catelog 1.0.1 → 1.0.3

package/dist/security.js

@@ -1,4 +1,7 @@
-import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+import { createHash, createHmac, timingSafeEqual, randomUUID } from "node:crypto";
+// ─────────────────────────────────────────────────
+//  Errors
+// ─────────────────────────────────────────────────
 export class SecurityVerificationError extends Error {
     code;
     statusCode;
@@ -9,82 +12,150 @@ export class SecurityVerificationError extends Error {
         this.name = "SecurityVerificationError";
     }
 }
+// ─────────────────────────────────────────────────
+//  SecurityManager
+// ─────────────────────────────────────────────────
 export class SecurityManager {
     secret;
+    publicKey;
     maxTimestampDriftMs;
     nonceTtlMs;
     seenNonces = new Map();
     activeRunIds = new Set();
     completedRunIds = new Map();
     constructor(options = {}) {
-        this.secret = options.secret;
+        // Auto-discover keys from environment if not provided
+        this.secret = options.secret || process.env.CATELOG_SECRET_KEY;
+        this.publicKey = options.publicKey || process.env.CATELOG_PUBLIC_KEY;
         this.maxTimestampDriftMs = options.maxTimestampDriftMs ?? 300_000; // 5 minutes
-        this.nonceTtlMs = options.nonceTtlMs ?? 300_000; // 5 minutes
-    }
-    setSecret(secret) {
-        this.secret = secret;
+        this.nonceTtlMs = options.nonceTtlMs ?? 300_000;
     }
     getSecret() {
         return this.secret;
     }
-    /**
-     * Computes SHA-256 hash in lowercase hex of request body
-     */
-    computeBodyHash(rawBody) {
-        return createHash("sha256").update(rawBody).digest("hex");
+    getPublicKey() {
+        return this.publicKey;
     }
-    /**
-     * Constructs the canonical string according to MAPS 1.0.0:
-     * METHOD\nPATH\nTIMESTAMP\nNONCE\nRUN_ID\nBodyHash
-     */
-    buildCanonicalString(method, path, timestamp, nonce, runId, bodyHash) {
-        const normalizedMethod = method.toUpperCase();
-        const normalizedPath = path.split("?")[0] || "/";
-        return `${normalizedMethod}\n${normalizedPath}\n${timestamp}\n${nonce}\n${runId}\n${bodyHash}`;
+    setSecret(secret) {
+        this.secret = secret;
     }
-    /**
-     * Calculates HMAC-SHA256 signature in lowercase hex
-     */
-    calculateSignature(canonicalString, secret) {
-        return createHmac("sha256", secret).update(canonicalString).digest("hex");
+    setPublicKey(publicKey) {
+        this.publicKey = publicKey;
+    }
+    isDevMode() {
+        return !this.secret && process.env.NODE_ENV !== "production";
     }
+    // ─────────────────────────────────────────────
+    //  Dual-Mode Auth: Detects Bearer vs HMAC vs Dev
+    // ─────────────────────────────────────────────
     /**
-     * Verifies headers, timestamp, nonce, and HMAC-SHA256 signature.
+     * Authenticates an incoming request using the best available method:
+     *
+     * 1. HMAC headers present → full HMAC-SHA256 verification (Gateway traffic)
+     * 2. Authorization: Bearer cat_sec_... → simple secret key match (curl/Postman)
+     * 3. Authorization: Bearer cat_pub_... → public key match (read-only allowed)
+     * 4. No auth + dev mode → permissive pass-through with warning
+     * 5. No auth + production → rejected
      */
-    verifyRequest(params) {
+    authenticateRequest(params) {
         this.cleanupOldEntries();
-        // If no secret configured, skip HMAC check (e.g. local dev / unauthenticated mode)
+        const headers = params.headers;
+        // ── Check for HMAC headers first (Gateway mode) ──
+        const signatureHeader = headers["x-marketplace-signature"];
+        if (signatureHeader) {
+            return this.verifyHmac(params, signatureHeader);
+        }
+        // ── Check for Bearer token (simple auth) ──
+        const authHeader = (headers["authorization"] || headers["Authorization"]);
+        if (authHeader) {
+            return this.verifyBearer(authHeader, headers);
+        }
+        // ── No auth provided ──
+        if (this.isDevMode()) {
+            const runId = headers["x-marketplace-run-id"] || `dev-${randomUUID().slice(0, 8)}`;
+            const nonce = headers["x-marketplace-nonce"] || `dev-${randomUUID().slice(0, 8)}`;
+            if (process.env.NODE_ENV !== "test") {
+                console.warn("\x1b[33m⚠ [catelog] Running in dev mode — no authentication required. " +
+                    "Set CATELOG_SECRET_KEY in production.\x1b[0m");
+            }
+            return { runId, nonce, timestamp: Date.now(), authMode: "dev" };
+        }
+        // Production with no auth → reject
+        throw new SecurityVerificationError("AUTH_MISSING_KEY", "No authentication provided. Supply Authorization: Bearer <key> or HMAC signature headers.", 401);
+    }
+    // ── Bearer Token Verification ──
+    verifyBearer(authHeader, headers) {
+        const token = authHeader.replace(/^Bearer\s+/i, "").trim();
+        if (!token) {
+            throw new SecurityVerificationError("AUTH_INVALID_KEY", "Empty Bearer token", 401);
+        }
+        // Check secret key (cat_sec_live_...)
+        if (token.startsWith("cat_sec_") && this.secret) {
+            // Constant-time comparison
+            const tokenBuf = Buffer.from(token, "utf8");
+            const secretBuf = Buffer.from(this.secret, "utf8");
+            if (tokenBuf.length !== secretBuf.length || !timingSafeEqual(tokenBuf, secretBuf)) {
+                throw new SecurityVerificationError("AUTH_INVALID_KEY", "Invalid secret key", 401);
+            }
+            const runId = headers["x-marketplace-run-id"] || `run-${randomUUID().slice(0, 8)}`;
+            const nonce = headers["x-marketplace-nonce"] || `nonce-${randomUUID().slice(0, 8)}`;
+            return { runId, nonce, timestamp: Date.now(), authMode: "bearer" };
+        }
+        // Check public key (cat_pub_live_...)
+        if (token.startsWith("cat_pub_") && this.publicKey) {
+            const tokenBuf = Buffer.from(token, "utf8");
+            const pubBuf = Buffer.from(this.publicKey, "utf8");
+            if (tokenBuf.length !== pubBuf.length || !timingSafeEqual(tokenBuf, pubBuf)) {
+                throw new SecurityVerificationError("AUTH_INVALID_KEY", "Invalid public key", 401);
+            }
+            const runId = headers["x-marketplace-run-id"] || `pub-${randomUUID().slice(0, 8)}`;
+            const nonce = headers["x-marketplace-nonce"] || `pub-${randomUUID().slice(0, 8)}`;
+            return { runId, nonce, timestamp: Date.now(), authMode: "public" };
+        }
+        // Dev mode fallback for any token
+        if (this.isDevMode()) {
+            const runId = headers["x-marketplace-run-id"] || `dev-${randomUUID().slice(0, 8)}`;
+            const nonce = headers["x-marketplace-nonce"] || `dev-${randomUUID().slice(0, 8)}`;
+            return { runId, nonce, timestamp: Date.now(), authMode: "dev" };
+        }
+        throw new SecurityVerificationError("AUTH_INVALID_KEY", "Invalid API key format or key mismatch", 401);
+    }
+    // ── HMAC-SHA256 Verification (Gateway traffic) ──
+    verifyHmac(params, signatureHeader) {
         if (!this.secret) {
-            const runId = params.headers["x-marketplace-run-id"] || "dev-run-id";
-            const nonce = params.headers["x-marketplace-nonce"] || "dev-nonce";
-            const timestamp = Date.now();
-            return { runId, nonce, timestamp };
-        }
-        const timestampHeader = params.headers["x-marketplace-timestamp"];
-        const nonceHeader = params.headers["x-marketplace-nonce"];
-        const runIdHeader = params.headers["x-marketplace-run-id"];
-        const signatureHeader = params.headers["x-marketplace-signature"];
-        if (!timestampHeader || !nonceHeader || !runIdHeader || !signatureHeader) {
-            throw new SecurityVerificationError("AUTH_INVALID_SIGNATURE", "Missing required marketplace authentication headers", 401);
+            // Dev mode: skip HMAC but warn
+            if (this.isDevMode()) {
+                const runId = params.headers["x-marketplace-run-id"] || `dev-${randomUUID().slice(0, 8)}`;
+                const nonce = params.headers["x-marketplace-nonce"] || `dev-${randomUUID().slice(0, 8)}`;
+                return { runId, nonce, timestamp: Date.now(), authMode: "dev" };
+            }
+            throw new SecurityVerificationError("AUTH_MISSING_KEY", "HMAC signature provided but no secret key configured", 401);
+        }
+        const headers = params.headers;
+        const timestampHeader = headers["x-marketplace-timestamp"];
+        const nonceHeader = headers["x-marketplace-nonce"];
+        const runIdHeader = headers["x-marketplace-run-id"];
+        if (!timestampHeader || !nonceHeader || !runIdHeader) {
+            throw new SecurityVerificationError("AUTH_INVALID_SIGNATURE", "Missing required HMAC headers (timestamp, nonce, run-id)", 401);
         }
         const timestamp = Number.parseInt(timestampHeader, 10);
         if (Number.isNaN(timestamp)) {
             throw new SecurityVerificationError("AUTH_TIMESTAMP_OUT_OF_BOUNDS", "Malformed X-Marketplace-Timestamp header", 401);
         }
-        // 1. Timestamp Bounds: Reject if |CurrentTime - Timestamp| > 5 minutes
+        // 1. Timestamp bounds
         const now = Date.now();
         if (Math.abs(now - timestamp) > this.maxTimestampDriftMs) {
-            throw new SecurityVerificationError("AUTH_TIMESTAMP_OUT_OF_BOUNDS", `Timestamp out of allowable bounds (clock drift > ${this.maxTimestampDriftMs}ms)`, 401);
+            throw new SecurityVerificationError("AUTH_TIMESTAMP_OUT_OF_BOUNDS", `Timestamp drift exceeds ${this.maxTimestampDriftMs}ms`, 401);
         }
-        // 2. Nonce Uniqueness: Sliding cache
+        // 2. Nonce uniqueness
         if (this.seenNonces.has(nonceHeader)) {
-            throw new SecurityVerificationError("AUTH_REPLAY_DETECTED", "Duplicate nonce detected (replay attack guard)", 401);
+            throw new SecurityVerificationError("AUTH_REPLAY_DETECTED", "Duplicate nonce (replay guard)", 401);
         }
-        // 3. Run ID Idempotency: Duplicate active or completed run
+        // 3. Run ID idempotency
         if (this.activeRunIds.has(runIdHeader) || this.completedRunIds.has(runIdHeader)) {
-            throw new SecurityVerificationError("AUTH_REPLAY_DETECTED", `Run ID ${runIdHeader} is currently executing or has already been completed`, 401);
+            throw new SecurityVerificationError("AUTH_REPLAY_DETECTED", `Run ID ${runIdHeader} already active or completed`, 401);
         }
-        // 4. Verify HMAC signature
+        // 4. Verify signature
         const bodyHash = this.computeBodyHash(params.rawBody);
         const canonicalString = this.buildCanonicalString(params.method, params.path, timestampHeader, nonceHeader, runIdHeader, bodyHash);
         const expectedSignature = this.calculateSignature(canonicalString, this.secret);
@@ -93,13 +164,21 @@ export class SecurityManager {
         if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) {
             throw new SecurityVerificationError("AUTH_INVALID_SIGNATURE", "HMAC-SHA256 signature verification failed", 401);
         }
-        // Mark nonce as seen
+        // Mark nonce seen
         this.seenNonces.set(nonceHeader, now);
-        return {
-            runId: runIdHeader,
-            nonce: nonceHeader,
-            timestamp,
-        };
+        return { runId: runIdHeader, nonce: nonceHeader, timestamp, authMode: "hmac" };
+    }
+    // ── Public helpers ──
+    computeBodyHash(rawBody) {
+        return createHash("sha256").update(rawBody).digest("hex");
+    }
+    buildCanonicalString(method, path, timestamp, nonce, runId, bodyHash) {
+        const normalizedMethod = method.toUpperCase();
+        const normalizedPath = path.split("?")[0] || "/";
+        return `${normalizedMethod}\n${normalizedPath}\n${timestamp}\n${nonce}\n${runId}\n${bodyHash}`;
+    }
+    calculateSignature(canonicalString, secret) {
+        return createHmac("sha256", secret).update(canonicalString).digest("hex");
     }
     markRunStarted(runId) {
         this.activeRunIds.add(runId);
@@ -112,14 +191,12 @@ export class SecurityManager {
         const now = Date.now();
         const expiry = now - this.nonceTtlMs;
         for (const [nonce, time] of this.seenNonces.entries()) {
-            if (time < expiry) {
+            if (time < expiry)
                 this.seenNonces.delete(nonce);
-            }
         }
         for (const [runId, time] of this.completedRunIds.entries()) {
-            if (time < expiry) {
+            if (time < expiry)
                 this.completedRunIds.delete(runId);
-            }
         }
     }
 }

package/dist/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAStE,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEhC;IAEA;IAHlB,YACkB,IAAe,EAC/B,OAAe,EACC,aAAqB,GAAG;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAW;QAEf,eAAU,GAAV,UAAU,CAAc;QAGxC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,MAAM,OAAO,eAAe;IAClB,MAAM,CAAU;IAChB,mBAAmB,CAAS;IAC5B,UAAU,CAAS;IACnB,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,YAAY,UAA2B,EAAE;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,CAAC,YAAY;QAC/E,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,YAAY;IAC/D,CAAC;IAEM,SAAS,CAAC,MAAc;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED;;OAEG;IACI,eAAe,CAAC,OAAwB;QAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACI,oBAAoB,CACzB,MAAc,EACd,IAAY,EACZ,SAA0B,EAC1B,KAAa,EACb,KAAa,EACb,QAAgB;QAEhB,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QACjD,OAAO,GAAG,gBAAgB,KAAK,cAAc,KAAK,SAAS,KAAK,KAAK,KAAK,KAAK,KAAK,QAAQ,EAAE,CAAC;IACjG,CAAC;IAED;;OAEG;IACI,kBAAkB,CAAC,eAAuB,EAAE,MAAc;QAC/D,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,MAKpB;QACC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,mFAAmF;QACnF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,KAAK,GAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAY,IAAI,YAAY,CAAC;YACjF,MAAM,KAAK,GAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAY,IAAI,WAAW,CAAC;YAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAuB,CAAC;QACxF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAuB,CAAC;QAChF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAuB,CAAC;QACjF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAuB,CAAC;QAExF,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,EAAE,CAAC;YACzE,MAAM,IAAI,yBAAyB,CACjC,wBAAwB,EACxB,qDAAqD,EACrD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,yBAAyB,CACjC,8BAA8B,EAC9B,0CAA0C,EAC1C,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,uEAAuE;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzD,MAAM,IAAI,yBAAyB,CACjC,8BAA8B,EAC9B,oDAAoD,IAAI,CAAC,mBAAmB,KAAK,EACjF,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,EACtB,gDAAgD,EAChD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,2DAA2D;QAC3D,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,EACtB,UAAU,WAAW,uDAAuD,EAC5E,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAC/C,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,IAAI,EACX,eAAe,EACf,WAAW,EACX,WAAW,EACX,QAAQ,CACT,CAAC;QAEF,MAAM,iBAAiB,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAEpE,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,yBAAyB,CACjC,wBAAwB,EACxB,2CAA2C,EAC3C,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,qBAAqB;QACrB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAEtC,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,WAAW;YAClB,SAAS;SACV,CAAC;IACJ,CAAC;IAEM,cAAc,CAAC,KAAa;QACjC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEM,gBAAgB,CAAC,KAAa;QACnC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEO,iBAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAErC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACtD,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;gBAClB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3D,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;gBAClB,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA6BlF,oDAAoD;AACpD,UAAU;AACV,oDAAoD;AAEpD,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEhC;IAEA;IAHlB,YACkB,IAAe,EAC/B,OAAe,EACC,aAAqB,GAAG;QAExC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAW;QAEf,eAAU,GAAV,UAAU,CAAc;QAGxC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,oDAAoD;AACpD,mBAAmB;AACnB,oDAAoD;AAEpD,MAAM,OAAO,eAAe;IAClB,MAAM,CAAU;IAChB,SAAS,CAAU;IACnB,mBAAmB,CAAS;IAC5B,UAAU,CAAS;IACnB,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,YAAY,UAA2B,EAAE;QACvC,sDAAsD;QACtD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC/D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACrE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC,CAAC,YAAY;QAC/E,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC;IAClD,CAAC;IAEM,SAAS;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEM,YAAY;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEM,SAAS,CAAC,MAAc;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAEM,YAAY,CAAC,SAAiB;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAEM,SAAS;QACd,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAC/D,CAAC;IAED,gDAAgD;IAChD,iDAAiD;IACjD,gDAAgD;IAEhD;;;;;;;;OAQG;IACI,mBAAmB,CAAC,MAK1B;QACC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/B,oDAAoD;QACpD,MAAM,eAAe,GAAG,OAAO,CAAC,yBAAyB,CAAuB,CAAC;QACjF,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QAClD,CAAC;QAED,6CAA6C;QAC7C,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,eAAe,CAAC,CAAuB,CAAC;QAChG,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACrB,MAAM,KAAK,GAAI,OAAO,CAAC,sBAAsB,CAAY,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC/F,MAAM,KAAK,GAAI,OAAO,CAAC,qBAAqB,CAAY,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAE9F,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CACV,wEAAwE;oBACxE,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAClE,CAAC;QAED,mCAAmC;QACnC,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,EAClB,2FAA2F,EAC3F,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,kCAAkC;IAE1B,YAAY,CAClB,UAAkB,EAClB,OAAsD;QAEtD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAE3D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,EAClB,oBAAoB,EACpB,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChD,2BAA2B;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAEnD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;gBAClF,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,EAClB,oBAAoB,EACpB,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAI,OAAO,CAAC,sBAAsB,CAAY,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC/F,MAAM,KAAK,GAAI,OAAO,CAAC,qBAAqB,CAAY,IAAI,SAAS,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAChG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACrE,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAEnD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,EAClB,oBAAoB,EACpB,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAI,OAAO,CAAC,sBAAsB,CAAY,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC/F,MAAM,KAAK,GAAI,OAAO,CAAC,qBAAqB,CAAY,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACrE,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACrB,MAAM,KAAK,GAAI,OAAO,CAAC,sBAAsB,CAAY,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC/F,MAAM,KAAK,GAAI,OAAO,CAAC,qBAAqB,CAAY,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,EAClB,wCAAwC,EACxC,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,mDAAmD;IAE3C,UAAU,CAChB,MAKC,EACD,eAAuB;QAEvB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,+BAA+B;YAC/B,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAY,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACtG,MAAM,KAAK,GAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAY,IAAI,OAAO,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACrG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YAClE,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,kBAAkB,EAClB,sDAAsD,EACtD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,MAAM,eAAe,GAAG,OAAO,CAAC,yBAAyB,CAAuB,CAAC;QACjF,MAAM,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAuB,CAAC;QACzE,MAAM,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAuB,CAAC;QAE1E,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,IAAI,yBAAyB,CACjC,wBAAwB,EACxB,0DAA0D,EAC1D,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,yBAAyB,CACjC,8BAA8B,EAC9B,0CAA0C,EAC1C,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzD,MAAM,IAAI,yBAAyB,CACjC,8BAA8B,EAC9B,2BAA2B,IAAI,CAAC,mBAAmB,IAAI,EACvD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,EACtB,gCAAgC,EAChC,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,yBAAyB,CACjC,sBAAsB,EACtB,UAAU,WAAW,8BAA8B,EACnD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,sBAAsB;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAC/C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAChF,CAAC;QACF,MAAM,iBAAiB,GAAG,IAAI,CAAC,kBAAkB,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAEpE,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,yBAAyB,CACjC,wBAAwB,EACxB,2CAA2C,EAC3C,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAEtC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACjF,CAAC;IAED,uBAAuB;IAEhB,eAAe,CAAC,OAAwB;QAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAEM,oBAAoB,CACzB,MAAc,EAAE,IAAY,EAAE,SAA0B,EACxD,KAAa,EAAE,KAAa,EAAE,QAAgB;QAE9C,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QACjD,OAAO,GAAG,gBAAgB,KAAK,cAAc,KAAK,SAAS,KAAK,KAAK,KAAK,KAAK,KAAK,QAAQ,EAAE,CAAC;IACjG,CAAC;IAEM,kBAAkB,CAAC,eAAuB,EAAE,MAAc;QAC/D,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAEM,cAAc,CAAC,KAAa;QACjC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEM,gBAAgB,CAAC,KAAa;QACnC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IAEO,iBAAiB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QACrC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YACtD,IAAI,IAAI,GAAG,MAAM;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3D,IAAI,IAAI,GAAG,MAAM;gBAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;CACF"}

package/dist/server.d.ts

@@ -1,10 +1,10 @@
 import { type Server } from "node:http";
-import type { MarketplaceAgent } from "./agent.js";
+import type { CatelogAgent } from "./agent.js";
 export interface ServerOptions {
     port?: number;
     host?: string;
     silent?: boolean;
     onListening?: (url: string) => void;
 }
-export declare function startAgentServer(agent: MarketplaceAgent<any, any>, options?: ServerOptions): Server;
+export declare function startAgentServer(agent: CatelogAgent<any, any>, options?: ServerOptions): Server;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AACjG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAGnD,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,GAAE,aAAkB,GAAG,MAAM,CAwBvG"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AACjG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,GAAE,aAAkB,GAAG,MAAM,CA6BnG"}

package/dist/server.js

@@ -5,10 +5,10 @@ export function startAgentServer(agent, options = {}) {
     const host = options.host ?? "0.0.0.0";
     const server = createServer((req, res) => {
         agent.handleRequest(req, res).catch((err) => {
-            console.error("[catelog-sdk] Unhandled error during request handling:", err);
+            console.error("[catelog] Unhandled error:", err);
             if (!res.writableEnded) {
                 res.writeHead(500, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ error: { code: "INTERNAL_CRASH", message: "Server encountered an unhandled error" } }));
+                res.end(JSON.stringify({ error: { code: "INTERNAL_CRASH", message: "Unhandled server error" } }));
             }
         });
     });
@@ -18,7 +18,12 @@ export function startAgentServer(agent, options = {}) {
             options.onListening(url);
         }
         else if (!options.silent) {
-            renderBanner("startup", { name: agent.name, url });
+            renderBanner("startup", {
+                name: agent.name,
+                url,
+                mode: agent.mode,
+                authConfigured: !!agent.security.getSecret(),
+            });
         }
     });
     return server;

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAEjG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,MAAM,UAAU,gBAAgB,CAAC,KAAiC,EAAE,UAAyB,EAAE;IAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IAEvC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACxE,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1C,OAAO,CAAC,KAAK,CAAC,wDAAwD,EAAE,GAAG,CAAC,CAAC;YAC7E,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,uCAAuC,EAAE,EAAE,CAAC,CAAC,CAAC;YACnH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG,UAAU,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACxE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC3B,YAAY,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAEjG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,MAAM,UAAU,gBAAgB,CAAC,KAA6B,EAAE,UAAyB,EAAE;IACzF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IAEvC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACxE,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1C,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;gBACvB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC,CAAC;YACpG,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG,UAAU,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;QACxE,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YAC3B,YAAY,CAAC,SAAS,EAAE;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG;gBACH,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE;aAC7C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/sse.d.ts

@@ -1,7 +1,9 @@
 import type { ServerResponse } from "node:http";
-import type { AgentStream, StructuredError, TelemetryData } from "./types.js";
+import type { AgentStream, StructuredError, TelemetryData, TaskState } from "./types.js";
 export interface SSEWriterOptions {
+    /** Heartbeat interval in ms (default: 15s) */
     heartbeatIntervalMs?: number;
+    /** Callback on client disconnect */
     onClientDisconnect?: () => void;
 }
 export declare class SSEWriter implements AgentStream {
@@ -12,21 +14,43 @@ export declare class SSEWriter implements AgentStream {
     private deltaIndex;
     private closed;
     private abortController;
+    chunksStreamed: number;
     constructor(runId: string, res: ServerResponse, options?: SSEWriterOptions);
     get signal(): AbortSignal;
     isClosed(): boolean;
-    /**
-     * Generic raw event sender adhering to SSE framing:
-     * event: <EVENT_TYPE>\ndata: <JSON_STRING>\n\n
-     */
     sendEvent(eventType: string, data: unknown): void;
-    sendRunStarted(): void;
-    step(label: string): void;
+    /** Emit task.status = "working" on execution start */
+    sendTaskStatus(status: TaskState): void;
+    /** Progress tick (0-100). Does NOT complete the task. */
+    progress(percent: number, message?: string): void;
+    /** Stream a text/token delta. Does NOT complete the task. */
     delta(content: string, delta_type?: "text" | "json_patch"): void;
+    /** Named activity event (tool_call, search, etc.) */
+    activity(type: string, data?: Record<string, unknown>): void;
+    /** Legacy step (maps to progress internally) */
+    step(label: string): void;
+    /** Convenience alias for delta */
+    write(text: string): void;
+    /** Raw event emitter */
     emit(event: string, data: unknown): void;
+    sendTaskCompleted<TOutput>(output: TOutput, durationMs: number, telemetry?: TelemetryData): void;
+    sendTaskFailed(error: StructuredError, durationMs: number): void;
+    sendTaskInputRequired(prompt: string, resumeToken: string, inputSchema?: Record<string, unknown>): void;
+    sendTaskCanceled(durationMs: number): void;
+    sendRunStarted(): void;
     sendRunSucceeded<TOutput>(output: TOutput, durationMs: number, telemetry?: TelemetryData): void;
     sendRunFailed(error: StructuredError, durationMs: number): void;
     close(): void;
     private clearHeartbeat;
 }
+export declare class NoopStream implements AgentStream {
+    chunksStreamed: number;
+    progress(_percent: number, _message?: string): void;
+    delta(_content: string, _type?: "text" | "json_patch"): void;
+    activity(_type: string, _data?: Record<string, unknown>): void;
+    step(_label: string): void;
+    emit(_event: string, _data: unknown): void;
+    write(text: string): void;
+    isClosed(): boolean;
+}
 //# sourceMappingURL=sse.d.ts.map

package/dist/sse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EACV,WAAW,EAOX,eAAe,EACf,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAED,qBAAa,SAAU,YAAW,WAAW;IAC3C,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,eAAe,CAAkB;gBAE7B,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,GAAE,gBAAqB;IAwC9E,IAAW,MAAM,IAAI,WAAW,CAE/B;IAEM,QAAQ,IAAI,OAAO;IAI1B;;;OAGG;IACI,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI;IAUjD,cAAc,IAAI,IAAI;IAStB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAYzB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,GAAG,YAAqB,GAAG,IAAI;IAWxE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI;IAIxC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,aAAa,GAAG,IAAI;IAa/F,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAY/D,KAAK,IAAI,IAAI;IAWpB,OAAO,CAAC,cAAc;CAMvB"}
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EACV,WAAW,EAQX,eAAe,EACf,aAAa,EACb,SAAS,EACV,MAAM,YAAY,CAAC;AAMpB,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oCAAoC;IACpC,kBAAkB,CAAC,EAAE,MAAM,IAAI,CAAC;CACjC;AAMD,qBAAa,SAAU,YAAW,WAAW;IAC3C,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,GAAG,CAAiB;IAC5B,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,eAAe,CAAkB;IAClC,cAAc,SAAK;gBAEd,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,OAAO,GAAE,gBAAqB;IAoC9E,IAAW,MAAM,IAAI,WAAW,CAE/B;IAEM,QAAQ,IAAI,OAAO;IAMnB,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI;IAYxD,sDAAsD;IAC/C,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI;IAU9C,yDAAyD;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI;IAaxD,6DAA6D;IACtD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,GAAG,YAAqB,GAAG,IAAI;IAY/E,qDAAqD;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAWnE,gDAAgD;IACzC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIhC,kCAAkC;IAC3B,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIhC,wBAAwB;IACjB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI;IAMxC,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,aAAa,GAAG,IAAI;IAahG,cAAc,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAYhE,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAcvG,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAS1C,cAAc,IAAI,IAAI;IAItB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,aAAa,GAAG,IAAI;IAI/F,aAAa,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IAM/D,KAAK,IAAI,IAAI;IAWpB,OAAO,CAAC,cAAc;CAMvB;AAMD,qBAAa,UAAW,YAAW,WAAW;IACrC,cAAc,SAAK;IAE1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IACnD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAG5D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAC9D,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAC1B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAC1C,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IACzB,QAAQ,IAAI,OAAO;CACpB"}

package/dist/sse.js

@@ -1,3 +1,6 @@
+// ─────────────────────────────────────────────────
+//  SSEWriter — streams canonical task lifecycle events
+// ─────────────────────────────────────────────────
 export class SSEWriter {
     runId;
     res;
@@ -6,6 +9,7 @@ export class SSEWriter {
     deltaIndex = 0;
     closed = false;
     abortController;
+    chunksStreamed = 0;
     constructor(runId, res, options = {}) {
         this.runId = runId;
         this.res = res;
@@ -17,7 +21,6 @@ export class SSEWriter {
             Connection: "keep-alive",
             "X-Accel-Buffering": "no",
         });
-        // Flush headers if supported
         if (typeof this.res.flushHeaders === "function") {
             this.res.flushHeaders();
         }
@@ -30,14 +33,11 @@ export class SSEWriter {
                 options.onClientDisconnect?.();
             }
         });
-        // Start 15-second heartbeat
+        // 15-second heartbeat
         const interval = options.heartbeatIntervalMs ?? 15_000;
         this.heartbeatTimer = setInterval(() => {
             if (!this.closed) {
-                this.sendEvent("heartbeat", {
-                    event: "heartbeat",
-                    timestamp: Date.now(),
-                });
+                this.sendEvent("heartbeat", { event: "heartbeat", timestamp: Date.now() });
             }
         }, interval);
     }
@@ -47,10 +47,7 @@ export class SSEWriter {
     isClosed() {
         return this.closed;
     }
-    /**
-     * Generic raw event sender adhering to SSE framing:
-     * event: <EVENT_TYPE>\ndata: <JSON_STRING>\n\n
-     */
+    // ── Raw SSE sender ──
     sendEvent(eventType, data) {
         if (this.closed)
             return;
@@ -62,63 +59,119 @@ export class SSEWriter {
             this.clearHeartbeat();
         }
     }
-    sendRunStarted() {
+    // ── Task Lifecycle Events ──
+    /** Emit task.status = "working" on execution start */
+    sendTaskStatus(status) {
         const payload = {
-            event: "run.started",
+            event: "task.status",
             run_id: this.runId,
+            status,
             timestamp: Date.now(),
         };
-        this.sendEvent("run.started", payload);
+        this.sendEvent("task.status", payload);
     }
-    step(label) {
+    /** Progress tick (0-100). Does NOT complete the task. */
+    progress(percent, message) {
         this.stepIndex += 1;
         const payload = {
-            event: "step.started",
+            event: "task.progress",
             run_id: this.runId,
-            step_index: this.stepIndex,
-            label,
+            percent: Math.min(100, Math.max(0, percent)),
+            message,
+            step: this.stepIndex,
             timestamp: Date.now(),
         };
-        this.sendEvent("step.started", payload);
+        this.sendEvent("task.progress", payload);
     }
+    /** Stream a text/token delta. Does NOT complete the task. */
     delta(content, delta_type = "text") {
+        this.chunksStreamed++;
         const payload = {
-            event: "output.delta",
+            event: "task.delta",
             run_id: this.runId,
             index: this.deltaIndex++,
             delta_type,
             content,
         };
-        this.sendEvent("output.delta", payload);
+        this.sendEvent("task.delta", payload);
+    }
+    /** Named activity event (tool_call, search, etc.) */
+    activity(type, data) {
+        const payload = {
+            event: "task.activity",
+            run_id: this.runId,
+            activity_type: type,
+            data,
+            timestamp: Date.now(),
+        };
+        this.sendEvent("task.activity", payload);
     }
+    /** Legacy step (maps to progress internally) */
+    step(label) {
+        this.progress(0, label);
+    }
+    /** Convenience alias for delta */
+    write(text) {
+        this.delta(text, "text");
+    }
+    /** Raw event emitter */
     emit(event, data) {
         this.sendEvent(event, data);
     }
-    sendRunSucceeded(output, durationMs, telemetry) {
+    // ── Terminal Events ──
+    sendTaskCompleted(output, durationMs, telemetry) {
         if (this.closed)
             return;
         const payload = {
-            event: "run.succeeded",
+            event: "task.completed",
             run_id: this.runId,
             duration_ms: durationMs,
             output,
             telemetry,
         };
-        this.sendEvent("run.succeeded", payload);
+        this.sendEvent("task.completed", payload);
         this.close();
     }
-    sendRunFailed(error, durationMs) {
+    sendTaskFailed(error, durationMs) {
         if (this.closed)
             return;
         const payload = {
-            event: "run.failed",
+            event: "task.failed",
             run_id: this.runId,
             duration_ms: durationMs,
             error,
         };
-        this.sendEvent("run.failed", payload);
+        this.sendEvent("task.failed", payload);
         this.close();
     }
+    sendTaskInputRequired(prompt, resumeToken, inputSchema) {
+        if (this.closed)
+            return;
+        const payload = {
+            event: "task.input_required",
+            run_id: this.runId,
+            prompt,
+            input_schema: inputSchema,
+            resume_token: resumeToken,
+            timestamp: Date.now(),
+        };
+        this.sendEvent("task.input_required", payload);
+        this.close();
+    }
+    sendTaskCanceled(durationMs) {
+        this.sendTaskFailed({ code: "TASK_CANCELED", message: "Execution was canceled", retryable: false }, durationMs);
+    }
+    // ── Backward compat wrappers ──
+    sendRunStarted() {
+        this.sendTaskStatus("working");
+    }
+    sendRunSucceeded(output, durationMs, telemetry) {
+        this.sendTaskCompleted(output, durationMs, telemetry);
+    }
+    sendRunFailed(error, durationMs) {
+        this.sendTaskFailed(error, durationMs);
+    }
+    // ── Lifecycle ──
     close() {
         if (this.closed)
             return;
@@ -138,4 +191,19 @@ export class SSEWriter {
         }
     }
 }
+// ─────────────────────────────────────────────────
+//  NoopStream — for batch JSON (non-SSE) mode
+// ─────────────────────────────────────────────────
+export class NoopStream {
+    chunksStreamed = 0;
+    progress(_percent, _message) { }
+    delta(_content, _type) {
+        this.chunksStreamed++;
+    }
+    activity(_type, _data) { }
+    step(_label) { }
+    emit(_event, _data) { }
+    write(text) { this.delta(text); }
+    isClosed() { return false; }
+}
 //# sourceMappingURL=sse.js.map