGrF,mDAAmD;AACnD,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAE3F,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGhE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG/E,uFAAuF;AACvF,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,gCAAgC,CAAC;AAG1E,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,EACb,QAAQ,EACR,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC"}

package/dist/manifest.d.ts

@@ -30,9 +30,9 @@ export interface AgentManifest {
         leader?: string;
         channel?: string;
     };
+    /** O e-mail com que o agente está registrado no gateway (`agent_register`). */
     identity: {
         email: string;
-        clientId?: string;
     };
     model: string;
     effort: 'low' | 'medium' | 'high' | 'xhigh' | 'max';

package/dist/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,GAAG,EAAoB,MAAM,KAAK,CAAC;AAC5C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAc,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAkB,MAAM,YAAY,CAAC;AA8D5D,MAAM,OAAO,aAAc,SAAQ,KAAK;IAEpB;IACA;IAFlB,YACkB,QAAgB,EAChB,QAAkB;QAElC,KAAK,CAAC,0BAA0B,QAAQ,UAAU,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAH7D,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAU;QAGlC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAElG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3E,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAElF,SAAS,cAAc,CAAC,CAAc;IACpC,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,KAAK,sBAAsB,EAAE,CAAC;QACzC,OAAO,GAAG,KAAK,yBAA0B,CAAC,CAAC,MAAyC,CAAC,kBAAkB,GAAG,CAAC;IAC7G,CAAC;IACD,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,CAAgB,EAAE,UAAmB;IACpE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAEpD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,yCAAyC,UAAU,GAAG,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAEvD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,+CAA+C,CAAC,CAAC;QACjH,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,4CAA4C,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,CAC7D,CAAC;IACF,IAAI,iBAAiB,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC,MAAM,sBAAsB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,4CAA4C,CAAC,CAAC;QAC9E,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QAChH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,cAAc,IAAI,+CAA+C,CAAC,CAAC;YACpI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,cAAc,IAAI,wCAAwC,CAAC,CAAC;YAC/G,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,cAAc,IAAI,qCAAqC,CAAC,CAAC;YAChH,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,yBAAyB,IAAI,MAAM,IAAI,4CAA4C,CAAC,CAAC;YACrH,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,qFAAqF;QACrF,+EAA+E;QAC/E,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,2CAA2C,CAAC,CAAC;YACzF,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,mCAAmC,CAAC,CAAC;YAC3F,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,yCAAyC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,UAAmB;IAChE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,qFAAqF;IACrF,mDAAmD;IACnD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,CAAC,cAAc,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAgC,CAAC;IAClD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAEvF,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1G,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEtD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAE1F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAE/G,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;;YAC3D,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,OAAO;QACL,QAAQ;QACR,GAAG;QACH,OAAO,EAAE,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;QAC1C,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,WAAW;QACX,UAAU;KACX,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,UAAkB;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/F,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,aAAa;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;gBAC1C,MAAM,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,gCAAgC,CAAC,CACrI,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../src/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,GAAG,EAAoB,MAAM,KAAK,CAAC;AAC5C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAc,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAkB,MAAM,YAAY,CAAC;AA+D5D,MAAM,OAAO,aAAc,SAAQ,KAAK;IAEpB;IACA;IAFlB,YACkB,QAAgB,EAChB,QAAkB;QAElC,KAAK,CAAC,0BAA0B,QAAQ,UAAU,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAH7D,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAU;QAGlC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAElG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3E,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAElF,SAAS,cAAc,CAAC,CAAc;IACpC,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC;IACzC,IAAI,CAAC,CAAC,OAAO,KAAK,sBAAsB,EAAE,CAAC;QACzC,OAAO,GAAG,KAAK,yBAA0B,CAAC,CAAC,MAAyC,CAAC,kBAAkB,GAAG,CAAC;IAC7G,CAAC;IACD,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,gBAAgB,CAAC,CAAgB,EAAE,UAAmB;IACpE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAEpD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,yCAAyC,UAAU,GAAG,CAAC,CAAC;IACnF,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAEvD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,+CAA+C,CAAC,CAAC;QACjH,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,4CAA4C,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,CAC7D,CAAC;IACF,IAAI,iBAAiB,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IAC5F,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,aAAa,CAAC,CAAC,MAAM,sBAAsB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,4CAA4C,CAAC,CAAC;QAC9E,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;QAChH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,cAAc,IAAI,+CAA+C,CAAC,CAAC;YACpI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,cAAc,IAAI,wCAAwC,CAAC,CAAC;YAC/G,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,cAAc,IAAI,qCAAqC,CAAC,CAAC;YAChH,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,yBAAyB,IAAI,MAAM,IAAI,4CAA4C,CAAC,CAAC;YACrH,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,qFAAqF;QACrF,+EAA+E;QAC/E,IAAI,CAAC,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,2CAA2C,CAAC,CAAC;YACzF,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,mCAAmC,CAAC,CAAC;YAC3F,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,IAAI,yCAAyC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,UAAmB;IAChE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,qFAAqF;IACrF,mDAAmD;IACnD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,CAAC,cAAc,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;IACzE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAgC,CAAC;IAClD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAgB;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAEvF,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1G,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEtD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAE1F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAE/G,MAAM,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;;YAC3D,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,OAAO;QACL,QAAQ;QACR,GAAG;QACH,OAAO,EAAE,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC;QAC1C,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,WAAW;QACX,UAAU;KACX,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,UAAkB;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/F,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,aAAa;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;gBAC1C,MAAM,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAE/F,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAC,gCAAgC,CAAC,CACrI,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/model-auth.d.ts

@@ -0,0 +1,84 @@
+import { type TokenSource } from './gateway.js';
+import type { LoadedAgent } from './manifest.js';
+export declare const ANTHROPIC_BASE_URL = "https://api.anthropic.com";
+/** Escopo do Keycloak que põe `aud: claude-console` no token do client do círculo. */
+export declare const DEFAULT_KEYCLOAK_SCOPE = "aud-claude-console-agents";
+/** Audience do token OIDC do GitHub Actions (padrão da Anthropic para esse provedor). */
+export declare const DEFAULT_GITHUB_AUDIENCE = "https://api.anthropic.com";
+export interface FederationIds {
+    organizationId: string;
+    federationRuleId: string;
+    serviceAccountId: string;
+    /** Obrigatório quando a regra vale para mais de um workspace. */
+    workspaceId?: string;
+}
+export type ModelAuthConfig = 
+/** O Claude Code resolve sozinho (API key, token, profile, federação por arquivo, nuvem). */
+{
+    mode: 'native';
+    source: string;
+} | {
+    mode: 'federation';
+    identity: 'keycloak';
+    ids: FederationIds;
+    baseUrl: string;
+    keycloak: {
+        issuer?: string;
+        clientId?: string;
+        scope: string;
+    };
+} | {
+    mode: 'federation';
+    identity: 'github-actions';
+    ids: FederationIds;
+    baseUrl: string;
+    audience: string;
+}
+/** Nada configurado: só vale fora de produção (login local do Claude Code). */
+ | {
+    mode: 'none';
+};
+/**
+ * Lê a configuração da credencial do modelo. Devolve também os problemas, para o
+ * `loadAgentEnv` juntar com os outros e falhar no boot.
+ */
+export declare function readModelAuth(env?: NodeJS.ProcessEnv): {
+    config: ModelAuthConfig;
+    problems: string[];
+};
+/** Um JWT novo do GitHub Actions a cada chamada (o do job vale ~5 min e tem `jti`). */
+export declare function githubActionsIdentity(audience: string, env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch): () => Promise<string>;
+/**
+ * Token da API da Claude por federação, guardado até 2 min antes de vencer. Cada troca
+ * pede um JWT novo a `identity` e nunca repete um que já foi apresentado.
+ */
+export declare class AnthropicFederationTokenSource implements TokenSource {
+    private readonly cfg;
+    private readonly identity;
+    private readonly fetchImpl;
+    private readonly now;
+    private cached?;
+    private inflight?;
+    constructor(cfg: {
+        ids: FederationIds;
+        baseUrl?: string;
+        label: string;
+    }, identity: () => Promise<string>, fetchImpl?: typeof fetch, now?: () => number);
+    token(): Promise<string>;
+    private exchange;
+}
+/** O que o `ClaudeBrain` pede antes de cada execução: variáveis a mais para o Claude Code. */
+export interface ModelAuth {
+    env(agent: LoadedAgent): Promise<Record<string, string>>;
+}
+/**
+ * Credencial do modelo a partir do ambiente. `undefined` quando o Claude Code resolve
+ * sozinho (ou, fora de produção, com o login local dele). Lança se a configuração for
+ * inválida; o `loadAgentEnv` já pegou isso no boot.
+ */
+export declare function modelAuthFromEnv(env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch): ModelAuth | undefined;
+/**
+ * Ambiente do processo do Claude Code: o do host, sem o que faria sombra ao token trocado
+ * aqui, mais as variáveis da credencial.
+ */
+export declare function childEnv(base: NodeJS.ProcessEnv, extra: Record<string, string>): Record<string, string>;

package/dist/model-auth.js

@@ -0,0 +1,225 @@
+/**
+ * Credencial do modelo sem API key: Workload Identity Federation da Anthropic.
+ *
+ * O runtime troca um JWT de um provedor de identidade em que a Anthropic confia por um
+ * token curto da API (`sk-ant-oat01-…`) e o entrega ao Claude Code de cada execução como
+ * `ANTHROPIC_AUTH_TOKEN`. Dois provedores:
+ *
+ *   - `keycloak` (a aplicação): o client do círculo (`AGENTS_CLIENT_ID`) faz
+ *     client_credentials no escopo `aud-claude-console-agents`, que só põe a audience
+ *     `claude-console` para quem tem a role `claude-console/agent`. É a mesma identidade com
+ *     que os agentes usam o gateway; o custo por agente fica no runtime.
+ *   - `github-actions` (CI dos evals): o token OIDC do job, sem segredo guardado no repo.
+ *
+ * A troca é feita aqui, uma vez, e não em cada processo do Claude Code: o JWT tem `jti` de
+ * uso único na Anthropic, e cada processo apresentando o mesmo JWT seria recusado como
+ * replay. Cada troca pede um JWT novo ao provedor.
+ *
+ * Com `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `ANTHROPIC_PROFILE`,
+ * `ANTHROPIC_IDENTITY_TOKEN[_FILE]` ou Bedrock/Vertex no ambiente, o runtime não interfere:
+ * o Claude Code resolve sozinho.
+ */
+import { optionalEnv } from '@t4h/mcp-provider-sdk';
+import { ClientCredentialsTokenSource } from './gateway.js';
+export const ANTHROPIC_BASE_URL = 'https://api.anthropic.com';
+/** Escopo do Keycloak que põe `aud: claude-console` no token do client do círculo. */
+export const DEFAULT_KEYCLOAK_SCOPE = 'aud-claude-console-agents';
+/** Audience do token OIDC do GitHub Actions (padrão da Anthropic para esse provedor). */
+export const DEFAULT_GITHUB_AUDIENCE = 'https://api.anthropic.com';
+/** Variáveis que não podem chegar ao Claude Code junto com o token trocado aqui. */
+const SHADOWING_VARS = [
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_PROFILE',
+    'ANTHROPIC_FEDERATION_RULE_ID',
+    'ANTHROPIC_ORGANIZATION_ID',
+    'ANTHROPIC_SERVICE_ACCOUNT_ID',
+    'ANTHROPIC_WORKSPACE_ID',
+    'ANTHROPIC_IDENTITY_TOKEN',
+    'ANTHROPIC_IDENTITY_TOKEN_FILE',
+];
+const NATIVE = [
+    'ANTHROPIC_API_KEY',
+    'ANTHROPIC_AUTH_TOKEN',
+    'ANTHROPIC_PROFILE',
+    'ANTHROPIC_IDENTITY_TOKEN_FILE',
+    'ANTHROPIC_IDENTITY_TOKEN',
+    'CLAUDE_CODE_USE_BEDROCK',
+    'CLAUDE_CODE_USE_VERTEX',
+];
+/**
+ * Lê a configuração da credencial do modelo. Devolve também os problemas, para o
+ * `loadAgentEnv` juntar com os outros e falhar no boot.
+ */
+export function readModelAuth(env = process.env) {
+    const problems = [];
+    const ids = {
+        organizationId: optionalEnv('ANTHROPIC_ORGANIZATION_ID', env),
+        federationRuleId: optionalEnv('ANTHROPIC_FEDERATION_RULE_ID', env),
+        serviceAccountId: optionalEnv('ANTHROPIC_SERVICE_ACCOUNT_ID', env),
+    };
+    const anyId = Object.values(ids).some(Boolean);
+    const native = NATIVE.find((k) => optionalEnv(k, env));
+    // Com a variável nativa, o Claude Code usa ela e ignora a federação em silêncio.
+    if (native && anyId && !native.startsWith('ANTHROPIC_IDENTITY_TOKEN')) {
+        problems.push(`${native} e a federação (ANTHROPIC_FEDERATION_RULE_ID…) ao mesmo tempo: ${native} venceria em silêncio; deixe só um`);
+    }
+    if (native)
+        return { config: { mode: 'native', source: native }, problems };
+    if (!anyId)
+        return { config: { mode: 'none' }, problems };
+    const missing = Object.entries({
+        ANTHROPIC_ORGANIZATION_ID: ids.organizationId,
+        ANTHROPIC_FEDERATION_RULE_ID: ids.federationRuleId,
+        ANTHROPIC_SERVICE_ACCOUNT_ID: ids.serviceAccountId,
+    })
+        .filter(([, v]) => !v)
+        .map(([k]) => k);
+    if (missing.length) {
+        problems.push(`federação do modelo pela metade: falta ${missing.join(', ')}`);
+        return { config: { mode: 'none' }, problems };
+    }
+    const fed = {
+        organizationId: ids.organizationId,
+        federationRuleId: ids.federationRuleId,
+        serviceAccountId: ids.serviceAccountId,
+        ...(optionalEnv('ANTHROPIC_WORKSPACE_ID', env) ? { workspaceId: optionalEnv('ANTHROPIC_WORKSPACE_ID', env) } : {}),
+    };
+    const baseUrl = (optionalEnv('ANTHROPIC_BASE_URL', env) ?? ANTHROPIC_BASE_URL).replace(/\/$/, '');
+    const inActions = Boolean(optionalEnv('ACTIONS_ID_TOKEN_REQUEST_URL', env));
+    const identity = optionalEnv('ANTHROPIC_IDENTITY_SOURCE', env) ?? (inActions ? 'github-actions' : 'keycloak');
+    if (identity === 'github-actions') {
+        if (!inActions || !optionalEnv('ACTIONS_ID_TOKEN_REQUEST_TOKEN', env)) {
+            problems.push('ANTHROPIC_IDENTITY_SOURCE=github-actions sem o token OIDC do job: dê `permissions: id-token: write` ao job');
+        }
+        return {
+            config: { mode: 'federation', identity, ids: fed, baseUrl, audience: optionalEnv('ANTHROPIC_OIDC_AUDIENCE', env) ?? DEFAULT_GITHUB_AUDIENCE },
+            problems,
+        };
+    }
+    if (identity === 'keycloak') {
+        const issuer = optionalEnv('KEYCLOAK_ISSUER', env);
+        const clientId = optionalEnv('AGENTS_CLIENT_ID', env);
+        const missing = [!issuer && 'KEYCLOAK_ISSUER', !clientId && 'AGENTS_CLIENT_ID', !optionalEnv('AGENTS_CLIENT_SECRET', env) && 'AGENTS_CLIENT_SECRET'].filter(Boolean);
+        if (missing.length)
+            problems.push(`federação do modelo pelo Keycloak sem ${missing.join(', ')}`);
+        return {
+            config: {
+                mode: 'federation',
+                identity,
+                ids: fed,
+                baseUrl,
+                keycloak: {
+                    ...(issuer ? { issuer } : {}),
+                    ...(clientId ? { clientId } : {}),
+                    scope: optionalEnv('ANTHROPIC_KEYCLOAK_SCOPE', env) ?? DEFAULT_KEYCLOAK_SCOPE,
+                },
+            },
+            problems,
+        };
+    }
+    problems.push(`ANTHROPIC_IDENTITY_SOURCE="${identity}" inválido: use keycloak ou github-actions`);
+    return { config: { mode: 'none' }, problems };
+}
+/** Um JWT novo do GitHub Actions a cada chamada (o do job vale ~5 min e tem `jti`). */
+export function githubActionsIdentity(audience, env = process.env, fetchImpl = fetch) {
+    return async () => {
+        const url = optionalEnv('ACTIONS_ID_TOKEN_REQUEST_URL', env);
+        const bearer = optionalEnv('ACTIONS_ID_TOKEN_REQUEST_TOKEN', env);
+        if (!url || !bearer)
+            throw new Error('sem o token OIDC do GitHub Actions: o job precisa de `permissions: id-token: write`');
+        const res = await fetchImpl(`${url}&audience=${encodeURIComponent(audience)}`, { headers: { authorization: `Bearer ${bearer}` } });
+        if (!res.ok)
+            throw new Error(`GitHub recusou o token OIDC: HTTP ${res.status}`);
+        const { value } = (await res.json());
+        if (!value)
+            throw new Error('GitHub devolveu o token OIDC vazio');
+        return value;
+    };
+}
+/**
+ * Token da API da Claude por federação, guardado até 2 min antes de vencer. Cada troca
+ * pede um JWT novo a `identity` e nunca repete um que já foi apresentado.
+ */
+export class AnthropicFederationTokenSource {
+    cfg;
+    identity;
+    fetchImpl;
+    now;
+    cached;
+    inflight;
+    constructor(cfg, identity, fetchImpl = fetch, now = Date.now) {
+        this.cfg = cfg;
+        this.identity = identity;
+        this.fetchImpl = fetchImpl;
+        this.now = now;
+    }
+    token() {
+        if (this.cached && this.cached.exp - 120_000 > this.now())
+            return Promise.resolve(this.cached.value);
+        // Duas execuções ao mesmo tempo esperam a mesma troca, em vez de gastar dois JWT.
+        this.inflight ??= this.exchange().finally(() => (this.inflight = undefined));
+        return this.inflight;
+    }
+    async exchange() {
+        const { ids } = this.cfg;
+        const started = this.now();
+        const res = await this.fetchImpl(`${(this.cfg.baseUrl ?? ANTHROPIC_BASE_URL).replace(/\/$/, '')}/v1/oauth/token`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+                grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+                assertion: await this.identity(),
+                federation_rule_id: ids.federationRuleId,
+                organization_id: ids.organizationId,
+                service_account_id: ids.serviceAccountId,
+                ...(ids.workspaceId ? { workspace_id: ids.workspaceId } : {}),
+            }),
+        });
+        if (!res.ok) {
+            // O 401 da Anthropic é opaco de propósito; o motivo fica no histórico de autenticação do Console.
+            const requestId = res.headers.get('request-id');
+            throw new Error(`Anthropic recusou a federação de ${this.cfg.label}: HTTP ${res.status}${requestId ? ` (request-id ${requestId})` : ''}`);
+        }
+        const json = (await res.json());
+        if (!json.access_token || !json.expires_in)
+            throw new Error(`Anthropic devolveu a federação de ${this.cfg.label} sem token`);
+        this.cached = { value: json.access_token, exp: started + json.expires_in * 1000 };
+        return json.access_token;
+    }
+}
+/**
+ * Credencial do modelo a partir do ambiente. `undefined` quando o Claude Code resolve
+ * sozinho (ou, fora de produção, com o login local dele). Lança se a configuração for
+ * inválida; o `loadAgentEnv` já pegou isso no boot.
+ */
+export function modelAuthFromEnv(env = process.env, fetchImpl = fetch) {
+    const { config, problems } = readModelAuth(env);
+    if (problems.length)
+        throw new Error(`credencial do modelo: ${problems.join('; ')}`);
+    if (config.mode !== 'federation')
+        return undefined;
+    if (config.identity === 'github-actions') {
+        const shared = new AnthropicFederationTokenSource({ ids: config.ids, baseUrl: config.baseUrl, label: 'GitHub Actions' }, githubActionsIdentity(config.audience, env, fetchImpl), fetchImpl);
+        return { env: async () => ({ ANTHROPIC_AUTH_TOKEN: await shared.token() }) };
+    }
+    // Keycloak: o client do círculo, o mesmo dos agentes no gateway. Um token para todos.
+    const { issuer, clientId, scope } = config.keycloak;
+    const clientSecret = optionalEnv('AGENTS_CLIENT_SECRET', env);
+    // `readModelAuth` já recusou a configuração incompleta.
+    const keycloak = new ClientCredentialsTokenSource({ issuer: issuer, clientId: clientId, clientSecret: clientSecret, scope, cache: false }, fetchImpl);
+    // Sem cache no Keycloak: cada troca na Anthropic precisa de um JWT com `jti` novo.
+    const shared = new AnthropicFederationTokenSource({ ids: config.ids, baseUrl: config.baseUrl, label: clientId }, () => keycloak.token(), fetchImpl);
+    return { env: async () => ({ ANTHROPIC_AUTH_TOKEN: await shared.token() }) };
+}
+/**
+ * Ambiente do processo do Claude Code: o do host, sem o que faria sombra ao token trocado
+ * aqui, mais as variáveis da credencial.
+ */
+export function childEnv(base, extra) {
+    const out = {};
+    for (const [k, v] of Object.entries(base))
+        if (v !== undefined && !SHADOWING_VARS.includes(k))
+            out[k] = v;
+    return { ...out, ...extra };
+}
+//# sourceMappingURL=model-auth.js.map

package/dist/model-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-auth.js","sourceRoot":"","sources":["../src/model-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAoB,MAAM,cAAc,CAAC;AAG9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAC9D,sFAAsF;AACtF,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAClE,yFAAyF;AACzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAEnE,oFAAoF;AACpF,MAAM,cAAc,GAAG;IACrB,mBAAmB;IACnB,mBAAmB;IACnB,8BAA8B;IAC9B,2BAA2B;IAC3B,8BAA8B;IAC9B,wBAAwB;IACxB,0BAA0B;IAC1B,+BAA+B;CAChC,CAAC;AAkBF,MAAM,MAAM,GAAG;IACb,mBAAmB;IACnB,sBAAsB;IACtB,mBAAmB;IACnB,+BAA+B;IAC/B,0BAA0B;IAC1B,yBAAyB;IACzB,wBAAwB;CACzB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG;QACV,cAAc,EAAE,WAAW,CAAC,2BAA2B,EAAE,GAAG,CAAC;QAC7D,gBAAgB,EAAE,WAAW,CAAC,8BAA8B,EAAE,GAAG,CAAC;QAClE,gBAAgB,EAAE,WAAW,CAAC,8BAA8B,EAAE,GAAG,CAAC;KACnE,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,iFAAiF;IACjF,IAAI,MAAM,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACtE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,kEAAkE,MAAM,oCAAoC,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;IAE1D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7B,yBAAyB,EAAE,GAAG,CAAC,cAAc;QAC7C,4BAA4B,EAAE,GAAG,CAAC,gBAAgB;QAClD,4BAA4B,EAAE,GAAG,CAAC,gBAAgB;KACnD,CAAC;SACC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,0CAA0C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,GAAG,GAAkB;QACzB,cAAc,EAAE,GAAG,CAAC,cAAe;QACnC,gBAAgB,EAAE,GAAG,CAAC,gBAAiB;QACvC,gBAAgB,EAAE,GAAG,CAAC,gBAAiB;QACvC,GAAG,CAAC,WAAW,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,wBAAwB,EAAE,GAAG,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpH,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,oBAAoB,EAAE,GAAG,CAAC,IAAI,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,WAAW,CAAC,2BAA2B,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAE9G,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,gCAAgC,EAAE,GAAG,CAAC,EAAE,CAAC;YACtE,QAAQ,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;QAC9H,CAAC;QACD,OAAO;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,IAAI,uBAAuB,EAAE;YAC7I,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC,QAAQ,IAAI,kBAAkB,EAAE,CAAC,WAAW,CAAC,sBAAsB,EAAE,GAAG,CAAC,IAAI,sBAAsB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrK,IAAI,OAAO,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,yCAAyC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjG,OAAO;YACL,MAAM,EAAE;gBACN,IAAI,EAAE,YAAY;gBAClB,QAAQ;gBACR,GAAG,EAAE,GAAG;gBACR,OAAO;gBACP,QAAQ,EAAE;oBACR,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjC,KAAK,EAAE,WAAW,CAAC,0BAA0B,EAAE,GAAG,CAAC,IAAI,sBAAsB;iBAC9E;aACF;YACD,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,8BAA8B,QAAQ,4CAA4C,CAAC,CAAC;IAClG,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;AAChD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,MAAyB,OAAO,CAAC,GAAG,EAAE,YAA0B,KAAK;IAC3H,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,WAAW,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QAC5H,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,GAAG,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACnI,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,8BAA8B;IAKtB;IACA;IACA;IACA;IAPX,MAAM,CAAkC;IACxC,QAAQ,CAAmB;IAEnC,YACmB,GAA4D,EAC5D,QAA+B,EAC/B,YAA0B,KAAK,EAC/B,MAAoB,IAAI,CAAC,GAAG;QAH5B,QAAG,GAAH,GAAG,CAAyD;QAC5D,aAAQ,GAAR,QAAQ,CAAuB;QAC/B,cAAS,GAAT,SAAS,CAAsB;QAC/B,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,KAAK;QACH,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrG,kFAAkF;QAClF,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,kBAAkB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,EAAE;YAChH,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,6CAA6C;gBACzD,SAAS,EAAE,MAAM,IAAI,CAAC,QAAQ,EAAE;gBAChC,kBAAkB,EAAE,GAAG,CAAC,gBAAgB;gBACxC,eAAe,EAAE,GAAG,CAAC,cAAc;gBACnC,kBAAkB,EAAE,GAAG,CAAC,gBAAgB;gBACxC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,kGAAkG;YAClG,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,GAAG,CAAC,KAAK,UAAU,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5I,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,CAAC;QAC7H,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;CACF;AAOD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,YAA0B,KAAK;IACpG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IAEnD,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,8BAA8B,CAC/C,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,EACrE,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,EACtD,SAAS,CACV,CAAC;QACF,OAAO,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,sFAAsF;IACtF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACpD,MAAM,YAAY,GAAG,WAAW,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAC9D,wDAAwD;IACxD,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC,EAAE,MAAM,EAAE,MAAO,EAAE,QAAQ,EAAE,QAAS,EAAE,YAAY,EAAE,YAAa,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACzJ,mFAAmF;IACnF,MAAM,MAAM,GAAG,IAAI,8BAA8B,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,QAAS,EAAE,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IACrJ,OAAO,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,oBAAoB,EAAE,MAAM,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAuB,EAAE,KAA6B;IAC7E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1G,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;AAC9B,CAAC"}

package/dist/start.js

@@ -13,6 +13,7 @@
  */
 import { createProviderServer, loadProviderContract } from '@t4h/mcp-provider-sdk';
 import { ClaudeBrain } from './brain.js';
+import { modelAuthFromEnv } from './model-auth.js';
 import { agentsConnectorHandlers, agentsProtoPath, AGENTS_SERVICE_FQN } from './connector.js';
 import { loadAgentEnv } from './env.js';
 import { AgentHost } from './host.js';
@@ -38,7 +39,7 @@ export async function startAgents(opts) {
     const host = new AgentHost({
         agents,
         store,
-        brain: opts.brain ?? new ClaudeBrain({ debug: env.debug }),
+        brain: opts.brain ?? new ClaudeBrain({ debug: env.debug, modelAuth: modelAuthFromEnv(opts.env ?? process.env) ?? null }),
         notifier: opts.notifier ?? consoleNotifier,
         ...(opts.pluginsDir ? { pluginsDir: opts.pluginsDir } : {}),
         askWaitMs: env.askWaitMs,

package/dist/start.js.map

@@ -1 +1 @@
-{"version":3,"file":"start.js","sourceRoot":"","sources":["../src/start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAuB,MAAM,uBAAuB,CAAC;AACxG,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAiB,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAiB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAe,MAAM,aAAa,CAAC;AA6BzD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACzI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,IAAI,GAAG,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,uJAAuJ,CAAC,CAAC;IACxK,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IAEtB,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC;QACzB,MAAM;QACN,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;QAC1D,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,eAAe;QAC1C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc;QACzC,GAAG,MAAM;KACV,CAAC,CAAC;IAEH,IAAI,QAAoC,CAAC;IACzC,IAAI,aAAiC,CAAC;IACtC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;YAC9C,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;YAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB;YAC/C,UAAU,EAAE,GAAG,CAAC,YAAY;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YAC5B,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,QAAQ,GAAG,MAAM,oBAAoB,CAAC;gBACpC,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC;gBACvC,QAAQ,EAAE,MAAM,oBAAoB,CAAC,eAAe,EAAE,EAAE,kBAAkB,CAAC;gBAC3E,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ;gBAChC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,GAAG,CAAC,kBAAkB;gBACrE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,aAAa,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC;IACV,CAAC;IAED,OAAO,CAAC,IAAI,CACV,YAAY,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,UAAU,EAAE;QACnF,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjF,CAAC;IAEF,IAAI,QAAmC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,CAAC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,sCAAsC;QACtC,MAAM,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,EAAE,CAAC,CAAC;IAER,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;gBACxB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC;gBACtC,qDAAqD;gBACrD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5C,IAAI,EAAE,CAAC,IAAI,CACT,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EACrB,CAAC,CAAC,EAAE,EAAE;oBACJ,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;AACpG,CAAC"}
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../src/start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAuB,MAAM,uBAAuB,CAAC;AACxG,OAAO,EAAE,WAAW,EAAc,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAiB,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAiB,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAe,MAAM,aAAa,CAAC;AA6BzD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACzI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,IAAI,GAAG,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,uJAAuJ,CAAC,CAAC;IACxK,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IAEtB,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC;QACzB,MAAM;QACN,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACxH,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,eAAe;QAC1C,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,cAAc;QACzC,GAAG,MAAM;KACV,CAAC,CAAC;IAEH,IAAI,QAAoC,CAAC;IACzC,IAAI,aAAiC,CAAC;IACtC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;YAC9C,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;YAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB;YAC/C,UAAU,EAAE,GAAG,CAAC,YAAY;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;YAC5B,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,QAAQ,GAAG,MAAM,oBAAoB,CAAC;gBACpC,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC;gBACvC,QAAQ,EAAE,MAAM,oBAAoB,CAAC,eAAe,EAAE,EAAE,kBAAkB,CAAC;gBAC3E,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,QAAQ;gBAChC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,GAAG,CAAC,kBAAkB;gBACrE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,aAAa,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC;IACV,CAAC;IAED,OAAO,CAAC,IAAI,CACV,YAAY,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,UAAU,EAAE;QACnF,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjF,CAAC;IAEF,IAAI,QAAmC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,CAAC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,kFAAkF;QAClF,iFAAiF;QACjF,iFAAiF;QACjF,sCAAsC;QACtC,MAAM,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,EAAE,CAAC,CAAC;IAER,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;gBACxB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC;gBACtC,qDAAqD;gBACrD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5C,IAAI,EAAE,CAAC,IAAI,CACT,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EACrB,CAAC,CAAC,EAAE,EAAE;oBACJ,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACjB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;AACpG,CAAC"}

package/dist/wiring.d.ts

@@ -1,7 +1,7 @@
 /**
- * Liga os agentes ao gateway: um `GatewayClient` por agente, cada um com a própria
- * identidade. É o que o gateway audita: a chamada sai no nome do agente, nunca de uma
- * conta compartilhada.
+ * Liga os agentes ao gateway: um `GatewayClient` por agente, todos com o token do client
+ * do círculo e cada um com o próprio `X-T4H-Agent`. É o que o gateway audita: a chamada
+ * sai no nome do agente, nunca do client do círculo (que sem o header é recusado).
  */
 import type { AgentEnv } from './env.js';
 import { type AgentHostOptions } from './host.js';

package/dist/wiring.js

@@ -1,23 +1,20 @@
 import { ClientCredentialsTokenSource, GatewayClient, StaticTokenSource } from './gateway.js';
 import { gatewayExecutor } from './host.js';
-function tokensFor(agent, gw) {
+function circleTokens(gw) {
     // `loadAgentEnv` já recusa o token fixo em produção.
     if (gw.devToken)
         return new StaticTokenSource(gw.devToken);
-    const secret = gw.clientSecrets.get(agent.manifest.id);
-    if (!gw.keycloakIssuer || !secret)
-        throw new Error(`${agent.manifest.id}: defina KEYCLOAK_ISSUER e o segredo do client do agente`);
-    return new ClientCredentialsTokenSource({
-        issuer: gw.keycloakIssuer,
-        clientId: agent.manifest.identity.clientId ?? `agent-${agent.manifest.id}`,
-        clientSecret: secret,
-    });
+    if (!gw.keycloakIssuer || !gw.client)
+        throw new Error('defina KEYCLOAK_ISSUER, AGENTS_CLIENT_ID e AGENTS_CLIENT_SECRET (o client do círculo)');
+    return new ClientCredentialsTokenSource({ issuer: gw.keycloakIssuer, clientId: gw.client.id, clientSecret: gw.client.secret });
 }
 export function gatewayWiring(agents, env) {
     const gw = env.gateway;
     if (!gw)
         throw new Error('sem GATEWAY_URL: defina o gateway ou passe um wiring local');
-    const clients = new Map(agents.map((a) => [a.manifest.id, new GatewayClient({ url: gw.url, tokens: tokensFor(a, gw) })]));
+    // Um token para o círculo inteiro (renovado num lugar só); o agente vai no header.
+    const tokens = circleTokens(gw);
+    const clients = new Map(agents.map((a) => [a.manifest.id, new GatewayClient({ url: gw.url, tokens, agentId: a.manifest.id })]));
     const client = (a) => {
         const c = clients.get(a.manifest.id);
         if (!c)

package/dist/wiring.js.map

@@ -1 +1 @@
-{"version":3,"file":"wiring.js","sourceRoot":"","sources":["../src/wiring.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,iBAAiB,EAAoB,MAAM,cAAc,CAAC;AAChH,OAAO,EAAE,eAAe,EAAyB,MAAM,WAAW,CAAC;AAMnE,SAAS,SAAS,CAAC,KAAkB,EAAE,EAAoC;IACzE,qDAAqD;IACrD,IAAI,EAAE,CAAC,QAAQ;QAAE,OAAO,IAAI,iBAAiB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,CAAC,cAAc,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,0DAA0D,CAAC,CAAC;IACnI,OAAO,IAAI,4BAA4B,CAAC;QACtC,MAAM,EAAE,EAAE,CAAC,cAAc;QACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,IAAI,SAAS,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE;QAC1E,YAAY,EAAE,MAAM;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAqB,EAAE,GAA8B;IACjF,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,aAAa,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1H,MAAM,MAAM,GAAG,CAAC,CAAc,EAAE,EAAE;QAChC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,4BAA4B,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QACpE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE;KACxF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"wiring.js","sourceRoot":"","sources":["../src/wiring.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,4BAA4B,EAAE,aAAa,EAAE,iBAAiB,EAAoB,MAAM,cAAc,CAAC;AAChH,OAAO,EAAE,eAAe,EAAyB,MAAM,WAAW,CAAC;AAMnE,SAAS,YAAY,CAAC,EAAoC;IACxD,qDAAqD;IACrD,IAAI,EAAE,CAAC,QAAQ;QAAE,OAAO,IAAI,iBAAiB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,EAAE,CAAC,cAAc,IAAI,CAAC,EAAE,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC/I,OAAO,IAAI,4BAA4B,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,cAAc,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAqB,EAAE,GAA8B;IACjF,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACvF,mFAAmF;IACnF,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,aAAa,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChI,MAAM,MAAM,GAAG,CAAC,CAAc,EAAE,EAAE;QAChC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,4BAA4B,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QACpE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE;KACxF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t4h/agent-runtime",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Runtime dos colaboradores digitais (agentes de IA) da Tech for Humans: manifesto agent.yaml, caixa de entrada de eventos, rodadas, níveis de autonomia por rotina com disjuntor, memória curta (SQLite) e longa (Postgres), acesso aos sistemas pelo Enterprise MCP Gateway com a identidade própria do agente, o conector agents_<círculo> e o boot do processo (startAgents).",
   "type": "module",
   "engines": {

package/schema/agent.schema.json

@@ -49,8 +49,7 @@
       "additionalProperties": false,
       "required": ["email"],
       "properties": {
-        "email": { "type": "string", "pattern": "^[^@\\s]+@[^@\\s]+$" },
-        "clientId": { "type": "string", "description": "Client do Keycloak usado no client_credentials. Padrão: agent-<id>." }
+        "email": { "type": "string", "pattern": "^[^@\\s]+@[^@\\s]+$", "description": "O e-mail com que o agente está registrado no gateway (agent_register)." }
       }
     },
     "model": { "type": "string", "pattern": "^claude-" },