npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.2 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (853) hide show

package/dist/esm/flows-actors/a2a/services/a2a.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"a2a.backend.service.js","sourceRoot":"","sources":["../../../../../../src/flows-actors/a2a/services/a2a.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,wEAAwE,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EACL,qCAAqC,GAEtC,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,6CAA6C,EAAE,MAAM,oFAAoF,CAAC;AACnJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kGAAkG,CAAC;AAElJ,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,kBAAkB,GAEnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAGrB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,qCAAqC,EACrC,4BAA4B,EAC5B,uBAAuB,GAExB,MAAM,mGAAmG,CAAC;AAC3G,OAAO,EACL,4BAA4B,GAE7B,MAAM,+EAA+E,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAwD3H;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,sCAAsC,GAAG;IAC7C,cAAc,EAAE,sBAAsB,CAAC,gBAAgB;IACvD,gBAAgB,EAAE,sBAAsB,CAAC,kBAAkB;IAC3D,WAAW,EAAE,sBAAsB,CAAC,aAAa;IACjD,mBAAmB,EAAE,sBAAsB,CAAC,qBAAqB;IACjE,cAAc,EAAE,sBAAsB,CAAC,gBAAgB;IACvD,kCAAkC,EAAE,sBAAsB,CAAC,gCAAgC;IAC3F,kCAAkC,EAAE,sBAAsB,CAAC,gCAAgC;IAC3F,mCAAmC,EAAE,sBAAsB,CAAC,iCAAiC;IAC7F,qCAAqC,EAAE,sBAAsB,CAAC,mCAAmC;IACjG,mFAAmF;IACnF,SAAS,EAAE,sBAAsB,CAAC,cAAc;CACQ,CAAC;AAmD3D;;;;;;GAMG;AACH,MAAM,oCAAoC,GAAwB,IAAI,GAAG,CAAC;IACxE,kCAAkC;IAClC,kCAAkC;IAClC,mCAAmC;IACnC,qCAAqC;CACO,CAAC,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAAC,MAAc;IAC9D,OAAO,oCAAoC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAiB9C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAE0B;IACoB;IACW;IACA;IACrB;IACA;IACJ;IACS;IACU;IAT/E,YACsD,MAAqB,EACD,mBAA+C,EACpC,uBAA8D,EAC9D,uBAA8D,EACnF,gBAAyC,EACzC,SAAkC,EACtC,YAA0B,EACjB,WAAyC,EAC/B,uBAAsE;QAR/F,WAAM,GAAN,MAAM,CAAe;QACD,wBAAmB,GAAnB,mBAAmB,CAA4B;QACpC,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC9D,4BAAuB,GAAvB,uBAAuB,CAAuC;QACnF,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,cAAS,GAAT,SAAS,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAAc;QACjB,gBAAW,GAAX,WAAW,CAA8B;QAC/B,4BAAuB,GAAvB,uBAAuB,CAA+C;IAClJ,CAAC;IAEJ;;;;OAIG;IACI,oBAAoB,CAAC,WAAoB;QAC9C,6FAA6F;QAC7F,iGAAiG;QACjG,+FAA+F;QAC/F,wFAAwF;QACxF,EAAE;QACF,kGAAkG;QAClG,yFAAyF;QACzF,OAAO,IAAI,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAClG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,yBAAyB,CAAC,WAAoB;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB;aACtC,SAAS,EAAE;aACX,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,CAAC,KAAK,CAAC;aACrF,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,mBAAmB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAElH,IAAI,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC/F,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,CAAC;QAC1C,IAAI,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC;QAClC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;OASG;IACI,cAAc,CAAC,WAAoB;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,iGAAiG;QACjG,kGAAkG;QAClG,kEAAkE;QAClE,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5H,MAAM,MAAM,GAAgB,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvF,EAAE,EAAE,MAAM,CAAC,GAAG;YACd,IAAI,EAAE,MAAM,CAAC,WAAW;YACxB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;SACxB,CAAC,CAAC,CAAC;QAEJ,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAExJ,OAAO;YACL,6FAA6F;YAC7F,mFAAmF;YACnF,eAAe,EAAE,oBAAoB;YACrC,0FAA0F;YAC1F,8FAA8F;YAC9F,6FAA6F;YAC7F,4CAA4C;YAC5C,mBAAmB,EAAE;gBACnB,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE;gBAC9E,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE;aACjF;YACD,IAAI,EAAE,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,IAAI,mBAAmB;YACvG,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,oDAAoD;YAC1F,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,OAAO;YAChB,2FAA2F;YAC3F,mEAAmE;YACnE,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,gCAAgC,EAAE;YACtF,iBAAiB,EAAE,CAAC,YAAY,CAAC;YACjC,kBAAkB,EAAE,CAAC,eAAe,CAAC;YACrC,MAAM;YACN,8EAA8E;YAC9E,gFAAgF;YAChF,iFAAiF;YACjF,kFAAkF;YAClF,eAAe,EAAE;gBACf,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE;wBACL,iBAAiB,EAAE;4BACjB,gBAAgB,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;4BAC5J,QAAQ;4BACR,MAAM,EAAE,EAAE;yBACX;wBACD,iBAAiB,EAAE;4BACjB,QAAQ;4BACR,MAAM,EAAE,EAAE;yBACX;qBACF;iBACF;aACF;YACD,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SAC3B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,QAAiB,EAAE,WAAoB;QACpF,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,8DAA8D,EAAE,CAAC;QACzG,CAAC;QAED,IAAI,IAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8EAA8E;YAC9E,8EAA8E;YAC9E,yEAAyE;YACzE,6EAA6E;YAC7E,oEAAoE;YACpE,6CAA6C;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4CAA4C,EAC5C,2BAA2B,CAAC,KAAK,CAAC,CACnC,CAAC;YACF,+FAA+F;YAC/F,6FAA6F;YAC7F,0FAA0F;YAC1F,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,8BAA8B,CACjC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EACnF,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,EAAE,CACvF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,4EAA4E,EAAE,CAAC;QACvH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,+DAA+D,EAAE,CAAC;QAC1G,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAAsB;QACtD,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzC,OAAO,4BAA4B,CACjC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACxD;YACE,YAAY;YACZ,cAAc,EAAE,kBAAkB,CAAC,GAAG;YACtC,YAAY,EAAE,0BAA0B;YACxC,aAAa,EAAE,qCAAqC;YACpD,cAAc,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc;SACrD,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAAsB;QACxD,OAAO,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACI,eAAe,CACpB,IAAsB,EACtB,MAAc,EACd,MAAyH,EACzH,YAAgC,EAChC,SAAkB;QAElB,+EAA+E;QAC/E,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,oBAAoB;eACvF,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,mBAAmB,CAAC;QAC/E,IAAI,SAAS;YAAE,OAAO;QAEtB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9C,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,2FAA2F;YAC3F,8FAA8F;YAC9F,eAAe;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,sEAAsE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9I,OAAO;QACT,CAAC;QAED,KAAK,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC;YAChD,YAAY;YACZ,8FAA8F;YAC9F,4FAA4F;YAC5F,qCAAqC;YACrC,mBAAmB,EAAE,MAAM;YAC3B,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,UAAU,EAAE,MAAM;YAClB,cAAc,EAAE,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACnE,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,+FAA+F;YAC/F,sGAAsG;YACtG,sGAAsG;YACtG,YAAY,EAAE,CAAC;YACf,uEAAuE;YACvE,SAAS,EAAE,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG;YACzG,WAAW;YACX,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc;YACjD,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa;SAChD,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,uDAAuD,EAAE;YACnG,MAAM;YACN,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAEM,kBAAkB,CACvB,IAAsB,EACtB,kBAA0B,EAC1B,MAAyB,EACzB,SAAkB;QAElB,IAAI,CAAC,SAAS,CAAC,gCAAgC,CAAC,IAAI,EAAE;YACpD,cAAc,EAAE,kBAAkB,CAAC,GAAG;YACtC,sFAAsF;YACtF,2DAA2D;YAC3D,kBAAkB;YAClB,mBAAmB,EAAE,sCAAsC,CAAC,MAAM,CAAC;YACnE,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,kBAAkB,CAAC,IAAsB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,YAAY,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACrF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,oBAAoB,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YACrG,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,mBAAmB,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACnG,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;OASG;IACI,sBAAsB,CAAC,OAAgB,EAAE,WAAoB;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,OAAO,6BAA6B,EAAE,CAAC;YAC1G,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,wCAAwC,EAAE,CAAC;QAC7G,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,wDAAwD,EAAE,CAAC;IACnG,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,OAAO,CAAC,MAkBpB;QACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;QAEnD,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,SAAkE,CAAC;QACvE;;;;;;WAMG;QACH,IAAI,YAAkE,CAAC;QAEvE,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,OAAO,GAAG,CAAC,KAAyB,EAAE,OAAgB,EAAQ,EAAE;YACpE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;YACrD,IAAI,KAAK,KAAK,kBAAkB,CAAC,oBAAoB,EAAE,CAAC;gBACtD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;gBACvD,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAChH,mFAAmF;oBACnF,iFAAiF;oBACjF,mFAAmF;oBACnF,yCAAyC;oBACzC,YAAY,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1E,CAAC;qBAAM,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC9B,SAAS,GAAG,OAAO,CAAC;gBACtB,CAAC;qBAAM,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;oBACvB,8EAA8E;oBAC9E,YAAY,IAAI,OAAO,CAAC;oBACxB,KAAK,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,KAAK,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;gBAC3D,SAAS,GAAG;oBACV,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;oBACzE,YAAY,EAAE,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,yCAAyC;iBAC9G,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEF,2FAA2F;QAC3F,uDAAuD;QACvD,IAAI,eAAmC,CAAC;QAExC,2EAA2E;QAC3E,0EAA0E;QAC1E,iCAAiC;QACjC,MAAM,IAAI,CAAC,uBAAuB,CAAC,4BAA4B,CAAC;YAC9D,yBAAyB,EAAE,MAAM,CAAC,WAAW;YAC7C,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC;YAChE,SAAS;YACT,WAAW,EAAE,SAAS;YACtB,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC/B,sEAAsE;YACtE,mEAAmE;YACnE,SAAS,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;YAClC,IAAI;YACJ,YAAY,EAAE,KAAK;YACnB,OAAO;YACP,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QAEH,6FAA6F;QAC7F,gGAAgG;QAChG,iGAAiG;QACjG,qDAAqD;QACrD,IAAI,eAAe,EAAE,CAAC;YACpB,KAAK,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,6FAA6F;YAC7F,kFAAkF;YAClF,EAAE;YACF,0FAA0F;YAC1F,4FAA4F;YAC5F,yFAAyF;YACzF,2FAA2F;YAC3F,4FAA4F;YAC5F,wFAAwF;YACxF,6FAA6F;YAC7F,EAAE;YACF,4FAA4F;YAC5F,8FAA8F;YAC9F,sFAAsF;YACtF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;gBAC1F,SAAS;gBACT,SAAS;gBACT,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;QACtD,yFAAyF;QACzF,4FAA4F;QAC5F,0FAA0F;QAC1F,uFAAuF;QACvF,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;IACpE,CAAC;CACF,CAAA;AAnfY,iBAAiB;IAD7B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IACrD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAChD,WAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;qCARC,aAAa;QACoB,0BAA0B;QACX,qCAAqC;QACrC,qCAAqC;QACjE,uBAAuB;QAC9B,uBAAuB;QACxB,YAAY;QACJ,4BAA4B;QACN,6CAA6C;GAV1I,iBAAiB,CAmf7B","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { randomUUID } from 'crypto';\n\nimport { A2A_Dialect } from '~wildo-backend-lib/flows-actors/a2a/models/a2a-dialect.backend.schemas';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { FlowsActorsRegistryService } from '~wildo-backend-lib/flows-actors/services/flows-actors-registry.service';\nimport {\n ConversationalExecutionBackendService,\n type ConversationalOwnerScope,\n} from '~wildo-backend-lib/flows-actors/services/conversational-execution.backend.service';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ResourceServerInstancesRegistryBackendService } from '~wildo-backend-lib/mcp/services/resource-server-instances-registry.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { recordExternalTokenAuthFailure } from '~wildo-backend-lib/security/authentications/services/utils/machine-auth-rate-limit.backend.utils';\nimport type { SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n Actor_ExecutionMode,\n CoreWebSocketEvent,\n ExecutionContext_ExecutionType,\n FlowActorSystem_Kind,\n MachineAccessOperation,\n MANUAL_CONTROLLER_ROUTES_URLS,\n ManualControllerRouteKey,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourceServerKind,\n type ActorSystem,\n} from '@wildo-ai/saas-models';\nimport {\n A2A_JSONRPC_TRANSPORT,\n A2A_PROTOCOL_VERSION,\n type A2A_AgentCard,\n type A2A_Skill,\n} from '~wildo-backend-lib/flows-actors/a2a/models/a2a.backend.schemas';\nimport {\n A2A_EXTERNAL_TURN_RATE_MAX,\n A2A_EXTERNAL_TURN_RATE_WINDOW_SECONDS,\n assertExternalTurnWithinRate,\n resolvePrincipalRateKey,\n type ExternalTurnRateDecision,\n} from '~wildo-backend-lib/security/authentications/services/utils/external-turn-rate-limit.backend.utils';\nimport {\n A2ATokenBudgetBackendService,\n type A2ATokenBudgetDecision,\n} from '~wildo-backend-lib/flows-actors/a2a/services/a2a-token-budget.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/*\n Outcome of authenticating an inbound A2A caller. Uses a STRING discriminant\n * (`kind`) rather than a boolean `ok` because this package compiles with\n * `strictNullChecks` off, under which TypeScript does not narrow boolean-literal\n * discriminated unions reliably.\n \n `owner` is the conversation owner scope resolved from the authenticated\n * principal — a user (`{ userId }`) or a machine (`{ organizationId }` /\n * `{ applicationId }`). It selects the persisted execution VARIANT.\n /\nexport type A2AAuthResult =\n \| { kind: 'ok'; auth: SocketAuthResult; owner: ConversationalOwnerScope }\n \| { kind: 'error'; errorMessage: string };\n\n/\n Outcome of running one A2A turn. String discriminant, same rationale as above.\n \n ## Why `awaiting-approval` is its own arm rather than a field on `ok`\n \n A turn that paused at a human-in-the-loop approval boundary produced NO answer — the model asked\n * permission and stopped. It is neither `ok` (there is nothing to reply with) nor `error` (nothing\n * failed). Modelling it as an optional field on `ok` would let every existing consumer keep\n * compiling while reporting a completed turn, which is precisely the defect shape this codebase has\n * hit repeatedly: an invariant applied at one of its call sites, the others silently recording a\n * terminal state for work that never happened.\n \n As a third arm, every site that consumes a turn is a COMPILE ERROR until it decides what a pause\n * means there — the three `runTurn` callers each needed a different answer, and a type is the only\n * thing that makes finding them not depend on remembering to look.\n /\nexport type A2ATurnResult =\n \| { kind: 'ok'; text: string; contextId: string }\n \| {\n /* The turn suspended awaiting a human decision; it will resume when one arrives. /\n kind: 'awaiting-approval';\n /* Correlates the decision back to the pending call — the client answers with this. /\n approvalId: string;\n /* The gated tool, so the transport can describe what is being asked. /\n toolName: string;\n contextId: string;\n }\n \| { kind: 'error'; errorCode: string; errorMessage: string };\n\n/* Outcome of resolving a target skill. String discriminant, same rationale. /\nexport type A2ASkillResolution =\n \| { kind: 'ok'; systemRef: string }\n \| { kind: 'error'; errorMessage: string };\n\n/* Callbacks the streaming (`message/stream`) transport supplies. /\nexport interface A2ATurnStreamHooks {\n /* A partial markdown delta of the agent's reply (SSE token stream). /\n onDelta?: (delta: string) => void;\n}\n\n/\n Backend service for the inbound Agent2Agent (A2A) transport. Exposes the app's\n * actor runtime to external agent callers WITHOUT reshaping the transport-agnostic\n * {@link ConversationalExecutionBackendService} — it is purely the identity /\n * ownership / protocol edge:\n \n - Agent card — advertises the exposable actor systems as A2A skills and the\n * OAuth2 security schemes a caller must satisfy. The card `url` is the agent's\n * canonical audience (RFC 8707 / external-access D7).\n * - Auth (D6, both principals) — the inbound Bearer token is authenticated by\n * the shared {@link ExecutionContextCreatorBackendService.authenticateExternalToken}\n * seam, which accepts EITHER a user-delegated `USER_REQUEST` token (the\n * conversation is owned by the delegating user → the `userFlowActorExecutions`\n * variant) OR a machine `client_credentials` token (`ORGANIZATION_MACHINE` /\n * `APPLICATION_MACHINE` → the `organization`/`applicationFlowActorExecutions`\n * variant). The turn runs with the caller's OWN roles/scope — never LLM- or\n * caller-supplied identity — via the same `SocketAuthResult` the WebSocket\n * transport uses; the conversation persists to the owner's variant.\n * - Audience binding — a user-delegated token's `aud` MUST equal this agent's\n * canonical URI; a machine token is resource-server-bound by `verifyMachineToken`\n * (a valid machine token for THIS API reaches this surface). See\n * `authenticateExternalToken` for the per-principal binding rationale.\n \n An inbound A2A `message/send` maps onto one conversational turn; the agent's\n * reply is returned as an A2A agent `Message`. `message/stream` forwards the token\n * deltas over SSE.\n /\n\n/\n A2A method → the audited machine-access operation.\n \n A `satisfies`-checked map rather than a ternary: the vocabulary is closed and now has\n * four members, so a conditional would silently mis-attribute any method added later.\n * Every externally-reachable A2A method must appear here — an unaudited one is an access\n * that happened with no record.\n \n semantic-literal-boundary: the keys are A2A protocol method names (JSON-RPC `method`\n * strings defined by the external spec, not by Wildo). This map is the thin adapter that\n * translates them into the internal `MachineAccessOperation` vocabulary; the literals must\n * not spread beyond it.\n /\nconst A2A_MACHINE_ACCESS_OPERATION_BY_METHOD = {\n 'message/send': MachineAccessOperation.A2A_MESSAGE_SEND,\n 'message/stream': MachineAccessOperation.A2A_MESSAGE_STREAM,\n 'tasks/get': MachineAccessOperation.A2A_TASKS_GET,\n 'tasks/resubscribe': MachineAccessOperation.A2A_TASKS_RESUBSCRIBE,\n 'tasks/cancel': MachineAccessOperation.A2A_TASKS_CANCEL,\n 'tasks/pushNotificationConfig/set': MachineAccessOperation.A2A_PUSH_NOTIFICATION_CONFIG_SET,\n 'tasks/pushNotificationConfig/get': MachineAccessOperation.A2A_PUSH_NOTIFICATION_CONFIG_GET,\n 'tasks/pushNotificationConfig/list': MachineAccessOperation.A2A_PUSH_NOTIFICATION_CONFIG_LIST,\n 'tasks/pushNotificationConfig/delete': MachineAccessOperation.A2A_PUSH_NOTIFICATION_CONFIG_DELETE,\n // 1.0-only: no v0.2.5 spelling exists, so these keys are the 1.0 names themselves.\n ListTasks: MachineAccessOperation.A2A_TASKS_LIST,\n} satisfies Record<A2A_MethodName, MachineAccessOperation>;\n\n/\n Every A2A JSON-RPC method this server answers.\n \n Named rather than inlined into the `satisfies` above so the closed vocabulary has ONE runtime\n * source, and so the dispatch site can be typed against the same union it audits against.\n \n ## The version note, because the names below are v0.2.5's and the shapes are 1.0's\n \n A2A 1.0 renames every method (`SendMessage`, `GetTask`, `CancelTask`, `SubscribeToTask`,\n * `CreateTaskPushNotificationConfig`, …). This surface still answers the v0.2.5 names, and the push\n * methods keep that vocabulary deliberately: shipping 1.0 names for the four new methods while\n * `tasks/get` and `tasks/cancel` kept the old ones would make the surface conformant to NEITHER\n * version. The DATA shapes follow 1.0 (see `a2a-push-notification.backend.schemas.ts`), because\n * that is where v0.2.5 is actually deficient — it never defined the webhook payload.\n \n Renaming the existing methods to the 1.0 vocabulary is a separate, larger unit: it touches every\n * method, every live lane, and every client. Tracked in `.claude/plans/a2a-surface-followups.md`.\n \n spec-cite: A2A 1.0 §5.3 (binding method table — the 1.0 JSON-RPC names) and the legacy anchors it\n * carries for the v0.2.5 names (e.g. `75-taskspushnotificationconfigset` on §3.1.7), which is what\n * makes the two vocabularies a published mapping rather than a guess.\n /\nexport type A2A_MethodName =\n // semantic-literal-boundary: these are the A2A specification's own JSON-RPC method names, not a\n // Wildo vocabulary — the wire strings a conformant client sends. Renaming a member here would not\n // rename anything, it would break conformance, so the union IS the translation boundary and there\n // is no runtime source to derive it from. The version split (v0.2.5 names for the existing methods,\n // the 1.0 name for `ListTasks`) is documented above and is a published mapping, not a guess.\n \| 'message/send'\n \| 'message/stream'\n \| 'tasks/get'\n \| 'tasks/cancel'\n \| 'tasks/resubscribe'\n \| 'tasks/pushNotificationConfig/set'\n \| 'tasks/pushNotificationConfig/get'\n \| 'tasks/pushNotificationConfig/list'\n \| 'tasks/pushNotificationConfig/delete'\n /\n A2A 1.0 only — v0.2.5 defines no equivalent, so this appears under its 1.0 name.\n \n `GetExtendedAgentCard` is deliberately ABSENT from this union and from the audit map: it is\n * refused unconditionally (we declare no extended card), so no access ever occurs and there is\n * nothing to record. A member here would describe an audit row that can never be written.\n /\n \| 'ListTasks';\n\n/* The four push-notification-configuration methods, as their own union. /\nexport type A2A_PushNotificationConfigMethod = Extract<A2A_MethodName, `tasks/pushNotificationConfig/${string}`>;\n\n/\n The four push-notification-configuration methods, as a runtime set.\n \n Typed against the union above so it cannot drift from it, and used at the dispatch site to apply\n * the §3.3.4 capability gate to all four at once — the alternative, four `\|\|`-joined comparisons,\n * is exactly the shape that acquires a fifth method without acquiring its gate.\n /\nconst A2A_PUSH_NOTIFICATION_CONFIG_METHODS: ReadonlySet<string> = new Set([\n 'tasks/pushNotificationConfig/set',\n 'tasks/pushNotificationConfig/get',\n 'tasks/pushNotificationConfig/list',\n 'tasks/pushNotificationConfig/delete',\n] satisfies A2A_PushNotificationConfigMethod[]);\n\n/\n Narrow a raw JSON-RPC `method` string to the push-configuration union.\n \n A type PREDICATE, not a set membership test the caller then casts through. The distinction is the\n * whole point: review finding G3-3 recorded that a cast at the dispatch site defeats the\n * `satisfies`-checked audit map — the method type-checks, resolves to `undefined` in the map, and\n * produces an access with no audit row. A predicate makes the compiler carry the narrowing into\n * `handleTaskMethod`, so a method that is not in the audited union cannot be dispatched there at all.\n /\nexport function isA2APushNotificationConfigMethod(method: string): method is A2A_PushNotificationConfigMethod {\n return A2A_PUSH_NOTIFICATION_CONFIG_METHODS.has(method);\n}\n\n/\n Whether this agent advertises — and therefore honours — webhook task updates.\n \n ONE constant, read by both the agent card and the dispatch gate. They are two call sites of a\n * single invariant (\"what the card promises is what the methods do\"), and hand-maintaining the\n * answer in both places is how a card comes to advertise a capability whose methods answer\n * `-32003`, or worse, the reverse: methods that quietly work while the card says they do not, so no\n * client ever calls them and the whole feature is dead code nobody notices.\n \n Turned `true` on 2026-08-09 on UNIT evidence; turned back to `false` on 2026-08-11 when the live\n * lane finally ran and found delivery inert; turned `true` again the same day once the cause was fixed\n * and the lane observed durable delivery rows. The middle step was not ceremony — it is what the\n * previous revision of this comment prescribed, and doing it kept the card honest for the hour between\n * discovering the defect and fixing it.\n \n ## The defect this constant caught, kept because the shape recurs\n \n ### Why it was `false` for an hour: DELIVERY WAS BROKEN, measured, not suspected\n \n `examples/wonder-todos/e2e/a2a-push-notifications.e2e.ts` drove two REAL transitions on tasks that\n * each carried a registered webhook (one organization-scoped, one user-scoped via the approval pause),\n * asserted that each cancel was ACCEPTED, and found zero delivery rows in all three variants. The\n * backend log names the cause once per configured webhook:\n \n resources_registry_operation_path_not_found\n * { resourceType: \"userA2aPushDeliveryLog\", operationIdentifier: \"create\" }\n \n `A2APushDeliveryLogRepository` writes through `SystemAccessBackendService`\n * (`createAsSystem` / `updateAsSystem`), which resolves its operation via\n * `getServiceOperationPathDefault` — admitting only `SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES`\n * (`INTERNAL_CALL` plus the URL-bearing pair). The delivery-log resource declared CREATE and UPDATE as\n * `REPOSITORY_ONLY`, which is in neither set. So every write threw, the dispatcher's no-throw\n * contract swallowed it at WARN, and the feature was inert end to end: no row opened, no job enqueued,\n * nothing for the worker to claim. Reads worked throughout — READ is `API_CALL` — which is exactly why\n * the configuration plane looked healthy.\n \n Two intentional decisions that were jointly unsatisfiable, not a typo: \"a delivery row is EVIDENCE,\n * so its writes never leave the repository tier\" and \"the repository writes through\n * `SystemAccessBackendService`\". `AsSystem` IS the service tier. See\n `SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES`, whose own JSDoc predicts this defect class verbatim\n * and records that it had already shipped once (the `USERS` retention opt-in).\n \n ### The fix, and the one that was NOT taken\n \n CREATE and UPDATE on the delivery log are now `INTERNAL_CALL` instead of `REPOSITORY_ONLY`. Both are\n * route-less, so no HTTP surface was opened and the \"a client must not be able to fabricate delivery\n * evidence\" property is untouched; only the TIER that can reach the op changed. This is the same\n * recipe already applied to the SSO and SCIM lazy-creates, and the sibling `flows-actors-task` config —\n * written by this same runtime through `AsSystem` — states the rule outright: \"INTERNAL_CALL (not\n REPOSITORY_ONLY) is mandatory\".\n \n An earlier revision of this comment prescribed the opposite fix — moving the repository to the\n * repository tier — and argued that `INTERNAL_CALL` would \"reverse the resource's stated decision that\n * these writes never leave the repository tier\". *That was wrong and is recorded rather than quietly\n deleted*, because the mistake is instructive: the stated decision was about EXPOSURE (no external\n caller may author evidence), and route-lessness delivers that under either variant. Conflating\n * \"route-less\" with \"repository-tier\" is what authored the bug in the first place, and it very nearly\n * authored the fix as well.\n \n ### What made it `true` again\n \n The live lane observed the durable rows: one per registered webhook, carrying the destination\n * captured at dispatch, the isolation axes and the dedup id, with the worker claiming and attempting\n * each. NOT unit tests — the unit pins were green and mutation-proven throughout the eleven days this\n * was broken, because they stub the repository and therefore cannot see which tier it writes at.\n \n Flipping this is a deliberate act that reddens G-6 in whichever direction it moves — do it only with\n * a live green D-section, never on the strength of the suite alone.\n /\nexport const A2A_PUSH_NOTIFICATIONS_SUPPORTED = true;\n\n/\n The A2A methods that emit a `MACHINE_ACCESS` audit — DERIVED from the map above rather\n * than restated, so the two can never drift apart.\n \n Every consumer that forwards a method into {@link A2ABackendService.auditMachineAccess}\n * types its own parameter as this. That is what makes an unaudited method a COMPILE error\n * instead of a runtime one: review finding G3-3 showed `handleTaskMethod` taking a bare\n * `string` and casting at the call site, which meant adding a fifth method (`tasks/resubscribe`)\n * type-checked cleanly, resolved to `undefined` in the map, failed the emit's required\n * `operationIdentifier` at Zod validation, and was swallowed by the fire-and-forget `.catch()` —\n * an unaudited access, which is exactly the failure the map claims to prevent.\n /\nexport type A2A_AuditedMethod = keyof typeof A2A_MACHINE_ACCESS_OPERATION_BY_METHOD;\n\n@injectable()\nexport class A2ABackendService {\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.FlowsActorsRegistryService) private readonly flowsActorsRegistry: FlowsActorsRegistryService,\n @inject(SAAS_SERVICE_TYPES.ConversationalExecutionBackendService) private readonly conversationalExecution: ConversationalExecutionBackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogs: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.A2ATokenBudgetService) private readonly tokenBudget: A2ATokenBudgetBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourceServerInstancesRegistry) private readonly resourceServerInstances: ResourceServerInstancesRegistryBackendService,\n ) {}\n\n /\n The agent's canonical URI = the absolute A2A task-endpoint URL. Doubles as\n * the audience a user-delegated inbound token must carry (RFC 8707). `undefined`\n * when the app public base URL is unresolvable (→ the transport fails closed).\n /\n public resolveAgentAudience(instanceRef?: string): string \| undefined {\n // Delegate to the single audience authority: the token MINT validates a requested `resource`\n // against `resolveResourceServerAudience(A2A)`, and THIS is the verify-side `callerAudience` the\n // A2A arm enforces — deriving both from one function makes \"mint and verify cannot drift\" TRUE\n // by construction (rather than by three parallel `${apiAudience}${route}` expressions).\n //\n // R-2: a NAMED agent instance carries its own audience (`…/a2a/<ref>`), so a token minted for one\n // agent is rejected at another — agents are separate resource servers, not views of one.\n return this.appConfigService.resolveResourceServerAudience(ResourceServerKind.A2A, instanceRef);\n }\n\n /\n The ACTOR systems this app exposes over A2A: those with an AGENTIC actor bound\n * to an agent (i.e. the exact set the conversational runtime can actually serve).\n * FLOW systems and agent-less actor systems are excluded — advertising a skill we\n * cannot run would be a lie in the agent card.\n \n R-2 instance semantics, deliberately FAIL-CLOSED (this mirrors the MCP twin\n * `isOnMcpServerInstance`, which returns `false` for an unresolvable instance rather than falling\n * back to the full catalog):\n \n - no `instanceRef` ⇒ the DEFAULT agent: every runnable system. The registry is never consulted,\n * so declaring agents stays purely additive.\n * - a declared agent with `actorSystemRefs` ⇒ exactly that subset.\n * - a declared agent with NO `actorSystemRefs` ⇒ every runnable system (\"no restriction\"). The\n * schema forbids an EMPTY list precisely so this reading is unambiguous: omitted means all, and a\n * present list always names at least one system.\n * - an UNRESOLVABLE ref ⇒ NOTHING. Previously this returned every runnable system, so a\n * deleted or mistyped agent ref silently produced a card advertising the app's ENTIRE skill set —\n * the exact opposite of the curation the caller asked for, and a widening failure on a surface whose\n * whole purpose is to narrow. The transports 404 an unknown ref before reaching here, so an empty\n * result is unreachable in practice; it is the fail-closed answer if that guard is ever bypassed.\n /\n public listExposableActorSystems(instanceRef?: string): ActorSystem[] {\n const runnable = this.flowsActorsRegistry\n .getActors()\n .filter((system): system is ActorSystem => system.kind === FlowActorSystem_Kind.ACTOR)\n .filter((system) => system.actors.some((a) => a.executionMode === Actor_ExecutionMode.AGENTIC && !!a.agentRef));\n\n if (!instanceRef) return runnable;\n const agent = this.resourceServerInstances.tryGetInstance(ResourceServerKind.A2A, instanceRef);\n if (!agent) return [];\n const allowedRefs = agent.actorSystemRefs;\n if (!allowedRefs) return runnable;\n return runnable.filter((system) => allowedRefs.includes(system.ref));\n }\n\n /\n Build the served A2A agent card, or `null` when the agent audience is\n * unresolvable (the controller then returns 503). Each exposable actor system becomes an A2A skill\n * (`skill.id === systemRef`).\n \n One card per AGENT: the DEFAULT agent (no `instanceRef`) carries the app-level identity and every\n * runnable skill, while each declared instance carries its own `displayName`/`description`, its own\n * `url` (== its own RFC 8707 audience) and only its `actorSystemRefs` subset — so a client that reads\n * a named card obtains a token scoped to THAT agent and nothing else.\n /\n public buildAgentCard(instanceRef?: string): A2A_AgentCard \| null {\n const audience = this.resolveAgentAudience(instanceRef);\n if (!audience) return null;\n // R-2: a named agent identifies itself with its OWN declared name/description; the default agent\n // keeps the app-level identity. `url` is always this agent's own audience, so a client that reads\n // the card obtains a token scoped to THIS agent and nothing else.\n const instance = instanceRef ? this.resourceServerInstances.tryGetInstance(ResourceServerKind.A2A, instanceRef) : undefined;\n\n const skills: A2A_Skill[] = this.listExposableActorSystems(instanceRef).map((system) => ({\n id: system.ref,\n name: system.displayName,\n description: system.description,\n tags: system.tags ?? [],\n }));\n\n const tokenUrl = `${this.appConfigService.resolveApiResourceAudience()}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]}`;\n\n return {\n // The legacy scalar, still `0.2.5` on purpose — see the field's JSDoc. A v0.2.5 client reads\n // ONLY this, and that is the version its dialect of this surface genuinely speaks.\n protocolVersion: A2A_PROTOCOL_VERSION,\n // 1.0 FIRST: the list is ordered by preference, so this is how the agent says \"prefer the\n // current norm\" while remaining reachable to clients that only know the old one. Both entries\n // point at the SAME url — the dialect is carried by the method name, not by the endpoint, so\n // there is no second route to keep in sync.\n supportedInterfaces: [\n { url: audience, transport: A2A_JSONRPC_TRANSPORT, version: A2A_Dialect.V1_0 },\n { url: audience, transport: A2A_JSONRPC_TRANSPORT, version: A2A_Dialect.V0_2_5 },\n ],\n name: instance?.displayName ?? this.appConfigService.config.appIdentity?.appName ?? 'Wildo Application',\n description: instance?.description ?? 'Actor systems exposed as Agent2Agent (A2A) skills.',\n url: audience,\n version: '1.0.0',\n // Read from the shared constant, never restated — see A2A_PUSH_NOTIFICATIONS_SUPPORTED for\n // why the card and the dispatch gate must not be able to disagree.\n capabilities: { streaming: true, pushNotifications: A2A_PUSH_NOTIFICATIONS_SUPPORTED },\n defaultInputModes: ['text/plain'],\n defaultOutputModes: ['text/markdown'],\n skills,\n // Both D6 principals: authorizationCode (user-delegated → user-owned session)\n // and clientCredentials (machine → org/app-owned session). The token endpoint +\n // JWKS are the app's OIDC provider surfaces. Callers request a token whose `aud`\n // (RFC 8707 `resource`) is THIS card's `url` (user) / the API resource (machine).\n securitySchemes: {\n oauth2: {\n type: 'oauth2',\n flows: {\n authorizationCode: {\n authorizationUrl: `${this.appConfigService.resolveApiResourceAudience()}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]}`,\n tokenUrl,\n scopes: {},\n },\n clientCredentials: {\n tokenUrl,\n scopes: {},\n },\n },\n },\n },\n security: [{ oauth2: [] }],\n };\n }\n\n /\n Authenticate an inbound A2A caller from its Bearer token (D6 — user-delegated\n * OR machine). Delegates verification + principal resolution to the shared\n * {@link ExecutionContextCreatorBackendService.authenticateExternalToken} seam\n * (audience binding, machine vs user), then maps the authenticated principal to\n * the conversation owner scope that selects the persisted execution variant.\n \n R-2: the token must be audience-bound to the AGENT INSTANCE it was presented to, so a token\n * minted for another agent (or for the default one) is rejected here — agents are separate\n * resource servers.\n /\n public async authenticateCaller(token: string, clientIp?: string, instanceRef?: string): Promise<A2AAuthResult> {\n const expectedAudience = this.resolveAgentAudience(instanceRef);\n if (!expectedAudience) {\n return { kind: 'error', errorMessage: 'A2A agent audience is not resolvable (app public URL unset).' };\n }\n\n let auth: SocketAuthResult;\n try {\n auth = await this.executionContextCreator.authenticateExternalToken(token, expectedAudience);\n } catch (error) {\n // `authenticateExternalToken` rejects with a `WildoError_Backend`, which is a\n // plain object rather than an `Error` — an `instanceof Error` ternary sent it\n // down the `String(...)` branch and logged every A2A auth failure as the\n // literal `'[object Object]'`, erasing WHY the token was refused (expired vs\n // wrong audience vs bad signature) on a security surface where that\n // distinction is the whole diagnostic value.\n this.logger.warn(\n '[A2A] Inbound caller authentication failed',\n projectCaughtErrorLogFields(error),\n );\n // SIEM-2 symmetry (S2): feed the shared per-IP failure counter + emit MACHINE_AUTH_FAILED so a\n // revoked/expired/forged token rejected at /a2a is visible to the SIEM (was invisible — only\n // the token-MINT endpoint audited failures). Fire-and-forget; never blocks the rejection.\n if (clientIp) {\n void recordExternalTokenAuthFailure(\n { redisService: this.redisService, logger: this.logger, auditLogs: this.auditLogs },\n { clientIp, resourceServer: ResourceServerKind.A2A, reason: 'external_token_invalid' },\n );\n }\n return { kind: 'error', errorMessage: 'The access token is invalid, expired, or not audience-bound to this agent.' };\n }\n\n const owner = this.ownerScopeFromAuth(auth);\n if (!owner) {\n return { kind: 'error', errorMessage: 'The authenticated token carries no resolvable owner identity.' };\n }\n return { kind: 'ok', auth, owner };\n }\n\n /\n Per-PRINCIPAL turn throttle for this agent (LLM-spend guard). An A2A agent turn runs the\n * LLM runtime, so an authenticated caller holding one valid token could otherwise drive\n * unbounded model spend; this caps turns-per-window per principal. Covers BOTH `message/send`\n * and `message/stream` (one turn each) — the controller calls it once before dispatch and\n * maps `rate_limited` to a transport-level 429. Fails OPEN (a limiter outage never breaks the\n * endpoint); see {@link assertExternalTurnWithinRate} for the fail-open + cost rationale. An\n * unkeyable principal (defensive — auth already fails closed without an owner id) is not\n * throttled.\n /\n public async assertTurnWithinRate(auth: SocketAuthResult): Promise<ExternalTurnRateDecision> {\n const principalKey = resolvePrincipalRateKey(auth);\n if (!principalKey) return { kind: 'ok' };\n return assertExternalTurnWithinRate(\n { redisService: this.redisService, logger: this.logger },\n {\n principalKey,\n resourceServer: ResourceServerKind.A2A,\n maxPerWindow: A2A_EXTERNAL_TURN_RATE_MAX,\n windowSeconds: A2A_EXTERNAL_TURN_RATE_WINDOW_SECONDS,\n applicationEnv: this.appConfigService.applicationEnv,\n },\n );\n }\n\n /\n Per-TENANT LLM token-budget gate (sustained spend control) — the complement to\n * {@link assertTurnWithinRate}'s per-principal BURST cap. Resolves the owner's plan-granted token\n * allowance and denies once the current period's accumulated consumption reaches it. Delegates to\n * {@link A2ATokenBudgetBackendService}; see that class for the deliberate fail-open (allowance\n * unresolvable → allow, budgeting is opt-in) vs fail-closed (budget configured but consumption\n * unverifiable → deny) split. The controller maps a denial to HTTP 402 / `BUDGET_EXCEEDED`.\n /\n public async assertTurnWithinBudget(auth: SocketAuthResult): Promise<A2ATokenBudgetDecision> {\n return this.tokenBudget.assertTurnWithinBudget(auth);\n }\n\n /\n SIEM-2: emit a per-request MACHINE_ACCESS audit for an authenticated A2A caller (fire-and-forget).\n * Normalises the A2A JSON-RPC method to a stable {@link MachineAccessOperation} (so A2A + MCP share\n * one audit vocabulary) and delegates the principal→audit shaping + F4 org routing to the single\n * source of truth {@link AuditLogsBackendService.logMachineResourceAccessFromAuth} — which no-ops\n * for user-delegated turns (a human action) and emits only for machine principals.\n /\n /\n Audit an A2A TASK-method access, for EITHER principal kind (review finding A3-7).\n \n ## Why this exists rather than calling `auditMachineAccess` alone\n \n `logMachineResourceAccessFromAuth` returns early for anything that is not a machine, with the\n * comment \"user-delegated turns are audited as human actions, not machine access\". For the task\n * methods that was not true: a user-delegated `tasks/get` or `tasks/cancel` produced only the\n * runtime-attributed `SYSTEM_CONTEXT_READ`/`SYSTEM_CONTEXT_WRITE` that `readAsSystem` emits, and\n * NOTHING naming the human. So the G2-1 remediation — which existed to stop an external principal\n * reading and cancelling a tenant's work with no record — closed only the machine half.\n \n A delegated token is a HUMAN acting through an agent, and `tasks/cancel` in particular destroys\n * in-flight work. `RESOURCE_OPERATION_PERFORMED` is the framework's human-attributed access event,\n * so the delegated arm emits that with the real actor on the row.\n \n Fire-and-forget, like every emitter on this path: auditing must never fail the request it\n * observes. Emitted BEFORE the read, so an attempt on a task the caller cannot see is recorded too.\n /\n public auditTaskAccess(\n auth: SocketAuthResult,\n taskId: string,\n method: Extract<A2A_AuditedMethod, 'tasks/get' \| 'tasks/cancel' \| 'tasks/resubscribe'> \| A2A_PushNotificationConfigMethod,\n resourceType: string \| undefined,\n ipAddress?: string,\n ): void {\n // Machine principals: unchanged, and the single source of truth still decides.\n this.auditMachineAccess(auth, taskId, method, ipAddress);\n\n const isMachine = auth.executionType === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE\n \|\| auth.executionType === ExecutionContext_ExecutionType.APPLICATION_MACHINE;\n if (isMachine) return;\n\n const actorUserId = auth.initiatorIds?.userId;\n if (!actorUserId \|\| !resourceType) {\n // Neither branch can name what it would record. Warn rather than emit a row whose actor or\n // subject is blank — an unattributable audit row is worse than a logged gap, because it reads\n // as evidence.\n this.logger.warn?.('[A2A] Task access could not be attributed for the human-action audit', { method, hasActor: !!actorUserId, resourceType });\n return;\n }\n\n void this.auditLogs.logResourceOperationPerformed({\n resourceType,\n // The A2A verb, not a core CRUD name: `tasks/cancel` is what the caller actually invoked, and\n // collapsing it to `update` would make a destructive protocol verb indistinguishable in the\n // trail from an ordinary field edit.\n operationIdentifier: method,\n variantType: ResourceOperationVariantType.API_CALL,\n resourceId: taskId,\n initiatorRoles: (auth.initiatorRoles ?? []).flatMap((r) => r.roles),\n executionType: auth.executionType,\n // Single-shot task methods with no cascade, so the depth is always the caller's own frame. The\n // request-correlation id is hoisted to the audit row's top-level `correlationId` by `_createAuditLog`\n // (from the ambient request-context frame), which correlates this row to its actual A2A HTTP request.\n subCallDepth: 0,\n // `tasks/cancel` destroys in-flight work; `tasks/get` merely observes.\n riskLevel: method === 'tasks/cancel' ? ResourceOperationRiskLevel.MEDIUM : ResourceOperationRiskLevel.LOW,\n actorUserId,\n organizationId: auth.initiatorIds?.organizationId,\n applicationId: auth.initiatorIds?.applicationId,\n }).catch((auditError) => this.logger.warn?.('[A2A] Task-access human audit emit failed (non-fatal)', {\n method,\n ...projectCaughtErrorLogFields(auditError),\n }));\n }\n\n public auditMachineAccess(\n auth: SocketAuthResult,\n resourceIdentifier: string,\n method: A2A_AuditedMethod,\n ipAddress?: string,\n ): void {\n this.auditLogs.logMachineResourceAccessFromAuth(auth, {\n resourceServer: ResourceServerKind.A2A,\n // For the message methods this is the target actor system; for the task methods it is\n // the task id, which is the thing actually being accessed.\n resourceIdentifier,\n operationIdentifier: A2A_MACHINE_ACCESS_OPERATION_BY_METHOD[method],\n ipAddress,\n });\n }\n\n /\n Map an authenticated principal to its conversation owner scope. USER_REQUEST →\n * `{ userId }`; the two machine principals → `{ organizationId }` / `{ applicationId }`.\n * Returns `undefined` when the expected owner id is missing (fail-closed).\n \n MULTI-ORG NOTE (parity with the MCP `contextIds` path): a user-delegated turn is owned by\n * `{ userId }`, so the conversation itself is unambiguous. The ACTIVE ORGANIZATION is a separate\n * axis, and A2A still has no per-request channel for the caller to select one — but since\n * 2026-07-31 it no longer needs one in the common case: `authenticateExternalToken` derives the\n * active org from the delegating OAuth client's OWN tenant (`azp` → org-scoped client →\n * organizationId). A multi-org member acting through an org's agent client is therefore correctly\n * scoped AND correctly billed, where previously such a turn carried no org at all — denying every\n * org-scoped resource operation while its token spend went uncapped.\n \n A turn still carries no active org when the delegating client is APPLICATION-scoped (no tenant to\n * pin — binding one at the authorize endpoint is the deferred extension), when the user has no\n * memberships, or when the client's pinned org is not one of the user's (deliberately declined\n * rather than substituted). Org-scoped operations continue to fail closed in those cases, and the\n * token budget's own guard covers the spend axis independently.\n /\n private ownerScopeFromAuth(auth: SocketAuthResult): ConversationalOwnerScope \| undefined {\n const ids = auth.initiatorIds;\n if (!ids) return undefined;\n if (auth.executionType === ExecutionContext_ExecutionType.USER_REQUEST && ids.userId) {\n return { userId: ids.userId };\n }\n if (auth.executionType === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE && ids.organizationId) {\n return { organizationId: ids.organizationId };\n }\n if (auth.executionType === ExecutionContext_ExecutionType.APPLICATION_MACHINE && ids.applicationId) {\n return { applicationId: ids.applicationId };\n }\n return undefined;\n }\n\n /\n Resolve the target actor system for a turn. A caller selects a skill via\n * `metadata.skillId`; when omitted AND exactly one system is exposed, that one\n * is used (the common single-agent app). Otherwise the caller must name a skill.\n \n R-2: resolution is scoped to the AGENT instance the request arrived on, so a `skillId` outside\n * that agent's declared subset is rejected exactly like an unknown skill — the card and the\n * dispatch gate advertise/accept the same set (a named agent cannot be used as a side-door into\n * another agent's actor system).\n /\n public resolveTargetSystemRef(skillId?: string, instanceRef?: string): A2ASkillResolution {\n const exposable = this.listExposableActorSystems(instanceRef);\n if (skillId) {\n const match = exposable.find((s) => s.ref === skillId);\n if (!match) return { kind: 'error', errorMessage: `No A2A skill '${skillId}' is exposed by this agent.` };\n return { kind: 'ok', systemRef: match.ref };\n }\n if (exposable.length === 1) return { kind: 'ok', systemRef: exposable[0].ref };\n if (exposable.length === 0) return { kind: 'error', errorMessage: 'This agent exposes no runnable skills.' };\n return { kind: 'error', errorMessage: 'Multiple skills are exposed; specify metadata.skillId.' };\n }\n\n /\n Run one A2A turn against the conversational runtime under the caller's OWN\n * context (user or machine principal). Returns the agent's full reply (blocking)\n * or an error. When `hooks.onDelta` is supplied, partial markdown deltas are\n * forwarded live (SSE streaming) while the final text is still returned. The\n * conversation persists to the owner's variant (`owner` selects it).\n /\n public async runTurn(params: {\n auth: SocketAuthResult;\n owner: ConversationalOwnerScope;\n systemRef: string;\n text: string;\n contextId?: string;\n /* The agent this turn arrived through — forwarded so the conversation records its origin. /\n instanceRef?: string;\n hooks?: A2ATurnStreamHooks;\n /\n Cancellation signal for the turn. Two transports supply one, for different reasons:\n * `blocking: false` task turns wire it to `tasks/cancel` (addressable by task id), and\n * `message/stream` wires it to the SSE socket closing — that path owns no task, so the\n * client's connection IS its cancellation channel. Reaches AI-SDK `streamText`, so it aborts\n * the multi-step tool loop, not just the text stream. The blocking `message/send` path passes\n * none: it holds the response open, so there is no disconnect to observe separately.\n /\n abortSignal?: AbortSignal;\n }): Promise<A2ATurnResult> {\n const { auth, owner, systemRef, text, hooks } = params;\n const contextId = params.contextId ?? randomUUID();\n\n let finalText = '';\n let streamedText = '';\n let turnError: { errorCode: string; errorMessage: string } \| undefined;\n /\n Set when the turn suspended for a human decision instead of answering.\n \n Read off the emitted PROGRESS payload rather than through a new return channel: the pause is\n * ALREADY announced on the transport-agnostic emitter (that is how the WebSocket plane learns\n * of it), so keying on the same event keeps one announcement rather than two that can disagree.\n */\n let turnApproval: { approvalId: string; toolName: string } \| undefined;\n\n // Transport-agnostic emitter: capture the terminal assistant message + any\n // error, and forward deltas to the SSE hook when streaming.\n const emitter = (event: CoreWebSocketEvent, payload: unknown): void => {\n const p = (payload ?? {}) as Record<string, unknown>;\n if (event === CoreWebSocketEvent.FLOWS_ACTORS_MESSAGE) {\n const content = typeof p.content === 'string' ? p.content : '';\n const data = (p.data ?? {}) as Record<string, unknown>;\n if (data.approvalRequested === true && typeof data.approvalId === 'string' && typeof data.toolName === 'string') {\n // A pause, not an answer. Captured BEFORE the delta arms below because an approval\n // progress payload carries no `messageId` and would otherwise fall through as an\n // ordinary tool-status frame — i.e. be dropped, leaving the turn indistinguishable\n // from one that simply produced no text.\n turnApproval = { approvalId: data.approvalId, toolName: data.toolName };\n } else if (p.isFinal === true) {\n finalText = content;\n } else if (p.messageId) {\n // A streamed answer delta (tool-status progress payloads carry no messageId).\n streamedText += content;\n hooks?.onDelta?.(content);\n }\n } else if (event === CoreWebSocketEvent.FLOWS_ACTORS_ERROR) {\n turnError = {\n errorCode: typeof p.errorCode === 'string' ? p.errorCode : 'AGENT_FAILED',\n errorMessage: typeof p.errorMessage === 'string' ? p.errorMessage : 'The agent failed to produce a response.',\n };\n }\n };\n\n // Token usage is only knowable AFTER the agent stream drains, so the runtime hands it back\n // through this sink rather than the per-delta emitter.\n let turnTotalTokens: number \| undefined;\n\n // `startConversationalExecution` never throws — it runs the whole turn and\n // reports every failure through the emitter, so inspecting captured state\n // after the await is sufficient.\n await this.conversationalExecution.startConversationalExecution({\n resourceServerInstanceRef: params.instanceRef,\n onUsage: ({ totalTokens }) => { turnTotalTokens = totalTokens; },\n systemRef,\n executionId: contextId,\n initialInput: { message: text },\n // The caller's server-verified identity (never LLM-supplied). Machine\n // principals always carry initiatorIds; the fallback is defensive.\n initiator: auth.initiatorIds ?? {},\n auth,\n scopeContext: owner,\n emitter,\n abortSignal: params.abortSignal,\n });\n\n // Accumulate this turn's tokens against the PAYING TENANT's period budget (resolved from the\n // principal, not the conversation owner — a delegated turn is paid by the user's organization).\n // Deliberately AFTER the turn (usage is only known once the agent finished) and fire-and-forget:\n // metering must never fail a turn we already served.\n if (turnTotalTokens) {\n void this.tokenBudget.recordTurnTokens(auth, turnTotalTokens);\n } else {\n // UNMETERABLE TURN. The provider reported no usage — the agent transport does not surface it\n // (CLI / image agents), or the invocation failed after the model had already run.\n //\n // A THIRD cause used to belong here and no longer does (review gate #2, F-A): a CANCELLED\n // turn. `result.usage` rejects on an aborted stream, so the throw skipped `reportUsage` and\n // every cancellation landed in this branch — which made cancelling a way to consume real\n // provider spend while the tenant's budget never moved, repeatable on demand. Fixed at the\n // source: `streamTextToDeltas` now accumulates per-step usage that survives the abort, so a\n // cancelled turn meters the steps that completed. If cancellations start appearing here\n // again, that accumulator has regressed — do not simply widen this comment to re-admit them.\n //\n // Either way this turn consumed spend that the budget cannot see, so a capped tenant drifts\n // above its allowance silently. Logged rather than denied: refusing would disable whole agent\n // transports for budgeted tenants, which is a product decision, not one to take here.\n this.logger.warn('[A2A] Turn produced no LLM usage — not metered against the token budget', {\n systemRef,\n contextId,\n executionType: auth.executionType,\n });\n }\n\n if (turnError) return { kind: 'error', ...turnError };\n // Ordered AFTER the error arm deliberately: a turn that suspended and then failed on the\n // persistence write has an error to report and no resumable pause, so the error wins. It is\n // ordered BEFORE the ok arm because a pause with partial streamed text is still a pause —\n // answering with that text would present a half-finished thought as the agent's reply.\n if (turnApproval) return { kind: 'awaiting-approval', ...turnApproval, contextId };\n return { kind: 'ok', text: finalText \|\| streamedText, contextId };\n }\n}\n"]}
1	+ {"version":3,"file":"a2a.backend.service.js","sourceRoot":"","sources":["../../../../../../src/flows-actors/a2a/services/a2a.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,wEAAwE,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,wEAAwE,CAAC;AACpH,OAAO,EACL,qCAAqC,GAEtC,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,qCAAqC,EAAE,MAAM,+EAA+E,CAAC;AACtI,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,6CAA6C,EAAE,MAAM,oFAAoF,CAAC;AACnJ,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACnF,OAAO,EAAE,8BAA8B,EAAE,MAAM,kGAAkG,CAAC;AAElJ,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,8BAA8B,EAC9B,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,0BAA0B,EAC1B,4BAA4B,EAC5B,kBAAkB,GAEnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GAGrB,MAAM,gEAAgE,CAAC;AACxE,OAAO,EACL,0BAA0B,EAC1B,qCAAqC,EACrC,4BAA4B,EAC5B,uBAAuB,GAExB,MAAM,mGAAmG,CAAC;AAC3G,OAAO,EACL,4BAA4B,GAE7B,MAAM,+EAA+E,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAwD3H;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,sCAAsC,GAAG;IAC7C,cAAc,EAAE,sBAAsB,CAAC,gBAAgB;IACvD,gBAAgB,EAAE,sBAAsB,CAAC,kBAAkB;IAC3D,WAAW,EAAE,sBAAsB,CAAC,aAAa;IACjD,mBAAmB,EAAE,sBAAsB,CAAC,qBAAqB;IACjE,cAAc,EAAE,sBAAsB,CAAC,gBAAgB;IACvD,kCAAkC,EAAE,sBAAsB,CAAC,gCAAgC;IAC3F,kCAAkC,EAAE,sBAAsB,CAAC,gCAAgC;IAC3F,mCAAmC,EAAE,sBAAsB,CAAC,iCAAiC;IAC7F,qCAAqC,EAAE,sBAAsB,CAAC,mCAAmC;IACjG,mFAAmF;IACnF,SAAS,EAAE,sBAAsB,CAAC,cAAc;CACQ,CAAC;AAwD3D;;;;;;GAMG;AACH,MAAM,oCAAoC,GAAwB,IAAI,GAAG,CAAC;IACxE,kCAAkC;IAClC,kCAAkC;IAClC,mCAAmC;IACnC,qCAAqC;CACO,CAAC,CAAC;AAEhD;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAAC,MAAc;IAC9D,OAAO,oCAAoC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC;AAiB9C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAE0B;IACoB;IACW;IACA;IACrB;IACA;IACJ;IACS;IACU;IAT/E,YACsD,MAAqB,EACD,mBAA+C,EACpC,uBAA8D,EAC9D,uBAA8D,EACnF,gBAAyC,EACzC,SAAkC,EACtC,YAA0B,EACjB,WAAyC,EAC/B,uBAAsE;QAR/F,WAAM,GAAN,MAAM,CAAe;QACD,wBAAmB,GAAnB,mBAAmB,CAA4B;QACpC,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC9D,4BAAuB,GAAvB,uBAAuB,CAAuC;QACnF,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,cAAS,GAAT,SAAS,CAAyB;QACtC,iBAAY,GAAZ,YAAY,CAAc;QACjB,gBAAW,GAAX,WAAW,CAA8B;QAC/B,4BAAuB,GAAvB,uBAAuB,CAA+C;IAClJ,CAAC;IAEJ;;;;OAIG;IACI,oBAAoB,CAAC,WAAoB;QAC9C,6FAA6F;QAC7F,iGAAiG;QACjG,+FAA+F;QAC/F,wFAAwF;QACxF,EAAE;QACF,kGAAkG;QAClG,yFAAyF;QACzF,OAAO,IAAI,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAClG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,yBAAyB,CAAC,WAAoB;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB;aACtC,SAAS,EAAE;aACX,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,CAAC,KAAK,CAAC;aACrF,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,mBAAmB,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAElH,IAAI,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC/F,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,KAAK,CAAC,eAAe,CAAC;QAC1C,IAAI,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC;QAClC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;;;OASG;IACI,cAAc,CAAC,WAAoB;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,iGAAiG;QACjG,kGAAkG;QAClG,kEAAkE;QAClE,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE5H,MAAM,MAAM,GAAgB,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACvF,EAAE,EAAE,MAAM,CAAC,GAAG;YACd,IAAI,EAAE,MAAM,CAAC,WAAW;YACxB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;SACxB,CAAC,CAAC,CAAC;QAEJ,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAExJ,OAAO;YACL,6FAA6F;YAC7F,mFAAmF;YACnF,eAAe,EAAE,oBAAoB;YACrC,0FAA0F;YAC1F,8FAA8F;YAC9F,6FAA6F;YAC7F,4CAA4C;YAC5C,mBAAmB,EAAE;gBACnB,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE;gBAC9E,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE;aACjF;YACD,IAAI,EAAE,QAAQ,EAAE,WAAW,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,IAAI,mBAAmB;YACvG,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,oDAAoD;YAC1F,GAAG,EAAE,QAAQ;YACb,OAAO,EAAE,OAAO;YAChB,2FAA2F;YAC3F,mEAAmE;YACnE,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,gCAAgC,EAAE;YACtF,iBAAiB,EAAE,CAAC,YAAY,CAAC;YACjC,kBAAkB,EAAE,CAAC,eAAe,CAAC;YACrC,MAAM;YACN,8EAA8E;YAC9E,gFAAgF;YAChF,iFAAiF;YACjF,kFAAkF;YAClF,eAAe,EAAE;gBACf,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE;wBACL,iBAAiB,EAAE;4BACjB,gBAAgB,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,0BAA0B,EAAE,GAAG,6BAA6B,CAAC,wBAAwB,CAAC,wBAAwB,CAAC,EAAE;4BAC5J,QAAQ;4BACR,MAAM,EAAE,EAAE;yBACX;wBACD,iBAAiB,EAAE;4BACjB,QAAQ;4BACR,MAAM,EAAE,EAAE;yBACX;qBACF;iBACF;aACF;YACD,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SAC3B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,QAAiB,EAAE,WAAoB;QACpF,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,8DAA8D,EAAE,CAAC;QACzG,CAAC;QAED,IAAI,IAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8EAA8E;YAC9E,8EAA8E;YAC9E,yEAAyE;YACzE,6EAA6E;YAC7E,oEAAoE;YACpE,6CAA6C;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4CAA4C,EAC5C,2BAA2B,CAAC,KAAK,CAAC,CACnC,CAAC;YACF,+FAA+F;YAC/F,6FAA6F;YAC7F,0FAA0F;YAC1F,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,8BAA8B,CACjC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EACnF,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,EAAE,CACvF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,4EAA4E,EAAE,CAAC;QACvH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,+DAA+D,EAAE,CAAC;QAC1G,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,oBAAoB,CAAC,IAAsB;QACtD,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzC,OAAO,4BAA4B,CACjC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACxD;YACE,YAAY;YACZ,cAAc,EAAE,kBAAkB,CAAC,GAAG;YACtC,YAAY,EAAE,0BAA0B;YACxC,aAAa,EAAE,qCAAqC;YACpD,cAAc,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc;SACrD,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,sBAAsB,CAAC,IAAsB;QACxD,OAAO,IAAI,CAAC,WAAW,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED;;;;;;OAMG;IACH;;;;;;;;;;;;;;;;;;OAkBG;IACI,eAAe,CACpB,IAAsB,EACtB,MAAc,EACd,MAAyH,EACzH,YAAgC,EAChC,SAAkB;QAElB,+EAA+E;QAC/E,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,oBAAoB;eACvF,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,mBAAmB,CAAC;QAC/E,IAAI,SAAS;YAAE,OAAO;QAEtB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9C,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;YAClC,2FAA2F;YAC3F,8FAA8F;YAC9F,eAAe;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,sEAAsE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9I,OAAO;QACT,CAAC;QAED,KAAK,IAAI,CAAC,SAAS,CAAC,6BAA6B,CAAC;YAChD,YAAY;YACZ,8FAA8F;YAC9F,4FAA4F;YAC5F,qCAAqC;YACrC,mBAAmB,EAAE,MAAM;YAC3B,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,UAAU,EAAE,MAAM;YAClB,cAAc,EAAE,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YACnE,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,+FAA+F;YAC/F,sGAAsG;YACtG,sGAAsG;YACtG,YAAY,EAAE,CAAC;YACf,uEAAuE;YACvE,SAAS,EAAE,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,GAAG;YACzG,WAAW;YACX,cAAc,EAAE,IAAI,CAAC,YAAY,EAAE,cAAc;YACjD,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa;SAChD,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,uDAAuD,EAAE;YACnG,MAAM;YACN,GAAG,2BAA2B,CAAC,UAAU,CAAC;SAC3C,CAAC,CAAC,CAAC;IACN,CAAC;IAEM,kBAAkB,CACvB,IAAsB,EACtB,kBAA0B,EAC1B,MAAyB,EACzB,SAAkB;QAElB,IAAI,CAAC,SAAS,CAAC,gCAAgC,CAAC,IAAI,EAAE;YACpD,cAAc,EAAE,kBAAkB,CAAC,GAAG;YACtC,sFAAsF;YACtF,2DAA2D;YAC3D,kBAAkB;YAClB,mBAAmB,EAAE,sCAAsC,CAAC,MAAM,CAAC;YACnE,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,kBAAkB,CAAC,IAAsB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,YAAY,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACrF,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,oBAAoB,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YACrG,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,8BAA8B,CAAC,mBAAmB,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;YACnG,OAAO,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;OASG;IACI,sBAAsB,CAAC,OAAgB,EAAE,WAAoB;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,OAAO,6BAA6B,EAAE,CAAC;YAC1G,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAC/E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,wCAAwC,EAAE,CAAC;QAC7G,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,wDAAwD,EAAE,CAAC;IACnG,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,OAAO,CAAC,MAkBpB;QACC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,UAAU,EAAE,CAAC;QAEnD,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,SAAkE,CAAC;QACvE;;;;;;WAMG;QACH,IAAI,YAAkE,CAAC;QAEvE,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,OAAO,GAAG,CAAC,KAAyB,EAAE,OAAgB,EAAQ,EAAE;YACpE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;YACrD,IAAI,KAAK,KAAK,kBAAkB,CAAC,oBAAoB,EAAE,CAAC;gBACtD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;gBACvD,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBAChH,mFAAmF;oBACnF,iFAAiF;oBACjF,mFAAmF;oBACnF,yCAAyC;oBACzC,YAAY,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1E,CAAC;qBAAM,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC9B,SAAS,GAAG,OAAO,CAAC;gBACtB,CAAC;qBAAM,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;oBACvB,8EAA8E;oBAC9E,YAAY,IAAI,OAAO,CAAC;oBACxB,KAAK,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,KAAK,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;gBAC3D,SAAS,GAAG;oBACV,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;oBACzE,YAAY,EAAE,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,yCAAyC;iBAC9G,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;QAEF,2FAA2F;QAC3F,uDAAuD;QACvD,IAAI,eAAmC,CAAC;QAExC,2EAA2E;QAC3E,0EAA0E;QAC1E,iCAAiC;QACjC,MAAM,IAAI,CAAC,uBAAuB,CAAC,4BAA4B,CAAC;YAC9D,yBAAyB,EAAE,MAAM,CAAC,WAAW;YAC7C,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,eAAe,GAAG,WAAW,CAAC,CAAC,CAAC;YAChE,SAAS;YACT,WAAW,EAAE,SAAS;YACtB,YAAY,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;YAC/B,sEAAsE;YACtE,mEAAmE;YACnE,SAAS,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;YAClC,IAAI;YACJ,YAAY,EAAE,KAAK;YACnB,OAAO;YACP,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;QAEH,6FAA6F;QAC7F,gGAAgG;QAChG,iGAAiG;QACjG,qDAAqD;QACrD,IAAI,eAAe,EAAE,CAAC;YACpB,KAAK,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,6FAA6F;YAC7F,kFAAkF;YAClF,EAAE;YACF,0FAA0F;YAC1F,4FAA4F;YAC5F,yFAAyF;YACzF,2FAA2F;YAC3F,4FAA4F;YAC5F,wFAAwF;YACxF,6FAA6F;YAC7F,EAAE;YACF,4FAA4F;YAC5F,8FAA8F;YAC9F,sFAAsF;YACtF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;gBAC1F,SAAS;gBACT,SAAS;gBACT,aAAa,EAAE,IAAI,CAAC,aAAa;aAClC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;QACtD,yFAAyF;QACzF,4FAA4F;QAC5F,0FAA0F;QAC1F,uFAAuF;QACvF,IAAI,YAAY;YAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC;QACnF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,IAAI,YAAY,EAAE,SAAS,EAAE,CAAC;IACpE,CAAC;CACF,CAAA;AAnfY,iBAAiB;IAD7B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,0BAA0B,CAAC,CAAA;IACrD,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,qCAAqC,CAAC,CAAA;IAChE,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IACvC,WAAA,MAAM,CAAC,kBAAkB,CAAC,qBAAqB,CAAC,CAAA;IAChD,WAAA,MAAM,CAAC,kBAAkB,CAAC,+BAA+B,CAAC,CAAA;qCARC,aAAa;QACoB,0BAA0B;QACX,qCAAqC;QACrC,qCAAqC;QACjE,uBAAuB;QAC9B,uBAAuB;QACxB,YAAY;QACJ,4BAA4B;QACN,6CAA6C;GAV1I,iBAAiB,CAmf7B","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { randomUUID } from 'crypto';\n\nimport { A2A_Dialect } from '~wildo-backend-lib/flows-actors/a2a/models/a2a-dialect.backend.schemas';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { FlowsActorsRegistryService } from '~wildo-backend-lib/flows-actors/services/flows-actors-registry.service';\nimport {\n ConversationalExecutionBackendService,\n type ConversationalOwnerScope,\n} from '~wildo-backend-lib/flows-actors/services/conversational-execution.backend.service';\nimport { ExecutionContextCreatorBackendService } from '~wildo-backend-lib/runtime/services/execution-context-creator.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { ResourceServerInstancesRegistryBackendService } from '~wildo-backend-lib/mcp/services/resource-server-instances-registry.backend.service';\nimport { AuditLogsBackendService } from '~wildo-backend-lib/compliance/audit-trails/services/audit-logs.backend.service';\nimport { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport { recordExternalTokenAuthFailure } from '~wildo-backend-lib/security/authentications/services/utils/machine-auth-rate-limit.backend.utils';\nimport type { SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport {\n Actor_ExecutionMode,\n CoreWebSocketEvent,\n ExecutionContext_ExecutionType,\n FlowActorSystem_Kind,\n MachineAccessOperation,\n MANUAL_CONTROLLER_ROUTES_URLS,\n ManualControllerRouteKey,\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n ResourceServerKind,\n type ActorSystem,\n} from '@wildo-ai/saas-models';\nimport {\n A2A_JSONRPC_TRANSPORT,\n A2A_PROTOCOL_VERSION,\n type A2A_AgentCard,\n type A2A_Skill,\n} from '~wildo-backend-lib/flows-actors/a2a/models/a2a.backend.schemas';\nimport {\n A2A_EXTERNAL_TURN_RATE_MAX,\n A2A_EXTERNAL_TURN_RATE_WINDOW_SECONDS,\n assertExternalTurnWithinRate,\n resolvePrincipalRateKey,\n type ExternalTurnRateDecision,\n} from '~wildo-backend-lib/security/authentications/services/utils/external-turn-rate-limit.backend.utils';\nimport {\n A2ATokenBudgetBackendService,\n type A2ATokenBudgetDecision,\n} from '~wildo-backend-lib/flows-actors/a2a/services/a2a-token-budget.backend.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\n\n/*\n Outcome of authenticating an inbound A2A caller. Uses a STRING discriminant\n * (`kind`) rather than a boolean `ok` because this package compiles with\n * `strictNullChecks` off, under which TypeScript does not narrow boolean-literal\n * discriminated unions reliably.\n \n `owner` is the conversation owner scope resolved from the authenticated\n * principal — a user (`{ userId }`) or a machine (`{ organizationId }` /\n * `{ applicationId }`). It selects the persisted execution VARIANT.\n /\nexport type A2AAuthResult =\n \| { kind: 'ok'; auth: SocketAuthResult; owner: ConversationalOwnerScope }\n \| { kind: 'error'; errorMessage: string };\n\n/\n Outcome of running one A2A turn. String discriminant, same rationale as above.\n \n ## Why `awaiting-approval` is its own arm rather than a field on `ok`\n \n A turn that paused at a human-in-the-loop approval boundary produced NO answer — the model asked\n * permission and stopped. It is neither `ok` (there is nothing to reply with) nor `error` (nothing\n * failed). Modelling it as an optional field on `ok` would let every existing consumer keep\n * compiling while reporting a completed turn, which is precisely the defect shape this codebase has\n * hit repeatedly: an invariant applied at one of its call sites, the others silently recording a\n * terminal state for work that never happened.\n \n As a third arm, every site that consumes a turn is a COMPILE ERROR until it decides what a pause\n * means there — the three `runTurn` callers each needed a different answer, and a type is the only\n * thing that makes finding them not depend on remembering to look.\n /\nexport type A2ATurnResult =\n \| { kind: 'ok'; text: string; contextId: string }\n \| {\n /* The turn suspended awaiting a human decision; it will resume when one arrives. /\n kind: 'awaiting-approval';\n /* Correlates the decision back to the pending call — the client answers with this. /\n approvalId: string;\n /* The gated tool, so the transport can describe what is being asked. /\n toolName: string;\n contextId: string;\n }\n \| { kind: 'error'; errorCode: string; errorMessage: string };\n\n/* Outcome of resolving a target skill. String discriminant, same rationale. /\nexport type A2ASkillResolution =\n \| { kind: 'ok'; systemRef: string }\n \| { kind: 'error'; errorMessage: string };\n\n/* Callbacks the streaming (`message/stream`) transport supplies. /\nexport interface A2ATurnStreamHooks {\n /* A partial markdown delta of the agent's reply (SSE token stream). /\n onDelta?: (delta: string) => void;\n}\n\n/\n Backend service for the inbound Agent2Agent (A2A) transport. Exposes the app's\n * actor runtime to external agent callers WITHOUT reshaping the transport-agnostic\n * {@link ConversationalExecutionBackendService} — it is purely the identity /\n * ownership / protocol edge:\n \n - Agent card — advertises the exposable actor systems as A2A skills and the\n * OAuth2 security schemes a caller must satisfy. The card `url` is the agent's\n * canonical audience (RFC 8707 / external-access D7).\n * - Auth (D6, both principals) — the inbound Bearer token is authenticated by\n * the shared {@link ExecutionContextCreatorBackendService.authenticateExternalToken}\n * seam, which accepts EITHER a user-delegated `USER_REQUEST` token (the\n * conversation is owned by the delegating user → the `userFlowActorExecutions`\n * variant) OR a machine `client_credentials` token (`ORGANIZATION_MACHINE` /\n * `APPLICATION_MACHINE` → the `organization`/`applicationFlowActorExecutions`\n * variant). The turn runs with the caller's OWN roles/scope — never LLM- or\n * caller-supplied identity — via the same `SocketAuthResult` the WebSocket\n * transport uses; the conversation persists to the owner's variant.\n * - Audience binding — a user-delegated token's `aud` MUST equal this agent's\n * canonical URI; a machine token is resource-server-bound by `verifyMachineToken`\n * (a valid machine token for THIS API reaches this surface). See\n * `authenticateExternalToken` for the per-principal binding rationale.\n \n An inbound A2A `message/send` maps onto one conversational turn; the agent's\n * reply is returned as an A2A agent `Message`. `message/stream` forwards the token\n * deltas over SSE.\n /\n\n/\n A2A method → the audited machine-access operation.\n \n A `satisfies`-checked map rather than a ternary: the vocabulary is closed and now has\n * four members, so a conditional would silently mis-attribute any method added later.\n * Every externally-reachable A2A method must appear here — an unaudited one is an access\n * that happened with no record.\n \n semantic-literal-boundary: the keys are A2A protocol method names (JSON-RPC `method`\n * strings defined by the external spec, not by Wildo). This map is the thin adapter that\n * translates them into the internal `MachineAccessOperation` vocabulary; the literals must\n * not spread beyond it.\n /\nconst A2A_MACHINE_ACCESS_OPERATION_BY_METHOD = {\n 'message/send': MachineAccessOperation.A2A_MESSAGE_SEND,\n 'message/stream': MachineAccessOperation.A2A_MESSAGE_STREAM,\n 'tasks/get': MachineAccessOperation.A2A_TASKS_GET,\n 'tasks/resubscribe': MachineAccessOperation.A2A_TASKS_RESUBSCRIBE,\n 'tasks/cancel': MachineAccessOperation.A2A_TASKS_CANCEL,\n 'tasks/pushNotificationConfig/set': MachineAccessOperation.A2A_PUSH_NOTIFICATION_CONFIG_SET,\n 'tasks/pushNotificationConfig/get': MachineAccessOperation.A2A_PUSH_NOTIFICATION_CONFIG_GET,\n 'tasks/pushNotificationConfig/list': MachineAccessOperation.A2A_PUSH_NOTIFICATION_CONFIG_LIST,\n 'tasks/pushNotificationConfig/delete': MachineAccessOperation.A2A_PUSH_NOTIFICATION_CONFIG_DELETE,\n // 1.0-only: no v0.2.5 spelling exists, so these keys are the 1.0 names themselves.\n ListTasks: MachineAccessOperation.A2A_TASKS_LIST,\n} satisfies Record<A2A_MethodName, MachineAccessOperation>;\n\n/\n Every A2A JSON-RPC method this server answers.\n \n Named rather than inlined into the `satisfies` above so the closed vocabulary has ONE runtime\n * source, and so the dispatch site can be typed against the same union it audits against.\n \n ## The version note, because the names below are v0.2.5's and the shapes are 1.0's\n \n A2A 1.0 renames every method (`SendMessage`, `GetTask`, `CancelTask`, `SubscribeToTask`,\n * `CreateTaskPushNotificationConfig`, …). The transport answers BOTH vocabularies: the method name\n * is the dialect signal, `resolveA2AMethod` classifies it, and the request is then NORMALISED to the\n * v0.2.5 spelling before any routing happens (see `a2a-dialect.backend.schemas.ts`). So this union\n * is the NORMALISED spelling that the audit map and every handler key off, not a statement that a\n * client may only send the older names. The one exception is `ListTasks`, which v0.2.5 never\n * defined, so it appears here under its 1.0 name.\n \n The DATA shapes follow 1.0 (see `a2a-push-notification.backend.schemas.ts`), because that is where\n * v0.2.5 is actually deficient: it never defined the webhook payload.\n \n Renaming the members below to the 1.0 vocabulary would be a separate, larger unit even now that\n * both dialects are served: it touches the audit map, every routing branch and every handler\n * signature, and it buys nothing on the wire, because the wire already accepts either spelling.\n \n spec-cite: A2A 1.0 §5.3 (binding method table — the 1.0 JSON-RPC names) and the legacy anchors it\n * carries for the v0.2.5 names (e.g. `75-taskspushnotificationconfigset` on §3.1.7), which is what\n * makes the two vocabularies a published mapping rather than a guess.\n /\nexport type A2A_MethodName =\n // semantic-literal-boundary: these are the A2A specification's own JSON-RPC method names, not a\n // Wildo vocabulary — the wire strings a conformant client sends. Renaming a member here would not\n // rename anything, it would break conformance, so the union IS the translation boundary and there\n // is no runtime source to derive it from. The version split (v0.2.5 names for the existing methods,\n // the 1.0 name for `ListTasks`) is documented above and is a published mapping, not a guess.\n \| 'message/send'\n \| 'message/stream'\n \| 'tasks/get'\n \| 'tasks/cancel'\n \| 'tasks/resubscribe'\n \| 'tasks/pushNotificationConfig/set'\n \| 'tasks/pushNotificationConfig/get'\n \| 'tasks/pushNotificationConfig/list'\n \| 'tasks/pushNotificationConfig/delete'\n /\n A2A 1.0 only — v0.2.5 defines no equivalent, so this appears under its 1.0 name.\n \n `GetExtendedAgentCard` is deliberately ABSENT from this union and from the audit map: it is\n * refused unconditionally (we declare no extended card), so no access ever occurs and there is\n * nothing to record. A member here would describe an audit row that can never be written.\n /\n \| 'ListTasks';\n\n/* The four push-notification-configuration methods, as their own union. /\nexport type A2A_PushNotificationConfigMethod = Extract<A2A_MethodName, `tasks/pushNotificationConfig/${string}`>;\n\n/\n The four push-notification-configuration methods, as a runtime set.\n \n Typed against the union above so it cannot drift from it, and used at the dispatch site to apply\n * the §3.3.4 capability gate to all four at once — the alternative, four `\|\|`-joined comparisons,\n * is exactly the shape that acquires a fifth method without acquiring its gate.\n /\nconst A2A_PUSH_NOTIFICATION_CONFIG_METHODS: ReadonlySet<string> = new Set([\n 'tasks/pushNotificationConfig/set',\n 'tasks/pushNotificationConfig/get',\n 'tasks/pushNotificationConfig/list',\n 'tasks/pushNotificationConfig/delete',\n] satisfies A2A_PushNotificationConfigMethod[]);\n\n/\n Narrow a raw JSON-RPC `method` string to the push-configuration union.\n \n A type PREDICATE, not a set membership test the caller then casts through. The distinction is the\n * whole point: review finding G3-3 recorded that a cast at the dispatch site defeats the\n * `satisfies`-checked audit map — the method type-checks, resolves to `undefined` in the map, and\n * produces an access with no audit row. A predicate makes the compiler carry the narrowing into\n * `handleTaskMethod`, so a method that is not in the audited union cannot be dispatched there at all.\n /\nexport function isA2APushNotificationConfigMethod(method: string): method is A2A_PushNotificationConfigMethod {\n return A2A_PUSH_NOTIFICATION_CONFIG_METHODS.has(method);\n}\n\n/\n Whether this agent advertises — and therefore honours — webhook task updates.\n \n ONE constant, read by both the agent card and the dispatch gate. They are two call sites of a\n * single invariant (\"what the card promises is what the methods do\"), and hand-maintaining the\n * answer in both places is how a card comes to advertise a capability whose methods answer\n * `-32003`, or worse, the reverse: methods that quietly work while the card says they do not, so no\n * client ever calls them and the whole feature is dead code nobody notices.\n \n Turned `true` on 2026-08-09 on UNIT evidence; turned back to `false` on 2026-08-11 when the live\n * lane finally ran and found delivery inert; turned `true` again the same day once the cause was fixed\n * and the lane observed durable delivery rows. The middle step was not ceremony — it is what the\n * previous revision of this comment prescribed, and doing it kept the card honest for the hour between\n * discovering the defect and fixing it.\n \n ## The defect this constant caught, kept because the shape recurs\n \n ### Why it was `false` for an hour: DELIVERY WAS BROKEN, measured, not suspected\n \n `examples/wonder-todos/e2e/a2a-push-notifications.e2e.ts` drove two REAL transitions on tasks that\n * each carried a registered webhook (one organization-scoped, one user-scoped via the approval pause),\n * asserted that each cancel was ACCEPTED, and found zero delivery rows in all three variants. The\n * backend log names the cause once per configured webhook:\n \n resources_registry_operation_path_not_found\n * { resourceType: \"userA2aPushDeliveryLog\", operationIdentifier: \"create\" }\n \n `A2APushDeliveryLogRepository` writes through `SystemAccessBackendService`\n * (`createAsSystem` / `updateAsSystem`), which resolves its operation via\n * `getServiceOperationPathDefault` — admitting only `SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES`\n * (`INTERNAL_CALL` plus the URL-bearing pair). The delivery-log resource declared CREATE and UPDATE as\n * `REPOSITORY_ONLY`, which is in neither set. So every write threw, the dispatcher's no-throw\n * contract swallowed it at WARN, and the feature was inert end to end: no row opened, no job enqueued,\n * nothing for the worker to claim. Reads worked throughout — READ is `API_CALL` — which is exactly why\n * the configuration plane looked healthy.\n \n Two intentional decisions that were jointly unsatisfiable, not a typo: \"a delivery row is EVIDENCE,\n * so its writes never leave the repository tier\" and \"the repository writes through\n * `SystemAccessBackendService`\". `AsSystem` IS the service tier. See\n `SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES`, whose own JSDoc predicts this defect class verbatim\n * and records that it had already shipped once (the `USERS` retention opt-in).\n \n ### The fix, and the one that was NOT taken\n \n CREATE and UPDATE on the delivery log are now `INTERNAL_CALL` instead of `REPOSITORY_ONLY`. Both are\n * route-less, so no HTTP surface was opened and the \"a client must not be able to fabricate delivery\n * evidence\" property is untouched; only the TIER that can reach the op changed. This is the same\n * recipe already applied to the SSO and SCIM lazy-creates, and the sibling `flows-actors-task` config —\n * written by this same runtime through `AsSystem` — states the rule outright: \"INTERNAL_CALL (not\n REPOSITORY_ONLY) is mandatory\".\n \n An earlier revision of this comment prescribed the opposite fix — moving the repository to the\n * repository tier — and argued that `INTERNAL_CALL` would \"reverse the resource's stated decision that\n * these writes never leave the repository tier\". *That was wrong and is recorded rather than quietly\n deleted*, because the mistake is instructive: the stated decision was about EXPOSURE (no external\n caller may author evidence), and route-lessness delivers that under either variant. Conflating\n * \"route-less\" with \"repository-tier\" is what authored the bug in the first place, and it very nearly\n * authored the fix as well.\n \n ### What made it `true` again\n \n The live lane observed the durable rows: one per registered webhook, carrying the destination\n * captured at dispatch, the isolation axes and the dedup id, with the worker claiming and attempting\n * each. NOT unit tests — the unit pins were green and mutation-proven throughout the eleven days this\n * was broken, because they stub the repository and therefore cannot see which tier it writes at.\n \n Flipping this is a deliberate act that reddens G-6 in whichever direction it moves — do it only with\n * a live green D-section, never on the strength of the suite alone.\n /\nexport const A2A_PUSH_NOTIFICATIONS_SUPPORTED = true;\n\n/\n The A2A methods that emit a `MACHINE_ACCESS` audit — DERIVED from the map above rather\n * than restated, so the two can never drift apart.\n \n Every consumer that forwards a method into {@link A2ABackendService.auditMachineAccess}\n * types its own parameter as this. That is what makes an unaudited method a COMPILE error\n * instead of a runtime one: review finding G3-3 showed `handleTaskMethod` taking a bare\n * `string` and casting at the call site, which meant adding a fifth method (`tasks/resubscribe`)\n * type-checked cleanly, resolved to `undefined` in the map, failed the emit's required\n * `operationIdentifier` at Zod validation, and was swallowed by the fire-and-forget `.catch()` —\n * an unaudited access, which is exactly the failure the map claims to prevent.\n /\nexport type A2A_AuditedMethod = keyof typeof A2A_MACHINE_ACCESS_OPERATION_BY_METHOD;\n\n@injectable()\nexport class A2ABackendService {\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.FlowsActorsRegistryService) private readonly flowsActorsRegistry: FlowsActorsRegistryService,\n @inject(SAAS_SERVICE_TYPES.ConversationalExecutionBackendService) private readonly conversationalExecution: ConversationalExecutionBackendService,\n @inject(SAAS_SERVICE_TYPES.ExecutionContextCreatorBackendService) private readonly executionContextCreator: ExecutionContextCreatorBackendService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuditLogsService) private readonly auditLogs: AuditLogsBackendService,\n @inject(SAAS_SERVICE_TYPES.RedisService) private readonly redisService: RedisService,\n @inject(SAAS_SERVICE_TYPES.A2ATokenBudgetService) private readonly tokenBudget: A2ATokenBudgetBackendService,\n @inject(SAAS_SERVICE_TYPES.ResourceServerInstancesRegistry) private readonly resourceServerInstances: ResourceServerInstancesRegistryBackendService,\n ) {}\n\n /\n The agent's canonical URI = the absolute A2A task-endpoint URL. Doubles as\n * the audience a user-delegated inbound token must carry (RFC 8707). `undefined`\n * when the app public base URL is unresolvable (→ the transport fails closed).\n /\n public resolveAgentAudience(instanceRef?: string): string \| undefined {\n // Delegate to the single audience authority: the token MINT validates a requested `resource`\n // against `resolveResourceServerAudience(A2A)`, and THIS is the verify-side `callerAudience` the\n // A2A arm enforces — deriving both from one function makes \"mint and verify cannot drift\" TRUE\n // by construction (rather than by three parallel `${apiAudience}${route}` expressions).\n //\n // R-2: a NAMED agent instance carries its own audience (`…/a2a/<ref>`), so a token minted for one\n // agent is rejected at another — agents are separate resource servers, not views of one.\n return this.appConfigService.resolveResourceServerAudience(ResourceServerKind.A2A, instanceRef);\n }\n\n /\n The ACTOR systems this app exposes over A2A: those with an AGENTIC actor bound\n * to an agent (i.e. the exact set the conversational runtime can actually serve).\n * FLOW systems and agent-less actor systems are excluded — advertising a skill we\n * cannot run would be a lie in the agent card.\n \n R-2 instance semantics, deliberately FAIL-CLOSED (this mirrors the MCP twin\n * `isOnMcpServerInstance`, which returns `false` for an unresolvable instance rather than falling\n * back to the full catalog):\n \n - no `instanceRef` ⇒ the DEFAULT agent: every runnable system. The registry is never consulted,\n * so declaring agents stays purely additive.\n * - a declared agent with `actorSystemRefs` ⇒ exactly that subset.\n * - a declared agent with NO `actorSystemRefs` ⇒ every runnable system (\"no restriction\"). The\n * schema forbids an EMPTY list precisely so this reading is unambiguous: omitted means all, and a\n * present list always names at least one system.\n * - an UNRESOLVABLE ref ⇒ NOTHING. Previously this returned every runnable system, so a\n * deleted or mistyped agent ref silently produced a card advertising the app's ENTIRE skill set —\n * the exact opposite of the curation the caller asked for, and a widening failure on a surface whose\n * whole purpose is to narrow. The transports 404 an unknown ref before reaching here, so an empty\n * result is unreachable in practice; it is the fail-closed answer if that guard is ever bypassed.\n /\n public listExposableActorSystems(instanceRef?: string): ActorSystem[] {\n const runnable = this.flowsActorsRegistry\n .getActors()\n .filter((system): system is ActorSystem => system.kind === FlowActorSystem_Kind.ACTOR)\n .filter((system) => system.actors.some((a) => a.executionMode === Actor_ExecutionMode.AGENTIC && !!a.agentRef));\n\n if (!instanceRef) return runnable;\n const agent = this.resourceServerInstances.tryGetInstance(ResourceServerKind.A2A, instanceRef);\n if (!agent) return [];\n const allowedRefs = agent.actorSystemRefs;\n if (!allowedRefs) return runnable;\n return runnable.filter((system) => allowedRefs.includes(system.ref));\n }\n\n /\n Build the served A2A agent card, or `null` when the agent audience is\n * unresolvable (the controller then returns 503). Each exposable actor system becomes an A2A skill\n * (`skill.id === systemRef`).\n \n One card per AGENT: the DEFAULT agent (no `instanceRef`) carries the app-level identity and every\n * runnable skill, while each declared instance carries its own `displayName`/`description`, its own\n * `url` (== its own RFC 8707 audience) and only its `actorSystemRefs` subset — so a client that reads\n * a named card obtains a token scoped to THAT agent and nothing else.\n /\n public buildAgentCard(instanceRef?: string): A2A_AgentCard \| null {\n const audience = this.resolveAgentAudience(instanceRef);\n if (!audience) return null;\n // R-2: a named agent identifies itself with its OWN declared name/description; the default agent\n // keeps the app-level identity. `url` is always this agent's own audience, so a client that reads\n // the card obtains a token scoped to THIS agent and nothing else.\n const instance = instanceRef ? this.resourceServerInstances.tryGetInstance(ResourceServerKind.A2A, instanceRef) : undefined;\n\n const skills: A2A_Skill[] = this.listExposableActorSystems(instanceRef).map((system) => ({\n id: system.ref,\n name: system.displayName,\n description: system.description,\n tags: system.tags ?? [],\n }));\n\n const tokenUrl = `${this.appConfigService.resolveApiResourceAudience()}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_TOKEN]}`;\n\n return {\n // The legacy scalar, still `0.2.5` on purpose — see the field's JSDoc. A v0.2.5 client reads\n // ONLY this, and that is the version its dialect of this surface genuinely speaks.\n protocolVersion: A2A_PROTOCOL_VERSION,\n // 1.0 FIRST: the list is ordered by preference, so this is how the agent says \"prefer the\n // current norm\" while remaining reachable to clients that only know the old one. Both entries\n // point at the SAME url — the dialect is carried by the method name, not by the endpoint, so\n // there is no second route to keep in sync.\n supportedInterfaces: [\n { url: audience, transport: A2A_JSONRPC_TRANSPORT, version: A2A_Dialect.V1_0 },\n { url: audience, transport: A2A_JSONRPC_TRANSPORT, version: A2A_Dialect.V0_2_5 },\n ],\n name: instance?.displayName ?? this.appConfigService.config.appIdentity?.appName ?? 'Wildo Application',\n description: instance?.description ?? 'Actor systems exposed as Agent2Agent (A2A) skills.',\n url: audience,\n version: '1.0.0',\n // Read from the shared constant, never restated — see A2A_PUSH_NOTIFICATIONS_SUPPORTED for\n // why the card and the dispatch gate must not be able to disagree.\n capabilities: { streaming: true, pushNotifications: A2A_PUSH_NOTIFICATIONS_SUPPORTED },\n defaultInputModes: ['text/plain'],\n defaultOutputModes: ['text/markdown'],\n skills,\n // Both D6 principals: authorizationCode (user-delegated → user-owned session)\n // and clientCredentials (machine → org/app-owned session). The token endpoint +\n // JWKS are the app's OIDC provider surfaces. Callers request a token whose `aud`\n // (RFC 8707 `resource`) is THIS card's `url` (user) / the API resource (machine).\n securitySchemes: {\n oauth2: {\n type: 'oauth2',\n flows: {\n authorizationCode: {\n authorizationUrl: `${this.appConfigService.resolveApiResourceAudience()}${MANUAL_CONTROLLER_ROUTES_URLS[ManualControllerRouteKey.OAUTH_PROVIDER_AUTHORIZE]}`,\n tokenUrl,\n scopes: {},\n },\n clientCredentials: {\n tokenUrl,\n scopes: {},\n },\n },\n },\n },\n security: [{ oauth2: [] }],\n };\n }\n\n /\n Authenticate an inbound A2A caller from its Bearer token (D6 — user-delegated\n * OR machine). Delegates verification + principal resolution to the shared\n * {@link ExecutionContextCreatorBackendService.authenticateExternalToken} seam\n * (audience binding, machine vs user), then maps the authenticated principal to\n * the conversation owner scope that selects the persisted execution variant.\n \n R-2: the token must be audience-bound to the AGENT INSTANCE it was presented to, so a token\n * minted for another agent (or for the default one) is rejected here — agents are separate\n * resource servers.\n /\n public async authenticateCaller(token: string, clientIp?: string, instanceRef?: string): Promise<A2AAuthResult> {\n const expectedAudience = this.resolveAgentAudience(instanceRef);\n if (!expectedAudience) {\n return { kind: 'error', errorMessage: 'A2A agent audience is not resolvable (app public URL unset).' };\n }\n\n let auth: SocketAuthResult;\n try {\n auth = await this.executionContextCreator.authenticateExternalToken(token, expectedAudience);\n } catch (error) {\n // `authenticateExternalToken` rejects with a `WildoError_Backend`, which is a\n // plain object rather than an `Error` — an `instanceof Error` ternary sent it\n // down the `String(...)` branch and logged every A2A auth failure as the\n // literal `'[object Object]'`, erasing WHY the token was refused (expired vs\n // wrong audience vs bad signature) on a security surface where that\n // distinction is the whole diagnostic value.\n this.logger.warn(\n '[A2A] Inbound caller authentication failed',\n projectCaughtErrorLogFields(error),\n );\n // SIEM-2 symmetry (S2): feed the shared per-IP failure counter + emit MACHINE_AUTH_FAILED so a\n // revoked/expired/forged token rejected at /a2a is visible to the SIEM (was invisible — only\n // the token-MINT endpoint audited failures). Fire-and-forget; never blocks the rejection.\n if (clientIp) {\n void recordExternalTokenAuthFailure(\n { redisService: this.redisService, logger: this.logger, auditLogs: this.auditLogs },\n { clientIp, resourceServer: ResourceServerKind.A2A, reason: 'external_token_invalid' },\n );\n }\n return { kind: 'error', errorMessage: 'The access token is invalid, expired, or not audience-bound to this agent.' };\n }\n\n const owner = this.ownerScopeFromAuth(auth);\n if (!owner) {\n return { kind: 'error', errorMessage: 'The authenticated token carries no resolvable owner identity.' };\n }\n return { kind: 'ok', auth, owner };\n }\n\n /\n Per-PRINCIPAL turn throttle for this agent (LLM-spend guard). An A2A agent turn runs the\n * LLM runtime, so an authenticated caller holding one valid token could otherwise drive\n * unbounded model spend; this caps turns-per-window per principal. Covers BOTH `message/send`\n * and `message/stream` (one turn each) — the controller calls it once before dispatch and\n * maps `rate_limited` to a transport-level 429. Fails OPEN (a limiter outage never breaks the\n * endpoint); see {@link assertExternalTurnWithinRate} for the fail-open + cost rationale. An\n * unkeyable principal (defensive — auth already fails closed without an owner id) is not\n * throttled.\n /\n public async assertTurnWithinRate(auth: SocketAuthResult): Promise<ExternalTurnRateDecision> {\n const principalKey = resolvePrincipalRateKey(auth);\n if (!principalKey) return { kind: 'ok' };\n return assertExternalTurnWithinRate(\n { redisService: this.redisService, logger: this.logger },\n {\n principalKey,\n resourceServer: ResourceServerKind.A2A,\n maxPerWindow: A2A_EXTERNAL_TURN_RATE_MAX,\n windowSeconds: A2A_EXTERNAL_TURN_RATE_WINDOW_SECONDS,\n applicationEnv: this.appConfigService.applicationEnv,\n },\n );\n }\n\n /\n Per-TENANT LLM token-budget gate (sustained spend control) — the complement to\n * {@link assertTurnWithinRate}'s per-principal BURST cap. Resolves the owner's plan-granted token\n * allowance and denies once the current period's accumulated consumption reaches it. Delegates to\n * {@link A2ATokenBudgetBackendService}; see that class for the deliberate fail-open (allowance\n * unresolvable → allow, budgeting is opt-in) vs fail-closed (budget configured but consumption\n * unverifiable → deny) split. The controller maps a denial to HTTP 402 / `BUDGET_EXCEEDED`.\n /\n public async assertTurnWithinBudget(auth: SocketAuthResult): Promise<A2ATokenBudgetDecision> {\n return this.tokenBudget.assertTurnWithinBudget(auth);\n }\n\n /\n SIEM-2: emit a per-request MACHINE_ACCESS audit for an authenticated A2A caller (fire-and-forget).\n * Normalises the A2A JSON-RPC method to a stable {@link MachineAccessOperation} (so A2A + MCP share\n * one audit vocabulary) and delegates the principal→audit shaping + F4 org routing to the single\n * source of truth {@link AuditLogsBackendService.logMachineResourceAccessFromAuth} — which no-ops\n * for user-delegated turns (a human action) and emits only for machine principals.\n /\n /\n Audit an A2A TASK-method access, for EITHER principal kind (review finding A3-7).\n \n ## Why this exists rather than calling `auditMachineAccess` alone\n \n `logMachineResourceAccessFromAuth` returns early for anything that is not a machine, with the\n * comment \"user-delegated turns are audited as human actions, not machine access\". For the task\n * methods that was not true: a user-delegated `tasks/get` or `tasks/cancel` produced only the\n * runtime-attributed `SYSTEM_CONTEXT_READ`/`SYSTEM_CONTEXT_WRITE` that `readAsSystem` emits, and\n * NOTHING naming the human. So the G2-1 remediation — which existed to stop an external principal\n * reading and cancelling a tenant's work with no record — closed only the machine half.\n \n A delegated token is a HUMAN acting through an agent, and `tasks/cancel` in particular destroys\n * in-flight work. `RESOURCE_OPERATION_PERFORMED` is the framework's human-attributed access event,\n * so the delegated arm emits that with the real actor on the row.\n \n Fire-and-forget, like every emitter on this path: auditing must never fail the request it\n * observes. Emitted BEFORE the read, so an attempt on a task the caller cannot see is recorded too.\n /\n public auditTaskAccess(\n auth: SocketAuthResult,\n taskId: string,\n method: Extract<A2A_AuditedMethod, 'tasks/get' \| 'tasks/cancel' \| 'tasks/resubscribe'> \| A2A_PushNotificationConfigMethod,\n resourceType: string \| undefined,\n ipAddress?: string,\n ): void {\n // Machine principals: unchanged, and the single source of truth still decides.\n this.auditMachineAccess(auth, taskId, method, ipAddress);\n\n const isMachine = auth.executionType === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE\n \|\| auth.executionType === ExecutionContext_ExecutionType.APPLICATION_MACHINE;\n if (isMachine) return;\n\n const actorUserId = auth.initiatorIds?.userId;\n if (!actorUserId \|\| !resourceType) {\n // Neither branch can name what it would record. Warn rather than emit a row whose actor or\n // subject is blank — an unattributable audit row is worse than a logged gap, because it reads\n // as evidence.\n this.logger.warn?.('[A2A] Task access could not be attributed for the human-action audit', { method, hasActor: !!actorUserId, resourceType });\n return;\n }\n\n void this.auditLogs.logResourceOperationPerformed({\n resourceType,\n // The A2A verb, not a core CRUD name: `tasks/cancel` is what the caller actually invoked, and\n // collapsing it to `update` would make a destructive protocol verb indistinguishable in the\n // trail from an ordinary field edit.\n operationIdentifier: method,\n variantType: ResourceOperationVariantType.API_CALL,\n resourceId: taskId,\n initiatorRoles: (auth.initiatorRoles ?? []).flatMap((r) => r.roles),\n executionType: auth.executionType,\n // Single-shot task methods with no cascade, so the depth is always the caller's own frame. The\n // request-correlation id is hoisted to the audit row's top-level `correlationId` by `_createAuditLog`\n // (from the ambient request-context frame), which correlates this row to its actual A2A HTTP request.\n subCallDepth: 0,\n // `tasks/cancel` destroys in-flight work; `tasks/get` merely observes.\n riskLevel: method === 'tasks/cancel' ? ResourceOperationRiskLevel.MEDIUM : ResourceOperationRiskLevel.LOW,\n actorUserId,\n organizationId: auth.initiatorIds?.organizationId,\n applicationId: auth.initiatorIds?.applicationId,\n }).catch((auditError) => this.logger.warn?.('[A2A] Task-access human audit emit failed (non-fatal)', {\n method,\n ...projectCaughtErrorLogFields(auditError),\n }));\n }\n\n public auditMachineAccess(\n auth: SocketAuthResult,\n resourceIdentifier: string,\n method: A2A_AuditedMethod,\n ipAddress?: string,\n ): void {\n this.auditLogs.logMachineResourceAccessFromAuth(auth, {\n resourceServer: ResourceServerKind.A2A,\n // For the message methods this is the target actor system; for the task methods it is\n // the task id, which is the thing actually being accessed.\n resourceIdentifier,\n operationIdentifier: A2A_MACHINE_ACCESS_OPERATION_BY_METHOD[method],\n ipAddress,\n });\n }\n\n /\n Map an authenticated principal to its conversation owner scope. USER_REQUEST →\n * `{ userId }`; the two machine principals → `{ organizationId }` / `{ applicationId }`.\n * Returns `undefined` when the expected owner id is missing (fail-closed).\n \n MULTI-ORG NOTE (parity with the MCP `contextIds` path): a user-delegated turn is owned by\n * `{ userId }`, so the conversation itself is unambiguous. The ACTIVE ORGANIZATION is a separate\n * axis, and A2A still has no per-request channel for the caller to select one — but since\n * 2026-07-31 it no longer needs one in the common case: `authenticateExternalToken` derives the\n * active org from the delegating OAuth client's OWN tenant (`azp` → org-scoped client →\n * organizationId). A multi-org member acting through an org's agent client is therefore correctly\n * scoped AND correctly billed, where previously such a turn carried no org at all — denying every\n * org-scoped resource operation while its token spend went uncapped.\n \n A turn still carries no active org when the delegating client is APPLICATION-scoped (no tenant to\n * pin — binding one at the authorize endpoint is the deferred extension), when the user has no\n * memberships, or when the client's pinned org is not one of the user's (deliberately declined\n * rather than substituted). Org-scoped operations continue to fail closed in those cases, and the\n * token budget's own guard covers the spend axis independently.\n /\n private ownerScopeFromAuth(auth: SocketAuthResult): ConversationalOwnerScope \| undefined {\n const ids = auth.initiatorIds;\n if (!ids) return undefined;\n if (auth.executionType === ExecutionContext_ExecutionType.USER_REQUEST && ids.userId) {\n return { userId: ids.userId };\n }\n if (auth.executionType === ExecutionContext_ExecutionType.ORGANIZATION_MACHINE && ids.organizationId) {\n return { organizationId: ids.organizationId };\n }\n if (auth.executionType === ExecutionContext_ExecutionType.APPLICATION_MACHINE && ids.applicationId) {\n return { applicationId: ids.applicationId };\n }\n return undefined;\n }\n\n /\n Resolve the target actor system for a turn. A caller selects a skill via\n * `metadata.skillId`; when omitted AND exactly one system is exposed, that one\n * is used (the common single-agent app). Otherwise the caller must name a skill.\n \n R-2: resolution is scoped to the AGENT instance the request arrived on, so a `skillId` outside\n * that agent's declared subset is rejected exactly like an unknown skill — the card and the\n * dispatch gate advertise/accept the same set (a named agent cannot be used as a side-door into\n * another agent's actor system).\n /\n public resolveTargetSystemRef(skillId?: string, instanceRef?: string): A2ASkillResolution {\n const exposable = this.listExposableActorSystems(instanceRef);\n if (skillId) {\n const match = exposable.find((s) => s.ref === skillId);\n if (!match) return { kind: 'error', errorMessage: `No A2A skill '${skillId}' is exposed by this agent.` };\n return { kind: 'ok', systemRef: match.ref };\n }\n if (exposable.length === 1) return { kind: 'ok', systemRef: exposable[0].ref };\n if (exposable.length === 0) return { kind: 'error', errorMessage: 'This agent exposes no runnable skills.' };\n return { kind: 'error', errorMessage: 'Multiple skills are exposed; specify metadata.skillId.' };\n }\n\n /\n Run one A2A turn against the conversational runtime under the caller's OWN\n * context (user or machine principal). Returns the agent's full reply (blocking)\n * or an error. When `hooks.onDelta` is supplied, partial markdown deltas are\n * forwarded live (SSE streaming) while the final text is still returned. The\n * conversation persists to the owner's variant (`owner` selects it).\n /\n public async runTurn(params: {\n auth: SocketAuthResult;\n owner: ConversationalOwnerScope;\n systemRef: string;\n text: string;\n contextId?: string;\n /* The agent this turn arrived through — forwarded so the conversation records its origin. /\n instanceRef?: string;\n hooks?: A2ATurnStreamHooks;\n /\n Cancellation signal for the turn. Two transports supply one, for different reasons:\n * `blocking: false` task turns wire it to `tasks/cancel` (addressable by task id), and\n * `message/stream` wires it to the SSE socket closing — that path owns no task, so the\n * client's connection IS its cancellation channel. Reaches AI-SDK `streamText`, so it aborts\n * the multi-step tool loop, not just the text stream. The blocking `message/send` path passes\n * none: it holds the response open, so there is no disconnect to observe separately.\n /\n abortSignal?: AbortSignal;\n }): Promise<A2ATurnResult> {\n const { auth, owner, systemRef, text, hooks } = params;\n const contextId = params.contextId ?? randomUUID();\n\n let finalText = '';\n let streamedText = '';\n let turnError: { errorCode: string; errorMessage: string } \| undefined;\n /\n Set when the turn suspended for a human decision instead of answering.\n \n Read off the emitted PROGRESS payload rather than through a new return channel: the pause is\n * ALREADY announced on the transport-agnostic emitter (that is how the WebSocket plane learns\n * of it), so keying on the same event keeps one announcement rather than two that can disagree.\n */\n let turnApproval: { approvalId: string; toolName: string } \| undefined;\n\n // Transport-agnostic emitter: capture the terminal assistant message + any\n // error, and forward deltas to the SSE hook when streaming.\n const emitter = (event: CoreWebSocketEvent, payload: unknown): void => {\n const p = (payload ?? {}) as Record<string, unknown>;\n if (event === CoreWebSocketEvent.FLOWS_ACTORS_MESSAGE) {\n const content = typeof p.content === 'string' ? p.content : '';\n const data = (p.data ?? {}) as Record<string, unknown>;\n if (data.approvalRequested === true && typeof data.approvalId === 'string' && typeof data.toolName === 'string') {\n // A pause, not an answer. Captured BEFORE the delta arms below because an approval\n // progress payload carries no `messageId` and would otherwise fall through as an\n // ordinary tool-status frame — i.e. be dropped, leaving the turn indistinguishable\n // from one that simply produced no text.\n turnApproval = { approvalId: data.approvalId, toolName: data.toolName };\n } else if (p.isFinal === true) {\n finalText = content;\n } else if (p.messageId) {\n // A streamed answer delta (tool-status progress payloads carry no messageId).\n streamedText += content;\n hooks?.onDelta?.(content);\n }\n } else if (event === CoreWebSocketEvent.FLOWS_ACTORS_ERROR) {\n turnError = {\n errorCode: typeof p.errorCode === 'string' ? p.errorCode : 'AGENT_FAILED',\n errorMessage: typeof p.errorMessage === 'string' ? p.errorMessage : 'The agent failed to produce a response.',\n };\n }\n };\n\n // Token usage is only knowable AFTER the agent stream drains, so the runtime hands it back\n // through this sink rather than the per-delta emitter.\n let turnTotalTokens: number \| undefined;\n\n // `startConversationalExecution` never throws — it runs the whole turn and\n // reports every failure through the emitter, so inspecting captured state\n // after the await is sufficient.\n await this.conversationalExecution.startConversationalExecution({\n resourceServerInstanceRef: params.instanceRef,\n onUsage: ({ totalTokens }) => { turnTotalTokens = totalTokens; },\n systemRef,\n executionId: contextId,\n initialInput: { message: text },\n // The caller's server-verified identity (never LLM-supplied). Machine\n // principals always carry initiatorIds; the fallback is defensive.\n initiator: auth.initiatorIds ?? {},\n auth,\n scopeContext: owner,\n emitter,\n abortSignal: params.abortSignal,\n });\n\n // Accumulate this turn's tokens against the PAYING TENANT's period budget (resolved from the\n // principal, not the conversation owner — a delegated turn is paid by the user's organization).\n // Deliberately AFTER the turn (usage is only known once the agent finished) and fire-and-forget:\n // metering must never fail a turn we already served.\n if (turnTotalTokens) {\n void this.tokenBudget.recordTurnTokens(auth, turnTotalTokens);\n } else {\n // UNMETERABLE TURN. The provider reported no usage — the agent transport does not surface it\n // (CLI / image agents), or the invocation failed after the model had already run.\n //\n // A THIRD cause used to belong here and no longer does (review gate #2, F-A): a CANCELLED\n // turn. `result.usage` rejects on an aborted stream, so the throw skipped `reportUsage` and\n // every cancellation landed in this branch — which made cancelling a way to consume real\n // provider spend while the tenant's budget never moved, repeatable on demand. Fixed at the\n // source: `streamTextToDeltas` now accumulates per-step usage that survives the abort, so a\n // cancelled turn meters the steps that completed. If cancellations start appearing here\n // again, that accumulator has regressed — do not simply widen this comment to re-admit them.\n //\n // Either way this turn consumed spend that the budget cannot see, so a capped tenant drifts\n // above its allowance silently. Logged rather than denied: refusing would disable whole agent\n // transports for budgeted tenants, which is a product decision, not one to take here.\n this.logger.warn('[A2A] Turn produced no LLM usage — not metered against the token budget', {\n systemRef,\n contextId,\n executionType: auth.executionType,\n });\n }\n\n if (turnError) return { kind: 'error', ...turnError };\n // Ordered AFTER the error arm deliberately: a turn that suspended and then failed on the\n // persistence write has an error to report and no resumable pause, so the error wins. It is\n // ordered BEFORE the ok arm because a pause with partial streamed text is still a pause —\n // answering with that text would present a half-finished thought as the agent's reply.\n if (turnApproval) return { kind: 'awaiting-approval', ...turnApproval, contextId };\n return { kind: 'ok', text: finalText \|\| streamedText, contextId };\n }\n}\n"]}

package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.d.ts CHANGED Viewed

@@ -8,7 +8,6 @@
  * - OutOfScopeCatalog: Explicit scope boundaries
  * - ModelPresetsCatalog: LLM configuration presets
  * - ToolBundlesCatalog: Tool function bundles
- * - MCPBundlesCatalog: MCP server bundles
  *
  * @see AGENT_FACETS_AND_CATALOGS.md for design documentation
  */
@@ -224,16 +223,4 @@ export declare const ToolBundlesCatalog: {
     };
 };
 export type ToolBundleId = keyof typeof ToolBundlesCatalog;
-export declare const MCPBundlesCatalog: {
-    readonly CODE_ASSISTANT: {
-        readonly mcpRefs: readonly ["filesystem-mcp", "code-editor-mcp", "git-mcp"];
-    };
-    readonly WEB_AUTOMATION: {
-        readonly mcpRefs: readonly ["browser-mcp", "screenshot-mcp"];
-    };
-    readonly DATABASE_ACCESS: {
-        readonly mcpRefs: readonly ["mongodb-mcp", "postgres-mcp"];
-    };
-};
-export type MCPBundleId = keyof typeof MCPBundlesCatalog;
 //# sourceMappingURL=agent-catalogs.backend.definitions.d.ts.map

package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"agent-catalogs.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/models/agent-catalogs.backend.definitions.ts"],"names":[],"mappings":"AAAA~~;;;;;;;;;;;;;GAaG~~;AAEH,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAOnF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuHrB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAO3D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;CA0DtB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAO7D,eAAO,MAAM,YAAY;;;;;;;;;;;;;CA4Bf,CAAC;AAEX,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,YAAY,CAAC;AAO/C,eAAO,MAAM,iBAAiB;;;;;;;;;;;CA0BpB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAO1D,eAAO,MAAM,mBAAmB;IAK9B;;;OAGG;;;;;;;;;;;;;;;;;;;;IAiCH;;;;;;;;;;;;OAYG;;;;;;;;;;;;;;CAkBK,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAO7D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;CAqCrB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,kBAAkB,CAAC~~;AAO3D,eAAO,MAAM,iBAAiB;;;;;;;;;;CAyBpB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,iBAAiB,CAAC~~"}
1	+ {"version":3,"file":"agent-catalogs.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/models/agent-catalogs.backend.definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAOnF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuHrB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,kBAAkB,CAAC;AAO3D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;CA0DtB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAO7D,eAAO,MAAM,YAAY;;;;;;;;;;;;;CA4Bf,CAAC;AAEX,MAAM,MAAM,MAAM,GAAG,MAAM,OAAO,YAAY,CAAC;AAO/C,eAAO,MAAM,iBAAiB;;;;;;;;;;;CA0BpB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAO1D,eAAO,MAAM,mBAAmB;IAK9B;;;OAGG;;;;;;;;;;;;;;;;;;;;IAiCH;;;;;;;;;;;;OAYG;;;;;;;;;;;;;;CAkBK,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAO7D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;CAqCrB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,kBAAkB,CAAC"}

package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.js CHANGED Viewed

@@ -8,7 +8,6 @@
  * - OutOfScopeCatalog: Explicit scope boundaries
  * - ModelPresetsCatalog: LLM configuration presets
  * - ToolBundlesCatalog: Tool function bundles
- * - MCPBundlesCatalog: MCP server bundles
  *
  * @see AGENT_FACETS_AND_CATALOGS.md for design documentation
  */
@@ -312,26 +311,19 @@ export const ToolBundlesCatalog = {
     },
 };
 //===============================================================
-// MCP BUNDLES CATALOG
+// MCP BUNDLES CATALOG — REMOVED 2026-09-09 (#491)
 //===============================================================
-export const MCPBundlesCatalog = {
-    //===================
-    // DEVELOPMENT
-    //===================
-    CODE_ASSISTANT: {
-        mcpRefs: ["filesystem-mcp", "code-editor-mcp", "git-mcp"],
-    },
-    //===================
-    // BROWSER
-    //===================
-    WEB_AUTOMATION: {
-        mcpRefs: ["browser-mcp", "screenshot-mcp"],
-    },
-    //===================
-    // DATABASE
-    //===================
-    DATABASE_ACCESS: {
-        mcpRefs: ["mongodb-mcp", "postgres-mcp"],
-    },
-};
+//
+// Held three bundles of invented server names — `filesystem-mcp`, `code-editor-mcp`, `git-mcp`,
+// `browser-mcp`, `screenshot-mcp`, `mongodb-mcp`, `postgres-mcp`. None named a server that existed,
+// nothing resolved them into a callable tool, and the agent card rendered them as capabilities: a
+// claim shown to a user about a reach the agent did not have.
+//
+// Two of the three bundles were referenced by nothing but their own tests. The third reached one
+// core facet, now withdrawn with it.
+//
+// An `mcpRef` now names an MCP server the APPLICATION declared (`FlowsActors_McpServer`), and the
+// registry REFUSES an agent whose refs name no declared server — so this shape cannot be recreated.
+// A shipped catalog of refs is the wrong home by construction: the engine does not know which third
+// parties an application permits its agents to reach.
 //# sourceMappingURL=agent-catalogs.backend.definitions.js.map

package/dist/esm/flows-actors/models/agent-catalogs.backend.definitions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"agent-catalogs.backend.definitions.js","sourceRoot":"","sources":["../../../../../src/flows-actors/models/agent-catalogs.backend.definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAGnF,iEAAiE;AACjE,sBAAsB;AACtB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,qBAAqB;IACrB,WAAW;IACX,qBAAqB;IAErB,sBAAsB,EAAE;QACtB,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,mFAAmF;QACzF,IAAI,EAAE,gCAAgC,CAAC,QAAQ;QAC/C,WAAW,EAAE,QAAiB;KAC/B;IAED,iBAAiB,EAAE;QACjB,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,gCAAgC,CAAC,QAAQ;QAC/C,WAAW,EAAE,QAAiB;KAC/B;IAED,kBAAkB,EAAE;QAClB,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,wDAAwD;QAC9D,IAAI,EAAE,gCAAgC,CAAC,QAAQ;QAC/C,WAAW,EAAE,QAAiB;KAC/B;IAED,aAAa,EAAE;QACb,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mDAAmD;QACzD,IAAI,EAAE,gCAAgC,CAAC,QAAQ;QAC/C,WAAW,EAAE,QAAiB;KAC/B;IAED,qBAAqB;IACrB,UAAU;IACV,qBAAqB;IAErB,aAAa,EAAE;QACb,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,8EAA8E;QACpF,IAAI,EAAE,gCAAgC,CAAC,OAAO;QAC9C,WAAW,EAAE,QAAiB;KAC/B;IAED,kBAAkB,EAAE;QAClB,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,gCAAgC,CAAC,OAAO;QAC9C,WAAW,EAAE,MAAe;KAC7B;IAED,qBAAqB;IACrB,SAAS;IACT,qBAAqB;IAErB,0BAA0B,EAAE;QAC1B,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,iFAAiF;QACvF,IAAI,EAAE,gCAAgC,CAAC,MAAM;QAC7C,WAAW,EAAE,QAAiB;KAC/B;IAED,gCAAgC,EAAE;QAChC,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,gCAAgC,CAAC,MAAM;QAC7C,WAAW,EAAE,QAAiB;KAC/B;IAED,oBAAoB,EAAE;QACpB,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,gCAAgC,CAAC,MAAM;QAC7C,WAAW,EAAE,MAAe;KAC7B;IAED,qBAAqB;IACrB,QAAQ;IACR,qBAAqB;IAErB,mBAAmB,EAAE;QACnB,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,4DAA4D;QAClE,IAAI,EAAE,gCAAgC,CAAC,KAAK;QAC5C,WAAW,EAAE,MAAe;KAC7B;IAED,cAAc,EAAE;QACd,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,gCAAgC,CAAC,KAAK;QAC5C,WAAW,EAAE,MAAe;KAC7B;IAED,qBAAqB,EAAE;QACrB,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,uEAAuE;QAC7E,IAAI,EAAE,gCAAgC,CAAC,KAAK;QAC5C,WAAW,EAAE,MAAe;KAC7B;IAED,qBAAqB;IACrB,aAAa;IACb,qBAAqB;IAErB,oBAAoB,EAAE;QACpB,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,gDAAgD;QACtD,IAAI,EAAE,gCAAgC,CAAC,UAAU;QACjD,WAAW,EAAE,MAAe;KAC7B;IAED,qBAAqB,EAAE;QACrB,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,+EAA+E;QACrF,IAAI,EAAE,gCAAgC,CAAC,UAAU;QACjD,WAAW,EAAE,MAAe;KAC7B;CAEO,CAAC;AAKX,iEAAiE;AACjE,uBAAuB;AACvB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,qBAAqB;IACrB,YAAY;IACZ,qBAAqB;IAErB,wBAAwB,EAAE,mDAAmD;IAC7E,YAAY,EAAE,kDAAkD;IAChE,cAAc,EAAE,0CAA0C;IAC1D,eAAe,EAAE,qDAAqD;IAEtE,qBAAqB;IACrB,UAAU;IACV,qBAAqB;IAErB,uBAAuB,EAAE,6CAA6C;IACtE,uBAAuB,EAAE,kDAAkD;IAC3E,iBAAiB,EAAE,4DAA4D;IAC/E,YAAY,EAAE,6DAA6D;IAE3E,qBAAqB;IACrB,SAAS;IACT,qBAAqB;IAErB,sBAAsB,EAAE,iDAAiD;IACzE,eAAe,EAAE,uCAAuC;IACxD,aAAa,EAAE,uDAAuD;IAEtE,qBAAqB;IACrB,UAAU;IACV,qBAAqB;IAErB,oBAAoB,EAAE,yDAAyD;IAC/E,kBAAkB,EAAE,sDAAsD;IAE1E,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IAErB,kBAAkB,EAAE,+DAA+D;IACnF,mBAAmB,EAAE,qDAAqD;IAC1E,aAAa,EAAE,mEAAmE;IAElF,qBAAqB;IACrB,wBAAwB;IACxB,qBAAqB;IAErB,iBAAiB,EAAE,0DAA0D;IAC7E,qBAAqB,EAAE,wDAAwD;IAC/E,sBAAsB,EAAE,8CAA8C;IAEtE,qBAAqB;IACrB,qBAAqB;IACrB,qBAAqB;IAErB,kBAAkB,EAAE,wDAAwD;IAC5E,iBAAiB,EAAE,4CAA4C;IAC/D,0BAA0B,EAAE,mDAAmD;CAEvE,CAAC;AAKX,iEAAiE;AACjE,gBAAgB;AAChB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,qBAAqB;IACrB,uBAAuB;IACvB,qBAAqB;IAErB,0BAA0B,EAAE,2CAA2C;IACvE,yBAAyB,EAAE,kDAAkD;IAC7E,wBAAwB,EAAE,+CAA+C;IACzE,sBAAsB,EAAE,sDAAsD;IAC9E,oBAAoB,EAAE,mCAAmC;IAEzD,qBAAqB;IACrB,gBAAgB;IAChB,qBAAqB;IAErB,SAAS,EAAE,wCAAwC;IACnD,YAAY,EAAE,0CAA0C;IACxD,eAAe,EAAE,iDAAiD;IAClE,qBAAqB,EAAE,uCAAuC;IAE9D,qBAAqB;IACrB,UAAU;IACV,qBAAqB;IAErB,qBAAqB,EAAE,8CAA8C;IACrE,mBAAmB,EAAE,sCAAsC;IAC3D,eAAe,EAAE,sCAAsC;CAE/C,CAAC;AAKX,iEAAiE;AACjE,uBAAuB;AACvB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,WAAW;IACX,qBAAqB;IAErB,eAAe,EAAE,yDAAyD;IAC1E,yBAAyB,EAAE,8CAA8C;IACzE,eAAe,EAAE,gCAAgC;IAEjD,qBAAqB;IACrB,aAAa;IACb,qBAAqB;IAErB,eAAe,EAAE,mDAAmD;IACpE,cAAc,EAAE,yDAAyD;IACzE,oBAAoB,EAAE,mDAAmD;IACzE,qBAAqB,EAAE,oDAAoD;IAE3E,qBAAqB;IACrB,QAAQ;IACR,qBAAqB;IAErB,oBAAoB,EAAE,mDAAmD;IACzE,0BAA0B,EAAE,8CAA8C;IAC1E,gBAAgB,EAAE,8CAA8C;CAExD,CAAC;AAKX,iEAAiE;AACjE,wBAAwB;AACxB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,qBAAqB;IACrB,YAAY;IACZ,qBAAqB;IAErB;;;OAGG;IACH,aAAa,EAAE;QACb,WAAW,EAAE,CAAC;KACf;IAED,cAAc,EAAE;QACd,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE,GAAG;KACV;IAED,qBAAqB;IACrB,WAAW;IACX,qBAAqB;IAErB,QAAQ,EAAE;QACR,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE,IAAI;KACX;IAED,QAAQ,EAAE;QACR,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE,GAAG;KACV;IAED,eAAe,EAAE;QACf,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE,GAAG;KACV;IAED,qBAAqB;IACrB,cAAc;IACd,qBAAqB;IAErB;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE;QACb,eAAe,EAAE,2BAA2B,CAAC,IAAI;KAClD;IAED,eAAe,EAAE;QACf,sBAAsB,EAAE,IAAI;KAC7B;IAED,cAAc,EAAE;QACd,aAAa,EAAE,IAAI;KACpB;IAED,eAAe,EAAE;QACf,WAAW,EAAE,GAAG;QAChB,gBAAgB,EAAE,GAAG;KACtB;CAEO,CAAC;AAKX,iEAAiE;AACjE,uBAAuB;AACvB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,qBAAqB;IACrB,WAAW;IACX,qBAAqB;IAErB,iBAAiB,EAAE;QACjB,YAAY,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,CAAC;KAC7E;IAED,qBAAqB;IACrB,OAAO;IACP,qBAAqB;IAErB,WAAW,EAAE;QACX,YAAY,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,qBAAqB,CAAC;KAC7D;IAED,eAAe,EAAE;QACf,YAAY,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,CAAC;KACpE;IAED,qBAAqB;IACrB,OAAO;IACP,qBAAqB;IAErB,aAAa,EAAE;QACb,YAAY,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;KACpE;IAED,qBAAqB;IACrB,aAAa;IACb,qBAAqB;IAErB,UAAU,EAAE;QACV,YAAY,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;KACvE;CAEO,CAAC;AAKX,iEAAiE;AACjE,sBAAsB;AACtB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,cAAc;IACd,qBAAqB;IAErB,cAAc,EAAE;QACd,OAAO,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,EAAE,SAAS,CAAC;KAC1D;IAED,qBAAqB;IACrB,UAAU;IACV,qBAAqB;IAErB,cAAc,EAAE;QACd,OAAO,EAAE,CAAC,aAAa,EAAE,gBAAgB,CAAC;KAC3C;IAED,qBAAqB;IACrB,WAAW;IACX,qBAAqB;IAErB,eAAe,EAAE;QACf,OAAO,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC;KACzC;CAEO,CAAC","sourcesContent":["/*\n Agent Catalogs - Reusable atomic elements for agent composition\n * \n * Catalogs provide typed, reusable building blocks:\n * - ConstraintsCatalog: Security, privacy, safety, scope, compliance constraints\n * - InstructionsCatalog: Behavioral instruction strings\n * - HintsCatalog: Soft guidance preferences\n * - OutOfScopeCatalog: Explicit scope boundaries\n * - ModelPresetsCatalog: LLM configuration presets\n * - ToolBundlesCatalog: Tool function bundles\n * - MCPBundlesCatalog: MCP server bundles\n * \n * @see AGENT_FACETS_AND_CATALOGS.md for design documentation\n /\n\nimport { FlowsActors_Agent_ConstraintType } from '@wildo-ai/saas-models';\nimport { LLMProvider_ReasoningEffort } from '@wildo-ai/external-connectors-models';\n\n\n//===============================================================\n// CONSTRAINTS CATALOG\n//===============================================================\n\nexport const ConstraintsCatalog = {\n //===================\n // SECURITY\n //===================\n \n NO_CREDENTIAL_EXPOSURE: {\n id: \"sec-no-creds\",\n text: \"Never expose credentials, API keys, secrets, or internal system details in output\",\n type: FlowsActors_Agent_ConstraintType.SECURITY,\n onViolation: \"refuse\" as const,\n },\n \n NO_SECRET_LOGGING: {\n id: \"sec-no-log-secrets\",\n text: \"Never log, store, or transmit sensitive credentials or tokens\",\n type: FlowsActors_Agent_ConstraintType.SECURITY,\n onViolation: \"refuse\" as const,\n },\n \n NO_BYPASS_SECURITY: {\n id: \"sec-no-bypass\",\n text: \"Never suggest bypassing or weakening security controls\",\n type: FlowsActors_Agent_ConstraintType.SECURITY,\n onViolation: \"refuse\" as const,\n },\n \n ANALYSIS_ONLY: {\n id: \"sec-analysis-only\",\n text: \"Only analyze code, never execute, run, or test it\",\n type: FlowsActors_Agent_ConstraintType.SECURITY,\n onViolation: \"refuse\" as const,\n },\n \n //===================\n // PRIVACY\n //===================\n \n NO_PII_OUTPUT: {\n id: \"priv-no-pii\",\n text: \"Do not include or expose personally identifiable information (PII) in output\",\n type: FlowsActors_Agent_ConstraintType.PRIVACY,\n onViolation: \"refuse\" as const,\n },\n \n ANONYMIZE_EXAMPLES: {\n id: \"priv-anon-examples\",\n text: \"Always anonymize any examples that could identify individuals\",\n type: FlowsActors_Agent_ConstraintType.PRIVACY,\n onViolation: \"warn\" as const,\n },\n \n //===================\n // SAFETY\n //===================\n \n CONFIRM_BEFORE_DESTRUCTIVE: {\n id: \"safe-confirm-destructive\",\n text: \"Always require explicit confirmation before destructive or irreversible actions\",\n type: FlowsActors_Agent_ConstraintType.SAFETY,\n onViolation: \"refuse\" as const,\n },\n \n NO_PRODUCTION_CHANGES_UNATTENDED: {\n id: \"safe-no-prod-unattended\",\n text: \"Never modify production systems without explicit user approval\",\n type: FlowsActors_Agent_ConstraintType.SAFETY,\n onViolation: \"refuse\" as const,\n },\n \n VERIFY_PREREQUISITES: {\n id: \"safe-verify-prereqs\",\n text: \"Verify all prerequisites before proceeding with any operation\",\n type: FlowsActors_Agent_ConstraintType.SAFETY,\n onViolation: \"warn\" as const,\n },\n \n //===================\n // SCOPE\n //===================\n \n STAY_IN_TASK_BOUNDS: {\n id: \"scope-task-bounds\",\n text: \"Only operate within the explicitly defined task boundaries\",\n type: FlowsActors_Agent_ConstraintType.SCOPE,\n onViolation: \"warn\" as const,\n },\n \n NO_SCOPE_CREEP: {\n id: \"scope-no-creep\",\n text: \"Do not add features or functionality not explicitly requested\",\n type: FlowsActors_Agent_ConstraintType.SCOPE,\n onViolation: \"warn\" as const,\n },\n \n SINGLE_RESPONSIBILITY: {\n id: \"scope-single-resp\",\n text: \"Focus on the specific task, do not attempt to solve adjacent problems\",\n type: FlowsActors_Agent_ConstraintType.SCOPE,\n onViolation: \"warn\" as const,\n },\n \n //===================\n // COMPLIANCE\n //===================\n \n DOCUMENT_ALL_ACTIONS: {\n id: \"comp-doc-actions\",\n text: \"Document every action taken for audit purposes\",\n type: FlowsActors_Agent_ConstraintType.COMPLIANCE,\n onViolation: \"warn\" as const,\n },\n \n FOLLOW_DATA_RETENTION: {\n id: \"comp-data-retention\",\n text: \"Adhere to data retention policies - do not persist data beyond required scope\",\n type: FlowsActors_Agent_ConstraintType.COMPLIANCE,\n onViolation: \"warn\" as const,\n },\n \n} as const;\n\nexport type ConstraintId = keyof typeof ConstraintsCatalog;\n\n\n//===============================================================\n// INSTRUCTIONS CATALOG\n//===============================================================\n\nexport const InstructionsCatalog = {\n //===================\n // STRUCTURE\n //===================\n \n USE_CONSISTENT_STRUCTURE: \"Present output in a structured, consistent format\",\n CITE_SOURCES: \"Cite specific sources or evidence for all claims\",\n SHOW_REASONING: \"Explain the reasoning behind conclusions\",\n SUMMARIZE_FIRST: \"Start with a brief summary before detailed analysis\",\n \n //===================\n // QUALITY\n //===================\n \n VERIFY_BEFORE_ASSERTING: \"Verify information before making assertions\",\n ACKNOWLEDGE_LIMITATIONS: \"Acknowledge limitations and areas of uncertainty\",\n PREFER_SIMPLICITY: \"Prefer simpler solutions over complex ones when equivalent\",\n AVOID_JARGON: \"Avoid unnecessary jargon; explain technical terms when used\",\n \n //===================\n // SAFETY\n //===================\n \n LOG_DECISION_RATIONALE: \"Log the rationale for each significant decision\",\n VALIDATE_INPUTS: \"Validate all inputs before processing\",\n CHECK_OUTPUTS: \"Verify outputs match expected format before returning\",\n \n //===================\n // PRIVACY\n //===================\n \n REDACT_PII_IN_OUTPUT: \"Redact any PII (names, emails, phone numbers) in output\",\n USE_SYNTHETIC_DATA: \"Use synthetic data for examples instead of real data\",\n \n //===================\n // DOMAIN: Security\n //===================\n \n FOCUS_OWASP_TOP_10: \"Focus on OWASP Top 10 vulnerabilities when reviewing security\",\n PROVIDE_REMEDIATION: \"Provide specific remediation steps for each finding\",\n RATE_SEVERITY: \"Rate each finding by severity (Critical, High, Medium, Low, Info)\",\n \n //===================\n // DOMAIN: Data Analysis\n //===================\n \n IDENTIFY_PATTERNS: \"Identify key themes and patterns in the provided content\",\n SUPPORT_WITH_EVIDENCE: \"Support findings with specific evidence from the input\",\n QUANTIFY_WHEN_POSSIBLE: \"Quantify findings with metrics when possible\",\n \n //===================\n // DOMAIN: Operations\n //===================\n \n DOCUMENT_EACH_STEP: \"Document each step of the operation for audit purposes\",\n VALIDATE_OUTCOMES: \"Validate outcomes against expected results\",\n STATE_IMPACT_BEFORE_ACTION: \"Before any action, clearly state what will happen\",\n \n} as const;\n\nexport type InstructionId = keyof typeof InstructionsCatalog;\n\n\n//===============================================================\n// HINTS CATALOG\n//===============================================================\n\nexport const HintsCatalog = {\n //===================\n // BEHAVIOR PREFERENCES\n //===================\n \n PREFER_ACCURACY_OVER_SPEED: \"When in doubt, prefer accuracy over speed\",\n PREFER_REVERSIBLE_ACTIONS: \"Prefer reversible actions over irreversible ones\",\n FAIL_SAFE_ON_UNCERTAINTY: \"When uncertain, fail safely rather than guess\",\n ASK_RATHER_THAN_ASSUME: \"Ask for clarification rather than making assumptions\",\n DOCUMENT_ASSUMPTIONS: \"Document any assumptions you make\",\n \n //===================\n // COMMUNICATION\n //===================\n \n BE_DIRECT: \"Be direct and get to the point quickly\",\n USE_EXAMPLES: \"Use examples to clarify complex concepts\",\n MATCH_USER_TONE: \"Match the formality level of the user's request\",\n ANTICIPATE_FOLLOW_UPS: \"Anticipate likely follow-up questions\",\n \n //===================\n // QUALITY\n //===================\n \n DOUBLE_CHECK_CRITICAL: \"Double-check critical calculations and facts\",\n CONSIDER_EDGE_CASES: \"Consider edge cases in your analysis\",\n TEST_YOUR_LOGIC: \"Walk through your logic step by step\",\n \n} as const;\n\nexport type HintId = keyof typeof HintsCatalog;\n\n\n//===============================================================\n// OUT OF SCOPE CATALOG\n//===============================================================\n\nexport const OutOfScopeCatalog = {\n //===================\n // SECURITY\n //===================\n \n NO_EXPLOIT_CODE: \"Do not provide exploit code or proof-of-concept attacks\",\n NO_SECURITY_BYPASS_ADVICE: \"Do not advise on bypassing security measures\",\n NO_EXECUTE_CODE: \"Do not execute or run any code\",\n \n //===================\n // OPERATIONS\n //===================\n \n NO_AUTO_EXECUTE: \"Do not auto-execute without explicit confirmation\",\n NO_PROD_MODIFY: \"Do not modify production data without explicit approval\",\n NO_BYPASS_VALIDATION: \"Do not bypass security checks or validation steps\",\n NO_ASSUME_INFRA_STATE: \"Do not make assumptions about infrastructure state\",\n \n //===================\n // SCOPE\n //===================\n \n NO_ADJACENT_PROBLEMS: \"Do not solve problems outside the requested scope\",\n NO_UNSOLICITED_REFACTORING: \"Do not refactor code unless explicitly asked\",\n NO_FEATURE_CREEP: \"Do not add features not explicitly requested\",\n \n} as const;\n\nexport type OutOfScopeId = keyof typeof OutOfScopeCatalog;\n\n\n//===============================================================\n// MODEL PRESETS CATALOG\n//===============================================================\n\nexport const ModelPresetsCatalog = {\n //===================\n // PRECISION\n //===================\n \n /\n Deterministic output with zero randomness\n * Note: Use agent-level config.seed for reproducible outputs if needed\n /\n DETERMINISTIC: {\n temperature: 0,\n },\n \n LOW_CREATIVITY: {\n temperature: 0.2,\n topP: 0.9,\n },\n \n //===================\n // CREATIVE\n //===================\n \n BALANCED: {\n temperature: 0.5,\n topP: 0.95,\n },\n \n CREATIVE: {\n temperature: 0.8,\n topP: 1.0,\n },\n \n HIGH_CREATIVITY: {\n temperature: 1.0,\n topP: 1.0,\n },\n \n //===================\n // SPECIALIZED\n //===================\n \n /\n Deep reasoning. Expressed as `reasoningEffort: HIGH` — the single authority\n * on reasoning depth, forwarded to the provider's native reasoning setting.\n \n This preset previously set an inert `thinkingEnabled: true` (retired\n * 2026-07-17): no executor ever read it, so composing it changed NOTHING.\n * `HIGH` (not XHIGH) is the deliberate default — it is the deep-judgment tier\n * used by the derivation/critique/judge agents, and it is supported by every\n * reasoning model we ship.\n \n Do NOT pair this preset with a non-reasoning model: registration validates\n * `model × reasoningEffort` against verified capability and will fail closed.\n */\n THINKING_MODE: {\n reasoningEffort: LLMProvider_ReasoningEffort.HIGH,\n },\n \n TOOLING_ENABLED: {\n toolingFunctionEnabled: true,\n },\n \n MCP_COMPATIBLE: {\n mcpCompatible: true,\n },\n \n CODE_GENERATION: {\n temperature: 0.2,\n frequencyPenalty: 0.1,\n },\n \n} as const;\n\nexport type ModelPresetId = keyof typeof ModelPresetsCatalog;\n\n\n//===============================================================\n// TOOL BUNDLES CATALOG\n//===============================================================\n\nexport const ToolBundlesCatalog = {\n //===================\n // SECURITY\n //===================\n \n SECURITY_ANALYSIS: {\n functionRefs: [\"security-scanner\", \"dependency-checker\", \"secrets-detector\"],\n },\n \n //===================\n // CODE\n //===================\n \n CODE_REVIEW: {\n functionRefs: [\"linter\", \"formatter\", \"complexity-analyzer\"],\n },\n \n CODE_GENERATION: {\n functionRefs: [\"code-generator\", \"test-generator\", \"doc-generator\"],\n },\n \n //===================\n // DATA\n //===================\n \n DATA_ANALYSIS: {\n functionRefs: [\"data-query\", \"chart-generator\", \"stats-calculator\"],\n },\n \n //===================\n // OPERATIONS\n //===================\n \n DEPLOYMENT: {\n functionRefs: [\"kubectl-runner\", \"health-checker\", \"rollback-trigger\"],\n },\n \n} as const;\n\nexport type ToolBundleId = keyof typeof ToolBundlesCatalog;\n\n\n//===============================================================\n// MCP BUNDLES CATALOG\n//===============================================================\n\nexport const MCPBundlesCatalog = {\n //===================\n // DEVELOPMENT\n //===================\n \n CODE_ASSISTANT: {\n mcpRefs: [\"filesystem-mcp\", \"code-editor-mcp\", \"git-mcp\"],\n },\n \n //===================\n // BROWSER\n //===================\n \n WEB_AUTOMATION: {\n mcpRefs: [\"browser-mcp\", \"screenshot-mcp\"],\n },\n \n //===================\n // DATABASE\n //===================\n \n DATABASE_ACCESS: {\n mcpRefs: [\"mongodb-mcp\", \"postgres-mcp\"],\n },\n \n} as const;\n\nexport type MCPBundleId = keyof typeof MCPBundlesCatalog;\n"]}
1	+ {"version":3,"file":"agent-catalogs.backend.definitions.js","sourceRoot":"","sources":["../../../../../src/flows-actors/models/agent-catalogs.backend.definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAGnF,iEAAiE;AACjE,sBAAsB;AACtB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,qBAAqB;IACrB,WAAW;IACX,qBAAqB;IAErB,sBAAsB,EAAE;QACtB,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,mFAAmF;QACzF,IAAI,EAAE,gCAAgC,CAAC,QAAQ;QAC/C,WAAW,EAAE,QAAiB;KAC/B;IAED,iBAAiB,EAAE;QACjB,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,gCAAgC,CAAC,QAAQ;QAC/C,WAAW,EAAE,QAAiB;KAC/B;IAED,kBAAkB,EAAE;QAClB,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,wDAAwD;QAC9D,IAAI,EAAE,gCAAgC,CAAC,QAAQ;QAC/C,WAAW,EAAE,QAAiB;KAC/B;IAED,aAAa,EAAE;QACb,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mDAAmD;QACzD,IAAI,EAAE,gCAAgC,CAAC,QAAQ;QAC/C,WAAW,EAAE,QAAiB;KAC/B;IAED,qBAAqB;IACrB,UAAU;IACV,qBAAqB;IAErB,aAAa,EAAE;QACb,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,8EAA8E;QACpF,IAAI,EAAE,gCAAgC,CAAC,OAAO;QAC9C,WAAW,EAAE,QAAiB;KAC/B;IAED,kBAAkB,EAAE;QAClB,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,gCAAgC,CAAC,OAAO;QAC9C,WAAW,EAAE,MAAe;KAC7B;IAED,qBAAqB;IACrB,SAAS;IACT,qBAAqB;IAErB,0BAA0B,EAAE;QAC1B,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,iFAAiF;QACvF,IAAI,EAAE,gCAAgC,CAAC,MAAM;QAC7C,WAAW,EAAE,QAAiB;KAC/B;IAED,gCAAgC,EAAE;QAChC,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,gEAAgE;QACtE,IAAI,EAAE,gCAAgC,CAAC,MAAM;QAC7C,WAAW,EAAE,QAAiB;KAC/B;IAED,oBAAoB,EAAE;QACpB,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,gCAAgC,CAAC,MAAM;QAC7C,WAAW,EAAE,MAAe;KAC7B;IAED,qBAAqB;IACrB,QAAQ;IACR,qBAAqB;IAErB,mBAAmB,EAAE;QACnB,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,4DAA4D;QAClE,IAAI,EAAE,gCAAgC,CAAC,KAAK;QAC5C,WAAW,EAAE,MAAe;KAC7B;IAED,cAAc,EAAE;QACd,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,+DAA+D;QACrE,IAAI,EAAE,gCAAgC,CAAC,KAAK;QAC5C,WAAW,EAAE,MAAe;KAC7B;IAED,qBAAqB,EAAE;QACrB,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,uEAAuE;QAC7E,IAAI,EAAE,gCAAgC,CAAC,KAAK;QAC5C,WAAW,EAAE,MAAe;KAC7B;IAED,qBAAqB;IACrB,aAAa;IACb,qBAAqB;IAErB,oBAAoB,EAAE;QACpB,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,gDAAgD;QACtD,IAAI,EAAE,gCAAgC,CAAC,UAAU;QACjD,WAAW,EAAE,MAAe;KAC7B;IAED,qBAAqB,EAAE;QACrB,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,+EAA+E;QACrF,IAAI,EAAE,gCAAgC,CAAC,UAAU;QACjD,WAAW,EAAE,MAAe;KAC7B;CAEO,CAAC;AAKX,iEAAiE;AACjE,uBAAuB;AACvB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,qBAAqB;IACrB,YAAY;IACZ,qBAAqB;IAErB,wBAAwB,EAAE,mDAAmD;IAC7E,YAAY,EAAE,kDAAkD;IAChE,cAAc,EAAE,0CAA0C;IAC1D,eAAe,EAAE,qDAAqD;IAEtE,qBAAqB;IACrB,UAAU;IACV,qBAAqB;IAErB,uBAAuB,EAAE,6CAA6C;IACtE,uBAAuB,EAAE,kDAAkD;IAC3E,iBAAiB,EAAE,4DAA4D;IAC/E,YAAY,EAAE,6DAA6D;IAE3E,qBAAqB;IACrB,SAAS;IACT,qBAAqB;IAErB,sBAAsB,EAAE,iDAAiD;IACzE,eAAe,EAAE,uCAAuC;IACxD,aAAa,EAAE,uDAAuD;IAEtE,qBAAqB;IACrB,UAAU;IACV,qBAAqB;IAErB,oBAAoB,EAAE,yDAAyD;IAC/E,kBAAkB,EAAE,sDAAsD;IAE1E,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IAErB,kBAAkB,EAAE,+DAA+D;IACnF,mBAAmB,EAAE,qDAAqD;IAC1E,aAAa,EAAE,mEAAmE;IAElF,qBAAqB;IACrB,wBAAwB;IACxB,qBAAqB;IAErB,iBAAiB,EAAE,0DAA0D;IAC7E,qBAAqB,EAAE,wDAAwD;IAC/E,sBAAsB,EAAE,8CAA8C;IAEtE,qBAAqB;IACrB,qBAAqB;IACrB,qBAAqB;IAErB,kBAAkB,EAAE,wDAAwD;IAC5E,iBAAiB,EAAE,4CAA4C;IAC/D,0BAA0B,EAAE,mDAAmD;CAEvE,CAAC;AAKX,iEAAiE;AACjE,gBAAgB;AAChB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,qBAAqB;IACrB,uBAAuB;IACvB,qBAAqB;IAErB,0BAA0B,EAAE,2CAA2C;IACvE,yBAAyB,EAAE,kDAAkD;IAC7E,wBAAwB,EAAE,+CAA+C;IACzE,sBAAsB,EAAE,sDAAsD;IAC9E,oBAAoB,EAAE,mCAAmC;IAEzD,qBAAqB;IACrB,gBAAgB;IAChB,qBAAqB;IAErB,SAAS,EAAE,wCAAwC;IACnD,YAAY,EAAE,0CAA0C;IACxD,eAAe,EAAE,iDAAiD;IAClE,qBAAqB,EAAE,uCAAuC;IAE9D,qBAAqB;IACrB,UAAU;IACV,qBAAqB;IAErB,qBAAqB,EAAE,8CAA8C;IACrE,mBAAmB,EAAE,sCAAsC;IAC3D,eAAe,EAAE,sCAAsC;CAE/C,CAAC;AAKX,iEAAiE;AACjE,uBAAuB;AACvB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,qBAAqB;IACrB,WAAW;IACX,qBAAqB;IAErB,eAAe,EAAE,yDAAyD;IAC1E,yBAAyB,EAAE,8CAA8C;IACzE,eAAe,EAAE,gCAAgC;IAEjD,qBAAqB;IACrB,aAAa;IACb,qBAAqB;IAErB,eAAe,EAAE,mDAAmD;IACpE,cAAc,EAAE,yDAAyD;IACzE,oBAAoB,EAAE,mDAAmD;IACzE,qBAAqB,EAAE,oDAAoD;IAE3E,qBAAqB;IACrB,QAAQ;IACR,qBAAqB;IAErB,oBAAoB,EAAE,mDAAmD;IACzE,0BAA0B,EAAE,8CAA8C;IAC1E,gBAAgB,EAAE,8CAA8C;CAExD,CAAC;AAKX,iEAAiE;AACjE,wBAAwB;AACxB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,qBAAqB;IACrB,YAAY;IACZ,qBAAqB;IAErB;;;OAGG;IACH,aAAa,EAAE;QACb,WAAW,EAAE,CAAC;KACf;IAED,cAAc,EAAE;QACd,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE,GAAG;KACV;IAED,qBAAqB;IACrB,WAAW;IACX,qBAAqB;IAErB,QAAQ,EAAE;QACR,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE,IAAI;KACX;IAED,QAAQ,EAAE;QACR,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE,GAAG;KACV;IAED,eAAe,EAAE;QACf,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE,GAAG;KACV;IAED,qBAAqB;IACrB,cAAc;IACd,qBAAqB;IAErB;;;;;;;;;;;;OAYG;IACH,aAAa,EAAE;QACb,eAAe,EAAE,2BAA2B,CAAC,IAAI;KAClD;IAED,eAAe,EAAE;QACf,sBAAsB,EAAE,IAAI;KAC7B;IAED,cAAc,EAAE;QACd,aAAa,EAAE,IAAI;KACpB;IAED,eAAe,EAAE;QACf,WAAW,EAAE,GAAG;QAChB,gBAAgB,EAAE,GAAG;KACtB;CAEO,CAAC;AAKX,iEAAiE;AACjE,uBAAuB;AACvB,iEAAiE;AAEjE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,qBAAqB;IACrB,WAAW;IACX,qBAAqB;IAErB,iBAAiB,EAAE;QACjB,YAAY,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,kBAAkB,CAAC;KAC7E;IAED,qBAAqB;IACrB,OAAO;IACP,qBAAqB;IAErB,WAAW,EAAE;QACX,YAAY,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,qBAAqB,CAAC;KAC7D;IAED,eAAe,EAAE;QACf,YAAY,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,CAAC;KACpE;IAED,qBAAqB;IACrB,OAAO;IACP,qBAAqB;IAErB,aAAa,EAAE;QACb,YAAY,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;KACpE;IAED,qBAAqB;IACrB,aAAa;IACb,qBAAqB;IAErB,UAAU,EAAE;QACV,YAAY,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;KACvE;CAEO,CAAC;AAKX,iEAAiE;AACjE,kDAAkD;AAClD,iEAAiE;AACjE,EAAE;AACF,gGAAgG;AAChG,oGAAoG;AACpG,kGAAkG;AAClG,8DAA8D;AAC9D,EAAE;AACF,iGAAiG;AACjG,qCAAqC;AACrC,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,oGAAoG;AACpG,sDAAsD","sourcesContent":["/*\n Agent Catalogs - Reusable atomic elements for agent composition\n * \n * Catalogs provide typed, reusable building blocks:\n * - ConstraintsCatalog: Security, privacy, safety, scope, compliance constraints\n * - InstructionsCatalog: Behavioral instruction strings\n * - HintsCatalog: Soft guidance preferences\n * - OutOfScopeCatalog: Explicit scope boundaries\n * - ModelPresetsCatalog: LLM configuration presets\n * - ToolBundlesCatalog: Tool function bundles\n * \n * @see AGENT_FACETS_AND_CATALOGS.md for design documentation\n /\n\nimport { FlowsActors_Agent_ConstraintType } from '@wildo-ai/saas-models';\nimport { LLMProvider_ReasoningEffort } from '@wildo-ai/external-connectors-models';\n\n\n//===============================================================\n// CONSTRAINTS CATALOG\n//===============================================================\n\nexport const ConstraintsCatalog = {\n //===================\n // SECURITY\n //===================\n \n NO_CREDENTIAL_EXPOSURE: {\n id: \"sec-no-creds\",\n text: \"Never expose credentials, API keys, secrets, or internal system details in output\",\n type: FlowsActors_Agent_ConstraintType.SECURITY,\n onViolation: \"refuse\" as const,\n },\n \n NO_SECRET_LOGGING: {\n id: \"sec-no-log-secrets\",\n text: \"Never log, store, or transmit sensitive credentials or tokens\",\n type: FlowsActors_Agent_ConstraintType.SECURITY,\n onViolation: \"refuse\" as const,\n },\n \n NO_BYPASS_SECURITY: {\n id: \"sec-no-bypass\",\n text: \"Never suggest bypassing or weakening security controls\",\n type: FlowsActors_Agent_ConstraintType.SECURITY,\n onViolation: \"refuse\" as const,\n },\n \n ANALYSIS_ONLY: {\n id: \"sec-analysis-only\",\n text: \"Only analyze code, never execute, run, or test it\",\n type: FlowsActors_Agent_ConstraintType.SECURITY,\n onViolation: \"refuse\" as const,\n },\n \n //===================\n // PRIVACY\n //===================\n \n NO_PII_OUTPUT: {\n id: \"priv-no-pii\",\n text: \"Do not include or expose personally identifiable information (PII) in output\",\n type: FlowsActors_Agent_ConstraintType.PRIVACY,\n onViolation: \"refuse\" as const,\n },\n \n ANONYMIZE_EXAMPLES: {\n id: \"priv-anon-examples\",\n text: \"Always anonymize any examples that could identify individuals\",\n type: FlowsActors_Agent_ConstraintType.PRIVACY,\n onViolation: \"warn\" as const,\n },\n \n //===================\n // SAFETY\n //===================\n \n CONFIRM_BEFORE_DESTRUCTIVE: {\n id: \"safe-confirm-destructive\",\n text: \"Always require explicit confirmation before destructive or irreversible actions\",\n type: FlowsActors_Agent_ConstraintType.SAFETY,\n onViolation: \"refuse\" as const,\n },\n \n NO_PRODUCTION_CHANGES_UNATTENDED: {\n id: \"safe-no-prod-unattended\",\n text: \"Never modify production systems without explicit user approval\",\n type: FlowsActors_Agent_ConstraintType.SAFETY,\n onViolation: \"refuse\" as const,\n },\n \n VERIFY_PREREQUISITES: {\n id: \"safe-verify-prereqs\",\n text: \"Verify all prerequisites before proceeding with any operation\",\n type: FlowsActors_Agent_ConstraintType.SAFETY,\n onViolation: \"warn\" as const,\n },\n \n //===================\n // SCOPE\n //===================\n \n STAY_IN_TASK_BOUNDS: {\n id: \"scope-task-bounds\",\n text: \"Only operate within the explicitly defined task boundaries\",\n type: FlowsActors_Agent_ConstraintType.SCOPE,\n onViolation: \"warn\" as const,\n },\n \n NO_SCOPE_CREEP: {\n id: \"scope-no-creep\",\n text: \"Do not add features or functionality not explicitly requested\",\n type: FlowsActors_Agent_ConstraintType.SCOPE,\n onViolation: \"warn\" as const,\n },\n \n SINGLE_RESPONSIBILITY: {\n id: \"scope-single-resp\",\n text: \"Focus on the specific task, do not attempt to solve adjacent problems\",\n type: FlowsActors_Agent_ConstraintType.SCOPE,\n onViolation: \"warn\" as const,\n },\n \n //===================\n // COMPLIANCE\n //===================\n \n DOCUMENT_ALL_ACTIONS: {\n id: \"comp-doc-actions\",\n text: \"Document every action taken for audit purposes\",\n type: FlowsActors_Agent_ConstraintType.COMPLIANCE,\n onViolation: \"warn\" as const,\n },\n \n FOLLOW_DATA_RETENTION: {\n id: \"comp-data-retention\",\n text: \"Adhere to data retention policies - do not persist data beyond required scope\",\n type: FlowsActors_Agent_ConstraintType.COMPLIANCE,\n onViolation: \"warn\" as const,\n },\n \n} as const;\n\nexport type ConstraintId = keyof typeof ConstraintsCatalog;\n\n\n//===============================================================\n// INSTRUCTIONS CATALOG\n//===============================================================\n\nexport const InstructionsCatalog = {\n //===================\n // STRUCTURE\n //===================\n \n USE_CONSISTENT_STRUCTURE: \"Present output in a structured, consistent format\",\n CITE_SOURCES: \"Cite specific sources or evidence for all claims\",\n SHOW_REASONING: \"Explain the reasoning behind conclusions\",\n SUMMARIZE_FIRST: \"Start with a brief summary before detailed analysis\",\n \n //===================\n // QUALITY\n //===================\n \n VERIFY_BEFORE_ASSERTING: \"Verify information before making assertions\",\n ACKNOWLEDGE_LIMITATIONS: \"Acknowledge limitations and areas of uncertainty\",\n PREFER_SIMPLICITY: \"Prefer simpler solutions over complex ones when equivalent\",\n AVOID_JARGON: \"Avoid unnecessary jargon; explain technical terms when used\",\n \n //===================\n // SAFETY\n //===================\n \n LOG_DECISION_RATIONALE: \"Log the rationale for each significant decision\",\n VALIDATE_INPUTS: \"Validate all inputs before processing\",\n CHECK_OUTPUTS: \"Verify outputs match expected format before returning\",\n \n //===================\n // PRIVACY\n //===================\n \n REDACT_PII_IN_OUTPUT: \"Redact any PII (names, emails, phone numbers) in output\",\n USE_SYNTHETIC_DATA: \"Use synthetic data for examples instead of real data\",\n \n //===================\n // DOMAIN: Security\n //===================\n \n FOCUS_OWASP_TOP_10: \"Focus on OWASP Top 10 vulnerabilities when reviewing security\",\n PROVIDE_REMEDIATION: \"Provide specific remediation steps for each finding\",\n RATE_SEVERITY: \"Rate each finding by severity (Critical, High, Medium, Low, Info)\",\n \n //===================\n // DOMAIN: Data Analysis\n //===================\n \n IDENTIFY_PATTERNS: \"Identify key themes and patterns in the provided content\",\n SUPPORT_WITH_EVIDENCE: \"Support findings with specific evidence from the input\",\n QUANTIFY_WHEN_POSSIBLE: \"Quantify findings with metrics when possible\",\n \n //===================\n // DOMAIN: Operations\n //===================\n \n DOCUMENT_EACH_STEP: \"Document each step of the operation for audit purposes\",\n VALIDATE_OUTCOMES: \"Validate outcomes against expected results\",\n STATE_IMPACT_BEFORE_ACTION: \"Before any action, clearly state what will happen\",\n \n} as const;\n\nexport type InstructionId = keyof typeof InstructionsCatalog;\n\n\n//===============================================================\n// HINTS CATALOG\n//===============================================================\n\nexport const HintsCatalog = {\n //===================\n // BEHAVIOR PREFERENCES\n //===================\n \n PREFER_ACCURACY_OVER_SPEED: \"When in doubt, prefer accuracy over speed\",\n PREFER_REVERSIBLE_ACTIONS: \"Prefer reversible actions over irreversible ones\",\n FAIL_SAFE_ON_UNCERTAINTY: \"When uncertain, fail safely rather than guess\",\n ASK_RATHER_THAN_ASSUME: \"Ask for clarification rather than making assumptions\",\n DOCUMENT_ASSUMPTIONS: \"Document any assumptions you make\",\n \n //===================\n // COMMUNICATION\n //===================\n \n BE_DIRECT: \"Be direct and get to the point quickly\",\n USE_EXAMPLES: \"Use examples to clarify complex concepts\",\n MATCH_USER_TONE: \"Match the formality level of the user's request\",\n ANTICIPATE_FOLLOW_UPS: \"Anticipate likely follow-up questions\",\n \n //===================\n // QUALITY\n //===================\n \n DOUBLE_CHECK_CRITICAL: \"Double-check critical calculations and facts\",\n CONSIDER_EDGE_CASES: \"Consider edge cases in your analysis\",\n TEST_YOUR_LOGIC: \"Walk through your logic step by step\",\n \n} as const;\n\nexport type HintId = keyof typeof HintsCatalog;\n\n\n//===============================================================\n// OUT OF SCOPE CATALOG\n//===============================================================\n\nexport const OutOfScopeCatalog = {\n //===================\n // SECURITY\n //===================\n \n NO_EXPLOIT_CODE: \"Do not provide exploit code or proof-of-concept attacks\",\n NO_SECURITY_BYPASS_ADVICE: \"Do not advise on bypassing security measures\",\n NO_EXECUTE_CODE: \"Do not execute or run any code\",\n \n //===================\n // OPERATIONS\n //===================\n \n NO_AUTO_EXECUTE: \"Do not auto-execute without explicit confirmation\",\n NO_PROD_MODIFY: \"Do not modify production data without explicit approval\",\n NO_BYPASS_VALIDATION: \"Do not bypass security checks or validation steps\",\n NO_ASSUME_INFRA_STATE: \"Do not make assumptions about infrastructure state\",\n \n //===================\n // SCOPE\n //===================\n \n NO_ADJACENT_PROBLEMS: \"Do not solve problems outside the requested scope\",\n NO_UNSOLICITED_REFACTORING: \"Do not refactor code unless explicitly asked\",\n NO_FEATURE_CREEP: \"Do not add features not explicitly requested\",\n \n} as const;\n\nexport type OutOfScopeId = keyof typeof OutOfScopeCatalog;\n\n\n//===============================================================\n// MODEL PRESETS CATALOG\n//===============================================================\n\nexport const ModelPresetsCatalog = {\n //===================\n // PRECISION\n //===================\n \n /\n Deterministic output with zero randomness\n * Note: Use agent-level config.seed for reproducible outputs if needed\n /\n DETERMINISTIC: {\n temperature: 0,\n },\n \n LOW_CREATIVITY: {\n temperature: 0.2,\n topP: 0.9,\n },\n \n //===================\n // CREATIVE\n //===================\n \n BALANCED: {\n temperature: 0.5,\n topP: 0.95,\n },\n \n CREATIVE: {\n temperature: 0.8,\n topP: 1.0,\n },\n \n HIGH_CREATIVITY: {\n temperature: 1.0,\n topP: 1.0,\n },\n \n //===================\n // SPECIALIZED\n //===================\n \n /\n Deep reasoning. Expressed as `reasoningEffort: HIGH` — the single authority\n * on reasoning depth, forwarded to the provider's native reasoning setting.\n \n This preset previously set an inert `thinkingEnabled: true` (retired\n * 2026-07-17): no executor ever read it, so composing it changed NOTHING.\n * `HIGH` (not XHIGH) is the deliberate default — it is the deep-judgment tier\n * used by the derivation/critique/judge agents, and it is supported by every\n * reasoning model we ship.\n \n Do NOT pair this preset with a non-reasoning model: registration validates\n * `model × reasoningEffort` against verified capability and will fail closed.\n */\n THINKING_MODE: {\n reasoningEffort: LLMProvider_ReasoningEffort.HIGH,\n },\n \n TOOLING_ENABLED: {\n toolingFunctionEnabled: true,\n },\n \n MCP_COMPATIBLE: {\n mcpCompatible: true,\n },\n \n CODE_GENERATION: {\n temperature: 0.2,\n frequencyPenalty: 0.1,\n },\n \n} as const;\n\nexport type ModelPresetId = keyof typeof ModelPresetsCatalog;\n\n\n//===============================================================\n// TOOL BUNDLES CATALOG\n//===============================================================\n\nexport const ToolBundlesCatalog = {\n //===================\n // SECURITY\n //===================\n \n SECURITY_ANALYSIS: {\n functionRefs: [\"security-scanner\", \"dependency-checker\", \"secrets-detector\"],\n },\n \n //===================\n // CODE\n //===================\n \n CODE_REVIEW: {\n functionRefs: [\"linter\", \"formatter\", \"complexity-analyzer\"],\n },\n \n CODE_GENERATION: {\n functionRefs: [\"code-generator\", \"test-generator\", \"doc-generator\"],\n },\n \n //===================\n // DATA\n //===================\n \n DATA_ANALYSIS: {\n functionRefs: [\"data-query\", \"chart-generator\", \"stats-calculator\"],\n },\n \n //===================\n // OPERATIONS\n //===================\n \n DEPLOYMENT: {\n functionRefs: [\"kubectl-runner\", \"health-checker\", \"rollback-trigger\"],\n },\n \n} as const;\n\nexport type ToolBundleId = keyof typeof ToolBundlesCatalog;\n\n\n//===============================================================\n// MCP BUNDLES CATALOG — REMOVED 2026-09-09 (#491)\n//===============================================================\n//\n// Held three bundles of invented server names — `filesystem-mcp`, `code-editor-mcp`, `git-mcp`,\n// `browser-mcp`, `screenshot-mcp`, `mongodb-mcp`, `postgres-mcp`. None named a server that existed,\n// nothing resolved them into a callable tool, and the agent card rendered them as capabilities: a\n// claim shown to a user about a reach the agent did not have.\n//\n// Two of the three bundles were referenced by nothing but their own tests. The third reached one\n// core facet, now withdrawn with it.\n//\n// An `mcpRef` now names an MCP server the APPLICATION declared (`FlowsActors_McpServer`), and the\n// registry REFUSES an agent whose refs name no declared server — so this shape cannot be recreated.\n// A shipped catalog of refs is the wrong home by construction: the engine does not know which third\n// parties an application permits its agents to reach.\n"]}

package/dist/esm/flows-actors/models/core-facets.backend.definitions.d.ts CHANGED Viewed

@@ -6,7 +6,7 @@
  * - Compliance: AuditTrailFacet, ConfirmationGateFacet
  * - Quality/Behavior: HighPrecisionFacet, ConservativeFacet, ThinkingModeFacet
  * - Output: VerboseFacet, SuccinctFacet
- * - Domain/Tooling: SecurityAnalysisFacet, MCPCodeAssistantFacet
+ * - Domain/Tooling: SecurityAnalysisFacet
  *
  * Presets (named facet arrays):
  * - CriticalOperationPreset
@@ -27,7 +27,6 @@ export declare const ThinkingModeFacet: AgentFacet;
 export declare const VerboseFacet: AgentFacet;
 export declare const SuccinctFacet: AgentFacet;
 export declare const SecurityAnalysisFacet: AgentFacet;
-export declare const MCPCodeAssistantFacet: AgentFacet;
 export declare const DataAnalysisFacet: AgentFacet;
 /**
  * Critical Operation Preset
@@ -41,7 +40,13 @@ export declare const CriticalOperationPreset: AgentFacet[];
 export declare const SecurityReviewerPreset: AgentFacet[];
 /**
  * Code Assistant Preset
- * Use for: Development assistance with MCP tools
+ * Use for: careful, deliberate assistance on precise work.
+ *
+ * `MCPCodeAssistantFacet` was removed from this preset 2026-09-09 (#491) — see its withdrawal note
+ * above. The preset is KEPT rather than deleted with it: what it composes now is a real posture
+ * (deliberate reasoning at high precision) that an application can use today, whereas the removed
+ * facet contributed only refs to servers that did not exist. Keeping the preset and dropping the
+ * facet is the honest split — nothing here ever supplied the tools, so nothing is lost by saying so.
  */
 export declare const CodeAssistantPreset: AgentFacet[];
 /**

package/dist/esm/flows-actors/models/core-facets.backend.definitions.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"core-facets.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/models/core-facets.backend.definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAiB,MAAM,oCAAoC,CAAC;~~AAqB~~/E,eAAO,MAAM,aAAa,EAAE,UAc3B,CAAC;AAGF,eAAO,MAAM,mBAAmB,EAAE,UAgBjC,CAAC;AAGF,eAAO,MAAM,mBAAmB,EAAE,UAcjC,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,UAiB7B,CAAC;AAGF,eAAO,MAAM,qBAAqB,EAAE,UAgBnC,CAAC;AAQF,eAAO,MAAM,kBAAkB,EAAE,UAgBhC,CAAC;AAGF,eAAO,MAAM,iBAAiB,EAAE,UAgB/B,CAAC;AAGF,eAAO,MAAM,iBAAiB,EAAE,UAiB/B,CAAC;AAQF,eAAO,MAAM,YAAY,EAAE,UAe1B,CAAC;AAGF,eAAO,MAAM,aAAa,EAAE,UAiB3B,CAAC;AAQF,eAAO,MAAM,qBAAqB,EAAE,UAsBnC,CAAC;~~AAGF~~,eAAO,MAAM,~~qBAAqB,EAAE,UASnC,CAAC;AAGF,eAAO,MAAM,~~iBAAiB,EAAE,UAe/B,CAAC;AAQF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,EAK/C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAAU,EAK9C,CAAC;AAEF~~;;;GAGG~~;AACH,eAAO,MAAM,mBAAmB,EAAE,UAAU,~~EAI3C~~,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAAU,EAIzC,CAAC"}
1	+ {"version":3,"file":"core-facets.backend.definitions.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/models/core-facets.backend.definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAiB,MAAM,oCAAoC,CAAC;AAoB/E,eAAO,MAAM,aAAa,EAAE,UAc3B,CAAC;AAGF,eAAO,MAAM,mBAAmB,EAAE,UAgBjC,CAAC;AAGF,eAAO,MAAM,mBAAmB,EAAE,UAcjC,CAAC;AAQF,eAAO,MAAM,eAAe,EAAE,UAiB7B,CAAC;AAGF,eAAO,MAAM,qBAAqB,EAAE,UAgBnC,CAAC;AAQF,eAAO,MAAM,kBAAkB,EAAE,UAgBhC,CAAC;AAGF,eAAO,MAAM,iBAAiB,EAAE,UAgB/B,CAAC;AAGF,eAAO,MAAM,iBAAiB,EAAE,UAiB/B,CAAC;AAQF,eAAO,MAAM,YAAY,EAAE,UAe1B,CAAC;AAGF,eAAO,MAAM,aAAa,EAAE,UAiB3B,CAAC;AAQF,eAAO,MAAM,qBAAqB,EAAE,UAsBnC,CAAC;AAoBF,eAAO,MAAM,iBAAiB,EAAE,UAe/B,CAAC;AAQF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,EAK/C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAAU,EAK9C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAAU,EAG3C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAAU,EAIzC,CAAC"}

package/dist/esm/flows-actors/models/core-facets.backend.definitions.js CHANGED Viewed

@@ -6,7 +6,7 @@
  * - Compliance: AuditTrailFacet, ConfirmationGateFacet
  * - Quality/Behavior: HighPrecisionFacet, ConservativeFacet, ThinkingModeFacet
  * - Output: VerboseFacet, SuccinctFacet
- * - Domain/Tooling: SecurityAnalysisFacet, MCPCodeAssistantFacet
+ * - Domain/Tooling: SecurityAnalysisFacet
  *
  * Presets (named facet arrays):
  * - CriticalOperationPreset
@@ -17,7 +17,7 @@
  */
 import { FacetCategory } from './agent-facets.backend.definitions.js';
 import { AgentFacetsBackendService } from '../../flows-actors/services/agent-facets.backend.service.js';
-import { ConstraintsCatalog, InstructionsCatalog, HintsCatalog, OutOfScopeCatalog, ModelPresetsCatalog, ToolBundlesCatalog, MCPBundlesCatalog, } from './agent-catalogs.backend.definitions.js';
+import { ConstraintsCatalog, InstructionsCatalog, HintsCatalog, OutOfScopeCatalog, ModelPresetsCatalog, ToolBundlesCatalog, } from './agent-catalogs.backend.definitions.js';
 import { FlowsActors_Agent_UncertaintyPolicy, FlowsActors_Agent_Verbosity, } from '@wildo-ai/saas-models';
 //===============================================================
 // SECURITY FACETS
@@ -235,17 +235,22 @@ export const SecurityAnalysisFacet = {
     },
 };
 AgentFacetsBackendService.registerFacet(SecurityAnalysisFacet);
-export const MCPCodeAssistantFacet = {
-    id: "mcp-code-assistant",
-    name: "MCP Code Assistant",
-    description: "Code editing and filesystem tools via MCP",
-    category: FacetCategory.TOOLING,
-    capabilities: {
-        tools: MCPBundlesCatalog.CODE_ASSISTANT,
-    },
-    config: ModelPresetsCatalog.TOOLING_ENABLED,
-};
-AgentFacetsBackendService.registerFacet(MCPCodeAssistantFacet);
+/*
+ * `MCPCodeAssistantFacet` was WITHDRAWN 2026-09-09 (#491), with `MCPBundlesCatalog` beside it.
+ *
+ * It composed `mcpRefs: ["filesystem-mcp", "code-editor-mcp", "git-mcp"]` — three strings that named
+ * no server anywhere. Nothing resolved them, and the agent card rendered them, so any agent carrying
+ * this facet advertised a reach it did not have. That is the whole of #491.
+ *
+ * It is not restored as an empty shell. An `mcpRef` now names a server the APPLICATION declared, so
+ * a facet shipped by the engine cannot supply one: the engine does not know which third parties an
+ * application permits its agents to reach, and that is the decision the declaration exists to hold.
+ * A code-assistant facet becomes meaningful again when an application declares a code-assistant MCP
+ * server and references it by ref — at which point it is that application's facet, not this file's.
+ *
+ * The names also described a CODING agent's reach — a filesystem, a git checkout — which is the ACP
+ * coding-agent lane rather than anything a generated business application's agent calls.
+ */
 export const DataAnalysisFacet = {
     id: "data-analysis",
     name: "Data Analysis",
@@ -288,10 +293,15 @@ export const SecurityReviewerPreset = [
 ];
 /**
  * Code Assistant Preset
- * Use for: Development assistance with MCP tools
+ * Use for: careful, deliberate assistance on precise work.
+ *
+ * `MCPCodeAssistantFacet` was removed from this preset 2026-09-09 (#491) — see its withdrawal note
+ * above. The preset is KEPT rather than deleted with it: what it composes now is a real posture
+ * (deliberate reasoning at high precision) that an application can use today, whereas the removed
+ * facet contributed only refs to servers that did not exist. Keeping the preset and dropping the
+ * facet is the honest split — nothing here ever supplied the tools, so nothing is lost by saying so.
  */
 export const CodeAssistantPreset = [
-    MCPCodeAssistantFacet,
     ThinkingModeFacet,
     HighPrecisionFacet,
 ];