@xopcai/xopc 0.0.141 → 0.0.143

package/dist/src/auth/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm, readdir } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\nconst warnedExpiredOAuthTokens = new Set<string>();\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      const warnKey = `${provider}:${token.expiresAt}`;\n      if (!warnedExpiredOAuthTokens.has(warnKey)) {\n        warnedExpiredOAuthTokens.add(warnKey);\n        log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      }\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * List persisted OAuth tokens without exposing access/refresh values.\n   */\n  async listOAuthTokens(): Promise<Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }>> {\n    const oauthDir = join(this.credentialsDir, 'oauth');\n    let files: string[];\n    try {\n      files = await readdir(oauthDir);\n    } catch {\n      return [];\n    }\n\n    const tokens: Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }> = [];\n    for (const file of files) {\n      if (!file.endsWith('.json')) continue;\n      try {\n        const content = await readFile(join(oauthDir, file), 'utf-8');\n        const token = JSON.parse(content) as OAuthToken;\n        if (token.type !== 'oauth' || !token.provider) continue;\n        const { access, refresh, ...safe } = token;\n        tokens.push({ ...safe, hasAccess: Boolean(access?.trim()), hasRefresh: Boolean(refresh?.trim()) });\n      } catch {\n        continue;\n      }\n    }\n    return tokens.sort((a, b) => a.provider.localeCompare(b.provider));\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const file = await this.loadAuthProfilesFile();\n    await mkdir(dirname(resolveAuthProfilesPath()), { recursive: true });\n    for (const [profileId, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        delete file.profiles[profileId];\n      }\n    }\n    await writeTextAtomic(resolveAuthProfilesPath(), JSON.stringify(file, null, 2));\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AAgdA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBA7dsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AACjC,4CAA2B,IAAI,KAAa;AA8CrC,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;IACnD,MAAM,UAAU,GAAG,SAAS,GAAG,MAAM;AACrC,QAAI,CAAC,yBAAyB,IAAI,QAAQ,EAAE;AAC1C,8BAAyB,IAAI,QAAQ;AACrC,SAAI,KAAK;MAAE;MAAU,WAAW,MAAM;MAAW,EAAE,yBAAyB;;AAE9E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,kBAAwH;GAC5H,MAAM,WAAW,KAAK,KAAK,gBAAgB,QAAQ;GACnD,IAAI;AACJ,OAAI;AACF,YAAQ,MAAM,QAAQ,SAAS;WACzB;AACN,WAAO,EAAE;;GAGX,MAAM,SAAsG,EAAE;AAC9G,QAAK,MAAM,QAAQ,OAAO;AACxB,QAAI,CAAC,KAAK,SAAS,QAAQ,CAAE;AAC7B,QAAI;KACF,MAAM,UAAU,MAAM,SAAS,KAAK,UAAU,KAAK,EAAE,QAAQ;KAC7D,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,SAAI,MAAM,SAAS,WAAW,CAAC,MAAM,SAAU;KAC/C,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;AACrC,YAAO,KAAK;MAAE,GAAG;MAAM,WAAW,QAAQ,QAAQ,MAAM,CAAC;MAAE,YAAY,QAAQ,SAAS,MAAM,CAAC;MAAE,CAAC;YAC5F;AACN;;;AAGJ,UAAO,OAAO,MAAM,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,SAAS,CAAC;;;;;EAMpE,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,SAAM,MAAM,QAAQ,yBAAyB,CAAC,EAAE,EAAE,WAAW,MAAM,CAAC;AACpE,QAAK,MAAM,CAAC,WAAW,YAAY,OAAO,QAAQ,KAAK,SAAS,CAC9D,KAAI,QAAQ,aAAa,mBACvB,QAAO,KAAK,SAAS;AAGzB,SAAM,gBAAgB,yBAAyB,EAAE,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;AAC/E,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}
+{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm, readdir } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\nconst warnedExpiredOAuthTokens = new Set<string>();\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      const warnKey = `${provider}:${token.expiresAt}`;\n      if (!warnedExpiredOAuthTokens.has(warnKey)) {\n        warnedExpiredOAuthTokens.add(warnKey);\n        log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      }\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * List persisted OAuth tokens without exposing access/refresh values.\n   */\n  async listOAuthTokens(): Promise<Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }>> {\n    const oauthDir = join(this.credentialsDir, 'oauth');\n    let files: string[];\n    try {\n      files = await readdir(oauthDir);\n    } catch {\n      return [];\n    }\n\n    const tokens: Array<Omit<OAuthToken, 'access' | 'refresh'> & { hasAccess: boolean; hasRefresh: boolean }> = [];\n    for (const file of files) {\n      if (!file.endsWith('.json')) continue;\n      try {\n        const content = await readFile(join(oauthDir, file), 'utf-8');\n        const token = JSON.parse(content) as OAuthToken;\n        if (token.type !== 'oauth' || !token.provider) continue;\n        const { access, refresh, ...safe } = token;\n        tokens.push({ ...safe, hasAccess: Boolean(access?.trim()), hasRefresh: Boolean(refresh?.trim()) });\n      } catch {\n        continue;\n      }\n    }\n    return tokens.sort((a, b) => a.provider.localeCompare(b.provider));\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const file = await this.loadAuthProfilesFile();\n    await mkdir(dirname(resolveAuthProfilesPath()), { recursive: true });\n    for (const [profileId, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        delete file.profiles[profileId];\n      }\n    }\n    await writeTextAtomic(resolveAuthProfilesPath(), JSON.stringify(file, null, 2));\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (options) return new CredentialResolver(options);\n  defaultResolver ??= new CredentialResolver();\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AAgdA,SAAgB,sBAAsB,SAAyD;AAC7F,KAAI,QAAS,QAAO,IAAI,mBAAmB,QAAQ;AACnD,qBAAoB,IAAI,oBAAoB;AAC5C,QAAO;;AAGT,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBA5dsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AACjC,4CAA2B,IAAI,KAAa;AA8CrC,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;IACnD,MAAM,UAAU,GAAG,SAAS,GAAG,MAAM;AACrC,QAAI,CAAC,yBAAyB,IAAI,QAAQ,EAAE;AAC1C,8BAAyB,IAAI,QAAQ;AACrC,SAAI,KAAK;MAAE;MAAU,WAAW,MAAM;MAAW,EAAE,yBAAyB;;AAE9E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,kBAAwH;GAC5H,MAAM,WAAW,KAAK,KAAK,gBAAgB,QAAQ;GACnD,IAAI;AACJ,OAAI;AACF,YAAQ,MAAM,QAAQ,SAAS;WACzB;AACN,WAAO,EAAE;;GAGX,MAAM,SAAsG,EAAE;AAC9G,QAAK,MAAM,QAAQ,OAAO;AACxB,QAAI,CAAC,KAAK,SAAS,QAAQ,CAAE;AAC7B,QAAI;KACF,MAAM,UAAU,MAAM,SAAS,KAAK,UAAU,KAAK,EAAE,QAAQ;KAC7D,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,SAAI,MAAM,SAAS,WAAW,CAAC,MAAM,SAAU;KAC/C,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;AACrC,YAAO,KAAK;MAAE,GAAG;MAAM,WAAW,QAAQ,QAAQ,MAAM,CAAC;MAAE,YAAY,QAAQ,SAAS,MAAM,CAAC;MAAE,CAAC;YAC5F;AACN;;;AAGJ,UAAO,OAAO,MAAM,GAAG,MAAM,EAAE,SAAS,cAAc,EAAE,SAAS,CAAC;;;;;EAMpE,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,SAAM,MAAM,QAAQ,yBAAyB,CAAC,EAAE,EAAE,WAAW,MAAM,CAAC;AACpE,QAAK,MAAM,CAAC,WAAW,YAAY,OAAO,QAAQ,KAAK,SAAS,CAC9D,KAAI,QAAQ,aAAa,mBACvB,QAAO,KAAK,SAAS;AAGzB,SAAM,gBAAgB,yBAAyB,EAAE,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;AAC/E,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;;AAQ1D,mBAA6C"}

package/dist/src/auth/oauth/github-copilot.d.ts

@@ -1,4 +1,3 @@
-/**
- * GitHub Copilot OAuth device code flow.
- */
-export { githubCopilotOAuthProvider, getGitHubCopilotBaseUrl, loginGitHubCopilot, normalizeDomain, refreshGitHubCopilotToken, } from '@earendil-works/pi-ai/oauth';
+/** GitHub Copilot OAuth adapter for pi-ai's provider-auth API. */
+import type { OAuthProviderInterface } from './types.js';
+export declare const githubCopilotOAuthProvider: OAuthProviderInterface;

package/dist/src/auth/oauth/github-copilot.js

@@ -1,2 +1,66 @@
-import { getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, loginGitHubCopilot, normalizeDomain, refreshGitHubCopilotToken } from "@earendil-works/pi-ai/oauth";
-export { getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, loginGitHubCopilot, normalizeDomain, refreshGitHubCopilotToken };
+import { githubCopilotProvider } from "@earendil-works/pi-ai/providers/github-copilot";
+//#region src/auth/oauth/github-copilot.ts
+/** GitHub Copilot OAuth adapter for pi-ai's provider-auth API. */
+function getCopilotOAuth() {
+	const oauth = githubCopilotProvider().auth.oauth;
+	if (!oauth) throw new Error("GitHub Copilot OAuth is unavailable");
+	return oauth;
+}
+function toPiCredential(credentials) {
+	return {
+		...credentials,
+		type: "oauth"
+	};
+}
+function fromPiCredential({ type: _type, ...credentials }) {
+	return credentials;
+}
+function toAuthInteraction(callbacks) {
+	return {
+		signal: callbacks.signal,
+		async prompt(prompt) {
+			if (prompt.type === "select") return await callbacks.onSelect({
+				message: prompt.message,
+				options: [...prompt.options].map(({ id, label }) => ({
+					id,
+					label
+				}))
+			}) ?? "";
+			return callbacks.onPrompt({
+				message: prompt.message,
+				placeholder: prompt.placeholder
+			});
+		},
+		notify(event) {
+			if (event.type === "auth_url") callbacks.onAuth({
+				url: event.url,
+				instructions: event.instructions
+			});
+			else if (event.type === "device_code") callbacks.onDeviceCode({
+				userCode: event.userCode,
+				verificationUri: event.verificationUri,
+				intervalSeconds: event.intervalSeconds,
+				expiresInSeconds: event.expiresInSeconds
+			});
+			else if (event.type === "progress" || event.type === "info") callbacks.onProgress?.(event.message);
+		}
+	};
+}
+const githubCopilotOAuthProvider = {
+	id: "github-copilot",
+	name: "GitHub Copilot",
+	usesCallbackServer: false,
+	async login(callbacks) {
+		return fromPiCredential(await getCopilotOAuth().login(toAuthInteraction(callbacks)));
+	},
+	async refreshToken(credentials) {
+		return fromPiCredential(await getCopilotOAuth().refresh(toPiCredential(credentials)));
+	},
+	getApiKey(credentials) {
+		return credentials.access;
+	}
+};
+//#endregion
+export { githubCopilotOAuthProvider };
+
+//# sourceMappingURL=github-copilot.js.map

package/dist/src/auth/oauth/github-copilot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-copilot.js","names":[],"sources":["../../../../src/auth/oauth/github-copilot.ts"],"sourcesContent":["/** GitHub Copilot OAuth adapter for pi-ai's provider-auth API. */\n\nimport { githubCopilotProvider } from '@earendil-works/pi-ai/providers/github-copilot';\nimport type { AuthInteraction, OAuthAuth, OAuthCredential } from '@earendil-works/pi-ai';\n\nimport type { OAuthCredentials, OAuthLoginCallbacks, OAuthProviderInterface } from './types.js';\n\nfunction getCopilotOAuth(): OAuthAuth {\n  const oauth = githubCopilotProvider().auth.oauth;\n  if (!oauth) {\n    throw new Error('GitHub Copilot OAuth is unavailable');\n  }\n  return oauth;\n}\n\nfunction toPiCredential(credentials: OAuthCredentials): OAuthCredential {\n  return { ...credentials, type: 'oauth' };\n}\n\nfunction fromPiCredential({ type: _type, ...credentials }: OAuthCredential): OAuthCredentials {\n  return credentials;\n}\n\nfunction toAuthInteraction(callbacks: OAuthLoginCallbacks): AuthInteraction {\n  return {\n    signal: callbacks.signal,\n    async prompt(prompt) {\n      if (prompt.type === 'select') {\n        return (await callbacks.onSelect({\n          message: prompt.message,\n          options: [...prompt.options].map(({ id, label }) => ({ id, label })),\n        })) ?? '';\n      }\n      return callbacks.onPrompt({\n        message: prompt.message,\n        placeholder: prompt.placeholder,\n      });\n    },\n    notify(event) {\n      if (event.type === 'auth_url') {\n        callbacks.onAuth({ url: event.url, instructions: event.instructions });\n      } else if (event.type === 'device_code') {\n        callbacks.onDeviceCode({\n          userCode: event.userCode,\n          verificationUri: event.verificationUri,\n          intervalSeconds: event.intervalSeconds,\n          expiresInSeconds: event.expiresInSeconds,\n        });\n      } else if (event.type === 'progress' || event.type === 'info') {\n        callbacks.onProgress?.(event.message);\n      }\n    },\n  };\n}\n\nexport const githubCopilotOAuthProvider: OAuthProviderInterface = {\n  id: 'github-copilot',\n  name: 'GitHub Copilot',\n  usesCallbackServer: false,\n  async login(callbacks) {\n    return fromPiCredential(await getCopilotOAuth().login(toAuthInteraction(callbacks)));\n  },\n  async refreshToken(credentials) {\n    return fromPiCredential(await getCopilotOAuth().refresh(toPiCredential(credentials)));\n  },\n  getApiKey(credentials) {\n    return credentials.access;\n  },\n};\n"],"mappings":";;;AAOA,SAAS,kBAA6B;CACpC,MAAM,QAAQ,uBAAuB,CAAC,KAAK;AAC3C,KAAI,CAAC,MACH,OAAM,IAAI,MAAM,sCAAsC;AAExD,QAAO;;AAGT,SAAS,eAAe,aAAgD;AACtE,QAAO;EAAE,GAAG;EAAa,MAAM;EAAS;;AAG1C,SAAS,iBAAiB,EAAE,MAAM,OAAO,GAAG,eAAkD;AAC5F,QAAO;;AAGT,SAAS,kBAAkB,WAAiD;AAC1E,QAAO;EACL,QAAQ,UAAU;EAClB,MAAM,OAAO,QAAQ;AACnB,OAAI,OAAO,SAAS,SAClB,QAAQ,MAAM,UAAU,SAAS;IAC/B,SAAS,OAAO;IAChB,SAAS,CAAC,GAAG,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,aAAa;KAAE;KAAI;KAAO,EAAE;IACrE,CAAC,IAAK;AAET,UAAO,UAAU,SAAS;IACxB,SAAS,OAAO;IAChB,aAAa,OAAO;IACrB,CAAC;;EAEJ,OAAO,OAAO;AACZ,OAAI,MAAM,SAAS,WACjB,WAAU,OAAO;IAAE,KAAK,MAAM;IAAK,cAAc,MAAM;IAAc,CAAC;YAC7D,MAAM,SAAS,cACxB,WAAU,aAAa;IACrB,UAAU,MAAM;IAChB,iBAAiB,MAAM;IACvB,iBAAiB,MAAM;IACvB,kBAAkB,MAAM;IACzB,CAAC;YACO,MAAM,SAAS,cAAc,MAAM,SAAS,OACrD,WAAU,aAAa,MAAM,QAAQ;;EAG1C;;AAGH,MAAa,6BAAqD;CAChE,IAAI;CACJ,MAAM;CACN,oBAAoB;CACpB,MAAM,MAAM,WAAW;AACrB,SAAO,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,kBAAkB,UAAU,CAAC,CAAC;;CAEtF,MAAM,aAAa,aAAa;AAC9B,SAAO,iBAAiB,MAAM,iBAAiB,CAAC,QAAQ,eAAe,YAAY,CAAC,CAAC;;CAEvF,UAAU,aAAa;AACrB,SAAO,YAAY;;CAEtB"}

package/dist/src/auth/oauth/index.js

@@ -2,10 +2,10 @@ import { anthropicOAuthProvider, loginAnthropic, refreshAnthropicToken } from ".
 import { minimaxOAuthProvider } from "./minimax.js";
 import { minimaxCnOAuthProvider } from "./minimax-cn.js";
 import { kimiCodingOAuthProvider } from "./kimi-coding.js";
-import { getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, loginGitHubCopilot, normalizeDomain, refreshGitHubCopilotToken } from "./github-copilot.js";
+import { githubCopilotOAuthProvider } from "./github-copilot.js";
 import { geminiCliOAuthProvider, loginGeminiCli, refreshGoogleCloudToken } from "./google-oauth/google-gemini-cli.js";
 import "./google-gemini-cli.js";
 import { antigravityOAuthProvider, loginAntigravity, refreshAntigravityToken } from "./google-oauth/google-antigravity.js";
 import "./google-antigravity.js";
 import { loginOpenAICodex, openaiCodexOAuthProvider, refreshOpenAICodexToken } from "./openai-codex.js";
-export { anthropicOAuthProvider, getGitHubCopilotBaseUrl, githubCopilotOAuthProvider, antigravityOAuthProvider as googleAntigravityOAuthProvider, geminiCliOAuthProvider as googleGeminiCliOAuthProvider, kimiCodingOAuthProvider, loginAnthropic, loginAntigravity, loginGeminiCli, loginGitHubCopilot, loginOpenAICodex, minimaxCnOAuthProvider, minimaxOAuthProvider, normalizeDomain, openaiCodexOAuthProvider, refreshAnthropicToken, refreshAntigravityToken, refreshGitHubCopilotToken, refreshGoogleCloudToken, refreshOpenAICodexToken };
+export { anthropicOAuthProvider, githubCopilotOAuthProvider, antigravityOAuthProvider as googleAntigravityOAuthProvider, geminiCliOAuthProvider as googleGeminiCliOAuthProvider, kimiCodingOAuthProvider, loginAnthropic, loginAntigravity, loginGeminiCli, loginOpenAICodex, minimaxCnOAuthProvider, minimaxOAuthProvider, openaiCodexOAuthProvider, refreshAnthropicToken, refreshAntigravityToken, refreshGoogleCloudToken, refreshOpenAICodexToken };

package/dist/src/automations/api/routes.js

@@ -1,5 +1,8 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { resolveAutomationSafetyForTrust } from "../../user-context/trust-policy.js";
+import { getUserTrustPolicy } from "../../storage/sqlite/user-trust-repository.js";
+import "../../storage/sqlite/index.js";
 import { init_agent_scope, resolveDefaultAgentId } from "../../agent/agent-scope.js";
 import { AutomationAlreadyRunningError } from "../service/automation-service.js";
 import { logRouteError } from "../../gateway/hono/lib/route-logger.js";
@@ -52,7 +55,16 @@ function registerAutomationRoutes(authenticated, deps) {
 				agentId,
 				language: body?.language === "zh" ? "zh" : "en"
 			}, c.req.raw.signal);
-			return c.json({ draft }, 201);
+			const safetyMode = resolveAutomationSafetyForTrust(getUserTrustPolicy().defaultActionLevel, draft.automation.safety?.mode);
+			const trustedDraft = {
+				...draft,
+				automation: {
+					...draft.automation,
+					safety: { mode: safetyMode }
+				}
+			};
+			trustedDraft.simulation = simulateAutomation(trustedDraft.automation);
+			return c.json({ draft: trustedDraft }, 201);
 		} catch (err) {
 			logRouteError(log, c, err, "gateway.route.automations", { operation: "draft" });
 			return c.json({ error: err instanceof Error ? err.message : "Failed to create automation draft" }, 400);

package/dist/src/automations/api/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","names":[],"sources":["../../../../src/automations/api/routes.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport { resolveDefaultAgentId } from '../../agent/agent-scope.js';\nimport type { AuthenticatedRouteDeps } from '../../gateway/hono/routes/deps.js';\nimport { logRouteError } from '../../gateway/hono/lib/route-logger.js';\nimport { createLogger } from '../../utils/logger.js';\nimport { AutomationDraftService, simulateAutomation } from '../draft/index.js';\nimport type { CreateAutomationInput } from '../domain/validation.js';\nimport { AutomationAlreadyRunningError } from '../service/automation-service.js';\n\nconst log = createLogger('Gateway:Automations');\n\nfunction parseLimit(raw: string | undefined, fallback: number): number {\n  const parsed = raw ? Number.parseInt(raw, 10) : fallback;\n  return Number.isFinite(parsed) ? parsed : fallback;\n}\n\nfunction parseProjectId(raw: string | undefined): string | undefined {\n  const trimmed = raw?.trim();\n  return trimmed || undefined;\n}\n\nexport function registerAutomationRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service } = deps;\n\n  authenticated.get('/api/automations', async (c) => {\n    const projectId = parseProjectId(c.req.query('projectId'));\n    if (projectId && !service.projects.get(projectId)) {\n      return c.json({ error: 'Project not found' }, 404);\n    }\n    const automations = await service.automationServiceInstance.list({ projectId });\n    return c.json({ automations });\n  });\n\n  authenticated.post('/api/automations', async (c) => {\n    try {\n      const body = await c.req.json() as CreateAutomationInput;\n      if (body.projectId && !service.projects.get(body.projectId)) {\n        return c.json({ error: 'Project not found' }, 404);\n      }\n      const automation = await service.automationServiceInstance.create(body);\n      return c.json({ automation }, 201);\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'create' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to create automation' }, 400);\n    }\n  });\n\n  authenticated.get('/api/automations/metrics', async (c) => {\n    const metrics = await service.automationServiceInstance.getMetrics();\n    return c.json(metrics);\n  });\n\n  authenticated.post('/api/automations/draft', async (c) => {\n    const body = await c.req.json().catch(() => null) as {\n      prompt?: unknown;\n      agentId?: unknown;\n      language?: unknown;\n    } | null;\n    const prompt = typeof body?.prompt === 'string' ? body.prompt.trim() : '';\n    if (!prompt) return c.json({ error: 'prompt is required' }, 400);\n    const agentId = typeof body?.agentId === 'string' && body.agentId.trim()\n      ? body.agentId.trim()\n      : resolveDefaultAgentId(service.currentConfig);\n    const draftService = new AutomationDraftService({ config: service.currentConfig });\n    try {\n      const draft = await draftService.createDraft({\n        prompt,\n        agentId,\n        language: body?.language === 'zh' ? 'zh' : 'en',\n      }, c.req.raw.signal);\n      return c.json({ draft }, 201);\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'draft' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to create automation draft' }, 400);\n    }\n  });\n\n  authenticated.post('/api/automations/simulate', async (c) => {\n    try {\n      const body = await c.req.json() as CreateAutomationInput;\n      return c.json({ simulation: simulateAutomation(body) });\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'simulate' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to simulate automation' }, 400);\n    }\n  });\n\n  authenticated.get('/api/automation-runs', async (c) => {\n    const automationId = c.req.query('automationId')?.trim();\n    const projectId = parseProjectId(c.req.query('projectId'));\n    if (projectId && !service.projects.get(projectId)) {\n      return c.json({ error: 'Project not found' }, 404);\n    }\n    const runs = await service.automationServiceInstance.listRuns({\n      automationId: automationId || undefined,\n      projectId: automationId ? undefined : projectId,\n      limit: parseLimit(c.req.query('limit'), 50),\n    });\n    return c.json({ runs });\n  });\n\n  authenticated.get('/api/automation-runs/product-events', async (c) => {\n    const eventType = c.req.query('eventType')?.trim();\n    if (!eventType) return c.json({ error: 'eventType is required' }, 400);\n    const payloadKey = c.req.query('payloadKey')?.trim();\n    const payloadValue = c.req.query('payloadValue')?.trim();\n    const items = await service.automationServiceInstance.listRunsForProductEvent({\n      eventType,\n      source: c.req.query('source')?.trim() || undefined,\n      payloadKey: payloadKey || undefined,\n      payloadValue: payloadValue || undefined,\n      limit: parseLimit(c.req.query('limit'), 10),\n    });\n    return c.json({ items });\n  });\n\n  authenticated.get('/api/automation-runs/:runId', async (c) => {\n    const run = await service.automationServiceInstance.getRun(c.req.param('runId'));\n    if (!run) return c.json({ error: 'Run not found' }, 404);\n    return c.json({ run });\n  });\n\n  authenticated.get('/api/automation-runs/:runId/events', async (c) => {\n    const runId = c.req.param('runId');\n    const run = await service.automationServiceInstance.getRun(runId);\n    if (!run) return c.json({ error: 'Run not found' }, 404);\n    const events = await service.automationServiceInstance.listRunEvents(runId);\n    return c.json({ events });\n  });\n\n  authenticated.post('/api/automation-runs/:runId/rerun', async (c) => {\n    try {\n      const run = await service.automationServiceInstance.rerunFromRun(c.req.param('runId'));\n      return c.json({ run }, 201);\n    } catch (err) {\n      if (err instanceof AutomationAlreadyRunningError) {\n        return c.json({\n          error: err.message,\n          code: 'automation_already_running',\n          automationId: err.automationId,\n          runningRunId: err.runningRunId,\n        }, 409);\n      }\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'rerun' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to rerun automation' }, 400);\n    }\n  });\n\n  authenticated.post('/api/automation-runs/:runId/repair-draft', async (c) => {\n    const runId = c.req.param('runId');\n    const run = await service.automationServiceInstance.getRun(runId);\n    if (!run) return c.json({ error: 'Run not found' }, 404);\n    if (!['failed', 'timeout', 'cancelled'].includes(run.status)) {\n      return c.json({ error: 'Repair draft is only available for failed, timed out, or cancelled runs' }, 400);\n    }\n    const automation = await service.automationServiceInstance.get(run.automationId);\n    if (!automation) return c.json({ error: 'Automation not found' }, 404);\n    const body = await c.req.json().catch(() => null) as { agentId?: unknown; language?: unknown } | null;\n    const agentId = typeof body?.agentId === 'string' && body.agentId.trim()\n      ? body.agentId.trim()\n      : resolveDefaultAgentId(service.currentConfig);\n    const events = await service.automationServiceInstance.listRunEvents(runId);\n    const draftService = new AutomationDraftService({ config: service.currentConfig });\n    try {\n      const repair = await draftService.createRepairDraft({\n        agentId,\n        automation,\n        run,\n        events,\n        language: body?.language === 'zh' ? 'zh' : 'en',\n      }, c.req.raw.signal);\n      return c.json({ repair }, 201);\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'repairDraft' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to create automation repair draft' }, 400);\n    }\n  });\n\n  authenticated.post('/api/automation-runs/:runId/cancel', async (c) => {\n    const cancelled = await service.automationServiceInstance.cancelRun(c.req.param('runId'));\n    return c.json({ cancelled });\n  });\n\n  authenticated.get('/api/automations/:id', async (c) => {\n    const automation = await service.automationServiceInstance.get(c.req.param('id'));\n    if (!automation) return c.json({ error: 'Automation not found' }, 404);\n    return c.json({ automation });\n  });\n\n  authenticated.patch('/api/automations/:id', async (c) => {\n    try {\n      const patch = await c.req.json() as Partial<CreateAutomationInput> & { enabled?: boolean };\n      if (patch.projectId && !service.projects.get(patch.projectId)) {\n        return c.json({ error: 'Project not found' }, 404);\n      }\n      const automation = await service.automationServiceInstance.update(c.req.param('id'), patch);\n      if (!automation) return c.json({ error: 'Automation not found' }, 404);\n      return c.json({ automation });\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'update' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to update automation' }, 400);\n    }\n  });\n\n  authenticated.delete('/api/automations/:id', async (c) => {\n    const removed = await service.automationServiceInstance.remove(c.req.param('id'));\n    return c.json({ removed });\n  });\n\n  authenticated.post('/api/automations/:id/run', async (c) => {\n    try {\n      const run = await service.automationServiceInstance.runNow(c.req.param('id'));\n      return c.json({ run });\n    } catch (err) {\n      if (err instanceof AutomationAlreadyRunningError) {\n        return c.json({\n          error: err.message,\n          code: 'automation_already_running',\n          automationId: err.automationId,\n          runningRunId: err.runningRunId,\n        }, 409);\n      }\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'run' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to run automation' }, 400);\n    }\n  });\n\n  authenticated.post('/api/automations/:id/pause', async (c) => {\n    const automation = await service.automationServiceInstance.pause(c.req.param('id'));\n    if (!automation) return c.json({ error: 'Automation not found' }, 404);\n    return c.json({ automation });\n  });\n\n  authenticated.post('/api/automations/:id/resume', async (c) => {\n    const automation = await service.automationServiceInstance.resume(c.req.param('id'));\n    if (!automation) return c.json({ error: 'Automation not found' }, 404);\n    return c.json({ automation });\n  });\n}\n"],"mappings":";;;;;;;;;kBAEmE;aAGd;AAKrD,MAAM,MAAM,aAAa,sBAAsB;AAE/C,SAAS,WAAW,KAAyB,UAA0B;CACrE,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK,GAAG,GAAG;AAChD,QAAO,OAAO,SAAS,OAAO,GAAG,SAAS;;AAG5C,SAAS,eAAe,KAA6C;AAEnE,QADgB,KAAK,MAAM,IACT,KAAA;;AAGpB,SAAgB,yBAAyB,eAAqB,MAAoC;CAChG,MAAM,EAAE,YAAY;AAEpB,eAAc,IAAI,oBAAoB,OAAO,MAAM;EACjD,MAAM,YAAY,eAAe,EAAE,IAAI,MAAM,YAAY,CAAC;AAC1D,MAAI,aAAa,CAAC,QAAQ,SAAS,IAAI,UAAU,CAC/C,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;EAEpD,MAAM,cAAc,MAAM,QAAQ,0BAA0B,KAAK,EAAE,WAAW,CAAC;AAC/E,SAAO,EAAE,KAAK,EAAE,aAAa,CAAC;GAC9B;AAEF,eAAc,KAAK,oBAAoB,OAAO,MAAM;AAClD,MAAI;GACF,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM;AAC/B,OAAI,KAAK,aAAa,CAAC,QAAQ,SAAS,IAAI,KAAK,UAAU,CACzD,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;GAEpD,MAAM,aAAa,MAAM,QAAQ,0BAA0B,OAAO,KAAK;AACvE,UAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI;WAC3B,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,UAAU,CAAC;AAChF,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,+BAA+B,EAAE,IAAI;;GAEnG;AAEF,eAAc,IAAI,4BAA4B,OAAO,MAAM;EACzD,MAAM,UAAU,MAAM,QAAQ,0BAA0B,YAAY;AACpE,SAAO,EAAE,KAAK,QAAQ;GACtB;AAEF,eAAc,KAAK,0BAA0B,OAAO,MAAM;EACxD,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;EAKjD,MAAM,SAAS,OAAO,MAAM,WAAW,WAAW,KAAK,OAAO,MAAM,GAAG;AACvE,MAAI,CAAC,OAAQ,QAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,IAAI;EAChE,MAAM,UAAU,OAAO,MAAM,YAAY,YAAY,KAAK,QAAQ,MAAM,GACpE,KAAK,QAAQ,MAAM,GACnB,sBAAsB,QAAQ,cAAc;EAChD,MAAM,eAAe,IAAI,uBAAuB,EAAE,QAAQ,QAAQ,eAAe,CAAC;AAClF,MAAI;GACF,MAAM,QAAQ,MAAM,aAAa,YAAY;IAC3C;IACA;IACA,UAAU,MAAM,aAAa,OAAO,OAAO;IAC5C,EAAE,EAAE,IAAI,IAAI,OAAO;AACpB,UAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;WACtB,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,SAAS,CAAC;AAC/E,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,qCAAqC,EAAE,IAAI;;GAEzG;AAEF,eAAc,KAAK,6BAA6B,OAAO,MAAM;AAC3D,MAAI;GACF,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM;AAC/B,UAAO,EAAE,KAAK,EAAE,YAAY,mBAAmB,KAAK,EAAE,CAAC;WAChD,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,YAAY,CAAC;AAClF,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,iCAAiC,EAAE,IAAI;;GAErG;AAEF,eAAc,IAAI,wBAAwB,OAAO,MAAM;EACrD,MAAM,eAAe,EAAE,IAAI,MAAM,eAAe,EAAE,MAAM;EACxD,MAAM,YAAY,eAAe,EAAE,IAAI,MAAM,YAAY,CAAC;AAC1D,MAAI,aAAa,CAAC,QAAQ,SAAS,IAAI,UAAU,CAC/C,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;EAEpD,MAAM,OAAO,MAAM,QAAQ,0BAA0B,SAAS;GAC5D,cAAc,gBAAgB,KAAA;GAC9B,WAAW,eAAe,KAAA,IAAY;GACtC,OAAO,WAAW,EAAE,IAAI,MAAM,QAAQ,EAAE,GAAG;GAC5C,CAAC;AACF,SAAO,EAAE,KAAK,EAAE,MAAM,CAAC;GACvB;AAEF,eAAc,IAAI,uCAAuC,OAAO,MAAM;EACpE,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY,EAAE,MAAM;AAClD,MAAI,CAAC,UAAW,QAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;EACtE,MAAM,aAAa,EAAE,IAAI,MAAM,aAAa,EAAE,MAAM;EACpD,MAAM,eAAe,EAAE,IAAI,MAAM,eAAe,EAAE,MAAM;EACxD,MAAM,QAAQ,MAAM,QAAQ,0BAA0B,wBAAwB;GAC5E;GACA,QAAQ,EAAE,IAAI,MAAM,SAAS,EAAE,MAAM,IAAI,KAAA;GACzC,YAAY,cAAc,KAAA;GAC1B,cAAc,gBAAgB,KAAA;GAC9B,OAAO,WAAW,EAAE,IAAI,MAAM,QAAQ,EAAE,GAAG;GAC5C,CAAC;AACF,SAAO,EAAE,KAAK,EAAE,OAAO,CAAC;GACxB;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,MAAM,MAAM,QAAQ,0BAA0B,OAAO,EAAE,IAAI,MAAM,QAAQ,CAAC;AAChF,MAAI,CAAC,IAAK,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI;AACxD,SAAO,EAAE,KAAK,EAAE,KAAK,CAAC;GACtB;AAEF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ;AAElC,MAAI,CAAC,MADa,QAAQ,0BAA0B,OAAO,MAAM,CACvD,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI;EACxD,MAAM,SAAS,MAAM,QAAQ,0BAA0B,cAAc,MAAM;AAC3E,SAAO,EAAE,KAAK,EAAE,QAAQ,CAAC;GACzB;AAEF,eAAc,KAAK,qCAAqC,OAAO,MAAM;AACnE,MAAI;GACF,MAAM,MAAM,MAAM,QAAQ,0BAA0B,aAAa,EAAE,IAAI,MAAM,QAAQ,CAAC;AACtF,UAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI;WACpB,KAAK;AACZ,OAAI,eAAe,8BACjB,QAAO,EAAE,KAAK;IACZ,OAAO,IAAI;IACX,MAAM;IACN,cAAc,IAAI;IAClB,cAAc,IAAI;IACnB,EAAE,IAAI;AAET,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,SAAS,CAAC;AAC/E,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,8BAA8B,EAAE,IAAI;;GAElG;AAEF,eAAc,KAAK,4CAA4C,OAAO,MAAM;EAC1E,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ;EAClC,MAAM,MAAM,MAAM,QAAQ,0BAA0B,OAAO,MAAM;AACjE,MAAI,CAAC,IAAK,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI;AACxD,MAAI,CAAC;GAAC;GAAU;GAAW;GAAY,CAAC,SAAS,IAAI,OAAO,CAC1D,QAAO,EAAE,KAAK,EAAE,OAAO,2EAA2E,EAAE,IAAI;EAE1G,MAAM,aAAa,MAAM,QAAQ,0BAA0B,IAAI,IAAI,aAAa;AAChF,MAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;EACtE,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;EACjD,MAAM,UAAU,OAAO,MAAM,YAAY,YAAY,KAAK,QAAQ,MAAM,GACpE,KAAK,QAAQ,MAAM,GACnB,sBAAsB,QAAQ,cAAc;EAChD,MAAM,SAAS,MAAM,QAAQ,0BAA0B,cAAc,MAAM;EAC3E,MAAM,eAAe,IAAI,uBAAuB,EAAE,QAAQ,QAAQ,eAAe,CAAC;AAClF,MAAI;GACF,MAAM,SAAS,MAAM,aAAa,kBAAkB;IAClD;IACA;IACA;IACA;IACA,UAAU,MAAM,aAAa,OAAO,OAAO;IAC5C,EAAE,EAAE,IAAI,IAAI,OAAO;AACpB,UAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI;WACvB,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,eAAe,CAAC;AACrF,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,4CAA4C,EAAE,IAAI;;GAEhH;AAEF,eAAc,KAAK,sCAAsC,OAAO,MAAM;EACpE,MAAM,YAAY,MAAM,QAAQ,0BAA0B,UAAU,EAAE,IAAI,MAAM,QAAQ,CAAC;AACzF,SAAO,EAAE,KAAK,EAAE,WAAW,CAAC;GAC5B;AAEF,eAAc,IAAI,wBAAwB,OAAO,MAAM;EACrD,MAAM,aAAa,MAAM,QAAQ,0BAA0B,IAAI,EAAE,IAAI,MAAM,KAAK,CAAC;AACjF,MAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;AACtE,SAAO,EAAE,KAAK,EAAE,YAAY,CAAC;GAC7B;AAEF,eAAc,MAAM,wBAAwB,OAAO,MAAM;AACvD,MAAI;GACF,MAAM,QAAQ,MAAM,EAAE,IAAI,MAAM;AAChC,OAAI,MAAM,aAAa,CAAC,QAAQ,SAAS,IAAI,MAAM,UAAU,CAC3D,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;GAEpD,MAAM,aAAa,MAAM,QAAQ,0BAA0B,OAAO,EAAE,IAAI,MAAM,KAAK,EAAE,MAAM;AAC3F,OAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;AACtE,UAAO,EAAE,KAAK,EAAE,YAAY,CAAC;WACtB,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,UAAU,CAAC;AAChF,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,+BAA+B,EAAE,IAAI;;GAEnG;AAEF,eAAc,OAAO,wBAAwB,OAAO,MAAM;EACxD,MAAM,UAAU,MAAM,QAAQ,0BAA0B,OAAO,EAAE,IAAI,MAAM,KAAK,CAAC;AACjF,SAAO,EAAE,KAAK,EAAE,SAAS,CAAC;GAC1B;AAEF,eAAc,KAAK,4BAA4B,OAAO,MAAM;AAC1D,MAAI;GACF,MAAM,MAAM,MAAM,QAAQ,0BAA0B,OAAO,EAAE,IAAI,MAAM,KAAK,CAAC;AAC7E,UAAO,EAAE,KAAK,EAAE,KAAK,CAAC;WACf,KAAK;AACZ,OAAI,eAAe,8BACjB,QAAO,EAAE,KAAK;IACZ,OAAO,IAAI;IACX,MAAM;IACN,cAAc,IAAI;IAClB,cAAc,IAAI;IACnB,EAAE,IAAI;AAET,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,OAAO,CAAC;AAC7E,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,4BAA4B,EAAE,IAAI;;GAEhG;AAEF,eAAc,KAAK,8BAA8B,OAAO,MAAM;EAC5D,MAAM,aAAa,MAAM,QAAQ,0BAA0B,MAAM,EAAE,IAAI,MAAM,KAAK,CAAC;AACnF,MAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;AACtE,SAAO,EAAE,KAAK,EAAE,YAAY,CAAC;GAC7B;AAEF,eAAc,KAAK,+BAA+B,OAAO,MAAM;EAC7D,MAAM,aAAa,MAAM,QAAQ,0BAA0B,OAAO,EAAE,IAAI,MAAM,KAAK,CAAC;AACpF,MAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;AACtE,SAAO,EAAE,KAAK,EAAE,YAAY,CAAC;GAC7B"}
+{"version":3,"file":"routes.js","names":[],"sources":["../../../../src/automations/api/routes.ts"],"sourcesContent":["import type { Hono } from 'hono';\n\nimport { resolveDefaultAgentId } from '../../agent/agent-scope.js';\nimport type { AuthenticatedRouteDeps } from '../../gateway/hono/routes/deps.js';\nimport { logRouteError } from '../../gateway/hono/lib/route-logger.js';\nimport { getUserTrustPolicy } from '../../storage/sqlite/index.js';\nimport { resolveAutomationSafetyForTrust } from '../../user-context/trust-policy.js';\nimport { createLogger } from '../../utils/logger.js';\nimport { AutomationDraftService, simulateAutomation } from '../draft/index.js';\nimport type { CreateAutomationInput } from '../domain/validation.js';\nimport { AutomationAlreadyRunningError } from '../service/automation-service.js';\n\nconst log = createLogger('Gateway:Automations');\n\nfunction parseLimit(raw: string | undefined, fallback: number): number {\n  const parsed = raw ? Number.parseInt(raw, 10) : fallback;\n  return Number.isFinite(parsed) ? parsed : fallback;\n}\n\nfunction parseProjectId(raw: string | undefined): string | undefined {\n  const trimmed = raw?.trim();\n  return trimmed || undefined;\n}\n\nexport function registerAutomationRoutes(authenticated: Hono, deps: AuthenticatedRouteDeps): void {\n  const { service } = deps;\n\n  authenticated.get('/api/automations', async (c) => {\n    const projectId = parseProjectId(c.req.query('projectId'));\n    if (projectId && !service.projects.get(projectId)) {\n      return c.json({ error: 'Project not found' }, 404);\n    }\n    const automations = await service.automationServiceInstance.list({ projectId });\n    return c.json({ automations });\n  });\n\n  authenticated.post('/api/automations', async (c) => {\n    try {\n      const body = await c.req.json() as CreateAutomationInput;\n      if (body.projectId && !service.projects.get(body.projectId)) {\n        return c.json({ error: 'Project not found' }, 404);\n      }\n      const automation = await service.automationServiceInstance.create(body);\n      return c.json({ automation }, 201);\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'create' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to create automation' }, 400);\n    }\n  });\n\n  authenticated.get('/api/automations/metrics', async (c) => {\n    const metrics = await service.automationServiceInstance.getMetrics();\n    return c.json(metrics);\n  });\n\n  authenticated.post('/api/automations/draft', async (c) => {\n    const body = await c.req.json().catch(() => null) as {\n      prompt?: unknown;\n      agentId?: unknown;\n      language?: unknown;\n    } | null;\n    const prompt = typeof body?.prompt === 'string' ? body.prompt.trim() : '';\n    if (!prompt) return c.json({ error: 'prompt is required' }, 400);\n    const agentId = typeof body?.agentId === 'string' && body.agentId.trim()\n      ? body.agentId.trim()\n      : resolveDefaultAgentId(service.currentConfig);\n    const draftService = new AutomationDraftService({ config: service.currentConfig });\n    try {\n      const draft = await draftService.createDraft({\n        prompt,\n        agentId,\n        language: body?.language === 'zh' ? 'zh' : 'en',\n      }, c.req.raw.signal);\n      const safetyMode = resolveAutomationSafetyForTrust(\n        getUserTrustPolicy().defaultActionLevel,\n        draft.automation.safety?.mode,\n      );\n      const trustedDraft = {\n        ...draft,\n        automation: { ...draft.automation, safety: { mode: safetyMode } },\n      };\n      trustedDraft.simulation = simulateAutomation(trustedDraft.automation);\n      return c.json({ draft: trustedDraft }, 201);\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'draft' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to create automation draft' }, 400);\n    }\n  });\n\n  authenticated.post('/api/automations/simulate', async (c) => {\n    try {\n      const body = await c.req.json() as CreateAutomationInput;\n      return c.json({ simulation: simulateAutomation(body) });\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'simulate' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to simulate automation' }, 400);\n    }\n  });\n\n  authenticated.get('/api/automation-runs', async (c) => {\n    const automationId = c.req.query('automationId')?.trim();\n    const projectId = parseProjectId(c.req.query('projectId'));\n    if (projectId && !service.projects.get(projectId)) {\n      return c.json({ error: 'Project not found' }, 404);\n    }\n    const runs = await service.automationServiceInstance.listRuns({\n      automationId: automationId || undefined,\n      projectId: automationId ? undefined : projectId,\n      limit: parseLimit(c.req.query('limit'), 50),\n    });\n    return c.json({ runs });\n  });\n\n  authenticated.get('/api/automation-runs/product-events', async (c) => {\n    const eventType = c.req.query('eventType')?.trim();\n    if (!eventType) return c.json({ error: 'eventType is required' }, 400);\n    const payloadKey = c.req.query('payloadKey')?.trim();\n    const payloadValue = c.req.query('payloadValue')?.trim();\n    const items = await service.automationServiceInstance.listRunsForProductEvent({\n      eventType,\n      source: c.req.query('source')?.trim() || undefined,\n      payloadKey: payloadKey || undefined,\n      payloadValue: payloadValue || undefined,\n      limit: parseLimit(c.req.query('limit'), 10),\n    });\n    return c.json({ items });\n  });\n\n  authenticated.get('/api/automation-runs/:runId', async (c) => {\n    const run = await service.automationServiceInstance.getRun(c.req.param('runId'));\n    if (!run) return c.json({ error: 'Run not found' }, 404);\n    return c.json({ run });\n  });\n\n  authenticated.get('/api/automation-runs/:runId/events', async (c) => {\n    const runId = c.req.param('runId');\n    const run = await service.automationServiceInstance.getRun(runId);\n    if (!run) return c.json({ error: 'Run not found' }, 404);\n    const events = await service.automationServiceInstance.listRunEvents(runId);\n    return c.json({ events });\n  });\n\n  authenticated.post('/api/automation-runs/:runId/rerun', async (c) => {\n    try {\n      const run = await service.automationServiceInstance.rerunFromRun(c.req.param('runId'));\n      return c.json({ run }, 201);\n    } catch (err) {\n      if (err instanceof AutomationAlreadyRunningError) {\n        return c.json({\n          error: err.message,\n          code: 'automation_already_running',\n          automationId: err.automationId,\n          runningRunId: err.runningRunId,\n        }, 409);\n      }\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'rerun' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to rerun automation' }, 400);\n    }\n  });\n\n  authenticated.post('/api/automation-runs/:runId/repair-draft', async (c) => {\n    const runId = c.req.param('runId');\n    const run = await service.automationServiceInstance.getRun(runId);\n    if (!run) return c.json({ error: 'Run not found' }, 404);\n    if (!['failed', 'timeout', 'cancelled'].includes(run.status)) {\n      return c.json({ error: 'Repair draft is only available for failed, timed out, or cancelled runs' }, 400);\n    }\n    const automation = await service.automationServiceInstance.get(run.automationId);\n    if (!automation) return c.json({ error: 'Automation not found' }, 404);\n    const body = await c.req.json().catch(() => null) as { agentId?: unknown; language?: unknown } | null;\n    const agentId = typeof body?.agentId === 'string' && body.agentId.trim()\n      ? body.agentId.trim()\n      : resolveDefaultAgentId(service.currentConfig);\n    const events = await service.automationServiceInstance.listRunEvents(runId);\n    const draftService = new AutomationDraftService({ config: service.currentConfig });\n    try {\n      const repair = await draftService.createRepairDraft({\n        agentId,\n        automation,\n        run,\n        events,\n        language: body?.language === 'zh' ? 'zh' : 'en',\n      }, c.req.raw.signal);\n      return c.json({ repair }, 201);\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'repairDraft' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to create automation repair draft' }, 400);\n    }\n  });\n\n  authenticated.post('/api/automation-runs/:runId/cancel', async (c) => {\n    const cancelled = await service.automationServiceInstance.cancelRun(c.req.param('runId'));\n    return c.json({ cancelled });\n  });\n\n  authenticated.get('/api/automations/:id', async (c) => {\n    const automation = await service.automationServiceInstance.get(c.req.param('id'));\n    if (!automation) return c.json({ error: 'Automation not found' }, 404);\n    return c.json({ automation });\n  });\n\n  authenticated.patch('/api/automations/:id', async (c) => {\n    try {\n      const patch = await c.req.json() as Partial<CreateAutomationInput> & { enabled?: boolean };\n      if (patch.projectId && !service.projects.get(patch.projectId)) {\n        return c.json({ error: 'Project not found' }, 404);\n      }\n      const automation = await service.automationServiceInstance.update(c.req.param('id'), patch);\n      if (!automation) return c.json({ error: 'Automation not found' }, 404);\n      return c.json({ automation });\n    } catch (err) {\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'update' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to update automation' }, 400);\n    }\n  });\n\n  authenticated.delete('/api/automations/:id', async (c) => {\n    const removed = await service.automationServiceInstance.remove(c.req.param('id'));\n    return c.json({ removed });\n  });\n\n  authenticated.post('/api/automations/:id/run', async (c) => {\n    try {\n      const run = await service.automationServiceInstance.runNow(c.req.param('id'));\n      return c.json({ run });\n    } catch (err) {\n      if (err instanceof AutomationAlreadyRunningError) {\n        return c.json({\n          error: err.message,\n          code: 'automation_already_running',\n          automationId: err.automationId,\n          runningRunId: err.runningRunId,\n        }, 409);\n      }\n      logRouteError(log, c, err, 'gateway.route.automations', { operation: 'run' });\n      return c.json({ error: err instanceof Error ? err.message : 'Failed to run automation' }, 400);\n    }\n  });\n\n  authenticated.post('/api/automations/:id/pause', async (c) => {\n    const automation = await service.automationServiceInstance.pause(c.req.param('id'));\n    if (!automation) return c.json({ error: 'Automation not found' }, 404);\n    return c.json({ automation });\n  });\n\n  authenticated.post('/api/automations/:id/resume', async (c) => {\n    const automation = await service.automationServiceInstance.resume(c.req.param('id'));\n    if (!automation) return c.json({ error: 'Automation not found' }, 404);\n    return c.json({ automation });\n  });\n}\n"],"mappings":";;;;;;;;;;;;kBAEmE;aAKd;AAKrD,MAAM,MAAM,aAAa,sBAAsB;AAE/C,SAAS,WAAW,KAAyB,UAA0B;CACrE,MAAM,SAAS,MAAM,OAAO,SAAS,KAAK,GAAG,GAAG;AAChD,QAAO,OAAO,SAAS,OAAO,GAAG,SAAS;;AAG5C,SAAS,eAAe,KAA6C;AAEnE,QADgB,KAAK,MAAM,IACT,KAAA;;AAGpB,SAAgB,yBAAyB,eAAqB,MAAoC;CAChG,MAAM,EAAE,YAAY;AAEpB,eAAc,IAAI,oBAAoB,OAAO,MAAM;EACjD,MAAM,YAAY,eAAe,EAAE,IAAI,MAAM,YAAY,CAAC;AAC1D,MAAI,aAAa,CAAC,QAAQ,SAAS,IAAI,UAAU,CAC/C,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;EAEpD,MAAM,cAAc,MAAM,QAAQ,0BAA0B,KAAK,EAAE,WAAW,CAAC;AAC/E,SAAO,EAAE,KAAK,EAAE,aAAa,CAAC;GAC9B;AAEF,eAAc,KAAK,oBAAoB,OAAO,MAAM;AAClD,MAAI;GACF,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM;AAC/B,OAAI,KAAK,aAAa,CAAC,QAAQ,SAAS,IAAI,KAAK,UAAU,CACzD,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;GAEpD,MAAM,aAAa,MAAM,QAAQ,0BAA0B,OAAO,KAAK;AACvE,UAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI;WAC3B,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,UAAU,CAAC;AAChF,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,+BAA+B,EAAE,IAAI;;GAEnG;AAEF,eAAc,IAAI,4BAA4B,OAAO,MAAM;EACzD,MAAM,UAAU,MAAM,QAAQ,0BAA0B,YAAY;AACpE,SAAO,EAAE,KAAK,QAAQ;GACtB;AAEF,eAAc,KAAK,0BAA0B,OAAO,MAAM;EACxD,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;EAKjD,MAAM,SAAS,OAAO,MAAM,WAAW,WAAW,KAAK,OAAO,MAAM,GAAG;AACvE,MAAI,CAAC,OAAQ,QAAO,EAAE,KAAK,EAAE,OAAO,sBAAsB,EAAE,IAAI;EAChE,MAAM,UAAU,OAAO,MAAM,YAAY,YAAY,KAAK,QAAQ,MAAM,GACpE,KAAK,QAAQ,MAAM,GACnB,sBAAsB,QAAQ,cAAc;EAChD,MAAM,eAAe,IAAI,uBAAuB,EAAE,QAAQ,QAAQ,eAAe,CAAC;AAClF,MAAI;GACF,MAAM,QAAQ,MAAM,aAAa,YAAY;IAC3C;IACA;IACA,UAAU,MAAM,aAAa,OAAO,OAAO;IAC5C,EAAE,EAAE,IAAI,IAAI,OAAO;GACpB,MAAM,aAAa,gCACjB,oBAAoB,CAAC,oBACrB,MAAM,WAAW,QAAQ,KAC1B;GACD,MAAM,eAAe;IACnB,GAAG;IACH,YAAY;KAAE,GAAG,MAAM;KAAY,QAAQ,EAAE,MAAM,YAAY;KAAE;IAClE;AACD,gBAAa,aAAa,mBAAmB,aAAa,WAAW;AACrE,UAAO,EAAE,KAAK,EAAE,OAAO,cAAc,EAAE,IAAI;WACpC,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,SAAS,CAAC;AAC/E,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,qCAAqC,EAAE,IAAI;;GAEzG;AAEF,eAAc,KAAK,6BAA6B,OAAO,MAAM;AAC3D,MAAI;GACF,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM;AAC/B,UAAO,EAAE,KAAK,EAAE,YAAY,mBAAmB,KAAK,EAAE,CAAC;WAChD,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,YAAY,CAAC;AAClF,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,iCAAiC,EAAE,IAAI;;GAErG;AAEF,eAAc,IAAI,wBAAwB,OAAO,MAAM;EACrD,MAAM,eAAe,EAAE,IAAI,MAAM,eAAe,EAAE,MAAM;EACxD,MAAM,YAAY,eAAe,EAAE,IAAI,MAAM,YAAY,CAAC;AAC1D,MAAI,aAAa,CAAC,QAAQ,SAAS,IAAI,UAAU,CAC/C,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;EAEpD,MAAM,OAAO,MAAM,QAAQ,0BAA0B,SAAS;GAC5D,cAAc,gBAAgB,KAAA;GAC9B,WAAW,eAAe,KAAA,IAAY;GACtC,OAAO,WAAW,EAAE,IAAI,MAAM,QAAQ,EAAE,GAAG;GAC5C,CAAC;AACF,SAAO,EAAE,KAAK,EAAE,MAAM,CAAC;GACvB;AAEF,eAAc,IAAI,uCAAuC,OAAO,MAAM;EACpE,MAAM,YAAY,EAAE,IAAI,MAAM,YAAY,EAAE,MAAM;AAClD,MAAI,CAAC,UAAW,QAAO,EAAE,KAAK,EAAE,OAAO,yBAAyB,EAAE,IAAI;EACtE,MAAM,aAAa,EAAE,IAAI,MAAM,aAAa,EAAE,MAAM;EACpD,MAAM,eAAe,EAAE,IAAI,MAAM,eAAe,EAAE,MAAM;EACxD,MAAM,QAAQ,MAAM,QAAQ,0BAA0B,wBAAwB;GAC5E;GACA,QAAQ,EAAE,IAAI,MAAM,SAAS,EAAE,MAAM,IAAI,KAAA;GACzC,YAAY,cAAc,KAAA;GAC1B,cAAc,gBAAgB,KAAA;GAC9B,OAAO,WAAW,EAAE,IAAI,MAAM,QAAQ,EAAE,GAAG;GAC5C,CAAC;AACF,SAAO,EAAE,KAAK,EAAE,OAAO,CAAC;GACxB;AAEF,eAAc,IAAI,+BAA+B,OAAO,MAAM;EAC5D,MAAM,MAAM,MAAM,QAAQ,0BAA0B,OAAO,EAAE,IAAI,MAAM,QAAQ,CAAC;AAChF,MAAI,CAAC,IAAK,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI;AACxD,SAAO,EAAE,KAAK,EAAE,KAAK,CAAC;GACtB;AAEF,eAAc,IAAI,sCAAsC,OAAO,MAAM;EACnE,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ;AAElC,MAAI,CAAC,MADa,QAAQ,0BAA0B,OAAO,MAAM,CACvD,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI;EACxD,MAAM,SAAS,MAAM,QAAQ,0BAA0B,cAAc,MAAM;AAC3E,SAAO,EAAE,KAAK,EAAE,QAAQ,CAAC;GACzB;AAEF,eAAc,KAAK,qCAAqC,OAAO,MAAM;AACnE,MAAI;GACF,MAAM,MAAM,MAAM,QAAQ,0BAA0B,aAAa,EAAE,IAAI,MAAM,QAAQ,CAAC;AACtF,UAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI;WACpB,KAAK;AACZ,OAAI,eAAe,8BACjB,QAAO,EAAE,KAAK;IACZ,OAAO,IAAI;IACX,MAAM;IACN,cAAc,IAAI;IAClB,cAAc,IAAI;IACnB,EAAE,IAAI;AAET,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,SAAS,CAAC;AAC/E,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,8BAA8B,EAAE,IAAI;;GAElG;AAEF,eAAc,KAAK,4CAA4C,OAAO,MAAM;EAC1E,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ;EAClC,MAAM,MAAM,MAAM,QAAQ,0BAA0B,OAAO,MAAM;AACjE,MAAI,CAAC,IAAK,QAAO,EAAE,KAAK,EAAE,OAAO,iBAAiB,EAAE,IAAI;AACxD,MAAI,CAAC;GAAC;GAAU;GAAW;GAAY,CAAC,SAAS,IAAI,OAAO,CAC1D,QAAO,EAAE,KAAK,EAAE,OAAO,2EAA2E,EAAE,IAAI;EAE1G,MAAM,aAAa,MAAM,QAAQ,0BAA0B,IAAI,IAAI,aAAa;AAChF,MAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;EACtE,MAAM,OAAO,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK;EACjD,MAAM,UAAU,OAAO,MAAM,YAAY,YAAY,KAAK,QAAQ,MAAM,GACpE,KAAK,QAAQ,MAAM,GACnB,sBAAsB,QAAQ,cAAc;EAChD,MAAM,SAAS,MAAM,QAAQ,0BAA0B,cAAc,MAAM;EAC3E,MAAM,eAAe,IAAI,uBAAuB,EAAE,QAAQ,QAAQ,eAAe,CAAC;AAClF,MAAI;GACF,MAAM,SAAS,MAAM,aAAa,kBAAkB;IAClD;IACA;IACA;IACA;IACA,UAAU,MAAM,aAAa,OAAO,OAAO;IAC5C,EAAE,EAAE,IAAI,IAAI,OAAO;AACpB,UAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI;WACvB,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,eAAe,CAAC;AACrF,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,4CAA4C,EAAE,IAAI;;GAEhH;AAEF,eAAc,KAAK,sCAAsC,OAAO,MAAM;EACpE,MAAM,YAAY,MAAM,QAAQ,0BAA0B,UAAU,EAAE,IAAI,MAAM,QAAQ,CAAC;AACzF,SAAO,EAAE,KAAK,EAAE,WAAW,CAAC;GAC5B;AAEF,eAAc,IAAI,wBAAwB,OAAO,MAAM;EACrD,MAAM,aAAa,MAAM,QAAQ,0BAA0B,IAAI,EAAE,IAAI,MAAM,KAAK,CAAC;AACjF,MAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;AACtE,SAAO,EAAE,KAAK,EAAE,YAAY,CAAC;GAC7B;AAEF,eAAc,MAAM,wBAAwB,OAAO,MAAM;AACvD,MAAI;GACF,MAAM,QAAQ,MAAM,EAAE,IAAI,MAAM;AAChC,OAAI,MAAM,aAAa,CAAC,QAAQ,SAAS,IAAI,MAAM,UAAU,CAC3D,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,EAAE,IAAI;GAEpD,MAAM,aAAa,MAAM,QAAQ,0BAA0B,OAAO,EAAE,IAAI,MAAM,KAAK,EAAE,MAAM;AAC3F,OAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;AACtE,UAAO,EAAE,KAAK,EAAE,YAAY,CAAC;WACtB,KAAK;AACZ,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,UAAU,CAAC;AAChF,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,+BAA+B,EAAE,IAAI;;GAEnG;AAEF,eAAc,OAAO,wBAAwB,OAAO,MAAM;EACxD,MAAM,UAAU,MAAM,QAAQ,0BAA0B,OAAO,EAAE,IAAI,MAAM,KAAK,CAAC;AACjF,SAAO,EAAE,KAAK,EAAE,SAAS,CAAC;GAC1B;AAEF,eAAc,KAAK,4BAA4B,OAAO,MAAM;AAC1D,MAAI;GACF,MAAM,MAAM,MAAM,QAAQ,0BAA0B,OAAO,EAAE,IAAI,MAAM,KAAK,CAAC;AAC7E,UAAO,EAAE,KAAK,EAAE,KAAK,CAAC;WACf,KAAK;AACZ,OAAI,eAAe,8BACjB,QAAO,EAAE,KAAK;IACZ,OAAO,IAAI;IACX,MAAM;IACN,cAAc,IAAI;IAClB,cAAc,IAAI;IACnB,EAAE,IAAI;AAET,iBAAc,KAAK,GAAG,KAAK,6BAA6B,EAAE,WAAW,OAAO,CAAC;AAC7E,UAAO,EAAE,KAAK,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,4BAA4B,EAAE,IAAI;;GAEhG;AAEF,eAAc,KAAK,8BAA8B,OAAO,MAAM;EAC5D,MAAM,aAAa,MAAM,QAAQ,0BAA0B,MAAM,EAAE,IAAI,MAAM,KAAK,CAAC;AACnF,MAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;AACtE,SAAO,EAAE,KAAK,EAAE,YAAY,CAAC;GAC7B;AAEF,eAAc,KAAK,+BAA+B,OAAO,MAAM;EAC7D,MAAM,aAAa,MAAM,QAAQ,0BAA0B,OAAO,EAAE,IAAI,MAAM,KAAK,CAAC;AACpF,MAAI,CAAC,WAAY,QAAO,EAAE,KAAK,EAAE,OAAO,wBAAwB,EAAE,IAAI;AACtE,SAAO,EAAE,KAAK,EAAE,YAAY,CAAC;GAC7B"}

package/dist/src/automations/domain/validation.d.ts

@@ -214,13 +214,6 @@ export declare const CreateAutomationSchema: z.ZodObject<{
         maxSubagents: z.ZodOptional<z.ZodNumber>;
         timeoutSeconds: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>], "kind">;
-    safety: z.ZodOptional<z.ZodObject<{
-        mode: z.ZodEnum<{
-            suggest_only: "suggest_only";
-            ask_before_apply: "ask_before_apply";
-            auto_apply: "auto_apply";
-        }>;
-    }, z.core.$strict>>;
     description: z.ZodOptional<z.ZodString>;
     trigger: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"manual">;
@@ -247,6 +240,13 @@ export declare const CreateAutomationSchema: z.ZodObject<{
         source: z.ZodPreprocess<z.ZodOptional<z.ZodString>>;
         payloadMatch: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
     }, z.core.$strict>], "kind">;
+    safety: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            suggest_only: "suggest_only";
+            ask_before_apply: "ask_before_apply";
+            auto_apply: "auto_apply";
+        }>;
+    }, z.core.$strict>>;
     afterRun: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"none">;
     }, z.core.$strict>, z.ZodObject<{
@@ -306,13 +306,6 @@ export declare const UpdateAutomationSchema: z.ZodObject<{
         maxSubagents: z.ZodOptional<z.ZodNumber>;
         timeoutSeconds: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>], "kind">>;
-    safety: z.ZodOptional<z.ZodOptional<z.ZodObject<{
-        mode: z.ZodEnum<{
-            suggest_only: "suggest_only";
-            ask_before_apply: "ask_before_apply";
-            auto_apply: "auto_apply";
-        }>;
-    }, z.core.$strict>>>;
     description: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     trigger: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"manual">;
@@ -354,6 +347,13 @@ export declare const UpdateAutomationSchema: z.ZodObject<{
         lastError: z.ZodOptional<z.ZodString>;
         consecutiveFailures: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>>;
+    safety: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            suggest_only: "suggest_only";
+            ask_before_apply: "ask_before_apply";
+            auto_apply: "auto_apply";
+        }>;
+    }, z.core.$strict>>>;
     afterRun: z.ZodOptional<z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"none">;
     }, z.core.$strict>, z.ZodObject<{

package/dist/src/automations/draft/automation-draft-service.js

@@ -1,10 +1,10 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { init_providers, resolveModel } from "../../providers/index.js";
+import { completeWithResolvedCredentials } from "../../providers/model-call.js";
 import { resolveDraftModelRef } from "../../workflows/draft/workflow-draft-service.js";
 import { buildAutomationDraftPrompt, buildAutomationDraftRepairPrompt, buildAutomationRunRepairPrompt, buildAutomationRunRepairRetryPrompt } from "./automation-draft-prompt.js";
 import { buildAutomationDraftResponse, parseGeneratedAutomationDraft, parseGeneratedAutomationRepairDraft } from "./automation-draft-validator.js";
-import { complete } from "@earendil-works/pi-ai/compat";
 //#region src/automations/draft/automation-draft-service.ts
 init_providers();
 init_logger();
@@ -27,7 +27,7 @@ var AutomationDraftService = class {
 		let lastText = "";
 		let lastIssues = [];
 		for (let attempt = 0; attempt <= maxRepairAttempts; attempt += 1) {
-			lastText = extractText(await complete(model, { messages: [{
+			lastText = extractText(await completeWithResolvedCredentials(model, { messages: [{
 				role: "user",
 				content: messageContent,
 				timestamp: Date.now()
@@ -80,7 +80,7 @@ var AutomationDraftService = class {
 		let lastText = "";
 		let lastIssues = [];
 		for (let attempt = 0; attempt <= maxRepairAttempts; attempt += 1) {
-			lastText = extractText(await complete(model, { messages: [{
+			lastText = extractText(await completeWithResolvedCredentials(model, { messages: [{
 				role: "user",
 				content: messageContent,
 				timestamp: Date.now()

package/dist/src/automations/draft/automation-draft-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"automation-draft-service.js","names":[],"sources":["../../../../src/automations/draft/automation-draft-service.ts"],"sourcesContent":["import { complete, type UserMessage } from '@earendil-works/pi-ai/compat';\n\nimport type { Config } from '../../config/schema.js';\nimport { resolveModel } from '../../providers/index.js';\nimport { createLogger } from '../../utils/logger.js';\nimport { resolveDraftModelRef } from '../../workflows/draft/workflow-draft-service.js';\nimport {\n  buildAutomationDraftPrompt,\n  buildAutomationDraftRepairPrompt,\n  buildAutomationRunRepairPrompt,\n  buildAutomationRunRepairRetryPrompt,\n  type AutomationDraftRepairIssue,\n} from './automation-draft-prompt.js';\nimport type {\n  AutomationDraftResponse,\n  AutomationRepairDraftResponse,\n  CreateAutomationDraftRequest,\n  CreateAutomationRepairDraftRequest,\n} from './automation-draft.types.js';\nimport {\n  buildAutomationDraftResponse,\n  parseGeneratedAutomationDraft,\n  parseGeneratedAutomationRepairDraft,\n} from './automation-draft-validator.js';\n\nconst log = createLogger('AutomationDraft');\nconst DEFAULT_MAX_REPAIR_ATTEMPTS = 2;\n\nexport interface AutomationDraftServiceOptions {\n  config: Config;\n  maxRepairAttempts?: number;\n}\n\nexport class AutomationDraftService {\n  constructor(private readonly options: AutomationDraftServiceOptions) {}\n\n  async createDraft(request: CreateAutomationDraftRequest, signal?: AbortSignal): Promise<AutomationDraftResponse> {\n    const prompt = request.prompt.trim();\n    if (!prompt) throw new Error('prompt is required');\n\n    const modelRef = resolveDraftModelRef(this.options.config, request.agentId);\n    const model = resolveModel(modelRef);\n    const maxRepairAttempts = this.options.maxRepairAttempts ?? DEFAULT_MAX_REPAIR_ATTEMPTS;\n    let messageContent = buildAutomationDraftPrompt({ prompt, language: request.language });\n    let lastText = '';\n    let lastIssues: AutomationDraftRepairIssue[] = [];\n\n    for (let attempt = 0; attempt <= maxRepairAttempts; attempt += 1) {\n      const userMsg: UserMessage = {\n        role: 'user',\n        content: messageContent,\n        timestamp: Date.now(),\n      };\n      const result = await complete(\n        model,\n        { messages: [userMsg] },\n        { maxTokens: 2048, temperature: attempt === 0 ? 0.2 : 0.1, signal },\n      );\n      lastText = extractText(result);\n      try {\n        const draft = parseGeneratedAutomationDraft(lastText);\n        return buildAutomationDraftResponse(draft, attempt);\n      } catch (err) {\n        lastIssues = [{\n          source: 'validation',\n          severity: 'error',\n          message: err instanceof Error ? err.message : String(err),\n        }];\n      }\n\n      if (attempt >= maxRepairAttempts) break;\n      log.warn(\n        { modelRef, attempt: attempt + 1, issueCount: lastIssues.length, preview: lastText.slice(0, 500) },\n        'Automation draft validation failed; asking model to repair',\n      );\n      messageContent = buildAutomationDraftRepairPrompt({\n        prompt,\n        language: request.language,\n        previousOutput: lastText,\n        issues: lastIssues,\n      });\n    }\n\n    const message = `Unable to generate a valid automation draft after ${maxRepairAttempts + 1} attempts`;\n    log.warn({ modelRef, issues: lastIssues, preview: lastText.slice(0, 500) }, message);\n    throw new Error(message);\n  }\n\n  async createRepairDraft(\n    request: CreateAutomationRepairDraftRequest,\n    signal?: AbortSignal,\n  ): Promise<AutomationRepairDraftResponse> {\n    const modelRef = resolveDraftModelRef(this.options.config, request.agentId);\n    const model = resolveModel(modelRef);\n    const maxRepairAttempts = this.options.maxRepairAttempts ?? DEFAULT_MAX_REPAIR_ATTEMPTS;\n    let messageContent = buildAutomationRunRepairPrompt({\n      language: request.language,\n      automation: request.automation,\n      run: request.run,\n      events: request.events,\n    });\n    let lastText = '';\n    let lastIssues: AutomationDraftRepairIssue[] = [];\n\n    for (let attempt = 0; attempt <= maxRepairAttempts; attempt += 1) {\n      const userMsg: UserMessage = {\n        role: 'user',\n        content: messageContent,\n        timestamp: Date.now(),\n      };\n      const result = await complete(\n        model,\n        { messages: [userMsg] },\n        { maxTokens: 2048, temperature: attempt === 0 ? 0.15 : 0.05, signal },\n      );\n      lastText = extractText(result);\n      try {\n        return parseGeneratedAutomationRepairDraft(lastText, attempt);\n      } catch (err) {\n        lastIssues = [{\n          source: 'validation',\n          severity: 'error',\n          message: err instanceof Error ? err.message : String(err),\n        }];\n      }\n\n      if (attempt >= maxRepairAttempts) break;\n      log.warn(\n        { modelRef, attempt: attempt + 1, issueCount: lastIssues.length, preview: lastText.slice(0, 500) },\n        'Automation repair draft validation failed; asking model to repair',\n      );\n      messageContent = buildAutomationRunRepairRetryPrompt({\n        language: request.language,\n        previousOutput: lastText,\n        issues: lastIssues,\n      });\n    }\n\n    const message = `Unable to generate a valid automation repair draft after ${maxRepairAttempts + 1} attempts`;\n    log.warn({ modelRef, issues: lastIssues, preview: lastText.slice(0, 500) }, message);\n    throw new Error(message);\n  }\n}\n\nfunction extractText(result: unknown): string {\n  const content = (result as { content?: unknown }).content;\n  if (typeof content === 'string') return content;\n  if (Array.isArray(content)) {\n    return content.map((item) => {\n      if (item && typeof item === 'object' && (item as { type?: string }).type === 'text') {\n        return String((item as { text?: string }).text ?? '');\n      }\n      return '';\n    }).join('');\n  }\n  return '';\n}\n"],"mappings":";;;;;;;;gBAGwD;aACH;AAqBrD,MAAM,MAAM,aAAa,kBAAkB;AAC3C,MAAM,8BAA8B;AAOpC,IAAa,yBAAb,MAAoC;CAClC,YAAY,SAAyD;AAAxC,OAAA,UAAA;;CAE7B,MAAM,YAAY,SAAuC,QAAwD;EAC/G,MAAM,SAAS,QAAQ,OAAO,MAAM;AACpC,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qBAAqB;EAElD,MAAM,WAAW,qBAAqB,KAAK,QAAQ,QAAQ,QAAQ,QAAQ;EAC3E,MAAM,QAAQ,aAAa,SAAS;EACpC,MAAM,oBAAoB,KAAK,QAAQ,qBAAqB;EAC5D,IAAI,iBAAiB,2BAA2B;GAAE;GAAQ,UAAU,QAAQ;GAAU,CAAC;EACvF,IAAI,WAAW;EACf,IAAI,aAA2C,EAAE;AAEjD,OAAK,IAAI,UAAU,GAAG,WAAW,mBAAmB,WAAW,GAAG;AAWhE,cAAW,YAAY,MALF,SACnB,OACA,EAAE,UAAU,CAAC;IANb,MAAM;IACN,SAAS;IACT,WAAW,KAAK,KAAK;IAID,CAAC,EAAE,EACvB;IAAE,WAAW;IAAM,aAAa,YAAY,IAAI,KAAM;IAAK;IAAQ,CACpE,CAC6B;AAC9B,OAAI;AAEF,WAAO,6BADO,8BAA8B,SACH,EAAE,QAAQ;YAC5C,KAAK;AACZ,iBAAa,CAAC;KACZ,QAAQ;KACR,UAAU;KACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KAC1D,CAAC;;AAGJ,OAAI,WAAW,kBAAmB;AAClC,OAAI,KACF;IAAE;IAAU,SAAS,UAAU;IAAG,YAAY,WAAW;IAAQ,SAAS,SAAS,MAAM,GAAG,IAAI;IAAE,EAClG,6DACD;AACD,oBAAiB,iCAAiC;IAChD;IACA,UAAU,QAAQ;IAClB,gBAAgB;IAChB,QAAQ;IACT,CAAC;;EAGJ,MAAM,UAAU,qDAAqD,oBAAoB,EAAE;AAC3F,MAAI,KAAK;GAAE;GAAU,QAAQ;GAAY,SAAS,SAAS,MAAM,GAAG,IAAI;GAAE,EAAE,QAAQ;AACpF,QAAM,IAAI,MAAM,QAAQ;;CAG1B,MAAM,kBACJ,SACA,QACwC;EACxC,MAAM,WAAW,qBAAqB,KAAK,QAAQ,QAAQ,QAAQ,QAAQ;EAC3E,MAAM,QAAQ,aAAa,SAAS;EACpC,MAAM,oBAAoB,KAAK,QAAQ,qBAAqB;EAC5D,IAAI,iBAAiB,+BAA+B;GAClD,UAAU,QAAQ;GAClB,YAAY,QAAQ;GACpB,KAAK,QAAQ;GACb,QAAQ,QAAQ;GACjB,CAAC;EACF,IAAI,WAAW;EACf,IAAI,aAA2C,EAAE;AAEjD,OAAK,IAAI,UAAU,GAAG,WAAW,mBAAmB,WAAW,GAAG;AAWhE,cAAW,YAAY,MALF,SACnB,OACA,EAAE,UAAU,CAAC;IANb,MAAM;IACN,SAAS;IACT,WAAW,KAAK,KAAK;IAID,CAAC,EAAE,EACvB;IAAE,WAAW;IAAM,aAAa,YAAY,IAAI,MAAO;IAAM;IAAQ,CACtE,CAC6B;AAC9B,OAAI;AACF,WAAO,oCAAoC,UAAU,QAAQ;YACtD,KAAK;AACZ,iBAAa,CAAC;KACZ,QAAQ;KACR,UAAU;KACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KAC1D,CAAC;;AAGJ,OAAI,WAAW,kBAAmB;AAClC,OAAI,KACF;IAAE;IAAU,SAAS,UAAU;IAAG,YAAY,WAAW;IAAQ,SAAS,SAAS,MAAM,GAAG,IAAI;IAAE,EAClG,oEACD;AACD,oBAAiB,oCAAoC;IACnD,UAAU,QAAQ;IAClB,gBAAgB;IAChB,QAAQ;IACT,CAAC;;EAGJ,MAAM,UAAU,4DAA4D,oBAAoB,EAAE;AAClG,MAAI,KAAK;GAAE;GAAU,QAAQ;GAAY,SAAS,SAAS,MAAM,GAAG,IAAI;GAAE,EAAE,QAAQ;AACpF,QAAM,IAAI,MAAM,QAAQ;;;AAI5B,SAAS,YAAY,QAAyB;CAC5C,MAAM,UAAW,OAAiC;AAClD,KAAI,OAAO,YAAY,SAAU,QAAO;AACxC,KAAI,MAAM,QAAQ,QAAQ,CACxB,QAAO,QAAQ,KAAK,SAAS;AAC3B,MAAI,QAAQ,OAAO,SAAS,YAAa,KAA2B,SAAS,OAC3E,QAAO,OAAQ,KAA2B,QAAQ,GAAG;AAEvD,SAAO;GACP,CAAC,KAAK,GAAG;AAEb,QAAO"}
+{"version":3,"file":"automation-draft-service.js","names":[],"sources":["../../../../src/automations/draft/automation-draft-service.ts"],"sourcesContent":["import { type UserMessage } from '@earendil-works/pi-ai/compat';\n\nimport type { Config } from '../../config/schema.js';\nimport { resolveModel } from '../../providers/index.js';\nimport { completeWithResolvedCredentials } from '../../providers/model-call.js';\nimport { createLogger } from '../../utils/logger.js';\nimport { resolveDraftModelRef } from '../../workflows/draft/workflow-draft-service.js';\nimport {\n  buildAutomationDraftPrompt,\n  buildAutomationDraftRepairPrompt,\n  buildAutomationRunRepairPrompt,\n  buildAutomationRunRepairRetryPrompt,\n  type AutomationDraftRepairIssue,\n} from './automation-draft-prompt.js';\nimport type {\n  AutomationDraftResponse,\n  AutomationRepairDraftResponse,\n  CreateAutomationDraftRequest,\n  CreateAutomationRepairDraftRequest,\n} from './automation-draft.types.js';\nimport {\n  buildAutomationDraftResponse,\n  parseGeneratedAutomationDraft,\n  parseGeneratedAutomationRepairDraft,\n} from './automation-draft-validator.js';\n\nconst log = createLogger('AutomationDraft');\nconst DEFAULT_MAX_REPAIR_ATTEMPTS = 2;\n\nexport interface AutomationDraftServiceOptions {\n  config: Config;\n  maxRepairAttempts?: number;\n}\n\nexport class AutomationDraftService {\n  constructor(private readonly options: AutomationDraftServiceOptions) {}\n\n  async createDraft(request: CreateAutomationDraftRequest, signal?: AbortSignal): Promise<AutomationDraftResponse> {\n    const prompt = request.prompt.trim();\n    if (!prompt) throw new Error('prompt is required');\n\n    const modelRef = resolveDraftModelRef(this.options.config, request.agentId);\n    const model = resolveModel(modelRef);\n    const maxRepairAttempts = this.options.maxRepairAttempts ?? DEFAULT_MAX_REPAIR_ATTEMPTS;\n    let messageContent = buildAutomationDraftPrompt({ prompt, language: request.language });\n    let lastText = '';\n    let lastIssues: AutomationDraftRepairIssue[] = [];\n\n    for (let attempt = 0; attempt <= maxRepairAttempts; attempt += 1) {\n      const userMsg: UserMessage = {\n        role: 'user',\n        content: messageContent,\n        timestamp: Date.now(),\n      };\n      const result = await completeWithResolvedCredentials(\n        model,\n        { messages: [userMsg] },\n        { maxTokens: 2048, temperature: attempt === 0 ? 0.2 : 0.1, signal },\n      );\n      lastText = extractText(result);\n      try {\n        const draft = parseGeneratedAutomationDraft(lastText);\n        return buildAutomationDraftResponse(draft, attempt);\n      } catch (err) {\n        lastIssues = [{\n          source: 'validation',\n          severity: 'error',\n          message: err instanceof Error ? err.message : String(err),\n        }];\n      }\n\n      if (attempt >= maxRepairAttempts) break;\n      log.warn(\n        { modelRef, attempt: attempt + 1, issueCount: lastIssues.length, preview: lastText.slice(0, 500) },\n        'Automation draft validation failed; asking model to repair',\n      );\n      messageContent = buildAutomationDraftRepairPrompt({\n        prompt,\n        language: request.language,\n        previousOutput: lastText,\n        issues: lastIssues,\n      });\n    }\n\n    const message = `Unable to generate a valid automation draft after ${maxRepairAttempts + 1} attempts`;\n    log.warn({ modelRef, issues: lastIssues, preview: lastText.slice(0, 500) }, message);\n    throw new Error(message);\n  }\n\n  async createRepairDraft(\n    request: CreateAutomationRepairDraftRequest,\n    signal?: AbortSignal,\n  ): Promise<AutomationRepairDraftResponse> {\n    const modelRef = resolveDraftModelRef(this.options.config, request.agentId);\n    const model = resolveModel(modelRef);\n    const maxRepairAttempts = this.options.maxRepairAttempts ?? DEFAULT_MAX_REPAIR_ATTEMPTS;\n    let messageContent = buildAutomationRunRepairPrompt({\n      language: request.language,\n      automation: request.automation,\n      run: request.run,\n      events: request.events,\n    });\n    let lastText = '';\n    let lastIssues: AutomationDraftRepairIssue[] = [];\n\n    for (let attempt = 0; attempt <= maxRepairAttempts; attempt += 1) {\n      const userMsg: UserMessage = {\n        role: 'user',\n        content: messageContent,\n        timestamp: Date.now(),\n      };\n      const result = await completeWithResolvedCredentials(\n        model,\n        { messages: [userMsg] },\n        { maxTokens: 2048, temperature: attempt === 0 ? 0.15 : 0.05, signal },\n      );\n      lastText = extractText(result);\n      try {\n        return parseGeneratedAutomationRepairDraft(lastText, attempt);\n      } catch (err) {\n        lastIssues = [{\n          source: 'validation',\n          severity: 'error',\n          message: err instanceof Error ? err.message : String(err),\n        }];\n      }\n\n      if (attempt >= maxRepairAttempts) break;\n      log.warn(\n        { modelRef, attempt: attempt + 1, issueCount: lastIssues.length, preview: lastText.slice(0, 500) },\n        'Automation repair draft validation failed; asking model to repair',\n      );\n      messageContent = buildAutomationRunRepairRetryPrompt({\n        language: request.language,\n        previousOutput: lastText,\n        issues: lastIssues,\n      });\n    }\n\n    const message = `Unable to generate a valid automation repair draft after ${maxRepairAttempts + 1} attempts`;\n    log.warn({ modelRef, issues: lastIssues, preview: lastText.slice(0, 500) }, message);\n    throw new Error(message);\n  }\n}\n\nfunction extractText(result: unknown): string {\n  const content = (result as { content?: unknown }).content;\n  if (typeof content === 'string') return content;\n  if (Array.isArray(content)) {\n    return content.map((item) => {\n      if (item && typeof item === 'object' && (item as { type?: string }).type === 'text') {\n        return String((item as { text?: string }).text ?? '');\n      }\n      return '';\n    }).join('');\n  }\n  return '';\n}\n"],"mappings":";;;;;;;;gBAGwD;aAEH;AAqBrD,MAAM,MAAM,aAAa,kBAAkB;AAC3C,MAAM,8BAA8B;AAOpC,IAAa,yBAAb,MAAoC;CAClC,YAAY,SAAyD;AAAxC,OAAA,UAAA;;CAE7B,MAAM,YAAY,SAAuC,QAAwD;EAC/G,MAAM,SAAS,QAAQ,OAAO,MAAM;AACpC,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qBAAqB;EAElD,MAAM,WAAW,qBAAqB,KAAK,QAAQ,QAAQ,QAAQ,QAAQ;EAC3E,MAAM,QAAQ,aAAa,SAAS;EACpC,MAAM,oBAAoB,KAAK,QAAQ,qBAAqB;EAC5D,IAAI,iBAAiB,2BAA2B;GAAE;GAAQ,UAAU,QAAQ;GAAU,CAAC;EACvF,IAAI,WAAW;EACf,IAAI,aAA2C,EAAE;AAEjD,OAAK,IAAI,UAAU,GAAG,WAAW,mBAAmB,WAAW,GAAG;AAWhE,cAAW,YAAY,MALF,gCACnB,OACA,EAAE,UAAU,CAAC;IANb,MAAM;IACN,SAAS;IACT,WAAW,KAAK,KAAK;IAID,CAAC,EAAE,EACvB;IAAE,WAAW;IAAM,aAAa,YAAY,IAAI,KAAM;IAAK;IAAQ,CACpE,CAC6B;AAC9B,OAAI;AAEF,WAAO,6BADO,8BAA8B,SACH,EAAE,QAAQ;YAC5C,KAAK;AACZ,iBAAa,CAAC;KACZ,QAAQ;KACR,UAAU;KACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KAC1D,CAAC;;AAGJ,OAAI,WAAW,kBAAmB;AAClC,OAAI,KACF;IAAE;IAAU,SAAS,UAAU;IAAG,YAAY,WAAW;IAAQ,SAAS,SAAS,MAAM,GAAG,IAAI;IAAE,EAClG,6DACD;AACD,oBAAiB,iCAAiC;IAChD;IACA,UAAU,QAAQ;IAClB,gBAAgB;IAChB,QAAQ;IACT,CAAC;;EAGJ,MAAM,UAAU,qDAAqD,oBAAoB,EAAE;AAC3F,MAAI,KAAK;GAAE;GAAU,QAAQ;GAAY,SAAS,SAAS,MAAM,GAAG,IAAI;GAAE,EAAE,QAAQ;AACpF,QAAM,IAAI,MAAM,QAAQ;;CAG1B,MAAM,kBACJ,SACA,QACwC;EACxC,MAAM,WAAW,qBAAqB,KAAK,QAAQ,QAAQ,QAAQ,QAAQ;EAC3E,MAAM,QAAQ,aAAa,SAAS;EACpC,MAAM,oBAAoB,KAAK,QAAQ,qBAAqB;EAC5D,IAAI,iBAAiB,+BAA+B;GAClD,UAAU,QAAQ;GAClB,YAAY,QAAQ;GACpB,KAAK,QAAQ;GACb,QAAQ,QAAQ;GACjB,CAAC;EACF,IAAI,WAAW;EACf,IAAI,aAA2C,EAAE;AAEjD,OAAK,IAAI,UAAU,GAAG,WAAW,mBAAmB,WAAW,GAAG;AAWhE,cAAW,YAAY,MALF,gCACnB,OACA,EAAE,UAAU,CAAC;IANb,MAAM;IACN,SAAS;IACT,WAAW,KAAK,KAAK;IAID,CAAC,EAAE,EACvB;IAAE,WAAW;IAAM,aAAa,YAAY,IAAI,MAAO;IAAM;IAAQ,CACtE,CAC6B;AAC9B,OAAI;AACF,WAAO,oCAAoC,UAAU,QAAQ;YACtD,KAAK;AACZ,iBAAa,CAAC;KACZ,QAAQ;KACR,UAAU;KACV,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;KAC1D,CAAC;;AAGJ,OAAI,WAAW,kBAAmB;AAClC,OAAI,KACF;IAAE;IAAU,SAAS,UAAU;IAAG,YAAY,WAAW;IAAQ,SAAS,SAAS,MAAM,GAAG,IAAI;IAAE,EAClG,oEACD;AACD,oBAAiB,oCAAoC;IACnD,UAAU,QAAQ;IAClB,gBAAgB;IAChB,QAAQ;IACT,CAAC;;EAGJ,MAAM,UAAU,4DAA4D,oBAAoB,EAAE;AAClG,MAAI,KAAK;GAAE;GAAU,QAAQ;GAAY,SAAS,SAAS,MAAM,GAAG,IAAI;GAAE,EAAE,QAAQ;AACpF,QAAM,IAAI,MAAM,QAAQ;;;AAI5B,SAAS,YAAY,QAAyB;CAC5C,MAAM,UAAW,OAAiC;AAClD,KAAI,OAAO,YAAY,SAAU,QAAO;AACxC,KAAI,MAAM,QAAQ,QAAQ,CACxB,QAAO,QAAQ,KAAK,SAAS;AAC3B,MAAI,QAAQ,OAAO,SAAS,YAAa,KAA2B,SAAS,OAC3E,QAAO,OAAQ,KAA2B,QAAQ,GAAG;AAEvD,SAAO;GACP,CAAC,KAAK,GAAG;AAEb,QAAO"}

package/dist/src/automations/draft/automation-draft-validator.d.ts

@@ -35,9 +35,6 @@ export declare function buildAutomationDraftResponse(draft: GeneratedAutomationD
             maxSubagents?: number;
             timeoutSeconds?: number;
         };
-        safety?: {
-            mode: "suggest_only" | "ask_before_apply" | "auto_apply";
-        };
         description?: string;
         trigger?: {
             kind: "manual";
@@ -64,6 +61,9 @@ export declare function buildAutomationDraftResponse(draft: GeneratedAutomationD
             source?: string;
             payloadMatch?: Record<string, string | number | boolean>;
         };
+        safety?: {
+            mode: "suggest_only" | "ask_before_apply" | "auto_apply";
+        };
         afterRun?: {
             kind: "none";
         } | {

package/dist/src/browser/providers/browser-ext-install.d.ts

@@ -59,12 +59,22 @@ export declare function ensureBrowserExtensionArtifacts(opts?: {
 export declare function ensureBrowserExtensionOnStartup(_config: unknown): Promise<void>;
 export declare function readInstalledExtensionDir(cacheDir?: string): Promise<string | null>;
 export type BrowserExtensionOpenAction = 'chrome' | 'folder' | 'both';
+type ExtensionManagerBrowser = 'chrome' | 'edge';
+interface ExtensionManagerTarget {
+    browser: ExtensionManagerBrowser;
+    executablePath: string;
+    url: string;
+}
+export declare function resolveWindowsExtensionManager(env?: NodeJS.ProcessEnv): ExtensionManagerTarget | null;
 /**
- * Open chrome://extensions and/or reveal the installed extension folder on the gateway host.
+ * Open the compatible browser's extension manager and/or reveal the installed extension folder
+ * on the gateway host.
  */
 export declare function openBrowserExtensionInstallUi(opts: {
     action: BrowserExtensionOpenAction;
     cacheDir?: string;
 }): Promise<{
     extensionDir: string;
+    browser?: ExtensionManagerBrowser;
 }>;
+export {};

package/dist/src/browser/providers/browser-ext-install.js

@@ -283,26 +283,46 @@ function spawnDetached(command, args) {
 		detached: true
 	}).unref();
 }
-function openChromeExtensionsPage() {
-	const chromeUrl = "chrome://extensions";
+function windowsExtensionManagerCandidates(env) {
+	const programFiles = [
+		env.PROGRAMFILES,
+		env["PROGRAMFILES(X86)"],
+		env.LOCALAPPDATA
+	].filter((path) => Boolean(path?.trim()));
+	const candidates = [];
+	for (const root of programFiles) candidates.push({
+		browser: "chrome",
+		executablePath: join(root, "Google", "Chrome", "Application", "chrome.exe"),
+		url: "chrome://extensions/"
+	});
+	for (const root of programFiles) candidates.push({
+		browser: "edge",
+		executablePath: join(root, "Microsoft", "Edge", "Application", "msedge.exe"),
+		url: "edge://extensions/"
+	});
+	return candidates;
+}
+function resolveWindowsExtensionManager(env = process.env) {
+	return windowsExtensionManagerCandidates(env).find(({ executablePath }) => existsSync(executablePath)) ?? null;
+}
+function openBrowserExtensionManager() {
+	const chromeUrl = "chrome://extensions/";
 	if (process.platform === "darwin") {
 		spawnDetached("open", [
 			"-a",
 			"Google Chrome",
 			chromeUrl
 		]);
-		return;
+		return "chrome";
 	}
 	if (process.platform === "win32") {
-		spawnDetached("cmd", [
-			"/c",
-			"start",
-			"chrome",
-			chromeUrl
-		]);
-		return;
+		const target = resolveWindowsExtensionManager();
+		if (!target) throw new Error("No compatible browser found. Install Google Chrome or Microsoft Edge, then try again.");
+		spawnDetached(target.executablePath, [target.url]);
+		return target.browser;
 	}
 	spawnDetached("xdg-open", [chromeUrl]);
+	return "chrome";
 }
 function revealFolderInFileManager(dir) {
 	if (process.platform === "darwin") {
@@ -316,16 +336,21 @@ function revealFolderInFileManager(dir) {
 	spawnDetached("xdg-open", [dir]);
 }
 /**
-* Open chrome://extensions and/or reveal the installed extension folder on the gateway host.
+* Open the compatible browser's extension manager and/or reveal the installed extension folder
+* on the gateway host.
 */
 async function openBrowserExtensionInstallUi(opts) {
 	const dir = (await browserExtDoctor({ cacheDir: opts.cacheDir })).extensionDir;
 	if (!dir) throw new Error("Extension not installed. Run xopc browser extension install first.");
-	if (opts.action === "chrome" || opts.action === "both") openChromeExtensionsPage();
+	let browser;
+	if (opts.action === "chrome" || opts.action === "both") browser = openBrowserExtensionManager();
 	if (opts.action === "folder" || opts.action === "both") revealFolderInFileManager(dir);
-	return { extensionDir: dir };
+	return {
+		extensionDir: dir,
+		browser
+	};
 }
 //#endregion
-export { BROWSER_EXT_REQUIRED_FILES, browserExtDoctor, computeNeedsRefresh, ensureBrowserExtensionArtifacts, ensureBrowserExtensionOnStartup, openBrowserExtensionInstallUi, readInstalledExtensionDir, resolveBundledBrowserExtDir, resolveInstalledExtensionPath, validateBrowserExtLayout };
+export { BROWSER_EXT_REQUIRED_FILES, browserExtDoctor, computeNeedsRefresh, ensureBrowserExtensionArtifacts, ensureBrowserExtensionOnStartup, openBrowserExtensionInstallUi, readInstalledExtensionDir, resolveBundledBrowserExtDir, resolveInstalledExtensionPath, resolveWindowsExtensionManager, validateBrowserExtLayout };
 
 //# sourceMappingURL=browser-ext-install.js.map