eve 0.37.0 → 0.37.1

package/dist/src/public/channels/auth.js

@@ -1 +1 @@
-import{createLogger}from"#internal/logging.js";import{isEveDevEnvironment}from"#internal/application/dev-environment.js";import{resolveVercelOidcCurrentProject}from"#runtime/governance/auth/vercel-oidc-project.js";import{decodeJwt}from"#compiled/jose/index.js";import{authenticateHttpBasicStrategy}from"#runtime/governance/auth/http-basic.js";import{authenticateJwtEcdsaStrategy}from"#runtime/governance/auth/jwt-ecdsa.js";import{authenticateJwtHmacStrategy}from"#runtime/governance/auth/jwt-hmac.js";import{authenticateOidcStrategy}from"#runtime/governance/auth/oidc.js";import{createRuntimeSessionAuthContext}from"#runtime/governance/auth/types.js";import{createRuntimeIpAllowList,isRuntimeIpAllowed}from"#runtime/governance/network/ip-allow-list.js";const vercelOidcLog=createLogger(`auth.vercel-oidc`);function verifyHttpBasic(e,t){if(e===null)return{ok:!1};let n=authenticateHttpBasicStrategy({authorization:e,strategy:{kind:`http-basic`,password:t.password,username:t.username}});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function verifyJwtHmac(e,t){if(e===null||e.length===0)return{ok:!1};let n=await authenticateJwtHmacStrategy({strategy:{algorithm:t.algorithm,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,issuer:t.issuer,kind:`jwt-hmac`,secret:t.secret,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}},token:e});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function verifyJwtEcdsa(e,t){if(e===null||e.length===0)return{ok:!1};let n=await authenticateJwtEcdsaStrategy({strategy:{algorithm:t.algorithm,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,issuer:t.issuer,kind:`jwt-ecdsa`,publicKey:t.publicKey,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}},token:e});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function verifyOidc(e,t){let n=await runOidcVerification(e,{...t,acceptCurrentVercelProject:!1,currentVercelProject:void 0});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function runOidcVerification(e,t){if(e===null||e.length===0)return{kind:`not-authenticated`};let n={acceptCurrentVercelProject:t.acceptCurrentVercelProject,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,discoveryUrl:t.discoveryUrl??`${t.issuer.replace(/\/$/,``)}/.well-known/openid-configuration`,issuer:t.issuer,kind:`oidc`,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}};return await authenticateOidcStrategy({strategy:t.currentVercelProject===void 0?n:{...n,currentVercelProject:t.currentVercelProject},token:e})}function extractBearerToken(e){if(e===null)return null;let t=/^Bearer\s+(.+)$/i.exec(e)?.[1]?.trim();return t===void 0||t.length===0?null:t}function createIpAllowList(e){return createRuntimeIpAllowList(e)}function isIpAllowed(e,t){return e!==null&&isRuntimeIpAllowed(e,t)}function createUnauthorizedResponse(e={}){let t=e.status??401,n=e.code??(t===403?`forbidden`:`unauthorized`),r=e.message??(t===403?`Forbidden.`:`Authorization is required for this route.`),i=e.challenges??[],a=new Headers({"cache-control":`no-store`});for(let e of i)a.append(`www-authenticate`,formatChallenge(e));return Response.json({code:n,error:r,ok:!1},{headers:a,status:t})}function formatChallenge(e){if(e.parameters===void 0||Object.keys(e.parameters).length===0)return e.scheme;let t=Object.entries(e.parameters).map(([e,t])=>`${e}="${escapeChallengeValue(t)}"`).join(`, `);return`${e.scheme} ${t}`}function escapeChallengeValue(e){return e.replaceAll(`\\`,`\\\\`).replaceAll(`"`,`\\"`)}var UnauthenticatedError=class extends Error{response;constructor(e={}){super(e.message??`Authorization is required for this route.`),this.name=`UnauthenticatedError`,this.response=createUnauthorizedResponse({...e,status:401})}},ForbiddenError=class extends Error{response;constructor(e={}){super(e.message??`Forbidden.`),this.name=`ForbiddenError`,this.response=createUnauthorizedResponse({...e,status:403})}};const AUTH_CHALLENGES_SYMBOL=Symbol.for(`eve.channels.auth.challenges`);function withAuthChallenges(e,t){let wrapped=t=>e(t);return Object.defineProperty(wrapped,AUTH_CHALLENGES_SYMBOL,{value:t}),wrapped}function getDeclaredChallenges(e){return e[AUTH_CHALLENGES_SYMBOL]}function collectDeclaredChallenges(e){let t=new Set,n=[];for(let r of e)for(let e of getDeclaredChallenges(r)??[]){let r=formatChallenge(e);t.has(r)||(t.add(r),n.push(e))}return n}async function routeAuth(e,t){let n=Array.isArray(t)?t:[t];try{for(let t of n){let n=await t(e);if(n)return n}}catch(e){if(typeof e==`object`&&e&&`response`in e&&e.response instanceof Response)return e.response;throw e}let r=collectDeclaredChallenges(n);return createUnauthorizedResponse({challenges:r.length>0?r:[{scheme:`Bearer`}]})}function placeholderAuth(){return()=>{if(process.env.VERCEL_ENV!==`production`)return null;throw new UnauthenticatedError({code:`eve_production_auth_not_configured`,message:`Production auth is not configured. Replace placeholderAuth() in agent/channels/eve.ts with your app's auth provider.`})}}function none(){return()=>ANONYMOUS_SESSION_AUTH_CONTEXT}function localDev(){return()=>isLocalDevelopmentServer()?LOCAL_DEV_SESSION_AUTH_CONTEXT:null}function isLocalDevelopmentServer(){return process.env.VERCEL&&process.env.VERCEL_ENV===`development`?!0:isEveDevEnvironment()}const ANONYMOUS_SESSION_AUTH_CONTEXT={attributes:{},authenticator:`none`,principalId:`anonymous`,principalType:`anonymous`},LOCAL_DEV_SESSION_AUTH_CONTEXT={attributes:{},authenticator:`local-dev`,principalId:`local-dev`,principalType:`local-dev`};async function verifyVercelOidc(e,t={}){if(e===null||e.length===0)return{ok:!1};let n=decodeUnverifiedJwtClaims(e);if(n===null)return vercelOidcLog.debug(`Rejected token that failed to decode as a JWT.`),{ok:!1};if(!n.issuer.startsWith(`https://oidc.vercel.com/`))return vercelOidcLog.debug(`Rejected token whose issuer is not a Vercel OIDC issuer.`,{issuer:n.issuer}),{ok:!1};if(n.audiences.length===0)return vercelOidcLog.debug(`Rejected token with no audience claim.`,{issuer:n.issuer}),{ok:!1};if(!n.audiences.some(e=>e.startsWith(`https://vercel.com/`)))return vercelOidcLog.debug(`Rejected token whose audience is not a Vercel audience.`,{audiences:n.audiences,issuer:n.issuer}),{ok:!1};let r=resolveCurrentVercelProject(t),i=await runOidcVerification(e,{acceptCurrentVercelProject:!0,audiences:n.audiences,currentVercelProject:r,issuer:n.issuer,subjects:t.subjects??[]});return i.kind===`authenticated`?(vercelOidcLog.debug(`Accepted Vercel OIDC token.`,{issuer:n.issuer,principalType:i.principal.principalType,subject:i.principal.subject}),{ok:!0,sessionAuth:createRuntimeSessionAuthContext(i.principal)}):(vercelOidcLog.debug(`Rejected Vercel OIDC token after verification.`,{audiences:n.audiences,issuer:n.issuer,reason:i.kind,subjectsConfigured:(t.subjects??[]).length>0,...i.kind===`misconfigured`?{detail:i.message}:{}}),{ok:!1})}function resolveCurrentVercelProject(e){if(e.currentVercelProject!==void 0)return e.currentVercelProject;let t=process.env.VERCEL_PROJECT_ID?.trim();if(t===void 0||t.length===0)return;let n=process.env.VERCEL_TARGET_ENV?.trim()||process.env.VERCEL_ENV?.trim();return n===void 0||n.length===0?{projectId:t}:{environment:n,projectId:t}}function vercelSubject(e){assertVercelSubjectSegment(`teamSlug`,e.teamSlug),assertVercelSubjectSegment(`projectName`,e.projectName);let t=e.environment??`production`;if(t!==`production`&&t!==`preview`&&t!==`development`&&t!==`*`)throw Error(`vercelSubject: invalid environment ${JSON.stringify(t)}; expected "production", "preview", "development", or "*".`);return`owner:${e.teamSlug}:project:${e.projectName}:environment:${t}`}function assertVercelSubjectSegment(e,t){if(t.length===0)throw Error(`vercelSubject: ${e} must be a non-empty string.`);if(t.includes(`*`)||t.includes(`:`))throw Error(`vercelSubject: ${e} ${JSON.stringify(t)} may not contain ${t.includes(`:`)?`':'`:`'*'`}. Hand-write the subject string when wildcards are intentional.`)}function vercelOidc(e={}){return withAuthChallenges(async t=>{let r=extractBearerToken(t.headers.get(`authorization`)),i=e.currentVercelProject??(r!==null&&isLocalDevelopmentVercelOidc()?await resolveVercelOidcCurrentProject(t):void 0),a=await verifyVercelOidc(r,i===void 0?e:{...e,currentVercelProject:i});return a.ok?a.sessionAuth:null},[{scheme:`Bearer`}])}function isLocalDevelopmentVercelOidc(){return process.env.VERCEL_ENV===`development`?!0:process.env.VERCEL_ENV===`preview`||process.env.VERCEL_ENV===`production`?!1:isEveDevEnvironment()}function httpBasic(e,t){return withAuthChallenges(t=>{let n=verifyHttpBasic(t.headers.get(`authorization`),e);return n.ok?n.sessionAuth:null},[{parameters:{realm:t?.realm??`eve`,charset:`UTF-8`},scheme:`Basic`}])}function jwtHmac(e){return withAuthChallenges(async t=>{let n=await verifyJwtHmac(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null},[{scheme:`Bearer`}])}function jwtEcdsa(e){return withAuthChallenges(async t=>{let n=await verifyJwtEcdsa(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null},[{scheme:`Bearer`}])}function oidc(e){return withAuthChallenges(async t=>{let n=await verifyOidc(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null},[{scheme:`Bearer`}])}function decodeUnverifiedJwtClaims(e){let t;try{t=decodeJwt(e)}catch{return null}return typeof t.iss!=`string`||t.iss.length===0?null:{audiences:typeof t.aud==`string`?[t.aud]:Array.isArray(t.aud)?t.aud.filter(e=>typeof e==`string`):[],issuer:t.iss}}export{ForbiddenError,UnauthenticatedError,createIpAllowList,createUnauthorizedResponse,extractBearerToken,httpBasic,isIpAllowed,jwtEcdsa,jwtHmac,localDev,none,oidc,placeholderAuth,routeAuth,vercelOidc,vercelSubject,verifyHttpBasic,verifyJwtEcdsa,verifyJwtHmac,verifyOidc,verifyVercelOidc,withAuthChallenges};
+import{createLogger}from"#internal/logging.js";import{isLoopbackHostname}from"#shared/network-address.js";import{isEveDevEnvironment}from"#internal/application/dev-environment.js";import{resolveVercelOidcCurrentProject}from"#runtime/governance/auth/vercel-oidc-project.js";import{decodeJwt}from"#compiled/jose/index.js";import{authenticateHttpBasicStrategy}from"#runtime/governance/auth/http-basic.js";import{authenticateJwtEcdsaStrategy}from"#runtime/governance/auth/jwt-ecdsa.js";import{authenticateJwtHmacStrategy}from"#runtime/governance/auth/jwt-hmac.js";import{authenticateOidcStrategy}from"#runtime/governance/auth/oidc.js";import{createRuntimeSessionAuthContext}from"#runtime/governance/auth/types.js";import{createRuntimeIpAllowList,isRuntimeIpAllowed}from"#runtime/governance/network/ip-allow-list.js";const vercelOidcLog=createLogger(`auth.vercel-oidc`);function verifyHttpBasic(e,t){if(e===null)return{ok:!1};let n=authenticateHttpBasicStrategy({authorization:e,strategy:{kind:`http-basic`,password:t.password,username:t.username}});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function verifyJwtHmac(e,t){if(e===null||e.length===0)return{ok:!1};let n=await authenticateJwtHmacStrategy({strategy:{algorithm:t.algorithm,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,issuer:t.issuer,kind:`jwt-hmac`,secret:t.secret,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}},token:e});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function verifyJwtEcdsa(e,t){if(e===null||e.length===0)return{ok:!1};let n=await authenticateJwtEcdsaStrategy({strategy:{algorithm:t.algorithm,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,issuer:t.issuer,kind:`jwt-ecdsa`,publicKey:t.publicKey,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}},token:e});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function verifyOidc(e,t){let n=await runOidcVerification(e,{...t,acceptCurrentVercelProject:!1,currentVercelProject:void 0});return n.kind===`authenticated`?{ok:!0,sessionAuth:createRuntimeSessionAuthContext(n.principal)}:{ok:!1}}async function runOidcVerification(e,t){if(e===null||e.length===0)return{kind:`not-authenticated`};let n={acceptCurrentVercelProject:t.acceptCurrentVercelProject,audiences:[...t.audiences],clockSkewSeconds:t.clockSkewSeconds??30,discoveryUrl:t.discoveryUrl??`${t.issuer.replace(/\/$/,``)}/.well-known/openid-configuration`,issuer:t.issuer,kind:`oidc`,...t.claims===void 0?{}:{claims:t.claims},...t.subjects===void 0?{}:{subjects:t.subjects}};return await authenticateOidcStrategy({strategy:t.currentVercelProject===void 0?n:{...n,currentVercelProject:t.currentVercelProject},token:e})}function extractBearerToken(e){if(e===null)return null;let t=/^Bearer\s+(.+)$/i.exec(e)?.[1]?.trim();return t===void 0||t.length===0?null:t}function createIpAllowList(e){return createRuntimeIpAllowList(e)}function isIpAllowed(e,t){return e!==null&&isRuntimeIpAllowed(e,t)}function createUnauthorizedResponse(e={}){let t=e.status??401,n=e.code??(t===403?`forbidden`:`unauthorized`),r=e.message??(t===403?`Forbidden.`:`Authorization is required for this route.`),i=e.challenges??[],a=new Headers({"cache-control":`no-store`});for(let e of i)a.append(`www-authenticate`,formatChallenge(e));return Response.json({code:n,error:r,ok:!1},{headers:a,status:t})}function formatChallenge(e){if(e.parameters===void 0||Object.keys(e.parameters).length===0)return e.scheme;let t=Object.entries(e.parameters).map(([e,t])=>`${e}="${escapeAuthChallengeParameter(t)}"`).join(`, `);return`${e.scheme} ${t}`}function escapeAuthChallengeParameter(e){return e.replaceAll(`\\`,`\\\\`).replaceAll(`"`,`\\"`)}function isValidOAuthIdentifierUrl(e){try{let n=new URL(e);return(n.protocol===`https:`||n.protocol===`http:`&&isLoopbackHostname(n.hostname))&&n.username.length===0&&n.password.length===0&&n.search.length===0&&n.hash.length===0}catch{return!1}}function isValidMetadataPath(e){if(!e.startsWith(`/`)||e.startsWith(`//`))return!1;let t=new URL(e,`https://eve.invalid`);return t.origin===`https://eve.invalid`&&t.search.length===0&&t.hash.length===0}var UnauthenticatedError=class extends Error{response;constructor(e={}){super(e.message??`Authorization is required for this route.`),this.name=`UnauthenticatedError`,this.response=createUnauthorizedResponse({...e,status:401})}},ForbiddenError=class extends Error{response;constructor(e={}){super(e.message??`Forbidden.`),this.name=`ForbiddenError`,this.response=createUnauthorizedResponse({...e,status:403})}};const OAUTH_RESOURCE_SYMBOL=Symbol.for(`eve.channels.auth.oauthResource`);function oauthResource(e,t){let n=t.issuer===void 0?t.authorizationServers:[t.issuer];if(n.length===0||n.some(e=>!isValidOAuthIdentifierUrl(e)))throw Error(`oauthResource requires at least one HTTPS authorization server URL (HTTP is allowed only on loopback).`);if(t.resource!==void 0&&!isValidOAuthIdentifierUrl(t.resource))throw Error(`oauthResource resource must be an HTTPS URL without credentials, query, or fragment (HTTP is allowed only on loopback).`);if(t.metadataPath!==void 0&&!isValidMetadataPath(t.metadataPath))throw Error(`oauthResource metadataPath must be an absolute path without a host, query, or fragment.`);let r=Array.isArray(e)?e:[e],composed=async e=>{for(let t of r){let n=await t(e);if(n)return n}return null},i=collectDeclaredChallenges(r),a=withAuthChallenges(composed,i.length>0?i:[{scheme:`Bearer`}]);return Object.defineProperty(a,OAUTH_RESOURCE_SYMBOL,{enumerable:!1,value:t}),a}function readOAuthResourceOptions(e){if(!Array.isArray(e))return e[OAUTH_RESOURCE_SYMBOL]}const AUTH_CHALLENGES_SYMBOL=Symbol.for(`eve.channels.auth.challenges`);function withAuthChallenges(e,t){let wrapped=t=>e(t);return Object.defineProperty(wrapped,AUTH_CHALLENGES_SYMBOL,{value:t}),wrapped}function getDeclaredChallenges(e){return e[AUTH_CHALLENGES_SYMBOL]}function collectDeclaredChallenges(e){let t=new Set,n=[];for(let r of e)for(let e of getDeclaredChallenges(r)??[]){let r=formatChallenge(e);t.has(r)||(t.add(r),n.push(e))}return n}async function routeAuth(e,t){let n=Array.isArray(t)?t:[t];try{for(let t of n){let n=await t(e);if(n)return n}}catch(e){if(typeof e==`object`&&e&&`response`in e&&e.response instanceof Response)return e.response;throw e}let r=collectDeclaredChallenges(n);return createUnauthorizedResponse({challenges:r.length>0?addInvalidBearerTokenError(e,r):[{scheme:`Bearer`}]})}function addInvalidBearerTokenError(e,t){let n=e.headers.get(`authorization`);return n===null||!/^Bearer(?:\s|$)/i.test(n.trim())||!t.some(e=>e.scheme===`Bearer`)?t:t.map(e=>e.scheme!==`Bearer`||e.parameters?.error!==void 0?e:{...e,parameters:{...e.parameters,error:`invalid_token`}})}function placeholderAuth(){return()=>{if(process.env.VERCEL_ENV!==`production`)return null;throw new UnauthenticatedError({code:`eve_production_auth_not_configured`,message:`Production auth is not configured. Replace placeholderAuth() in agent/channels/eve.ts with your app's auth provider.`})}}function none(){return()=>ANONYMOUS_SESSION_AUTH_CONTEXT}function localDev(){return()=>isLocalDevelopmentServer()?LOCAL_DEV_SESSION_AUTH_CONTEXT:null}function isLocalDevelopmentServer(){return process.env.VERCEL&&process.env.VERCEL_ENV===`development`?!0:isEveDevEnvironment()}const ANONYMOUS_SESSION_AUTH_CONTEXT={attributes:{},authenticator:`none`,principalId:`anonymous`,principalType:`anonymous`},LOCAL_DEV_SESSION_AUTH_CONTEXT={attributes:{},authenticator:`local-dev`,principalId:`local-dev`,principalType:`local-dev`};async function verifyVercelOidc(e,t={}){if(e===null||e.length===0)return{ok:!1};let n=decodeUnverifiedJwtClaims(e);if(n===null)return vercelOidcLog.debug(`Rejected token that failed to decode as a JWT.`),{ok:!1};if(!n.issuer.startsWith(`https://oidc.vercel.com/`))return vercelOidcLog.debug(`Rejected token whose issuer is not a Vercel OIDC issuer.`,{issuer:n.issuer}),{ok:!1};if(n.audiences.length===0)return vercelOidcLog.debug(`Rejected token with no audience claim.`,{issuer:n.issuer}),{ok:!1};if(!n.audiences.some(e=>e.startsWith(`https://vercel.com/`)))return vercelOidcLog.debug(`Rejected token whose audience is not a Vercel audience.`,{audiences:n.audiences,issuer:n.issuer}),{ok:!1};let r=resolveCurrentVercelProject(t),i=await runOidcVerification(e,{acceptCurrentVercelProject:!0,audiences:n.audiences,currentVercelProject:r,issuer:n.issuer,subjects:t.subjects??[]});return i.kind===`authenticated`?(vercelOidcLog.debug(`Accepted Vercel OIDC token.`,{issuer:n.issuer,principalType:i.principal.principalType,subject:i.principal.subject}),{ok:!0,sessionAuth:createRuntimeSessionAuthContext(i.principal)}):(vercelOidcLog.debug(`Rejected Vercel OIDC token after verification.`,{audiences:n.audiences,issuer:n.issuer,reason:i.kind,subjectsConfigured:(t.subjects??[]).length>0,...i.kind===`misconfigured`?{detail:i.message}:{}}),{ok:!1})}function resolveCurrentVercelProject(e){if(e.currentVercelProject!==void 0)return e.currentVercelProject;let t=process.env.VERCEL_PROJECT_ID?.trim();if(t===void 0||t.length===0)return;let n=process.env.VERCEL_TARGET_ENV?.trim()||process.env.VERCEL_ENV?.trim();return n===void 0||n.length===0?{projectId:t}:{environment:n,projectId:t}}function vercelSubject(e){assertVercelSubjectSegment(`teamSlug`,e.teamSlug),assertVercelSubjectSegment(`projectName`,e.projectName);let t=e.environment??`production`;if(t!==`production`&&t!==`preview`&&t!==`development`&&t!==`*`)throw Error(`vercelSubject: invalid environment ${JSON.stringify(t)}; expected "production", "preview", "development", or "*".`);return`owner:${e.teamSlug}:project:${e.projectName}:environment:${t}`}function assertVercelSubjectSegment(e,t){if(t.length===0)throw Error(`vercelSubject: ${e} must be a non-empty string.`);if(t.includes(`*`)||t.includes(`:`))throw Error(`vercelSubject: ${e} ${JSON.stringify(t)} may not contain ${t.includes(`:`)?`':'`:`'*'`}. Hand-write the subject string when wildcards are intentional.`)}function vercelOidc(e={}){return withAuthChallenges(async t=>{let n=extractBearerToken(t.headers.get(`authorization`)),i=e.currentVercelProject??(n!==null&&isLocalDevelopmentVercelOidc()?await resolveVercelOidcCurrentProject(t):void 0),a=await verifyVercelOidc(n,i===void 0?e:{...e,currentVercelProject:i});return a.ok?a.sessionAuth:null},[{scheme:`Bearer`}])}function isLocalDevelopmentVercelOidc(){return process.env.VERCEL_ENV===`development`?!0:process.env.VERCEL_ENV===`preview`||process.env.VERCEL_ENV===`production`?!1:isEveDevEnvironment()}function httpBasic(e,t){return withAuthChallenges(t=>{let n=verifyHttpBasic(t.headers.get(`authorization`),e);return n.ok?n.sessionAuth:null},[{parameters:{realm:t?.realm??`eve`,charset:`UTF-8`},scheme:`Basic`}])}function jwtHmac(e){return withAuthChallenges(async t=>{let n=await verifyJwtHmac(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null},[{scheme:`Bearer`}])}function jwtEcdsa(e){return withAuthChallenges(async t=>{let n=await verifyJwtEcdsa(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null},[{scheme:`Bearer`}])}function oidc(e){return withAuthChallenges(async t=>{let n=await verifyOidc(extractBearerToken(t.headers.get(`authorization`)),e);return n.ok?n.sessionAuth:null},[{scheme:`Bearer`}])}function decodeUnverifiedJwtClaims(e){let t;try{t=decodeJwt(e)}catch{return null}return typeof t.iss!=`string`||t.iss.length===0?null:{audiences:typeof t.aud==`string`?[t.aud]:Array.isArray(t.aud)?t.aud.filter(e=>typeof e==`string`):[],issuer:t.iss}}export{ForbiddenError,UnauthenticatedError,createIpAllowList,createUnauthorizedResponse,escapeAuthChallengeParameter,extractBearerToken,httpBasic,isIpAllowed,jwtEcdsa,jwtHmac,localDev,none,oauthResource,oidc,placeholderAuth,readOAuthResourceOptions,routeAuth,vercelOidc,vercelSubject,verifyHttpBasic,verifyJwtEcdsa,verifyJwtHmac,verifyOidc,verifyVercelOidc,withAuthChallenges};

package/dist/src/public/channels/eve.js

@@ -1,3 +1,3 @@
-import{createLogger,logError}from"#internal/logging.js";import{hasInternalRefScheme}from"#internal/attachments/url-refs.js";import{EVE_INFO_ROUTE_PATH,EVE_SESSION_CANCEL_ROUTE_PATTERN,EVE_SESSION_CLEAR_ROUTE_PATTERN,EVE_SESSION_COMPACT_ROUTE_PATTERN,EVE_SESSION_RESET_ROUTE_PATTERN,EVE_SESSION_ROUTE_PATH,EVE_SESSION_ROUTE_PATTERN,EVE_SESSION_STREAM_ROUTE_PATTERN}from"#protocol/routes.js";import{EVE_MESSAGE_STREAM_CONTENT_TYPE,EVE_MESSAGE_STREAM_FORMAT,EVE_MESSAGE_STREAM_VERSION,EVE_SESSION_ID_HEADER,EVE_STREAM_FORMAT_HEADER,EVE_STREAM_TAIL_INDEX_HEADER,EVE_STREAM_VERSION_HEADER}from"#protocol/message.js";import{isInputResponse}from"#runtime/input/types.js";import{parseJsonObject}from"#shared/json.js";import{GET,POST,defineChannel}from"#public/definitions/channel.js";import"ai";import{parseSessionCallback}from"#channel/session-callback.js";import{parseTraceparent}from"#protocol/traceparent.js";import{readAgentInfoRouteResponse,readRouteSessionCreator}from"#internal/nitro/routes/channel-route-context.js";import{resolveForwardedPrincipal}from"#channel/forwarded-principal.js";import{routeAuth}from"#public/channels/auth.js";import{collectUploadPolicyViolations,formatUploadPolicyViolation,mergeUploadPolicy}from"#public/channels/upload-policy.js";const log=createLogger(`eve.channel`);function defaultEveAuth(e){return e.eve.caller}function eveChannel(e){let n=mergeUploadPolicy(e.uploadPolicy);return defineChannel({cors:normalizeEveCors(e.cors),turnPolicy:e.turnPolicy,routes:[GET(EVE_INFO_ROUTE_PATH,async(t,n)=>{let r=await routeAuth(t,e.auth);if(r instanceof Response)return r;let i=readAgentInfoRouteResponse(n);return i===void 0?Response.json({error:`Agent info route requires internal channel dispatch context.`,ok:!1},{status:500}):await i()}),POST(EVE_SESSION_ROUTE_PATH,async(r,i)=>{let a=await routeAuth(r,e.auth);if(a instanceof Response)return a;let o=await parseJsonRequest(r);if(o instanceof Response)return o;let s=rejectSessionContinuationToken(o);if(s!==null)return s;let c=await resolveForwardedPrincipal({trustedForwarders:e.trustedForwarders,forwarder:a,payload:o});if(c instanceof Response)return c;let l=parseCreateBody(o);if(l instanceof Response)return l;let u=parseTraceparent(r.headers.get(`traceparent`)),d=checkUploadPolicy(l,n);if(d!==null)return d;let f=await resolveOnMessage({auth:c.auth,config:e,message:l.message,request:r});if(f instanceof Response)return f;let p=readRouteSessionCreator(i);if(p===void 0)return Response.json({error:`Session creation requires internal channel dispatch context.`,ok:!1},{status:500});let m;try{m=await p({auth:f.auth,capabilities:l.capabilities??(l.mode===`task`?void 0:{requestInput:!0}),callback:l.callback,initiatorAuth:c.accepted?c.initiatorAuth:void 0,input:{message:l.message,context:mergeContext(l.context,f.context),outputSchema:l.outputSchema},mode:l.mode??`conversation`,parentTraceContext:u})}catch(e){let n=logError(log,`session-create request failed`,e);return Response.json({error:`Failed to create the session.`,errorId:n,ok:!1},{status:500})}return Response.json({ok:!0,sessionId:m.sessionId,status:`accepted`},{headers:{"cache-control":`no-store`,[EVE_SESSION_ID_HEADER]:m.sessionId},status:202})}),POST(EVE_SESSION_ROUTE_PATTERN,async(r,{attachSession:i,params:a})=>{let o=await routeAuth(r,e.auth);if(o instanceof Response)return o;let s=requireSessionId(a);if(s instanceof Response)return s;let c=await parseJsonRequest(r);if(c instanceof Response)return c;let l=parseSessionMessageBody(c);if(l instanceof Response)return l;let u=checkUploadPolicy(l,n);if(u!==null)return u;let d=l.context,f=o;if(l.message!==void 0){let t=await resolveOnMessage({auth:o,config:e,message:l.message,request:r,sessionId:s});if(t instanceof Response)return t;d=mergeContext(l.context,t.context),f=t.auth}let p;try{let e=i(s),t={auth:f,callback:l.callback,context:d,outputSchema:l.outputSchema,turnPolicy:l.turnPolicy};p=l.inputResponses===void 0?await e.send(l.message,t):await e.respond(l.inputResponses,t)}catch(e){let n=logError(log,`session-message request failed`,e,{sessionId:s});return Response.json({error:`Failed to send the session message.`,errorId:n,ok:!1},{status:500})}return p.status===`session_not_active`?Response.json({code:`session_not_active`,error:`The session is no longer active.`,ok:!1},{headers:{"cache-control":`no-store`},status:409}):Response.json({ok:!0,sessionId:p.sessionId,status:`accepted`},{headers:{"cache-control":`no-store`,[EVE_SESSION_ID_HEADER]:p.sessionId},status:202})}),POST(EVE_SESSION_CANCEL_ROUTE_PATTERN,async(n,{attachSession:r,params:i})=>{let a=await routeAuth(n,e.auth);if(a instanceof Response)return a;let o=requireSessionId(i);if(o instanceof Response)return o;let s=await parseCancelTurnBody(n);if(s instanceof Response)return s;let c;try{c=await r(o).cancel({turnId:s.turnId})}catch(e){let n=logError(log,`cancel-turn request failed`,e,{sessionId:o});return Response.json({error:`Failed to cancel the turn.`,errorId:n,ok:!1},{status:500})}return Response.json(c.status===`accepted`?{ok:!0,sessionId:c.sessionId,status:`accepted`}:{ok:!0,status:`no_active_turn`},{headers:{"cache-control":`no-store`},status:c.status===`accepted`?202:200})}),POST(EVE_SESSION_COMPACT_ROUTE_PATTERN,async(n,{attachSession:r,params:i})=>{let a=await routeAuth(n,e.auth);if(a instanceof Response)return a;let o=requireSessionId(i);if(o instanceof Response)return o;let s=await parseSessionControlBody(n);if(s instanceof Response)return s;let c;try{c=await r(o).compact()}catch(e){let n=logError(log,`session-compaction request failed`,e,{sessionId:o});return Response.json({error:`Failed to compact the session.`,errorId:n,ok:!1},{status:500})}return Response.json(c.status===`accepted`?{ok:!0,sessionId:c.sessionId,status:`accepted`}:{ok:!0,status:`no_active_session`},{headers:{"cache-control":`no-store`},status:c.status===`accepted`?202:200})}),POST(EVE_SESSION_CLEAR_ROUTE_PATTERN,async(n,{attachSession:r,params:i})=>{let a=await routeAuth(n,e.auth);if(a instanceof Response)return a;let o=requireSessionId(i);if(o instanceof Response)return o;let s=await parseSessionControlBody(n);if(s instanceof Response)return s;let c;try{c=await r(o).clear()}catch(e){let n=logError(log,`session-clear request failed`,e,{sessionId:o});return Response.json({error:`Failed to clear the session context.`,errorId:n,ok:!1},{status:500})}return Response.json(c.status===`accepted`?{ok:!0,sessionId:c.sessionId,status:`accepted`}:{ok:!0,status:`no_active_session`},{headers:{"cache-control":`no-store`},status:c.status===`accepted`?202:200})}),POST(EVE_SESSION_RESET_ROUTE_PATTERN,async(n,{attachSession:r,params:i})=>{let a=await routeAuth(n,e.auth);if(a instanceof Response)return a;let o=requireSessionId(i);if(o instanceof Response)return o;let s=await parseResetBody(n);if(s instanceof Response)return s;let c;try{c=await r(o).reset({reason:s.reason})}catch(e){let n=logError(log,`session-reset request failed`,e,{sessionId:o});return Response.json({error:`Failed to reset the session.`,errorId:n,ok:!1},{status:500})}return Response.json(c.status===`reset`?{ok:!0,previousSessionId:c.previousSessionId,status:`reset`}:{ok:!0,status:`no_active_session`},{headers:{"cache-control":`no-store`}})}),GET(EVE_SESSION_STREAM_ROUTE_PATTERN,async(t,{attachSession:n,params:r})=>{let i=await routeAuth(t,e.auth);if(i instanceof Response)return i;let a=requireSessionId(r);return a instanceof Response?a:await createSessionStreamResponse(t,n(a))})],events:e.events})}function normalizeEveCors(e){if(e===void 0||e===!1)return!1;if(e===!0)return!0;let t={};return e.origin!==void 0&&(t.origin=normalizeEveCorsOrigin(e.origin)),e.methods!==void 0&&(t.methods=e.methods),e.allowedHeaders!==void 0&&(t.allowHeaders=e.allowedHeaders),e.exposedHeaders!==void 0&&(t.exposeHeaders=e.exposedHeaders),e.credentials!==void 0&&(t.credentials=e.credentials),e.maxAge!==void 0&&(t.maxAge=e.maxAge),e.preflightStatus!==void 0&&(t.preflight={statusCode:e.preflightStatus}),t}function normalizeEveCorsOrigin(e){return e===`*`||e===`null`?e:typeof e==`string`?[e]:e}async function resolveOnMessage(e){let n=e.config.onMessage??defaultOnMessage,r;try{if(r=await n({eve:e.sessionId===void 0?{caller:e.auth,request:e.request}:{caller:e.auth,request:e.request,sessionId:e.sessionId}},e.message),r==null)throw TypeError(`eveChannel onMessage must return an auth result.`)}catch(n){let r=logError(log,`onMessage handler failed`,n,{sessionId:e.sessionId});return Response.json({error:`onMessage handler failed.`,errorId:r,ok:!1},{status:500})}return r.context===void 0?{auth:r.auth}:{auth:r.auth,context:r.context}}function defaultOnMessage(e){return{auth:defaultEveAuth(e)}}function parseCreateBody(e){if(e.inputResponses!==void 0)return Response.json({error:`'inputResponses' is only accepted for an existing session.`,ok:!1},{status:400});let t=parseMessageField(e.message);if(t instanceof Response)return t;let n=parseClientContextField(e.clientContext);if(n instanceof Response)return n;let r=parseCallbackField(e.callback);if(r instanceof Response)return r;let i=parseCapabilitiesField(e.capabilities);if(i instanceof Response)return i;let a=parseModeField(e.mode);if(a instanceof Response)return a;let o=parseOutputSchemaField(e.outputSchema);return o instanceof Response?o:t===void 0?Response.json({error:`Missing or empty 'message' field.`,ok:!1},{status:400}):{callback:r,capabilities:i,message:t,mode:a,context:n,outputSchema:o}}function parseSessionMessageBody(e){let t=rejectSessionContinuationToken(e);if(t!==null)return t;if(e.forwardedPrincipal!==void 0)return Response.json({error:`A forwarded principal is only accepted on session creation.`,ok:!1},{status:400});let n=parseMessageField(e.message);if(n instanceof Response)return n;let r=parseCallbackField(e.callback);if(r instanceof Response)return r;let i=parseInputResponses(e.inputResponses);if(i instanceof Response)return i;let a=parseClientContextField(e.clientContext);if(a instanceof Response)return a;let o=parseOutputSchemaField(e.outputSchema);if(o instanceof Response)return o;let s=parseTurnPolicyField(e.turnPolicy);return s instanceof Response?s:n===void 0&&i===void 0?Response.json({error:`Expected a non-empty 'message' or a non-empty 'inputResponses' array.`,ok:!1},{status:400}):n!==void 0&&i!==void 0?Response.json({error:`'message' and 'inputResponses' are mutually exclusive.`,ok:!1},{status:400}):{callback:r,message:n,inputResponses:i,context:a,outputSchema:o,turnPolicy:s}}async function parseCancelTurnBody(e){let t=await parseOptionalJsonRequest(e);if(t instanceof Response)return t;let n=rejectSessionContinuationToken(t);if(n!==null)return n;let r=t.turnId;return r===void 0?{}:typeof r!=`string`||r.length===0?Response.json({error:`Expected 'turnId' to be a non-empty string.`,ok:!1},{status:400}):{turnId:r}}async function parseJsonRequest(e){let t;try{t=await e.json()}catch{return Response.json({error:`Invalid JSON body.`,ok:!1},{status:400})}return typeof t!=`object`||!t||Array.isArray(t)?Response.json({error:`Expected a JSON object.`,ok:!1},{status:400}):t}async function parseResetBody(e){let t=await parseOptionalJsonRequest(e);if(t instanceof Response)return t;let n=rejectSessionContinuationToken(t);if(n!==null)return n;let r=t.reason;return r!==void 0&&(typeof r!=`string`||r.length===0)?Response.json({error:`Expected 'reason' to be a non-empty string.`,ok:!1},{status:400}):r===void 0?{}:{reason:r}}async function parseSessionControlBody(e){let t=await parseOptionalJsonRequest(e);return t instanceof Response?t:rejectSessionContinuationToken(t)??t}async function parseOptionalJsonRequest(e){let t;try{t=await e.text()}catch{return Response.json({error:`Unreadable request body.`,ok:!1},{status:400})}if(t.trim().length===0)return{};let n;try{n=JSON.parse(t)}catch{return Response.json({error:`Invalid JSON body.`,ok:!1},{status:400})}return typeof n!=`object`||!n||Array.isArray(n)?Response.json({error:`Expected a JSON object.`,ok:!1},{status:400}):n}function rejectSessionContinuationToken(e){return`continuationToken`in e?Response.json({error:`Session-ID routes do not accept 'continuationToken'.`,ok:!1},{status:400}):null}function requireSessionId(e){return e.sessionId||Response.json({error:`Missing session id.`,ok:!1},{status:400})}async function createSessionStreamResponse(e,t){let n=parseStartIndex(e);if(n instanceof Response)return n;let r=parseIncludeTailIndex(e);try{let e=r?await t.getStreamTailIndex():void 0,i=await t.getEventStream({startIndex:n}),a=new Headers({"cache-control":`no-store, no-transform`,"content-type":EVE_MESSAGE_STREAM_CONTENT_TYPE,"x-accel-buffering":`no`,[EVE_SESSION_ID_HEADER]:t.id,[EVE_STREAM_FORMAT_HEADER]:EVE_MESSAGE_STREAM_FORMAT,[EVE_STREAM_VERSION_HEADER]:EVE_MESSAGE_STREAM_VERSION});return e!==void 0&&a.set(EVE_STREAM_TAIL_INDEX_HEADER,String(e)),new Response(serializeAsNdjson(i),{headers:a})}catch{return Response.json({error:`Session not found.`,ok:!1},{status:404})}}function parseOutputSchemaField(e){if(e!==void 0)try{return parseJsonObject(e)}catch{return Response.json({error:`Expected 'outputSchema' to be a JSON-serializable object.`,ok:!1},{status:400})}}function parseCallbackField(e){if(e===void 0)return;let t=parseSessionCallback(e);return t.ok?t.callback:Response.json({error:t.message,ok:!1},{status:400})}function parseCapabilitiesField(e){if(e===void 0)return;if(typeof e!=`object`||!e||Array.isArray(e))return Response.json({error:`Expected 'capabilities' to be an object.`,ok:!1},{status:400});let t=Object.keys(e),n=Reflect.get(e,`requestInput`);return t.some(e=>e!==`requestInput`)||n!==void 0&&typeof n!=`boolean`?Response.json({error:`Expected 'capabilities.requestInput' to be a boolean when provided.`,ok:!1},{status:400}):n===void 0?{}:{requestInput:n}}function parseModeField(e){if(e!==void 0)return e===`conversation`||e===`task`?e:Response.json({error:`Expected 'mode' to be either 'conversation' or 'task'.`,ok:!1},{status:400})}function parseTurnPolicyField(e){if(e!==void 0)return e===`queue`||e===`steer`?e:Response.json({error:`Expected 'turnPolicy' to be either 'queue' or 'steer'.`,ok:!1},{status:400})}function parseMessageField(e){if(e===void 0)return;if(typeof e==`string`)return e.length>0?e:void 0;if(!Array.isArray(e))return Response.json({error:`Expected 'message' to be a string or an array of text/file parts.`,ok:!1},{status:400});if(e.length===0)return;let t=[];for(let n of e){let e=parseMessagePart(n);if(e instanceof Response)return e;t.push(e)}return t}function parseMessagePart(e){if(typeof e!=`object`||!e)return Response.json({error:`Expected each message part to be an object.`,ok:!1},{status:400});let t=e;if(t.type===`text`)return typeof t.text!=`string`||t.text.length===0?Response.json({error:`Text parts require a non-empty 'text' string.`,ok:!1},{status:400}):{type:`text`,text:t.text};if(t.type===`file`){if(typeof t.mediaType!=`string`||t.mediaType.length===0)return Response.json({error:`File parts require a non-empty 'mediaType' string.`,ok:!1},{status:400});if(typeof t.data!=`string`)return Response.json({error:`File parts require a 'data' string (base64, data URL, or URL).`,ok:!1},{status:400});if(hasInternalRefScheme(t.data))return Response.json({error:`File part 'data' must not use a framework-internal ref scheme.`,ok:!1},{status:400});let e={type:`file`,mediaType:t.mediaType,data:t.data};return typeof t.filename==`string`&&t.filename.length>0&&(e.filename=t.filename),e}return Response.json({error:`Unsupported message part type "${String(t.type)}". Use 'text' or 'file'.`,ok:!1},{status:400})}function checkUploadPolicy(e,t){if(!e.message)return null;let n=collectUploadPolicyViolations(e.message,t);if(n.length===0)return null;let[r]=n;if(!r)return null;let i=r.kind===`too-large`?413:415;return Response.json({error:formatUploadPolicyViolation(r),ok:!1,violations:n.map(e=>e.kind===`too-large`?{byteLength:e.byteLength,filename:e.filename,kind:e.kind,limit:e.limit,mediaType:e.mediaType}:{allowedMediaTypes:e.allowedMediaTypes,filename:e.filename,kind:e.kind,mediaType:e.mediaType})},{status:i})}function parseInputResponses(e){if(e===void 0)return;if(!Array.isArray(e)||e.length===0)return Response.json({error:`Expected 'inputResponses' to be a non-empty array.`,ok:!1},{status:400});let t=e.filter(isInputResponse);return t.length===e.length?t:Response.json({error:`Expected every 'inputResponses' entry to match the HITL response schema.`,ok:!1},{status:400})}function mergeContext(e,t){return e===void 0?t:t===void 0?e:[...e,...t]}function parseClientContextField(e){if(e!==void 0){if(typeof e==`string`)return e.length>0?[toClientContextMessage(e)]:void 0;if(Array.isArray(e))return e.length===0?void 0:e.every(e=>typeof e==`string`&&e.length>0)?e.map(e=>toClientContextMessage(e)):Response.json({error:`Expected 'clientContext' array entries to be non-empty strings.`,ok:!1},{status:400});if(typeof e!=`object`||!e)return Response.json({error:`Expected 'clientContext' to be a string, string array, or JSON object.`,ok:!1},{status:400});try{let t=parseJsonObject(e);return[toClientContextMessage(JSON.stringify(t))]}catch{return Response.json({error:`Expected 'clientContext' to be a JSON-serializable object.`,ok:!1},{status:400})}}}function toClientContextMessage(e){return`Client context:
+import{createLogger,logError}from"#internal/logging.js";import{isRuntimeSessionOwnershipConflictError}from"#execution/runtime-errors.js";import{hasInternalRefScheme}from"#internal/attachments/url-refs.js";import{EVE_INFO_ROUTE_PATH,EVE_SESSION_CANCEL_ROUTE_PATTERN,EVE_SESSION_CLEAR_ROUTE_PATTERN,EVE_SESSION_COMPACT_ROUTE_PATTERN,EVE_SESSION_RESET_ROUTE_PATTERN,EVE_SESSION_ROUTE_PATH,EVE_SESSION_ROUTE_PATTERN,EVE_SESSION_STREAM_ROUTE_PATTERN,EVE_SUBAGENT_STREAM_ROUTE_PATTERN,createEveSessionStreamRoutePath,createEveSubagentStreamRoutePath}from"#protocol/routes.js";import{EVE_MESSAGE_STREAM_CONTENT_TYPE,EVE_MESSAGE_STREAM_FORMAT,EVE_MESSAGE_STREAM_VERSION,EVE_SESSION_ID_HEADER,EVE_STREAM_FORMAT_HEADER,EVE_STREAM_TAIL_INDEX_HEADER,EVE_STREAM_VERSION_HEADER}from"#protocol/message.js";import{isInputResponse}from"#runtime/input/types.js";import{parseJsonObject}from"#shared/json.js";import{GET,POST,defineChannel}from"#public/definitions/channel.js";import"ai";import{parseSessionCallback}from"#channel/session-callback.js";import{parseTraceparent}from"#protocol/traceparent.js";import{routeAuth}from"#public/channels/auth.js";import{readAgentInfoRouteResponse,readRemoteAgentStreamHeadersResolver,readRouteSessionCreator}from"#internal/nitro/routes/channel-route-context.js";import{resolveForwardedPrincipal}from"#channel/forwarded-principal.js";import{collectUploadPolicyViolations,formatUploadPolicyViolation,mergeUploadPolicy}from"#public/channels/upload-policy.js";const log=createLogger(`eve.channel`);function defaultEveAuth(e){return e.eve.caller}function eveChannel(e){let r=mergeUploadPolicy(e.uploadPolicy);return defineChannel({cors:normalizeEveCors(e.cors),turnPolicy:e.turnPolicy,routes:[GET(EVE_INFO_ROUTE_PATH,async(t,n)=>{let r=await routeAuth(t,e.auth);if(r instanceof Response)return r;let i=readAgentInfoRouteResponse(n);return i===void 0?Response.json({error:`Agent info route requires internal channel dispatch context.`,ok:!1},{status:500}):await i()}),POST(EVE_SESSION_ROUTE_PATH,async(i,a)=>{let o=await routeAuth(i,e.auth);if(o instanceof Response)return o;let s=await parseJsonRequest(i);if(s instanceof Response)return s;let c=rejectSessionContinuationToken(s);if(c!==null)return c;let l=await resolveForwardedPrincipal({trustedForwarders:e.trustedForwarders,forwarder:o,payload:s});if(l instanceof Response)return l;let u=parseCreateBody(s);if(u instanceof Response)return u;let d=parseTraceparent(i.headers.get(`traceparent`)),f=checkUploadPolicy(u,r);if(f!==null)return f;if(u.operationId!==void 0&&l.auth.principalType===`anonymous`)return Response.json({error:`operationId requires an authenticated principal.`,ok:!1},{status:400});let p=u.operationId===void 0?void 0:await deriveOperationContinuationToken({auth:l.auth,operationId:u.operationId});if(p!==void 0){let e=await a.resolveSession(p);if(e!==void 0)return Response.json({ok:!0,sessionId:e.id,status:`accepted`},{headers:{"cache-control":`no-store`,[EVE_SESSION_ID_HEADER]:e.id},status:202})}let m=await resolveOnMessage({auth:l.auth,config:e,message:u.message,request:i});if(m instanceof Response)return m;let h=readRouteSessionCreator(a);if(h===void 0)return Response.json({error:`Session creation requires internal channel dispatch context.`,ok:!1},{status:500});let g;try{g=await h({auth:m.auth,capabilities:u.capabilities??(u.mode===`task`?void 0:{requestInput:!0}),callback:u.callback,continuationToken:p,initiatorAuth:l.accepted?l.initiatorAuth:void 0,input:{message:u.message,context:mergeContext(u.context,m.context),outputSchema:u.outputSchema},mode:u.mode??`conversation`,parentTraceContext:d})}catch(e){if(p!==void 0&&isRuntimeSessionOwnershipConflictError(e))return Response.json({ok:!0,sessionId:e.ownerSessionId,status:`accepted`},{headers:{"cache-control":`no-store`,[EVE_SESSION_ID_HEADER]:e.ownerSessionId},status:202});let r=logError(log,`session-create request failed`,e);return Response.json({error:`Failed to create the session.`,errorId:r,ok:!1},{status:500})}return Response.json({ok:!0,sessionId:g.sessionId,status:`accepted`},{headers:{"cache-control":`no-store`,[EVE_SESSION_ID_HEADER]:g.sessionId},status:202})}),POST(EVE_SESSION_ROUTE_PATTERN,async(n,{attachSession:i,params:a})=>{let o=await routeAuth(n,e.auth);if(o instanceof Response)return o;let s=requireSessionId(a);if(s instanceof Response)return s;let c=await parseJsonRequest(n);if(c instanceof Response)return c;let l=parseSessionMessageBody(c);if(l instanceof Response)return l;let u=checkUploadPolicy(l,r);if(u!==null)return u;let d=l.context,f=o;if(l.message!==void 0){let t=await resolveOnMessage({auth:o,config:e,message:l.message,request:n,sessionId:s});if(t instanceof Response)return t;d=mergeContext(l.context,t.context),f=t.auth}let p;try{let e=i(s),t={auth:f,callback:l.callback,context:d,outputSchema:l.outputSchema,turnPolicy:l.turnPolicy};p=l.inputResponses===void 0?await e.send(l.message,t):await e.respond(l.inputResponses,t)}catch(e){let n=logError(log,`session-message request failed`,e,{sessionId:s});return Response.json({error:`Failed to send the session message.`,errorId:n,ok:!1},{status:500})}return p.status===`session_not_active`?Response.json({code:`session_not_active`,error:`The session is no longer active.`,ok:!1},{headers:{"cache-control":`no-store`},status:409}):Response.json({ok:!0,sessionId:p.sessionId,status:`accepted`},{headers:{"cache-control":`no-store`,[EVE_SESSION_ID_HEADER]:p.sessionId},status:202})}),POST(EVE_SESSION_CANCEL_ROUTE_PATTERN,async(n,{attachSession:r,params:i})=>{let a=await routeAuth(n,e.auth);if(a instanceof Response)return a;let o=requireSessionId(i);if(o instanceof Response)return o;let s=await parseCancelTurnBody(n);if(s instanceof Response)return s;let c;try{c=await r(o).cancel({taskId:s.taskId,turnId:s.turnId})}catch(e){let n=logError(log,`cancel-turn request failed`,e,{sessionId:o});return Response.json({error:`Failed to cancel the turn.`,errorId:n,ok:!1},{status:500})}return Response.json(c.status===`accepted`?{ok:!0,sessionId:c.sessionId,status:`accepted`}:{ok:!0,status:`no_active_turn`},{headers:{"cache-control":`no-store`},status:c.status===`accepted`?202:200})}),POST(EVE_SESSION_COMPACT_ROUTE_PATTERN,async(n,{attachSession:r,params:i})=>{let a=await routeAuth(n,e.auth);if(a instanceof Response)return a;let o=requireSessionId(i);if(o instanceof Response)return o;let s=await parseSessionControlBody(n);if(s instanceof Response)return s;let c;try{c=await r(o).compact()}catch(e){let n=logError(log,`session-compaction request failed`,e,{sessionId:o});return Response.json({error:`Failed to compact the session.`,errorId:n,ok:!1},{status:500})}return Response.json(c.status===`accepted`?{ok:!0,sessionId:c.sessionId,status:`accepted`}:{ok:!0,status:`no_active_session`},{headers:{"cache-control":`no-store`},status:c.status===`accepted`?202:200})}),POST(EVE_SESSION_CLEAR_ROUTE_PATTERN,async(n,{attachSession:r,params:i})=>{let a=await routeAuth(n,e.auth);if(a instanceof Response)return a;let o=requireSessionId(i);if(o instanceof Response)return o;let s=await parseSessionControlBody(n);if(s instanceof Response)return s;let c;try{c=await r(o).clear()}catch(e){let n=logError(log,`session-clear request failed`,e,{sessionId:o});return Response.json({error:`Failed to clear the session context.`,errorId:n,ok:!1},{status:500})}return Response.json(c.status===`accepted`?{ok:!0,sessionId:c.sessionId,status:`accepted`}:{ok:!0,status:`no_active_session`},{headers:{"cache-control":`no-store`},status:c.status===`accepted`?202:200})}),POST(EVE_SESSION_RESET_ROUTE_PATTERN,async(n,{attachSession:r,params:i})=>{let a=await routeAuth(n,e.auth);if(a instanceof Response)return a;let o=requireSessionId(i);if(o instanceof Response)return o;let s=await parseResetBody(n);if(s instanceof Response)return s;let c;try{c=await r(o).reset({reason:s.reason})}catch(e){let n=logError(log,`session-reset request failed`,e,{sessionId:o});return Response.json({error:`Failed to reset the session.`,errorId:n,ok:!1},{status:500})}return Response.json(c.status===`reset`?{ok:!0,previousSessionId:c.previousSessionId,status:`reset`}:{ok:!0,status:`no_active_session`},{headers:{"cache-control":`no-store`}})}),GET(EVE_SESSION_STREAM_ROUTE_PATTERN,async(t,{attachSession:n,params:r})=>{let i=await routeAuth(t,e.auth);if(i instanceof Response)return i;let a=requireSessionId(r);return a instanceof Response?a:await createSessionStreamResponse(t,n(a))}),GET(EVE_SUBAGENT_STREAM_ROUTE_PATTERN,async(t,n)=>{let r=await routeAuth(t,e.auth);if(r instanceof Response)return r;let i=n.params.parentSessionId,a=n.params.callId,o=n.params.childSessionId;if(!i||!a||!o)return Response.json({error:`Missing subagent stream coordinates.`,ok:!1},{status:400});let s=parseStartIndex(t);if(s instanceof Response)return s;let c=parseIncludeTailIndex(t),l=createEveSubagentStreamRoutePath({callId:a,childSessionId:o,parentSessionId:i}),u;try{let e=await findRemoteSubagentBinding({callId:a,childSessionId:o,childStreamPath:l,parentSessionId:i,parent:n.attachSession(i)});if(e===void 0)throw Error(`Remote subagent binding not found.`);u=e}catch{return Response.json({error:`Subagent stream not found.`,ok:!1},{status:404})}let d=readRemoteAgentStreamHeadersResolver(n);if(d===void 0)return Response.json({error:`Subagent stream proxy requires internal channel dispatch context.`,ok:!1},{status:500});let f;try{f=await d({name:u.data.toolName,resolverId:u.data.remote.resolverId,url:u.data.remote.url})}catch{return Response.json({error:`Subagent stream not found.`,ok:!1},{status:404})}let h=new URL(createEveSessionStreamRoutePath(o).replace(/^\/+/,``),`${u.data.remote.url.replace(/\/+$/,``)}/`);s!==void 0&&h.searchParams.set(`startIndex`,String(s)),c&&h.searchParams.set(`includeTailIndex`,`1`);let g=await fetch(h,{cache:`no-store`,headers:f,redirect:`manual`,signal:t.signal}),_=new Headers;for(let e of[`cache-control`,`content-type`,`x-accel-buffering`,EVE_SESSION_ID_HEADER,EVE_STREAM_FORMAT_HEADER,EVE_STREAM_TAIL_INDEX_HEADER,EVE_STREAM_VERSION_HEADER]){let t=g.headers.get(e);t!==null&&_.set(e,t)}return new Response(g.body,{headers:_,status:g.status,statusText:g.statusText})})],events:e.events})}async function findRemoteSubagentBinding(e){let t=await e.parent.getStreamTailIndex();if(t<0)return;let n=(await e.parent.getEventStream({startIndex:0})).getReader(),r;try{for(let i=0;i<=t;i+=1){let t=await n.read();if(t.done)break;let i=t.value;i.type===`subagent.called`&&i.data.sessionId===e.parentSessionId&&i.data.callId===e.callId&&i.data.childSessionId===e.childSessionId&&i.data.childStreamPath===e.childStreamPath&&i.data.remote!==void 0&&(r=i)}}finally{await n.cancel().catch(()=>{})}return r}function normalizeEveCors(e){if(e===void 0||e===!1)return!1;if(e===!0)return!0;let t={};return e.origin!==void 0&&(t.origin=normalizeEveCorsOrigin(e.origin)),e.methods!==void 0&&(t.methods=e.methods),e.allowedHeaders!==void 0&&(t.allowHeaders=e.allowedHeaders),e.exposedHeaders!==void 0&&(t.exposeHeaders=e.exposedHeaders),e.credentials!==void 0&&(t.credentials=e.credentials),e.maxAge!==void 0&&(t.maxAge=e.maxAge),e.preflightStatus!==void 0&&(t.preflight={statusCode:e.preflightStatus}),t}function normalizeEveCorsOrigin(e){return e===`*`||e===`null`?e:typeof e==`string`?[e]:e}async function resolveOnMessage(e){let n=e.config.onMessage??defaultOnMessage,r;try{if(r=await n({eve:e.sessionId===void 0?{caller:e.auth,request:e.request}:{caller:e.auth,request:e.request,sessionId:e.sessionId}},e.message),r==null)throw TypeError(`eveChannel onMessage must return an auth result.`)}catch(n){let r=logError(log,`onMessage handler failed`,n,{sessionId:e.sessionId});return Response.json({error:`onMessage handler failed.`,errorId:r,ok:!1},{status:500})}return r.context===void 0?{auth:r.auth}:{auth:r.auth,context:r.context}}function defaultOnMessage(e){return{auth:defaultEveAuth(e)}}async function deriveOperationContinuationToken(e){let t=JSON.stringify([`eve:create-session:v1`,e.auth.authenticator,e.auth.issuer??null,e.auth.principalType,e.auth.principalId,e.operationId]),n=await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(t));return`eve:op:${Array.from(new Uint8Array(n),e=>e.toString(16).padStart(2,`0`)).join(``).slice(0,32)}`}function parseCreateBody(e){if(e.inputResponses!==void 0)return Response.json({error:`'inputResponses' is only accepted for an existing session.`,ok:!1},{status:400});let t=parseMessageField(e.message);if(t instanceof Response)return t;let n=parseClientContextField(e.clientContext);if(n instanceof Response)return n;let r=parseCallbackField(e.callback);if(r instanceof Response)return r;let i=parseCapabilitiesField(e.capabilities);if(i instanceof Response)return i;let a=parseModeField(e.mode);if(a instanceof Response)return a;let o=parseOutputSchemaField(e.outputSchema);if(o instanceof Response)return o;if(t===void 0)return Response.json({error:`Missing or empty 'message' field.`,ok:!1},{status:400});let s=e.operationId;if(s!==void 0&&(typeof s!=`string`||!s))return Response.json({error:`Expected 'operationId' to be a non-empty string.`,ok:!1},{status:400});let c={callback:r,capabilities:i,message:t,mode:a,context:n,outputSchema:o};return typeof s==`string`&&(c.operationId=s),c}function parseSessionMessageBody(e){let t=rejectSessionContinuationToken(e);if(t!==null)return t;if(e.forwardedPrincipal!==void 0)return Response.json({error:`A forwarded principal is only accepted on session creation.`,ok:!1},{status:400});let n=parseMessageField(e.message);if(n instanceof Response)return n;let r=parseCallbackField(e.callback);if(r instanceof Response)return r;let i=parseInputResponses(e.inputResponses);if(i instanceof Response)return i;let a=parseClientContextField(e.clientContext);if(a instanceof Response)return a;let o=parseOutputSchemaField(e.outputSchema);if(o instanceof Response)return o;let s=parseTurnPolicyField(e.turnPolicy);return s instanceof Response?s:n===void 0&&i===void 0?Response.json({error:`Expected a non-empty 'message' or a non-empty 'inputResponses' array.`,ok:!1},{status:400}):n!==void 0&&i!==void 0?Response.json({error:`'message' and 'inputResponses' are mutually exclusive.`,ok:!1},{status:400}):{callback:r,message:n,inputResponses:i,context:a,outputSchema:o,turnPolicy:s}}async function parseCancelTurnBody(e){let t=await parseOptionalJsonRequest(e);if(t instanceof Response)return t;let n=rejectSessionContinuationToken(t);if(n!==null)return n;let r=t.turnId,i=t.taskId;if(r!==void 0&&(typeof r!=`string`||r.length===0))return Response.json({error:`Expected 'turnId' to be a non-empty string.`,ok:!1},{status:400});if(i!==void 0&&(typeof i!=`string`||i.length===0))return Response.json({error:`Expected 'taskId' to be a non-empty string.`,ok:!1},{status:400});let a={};return typeof i==`string`&&(a.taskId=i),typeof r==`string`&&(a.turnId=r),a}async function parseJsonRequest(e){let t;try{t=await e.json()}catch{return Response.json({error:`Invalid JSON body.`,ok:!1},{status:400})}return typeof t!=`object`||!t||Array.isArray(t)?Response.json({error:`Expected a JSON object.`,ok:!1},{status:400}):t}async function parseResetBody(e){let t=await parseOptionalJsonRequest(e);if(t instanceof Response)return t;let n=rejectSessionContinuationToken(t);if(n!==null)return n;let r=t.reason;return r!==void 0&&(typeof r!=`string`||r.length===0)?Response.json({error:`Expected 'reason' to be a non-empty string.`,ok:!1},{status:400}):r===void 0?{}:{reason:r}}async function parseSessionControlBody(e){let t=await parseOptionalJsonRequest(e);return t instanceof Response?t:rejectSessionContinuationToken(t)??t}async function parseOptionalJsonRequest(e){let t;try{t=await e.text()}catch{return Response.json({error:`Unreadable request body.`,ok:!1},{status:400})}if(t.trim().length===0)return{};let n;try{n=JSON.parse(t)}catch{return Response.json({error:`Invalid JSON body.`,ok:!1},{status:400})}return typeof n!=`object`||!n||Array.isArray(n)?Response.json({error:`Expected a JSON object.`,ok:!1},{status:400}):n}function rejectSessionContinuationToken(e){return`continuationToken`in e?Response.json({error:`Session-ID routes do not accept 'continuationToken'.`,ok:!1},{status:400}):null}function requireSessionId(e){return e.sessionId||Response.json({error:`Missing session id.`,ok:!1},{status:400})}async function createSessionStreamResponse(e,t){let n=parseStartIndex(e);if(n instanceof Response)return n;let r=parseIncludeTailIndex(e);try{let e=r?await t.getStreamTailIndex():void 0,i=await t.getEventStream({startIndex:n}),a=new Headers({"cache-control":`no-store, no-transform`,"content-type":EVE_MESSAGE_STREAM_CONTENT_TYPE,"x-accel-buffering":`no`,[EVE_SESSION_ID_HEADER]:t.id,[EVE_STREAM_FORMAT_HEADER]:EVE_MESSAGE_STREAM_FORMAT,[EVE_STREAM_VERSION_HEADER]:EVE_MESSAGE_STREAM_VERSION});return e!==void 0&&a.set(EVE_STREAM_TAIL_INDEX_HEADER,String(e)),new Response(serializeAsNdjson(i),{headers:a})}catch{return Response.json({error:`Session not found.`,ok:!1},{status:404})}}function parseOutputSchemaField(e){if(e!==void 0)try{return parseJsonObject(e)}catch{return Response.json({error:`Expected 'outputSchema' to be a JSON-serializable object.`,ok:!1},{status:400})}}function parseCallbackField(e){if(e===void 0)return;let t=parseSessionCallback(e);return t.ok?t.callback:Response.json({error:t.message,ok:!1},{status:400})}function parseCapabilitiesField(e){if(e===void 0)return;if(typeof e!=`object`||!e||Array.isArray(e))return Response.json({error:`Expected 'capabilities' to be an object.`,ok:!1},{status:400});let t=Object.keys(e),n=Reflect.get(e,`requestInput`);return t.some(e=>e!==`requestInput`)||n!==void 0&&typeof n!=`boolean`?Response.json({error:`Expected 'capabilities.requestInput' to be a boolean when provided.`,ok:!1},{status:400}):n===void 0?{}:{requestInput:n}}function parseModeField(e){if(e!==void 0)return e===`conversation`||e===`task`?e:Response.json({error:`Expected 'mode' to be either 'conversation' or 'task'.`,ok:!1},{status:400})}function parseTurnPolicyField(e){if(e!==void 0)return e===`queue`||e===`steer`?e:Response.json({error:`Expected 'turnPolicy' to be either 'queue' or 'steer'.`,ok:!1},{status:400})}function parseMessageField(e){if(e===void 0)return;if(typeof e==`string`)return e.length>0?e:void 0;if(!Array.isArray(e))return Response.json({error:`Expected 'message' to be a string or an array of text/file parts.`,ok:!1},{status:400});if(e.length===0)return;let t=[];for(let n of e){let e=parseMessagePart(n);if(e instanceof Response)return e;t.push(e)}return t}function parseMessagePart(e){if(typeof e!=`object`||!e)return Response.json({error:`Expected each message part to be an object.`,ok:!1},{status:400});let t=e;if(t.type===`text`)return typeof t.text!=`string`||t.text.length===0?Response.json({error:`Text parts require a non-empty 'text' string.`,ok:!1},{status:400}):{type:`text`,text:t.text};if(t.type===`file`){if(typeof t.mediaType!=`string`||t.mediaType.length===0)return Response.json({error:`File parts require a non-empty 'mediaType' string.`,ok:!1},{status:400});if(typeof t.data!=`string`)return Response.json({error:`File parts require a 'data' string (base64, data URL, or URL).`,ok:!1},{status:400});if(hasInternalRefScheme(t.data))return Response.json({error:`File part 'data' must not use a framework-internal ref scheme.`,ok:!1},{status:400});let e={type:`file`,mediaType:t.mediaType,data:t.data};return typeof t.filename==`string`&&t.filename.length>0&&(e.filename=t.filename),e}return Response.json({error:`Unsupported message part type "${String(t.type)}". Use 'text' or 'file'.`,ok:!1},{status:400})}function checkUploadPolicy(e,t){if(!e.message)return null;let n=collectUploadPolicyViolations(e.message,t);if(n.length===0)return null;let[r]=n;if(!r)return null;let i=r.kind===`too-large`?413:415;return Response.json({error:formatUploadPolicyViolation(r),ok:!1,violations:n.map(e=>e.kind===`too-large`?{byteLength:e.byteLength,filename:e.filename,kind:e.kind,limit:e.limit,mediaType:e.mediaType}:{allowedMediaTypes:e.allowedMediaTypes,filename:e.filename,kind:e.kind,mediaType:e.mediaType})},{status:i})}function parseInputResponses(e){if(e===void 0)return;if(!Array.isArray(e)||e.length===0)return Response.json({error:`Expected 'inputResponses' to be a non-empty array.`,ok:!1},{status:400});let t=e.filter(isInputResponse);return t.length===e.length?t:Response.json({error:`Expected every 'inputResponses' entry to match the HITL response schema.`,ok:!1},{status:400})}function mergeContext(e,t){return e===void 0?t:t===void 0?e:[...e,...t]}function parseClientContextField(e){if(e!==void 0){if(typeof e==`string`)return e.length>0?[toClientContextMessage(e)]:void 0;if(Array.isArray(e))return e.length===0?void 0:e.every(e=>typeof e==`string`&&e.length>0)?e.map(e=>toClientContextMessage(e)):Response.json({error:`Expected 'clientContext' array entries to be non-empty strings.`,ok:!1},{status:400});if(typeof e!=`object`||!e)return Response.json({error:`Expected 'clientContext' to be a string, string array, or JSON object.`,ok:!1},{status:400});try{let t=parseJsonObject(e);return[toClientContextMessage(JSON.stringify(t))]}catch{return Response.json({error:`Expected 'clientContext' to be a JSON-serializable object.`,ok:!1},{status:400})}}}function toClientContextMessage(e){return`Client context:
 ${e}`}function parseIncludeTailIndex(e){let t=new URL(e.url).searchParams.get(`includeTailIndex`);return t===`1`||t===`true`}function parseStartIndex(e){let t=new URL(e.url).searchParams.get(`startIndex`);if(t===null)return;let n=Number(t);return!/^-?\d+$/.test(t)||!Number.isSafeInteger(n)?Response.json({error:`Expected startIndex to be an integer.`,ok:!1},{status:400}):n}function serializeAsNdjson(e){let t=new TextEncoder;return e.pipeThrough(new TransformStream({start(e){e.enqueue(t.encode(`
 `))},transform(e,n){n.enqueue(t.encode(`${JSON.stringify(e)}\n`))}}))}export{defaultEveAuth,eveChannel};

package/dist/src/public/channels/mcp.d.ts

@@ -0,0 +1,19 @@
+import { type Channel } from "#public/definitions/channel.js";
+import { type AuthFn } from "#public/channels/auth.js";
+export interface McpChannelInput {
+    /** Existing eve route-auth policy. Use `none()` for explicit public access. */
+    readonly auth: AuthFn<Request> | readonly AuthFn<Request>[];
+    /** Streamable HTTP endpoint path. Defaults to `/mcp`. */
+    readonly path?: string;
+}
+/** Public MCP channel exposing durable agent invocation compatibility tools. */
+export type McpChannel = Channel;
+/**
+ * Publishes this agent as a stateless Streamable HTTP MCP server.
+ *
+ * This channel owns only MCP transport and durable eve invocation. It reuses
+ * eve's inbound auth strategies and recognizes `oauthResource(...)` metadata
+ * when OAuth discovery is needed.
+ * The file containing this channel must be `agent/channels/mcp.ts`.
+ */
+export declare function mcpChannel(input: McpChannelInput): McpChannel;

package/dist/src/public/channels/mcp.js

@@ -0,0 +1 @@
+import{z}from"#compiled/zod/index.js";import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{inputRequestSchema,inputResponseSchema}from"#runtime/input/types.js";import{parseJsonObject}from"#shared/json.js";import{DELETE,GET,HEAD,OPTIONS,POST,defineChannel}from"#public/definitions/channel.js";import{escapeAuthChallengeParameter,readOAuthResourceOptions,routeAuth}from"#public/channels/auth.js";import{readAgentInfoRouteResponse,readRouteChannelName,readRouteSessionCreator}from"#internal/nitro/routes/channel-route-context.js";import{WorkflowAgentInvocationExecution}from"#internal/invocation/workflow-execution.js";import{validateMcpHttpRequest,validateMcpMetadataRequest}from"#internal/mcp/http-security.js";import{createMcpStreamableHttpServer,defineMcpTool}from"#internal/mcp/streamable-http-server.js";import{createMcpProtectedResourceMetadata,createMcpResourceChallenge}from"#internal/mcp/protected-resource.js";function mcpChannel(e){if(e?.auth===void 0)throw Error(`mcpChannel requires auth. Use none() for explicit public access.`);let t=e.path??`/mcp`,n=readOAuthResourceOptions(e.auth),r=[GET(t,async(t,r)=>await authenticateMcpRequest(t,r,e.auth,n)),POST(t,async(t,r)=>await authenticateMcpRequest(t,r,e.auth,n)),DELETE(t,async(t,r)=>await authenticateMcpRequest(t,r,e.auth,n))];return n!==void 0&&r.unshift(...protectedResourceMetadataRoutes(n,t)),defineChannel({routes:r})}function protectedResourceMetadataRoutes(e,t){let n=e.metadataPath??`/.well-known/oauth-protected-resource`;return[GET(n,async n=>protectedResourceMetadataResponse(n,e,t,!1)),HEAD(n,async n=>protectedResourceMetadataResponse(n,e,t,!0)),OPTIONS(n,async e=>protectedResourceMetadataOptionsResponse(e))]}function protectedResourceMetadataResponse(e,t,n,r){let i=validateMcpMetadataRequest(e);if(i!==void 0)return i;let a=t.resource??new URL(n,new URL(e.url).origin).toString(),o=t.issuer===void 0?t.authorizationServers:[t.issuer],s=Response.json(createMcpProtectedResourceMetadata({authorizationServers:o,resource:a,scopesSupported:t.scopes}),{headers:{"access-control-allow-origin":`*`,"cache-control":`no-store`}});return r?new Response(null,{headers:s.headers,status:s.status}):s}function protectedResourceMetadataOptionsResponse(e){let t=validateMcpMetadataRequest(e);if(t!==void 0)return t;let n=new Headers({"access-control-allow-methods":`GET, HEAD, OPTIONS`,"access-control-allow-origin":`*`,"cache-control":`no-store`}),r=e.headers.get(`access-control-request-headers`);return r!==null&&(n.set(`access-control-allow-headers`,r),n.set(`vary`,`Access-Control-Request-Headers`)),new Response(null,{headers:n,status:204})}function addResourceChallenge(e,t,n){if(e.status!==401&&e.status!==403)return e;let r=n.metadataPath??`/.well-known/oauth-protected-resource`,i=n.resource??new URL(t.url).origin,a=new URL(r,i).toString(),o=new Headers(e.headers),s=o.get(`www-authenticate`);if(e.status===401)o.set(`www-authenticate`,mergeMcpBearerChallenge(s,a,n.scopes));else{let t=augmentInsufficientScopeChallenge(s,a);if(t===void 0)return e;o.set(`www-authenticate`,t)}return new Response(e.body,{headers:o,status:e.status,statusText:e.statusText})}function mergeMcpBearerChallenge(e,t,n){let r=parseAuthChallenges(e),i=r.find(e=>e.scheme.toLowerCase()===`bearer`&&hasAuthParameter(e.value,`error`))??r.find(e=>e.scheme.toLowerCase()===`bearer`);return replaceBearerChallenges(r,i,i===void 0?createMcpResourceChallenge(t,n):augmentBearerChallenge(i.value,t,n))}function augmentInsufficientScopeChallenge(e,t){let n=parseAuthChallenges(e),r=n.find(e=>e.scheme.toLowerCase()===`bearer`&&hasAuthParameter(e.value,`error`,`insufficient_scope`));if(r!==void 0)return replaceBearerChallenges(n,r,augmentBearerChallenge(r.value,t))}function replaceBearerChallenges(e,t,n){let r=[],i=!1;for(let a of e){if(a.scheme.toLowerCase()!==`bearer`){r.push(a.value);continue}!i&&a===t&&(r.push(n),i=!0)}return i||r.push(n),r.join(`, `)}function augmentBearerChallenge(e,t,n){let r=e;return hasAuthParameter(r,`resource_metadata`)||(r=appendAuthParameter(r,`resource_metadata`,t)),n?.length&&!hasAuthParameter(r,`scope`)&&(r=appendAuthParameter(r,`scope`,n.join(` `))),r}function appendAuthParameter(e,t,n){return`${e}${e.trim().toLowerCase()===`bearer`?` `:`, `}${t}="${escapeAuthChallengeParameter(n)}"`}function hasAuthParameter(e,t,n){let r=t.replaceAll(/[.*+?^${}()|[\]\\]/g,`\\$&`);if(n===void 0)return RegExp(`(?:^|[\\s,])${r}\\s*=`,`i`).test(e);let i=n.replaceAll(/[.*+?^${}()|[\]\\]/g,`\\$&`);return RegExp(`(?:^|[\\s,])${r}\\s*=\\s*(?:"${i}"|${i})(?=$|[\\s,])`,`i`).test(e)}function parseAuthChallenges(e){if(e===null)return[];let t=[];for(let n of splitQuotedHeaderList(e)){let e=readChallengeScheme(n);if(e!==void 0){t.push({scheme:e,value:n});continue}let r=t.at(-1);r!==void 0&&(r.value+=`, ${n}`)}return t}function splitQuotedHeaderList(e){let t=[],n=!1,r=!1,i=0;for(let a=0;a<e.length;a++){let o=e[a];if(n)n=!1;else if(o===`\\`)n=!0;else if(o===`"`)r=!r;else if(o===`,`&&!r){let n=e.slice(i,a).trim();n.length>0&&t.push(n),i=a+1}}let a=e.slice(i).trim();return a.length>0&&t.push(a),t}function readChallengeScheme(e){let t=/^([!#$%&'*+\-.^_`|~0-9A-Za-z]+)(?:\s+|$)/.exec(e);if(t===null)return;let n=t[1];if(n!==void 0)return e.slice(n.length).trimStart().startsWith(`=`)?void 0:n}async function authenticateMcpRequest(e,t,n,r){let i=validateMcpHttpRequest(e);if(i!==void 0)return i;let a=await routeAuth(e,n);return a instanceof Response?r===void 0?a:addResourceChallenge(a,e,r):await handleMcpRequest(e,t,a)}async function handleMcpRequest(e,n,r){let i=readRouteSessionCreator(n),a=readRouteChannelName(n),o=readAgentInfoRouteResponse(n);if(a===void 0||i===void 0||o===void 0)return Response.json({error:`MCP requires agent route context.`},{status:500});let s=await o();if(!s.ok)return s;let c=await s.json();if(typeof c.agent?.name!=`string`)return Response.json({error:`MCP requires compiled agent metadata.`},{status:500});let l=typeof c.agent.description==`string`?c.agent.description:void 0,u=new WorkflowAgentInvocationExecution({createSession:i,from:n.from});return await createMcpStreamableHttpServer({authenticate:async()=>r,name:c.agent.name,tools:createInvocationTools(u,l,r.authenticator===`none`&&r.principalType===`anonymous`),version:resolveInstalledPackageInfo().version})(e)}function createInvocationTools(t,n,i){let a=i?` On this public channel, the invocation ID is a bearer capability until workflow retention expires.`:``,o=`Starts durable work and returns an invocation handle immediately.${a}`;return[defineMcpTool({definition:{annotations:{destructiveHint:!0,idempotentHint:!1,openWorldHint:!0,readOnlyHint:!1},description:n===void 0?o:`${n} ${o}`,inputSchema:z.strictObject({message:z.string().min(1),outputSchema:z.looseObject({}).optional()}),name:`agent_start`,outputSchema:AGENT_INVOCATION_OUTPUT_SCHEMA},async call(e,n){return invocationResult(await t.create({auth:n.auth,message:e.message,outputSchema:asJsonObject(e.outputSchema)}))}}),defineMcpTool({definition:{annotations:{destructiveHint:!1,idempotentHint:!0,openWorldHint:!1,readOnlyHint:!0},description:`Reads complete durable invocation state.${a}`,inputSchema:z.strictObject({invocationId:z.string().min(1)}),name:`agent_get`,outputSchema:AGENT_INVOCATION_OUTPUT_SCHEMA},async call(e,n){return invocationResult(requiredInvocation(await t.read({auth:n.auth,invocationId:e.invocationId})))}}),defineMcpTool({definition:{annotations:{destructiveHint:!0,idempotentHint:!1,openWorldHint:!0,readOnlyHint:!1},description:`Answers a pending input request on a durable invocation.`,inputSchema:z.strictObject({invocationId:z.string().min(1),responses:z.array(inputResponseSchema).min(1)}),name:`agent_update`,outputSchema:AGENT_INVOCATION_OUTPUT_SCHEMA},async call(e,n){return invocationResult(requiredMutation(await t.update({auth:n.auth,invocationId:e.invocationId,responses:e.responses})))}}),defineMcpTool({definition:{annotations:{destructiveHint:!0,idempotentHint:!0,openWorldHint:!1,readOnlyHint:!1},description:`Requests cancellation of a durable invocation. Read it again to observe acknowledgement.`,inputSchema:z.strictObject({invocationId:z.string().min(1)}),name:`agent_cancel`,outputSchema:AGENT_INVOCATION_OUTPUT_SCHEMA},async call(e,n){return invocationResult(requiredInvocation(await t.cancel({auth:n.auth,invocationId:e.invocationId})))}})]}function requiredInvocation(e){if(e===void 0)throw Error(`Invocation not found.`);return e}function requiredMutation(e){switch(e.type){case`success`:return e.invocation;case`conflict`:throw Error(e.message);case`not_found`:throw Error(`Invocation not found.`)}}function invocationResult(e){let t=parseJsonObject(e);return{content:[{text:JSON.stringify(t),type:`text`}],structuredContent:t}}function asJsonObject(e){if(e===void 0)return;let t=parseJsonObject(e);return validateOutputSchemaComplexity(t),t}const AUTHORIZATION_CHALLENGE_SCHEMA=z.strictObject({displayName:z.string().optional(),expiresAt:z.iso.datetime().optional(),instructions:z.string().optional(),url:z.url().optional(),userCode:z.string().optional()}),AUTHORIZATION_REQUEST_SCHEMA=z.strictObject({authorization:AUTHORIZATION_CHALLENGE_SCHEMA.optional(),description:z.string(),name:z.string(),webhookUrl:z.url().optional()}),MCP_INPUT_REQUEST_SCHEMA=inputRequestSchema.safeExtend({action:z.strictObject({callId:z.string(),input:z.record(z.string(),z.json()),kind:z.literal(`tool-call`),toolName:z.string()})}),AGENT_INVOCATION_BASE_SCHEMA=z.strictObject({createdAt:z.iso.datetime(),expiresAt:z.iso.datetime().optional(),invocationId:z.string()}),AGENT_INVOCATION_OUTPUT_SCHEMA=z.discriminatedUnion(`status`,[AGENT_INVOCATION_BASE_SCHEMA.extend({pollAfterMs:z.number().int().nonnegative(),result:z.json().optional(),status:z.literal(`working`)}),AGENT_INVOCATION_BASE_SCHEMA.extend({inputRequests:z.record(z.string(),MCP_INPUT_REQUEST_SCHEMA),result:z.json().optional(),status:z.literal(`input_required`)}),AGENT_INVOCATION_BASE_SCHEMA.extend({authorizations:z.array(AUTHORIZATION_REQUEST_SCHEMA).min(1),pollAfterMs:z.number().int().nonnegative(),result:z.json().optional(),status:z.literal(`authorization_required`)}),AGENT_INVOCATION_BASE_SCHEMA.extend({result:z.json().optional(),status:z.literal(`completed`)}),AGENT_INVOCATION_BASE_SCHEMA.extend({error:z.strictObject({code:z.number().int(),data:z.json().optional(),message:z.string()}),status:z.literal(`failed`)}),AGENT_INVOCATION_BASE_SCHEMA.extend({status:z.literal(`cancelled`)})]);function validateOutputSchemaComplexity(e){if(new TextEncoder().encode(JSON.stringify(e)).byteLength>65536)throw Error(`outputSchema must be at most 65536 bytes.`);let t=0,visit=(e,n)=>{if(t++,t>2048)throw Error(`outputSchema must contain at most 2048 nodes.`);if(n>32)throw Error(`outputSchema must be at most 32 levels deep.`);if(Array.isArray(e)){for(let t of e)visit(t,n+1);return}if(!(typeof e!=`object`||!e))for(let[t,r]of Object.entries(e)){if(t===`$ref`&&typeof r==`string`&&!r.startsWith(`#`))throw Error(`outputSchema external $ref values are not supported.`);visit(r,n+1)}};visit(e,0)}export{mcpChannel};

package/dist/src/public/definitions/channel.d.ts

@@ -12,14 +12,14 @@ export type { Session, SessionHandle } from "#channel/session.js";
 export type { SessionRespondOptions, SessionSendOptions } from "#channel/session.js";
 export type { ChannelFrom, ChannelReceiveContext, ChannelResolveSession, ChannelRespondOptions, ChannelSendOptions, ChannelSource, };
 export type { ChannelCors, ChannelCorsOptions } from "#channel/cors.js";
-export { GET, POST, PUT, PATCH, DELETE, WS } from "#channel/routes.js";
+export { DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT, WS } from "#channel/routes.js";
 export type { AttachSessionFn, HttpRouteDefinition, RouteDefinition, RouteHandlerArgs, WebSocketMessage, WebSocketPeer, WebSocketRouteDefinition, WebSocketRouteHandler, WebSocketRouteHooks, WebSocketUpgradeRequest, WebSocketUpgradeResult, } from "#channel/routes.js";
 /**
  * HTTP method a route handles. Defaults to `"POST"` — almost every route
  * is a webhook. Override only when authoring a non-webhook route such as a
  * long-poll endpoint or an event-stream reader.
  */
-export type ChannelMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+export type ChannelMethod = "GET" | "HEAD" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS";
 /**
  * Method-like discriminator used by compiled channel route entries.
  *

package/dist/src/public/definitions/channel.js

@@ -1 +1 @@
-import{CHANNEL_SENTINEL}from"#channel/compiled-channel.js";import{defaultDeliverResult}from"#channel/adapter.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{normalizeChannelCors}from"#channel/cors.js";import{HTTP_ADAPTER_KIND}from"#channel/http.js";import{DELETE,GET,PATCH,POST,PUT,WS}from"#channel/routes.js";const DISABLED_ROUTE_SENTINEL_KIND=`eve:disabled-channel`;function disableRoute(){return{kind:DISABLED_ROUTE_SENTINEL_KIND}}function isDisabledRouteSentinel(e){return typeof e==`object`&&!!e&&e.kind===DISABLED_ROUTE_SENTINEL_KIND}function defineChannel(t){let n=buildAdapter(t),i=normalizeChannelCors(t.cors);return{__kind:CHANNEL_SENTINEL,routes:t.routes,adapter:n,cors:i,receive:t.receive}}const eventTypes=Object.keys({"approval.candidate":null,"approval.settled":null,"context.cleared":null,"compaction.requested":null,"compaction.completed":null,"turn.started":null,"actions.requested":null,"action.partial":null,"action.result":null,"message.completed":null,"message.appended":null,"reasoning.appended":null,"reasoning.completed":null,"input.requested":null,"turn.failed":null,"turn.completed":null,"turn.cancelled":null,"session.failed":null,"session.completed":null,"session.waiting":null,"authorization.required":null,"authorization.completed":null});function buildAdapter(e){let r=e.state!=null,a=e.context!=null,o=e.fetchFile!==void 0,s=e.metadata,c=r||a||s!==void 0,l={},u=!1,d=e.events;for(let e of eventTypes){let t=d?.[e];t&&(u=!0,l[e]=(r,i)=>{let{session:a,...o}=i,s={...o,continuation:a?.continuation===void 0?void 0:{token:a.continuation.token,rekey:e=>a.continuation?.rekey(e)}};if(e===`session.failed`)return t(r,s);let c=buildCallbackContext();return t(r,s,c)})}return!c&&!u&&!o?{kind:e.kindHint??HTTP_ADAPTER_KIND}:{kind:e.kindHint??`defineChannel`,state:r?{...e.state}:{},fetchFile:e.fetchFile,instrumentation:s===void 0?void 0:{metadata(e){return s(e)}},createAdapterContext(t){let n=t.state,r=t.session;return{...a?e.context(n,r):{},state:n,ctx:t.ctx,session:r}},deliver(n,r){return e.deliver===void 0?defaultDeliverResult(n):e.deliver(n,r)},...l}}export{DELETE,GET,PATCH,POST,PUT,WS,defineChannel,disableRoute,isDisabledRouteSentinel};
+import{CHANNEL_SENTINEL}from"#channel/compiled-channel.js";import{defaultDeliverResult}from"#channel/adapter.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{normalizeChannelCors}from"#channel/cors.js";import{HTTP_ADAPTER_KIND}from"#channel/http.js";import{DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,WS}from"#channel/routes.js";const DISABLED_ROUTE_SENTINEL_KIND=`eve:disabled-channel`;function disableRoute(){return{kind:DISABLED_ROUTE_SENTINEL_KIND}}function isDisabledRouteSentinel(e){return typeof e==`object`&&!!e&&e.kind===DISABLED_ROUTE_SENTINEL_KIND}function defineChannel(t){let n=buildAdapter(t),i=normalizeChannelCors(t.cors);return{__kind:CHANNEL_SENTINEL,routes:t.routes,adapter:n,cors:i,receive:t.receive}}const eventTypes=Object.keys({"approval.candidate":null,"approval.settled":null,"context.cleared":null,"compaction.requested":null,"compaction.completed":null,"turn.started":null,"actions.requested":null,"action.partial":null,"action.result":null,"message.completed":null,"message.appended":null,"reasoning.appended":null,"reasoning.completed":null,"input.requested":null,"turn.failed":null,"turn.completed":null,"turn.cancelled":null,"session.failed":null,"session.completed":null,"session.waiting":null,"authorization.required":null,"authorization.completed":null});function buildAdapter(e){let r=e.state!=null,a=e.context!=null,o=e.fetchFile!==void 0,s=e.metadata,c=r||a||s!==void 0,l={},u=!1,d=e.events;for(let e of eventTypes){let t=d?.[e];t&&(u=!0,l[e]=(r,i)=>{let{session:a,...o}=i,s={...o,continuation:a?.continuation===void 0?void 0:{token:a.continuation.token,rekey:e=>a.continuation?.rekey(e)}};if(e===`session.failed`)return t(r,s);let c=buildCallbackContext();return t(r,s,c)})}return!c&&!u&&!o?{kind:e.kindHint??HTTP_ADAPTER_KIND}:{kind:e.kindHint??`defineChannel`,state:r?{...e.state}:{},fetchFile:e.fetchFile,instrumentation:s===void 0?void 0:{metadata(e){return s(e)}},createAdapterContext(t){let n=t.state,r=t.session;return{...a?e.context(n,r):{},state:n,ctx:t.ctx,session:r}},deliver(n,r){return e.deliver===void 0?defaultDeliverResult(n):e.deliver(n,r)},...l}}export{DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,WS,defineChannel,disableRoute,isDisabledRouteSentinel};

package/dist/src/react/use-eve-agent.js

@@ -1 +1 @@
-import{EveAgentStore}from"#client/eve-agent-store.js";import{defaultMessageReducer}from"#client/message-reducer.js";import{useCallback,useMemo,useRef,useSyncExternalStore}from"react";import{resolveEveAgentHost}from"#client/agent-host.js";function useEveAgent(r={}){let i=useRef(void 0);if(!i.current){let n=r.reducer??defaultMessageReducer();i.current=new EveAgentStore({auth:r.auth,headers:r.headers,host:resolveEveAgentHost({agent:r.agent,host:r.host}),initialEvents:r.initialEvents,initialSession:r.initialSession,optimistic:r.optimistic,reducer:n,session:r.session})}let a=i.current;a.setCallbacks({onError:r.onError,onEvent:r.onEvent,onFinish:r.onFinish,onSessionChange:r.onSessionChange,prepareSend:r.prepareSend});let o=useSyncExternalStore(useCallback(e=>a.subscribe(e),[a]),()=>a.snapshot,()=>a.snapshot),s=useCallback(()=>a.reset(),[a]),c=useCallback((e,t)=>a.send({...t,message:e}),[a]),l=useCallback((e,t)=>a.send({...t,inputResponses:e}),[a]),u=useCallback(()=>a.stop(),[a]);return useMemo(()=>({...o,reset:s,respond:l,send:c,stop:u}),[s,l,c,o,u])}export{useEveAgent};
+import{EveAgentStore}from"#client/eve-agent-store.js";import{defaultMessageReducer}from"#client/message-reducer.js";import{useCallback,useEffect,useMemo,useRef,useSyncExternalStore}from"react";import{resolveEveAgentHost}from"#client/agent-host.js";function useEveAgent(r={}){let i=useRef(void 0);if(!i.current){let n=r.reducer??defaultMessageReducer();i.current=new EveAgentStore({auth:r.auth,headers:r.headers,host:resolveEveAgentHost({agent:r.agent,host:r.host}),initialEvents:r.initialEvents,initialSession:r.initialSession,optimistic:r.optimistic,reducer:n,session:r.session})}let a=i.current;a.setCallbacks({onError:r.onError,onEvent:r.onEvent,onFinish:r.onFinish,onSessionChange:r.onSessionChange,prepareSend:r.prepareSend});let o=useSyncExternalStore(useCallback(e=>a.subscribe(e),[a]),()=>a.snapshot,()=>a.snapshot);useEffect(()=>()=>a.stop(),[a]);let s=useCallback(()=>a.reset(),[a]),c=useCallback((e,t)=>a.send({...t,message:e}),[a]),l=useCallback((e,t)=>a.send({...t,inputResponses:e}),[a]),u=useCallback(()=>a.stop(),[a]);return useMemo(()=>({...o,reset:s,respond:l,send:c,stop:u}),[s,l,c,o,u])}export{useEveAgent};

package/dist/src/runtime/actions/types.d.ts

@@ -131,12 +131,21 @@ declare const runtimeToolResultActionResultSchema: z.ZodObject<{
  * so the parent never infers lifecycle from an absent field. `usage`
  * carries the turn's token spend so the caller can attribute the
  * subagent's tokens.
+ *
+ * `backgroundTask` marks the one parent-produced exception: delegated
+ * dispatch resolves the model's tool call with a parked task receipt before
+ * the child settles. Stream consumers use the marker to keep child lifecycle
+ * open while still recording the receipt as the tool result.
  */
 export type RuntimeSubagentChildResult = z.infer<typeof runtimeSubagentChildResultSchema>;
 /**
  * Zod schema for one child-produced subagent result.
  */
 declare const runtimeSubagentChildResultSchema: z.ZodObject<{
+    backgroundTask: z.ZodOptional<z.ZodObject<{
+        status: z.ZodLiteral<"working">;
+        taskId: z.ZodString;
+    }, z.core.$strict>>;
     callId: z.ZodString;
     isError: z.ZodOptional<z.ZodBoolean>;
     kind: z.ZodLiteral<"subagent-result">;

package/dist/src/runtime/actions/types.js

@@ -1 +1 @@
-import{z}from"#compiled/zod/index.js";import{jsonObjectSchema,jsonValueSchema}from"#shared/json-schemas.js";import{agentTurnOutcomeSchema}from"#shared/agent-turn-outcome.js";import{tokenUsageSchema}from"#shared/token-usage.js";const runtimeToolCallActionRequestSchema=z.object({callId:z.string(),input:jsonObjectSchema,kind:z.literal(`tool-call`),toolName:z.string()}).strict(),runtimeSubagentCallActionRequestSchema=z.object({callId:z.string(),description:z.string(),input:jsonObjectSchema,kind:z.literal(`subagent-call`),name:z.string(),nodeId:z.string(),subagentName:z.string()}).strict(),runtimeRemoteAgentCallActionRequestSchema=z.object({callId:z.string(),description:z.string(),input:jsonObjectSchema,kind:z.literal(`remote-agent-call`),name:z.string(),nodeId:z.string(),remoteAgentName:z.string()}).strict(),runtimeLoadSkillActionRequestSchema=z.object({callId:z.string(),input:jsonObjectSchema,kind:z.literal(`load-skill`)}).strict(),runtimeActionRequestSchema=z.discriminatedUnion(`kind`,[runtimeLoadSkillActionRequestSchema,runtimeRemoteAgentCallActionRequestSchema,runtimeSubagentCallActionRequestSchema,runtimeToolCallActionRequestSchema]);z.object({callId:z.string(),isError:z.boolean().optional(),kind:z.literal(`tool-result`),output:jsonValueSchema,toolName:z.string()}).strict(),z.object({callId:z.string(),isError:z.boolean().optional(),kind:z.literal(`subagent-result`),origin:z.literal(`child`),outcome:agentTurnOutcomeSchema,output:jsonValueSchema,subagentName:z.string(),usage:tokenUsageSchema.optional()}).strict(),z.object({callId:z.string(),isError:z.literal(!0),kind:z.literal(`subagent-result`),origin:z.literal(`dispatch`),output:jsonValueSchema,subagentName:z.string()}).strict(),z.object({callId:z.string(),isError:z.boolean().optional(),kind:z.literal(`load-skill-result`),output:jsonValueSchema,name:z.string().optional()}).strict();export{runtimeActionRequestSchema,runtimeRemoteAgentCallActionRequestSchema,runtimeToolCallActionRequestSchema};
+import{z}from"#compiled/zod/index.js";import{jsonObjectSchema,jsonValueSchema}from"#shared/json-schemas.js";import{agentTurnOutcomeSchema}from"#shared/agent-turn-outcome.js";import{tokenUsageSchema}from"#shared/token-usage.js";const runtimeToolCallActionRequestSchema=z.object({callId:z.string(),input:jsonObjectSchema,kind:z.literal(`tool-call`),toolName:z.string()}).strict(),runtimeSubagentCallActionRequestSchema=z.object({callId:z.string(),description:z.string(),input:jsonObjectSchema,kind:z.literal(`subagent-call`),name:z.string(),nodeId:z.string(),subagentName:z.string()}).strict(),runtimeRemoteAgentCallActionRequestSchema=z.object({callId:z.string(),description:z.string(),input:jsonObjectSchema,kind:z.literal(`remote-agent-call`),name:z.string(),nodeId:z.string(),remoteAgentName:z.string()}).strict(),runtimeLoadSkillActionRequestSchema=z.object({callId:z.string(),input:jsonObjectSchema,kind:z.literal(`load-skill`)}).strict(),runtimeActionRequestSchema=z.discriminatedUnion(`kind`,[runtimeLoadSkillActionRequestSchema,runtimeRemoteAgentCallActionRequestSchema,runtimeSubagentCallActionRequestSchema,runtimeToolCallActionRequestSchema]);z.object({callId:z.string(),isError:z.boolean().optional(),kind:z.literal(`tool-result`),output:jsonValueSchema,toolName:z.string()}).strict(),z.object({backgroundTask:z.strictObject({status:z.literal(`working`),taskId:z.string()}).optional(),callId:z.string(),isError:z.boolean().optional(),kind:z.literal(`subagent-result`),origin:z.literal(`child`),outcome:agentTurnOutcomeSchema,output:jsonValueSchema,subagentName:z.string(),usage:tokenUsageSchema.optional()}).strict(),z.object({callId:z.string(),isError:z.literal(!0),kind:z.literal(`subagent-result`),origin:z.literal(`dispatch`),output:jsonValueSchema,subagentName:z.string()}).strict(),z.object({callId:z.string(),isError:z.boolean().optional(),kind:z.literal(`load-skill-result`),output:jsonValueSchema,name:z.string().optional()}).strict();export{runtimeActionRequestSchema,runtimeRemoteAgentCallActionRequestSchema,runtimeToolCallActionRequestSchema};

package/dist/src/runtime/agent/bootstrap.js

@@ -1 +1 @@
-import{AGENT_TOOL_NAME,isImplicitAgentToolAvailable}from"#runtime/framework-tools/agent.js";import{composeRuntimeBasePrompt}from"#runtime/prompt/compose.js";const BOOTSTRAP_RUNTIME_MODEL_ID=`eve-bootstrap-model`,BOOTSTRAP_RUNTIME_SYSTEM_PROMPT=`You are the eve bootstrap agent. Be concise, stay grounded in the current conversation, and do not assume tools are available unless the runtime provides them.`;function createResolvedRuntimeTurnAgent(n){let r=n.agent,i=r.config,a=n.id??i?.name;if(a===void 0)throw Error(`Expected a path-derived agent id while resolving agent resources.`);let o=n.tools.some(e=>e.kind===`subagent`||e.kind===`remote`),s=isImplicitAgentToolAvailable({disabledFrameworkTools:r.disabledFrameworkTools,hasAuthoredAgentTool:n.tools.some(t=>t.name===AGENT_TOOL_NAME),nodeId:n.nodeId}),c={availableSkills:r.skills.map(e=>({description:e.description,name:e.name})),id:a,initialMessages:r.instructions.filter(e=>e.role===`user`&&e.content.trim().length>0).map(e=>({content:e.content.trim(),role:`user`})),instructions:composeRuntimeBasePrompt({connections:r.connections,instructions:r.instructions,persistentSubagentSessions:i?.experimental?.subagentPersistentSessions===!0,subagentsAvailable:o||s,toolsAvailable:n.tools.length>0||s,workspaceSpec:r.workspaceSpec}),compactionModel:i?.compaction?.model,nodeId:n.nodeId,outputSchema:i?.outputSchema,reasoning:i?.reasoning,tools:[...n.tools],workspaceSpec:r.workspaceSpec};return i===void 0?{...c,configResolver:!0}:i.dynamicModel===void 0?{...c,model:i.model}:{...c,dynamicModel:i.dynamicModel}}export{BOOTSTRAP_RUNTIME_MODEL_ID,BOOTSTRAP_RUNTIME_SYSTEM_PROMPT,createResolvedRuntimeTurnAgent};
+import{AGENT_TOOL_NAME,isImplicitAgentToolAvailable}from"#runtime/framework-tools/agent.js";import{composeRuntimeBasePrompt}from"#runtime/prompt/compose.js";const BOOTSTRAP_RUNTIME_MODEL_ID=`eve-bootstrap-model`,BOOTSTRAP_RUNTIME_SYSTEM_PROMPT=`You are the eve bootstrap agent. Be concise, stay grounded in the current conversation, and do not assume tools are available unless the runtime provides them.`;function createResolvedRuntimeTurnAgent(n){let r=n.agent,i=r.config,a=n.id??i?.name;if(a===void 0)throw Error(`Expected a path-derived agent id while resolving agent resources.`);let o=n.tools.some(e=>e.kind===`subagent`||e.kind===`remote`),s=isImplicitAgentToolAvailable({disabledFrameworkTools:r.disabledFrameworkTools,hasAuthoredAgentTool:n.tools.some(t=>t.name===AGENT_TOOL_NAME),nodeId:n.nodeId}),c={availableSkills:r.skills.map(e=>({description:e.description,name:e.name})),id:a,initialMessages:r.instructions.filter(e=>e.role===`user`&&e.content.trim().length>0).map(e=>({content:e.content.trim(),role:`user`})),instructions:composeRuntimeBasePrompt({connections:r.connections,instructions:r.instructions,persistentSubagentSessions:i?.experimental?.tasks===!0||i?.experimental?.subagentPersistentSessions===!0,subagentsAvailable:o||s,tasksEnabled:i?.experimental?.tasks===!0,toolsAvailable:n.tools.length>0||s,workspaceSpec:r.workspaceSpec}),compactionModel:i?.compaction?.model,nodeId:n.nodeId,outputSchema:i?.outputSchema,reasoning:i?.reasoning,tools:[...n.tools],workspaceSpec:r.workspaceSpec};return i===void 0?{...c,configResolver:!0}:i.dynamicModel===void 0?{...c,model:i.model}:{...c,dynamicModel:i.dynamicModel}}export{BOOTSTRAP_RUNTIME_MODEL_ID,BOOTSTRAP_RUNTIME_SYSTEM_PROMPT,createResolvedRuntimeTurnAgent};

package/dist/src/runtime/connections/authorization-complete-page.js

@@ -7,47 +7,89 @@ function buildAuthorizationCompletePage(){return new Response(`<!doctype html>
     <style>
       :root {
         color-scheme: light dark;
-        --bg: #fafafa;
-        --fg: #111111;
-        --muted: #525252;
-        --card-bg: #ffffff;
-        --card-border: #e5e5e5;
+        --background: oklch(0.984 0 0);
+        --foreground: oklch(0.205 0 0);
+        --secondary: oklch(0.42 0 0);
       }
       @media (prefers-color-scheme: dark) {
         :root {
-          --bg: #0a0a0a;
-          --fg: #fafafa;
-          --muted: #a3a3a3;
-          --card-bg: #171717;
-          --card-border: #262626;
+          --background: oklch(0.027 0 0);
+          --foreground: oklch(0.946 0 0);
+          --secondary: oklch(0.706 0 0);
         }
       }
+      * { box-sizing: border-box; }
       body {
         margin: 0;
+        font-family: "Geist Sans", "Helvetica Neue", Helvetica, Arial, sans-serif;
+        -webkit-font-smoothing: antialiased;
+        background: var(--background);
+        color: var(--foreground);
+      }
+      .screen {
         min-height: 100vh;
-        display: grid;
-        place-items: center;
-        font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
-        background: var(--bg);
-        color: var(--fg);
-      }
-      .card {
-        max-width: 28rem;
-        padding: 2rem 2.25rem;
-        border: 1px solid var(--card-border);
-        border-radius: 12px;
-        background: var(--card-bg);
-        color: var(--fg);
+        min-height: 100dvh;
+        padding: 2rem 1rem;
+        display: flex;
+        align-items: center;
+        justify-content: center;
+        background: var(--background);
+        color: var(--foreground);
+      }
+      .content {
+        width: 100%;
+        max-width: 27.5rem;
+      }
+      .header {
+        padding: 1.5rem 1.5rem 0;
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        text-align: center;
+      }
+      .icon {
+        width: 2rem;
+        height: 2rem;
+        margin-top: 1.5rem;
+        color: var(--foreground);
+      }
+      .icon svg {
+        display: block;
+        width: 100%;
+        height: 100%;
+      }
+      h1 {
+        margin: 1.5rem 0 0;
+        color: var(--foreground);
+        font-size: 1.5rem;
+        font-weight: 600;
+        line-height: 2rem;
+        letter-spacing: -0.06rem;
+      }
+      p {
+        margin: 0;
+        padding: 1rem 1.5rem;
+        color: var(--secondary);
+        font-size: 0.8125rem;
+        line-height: 1.125rem;
         text-align: center;
       }
-      h1 { font-size: 1.25rem; margin: 0 0 0.5rem; color: var(--fg); }
-      p { margin: 0; color: var(--muted); line-height: 1.5; }
     </style>
   </head>
   <body>
-    <main class="card">
-      <h1>Authorization complete</h1>
-      <p>You can close this tab and return to your app.</p>
+    <main class="screen" aria-labelledby="authorization-title">
+      <div class="content">
+        <div class="header">
+          <h1 id="authorization-title">Authorization complete</h1>
+          <div class="icon" aria-hidden="true">
+            <svg viewBox="0 0 16 16" fill="none">
+              <path fill="currentColor" fill-rule="evenodd" d="M16 8A8 8 0 1 1 0 8a8 8 0 0 1 16 0m-4.47-1.47.53-.53L11 4.94l-.53.53L6.5 9.44l-.97-.97L5 7.94 3.94 9l.53.53 1.5 1.5c.3.3.77.3 1.06 0z" clip-rule="evenodd" />
+            </svg>
+          </div>
+        </div>
+        <div style="height: 0.5rem" aria-hidden="true"></div>
+        <p>You can close this tab and return to your app.</p>
+      </div>
     </main>
   </body>
 </html>`,{headers:{"cache-control":`no-store`,"content-type":`text/html; charset=utf-8`},status:200})}export{buildAuthorizationCompletePage};

package/dist/src/runtime/framework-channels/index.js

@@ -1 +1 @@
-import{localDev,placeholderAuth,vercelOidc}from"#public/channels/auth.js";import{isHttpRouteDefinition}from"#channel/routes.js";import{eveChannel}from"#public/channels/eve.js";import{getConnectionCallbackChannelDefinitions,getConnectionCallbackChannelNames}from"#runtime/connections/callback-route.js";import{getSessionCallbackChannelDefinitions,getSessionCallbackChannelNames}from"#runtime/session-callback-route.js";function getFrameworkChannelDefinitions(){let r=eveChannel({auth:[vercelOidc(),localDev(),placeholderAuth()]}),i=[];for(let e of r.routes)isHttpRouteDefinition(e)&&i.push({name:`eve`,method:e.method.toUpperCase(),urlPath:e.path,cors:r.cors,fetch:async(t,n)=>e.handler(t,n),handler:e.handler,adapter:r.adapter,turnPolicy:r.turnPolicy,logicalPath:`framework://channels/${e.path}`,sourceId:`eve:framework:${e.method.toLowerCase()}-${e.path}`,sourceKind:`module`});return i.push(...getConnectionCallbackChannelDefinitions(),...getSessionCallbackChannelDefinitions()),i}function getAllFrameworkChannelNames(){return new Set([`eve`,...getConnectionCallbackChannelNames(),...getSessionCallbackChannelNames()])}export{getAllFrameworkChannelNames,getFrameworkChannelDefinitions};
+import{localDev,placeholderAuth,vercelOidc}from"#public/channels/auth.js";import{isHttpRouteDefinition}from"#channel/routes.js";import{eveChannel}from"#public/channels/eve.js";import{getConnectionCallbackChannelDefinitions,getConnectionCallbackChannelNames}from"#runtime/connections/callback-route.js";import{getSessionCallbackChannelDefinitions,getSessionCallbackChannelNames}from"#runtime/session-callback-route.js";import{getTaskInputResponseChannelDefinitions,getTaskInputResponseChannelNames}from"#runtime/task-input-response-route.js";function getFrameworkChannelDefinitions(){let r=eveChannel({auth:[vercelOidc(),localDev(),placeholderAuth()]}),i=[];for(let e of r.routes)isHttpRouteDefinition(e)&&i.push({name:`eve`,method:e.method.toUpperCase(),urlPath:e.path,cors:r.cors,fetch:async(t,n)=>e.handler(t,n),handler:e.handler,adapter:r.adapter,turnPolicy:r.turnPolicy,logicalPath:`framework://channels/${e.path}`,sourceId:`eve:framework:${e.method.toLowerCase()}-${e.path}`,sourceKind:`module`});return i.push(...getConnectionCallbackChannelDefinitions(),...getSessionCallbackChannelDefinitions(),...getTaskInputResponseChannelDefinitions()),i}function getAllFrameworkChannelNames(){return new Set([`eve`,...getConnectionCallbackChannelNames(),...getSessionCallbackChannelNames(),...getTaskInputResponseChannelNames()])}export{getAllFrameworkChannelNames,getFrameworkChannelDefinitions};

package/dist/src/runtime/framework-tools/index.js

@@ -1 +1 @@
-import{ConnectionRegistryKey}from"#context/providers/connection-key.js";import{ReadFileStateKey}from"#runtime/framework-tools/file-state.js";import{TODO_TOOL_DEFINITION,TodoStateKey}from"#runtime/framework-tools/todo.js";import{AGENT_TOOL_DEFINITION}from"#runtime/framework-tools/agent.js";import{ASK_QUESTION_TOOL_DEFINITION}from"#runtime/framework-tools/ask-question.js";import{WEB_SEARCH_TOOL_DEFINITION}from"#runtime/framework-tools/web-search.js";import{BASH_TOOL_DEFINITION}from"#runtime/framework-tools/bash.js";import{GLOB_TOOL_DEFINITION}from"#runtime/framework-tools/glob.js";import{GREP_TOOL_DEFINITION}from"#runtime/framework-tools/grep.js";import{READ_FILE_TOOL_DEFINITION}from"#runtime/framework-tools/read-file.js";import{SKILL_TOOL_DEFINITION,createSkillToolDefinition}from"#runtime/framework-tools/skill.js";import{WEB_FETCH_TOOL_DEFINITION}from"#runtime/framework-tools/web-fetch.js";import{WRITE_FILE_TOOL_DEFINITION}from"#runtime/framework-tools/write-file.js";import connectionSearchDynamicDefinition from"#runtime/framework-tools/connection-search-dynamic.js";import{resolveLoadedDynamicToolDefinition}from"#runtime/resolve-dynamic-tool.js";const REGISTERED_FRAMEWORK_DYNAMIC_TOOLS=[{definition:connectionSearchDynamicDefinition,logicalPath:`eve:framework/connection-search-dynamic`,slug:`connection`,sourceId:`eve:connection-search-dynamic`}],REGISTERED_FRAMEWORK_TOOLS=[ASK_QUESTION_TOOL_DEFINITION,BASH_TOOL_DEFINITION,GLOB_TOOL_DEFINITION,GREP_TOOL_DEFINITION,READ_FILE_TOOL_DEFINITION,WRITE_FILE_TOOL_DEFINITION,TODO_TOOL_DEFINITION,WEB_FETCH_TOOL_DEFINITION,WEB_SEARCH_TOOL_DEFINITION,SKILL_TOOL_DEFINITION],ALL_FRAMEWORK_TOOLS=[...REGISTERED_FRAMEWORK_TOOLS,AGENT_TOOL_DEFINITION];function getFrameworkToolDefinitions(e){let t=e?.authoredSkills;return t===void 0?REGISTERED_FRAMEWORK_TOOLS:REGISTERED_FRAMEWORK_TOOLS.map(e=>e.name===SKILL_TOOL_DEFINITION.name?createSkillToolDefinition(t):e)}function getFrameworkDynamicToolResolvers(){return REGISTERED_FRAMEWORK_DYNAMIC_TOOLS.map(e=>resolveLoadedDynamicToolDefinition(e.definition,{logicalPath:e.logicalPath,slug:e.slug,sourceId:e.sourceId,sourceKind:`module`}))}function getAllFrameworkToolDefinitions(){return ALL_FRAMEWORK_TOOLS}function getAllFrameworkToolNames(){return new Set(ALL_FRAMEWORK_TOOLS.map(e=>e.name))}export{ConnectionRegistryKey,ReadFileStateKey,TodoStateKey,getAllFrameworkToolDefinitions,getAllFrameworkToolNames,getFrameworkDynamicToolResolvers,getFrameworkToolDefinitions};
+import{ConnectionRegistryKey}from"#context/providers/connection-key.js";import{ReadFileStateKey}from"#runtime/framework-tools/file-state.js";import{TODO_TOOL_DEFINITION,TodoStateKey}from"#runtime/framework-tools/todo.js";import{AGENT_TOOL_DEFINITION}from"#runtime/framework-tools/agent.js";import{TASK_TOOL_DEFINITIONS}from"#runtime/framework-tools/tasks.js";import{ASK_QUESTION_TOOL_DEFINITION}from"#runtime/framework-tools/ask-question.js";import{WEB_SEARCH_TOOL_DEFINITION}from"#runtime/framework-tools/web-search.js";import{BASH_TOOL_DEFINITION}from"#runtime/framework-tools/bash.js";import{GLOB_TOOL_DEFINITION}from"#runtime/framework-tools/glob.js";import{GREP_TOOL_DEFINITION}from"#runtime/framework-tools/grep.js";import{READ_FILE_TOOL_DEFINITION}from"#runtime/framework-tools/read-file.js";import{SKILL_TOOL_DEFINITION,createSkillToolDefinition}from"#runtime/framework-tools/skill.js";import{WEB_FETCH_TOOL_DEFINITION}from"#runtime/framework-tools/web-fetch.js";import{WRITE_FILE_TOOL_DEFINITION}from"#runtime/framework-tools/write-file.js";import connectionSearchDynamicDefinition from"#runtime/framework-tools/connection-search-dynamic.js";import{resolveLoadedDynamicToolDefinition}from"#runtime/resolve-dynamic-tool.js";const REGISTERED_FRAMEWORK_DYNAMIC_TOOLS=[{definition:connectionSearchDynamicDefinition,logicalPath:`eve:framework/connection-search-dynamic`,slug:`connection`,sourceId:`eve:connection-search-dynamic`}],REGISTERED_FRAMEWORK_TOOLS=[ASK_QUESTION_TOOL_DEFINITION,BASH_TOOL_DEFINITION,GLOB_TOOL_DEFINITION,GREP_TOOL_DEFINITION,READ_FILE_TOOL_DEFINITION,WRITE_FILE_TOOL_DEFINITION,TODO_TOOL_DEFINITION,WEB_FETCH_TOOL_DEFINITION,WEB_SEARCH_TOOL_DEFINITION,SKILL_TOOL_DEFINITION],ALL_FRAMEWORK_TOOLS=[...REGISTERED_FRAMEWORK_TOOLS,AGENT_TOOL_DEFINITION,...TASK_TOOL_DEFINITIONS];function getFrameworkToolDefinitions(e){let t=e?.authoredSkills;return t===void 0?REGISTERED_FRAMEWORK_TOOLS:REGISTERED_FRAMEWORK_TOOLS.map(e=>e.name===SKILL_TOOL_DEFINITION.name?createSkillToolDefinition(t):e)}function getFrameworkDynamicToolResolvers(){return REGISTERED_FRAMEWORK_DYNAMIC_TOOLS.map(e=>resolveLoadedDynamicToolDefinition(e.definition,{logicalPath:e.logicalPath,slug:e.slug,sourceId:e.sourceId,sourceKind:`module`}))}function getAllFrameworkToolDefinitions(){return ALL_FRAMEWORK_TOOLS}function getAllFrameworkToolNames(){return new Set(ALL_FRAMEWORK_TOOLS.map(e=>e.name))}export{ConnectionRegistryKey,ReadFileStateKey,TodoStateKey,getAllFrameworkToolDefinitions,getAllFrameworkToolNames,getFrameworkDynamicToolResolvers,getFrameworkToolDefinitions};

package/dist/src/runtime/framework-tools/tasks.d.ts

@@ -0,0 +1,95 @@
+import { z } from "#compiled/zod/index.js";
+import type { HarnessToolDefinition } from "#harness/execute-tool.js";
+import type { ResolvedToolDefinition } from "#runtime/types.js";
+/**
+ * Framework task tools for `experimental.tasks`.
+ *
+ * With the flag on, subagent calls return a task receipt instead of
+ * blocking the parent turn; these tools are the model's controls over
+ * that delegated work. `task_peek` and `task_cancel` are
+ * execute-less runtime actions — they need durable session state and
+ * world access, so the runtime-action dispatch step executes them.
+ * `task_sleep` only records a durable pause and executes in-loop.
+ */
+export declare const TASK_PEEK_TOOL_NAME = "task_peek";
+export declare const TASK_CANCEL_TOOL_NAME = "task_cancel";
+export declare const TASK_SEND_TOOL_NAME = "task_send";
+export declare const TASK_SLEEP_TOOL_NAME = "task_sleep";
+/** Every model-visible task tool name, for gating and dispatch matching. */
+export declare const TASK_TOOL_NAMES: ReadonlySet<string>;
+/** Task-control tools executed by the runtime-action dispatch step. */
+export declare const TASK_CONTROL_TOOL_NAMES: ReadonlySet<string>;
+export declare const TASK_PEEK_INPUT_SCHEMA: z.ZodObject<{
+    taskIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const TASK_CANCEL_INPUT_SCHEMA: z.ZodObject<{
+    taskIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const TASK_SEND_INPUT_SCHEMA: z.ZodObject<{
+    message: z.ZodString;
+    taskId: z.ZodString;
+}, z.core.$strict>;
+export declare const TASK_SLEEP_INPUT_SCHEMA: z.ZodObject<{
+    seconds: z.ZodNumber;
+}, z.core.$strict>;
+export declare const TASK_VIEWS_OUTPUT_SCHEMA: z.ZodObject<{
+    tasks: z.ZodArray<z.ZodObject<{
+        inputRequests: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+        lastOutput: z.ZodOptional<z.ZodObject<{
+            data: z.ZodUnknown;
+            type: z.ZodEnum<{
+                error: "error";
+                result: "result";
+            }>;
+        }, z.core.$strip>>;
+        metadata: z.ZodObject<{
+            agentId: z.ZodString;
+            kind: z.ZodLiteral<"subagent">;
+            mode: z.ZodEnum<{
+                local: "local";
+                remote: "remote";
+            }>;
+            name: z.ZodString;
+        }, z.core.$strip>;
+        status: z.ZodEnum<{
+            cancelled: "cancelled";
+            completed: "completed";
+            failed: "failed";
+            input_required: "input_required";
+            working: "working";
+        }>;
+        taskId: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const TASK_SLEEP_OUTPUT_SCHEMA: z.ZodObject<{
+    waitedSeconds: z.ZodNumber;
+}, z.core.$strict>;
+/**
+ * Builds the harness definitions injected when the root agent enables
+ * `experimental.tasks`. Follows the implicit `agent` tool pattern:
+ * inline definitions, no registry entry, session-shape hiding in
+ * advertised-tools, and re-validation at dispatch.
+ */
+export declare function createTaskToolHarnessDefinitions(): readonly HarnessToolDefinition[];
+/**
+ * Whether one node's sessions receive the task tools.
+ *
+ * Mirrors `isImplicitAgentToolAvailable`: the compile step already
+ * rejects `experimental.tasks` on subagents, authored tools with the
+ * same name shadow the framework tool, and `disableTool(name)` removes
+ * individual tools. Root-node self-delegated children share this node's
+ * config, so advertised-tools additionally hides the tools from any
+ * child-shaped session.
+ */
+export declare function isTaskToolAvailable(input: {
+    readonly disabledFrameworkTools: readonly string[];
+    readonly hasAuthoredTool: boolean;
+    readonly tasksEnabled: boolean;
+    readonly toolName: string;
+}): boolean;
+/**
+ * Registry-shaped metadata for the task tools. Not registered in the
+ * tool registry (the harness injects the real definitions per node);
+ * these entries exist so `disableTool(name)` validates the names.
+ */
+export declare const TASK_TOOL_DEFINITIONS: readonly ResolvedToolDefinition[];

package/dist/src/runtime/framework-tools/tasks.js

@@ -0,0 +1 @@
+import{z}from"#compiled/zod/index.js";import{requestTurnSleep}from"#harness/turn-sleep.js";const TASK_PEEK_TOOL_NAME=`task_peek`,TASK_CANCEL_TOOL_NAME=`task_cancel`,TASK_SEND_TOOL_NAME=`task_send`,TASK_SLEEP_TOOL_NAME=`task_sleep`,TASK_TOOL_NAMES=new Set([TASK_PEEK_TOOL_NAME,TASK_CANCEL_TOOL_NAME,TASK_SEND_TOOL_NAME,TASK_SLEEP_TOOL_NAME]),TASK_CONTROL_TOOL_NAMES=new Set([TASK_PEEK_TOOL_NAME,TASK_CANCEL_TOOL_NAME,TASK_SEND_TOOL_NAME]),TASK_IDS_SCHEMA=z.array(z.string().min(1)).min(1).describe(`Task ids from earlier subagent task receipts.`),TASK_PEEK_INPUT_SCHEMA=z.strictObject({taskIds:TASK_IDS_SCHEMA}),TASK_CANCEL_INPUT_SCHEMA=z.strictObject({taskIds:TASK_IDS_SCHEMA}),TASK_SEND_INPUT_SCHEMA=z.strictObject({message:z.string().describe(`Follow-up message for a finished task's agent; starts a new task in the same conversation.`),taskId:z.string().min(1).describe(`Task id from an earlier task receipt.`)}),MAX_SLEEP_SECONDS=Math.floor((2**53-1)/1e3),TASK_SLEEP_INPUT_SCHEMA=z.strictObject({seconds:z.number().positive().max(MAX_SLEEP_SECONDS).describe(`How long to wait, in seconds.`)}),TASK_VIEW_SCHEMA=z.object({inputRequests:z.array(z.unknown()).optional(),lastOutput:z.object({data:z.unknown(),type:z.enum([`result`,`error`])}).optional(),metadata:z.object({agentId:z.string(),kind:z.literal(`subagent`),mode:z.enum([`local`,`remote`]),name:z.string()}),status:z.enum([`working`,`input_required`,`completed`,`failed`,`cancelled`]),taskId:z.string()}),TASK_VIEWS_OUTPUT_SCHEMA=z.object({tasks:z.array(TASK_VIEW_SCHEMA)}),TASK_SLEEP_OUTPUT_SCHEMA=z.strictObject({waitedSeconds:z.number().positive()}),TASK_PEEK_DESCRIPTION=`Read the current state of one or more background tasks without waiting. Returns each task's status and, for finished tasks, its output. Does not wake or change the task.`,TASK_CANCEL_DESCRIPTION=`Request cooperative cancellation of one or more background tasks. Cancellation is final: a task that finishes after you cancel it stays cancelled. Cancelling an already-finished task changes nothing.`,TASK_SEND_DESCRIPTION=`Send a follow-up message to a finished background task's agent. This starts a new task in the same conversation and returns its receipt. Human input for an input_required task is routed directly through the parent channel. A task that is still working cannot receive sends.`,TASK_SLEEP_DESCRIPTION=`Pause durably before continuing, for paced background-task checks. Does not read or change any task; follow it with task_peek.`;function createTaskToolHarnessDefinitions(){return[{description:TASK_PEEK_DESCRIPTION,inputSchema:TASK_PEEK_INPUT_SCHEMA,name:TASK_PEEK_TOOL_NAME,outputSchema:TASK_VIEWS_OUTPUT_SCHEMA,runtimeAction:{kind:`task-control`}},{description:TASK_CANCEL_DESCRIPTION,inputSchema:TASK_CANCEL_INPUT_SCHEMA,name:TASK_CANCEL_TOOL_NAME,outputSchema:TASK_VIEWS_OUTPUT_SCHEMA,runtimeAction:{kind:`task-control`}},{description:TASK_SEND_DESCRIPTION,inputSchema:TASK_SEND_INPUT_SCHEMA,name:TASK_SEND_TOOL_NAME,runtimeAction:{kind:`task-control`}},{description:TASK_SLEEP_DESCRIPTION,execute:async e=>(requestTurnSleep(Math.ceil(e.seconds*1e3)),{waitedSeconds:e.seconds}),inputSchema:TASK_SLEEP_INPUT_SCHEMA,name:TASK_SLEEP_TOOL_NAME,outputSchema:TASK_SLEEP_OUTPUT_SCHEMA}]}function isTaskToolAvailable(e){return e.tasksEnabled&&!e.disabledFrameworkTools.includes(e.toolName)&&!e.hasAuthoredTool}function createResolvedTaskToolStub(e){return{description:e.description,inputSchema:null,logicalPath:`eve:framework/${e.name}`,name:e.name,sourceId:`eve:${e.name}-tool`,sourceKind:`module`}}const TASK_TOOL_DEFINITIONS=[createResolvedTaskToolStub({description:TASK_PEEK_DESCRIPTION,name:TASK_PEEK_TOOL_NAME}),createResolvedTaskToolStub({description:TASK_CANCEL_DESCRIPTION,name:TASK_CANCEL_TOOL_NAME}),createResolvedTaskToolStub({description:TASK_SEND_DESCRIPTION,name:TASK_SEND_TOOL_NAME}),createResolvedTaskToolStub({description:TASK_SLEEP_DESCRIPTION,name:TASK_SLEEP_TOOL_NAME})];export{TASK_CANCEL_INPUT_SCHEMA,TASK_CANCEL_TOOL_NAME,TASK_CONTROL_TOOL_NAMES,TASK_PEEK_INPUT_SCHEMA,TASK_PEEK_TOOL_NAME,TASK_SEND_INPUT_SCHEMA,TASK_SEND_TOOL_NAME,TASK_SLEEP_INPUT_SCHEMA,TASK_SLEEP_OUTPUT_SCHEMA,TASK_SLEEP_TOOL_NAME,TASK_TOOL_DEFINITIONS,TASK_TOOL_NAMES,TASK_VIEWS_OUTPUT_SCHEMA,createTaskToolHarnessDefinitions,isTaskToolAvailable};

package/dist/src/runtime/prompt/compose.d.ts

@@ -13,6 +13,7 @@ interface ComposeRuntimeBasePromptInput {
      * continuation and the `<agents>` listing.
      */
     persistentSubagentSessions?: boolean;
+    tasksEnabled?: boolean;
     skills?: readonly ResolvedSkillDefinition[];
     subagentsAvailable?: boolean;
     toolsAvailable?: boolean;

package/dist/src/runtime/prompt/compose.js

@@ -1,4 +1,4 @@
 import{formatAvailableSkillsSection}from"#execution/skills/instructions.js";import{createWorkspacePromptSection}from"#runtime/workspace/spec.js";import{formatConnectionsSection}from"#runtime/prompt/connections.js";function composeRuntimeBasePrompt(e){return[...createInstructionsPromptBlocks(e.instructions),...createWorkspacePromptBlocks(e.workspaceSpec),...e.toolsAvailable?[`Tool execution
-A single tool or subagent call runs as one serial action. If you call multiple independent tools or subagents in one response, eve treats that batch as parallel work. Only batch work that is independent and does not rely on another call in the same response.`]:[],...e.subagentsAvailable&&e.persistentSubagentSessions?["Agent messaging\nAgents you have already delegated to stay available after they answer. eve injects the current `<agents>` list into the conversation as a note labeled `[Agents]`; it is added automatically by the framework, not written by the user, and never requires a reply. The list is only a record of those existing agents — their `agentId`, name, and latest status. It does not limit which subagent tools you can call: your tool list is the source of truth, and any subagent tool can always be called without `agentId` to start a new agent, including when the `<agents>` list is empty or absent. Pass `agentId` to the same subagent tool only to continue one of those existing agents' sessions."]:[],...createConnectionsPromptBlocks(e.connections),...createSkillsPromptBlocks(e.skills)]}function createInstructionsPromptBlocks(e){let t=(e??[]).filter(e=>e.role===`system`&&e.content.trim().length>0);if(t.length===0)return[];let n=t.length===1?t[0]:void 0;return[`Instructions (${n!==void 0&&!n.sourceId.startsWith(`ext:`)&&!n.sourceId.startsWith(`ext-override:`)?n.name:`instructions`})\n${t.map(e=>e.content).join(`
+A single tool or subagent call runs as one serial action. If you call multiple independent tools or subagents in one response, eve treats that batch as parallel work. Only batch work that is independent and does not rely on another call in the same response.`]:[],...e.subagentsAvailable&&e.persistentSubagentSessions?[e.tasksEnabled?"Agent messaging\nAgents you have already delegated to remain visible in the framework-authored `<agents>` conversation note. `availability=busy` means the listed task still owns that agent session: use task_peek, task_send, or task_cancel with its taskId instead of starting a continuation. `availability=available` means no nonterminal task owns the session, so you may pass agentId to the same subagent tool to continue it. Calling a subagent without agentId always starts a new agent session.":"Agent messaging\nAgents you have already delegated to stay available after they answer. eve injects the current `<agents>` list into the conversation as a note labeled `[Agents]`; it is added automatically by the framework, not written by the user, and never requires a reply. The list is only a record of those existing agents — their `agentId`, name, and latest status. It does not limit which subagent tools you can call: your tool list is the source of truth, and any subagent tool can always be called without `agentId` to start a new agent, including when the `<agents>` list is empty or absent. Pass `agentId` to the same subagent tool only to continue one of those existing agents' sessions."]:[],...createConnectionsPromptBlocks(e.connections),...createSkillsPromptBlocks(e.skills)]}function createInstructionsPromptBlocks(e){let t=(e??[]).filter(e=>e.role===`system`&&e.content.trim().length>0);if(t.length===0)return[];let n=t.length===1?t[0]:void 0;return[`Instructions (${n!==void 0&&!n.sourceId.startsWith(`ext:`)&&!n.sourceId.startsWith(`ext-override:`)?n.name:`instructions`})\n${t.map(e=>e.content).join(`
 
 `).trim()}`]}function createWorkspacePromptBlocks(e){if(e===void 0)return[];let n=createWorkspacePromptSection(e);return n===void 0?[]:[n]}function createConnectionsPromptBlocks(e){return!e||e.length===0?[]:[formatConnectionsSection(e)]}function createSkillsPromptBlocks(t){if(!t||t.length===0)return[];let n=formatAvailableSkillsSection(t);return n===null?[]:[n]}export{composeRuntimeBasePrompt};

package/dist/src/runtime/resolve-agent-graph.js

@@ -1 +1 @@
-import{expectObjectRecord}from"#internal/authored-module.js";import{ROOT_COMPILED_AGENT_NODE_ID}from"#compiler/manifest.js";import{createRuntimeSubagentRegistry}from"#runtime/subagents/registry.js";import{LOAD_SKILL_TOOL_NAME}from"#runtime/skills/fragment-context.js";import{createRuntimeToolRegistry}from"#runtime/tools/registry.js";import{ROOT_RUNTIME_AGENT_NODE_ID}from"#runtime/graph.js";import{WORKFLOW_TOOL_NAME}from"#shared/workflow-sandbox.js";import{getAllFrameworkChannelNames,getFrameworkChannelDefinitions}from"#runtime/framework-channels/index.js";import{getAllFrameworkToolNames,getFrameworkDynamicToolResolvers,getFrameworkToolDefinitions}from"#runtime/framework-tools/index.js";import{resolveAgent}from"#runtime/resolve-agent.js";import{loadResolvedModuleExport}from"#runtime/resolve-helpers.js";import{createResolvedRuntimeTurnAgent}from"#runtime/agent/bootstrap.js";import{createRuntimeHookRegistry}from"#runtime/hooks/registry.js";import{resolveDynamicSubagentDefinition}from"#runtime/resolve-dynamic-subagent.js";import{createRuntimeSandboxRegistry}from"#runtime/sandbox/registry.js";var ResolveRuntimeAgentGraphError=class extends Error{logicalPath;nodeId;sourceId;constructor(e,t={}){super(e),this.name=`ResolveRuntimeAgentGraphError`,t.logicalPath!==void 0&&(this.logicalPath=t.logicalPath),t.nodeId!==void 0&&(this.nodeId=t.nodeId),t.sourceId!==void 0&&(this.sourceId=t.sourceId)}};async function resolveRuntimeAgentGraph(e){let n=new Map,r=createChildNodeIdsByParentNodeId(e.manifest),i=new Map(e.manifest.subagents.map(e=>[e.nodeId,e]));return{nodesByNodeId:n,root:await resolveRuntimeAgentNode({childNodeIdsByParentNodeId:r,manifest:e.manifest,moduleMap:e.moduleMap,nodeId:ROOT_COMPILED_AGENT_NODE_ID,nodesByNodeId:n,subagentNodesById:i})}}async function resolveRuntimeAgentNode(e){let t=toRuntimeNodeId(e.nodeId);if(e.nodesByNodeId.has(t))throw new ResolveRuntimeAgentGraphError(`Found multiple runtime agent nodes for node id "${t}".`,{nodeId:t,sourceId:e.sourceId});let a=await resolveAgent({manifest:e.manifest,moduleMap:e.moduleMap,nodeId:e.nodeId}),o=getFrameworkToolDefinitions({authoredSkills:a.skills}),s=new Set(o.map(e=>e.name)),c=getAllFrameworkToolNames(),l=new Set(a.tools.map(e=>e.name));for(let n of a.disabledFrameworkTools)if(!c.has(n))throw new ResolveRuntimeAgentGraphError(`agent/tools/${n}.ts exports disableTool() but "${n}" is not a framework tool. Rename the file to one of: ${[...c].sort().join(`, `)}.`,{nodeId:t,sourceId:e.sourceId});let u=new Set(a.disabledFrameworkTools),d=await createRuntimeToolRegistry({tools:[...o.filter(e=>!l.has(e.name)&&!u.has(e.name)),...a.tools]},{reservedToolNames:[WORKFLOW_TOOL_NAME,...s.has(LOAD_SKILL_TOOL_NAME)||l.has(LOAD_SKILL_TOOL_NAME)?[]:[LOAD_SKILL_TOOL_NAME]]}),f=new Set(a.channels.map(e=>e.name)),p=getAllFrameworkChannelNames();for(let n of a.disabledFrameworkChannels)if(!p.has(n))throw new ResolveRuntimeAgentGraphError(`agent/channels/${n}.ts exports disableRoute() but "${n}" is not a framework channel. Rename the file to one of: ${[...p].sort().join(`, `)}.`,{nodeId:t,sourceId:e.sourceId});let m=new Set(a.disabledFrameworkChannels),h=[...getFrameworkChannelDefinitions().filter(e=>!f.has(e.name)&&!m.has(e.name)),...a.channels],g=createRuntimeSandboxRegistry({authoredSandbox:a.sandbox,workspaceResourceRoot:a.workspaceResourceRoot}),_=createRuntimeSubagentRegistry({persistentSessions:a.config?.experimental?.subagentPersistentSessions===!0,reservedToolNames:[LOAD_SKILL_TOOL_NAME,...d.preparedTools.map(e=>e.name)],subagents:await resolveRuntimeSubagents({childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,manifest:e.manifest,moduleMap:e.moduleMap,nodesByNodeId:e.nodesByNodeId,parentNodeId:e.nodeId,subagentNodesById:e.subagentNodesById})}),v={...a,dynamicToolResolvers:[...a.dynamicToolResolvers,...getFrameworkDynamicToolResolvers()]},y={agent:v,channels:h,hookRegistry:createRuntimeHookRegistry(v.hooks),nodeId:t,sandboxRegistry:g,sourceId:e.sourceId,subagentRegistry:_,toolRegistry:d,turnAgent:createResolvedRuntimeTurnAgent({agent:v,id:e.agentId,nodeId:t,tools:[...d.preparedTools,..._.preparedTools]})};return e.nodesByNodeId.set(t,y),y}async function resolveRuntimeSubagents(e){let t=[],n=e.childNodeIdsByParentNodeId.get(e.parentNodeId)??[];for(let r of n){let n=e.subagentNodesById.get(r);if(n===void 0)throw new ResolveRuntimeAgentGraphError(`Missing compiled subagent node "${r}" while resolving runtime subagents.`,{nodeId:toRuntimeNodeId(e.parentNodeId),sourceId:r});t.push(await resolveRuntimeSubagent({childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,moduleMap:e.moduleMap,nodesByNodeId:e.nodesByNodeId,sourceRef:n,subagentNodesById:e.subagentNodesById}))}for(let n of e.manifest.remoteAgents)t.push(await resolveRuntimeRemoteAgent({moduleMap:e.moduleMap,nodeScopeId:e.parentNodeId,sourceRef:n}));return t}async function resolveRuntimeSubagent(e){let t={...e.sourceRef.configResolver===void 0?{description:e.sourceRef.description}:{dynamic:await resolveDynamicSubagentDefinition({definition:e.sourceRef.configResolver,moduleMap:e.moduleMap,nodeId:e.sourceRef.nodeId})},kind:`subagent`,logicalPath:e.sourceRef.logicalPath,name:e.sourceRef.name,nodeId:toRuntimeNodeId(e.sourceRef.nodeId),sourceId:e.sourceRef.sourceId,sourceKind:`module`};return await resolveRuntimeAgentNode({agentId:e.sourceRef.name,childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,manifest:e.sourceRef.agent,moduleMap:e.moduleMap,nodeId:e.sourceRef.nodeId,nodesByNodeId:e.nodesByNodeId,sourceId:e.sourceRef.sourceId,subagentNodesById:e.subagentNodesById}),t}async function resolveRuntimeRemoteAgent(t){let n=expectObjectRecord(await loadResolvedModuleExport({definition:t.sourceRef,kindLabel:`remote agent`,moduleMap:t.moduleMap,nodeId:t.nodeScopeId}),`Expected remote agent source "${t.sourceRef.logicalPath}" to export an object.`),r={description:t.sourceRef.description,kind:`remote`,logicalPath:t.sourceRef.logicalPath,name:t.sourceRef.name,nodeId:toRuntimeNodeId(t.sourceRef.nodeId),outputSchema:t.sourceRef.outputSchema,path:t.sourceRef.path,sourceId:t.sourceRef.sourceId,sourceKind:`module`,url:await resolveRemoteAgentUrl({bakedUrl:t.sourceRef.url,logicalPath:t.sourceRef.logicalPath,resolvedUrl:n.url})};typeof n.auth==`function`&&(r.auth=n.auth),n.forwardPrincipal===!0&&(r.forwardPrincipal=!0);let i=resolveRemoteAgentHeaders(n.headers);return i!==void 0&&(r.headers=i),r}async function resolveRemoteAgentUrl(e){if(typeof e.resolvedUrl==`function`){let t=await e.resolvedUrl();if(typeof t!=`string`||t.length===0)throw Error(`Remote agent "${e.logicalPath}" url function must return a non-empty string.`);return t}let t=e.bakedUrl??(typeof e.resolvedUrl==`string`?e.resolvedUrl:``);if(t.length===0)throw Error(`Remote agent "${e.logicalPath}" is missing a url.`);return t}function resolveRemoteAgentHeaders(e){if(e===void 0)return;if(typeof e==`function`)return e;if(typeof e!=`object`||!e||Array.isArray(e))return;let t={};for(let[n,r]of Object.entries(e))typeof r==`string`&&(t[n]=r);return t}function createChildNodeIdsByParentNodeId(e){let t=new Map;for(let n of e.subagentEdges){let e=t.get(n.parentNodeId);if(e===void 0){t.set(n.parentNodeId,[n.childNodeId]);continue}e.push(n.childNodeId)}return t}function toRuntimeNodeId(e){return e===ROOT_COMPILED_AGENT_NODE_ID?ROOT_RUNTIME_AGENT_NODE_ID:e}export{resolveRuntimeAgentGraph};
+import{expectObjectRecord}from"#internal/authored-module.js";import{ROOT_COMPILED_AGENT_NODE_ID}from"#compiler/manifest.js";import{createRuntimeSubagentRegistry}from"#runtime/subagents/registry.js";import{LOAD_SKILL_TOOL_NAME}from"#runtime/skills/fragment-context.js";import{createRuntimeToolRegistry}from"#runtime/tools/registry.js";import{ROOT_RUNTIME_AGENT_NODE_ID}from"#runtime/graph.js";import{WORKFLOW_TOOL_NAME}from"#shared/workflow-sandbox.js";import{getAllFrameworkChannelNames,getFrameworkChannelDefinitions}from"#runtime/framework-channels/index.js";import{getAllFrameworkToolNames,getFrameworkDynamicToolResolvers,getFrameworkToolDefinitions}from"#runtime/framework-tools/index.js";import{resolveAgent}from"#runtime/resolve-agent.js";import{loadResolvedModuleExport}from"#runtime/resolve-helpers.js";import{createResolvedRuntimeTurnAgent}from"#runtime/agent/bootstrap.js";import{createRuntimeHookRegistry}from"#runtime/hooks/registry.js";import{resolveDynamicSubagentDefinition}from"#runtime/resolve-dynamic-subagent.js";import{createRuntimeSandboxRegistry}from"#runtime/sandbox/registry.js";var ResolveRuntimeAgentGraphError=class extends Error{logicalPath;nodeId;sourceId;constructor(e,t={}){super(e),this.name=`ResolveRuntimeAgentGraphError`,t.logicalPath!==void 0&&(this.logicalPath=t.logicalPath),t.nodeId!==void 0&&(this.nodeId=t.nodeId),t.sourceId!==void 0&&(this.sourceId=t.sourceId)}};async function resolveRuntimeAgentGraph(e){let n=new Map,r=createChildNodeIdsByParentNodeId(e.manifest),i=new Map(e.manifest.subagents.map(e=>[e.nodeId,e]));return{nodesByNodeId:n,root:await resolveRuntimeAgentNode({childNodeIdsByParentNodeId:r,manifest:e.manifest,moduleMap:e.moduleMap,nodeId:ROOT_COMPILED_AGENT_NODE_ID,nodesByNodeId:n,subagentNodesById:i})}}async function resolveRuntimeAgentNode(e){let t=toRuntimeNodeId(e.nodeId);if(e.nodesByNodeId.has(t))throw new ResolveRuntimeAgentGraphError(`Found multiple runtime agent nodes for node id "${t}".`,{nodeId:t,sourceId:e.sourceId});let a=await resolveAgent({manifest:e.manifest,moduleMap:e.moduleMap,nodeId:e.nodeId}),o=getFrameworkToolDefinitions({authoredSkills:a.skills}),s=new Set(o.map(e=>e.name)),c=getAllFrameworkToolNames(),l=new Set(a.tools.map(e=>e.name));for(let n of a.disabledFrameworkTools)if(!c.has(n))throw new ResolveRuntimeAgentGraphError(`agent/tools/${n}.ts exports disableTool() but "${n}" is not a framework tool. Rename the file to one of: ${[...c].sort().join(`, `)}.`,{nodeId:t,sourceId:e.sourceId});let u=new Set(a.disabledFrameworkTools),d=await createRuntimeToolRegistry({tools:[...o.filter(e=>!l.has(e.name)&&!u.has(e.name)),...a.tools]},{reservedToolNames:[WORKFLOW_TOOL_NAME,...s.has(LOAD_SKILL_TOOL_NAME)||l.has(LOAD_SKILL_TOOL_NAME)?[]:[LOAD_SKILL_TOOL_NAME]]}),f=new Set(a.channels.map(e=>e.name)),p=getAllFrameworkChannelNames();for(let n of a.disabledFrameworkChannels)if(!p.has(n))throw new ResolveRuntimeAgentGraphError(`agent/channels/${n}.ts exports disableRoute() but "${n}" is not a framework channel. Rename the file to one of: ${[...p].sort().join(`, `)}.`,{nodeId:t,sourceId:e.sourceId});let m=new Set(a.disabledFrameworkChannels),h=[...getFrameworkChannelDefinitions().filter(e=>!f.has(e.name)&&!m.has(e.name)),...a.channels],g=createRuntimeSandboxRegistry({authoredSandbox:a.sandbox,workspaceResourceRoot:a.workspaceResourceRoot}),_=createRuntimeSubagentRegistry({persistentSessions:a.config?.experimental?.tasks===!0||a.config?.experimental?.subagentPersistentSessions===!0,reservedToolNames:[LOAD_SKILL_TOOL_NAME,...d.preparedTools.map(e=>e.name)],subagents:await resolveRuntimeSubagents({childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,manifest:e.manifest,moduleMap:e.moduleMap,nodesByNodeId:e.nodesByNodeId,parentNodeId:e.nodeId,subagentNodesById:e.subagentNodesById})}),v={...a,dynamicToolResolvers:[...a.dynamicToolResolvers,...getFrameworkDynamicToolResolvers()]},y={agent:v,channels:h,hookRegistry:createRuntimeHookRegistry(v.hooks),nodeId:t,sandboxRegistry:g,sourceId:e.sourceId,subagentRegistry:_,toolRegistry:d,turnAgent:createResolvedRuntimeTurnAgent({agent:v,id:e.agentId,nodeId:t,tools:[...d.preparedTools,..._.preparedTools]})};return e.nodesByNodeId.set(t,y),y}async function resolveRuntimeSubagents(e){let t=[],n=e.childNodeIdsByParentNodeId.get(e.parentNodeId)??[];for(let r of n){let n=e.subagentNodesById.get(r);if(n===void 0)throw new ResolveRuntimeAgentGraphError(`Missing compiled subagent node "${r}" while resolving runtime subagents.`,{nodeId:toRuntimeNodeId(e.parentNodeId),sourceId:r});t.push(await resolveRuntimeSubagent({childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,moduleMap:e.moduleMap,nodesByNodeId:e.nodesByNodeId,sourceRef:n,subagentNodesById:e.subagentNodesById}))}for(let n of e.manifest.remoteAgents)t.push(await resolveRuntimeRemoteAgent({moduleMap:e.moduleMap,nodeScopeId:e.parentNodeId,sourceRef:n}));return t}async function resolveRuntimeSubagent(e){let t={...e.sourceRef.configResolver===void 0?{description:e.sourceRef.description}:{dynamic:await resolveDynamicSubagentDefinition({definition:e.sourceRef.configResolver,moduleMap:e.moduleMap,nodeId:e.sourceRef.nodeId})},kind:`subagent`,logicalPath:e.sourceRef.logicalPath,name:e.sourceRef.name,nodeId:toRuntimeNodeId(e.sourceRef.nodeId),sourceId:e.sourceRef.sourceId,sourceKind:`module`};return await resolveRuntimeAgentNode({agentId:e.sourceRef.name,childNodeIdsByParentNodeId:e.childNodeIdsByParentNodeId,manifest:e.sourceRef.agent,moduleMap:e.moduleMap,nodeId:e.sourceRef.nodeId,nodesByNodeId:e.nodesByNodeId,sourceId:e.sourceRef.sourceId,subagentNodesById:e.subagentNodesById}),t}async function resolveRuntimeRemoteAgent(t){let n=expectObjectRecord(await loadResolvedModuleExport({definition:t.sourceRef,kindLabel:`remote agent`,moduleMap:t.moduleMap,nodeId:t.nodeScopeId}),`Expected remote agent source "${t.sourceRef.logicalPath}" to export an object.`),r={description:t.sourceRef.description,kind:`remote`,logicalPath:t.sourceRef.logicalPath,name:t.sourceRef.name,nodeId:toRuntimeNodeId(t.sourceRef.nodeId),outputSchema:t.sourceRef.outputSchema,path:t.sourceRef.path,sourceId:t.sourceRef.sourceId,sourceKind:`module`,url:await resolveRemoteAgentUrl({bakedUrl:t.sourceRef.url,logicalPath:t.sourceRef.logicalPath,resolvedUrl:n.url})};typeof n.auth==`function`&&(r.auth=n.auth),n.forwardPrincipal===!0&&(r.forwardPrincipal=!0);let i=resolveRemoteAgentHeaders(n.headers);return i!==void 0&&(r.headers=i),r}async function resolveRemoteAgentUrl(e){if(typeof e.resolvedUrl==`function`){let t=await e.resolvedUrl();if(typeof t!=`string`||t.length===0)throw Error(`Remote agent "${e.logicalPath}" url function must return a non-empty string.`);return t}let t=e.bakedUrl??(typeof e.resolvedUrl==`string`?e.resolvedUrl:``);if(t.length===0)throw Error(`Remote agent "${e.logicalPath}" is missing a url.`);return t}function resolveRemoteAgentHeaders(e){if(e===void 0)return;if(typeof e==`function`)return e;if(typeof e!=`object`||!e||Array.isArray(e))return;let t={};for(let[n,r]of Object.entries(e))typeof r==`string`&&(t[n]=r);return t}function createChildNodeIdsByParentNodeId(e){let t=new Map;for(let n of e.subagentEdges){let e=t.get(n.parentNodeId);if(e===void 0){t.set(n.parentNodeId,[n.childNodeId]);continue}e.push(n.childNodeId)}return t}function toRuntimeNodeId(e){return e===ROOT_COMPILED_AGENT_NODE_ID?ROOT_RUNTIME_AGENT_NODE_ID:e}export{resolveRuntimeAgentGraph};