eve 0.67.2 → 0.69.0

package/dist/src/execution/tools/workflow/withdraw-step.d.ts

@@ -0,0 +1,31 @@
+import { type PublishedSessionEvents, type SessionStepState } from "#execution/publish-session-events.js";
+import { type SessionStateTransition } from "#execution/session/state-delta.js";
+import { type ProxyInputRequest } from "#harness/proxy-input-requests.js";
+/**
+ * Decides a run's request to withdraw a question. A question the session
+ * still offers is retired and relayed `cancelled`, so channels stop offering
+ * it. One it no longer offers was already answered or withdrawn when its turn
+ * was cancelled. Either way the run hears `withdrawn`, after any answer the
+ * session sent it first, so the question resolves from the session's first
+ * decision.
+ */
+export declare function withdrawWorkflowToolRunQuestionStep(input: WithdrawQuestionInput): Promise<SessionStateTransition>;
+type WithdrawQuestionInput = SessionStepState & {
+    readonly control: string;
+    readonly requestId: string;
+    readonly runId: string;
+};
+/**
+ * Withdraws the requests a finished run left open: its own questions and those
+ * of the sessions it opened, which ended with it. Nobody can answer them now,
+ * so each is relayed `cancelled`.
+ */
+export declare function withdrawFinishedRunQuestionsStep(input: SessionStepState & {
+    readonly runId: string;
+}): Promise<SessionStateTransition>;
+/**
+ * Retires the relayed requests `select` picks and relays the `input.resolved`
+ * that reports each one `cancelled`, for a step that owns the session.
+ */
+export declare function relayWithdrawnRequests(input: SessionStepState, select: (requestId: string, route: ProxyInputRequest) => boolean): Promise<PublishedSessionEvents>;
+export {};

package/dist/src/execution/tools/workflow/withdraw-step.js

@@ -0,0 +1 @@
+import{readDurableSession,replaceDurableSessionSnapshot}from"#execution/durable-session-store.js";import{relaySessionEvents}from"#execution/publish-session-events.js";import{withSessionStateDelta}from"#execution/session/state-delta.js";import{withdrawProxyInputRequests}from"#harness/proxy-input-requests.js";import{resumeHook}from"#internal/workflow/runtime.js";import{ignoreGoneTarget}from"#execution/tasks/workflow-target.js";async function withdrawWorkflowToolRunQuestionStep(e){"use step";return await withSessionStateDelta(e,withdrawWorkflowToolRunQuestion)}async function withdrawWorkflowToolRunQuestion(e){let t={kind:`withdrawn`,requestId:e.requestId};return await ignoreGoneTarget(resumeHook(e.control,t)),await relayWithdrawnRequests(e,(t,n)=>t===e.requestId&&n.workflowAsk!==void 0&&n.runId===e.runId)}async function withdrawFinishedRunQuestionsStep(e){"use step";return await withSessionStateDelta(e,e=>relayWithdrawnRequests(e,(t,n)=>n.runId===e.runId))}async function relayWithdrawnRequests(e,t){let n=withdrawProxyInputRequests(readDurableSession(e.sessionState),t);return await relaySessionEvents({serializedContext:e.serializedContext,sessionState:replaceDurableSessionSnapshot({session:n.session,state:e.sessionState}),sessionWritable:e.sessionWritable},n.events)}export{relayWithdrawnRequests,withdrawFinishedRunQuestionsStep,withdrawWorkflowToolRunQuestionStep};

package/dist/src/execution/tools/workflow/workflow-owner-blocking.d.ts

@@ -1,12 +1,10 @@
 import { type ChannelReader } from "#execution/tools/workflow/owner-channels.js";
-import { type WorkflowToolRunMessage, type WorkflowToolRunControlMessage } from "#execution/tools/workflow/messages.js";
+import type { WorkflowToolRunMessage, WorkflowToolRunControlMessage } from "#execution/tools/workflow/messages.js";
 import type { WorkflowToolRunInput } from "#execution/tools/workflow/types.js";
 export interface BlockingWorkflowOwner {
-    readonly kind: "turn";
+    /** The session's commands, from the run's control hook. */
     readonly commands: ChannelReader<"control", WorkflowToolRunControlMessage>;
-    readonly signal: AbortSignal;
-    handleCommand(message: WorkflowToolRunControlMessage): void;
     handleMessage(message: WorkflowToolRunMessage): Promise<void>;
 }
-/** Routes invocation messages to the waiting turn and accepts cancellation. */
+/** The run's link to its session: commands arrive on its control hook, and its messages go to the session's inbox. */
 export declare function createBlockingWorkflow(input: WorkflowToolRunInput): BlockingWorkflowOwner;

package/dist/src/execution/tools/workflow/workflow-owner-blocking.js

@@ -1 +1 @@
-import{createHook}from"#compiled/@workflow/core/index.js";import{resumeHookStep}from"#execution/tools/workflow/resume-hook-step.js";import{isWorkflowToolRunControlMessage}from"#execution/tools/workflow/messages.js";import{createChannelReader}from"#execution/tools/workflow/owner-channels.js";function createBlockingWorkflow(e){let t=new AbortController,n=createHook({token:e.hookToken});return{kind:`turn`,commands:createChannelReader(`control`,n),signal:t.signal,handleCommand(e){isWorkflowToolRunControlMessage(e)&&t.abort(new WorkflowToolRunCancelledError(e.reason))},handleMessage(t){return resumeHookStep(e.owner.inbox,t,{ifPresent:t.kind===`outcome`&&t.result.status===`cancelled`})}}}var WorkflowToolRunCancelledError=class extends Error{constructor(e){super(e),this.name=`WorkflowToolRunCancelledError`}};export{createBlockingWorkflow};
+import{createHook}from"#compiled/@workflow/core/index.js";import{resumeHookStep}from"#execution/tools/workflow/resume-hook-step.js";import{createChannelReader}from"#execution/tools/workflow/owner-channels.js";function createBlockingWorkflow(e){let t=createHook({token:e.hookToken});return{commands:createChannelReader(`control`,t),handleMessage(t){return resumeHookStep(e.owner.inbox,t,{ifPresent:t.kind===`outcome`&&t.result.status===`cancelled`})}}}export{createBlockingWorkflow};

package/dist/src/execution/tools/workflow/workflow.d.ts

@@ -1,3 +1,3 @@
-import type { BackgroundWorkflowToolRunInput, WorkflowToolRunInput } from "#execution/tools/workflow/types.js";
-/** Owns admission, command intake, body execution, and settlement for either lifetime. */
-export declare function workflowToolRunWorkflow(input: WorkflowToolRunInput | BackgroundWorkflowToolRunInput): Promise<void>;
+import type { WorkflowToolRunInput } from "#execution/tools/workflow/types.js";
+/** Owns command intake, body execution, and settlement for one workflow tool call. */
+export declare function workflowToolRunWorkflow(input: WorkflowToolRunInput): Promise<void>;

package/dist/src/execution/tools/workflow/workflow.js

@@ -1 +1 @@
-import{sleep}from"#compiled/@workflow/core/index.js";import{normalizeSerializableError}from"#execution/workflow-errors.js";import{openWorkflowToolRunOwnerInbox}from"#execution/tools/workflow/owner.js";import{WORKFLOW_CANCELLATION_CLEANUP_MS}from"#execution/tools/workflow/cancellation-policy.js";import{createChannelReader,raceChannelReads}from"#execution/tools/workflow/owner-channels.js";import{createWorkflowBodyRef,executeWorkflowBody}from"#execution/tools/workflow/body.js";import{createBackgroundWorkflowOwner}from"#execution/tools/workflow/workflow-owner-background.js";import{createBlockingWorkflow}from"#execution/tools/workflow/workflow-owner-blocking.js";async function workflowToolRunWorkflow(e){"use workflow";let t=`workflow`in e?await createBackgroundWorkflowOwner(e):createBlockingWorkflow(e);if(t===void 0)return;let n=`workflow`in e?{...e.workflow,execution:`background`}:{...e,execution:e.execution??`blocking`},{signal:r}=t,i=t.kind===`turn`,a=!0,o,s=0,c,l,u;for(;;){if(i&&r.aborted){if(o===void 0)break;l??=sleep(WORKFLOW_CANCELLATION_CLEANUP_MS).then(()=>`cancel`)}if(c!==void 0&&s>=c.reportCount&&t.commands.landed.length===0&&t.commands.failure===void 0){u=c.outcome;break}let e;try{if(i&&o===void 0){let e=openWorkflowToolRunOwnerInbox();o={inbox:e,reader:createChannelReader(`body`,awaitBodyResult(executeWorkflowBody({...n,owner:e.owner},r)))}}let s=[];a&&s.push(t.commands),o!==void 0&&(s.push(o.inbox.reader),c===void 0&&s.push(o.reader)),e=await raceChannelReads(s,l)}catch(e){if(t.commands.failure!==void 0)throw e;u={status:`failed`,error:normalizeSerializableError(e)};break}if(e===`cancel`)break;if(e.next.done){if(e.channel===`control`){a=!1;continue}if(e.channel===`body`){u={status:`failed`,error:`Workflow body ended without an outcome.`};break}if(i&&r.aborted)break;return}if(e.channel===`control`){if(t.kind!==`turn`)throw Error(`Session-owned workflow run received a turn command.`);t.handleCommand(e.next.value);continue}if(e.channel===`commands`){if(t.kind!==`session`)throw Error(`Turn-owned workflow run received a task command.`);let n=e.next.value;if(i&&n.kind===`task-command`&&(n.command.kind===`ready`||n.command.kind===`reject-dispatch`))continue;let r=await t.handleCommand(n);if(r===`stop`)return;r===`start`&&(i=!0);continue}if(e.channel===`body`){c=e.next.value;continue}e.next.value.kind!==`outcome`&&(e.next.value.kind===`report`&&(s+=1),await t.handleMessage(e.next.value))}r.aborted&&(u={status:`cancelled`,reason:r.reason instanceof Error?r.reason.message:String(r.reason??``)}),u!==void 0&&await t.handleMessage({from:createWorkflowBodyRef(n),kind:`outcome`,result:u})}async function*awaitBodyResult(e){yield await e}workflowToolRunWorkflow.workflowId=`workflow//eve//workflowToolRunWorkflow`;export{workflowToolRunWorkflow};
+import{sleep}from"#compiled/@workflow/core/index.js";import{normalizeSerializableError}from"#execution/workflow-errors.js";import{openWorkflowToolRunOwnerInbox}from"#execution/tools/workflow/owner.js";import{WORKFLOW_CANCELLATION_CLEANUP_MS}from"#execution/tools/workflow/cancellation-policy.js";import{resumeHookStep}from"#execution/tools/workflow/resume-hook-step.js";import{createChannelReader,raceChannelReads}from"#execution/tools/workflow/owner-channels.js";import{createWorkflowBodyRef,startCallBody}from"#execution/tools/workflow/body.js";import{isWorkflowToolRunAskDecision,isWorkflowToolRunControlMessage}from"#execution/tools/workflow/messages.js";import{createBlockingWorkflow}from"#execution/tools/workflow/workflow-owner-blocking.js";import{startServeBody}from"#execution/tools/workflow/serve.js";async function workflowToolRunWorkflow(e){"use workflow";let t=createBlockingWorkflow(e),n=openWorkflowToolRunOwnerInbox();e.entry.entryPoint!==`execute`&&await reportTaskStarted(e);let r=startWorkflowBody({...e,owner:n.owner}),i=r.control.runSignal,a=createChannelReader(`body`,awaitBodyOutcome(r.outcome)),o=!0,s=0,c,l,u;try{for(;;){if(r.control.unwinding&&(l??=sleep(WORKFLOW_CANCELLATION_CLEANUP_MS).then(()=>`cancel`)),c!==void 0&&s>=n.owner.sent&&t.commands.landed.length===0&&t.commands.failure===void 0){u=c;break}let e;try{let r=[];o&&r.push(t.commands),r.push(n.reader),c===void 0&&r.push(a),e=await raceChannelReads(r,l)}catch(e){if(t.commands.failure!==void 0)throw e;u={status:`failed`,error:normalizeSerializableError(e)};break}if(e===`cancel`){if(!r.control.unwinding){l=void 0;continue}i.aborted||r.control.apply({kind:`end`,reason:`The task was cancelled and its serve body didn't return to receive() within 30 seconds.`});break}if(e.next.done){if(e.channel===`control`){o=!1;continue}if(e.channel===`body`){u={status:`failed`,error:`Workflow body ended without an outcome.`};break}if(i.aborted)break;return}if(e.channel===`control`){r.control.unwinding||(l=void 0),applyControlMessage(r,e.next.value);continue}if(e.channel===`body`){c=e.next.value;continue}let d=e.next.value;d.kind!==`outcome`&&(s+=1,await t.handleMessage(d))}}finally{await r.close()}if(i.aborted&&(u={status:`cancelled`,reason:i.reason instanceof Error?i.reason.message:String(i.reason??``)}),u!==void 0){let n=r.usage.total();await t.handleMessage({from:createWorkflowBodyRef(e),kind:`outcome`,result:u,...n!==void 0&&{usage:n}})}}async function reportTaskStarted(e){await resumeHookStep(e.owner.inbox,{from:createWorkflowBodyRef(e),kind:`started`},{ifPresent:!0})}function applyControlMessage(e,t){if(isWorkflowToolRunControlMessage(t)){if(isWorkflowToolRunAskDecision(t)){e.asks.settle(t);return}e.control.apply(t)}}function startWorkflowBody(e){switch(e.entry.entryPoint){case`execute`:case`task`:return startCallBody(e);case`serve`:return startServeBody(e)}}async function*awaitBodyOutcome(e){yield await e}workflowToolRunWorkflow.workflowId=`workflow//eve//workflowToolRunWorkflow`;export{workflowToolRunWorkflow};

package/dist/src/execution/web-fetch/request.js

@@ -1 +1 @@
-import{isLoopbackHostname,isPrivateOrReservedIpAddress}from"#shared/network-address.js";import{isIP}from"node:net";import{lookup}from"node:dns";const REDIRECT_STATUSES=new Set([301,302,303,307,308]),UNSAFE_DESTINATION_ERROR=`URL must not target localhost, private, link-local, or reserved IP addresses.`;async function requestPublicUrl(e,t){let n=parseHttpsUrl(e);for(let e=0;;e++){let{dispatcher:r,response:i}=await requestOnce(n,t);try{let r=i.headers.get(`location`);if(r!==null&&REDIRECT_STATUSES.has(i.status)&&e<10){await cancelResponseBody(i),n=parseHttpsUrl(new URL(r,n).toString());continue}return await consumeResponse(i,t.maxResponseSize)}finally{await r.close()}}}function parseHttpsUrl(e){let t;try{t=new URL(e)}catch{throw Error(`URL must be a valid absolute https:// URL.`)}if(t.protocol!==`https:`)throw Error(`URL must start with https://`);return t}async function requestOnce(e,t){assertPublicHostname(e.hostname);let{Agent:n,Dispatcher1Wrapper:r}=await import(`undici`),i=new r(new n({connect:{lookup:createPublicLookup()}}));try{return{dispatcher:i,response:await fetchWithDispatcher(e,{dispatcher:i,headers:t.headers,redirect:`manual`,signal:t.signal})}}catch(e){throw await i.close(),e}}function fetchWithDispatcher(e,t){return fetch(e,t)}function assertPublicHostname(e){let t=e.replace(/^\[(.*)\]$/u,`$1`);if(isIP(t)!==0){assertPublicAddress(t);return}if(isLoopbackHostname(t))throw Error(UNSAFE_DESTINATION_ERROR)}function assertPublicAddress(e){if(isPrivateOrReservedIpAddress(e))throw Error(UNSAFE_DESTINATION_ERROR)}function createPublicLookup(){return(e,t,n)=>{lookup(e,{all:!0,verbatim:!0},(r,i)=>{if(r!==null){n(r,``,0);return}try{for(let{address:e}of i)assertPublicAddress(e)}catch(e){n(e,``,0);return}let a=t.family===void 0||t.family===0?i:i.filter(({family:e})=>e===t.family);if(a.length===0){let t=Error(`Unable to resolve URL hostname "${e}" in the requested IP family.`);Object.assign(t,{code:`ENOTFOUND`}),n(t,``,0);return}if(t.all===!0){n(null,a);return}let o=a[0];n(null,o.address,o.family)})}}async function consumeResponse(e,t){let n=parseContentLength(e.headers.get(`content-length`));if(n!==void 0&&n>t)throw await cancelResponseBody(e),createResponseTooLargeError();let r=await readBoundedBody(e,t),i=r.byteLength===0?null:Uint8Array.from(r).buffer;return new Response(i,{headers:e.headers,status:e.status,statusText:e.statusText})}function parseContentLength(e){if(e===null)return;let t=Number.parseInt(e,10);return Number.isFinite(t)&&t>=0?t:void 0}async function readBoundedBody(e,t){if(e.body===null)return new Uint8Array;let n=e.body.getReader(),r=[],i=0;try{for(;;){let{done:e,value:a}=await n.read();if(e)break;if(i+=a.byteLength,i>t)throw await n.cancel(),createResponseTooLargeError();r.push(a)}}finally{n.releaseLock()}let a=new Uint8Array(i),o=0;for(let e of r)a.set(e,o),o+=e.byteLength;return a}async function cancelResponseBody(e){try{await e.body?.cancel()}catch{}}function createResponseTooLargeError(){return Error(`Response too large (exceeds 5 MB limit).`)}export{requestPublicUrl};
+import{isIP}from"node:net";import{isLoopbackHostname,isPrivateOrReservedIpAddress}from"#shared/network-address.js";import{lookup}from"node:dns";const REDIRECT_STATUSES=new Set([301,302,303,307,308]),UNSAFE_DESTINATION_ERROR=`URL must not target localhost, private, link-local, or reserved IP addresses.`;async function requestPublicUrl(e,t){let n=parseHttpsUrl(e);for(let e=0;;e++){let{dispatcher:r,response:i}=await requestOnce(n,t);try{let r=i.headers.get(`location`);if(r!==null&&REDIRECT_STATUSES.has(i.status)&&e<10){await cancelResponseBody(i),n=parseHttpsUrl(new URL(r,n).toString());continue}return await consumeResponse(i,t.maxResponseSize)}finally{await r.close()}}}function parseHttpsUrl(e){let t;try{t=new URL(e)}catch{throw Error(`URL must be a valid absolute https:// URL.`)}if(t.protocol!==`https:`)throw Error(`URL must start with https://`);return t}async function requestOnce(e,t){assertPublicHostname(e.hostname);let{Agent:n,Dispatcher1Wrapper:r}=await import(`undici`),i=new r(new n({connect:{lookup:createPublicLookup()}}));try{return{dispatcher:i,response:await fetchWithDispatcher(e,{dispatcher:i,headers:t.headers,redirect:`manual`,signal:t.signal})}}catch(e){throw await i.close(),e}}function fetchWithDispatcher(e,t){return fetch(e,t)}function assertPublicHostname(e){let t=e.replace(/^\[(.*)\]$/u,`$1`);if(isIP(t)!==0){assertPublicAddress(t);return}if(isLoopbackHostname(t))throw Error(UNSAFE_DESTINATION_ERROR)}function assertPublicAddress(e){if(isPrivateOrReservedIpAddress(e))throw Error(UNSAFE_DESTINATION_ERROR)}function createPublicLookup(){return(e,t,n)=>{lookup(e,{all:!0,verbatim:!0},(r,i)=>{if(r!==null){n(r,``,0);return}try{for(let{address:e}of i)assertPublicAddress(e)}catch(e){n(e,``,0);return}let a=t.family===void 0||t.family===0?i:i.filter(({family:e})=>e===t.family);if(a.length===0){let t=Error(`Unable to resolve URL hostname "${e}" in the requested IP family.`);Object.assign(t,{code:`ENOTFOUND`}),n(t,``,0);return}if(t.all===!0){n(null,a);return}let o=a[0];n(null,o.address,o.family)})}}async function consumeResponse(e,t){let n=parseContentLength(e.headers.get(`content-length`));if(n!==void 0&&n>t)throw await cancelResponseBody(e),createResponseTooLargeError();let r=await readBoundedBody(e,t),i=r.byteLength===0?null:Uint8Array.from(r).buffer;return new Response(i,{headers:e.headers,status:e.status,statusText:e.statusText})}function parseContentLength(e){if(e===null)return;let t=Number.parseInt(e,10);return Number.isFinite(t)&&t>=0?t:void 0}async function readBoundedBody(e,t){if(e.body===null)return new Uint8Array;let n=e.body.getReader(),r=[],i=0;try{for(;;){let{done:e,value:a}=await n.read();if(e)break;if(i+=a.byteLength,i>t)throw await n.cancel(),createResponseTooLargeError();r.push(a)}}finally{n.releaseLock()}let a=new Uint8Array(i),o=0;for(let e of r)a.set(e,o),o+=e.byteLength;return a}async function cancelResponseBody(e){try{await e.body?.cancel()}catch{}}function createResponseTooLargeError(){return Error(`Response too large (exceeds 5 MB limit).`)}export{requestPublicUrl};

package/dist/src/execution/workflow-callback-url.d.ts

@@ -28,8 +28,3 @@ export declare function resolveWorkflowCallbackBaseUrl(metadataUrl: string): str
  * `new URL(path, base)` would drop for absolute paths.
  */
 export declare function createWorkflowCallbackUrl(baseUrl: string, callbackPath: string): string;
-/**
- * Builds a callback to a remote task child without disclosing this deployment's
- * protection bypass secret to an authored external origin.
- */
-export declare function createRemoteTaskInputCallbackUrl(baseUrl: string, callbackPath: string): string;

package/dist/src/execution/workflow-callback-url.js

@@ -1 +1 @@
-import{joinEveRoutePath}from"#shared/eve-route-path.js";import{EVE_PUBLIC_ROUTE_PREFIX_ENV,normalizePublicRoutePrefix}from"#shared/public-route-prefix.js";const VERCEL_PROTECTION_BYPASS_QUERY=`x-vercel-protection-bypass`,VERCEL_CALLBACK_HOST_ENVS=[`VERCEL_URL`,`VERCEL_BRANCH_URL`,`VERCEL_PROJECT_PRODUCTION_URL`];function resolveVercelProductionCallbackBaseUrl(){return process.env.VERCEL_ENV===`production`&&process.env.VERCEL_PROJECT_PRODUCTION_URL?`https://${process.env.VERCEL_PROJECT_PRODUCTION_URL}`:null}function resolveWorkflowCallbackBaseUrl(e){let t=process.env.WORKFLOW_LOCAL_BASE_URL?.trim()||void 0,n=(resolveVercelProductionCallbackBaseUrl()??t??e).replace(/\/$/,``),r=normalizePublicRoutePrefix(process.env[EVE_PUBLIC_ROUTE_PREFIX_ENV]);return r===void 0?n:`${n}${r}`}function createWorkflowCallbackUrl(e,t){let n=new URL(t,`http://eve.local`),r=new URL(e);r.pathname=joinEveRoutePath(r.pathname,n.pathname),r.search=n.search;let i=process.env.VERCEL_AUTOMATION_BYPASS_SECRET?.trim();return i&&r.searchParams.set(VERCEL_PROTECTION_BYPASS_QUERY,i),r.toString()}function createRemoteTaskInputCallbackUrl(e,t){let n=new URL(t,`http://eve.local`),r=new URL(e);r.pathname=joinEveRoutePath(r.pathname,n.pathname),r.search=n.search;let i=process.env.VERCEL_AUTOMATION_BYPASS_SECRET?.trim(),a=VERCEL_CALLBACK_HOST_ENVS.some(e=>process.env[e]?.trim().toLowerCase()===r.hostname.toLowerCase());return i&&r.protocol===`https:`&&a&&r.searchParams.set(VERCEL_PROTECTION_BYPASS_QUERY,i),r.toString()}export{createRemoteTaskInputCallbackUrl,createWorkflowCallbackUrl,resolveVercelProductionCallbackBaseUrl,resolveWorkflowCallbackBaseUrl};
+import{joinEveRoutePath}from"#shared/eve-route-path.js";import{EVE_PUBLIC_ROUTE_PREFIX_ENV,normalizePublicRoutePrefix}from"#shared/public-route-prefix.js";function resolveVercelProductionCallbackBaseUrl(){return process.env.VERCEL_ENV===`production`&&process.env.VERCEL_PROJECT_PRODUCTION_URL?`https://${process.env.VERCEL_PROJECT_PRODUCTION_URL}`:null}function resolveWorkflowCallbackBaseUrl(e){let t=process.env.WORKFLOW_LOCAL_BASE_URL?.trim()||void 0,n=(resolveVercelProductionCallbackBaseUrl()??t??e).replace(/\/$/,``),r=normalizePublicRoutePrefix(process.env[EVE_PUBLIC_ROUTE_PREFIX_ENV]);return r===void 0?n:`${n}${r}`}function createWorkflowCallbackUrl(e,t){let n=new URL(t,`http://eve.local`),r=new URL(e);r.pathname=joinEveRoutePath(r.pathname,n.pathname),r.search=n.search;let i=process.env.VERCEL_AUTOMATION_BYPASS_SECRET?.trim();return i&&r.searchParams.set(`x-vercel-protection-bypass`,i),r.toString()}export{createWorkflowCallbackUrl,resolveVercelProductionCallbackBaseUrl,resolveWorkflowCallbackBaseUrl};

package/dist/src/execution/workflow-runtime.d.ts

@@ -1,4 +1,4 @@
-import type { CancelTurnInput, CancelTurnResult, DeliverHookPayload, Runtime } from "#channel/types.js";
+import type { CancelTurnInput, CancelTurnResult, DeliverHookPayload, DispatchSessionInput, Runtime, SessionCommand, SessionCommandResult } from "#channel/types.js";
 import { type Run, type StartOptionsWithoutDeploymentId, type WorkflowFunction, type WorkflowMetadata } from "#internal/workflow/runtime.js";
 import type { RuntimeCompiledArtifactsSource } from "#runtime/compiled-artifacts-source.js";
 import type { SessionCheckpoint } from "#execution/session/handoff.js";
@@ -19,10 +19,6 @@ export declare const workflowEntryReference: {
 export declare const sessionTimeoutWorkflowReference: {
     workflowId: string;
 };
-/** Stable workflow reference for root-session activity collectors. */
-export declare const activityCollectorWorkflowReference: {
-    workflowId: string;
-};
 /** Stable workflow reference for authored workflow tool runs. */
 export declare const workflowToolRunWorkflowReference: {
     workflowId: string;
@@ -46,6 +42,8 @@ export interface SessionOwnerStartInput {
 }
 /** Starts a successor owner and binds its output to the original session stream. */
 export declare function startSessionOwnerStep(input: SessionOwnerStartInput): Promise<void>;
+/** Sends one command to a session through its stable command inbox. */
+export declare function dispatchWorkflowSessionCommand<TCommand extends SessionCommand>(input: DispatchSessionInput<TCommand>): Promise<SessionCommandResult<TCommand>>;
 /** Requests cancellation through a session's stable command inbox. */
 export declare function requestWorkflowTurnCancellation(input: CancelTurnInput): Promise<CancelTurnResult>;
 /**

package/dist/src/execution/workflow-runtime.js

@@ -1 +1 @@
-import{randomBytes}from"node:crypto";import{createEveActivityRoutePath}from"#protocol/routes.js";import{createLogger,logError}from"#internal/logging.js";import{getChannelActivityPresentation}from"#channel/activity-renderer.js";import{sessionCommandHookToken,sessionInboxHookToken}from"#execution/session-inbox/address.js";import{ActivityObserverKey}from"#context/keys.js";import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{walkCauseChain}from"#shared/errors.js";import{normalizePersistedMessageStreamEvent}from"#protocol/message-version.js";import{cancelRun,getHookByToken,getRun,getWorld,start}from"#internal/workflow/runtime.js";import{serializeContext}from"#context/serialize.js";import{resolveEffectiveAgentRuntime}from"#execution/effective-agent-config.js";import{EntityConflictError,HookNotFoundError,RunExpiredError,WorkflowRunNotFoundError}from"#compiled/@workflow/errors/index.js";import{AcceptedSessionIdentityError,resolveSessionInbox,resumeSessionInbox}from"#execution/session-inbox/resume.js";import{getCompiledRuntimeAgentBundle}from"#runtime/sessions/compiled-agent-cache.js";import{buildSessionAttributes,buildSubagentRootAttributes,readParentLineage}from"#execution/eve-workflow-attributes.js";import{ROOT_RUNTIME_AGENT_NODE_ID}from"#runtime/graph.js";import{initializeSessionInstrumentation}from"#instrumentation/runtime.js";import{createWorkflowCallbackUrl,resolveWorkflowCallbackBaseUrl}from"#execution/workflow-callback-url.js";import{context,trace}from"#compiled/@opentelemetry/api/index.js";import{normalizeEveAttributes}from"#runtime/attributes/normalize.js";import{buildRunContext}from"#execution/runtime-context.js";import{parseNdjsonStream}from"#execution/ndjson-stream.js";import{SESSION_HANDOFF_VERSION}from"#execution/session/entry-input.js";import{buildInvocationAttributes}from"#internal/invocation/metadata.js";import{isAgentTraceContext}from"#tracing/agent-trace-context.js";import{ACTIVITY_COLLECTOR_WORKFLOW_NAME,SESSION_TIMEOUT_WORKFLOW_NAME,WORKFLOW_ENTRY_NAME,WORKFLOW_TOOL_RUN_WORKFLOW_NAME}from"#execution/stable-workflow-names.js";const EVE_PACKAGE_INFO=resolveInstalledPackageInfo(),COMMAND_HOOK_READY_TIMEOUT_MS=3e4,STABLE_ID_BASE=EVE_PACKAGE_INFO.name,log=createLogger(`execution.workflow-runtime`),workflowEntryReference={workflowId:`workflow//${STABLE_ID_BASE}//${WORKFLOW_ENTRY_NAME}`},sessionTimeoutWorkflowReference={workflowId:`workflow//${STABLE_ID_BASE}//${SESSION_TIMEOUT_WORKFLOW_NAME}`},activityCollectorWorkflowReference={workflowId:`workflow//${STABLE_ID_BASE}//${ACTIVITY_COLLECTOR_WORKFLOW_NAME}`},workflowToolRunWorkflowReference={workflowId:`workflow//${STABLE_ID_BASE}//${WORKFLOW_TOOL_RUN_WORKFLOW_NAME}`};function createWorkflowRuntime(e){return{async createSession(t){let n=await getCompiledRuntimeAgentBundle({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:e.nodeId}),r=buildRunContext({bundle:n,dynamicSubagentAgentConfig:e.dynamicSubagentAgentConfig,run:t}),i=resolveEffectiveAgentRuntime(n,r);initializeSessionInstrumentation({agentName:i.turnAgent.id,ctx:r});let a=i.limits?.sessionTimeoutMs,o=n.resolvedAgent.config?.experimental?.workflow?.retention,s,c=t.activityObserver;if(t.parent===void 0&&c===void 0&&(getChannelActivityPresentation(t.adapter)?.renderers.length??0)>0){let e=serializeContext(r),t=randomBytes(32).toString(`base64url`),n={expiresAt:new Date(Date.now()+(typeof a==`number`?a:864e5)).toISOString(),serializedContext:e,token:t};try{s=(await startWorkflowOnCurrentDeployment(activityCollectorWorkflowReference,[n],{experimental_retention:o})).runId;let e=process.env.VERCEL_URL?`https://${process.env.VERCEL_URL}`:`http://localhost:3000`,i=resolveWorkflowCallbackBaseUrl(e);c={sink:{url:createWorkflowCallbackUrl(i,createEveActivityRoutePath(t)),version:1}},r.set(ActivityObserverKey,c)}catch{await cancelActivityCollector(s),s=void 0,log.warn(`failed to start activity collector`)}}let l=serializeContext(r),u=readParentLineage(l),d={kind:`initial`,input:t.input,ownerDeploymentId:await resolveCurrentWorkflowDeploymentId(),serializedContext:l},f=t.taskId??t.callback?.taskId;t.limits!==void 0&&(d.limits=t.limits),f!==void 0&&(d.taskId=f),s!==void 0&&(d.activityCollectorRunId=s),t.continuationConflictCommand!==void 0&&(d.continuationConflictCommand=t.continuationConflictCommand),a!==void 0&&(d.sessionTimeoutMs=a),o!==void 0&&(d.retention=o);let p={...u.sessionId===void 0?buildSessionAttributes({serializedContext:l}):buildSubagentRootAttributes({identity:{nodeId:n.nodeId??ROOT_RUNTIME_AGENT_NODE_ID},parentCallId:u.callId,parentSessionId:u.sessionId,parentTurnId:u.turnId,rootSessionId:u.rootSessionId??u.sessionId,serializedContext:l}),...t.externalInvocation===void 0?{}:buildInvocationAttributes(t.externalInvocation)},m;try{let e={allowReservedAttributes:!0,attributes:normalizeEveAttributes(p)};o!==void 0&&(e.experimental_retention=o),m=await startWorkflowOnDeployment(workflowEntryReference,[d],d.ownerDeploymentId,e)}catch(e){throw await cancelActivityCollector(s),logError(log,`failed to start workflow run`,e,{continuationToken:t.continuationToken}),e}let h,getEvents=()=>(h??=parseNdjsonStream(()=>getRun(m.runId).getReadable(),normalizePersistedEvent),h);return{get events(){return getEvents()},sessionId:m.runId}},async dispatchContinuation(e){return await dispatchWorkflowCommand(e.continuationToken,e.command)},async dispatchSession(e){return await dispatchWorkflowCommand({sessionId:e.sessionId},e.command)},async getEventStream(e,t){return parseNdjsonStream(()=>getRun(e).getReadable({startIndex:t?.startIndex}),normalizePersistedEvent)},async getStreamTailIndex(e){let t=getRun(e).getReadable();try{return await t.getTailIndex()}finally{await t.cancel().catch(()=>{})}},async resolveContinuation(e){try{return await resolveSessionInbox(e)}catch(t){if(HookNotFoundError.is(t))return;throw logError(log,`failed to resolve session by continuation token`,t,{continuationToken:e}),t}}}}async function startSessionOwnerStep(e){"use step";let t={activationToken:e.activationToken,checkpoint:e.checkpoint,delivery:e.delivery,handoffVersion:SESSION_HANDOFF_VERSION,kind:`handoff`,ownerDeploymentId:e.targetDeploymentId,sessionWritable:getRun(e.anchorRunId).getWritable(),sessionId:e.anchorRunId};await startWorkflowOnDeployment(workflowEntryReference,[t],e.targetDeploymentId,e.checkpoint.retention===void 0?void 0:{experimental_retention:e.checkpoint.retention})}function normalizePersistedEvent(e){return normalizePersistedMessageStreamEvent(e)}async function cancelActivityCollector(e){if(e!==void 0)try{await cancelRun(await getWorld(),e,{cancelReason:`Root session creation did not complete`})}catch{log.warn(`failed to cancel unowned activity collector`)}}async function dispatchWorkflowCommand(e,t){let n;try{let r=await resumeSessionInbox(e,t);n={runId:r.ownerRunId,sessionId:await r.sessionId}}catch(n){if(isInactiveCommandTarget(n)){if(t.kind===`send`&&typeof e!=`string`)try{let t=await getRun(e.sessionId).status;if(t===`pending`||t===`running`)return{status:`session_not_active`,retryable:!0}}catch(e){if(!isInactiveCommandTarget(e))throw e}return inactiveCommandResult(t)}throw logError(log,`failed to dispatch session command`,n,{command:t.kind,token:e}),n}if(t.kind===`reset`){let t=typeof e==`string`?e:sessionCommandHookToken(e.sessionId),r=new Set([sessionCommandHookToken(n.sessionId),t]);await Promise.all([...r].map(e=>waitForHookRelease(sessionInboxHookToken(e),n.runId)))}return activeCommandResult(t,n.sessionId)}function activeCommandResult(e,t){return e.kind===`reset`?{previousSessionId:t,status:`reset`}:e.kind===`send`&&e.delivery!==void 0?{sessionId:t,status:`accepted`,deliveryId:e.delivery.deliveryId}:{sessionId:t,status:`accepted`}}function inactiveCommandResult(e){return e.kind===`send`?{status:`session_not_active`}:e.kind===`cancel`?{status:`no_active_turn`}:{status:`no_active_session`}}async function requestWorkflowTurnCancellation(e){let t={kind:`cancel`};return e.taskId!==void 0&&(t.taskId=e.taskId),e.tasks!==void 0&&(t.tasks=e.tasks),e.turnId!==void 0&&(t.turnId=e.turnId),await dispatchWorkflowCommand({sessionId:e.sessionId},t)}function isInactiveCommandTarget(e){if(e instanceof AcceptedSessionIdentityError)return!1;if(HookNotFoundError.is(e))return!0;for(let t of walkCauseChain(e))if(WorkflowRunNotFoundError.is(t)||RunExpiredError.is(t)||EntityConflictError.is(t))return!0;return!1}async function waitForCommandHookOwner(e){let t=Date.now()+COMMAND_HOOK_READY_TIMEOUT_MS;for(;;)try{return normalizeWorkflowHook(await getHookByToken(e))}catch(e){if(!HookNotFoundError.is(e)||Date.now()>=t)throw e;await new Promise(e=>setTimeout(e,20))}}async function waitForHookRelease(e,t){let n=Date.now()+COMMAND_HOOK_READY_TIMEOUT_MS;for(;;){try{if(normalizeWorkflowHook(await getHookByToken(e)).runId!==t)return}catch(e){if(HookNotFoundError.is(e))return;throw e}if(Date.now()>=n)throw Error(`Timed out waiting for session "${t}" to release inbox "${e}".`);await new Promise(e=>setTimeout(e,20))}}async function startWorkflowOnCurrentDeployment(e,t,n){return await startWorkflowOnDeployment(e,t,await resolveCurrentWorkflowDeploymentId(),n)}async function startWorkflowOnDeployment(e,t,n,r){return await withWorkflowStartContext(async()=>{if(n.length===0||n===`latest`)throw Error(`Workflow starts require an exact deployment id.`);return await start(e,t,{...r,deploymentId:n})})}async function resolveCurrentWorkflowDeploymentId(){let e=process.env.VERCEL_DEPLOYMENT_ID?.trim()||await(await getWorld()).getDeploymentId();if(e.length===0||e===`latest`)throw Error(`Workflow runtime could not resolve an exact deployment id.`);return e}async function withWorkflowStartContext(e){let t=context.active(),n=isAgentTraceContext(t)?trace.deleteSpan(t):t;return await context.with(n,e)}function normalizeWorkflowHook(e){if(typeof e!=`object`||!e||!(`runId`in e))throw Error(`Workflow hook did not include a run id.`);let t=e.runId;if(typeof t!=`string`||t.length===0)throw Error(`Workflow hook did not include a run id.`);return{runId:t}}export{activityCollectorWorkflowReference,createWorkflowRuntime,requestWorkflowTurnCancellation,sessionTimeoutWorkflowReference,startSessionOwnerStep,startWorkflowOnCurrentDeployment,waitForCommandHookOwner,workflowEntryReference,workflowToolRunWorkflowReference};
+import{createLogger,logError}from"#internal/logging.js";import{sessionCommandHookToken,sessionInboxHookToken}from"#execution/session-inbox/address.js";import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{walkCauseChain}from"#shared/errors.js";import{getCompiledRuntimeAgentBundle}from"#runtime/sessions/compiled-agent-cache.js";import{ROOT_RUNTIME_AGENT_NODE_ID}from"#runtime/graph.js";import{serializeContext}from"#context/serialize.js";import{AcceptedSessionIdentityError,resolveSessionInbox,resumeSessionInbox}from"#execution/session-inbox/resume.js";import{resolveEffectiveAgentRuntime}from"#execution/effective-agent-config.js";import{EntityConflictError,HookNotFoundError,RunExpiredError,WorkflowRunNotFoundError}from"#compiled/@workflow/errors/index.js";import{getHookByToken,getRun,getWorld,start}from"#internal/workflow/runtime.js";import{initializeSessionInstrumentation}from"#instrumentation/runtime.js";import{buildSessionAttributes,buildSubagentRootAttributes,readParentLineage}from"#execution/eve-workflow-attributes.js";import{context,trace}from"#compiled/@opentelemetry/api/index.js";import{normalizeEveAttributes}from"#runtime/attributes/normalize.js";import{buildRunContext}from"#execution/runtime-context.js";import{readSessionEventStream,readSessionStreamTailIndex}from"#execution/session-event-stream.js";import{SESSION_HANDOFF_VERSION}from"#execution/session/entry-input.js";import{buildInvocationAttributes}from"#internal/invocation/metadata.js";import{isAgentTraceContext}from"#tracing/agent-trace-context.js";import{SESSION_TIMEOUT_WORKFLOW_NAME,WORKFLOW_ENTRY_NAME,WORKFLOW_TOOL_RUN_WORKFLOW_NAME}from"#execution/stable-workflow-names.js";const EVE_PACKAGE_INFO=resolveInstalledPackageInfo(),COMMAND_HOOK_READY_TIMEOUT_MS=3e4,STABLE_ID_BASE=EVE_PACKAGE_INFO.name,log=createLogger(`execution.workflow-runtime`),workflowEntryReference={workflowId:`workflow//${STABLE_ID_BASE}//${WORKFLOW_ENTRY_NAME}`},sessionTimeoutWorkflowReference={workflowId:`workflow//${STABLE_ID_BASE}//${SESSION_TIMEOUT_WORKFLOW_NAME}`},workflowToolRunWorkflowReference={workflowId:`workflow//${STABLE_ID_BASE}//${WORKFLOW_TOOL_RUN_WORKFLOW_NAME}`};function createWorkflowRuntime(e){return{async createSession(t){let n=await getCompiledRuntimeAgentBundle({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:e.nodeId}),r=buildRunContext({bundle:n,dynamicSubagentAgentConfig:e.dynamicSubagentAgentConfig,run:t}),i=resolveEffectiveAgentRuntime(n,r);initializeSessionInstrumentation({agentName:i.turnAgent.id,ctx:r});let a=i.limits?.sessionTimeoutMs,o=n.resolvedAgent.config?.experimental?.workflow?.retention,s=serializeContext(r),c=readParentLineage(s),l={kind:`initial`,input:t.input,ownerDeploymentId:await resolveCurrentWorkflowDeploymentId(),serializedContext:s};t.limits!==void 0&&(l.limits=t.limits),t.continuationConflictCommand!==void 0&&(l.continuationConflictCommand=t.continuationConflictCommand),a!==void 0&&(l.sessionTimeoutMs=a),o!==void 0&&(l.retention=o);let u={...c.sessionId===void 0?buildSessionAttributes({serializedContext:s}):buildSubagentRootAttributes({identity:{nodeId:n.nodeId??ROOT_RUNTIME_AGENT_NODE_ID},parentCallId:c.callId,parentSessionId:c.sessionId,parentTurnId:c.turnId,rootSessionId:c.rootSessionId??c.sessionId,serializedContext:s}),...t.externalInvocation===void 0?{}:buildInvocationAttributes(t.externalInvocation)},d;try{let e={allowReservedAttributes:!0,attributes:normalizeEveAttributes(u)};o!==void 0&&(e.experimental_retention=o),d=await startWorkflowOnDeployment(workflowEntryReference,[l],l.ownerDeploymentId,e)}catch(e){throw logError(log,`failed to start workflow run`,e,{continuationToken:t.continuationToken}),e}let f,getEvents=()=>(f??=readSessionEventStream(d.runId),f);return{get events(){return getEvents()},sessionId:d.runId}},async dispatchContinuation(e){return await dispatchWorkflowCommand(e.continuationToken,e.command)},async dispatchSession(e){return await dispatchWorkflowSessionCommand(e)},async getEventStream(e,t){return readSessionEventStream(e,t?.startIndex)},async getStreamTailIndex(e){return await readSessionStreamTailIndex(e)},async resolveContinuation(e){try{return await resolveSessionInbox(e)}catch(t){if(HookNotFoundError.is(t))return;throw logError(log,`failed to resolve session by continuation token`,t,{continuationToken:e}),t}}}}async function startSessionOwnerStep(e){"use step";let t={activationToken:e.activationToken,checkpoint:e.checkpoint,delivery:e.delivery,handoffVersion:SESSION_HANDOFF_VERSION,kind:`handoff`,ownerDeploymentId:e.targetDeploymentId,sessionWritable:getRun(e.anchorRunId).getWritable(),sessionId:e.anchorRunId};await startWorkflowOnDeployment(workflowEntryReference,[t],e.targetDeploymentId,e.checkpoint.retention===void 0?void 0:{experimental_retention:e.checkpoint.retention})}async function dispatchWorkflowCommand(e,t){let n;try{let r=await resumeSessionInbox(e,t);n={runId:r.ownerRunId,sessionId:await r.sessionId}}catch(n){if(isInactiveCommandTarget(n)){if(t.kind===`send`&&typeof e!=`string`)try{let t=await getRun(e.sessionId).status;if(t===`pending`||t===`running`)return{status:`session_not_active`,retryable:!0}}catch(e){if(!isInactiveCommandTarget(e))throw e}return inactiveCommandResult(t)}throw logError(log,`failed to dispatch session command`,n,{command:t.kind,token:e}),n}if(t.kind===`reset`){let t=typeof e==`string`?e:sessionCommandHookToken(e.sessionId),r=new Set([sessionCommandHookToken(n.sessionId),t]);await Promise.all([...r].map(e=>waitForHookRelease(sessionInboxHookToken(e),n.runId)))}return activeCommandResult(t,n.sessionId)}function activeCommandResult(e,t){return e.kind===`reset`?{previousSessionId:t,status:`reset`}:e.kind===`send`&&e.delivery!==void 0?{sessionId:t,status:`accepted`,deliveryId:e.delivery.deliveryId}:{sessionId:t,status:`accepted`}}function inactiveCommandResult(e){return e.kind===`send`?{status:`session_not_active`}:e.kind===`cancel`?{status:`no_active_turn`}:{status:`no_active_session`}}async function dispatchWorkflowSessionCommand(e){return await dispatchWorkflowCommand({sessionId:e.sessionId},e.command)}async function requestWorkflowTurnCancellation(e){let t={kind:`cancel`};return e.turnId!==void 0&&(t.turnId=e.turnId),await dispatchWorkflowCommand({sessionId:e.sessionId},t)}function isInactiveCommandTarget(e){if(e instanceof AcceptedSessionIdentityError)return!1;if(HookNotFoundError.is(e))return!0;for(let t of walkCauseChain(e))if(WorkflowRunNotFoundError.is(t)||RunExpiredError.is(t)||EntityConflictError.is(t))return!0;return!1}async function waitForCommandHookOwner(e){let t=Date.now()+COMMAND_HOOK_READY_TIMEOUT_MS;for(;;)try{return normalizeWorkflowHook(await getHookByToken(e))}catch(e){if(!HookNotFoundError.is(e)||Date.now()>=t)throw e;await new Promise(e=>setTimeout(e,20))}}async function waitForHookRelease(e,t){let n=Date.now()+COMMAND_HOOK_READY_TIMEOUT_MS;for(;;){try{if(normalizeWorkflowHook(await getHookByToken(e)).runId!==t)return}catch(e){if(HookNotFoundError.is(e))return;throw e}if(Date.now()>=n)throw Error(`Timed out waiting for session "${t}" to release inbox "${e}".`);await new Promise(e=>setTimeout(e,20))}}async function startWorkflowOnCurrentDeployment(e,t,n){return await startWorkflowOnDeployment(e,t,await resolveCurrentWorkflowDeploymentId(),n)}async function startWorkflowOnDeployment(e,t,n,r){return await withWorkflowStartContext(async()=>{if(n.length===0||n===`latest`)throw Error(`Workflow starts require an exact deployment id.`);return await start(e,t,{...r,deploymentId:n})})}async function resolveCurrentWorkflowDeploymentId(){let e=process.env.VERCEL_DEPLOYMENT_ID?.trim()||await(await getWorld()).getDeploymentId();if(e.length===0||e===`latest`)throw Error(`Workflow runtime could not resolve an exact deployment id.`);return e}async function withWorkflowStartContext(e){let t=context.active(),n=isAgentTraceContext(t)?trace.deleteSpan(t):t;return await context.with(n,e)}function normalizeWorkflowHook(e){if(typeof e!=`object`||!e||!(`runId`in e))throw Error(`Workflow hook did not include a run id.`);let t=e.runId;if(typeof t!=`string`||t.length===0)throw Error(`Workflow hook did not include a run id.`);return{runId:t}}export{createWorkflowRuntime,dispatchWorkflowSessionCommand,requestWorkflowTurnCancellation,sessionTimeoutWorkflowReference,startSessionOwnerStep,startWorkflowOnCurrentDeployment,waitForCommandHookOwner,workflowEntryReference,workflowToolRunWorkflowReference};

package/dist/src/execution/workflow-webhook-route.js

@@ -1 +1 @@
-import{walkCauseChain}from"#shared/errors.js";import{resumeWebhook}from"#internal/workflow/runtime.js";import{HookNotFoundError}from"#compiled/@workflow/errors/index.js";const WORKFLOW_WEBHOOK_ROUTE_PATTERN=`/.well-known/workflow/v1/webhook/:token`;async function handleWorkflowWebhookRequest(e,t){let n=t.params.token;if(typeof n!=`string`||n.length===0)return Response.json({error:`Missing webhook token.`,ok:!1},{status:400});try{let t=new Request(e.url,{method:e.method,headers:new Headers(e.headers),body:e.body,signal:e.signal,duplex:`half`});return await resumeWebhook(n,t)}catch(e){for(let t of walkCauseChain(e))if(HookNotFoundError.is(t))return Response.json({error:`Webhook not pending.`,ok:!1},{status:404});throw e}}export{WORKFLOW_WEBHOOK_ROUTE_PATTERN,handleWorkflowWebhookRequest};
+import{walkCauseChain}from"#shared/errors.js";import{HookNotFoundError}from"#compiled/@workflow/errors/index.js";import{resumeWebhook}from"#internal/workflow/runtime.js";const WORKFLOW_WEBHOOK_ROUTE_PATTERN=`/.well-known/workflow/v1/webhook/:token`;async function handleWorkflowWebhookRequest(e,t){let n=t.params.token;if(typeof n!=`string`||n.length===0)return Response.json({error:`Missing webhook token.`,ok:!1},{status:400});try{let t=new Request(e.url,{method:e.method,headers:new Headers(e.headers),body:e.body,signal:e.signal,duplex:`half`});return await resumeWebhook(n,t)}catch(e){for(let t of walkCauseChain(e))if(HookNotFoundError.is(t))return Response.json({error:`Webhook not pending.`,ok:!1},{status:404});throw e}}export{WORKFLOW_WEBHOOK_ROUTE_PATTERN,handleWorkflowWebhookRequest};

package/dist/src/extensions/code/extension/lib/connect-authentication.js

@@ -1 +1 @@
-import"../extension.js";import{ConnectError,ConnectorInstallationRequiredError,getToken}from"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/token.js";import"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/index.js";import{authenticateVercel}from"./credentials.js";async function authenticateTurn(e,t,n=getToken){if(e.vercel===void 0)return;let r=await t(),i=await resolveToken(e.vercel.connector,{subject:{type:`app`}},n);await authenticateVercel(r,{token:i,delivery:e.vercel.delivery,broker:e.broker})}async function resolveToken(e,t,n){try{let r=await n(e,t);if(r.length===0)throw Error(`Connect returned an empty token`);return r}catch(t){let n=t instanceof ConnectorInstallationRequiredError?`connector installation is required`:t instanceof ConnectError?`Connect rejected the token request`:`Connect token request failed`,r=t instanceof Error?t.message:String(t);throw Error(`${n} for ${JSON.stringify(e)}: ${r}`,{cause:t})}}export{authenticateTurn};
+import"../extension.js";import{authenticateVercel}from"./credentials.js";import{ConnectError,ConnectorInstallationRequiredError,getToken}from"#compiled/@vercel/connect/index.js";async function authenticateTurn(e,t,n=getToken){if(e.vercel===void 0)return;let r=await t(),i=await resolveToken(e.vercel.connector,{subject:{type:`app`}},n);await authenticateVercel(r,{token:i,delivery:e.vercel.delivery,broker:e.broker})}async function resolveToken(e,t,n){try{let r=await n(e,t);if(r.length===0)throw Error(`Connect returned an empty token`);return r}catch(t){let n=t instanceof ConnectorInstallationRequiredError?`connector installation is required`:t instanceof ConnectError?`Connect rejected the token request`:`Connect token request failed`,r=t instanceof Error?t.message:String(t);throw Error(`${n} for ${JSON.stringify(e)}: ${r}`,{cause:t})}}export{authenticateTurn};

package/dist/src/extensions/code/extension/lib/github-shell.js

@@ -1 +1 @@
-import{getToken}from"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/token.js";import"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/index.js";import{shellQuote}from"./shell.js";import{toolingPaths}from"./tooling.js";import{validateRepositoryRoot}from"./repository-root.js";import{posix}from"node:path";const MAX_OUTPUT_BYTES=1e5,leaseQueues=new Map,ALLOWED_GIT_REMOTE_COMMANDS=new Set([`fetch`,`ls-remote`,`pull`,`push`]);function githubShellApproval(e){if(!e)return`not-applicable`;try{return validateGitHubShellInput(e),`not-applicable`}catch(e){return{type:`denied`,reason:e instanceof Error?e.message:`Invalid GitHub command.`}}}async function executeGitHubShell(e,t,n){if(!t)throw Error(`GitHub command access is not configured for this agent.`);let r=validateGitHubShellInput(e),i=await n.getSandbox(),a=resolveWorkingDirectory(i,e.workingDirectory);(r[0]===`git`||r[0]===`gh-signed-commit`)&&(a=await validateRepositoryRoot(i,a));let o=e.permissions[0].repositories,s=await assertCommandTargets(r,o,a,i),c=repositoryNames(o,t.org),l={authorizationDetails:[{type:`github_app_installation`,org:t.org,repositories:c}],subject:{type:`app`}},u=await(n.getConnectToken??getToken)(t.connector,l);if(!u)throw Error(`Connect returned an empty token for ${JSON.stringify(t.connector)}.`);let d=executablePath(r[0],i),f=s?[`-c`,`protocol.allow=never`,`-c`,`protocol.https.allow=always`,r[1],`https://github.com/${s}.git`,...r.slice(3)]:r.slice(1),p=`cd ${shellQuote(a)} && exec ${shellQuote(d)} ${f.map(shellQuote).join(` `)}`,m=`Basic ${Buffer.from(`x-access-token:${u}`).toString(`base64`)}`,h=crypto.randomUUID(),g=`eve-github-${h}`,_=`/tmp/eve-code-gh-${h}`,v=`Basic ${Buffer.from(`x-access-token:${g}`).toString(`base64`)}`,y;try{y=await withGitHubCredentialLease(i,n.sessionId,{authorization:m,placeholder:g,placeholderAuthorization:v,token:u},()=>{let e={GH_CONFIG_DIR:_,GH_PROMPT_DISABLED:`1`};return r[0]!==`git`&&(e.GH_TOKEN=g),e.GIT_CONFIG_COUNT=`2`,e.GIT_CONFIG_KEY_0=`http.https://github.com/.extraheader`,e.GIT_CONFIG_VALUE_0=`Authorization: ${v}`,e.GIT_CONFIG_KEY_1=`core.hooksPath`,e.GIT_CONFIG_VALUE_1=`/dev/null`,e.GIT_TERMINAL_PROMPT=`0`,e.PATH=`/usr/local/bin:/usr/bin:/bin`,i.run({command:p,env:e})},t.broker)}finally{await i.removePath({path:_,recursive:!0,force:!0})}let b=sanitizeOutput(y.stdout,u,m),x=sanitizeOutput(y.stderr,u,m);return{exitCode:y.exitCode,stdout:b.value,stderr:x.value,truncated:b.truncated||x.truncated}}async function withGitHubCredentialLease(e,t,n,r,i){let a=leaseQueues.get(t)??Promise.resolve(),o,s=new Promise(e=>{o=e}),c=a.then(()=>s);leaseQueues.set(t,c),await a;try{return await i(e,{"api.github.com":[{match:{headers:[{key:{exact:`authorization`},value:{regex:`^(?:token|Bearer) ${n.placeholder}$`}}]},transform:[{headers:{authorization:`Bearer ${n.token}`}}]}],"github.com":[{match:{headers:[{key:{exact:`authorization`},value:{exact:n.placeholderAuthorization}}]},transform:[{headers:{authorization:n.authorization}}]}]}),await r()}finally{try{await i(e,null)}finally{o(),leaseQueues.get(t)===c&&leaseQueues.delete(t)}}}function parseCommand(e){let t=e.trim();if(!t)throw Error(`GitHub command must not be empty.`);let n=[],r=``,i=null,a=!1,o=!1;for(let e of t){if(a){r+=e,a=!1,o=!0;continue}if(e===`\\`&&i!==`single`){a=!0,o=!0;continue}if(i===`single`){e===`'`?i=null:r+=e;continue}if(i===`double`){if(e===`"`)i=null;else if(e===`$`||e==="`")throw unsupportedSyntax();else r+=e;continue}if(e===`'`)i=`single`,o=!0;else if(e===`"`)i=`double`,o=!0;else if(/\s/u.test(e))o&&=(n.push(r),r=``,!1);else if(";&|<>$`(){}".includes(e))throw unsupportedSyntax();else r+=e,o=!0}if(a||i)throw Error(`GitHub command contains an unfinished quote or escape.`);if(o&&n.push(r),n.length===0)throw Error(`GitHub command must not be empty.`);return n}function validateGitHubShellInput(e){let t=parseCommand(e.command),n=e.permissions[0];if(e.permissions.length!==1||n?.provider!==`github`)throw Error(`Exactly one GitHub permission is required.`);if(n.access!==`write`)throw Error(`GitHub App commands require explicit write-capable access.`);if(!e.description.trim())throw Error(`description must describe the intended result.`);let[r,i]=t;if(r===`gh`){if(!i)throw Error(`A gh subcommand is required.`)}else if(r===`git`){if(!i||!ALLOWED_GIT_REMOTE_COMMANDS.has(i))throw Error(`Authenticated git supports only fetch, ls-remote, pull, and push; clone with gh repo clone.`)}else if(r!==`gh-signed-commit`)throw Error(`GitHub commands must use gh, an authenticated git remote command, or gh-signed-commit.`);return t}async function assertCommandTargets(e,t,n,r){let i=new Set(t.map(e=>e.toLowerCase())),a,o;if(e[0]===`git`){if(e[2]!==`origin`)throw Error(`Authenticated git commands must use the validated origin remote.`);let t=e[1]===`push`,i=await r.run({command:`cd ${shellQuote(n)} && git remote get-url ${t?`--push `:``}origin`,env:{GIT_TERMINAL_PROMPT:`0`,PATH:`/usr/bin:/bin`}});if(i.exitCode!==0)throw Error(`Could not resolve the origin GitHub repository.`);a=repositoryFromRemote(i.stdout.trim()),o=[a]}else if(e[0]===`gh-signed-commit`){if(o=repoFlagTargets(e.slice(1)),o.length===0)throw Error(`gh-signed-commit requires an explicit --repo owner/repository target.`)}else o=repoFlagTargets(e.slice(1)),e[1]===`repo`&&(e[2]===`clone`||e[2]===`view`||e[2]===`fork`)&&e[3]&&!e[3].startsWith(`-`)&&o.push(canonicalRepository(e[3]));for(let e of o)if(!i.has(e.toLowerCase()))throw Error(`Command target ${JSON.stringify(e)} is not in the declared repositories.`);return a}function repoFlagTargets(e){let t=[];for(let n=0;n<e.length;n+=1){let r=e[n];if(r===`--repo`||r===`-R`){let i=e[n+1];if(!i)throw Error(`${r} requires an owner/repository value.`);t.push(canonicalRepository(i)),n+=1}else r?.startsWith(`--repo=`)&&t.push(canonicalRepository(r.slice(7)))}return t}function repositoryFromRemote(e){let t=/^https:\/\/github\.com\/([^/]+\/[^/]+?)(?:\.git)?$/iu.exec(e);if(t?.[1])return canonicalRepository(t[1]);let n=/^git@github\.com:([^/]+\/[^/]+?)(?:\.git)?$/iu.exec(e);if(n?.[1])return canonicalRepository(n[1]);throw Error(`The origin remote is not a canonical GitHub repository URL.`)}function canonicalRepository(e){let t=e.replace(/\.git$/iu,``);if(!/^[A-Za-z0-9-]+\/[A-Za-z0-9._-]+$/u.test(t))throw Error(`Invalid GitHub repository ${JSON.stringify(e)}.`);return t}function repositoryNames(e,t){if(e.length!==1)throw Error(`Exactly one GitHub repository is required.`);let n=new Set;for(let r of e){let e=/^([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+)$/u.exec(r);if(!e)throw Error(`Invalid GitHub repository ${JSON.stringify(r)}.`);if(e[1]?.toLowerCase()!==t.toLowerCase())throw Error(`Repository ${JSON.stringify(r)} is outside ${t}.`);n.add(e[2])}if(n.size!==1)throw Error(`Exactly one GitHub repository is required.`);return[...n]}function executablePath(e,t){return e===`gh`?toolingPaths(t).ghReal:e===`gh-signed-commit`?toolingPaths(t).trustedSignedCommit:`git`}function resolveWorkingDirectory(e,t){let n=posix.resolve(`/`,e.resolvePath(``)),r=posix.resolve(`/`,e.resolvePath(t?.trim()||``));if(r!==n&&!r.startsWith(`${n}/`))throw Error(`GitHub command workingDirectory must stay inside the sandbox workspace.`);return r}function sanitizeOutput(e,t,n){let r=e.replaceAll(t,`[redacted]`).replaceAll(n,`[redacted]`);return Buffer.byteLength(r)<=MAX_OUTPUT_BYTES?{value:r,truncated:!1}:{value:`[output truncated: showing final ${MAX_OUTPUT_BYTES} bytes]\n${Buffer.from(r).subarray(-1e5).toString()}`,truncated:!0}}function unsupportedSyntax(){return Error(`GitHub commands support argv syntax only, not pipes, redirects, substitutions, or shell operators.`)}export{executeGitHubShell,githubShellApproval,parseCommand};
+import{shellQuote}from"./shell.js";import{toolingPaths}from"./tooling.js";import{validateRepositoryRoot}from"./repository-root.js";import{posix}from"node:path";import{getToken}from"#compiled/@vercel/connect/index.js";const MAX_OUTPUT_BYTES=1e5,leaseQueues=new Map,ALLOWED_GIT_REMOTE_COMMANDS=new Set([`fetch`,`ls-remote`,`pull`,`push`]);function githubShellApproval(e){if(!e)return`not-applicable`;try{return validateGitHubShellInput(e),`not-applicable`}catch(e){return{type:`denied`,reason:e instanceof Error?e.message:`Invalid GitHub command.`}}}async function executeGitHubShell(e,t,n){if(!t)throw Error(`GitHub command access is not configured for this agent.`);let r=validateGitHubShellInput(e),i=await n.getSandbox(),a=resolveWorkingDirectory(i,e.workingDirectory);(r[0]===`git`||r[0]===`gh-signed-commit`)&&(a=await validateRepositoryRoot(i,a));let o=e.permissions[0].repositories,s=await assertCommandTargets(r,o,a,i),c=repositoryNames(o,t.org),l={authorizationDetails:[{type:`github_app_installation`,org:t.org,repositories:c}],subject:{type:`app`}},u=await(n.getConnectToken??getToken)(t.connector,l);if(!u)throw Error(`Connect returned an empty token for ${JSON.stringify(t.connector)}.`);let d=executablePath(r[0],i),f=s?[`-c`,`protocol.allow=never`,`-c`,`protocol.https.allow=always`,r[1],`https://github.com/${s}.git`,...r.slice(3)]:r.slice(1),p=`cd ${shellQuote(a)} && exec ${shellQuote(d)} ${f.map(shellQuote).join(` `)}`,m=`Basic ${Buffer.from(`x-access-token:${u}`).toString(`base64`)}`,h=crypto.randomUUID(),g=`eve-github-${h}`,_=`/tmp/eve-code-gh-${h}`,v=`Basic ${Buffer.from(`x-access-token:${g}`).toString(`base64`)}`,y;try{y=await withGitHubCredentialLease(i,n.sessionId,{authorization:m,placeholder:g,placeholderAuthorization:v,token:u},()=>{let e={GH_CONFIG_DIR:_,GH_PROMPT_DISABLED:`1`};return r[0]!==`git`&&(e.GH_TOKEN=g),e.GIT_CONFIG_COUNT=`2`,e.GIT_CONFIG_KEY_0=`http.https://github.com/.extraheader`,e.GIT_CONFIG_VALUE_0=`Authorization: ${v}`,e.GIT_CONFIG_KEY_1=`core.hooksPath`,e.GIT_CONFIG_VALUE_1=`/dev/null`,e.GIT_TERMINAL_PROMPT=`0`,e.PATH=`/usr/local/bin:/usr/bin:/bin`,i.run({command:p,env:e})},t.broker)}finally{await i.removePath({path:_,recursive:!0,force:!0})}let b=sanitizeOutput(y.stdout,u,m),x=sanitizeOutput(y.stderr,u,m);return{exitCode:y.exitCode,stdout:b.value,stderr:x.value,truncated:b.truncated||x.truncated}}async function withGitHubCredentialLease(e,t,n,r,i){let a=leaseQueues.get(t)??Promise.resolve(),o,s=new Promise(e=>{o=e}),c=a.then(()=>s);leaseQueues.set(t,c),await a;try{return await i(e,{"api.github.com":[{match:{headers:[{key:{exact:`authorization`},value:{regex:`^(?:token|Bearer) ${n.placeholder}$`}}]},transform:[{headers:{authorization:`Bearer ${n.token}`}}]}],"github.com":[{match:{headers:[{key:{exact:`authorization`},value:{exact:n.placeholderAuthorization}}]},transform:[{headers:{authorization:n.authorization}}]}]}),await r()}finally{try{await i(e,null)}finally{o(),leaseQueues.get(t)===c&&leaseQueues.delete(t)}}}function parseCommand(e){let t=e.trim();if(!t)throw Error(`GitHub command must not be empty.`);let n=[],r=``,i=null,a=!1,o=!1;for(let e of t){if(a){r+=e,a=!1,o=!0;continue}if(e===`\\`&&i!==`single`){a=!0,o=!0;continue}if(i===`single`){e===`'`?i=null:r+=e;continue}if(i===`double`){if(e===`"`)i=null;else if(e===`$`||e==="`")throw unsupportedSyntax();else r+=e;continue}if(e===`'`)i=`single`,o=!0;else if(e===`"`)i=`double`,o=!0;else if(/\s/u.test(e))o&&=(n.push(r),r=``,!1);else if(";&|<>$`(){}".includes(e))throw unsupportedSyntax();else r+=e,o=!0}if(a||i)throw Error(`GitHub command contains an unfinished quote or escape.`);if(o&&n.push(r),n.length===0)throw Error(`GitHub command must not be empty.`);return n}function validateGitHubShellInput(e){let t=parseCommand(e.command),n=e.permissions[0];if(e.permissions.length!==1||n?.provider!==`github`)throw Error(`Exactly one GitHub permission is required.`);if(n.access!==`write`)throw Error(`GitHub App commands require explicit write-capable access.`);if(!e.description.trim())throw Error(`description must describe the intended result.`);let[r,i]=t;if(r===`gh`){if(!i)throw Error(`A gh subcommand is required.`)}else if(r===`git`){if(!i||!ALLOWED_GIT_REMOTE_COMMANDS.has(i))throw Error(`Authenticated git supports only fetch, ls-remote, pull, and push; clone with gh repo clone.`)}else if(r!==`gh-signed-commit`)throw Error(`GitHub commands must use gh, an authenticated git remote command, or gh-signed-commit.`);return t}async function assertCommandTargets(e,t,n,r){let i=new Set(t.map(e=>e.toLowerCase())),a,o;if(e[0]===`git`){if(e[2]!==`origin`)throw Error(`Authenticated git commands must use the validated origin remote.`);let t=e[1]===`push`,i=await r.run({command:`cd ${shellQuote(n)} && git remote get-url ${t?`--push `:``}origin`,env:{GIT_TERMINAL_PROMPT:`0`,PATH:`/usr/bin:/bin`}});if(i.exitCode!==0)throw Error(`Could not resolve the origin GitHub repository.`);a=repositoryFromRemote(i.stdout.trim()),o=[a]}else if(e[0]===`gh-signed-commit`){if(o=repoFlagTargets(e.slice(1)),o.length===0)throw Error(`gh-signed-commit requires an explicit --repo owner/repository target.`)}else o=repoFlagTargets(e.slice(1)),e[1]===`repo`&&(e[2]===`clone`||e[2]===`view`||e[2]===`fork`)&&e[3]&&!e[3].startsWith(`-`)&&o.push(canonicalRepository(e[3]));for(let e of o)if(!i.has(e.toLowerCase()))throw Error(`Command target ${JSON.stringify(e)} is not in the declared repositories.`);return a}function repoFlagTargets(e){let t=[];for(let n=0;n<e.length;n+=1){let r=e[n];if(r===`--repo`||r===`-R`){let i=e[n+1];if(!i)throw Error(`${r} requires an owner/repository value.`);t.push(canonicalRepository(i)),n+=1}else r?.startsWith(`--repo=`)&&t.push(canonicalRepository(r.slice(7)))}return t}function repositoryFromRemote(e){let t=/^https:\/\/github\.com\/([^/]+\/[^/]+?)(?:\.git)?$/iu.exec(e);if(t?.[1])return canonicalRepository(t[1]);let n=/^git@github\.com:([^/]+\/[^/]+?)(?:\.git)?$/iu.exec(e);if(n?.[1])return canonicalRepository(n[1]);throw Error(`The origin remote is not a canonical GitHub repository URL.`)}function canonicalRepository(e){let t=e.replace(/\.git$/iu,``);if(!/^[A-Za-z0-9-]+\/[A-Za-z0-9._-]+$/u.test(t))throw Error(`Invalid GitHub repository ${JSON.stringify(e)}.`);return t}function repositoryNames(e,t){if(e.length!==1)throw Error(`Exactly one GitHub repository is required.`);let n=new Set;for(let r of e){let e=/^([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+)$/u.exec(r);if(!e)throw Error(`Invalid GitHub repository ${JSON.stringify(r)}.`);if(e[1]?.toLowerCase()!==t.toLowerCase())throw Error(`Repository ${JSON.stringify(r)} is outside ${t}.`);n.add(e[2])}if(n.size!==1)throw Error(`Exactly one GitHub repository is required.`);return[...n]}function executablePath(e,t){return e===`gh`?toolingPaths(t).ghReal:e===`gh-signed-commit`?toolingPaths(t).trustedSignedCommit:`git`}function resolveWorkingDirectory(e,t){let n=posix.resolve(`/`,e.resolvePath(``)),r=posix.resolve(`/`,e.resolvePath(t?.trim()||``));if(r!==n&&!r.startsWith(`${n}/`))throw Error(`GitHub command workingDirectory must stay inside the sandbox workspace.`);return r}function sanitizeOutput(e,t,n){let r=e.replaceAll(t,`[redacted]`).replaceAll(n,`[redacted]`);return Buffer.byteLength(r)<=MAX_OUTPUT_BYTES?{value:r,truncated:!1}:{value:`[output truncated: showing final ${MAX_OUTPUT_BYTES} bytes]\n${Buffer.from(r).subarray(-1e5).toString()}`,truncated:!0}}function unsupportedSyntax(){return Error(`GitHub commands support argv syntax only, not pipes, redirects, substitutions, or shell operators.`)}export{executeGitHubShell,githubShellApproval,parseCommand};

package/dist/src/extensions/code/extension/lib/prwatch-github.js

@@ -1 +1 @@
-import extension_default from"../extension.js";import{deleteTokenCacheEntry,getToken}from"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/token.js";import"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/index.js";import{z}from"#compiled/zod/index.js";const RepoSchema=z.string().trim().regex(/^[A-Za-z0-9-]+\/[A-Za-z0-9._-]+$/u).transform(e=>e.toLowerCase()),PullRequestWatchInputSchema=z.object({repo:RepoSchema,pullRequestNumber:z.number().int().positive(),reviewOwner:z.string().trim().min(1),redHeadOid:z.string().regex(/^[0-9a-f]{40}$/iu).transform(e=>e.toLowerCase())}),PrwatchDeleteInputSchema=z.object({repo:RepoSchema,pullRequestNumber:z.number().int().positive()}),PullRequestSchema=z.object({head:z.object({sha:z.string().min(1)}),html_url:z.string().url(),merged:z.boolean().optional().default(!1),state:z.enum([`open`,`closed`])}),ReviewSchema=z.object({commit_id:z.string().nullable(),state:z.string(),submitted_at:z.string().nullable(),user:z.object({login:z.string()}).nullable()});function initialPullRequestWatchNotificationState(){return{previousSnapshot:null,redHeadPolls:0,redHeadWakeSent:!1}}function framePullRequestWatchWake(e){return`${e}\n\nThis is an internal watch wake, not a request for a progress report. Continue any necessary work. Send a user-facing response only when the original request is complete or a new blocker requires human input. Otherwise, finish by replying with exactly <eve-empty-delivery/> and no other text. Do not report that nothing changed or that work is still in progress.`}function reviewFingerprint(e){return e?.ownerReviewState===null||e===null?null:`${e.ownerReviewState}:${e.ownerReviewSubmittedAt??``}`}function advancePullRequestWatchNotification(e){let t=e.state.previousSnapshot,n=e.snapshot.headOid!==(t?.headOid??e.redHeadOid),r=t!==null&&reviewFingerprint(e.snapshot)!==reviewFingerprint(t),i=e.snapshot.headOid===e.redHeadOid,a=i?e.state.redHeadPolls+1:0,o=null;return n?o=`head_changed`:r?o=`owner_review_changed`:i&&!e.state.redHeadWakeSent&&a===e.staleAfterPolls&&(o=`red_head_stalled`),{state:{previousSnapshot:e.snapshot,redHeadPolls:a,redHeadWakeSent:e.state.redHeadWakeSent||o===`red_head_stalled`},wakeReason:o}}var RetryablePullRequestWatchError=class extends Error{},GitHubWatchResponseError=class extends Error{status;constructor(e,t){super(t),this.name=`GitHubWatchResponseError`,this.status=e}};function errorStatus(e){return typeof e!=`object`||!e||!(`status`in e)?null:typeof e.status==`number`?e.status:null}function shouldRefreshPullRequestWatchToken(e){return errorStatus(e)===401}function isRetryablePullRequestWatchError(e){let t=errorStatus(e);return t===429||t!==null&&t>=500||e instanceof RetryablePullRequestWatchError||e instanceof TypeError||e instanceof Error&&(/^GitHub watch (?:request|token request) failed:/u.test(e.message)||/\((?:429|5\d{2})\b/u.test(e.message))}function pullRequestWatchSnapshot(e){let t=e.reviewOwner.toLowerCase(),n=e.pullRequest.head.sha.toLowerCase(),r=e.reviews.filter(e=>e.commit_id?.toLowerCase()===n&&e.user?.login.toLowerCase()===t).at(-1);return{headOid:n,ownerApprovedCurrentHead:r?.state.toUpperCase()===`APPROVED`,ownerReviewState:r?.state.toUpperCase()??null,ownerReviewSubmittedAt:r?.submitted_at??null,state:e.pullRequest.merged?`merged`:e.pullRequest.state,url:e.pullRequest.html_url}}function repoParts(e){let[t,n]=e.split(`/`);if(t===void 0||n===void 0)throw Error(`Invalid GitHub repository: ${e}`);return{owner:t,name:n}}function repoFullName(e){let t=repoParts(e);return`${t.owner}/${t.name}`}function repoApiPath(e){let t=repoParts(e);return`/repos/${encodeURIComponent(t.owner)}/${encodeURIComponent(t.name)}`}function redactGithubToken(e,t){return t.length===0?e:e.split(t).join(`[redacted]`)}function githubHeaders(e){return{Accept:`application/vnd.github+json`,Authorization:`Bearer ${e}`,"X-GitHub-Api-Version":`2022-11-28`}}function githubTokenParams(e,t){return{authorizationDetails:[{org:e,repositories:[t],type:`github_app_installation`}],subject:{type:`app`}}}async function mintWatchToken(e){let t=extension_default.config.github;if(t===void 0)throw Error(`GitHub is not configured for this agent.`);let n=repoParts(e);if(n.owner!==t.org.toLowerCase())throw Error(`Repository ${e} is outside ${t.org}.`);let r=await getToken(t.connector,githubTokenParams(t.org,n.name));if(r.length===0)throw Error(`Connect returned an empty GitHub token for ${e}.`);return r}async function invalidateWatchToken(e){let t=extension_default.config.github;if(t===void 0)return;let n=repoParts(e);deleteTokenCacheEntry(t.connector,githubTokenParams(t.org,n.name))}async function githubJson(e,t){let n;try{n=await fetch(e,{headers:githubHeaders(t)})}catch(e){throw new RetryablePullRequestWatchError(`GitHub watch request failed: ${e instanceof Error?e.message:String(e)}`)}if(n.ok)return n.json();let r=await n.text().catch(()=>``),i=`GitHub request failed (${n.status} ${n.statusText})`+(r.length>0?`: ${redactGithubToken(r,t)}`:``);throw n.status===429||n.status>=500?new RetryablePullRequestWatchError(i):new GitHubWatchResponseError(n.status,i)}async function readPullRequestWatchSnapshotWithToken(e,t){let n=`https://api.github.com${repoApiPath(e.repo)}/pulls/${e.pullRequestNumber}`,r=PullRequestSchema.parse(await githubJson(n,t));if(r.state===`closed`||r.merged)return pullRequestWatchSnapshot({pullRequest:r,reviewOwner:e.reviewOwner,reviews:[]});let i=[];for(let r=1;r<=20;r+=1){let a=z.array(ReviewSchema).parse(await githubJson(`${n}/reviews?per_page=100&page=${r}`,t));if(i.push(...a),a.length<100)break;if(r===20)throw Error(`PR #${e.pullRequestNumber} has too many reviews to verify`)}return pullRequestWatchSnapshot({pullRequest:r,reviewOwner:e.reviewOwner,reviews:i})}async function readPullRequestWatchSnapshot(e){for(let t=0;t<2;t+=1){let n;try{n=await mintWatchToken(e.repo)}catch(e){throw isRetryablePullRequestWatchError(e)?new RetryablePullRequestWatchError(`GitHub watch token request failed: ${e instanceof Error?e.message:String(e)}`):e}try{return await readPullRequestWatchSnapshotWithToken(e,n)}catch(n){if(t>0||!shouldRefreshPullRequestWatchToken(n))throw n;await invalidateWatchToken(e.repo)}}throw Error(`Pull request watch token refresh exhausted unexpectedly.`)}export{PrwatchDeleteInputSchema,PullRequestWatchInputSchema,advancePullRequestWatchNotification,framePullRequestWatchWake,initialPullRequestWatchNotificationState,isRetryablePullRequestWatchError,pullRequestWatchSnapshot,readPullRequestWatchSnapshot,repoFullName,shouldRefreshPullRequestWatchToken};
+import extension_default from"../extension.js";import{z}from"#compiled/zod/index.js";import{deleteTokenCacheEntry,getToken}from"#compiled/@vercel/connect/index.js";const RepoSchema=z.string().trim().regex(/^[A-Za-z0-9-]+\/[A-Za-z0-9._-]+$/u).transform(e=>e.toLowerCase()),PullRequestWatchInputSchema=z.object({repo:RepoSchema,pullRequestNumber:z.number().int().positive(),reviewOwner:z.string().trim().min(1),redHeadOid:z.string().regex(/^[0-9a-f]{40}$/iu).transform(e=>e.toLowerCase())}),PrwatchDeleteInputSchema=z.object({repo:RepoSchema,pullRequestNumber:z.number().int().positive()}),PullRequestSchema=z.object({head:z.object({sha:z.string().min(1)}),html_url:z.string().url(),merged:z.boolean().optional().default(!1),state:z.enum([`open`,`closed`])}),ReviewSchema=z.object({commit_id:z.string().nullable(),state:z.string(),submitted_at:z.string().nullable(),user:z.object({login:z.string()}).nullable()});function initialPullRequestWatchNotificationState(){return{previousSnapshot:null,redHeadPolls:0,redHeadWakeSent:!1}}function framePullRequestWatchWake(e){return`${e}\n\nThis is an internal watch wake, not a request for a progress report. Continue any necessary work. Send a user-facing response only when the original request is complete or a new blocker requires human input. Do not report that nothing changed or that work is still in progress.`}function reviewFingerprint(e){return e?.ownerReviewState===null||e===null?null:`${e.ownerReviewState}:${e.ownerReviewSubmittedAt??``}`}function advancePullRequestWatchNotification(e){let t=e.state.previousSnapshot,n=e.snapshot.headOid!==(t?.headOid??e.redHeadOid),r=t!==null&&reviewFingerprint(e.snapshot)!==reviewFingerprint(t),i=e.snapshot.headOid===e.redHeadOid,a=i?e.state.redHeadPolls+1:0,o=null;return n?o=`head_changed`:r?o=`owner_review_changed`:i&&!e.state.redHeadWakeSent&&a===e.staleAfterPolls&&(o=`red_head_stalled`),{state:{previousSnapshot:e.snapshot,redHeadPolls:a,redHeadWakeSent:e.state.redHeadWakeSent||o===`red_head_stalled`},wakeReason:o}}var RetryablePullRequestWatchError=class extends Error{},GitHubWatchResponseError=class extends Error{status;constructor(e,t){super(t),this.name=`GitHubWatchResponseError`,this.status=e}};function errorStatus(e){return typeof e!=`object`||!e||!(`status`in e)?null:typeof e.status==`number`?e.status:null}function shouldRefreshPullRequestWatchToken(e){return errorStatus(e)===401}function isRetryablePullRequestWatchError(e){let t=errorStatus(e);return t===429||t!==null&&t>=500||e instanceof RetryablePullRequestWatchError||e instanceof TypeError||e instanceof Error&&(/^GitHub watch (?:request|token request) failed:/u.test(e.message)||/\((?:429|5\d{2})\b/u.test(e.message))}function pullRequestWatchSnapshot(e){let t=e.reviewOwner.toLowerCase(),n=e.pullRequest.head.sha.toLowerCase(),r=e.reviews.filter(e=>e.commit_id?.toLowerCase()===n&&e.user?.login.toLowerCase()===t).at(-1);return{headOid:n,ownerApprovedCurrentHead:r?.state.toUpperCase()===`APPROVED`,ownerReviewState:r?.state.toUpperCase()??null,ownerReviewSubmittedAt:r?.submitted_at??null,state:e.pullRequest.merged?`merged`:e.pullRequest.state,url:e.pullRequest.html_url}}function repoParts(e){let[t,n]=e.split(`/`);if(t===void 0||n===void 0)throw Error(`Invalid GitHub repository: ${e}`);return{owner:t,name:n}}function repoFullName(e){let t=repoParts(e);return`${t.owner}/${t.name}`}function repoApiPath(e){let t=repoParts(e);return`/repos/${encodeURIComponent(t.owner)}/${encodeURIComponent(t.name)}`}function redactGithubToken(e,t){return t.length===0?e:e.split(t).join(`[redacted]`)}function githubHeaders(e){return{Accept:`application/vnd.github+json`,Authorization:`Bearer ${e}`,"X-GitHub-Api-Version":`2022-11-28`}}function githubTokenParams(e,t){return{authorizationDetails:[{org:e,repositories:[t],type:`github_app_installation`}],subject:{type:`app`}}}async function mintWatchToken(e){let t=extension_default.config.github;if(t===void 0)throw Error(`GitHub is not configured for this agent.`);let n=repoParts(e);if(n.owner!==t.org.toLowerCase())throw Error(`Repository ${e} is outside ${t.org}.`);let r=await getToken(t.connector,githubTokenParams(t.org,n.name));if(r.length===0)throw Error(`Connect returned an empty GitHub token for ${e}.`);return r}async function invalidateWatchToken(e){let t=extension_default.config.github;if(t===void 0)return;let n=repoParts(e);deleteTokenCacheEntry(t.connector,githubTokenParams(t.org,n.name))}async function githubJson(e,t){let n;try{n=await fetch(e,{headers:githubHeaders(t)})}catch(e){throw new RetryablePullRequestWatchError(`GitHub watch request failed: ${e instanceof Error?e.message:String(e)}`)}if(n.ok)return n.json();let r=await n.text().catch(()=>``),i=`GitHub request failed (${n.status} ${n.statusText})`+(r.length>0?`: ${redactGithubToken(r,t)}`:``);throw n.status===429||n.status>=500?new RetryablePullRequestWatchError(i):new GitHubWatchResponseError(n.status,i)}async function readPullRequestWatchSnapshotWithToken(e,t){let n=`https://api.github.com${repoApiPath(e.repo)}/pulls/${e.pullRequestNumber}`,r=PullRequestSchema.parse(await githubJson(n,t));if(r.state===`closed`||r.merged)return pullRequestWatchSnapshot({pullRequest:r,reviewOwner:e.reviewOwner,reviews:[]});let i=[];for(let r=1;r<=20;r+=1){let a=z.array(ReviewSchema).parse(await githubJson(`${n}/reviews?per_page=100&page=${r}`,t));if(i.push(...a),a.length<100)break;if(r===20)throw Error(`PR #${e.pullRequestNumber} has too many reviews to verify`)}return pullRequestWatchSnapshot({pullRequest:r,reviewOwner:e.reviewOwner,reviews:i})}async function readPullRequestWatchSnapshot(e){for(let t=0;t<2;t+=1){let n;try{n=await mintWatchToken(e.repo)}catch(e){throw isRetryablePullRequestWatchError(e)?new RetryablePullRequestWatchError(`GitHub watch token request failed: ${e instanceof Error?e.message:String(e)}`):e}try{return await readPullRequestWatchSnapshotWithToken(e,n)}catch(n){if(t>0||!shouldRefreshPullRequestWatchToken(n))throw n;await invalidateWatchToken(e.repo)}}throw Error(`Pull request watch token refresh exhausted unexpectedly.`)}export{PrwatchDeleteInputSchema,PullRequestWatchInputSchema,advancePullRequestWatchNotification,framePullRequestWatchWake,initialPullRequestWatchNotificationState,isRetryablePullRequestWatchError,pullRequestWatchSnapshot,readPullRequestWatchSnapshot,repoFullName,shouldRefreshPullRequestWatchToken};

package/dist/src/extensions/code/extension/lib/sandbox.d.ts

@@ -2,11 +2,12 @@
 import type { SandboxSession } from "eve/sandbox";
 type ToolingSandbox = Pick<SandboxSession, "resolvePath" | "run" | "writeTextFile">;
 /** Include in the consumer's sandbox `revalidationKey` so cached templates rebuild when the tooling changes. */
-export declare const CODE_TOOLING_REVALIDATION_KEY = "eve-code-tooling:3:2:6.0.3";
+export declare const CODE_TOOLING_REVALIDATION_KEY = "eve-code-tooling:3:3:6.0.3";
 /** Install CLI wrappers, signed commits, and TypeScript diagnostics. */
 export declare function installCodeTooling(sandbox: ToolingSandbox, options?: {
     readonly vercel?: boolean;
 }): Promise<void>;
 export { authenticateGitHub, authenticateVercel, type BrokeredCredentialOptions, } from "./credentials.ts";
-export { COMPUTER_USE_REVALIDATION_KEY, installComputerUse, startComputerUse, } from "./computer-use-sandbox.ts";
+/** @deprecated Import from `eve/computer-use/sandbox` and mount `eve/computer-use`. */
+export { COMPUTER_USE_REVALIDATION_KEY, installComputerUse, startComputerUse, } from "eve/computer-use/sandbox";
 export { executeGitHubShell, githubShellApproval, type GitHubLeaseRule, type GitHubShellInput, type GitHubShellOutput, } from "./github-shell.ts";

package/dist/src/extensions/code/extension/lib/sandbox.js

@@ -1,2 +1,2 @@
-import{GH_SIGNED_COMMIT_SOURCE}from"./signed-commit.js";import{DIAGNOSTICS_WORKER_SOURCE,TYPESCRIPT_VERSION,ghWrapperSource,toolingPaths,typescriptInstallCommand,vercelWrapperSource}from"./tooling.js";import{authenticateGitHub,authenticateVercel}from"./credentials.js";import{commandFailureDetail}from"./command-failure.js";import{COMPUTER_USE_REVALIDATION_KEY,installComputerUse,startComputerUse}from"./computer-use-sandbox.js";import{executeGitHubShell,githubShellApproval}from"./github-shell.js";const CODE_TOOLING_REVALIDATION_KEY=`eve-code-tooling:3:2:${TYPESCRIPT_VERSION}`;async function installCodeTooling(e,t={}){let n=toolingPaths(e);await Promise.all([e.writeTextFile({path:n.ghWrapper,content:ghWrapperSource(e)}),e.writeTextFile({path:n.signedCommit,content:GH_SIGNED_COMMIT_SOURCE}),e.writeTextFile({path:n.workerSource,content:DIAGNOSTICS_WORKER_SOURCE}),...t.vercel===!0?[e.writeTextFile({path:n.vercelWrapper,content:vercelWrapperSource(e)})]:[]]);let r=await e.run({command:toolingInstallCommand(e,t.vercel===!0)});if(r.exitCode!==0)throw Error(`eve-code tooling installation failed (exit ${r.exitCode}): ${commandFailureDetail(r)}`)}function toolingInstallCommand(e,t){let n=toolingPaths(e),quote=e=>`'${e.replaceAll(`'`,`'"'"'`)}'`;return[`set -e`,`mkdir -p ${quote(n.root)}`,`if ! command -v gh >/dev/null 2>&1; then`,`  command -v apt-get >/dev/null 2>&1 || { echo 'eve-code requires gh or apt-get' >&2; exit 1; }`,`  if [ "$(id -u)" = 0 ]; then APT=apt-get; else command -v sudo >/dev/null 2>&1 || { echo 'eve-code needs root or sudo to install gh' >&2; exit 1; }; APT='sudo -n apt-get'; fi`,`  $APT update && $APT install -y gh`,`fi`,`chmod 755 ${quote(n.ghWrapper)} ${quote(n.signedCommit)}`,`if [ "$(id -u)" = 0 ]; then INSTALL=install; else INSTALL='sudo -n install'; fi`,`$INSTALL -d -o root -g root -m 755 ${quote(n.trustedRoot)} ${quote(n.typescriptRoot)}`,`[ -x /usr/bin/gh ] || { echo 'eve-code requires gh at /usr/bin/gh' >&2; exit 1; }`,`$INSTALL -m 755 /usr/bin/gh ${quote(n.ghReal)}`,`$INSTALL -m 755 ${quote(n.signedCommit)} ${quote(n.trustedSignedCommit)}`,`$INSTALL -m 644 ${quote(n.workerSource)} ${quote(n.worker)}`,`$INSTALL -m 755 ${quote(n.ghWrapper)} /usr/local/bin/gh`,`$INSTALL -m 755 ${quote(n.trustedSignedCommit)} /usr/local/bin/gh-signed-commit`,typescriptInstallCommand(e),...t?[`if [ "$(id -u)" = 0 ]; then npm install -g vercel@latest; else sudo -n npm install -g vercel@latest; fi`,`$INSTALL -m 755 ${quote(n.vercelWrapper)} /usr/local/bin/vercel`,`$INSTALL -m 755 ${quote(n.vercelWrapper)} /usr/local/bin/vc`]:[]].join(`
+import{GH_SIGNED_COMMIT_SOURCE}from"./signed-commit.js";import{DIAGNOSTICS_WORKER_SOURCE,TYPESCRIPT_VERSION,ghWrapperSource,toolingPaths,typescriptInstallCommand,vercelWrapperSource}from"./tooling.js";import{authenticateGitHub,authenticateVercel}from"./credentials.js";import{commandFailureDetail}from"./command-failure.js";import{executeGitHubShell,githubShellApproval}from"./github-shell.js";import{COMPUTER_USE_REVALIDATION_KEY,installComputerUse,startComputerUse}from"eve/computer-use/sandbox";const CODE_TOOLING_REVALIDATION_KEY=`eve-code-tooling:3:3:${TYPESCRIPT_VERSION}`;async function installCodeTooling(e,t={}){let n=toolingPaths(e);await Promise.all([e.writeTextFile({path:n.ghWrapper,content:ghWrapperSource(e)}),e.writeTextFile({path:n.signedCommit,content:GH_SIGNED_COMMIT_SOURCE}),e.writeTextFile({path:n.workerSource,content:DIAGNOSTICS_WORKER_SOURCE}),...t.vercel===!0?[e.writeTextFile({path:n.vercelWrapper,content:vercelWrapperSource(e)})]:[]]);let r=await e.run({command:toolingInstallCommand(e,t.vercel===!0)});if(r.exitCode!==0)throw Error(`eve-code tooling installation failed (exit ${r.exitCode}): ${commandFailureDetail(r)}`)}function toolingInstallCommand(e,t){let n=toolingPaths(e),quote=e=>`'${e.replaceAll(`'`,`'"'"'`)}'`;return[`set -e`,`mkdir -p ${quote(n.root)}`,`if ! command -v gh >/dev/null 2>&1; then`,`  command -v apt-get >/dev/null 2>&1 || { echo 'eve-code requires gh or apt-get' >&2; exit 1; }`,`  if [ "$(id -u)" = 0 ]; then APT=apt-get; else command -v sudo >/dev/null 2>&1 || { echo 'eve-code needs root or sudo to install gh' >&2; exit 1; }; APT='sudo -n apt-get'; fi`,`  $APT update && $APT install -y gh`,`fi`,`chmod 755 ${quote(n.ghWrapper)} ${quote(n.signedCommit)}`,`if [ "$(id -u)" = 0 ]; then INSTALL=install; else INSTALL='sudo -n install'; fi`,`$INSTALL -d -o root -g root -m 755 ${quote(n.trustedRoot)} ${quote(n.typescriptRoot)}`,`[ -x /usr/bin/gh ] || { echo 'eve-code requires gh at /usr/bin/gh' >&2; exit 1; }`,`$INSTALL -m 755 /usr/bin/gh ${quote(n.ghReal)}`,`$INSTALL -m 755 ${quote(n.signedCommit)} ${quote(n.trustedSignedCommit)}`,`$INSTALL -m 644 ${quote(n.workerSource)} ${quote(n.worker)}`,`$INSTALL -m 755 ${quote(n.ghWrapper)} /usr/local/bin/gh`,`$INSTALL -m 755 ${quote(n.trustedSignedCommit)} /usr/local/bin/gh-signed-commit`,typescriptInstallCommand(e),...t?[`if [ "$(id -u)" = 0 ]; then npm install -g vercel@latest; else sudo -n npm install -g vercel@latest; fi`,`$INSTALL -m 755 ${quote(n.vercelWrapper)} /usr/local/bin/vercel`,`$INSTALL -m 755 ${quote(n.vercelWrapper)} /usr/local/bin/vc`]:[]].join(`
 `)}export{CODE_TOOLING_REVALIDATION_KEY,COMPUTER_USE_REVALIDATION_KEY,authenticateGitHub,authenticateVercel,executeGitHubShell,githubShellApproval,installCodeTooling,installComputerUse,startComputerUse};

package/dist/src/extensions/code/extension/lib/signed-commit.d.ts

@@ -1,2 +1,2 @@
-export declare const GH_SIGNED_COMMIT_VERSION = "2";
+export declare const GH_SIGNED_COMMIT_VERSION = "3";
 export declare const GH_SIGNED_COMMIT_SOURCE: string;

package/dist/src/extensions/code/extension/lib/signed-commit.js

@@ -1,4 +1,4 @@
-const GH_SIGNED_COMMIT_VERSION=`2`,GH_SIGNED_COMMIT_SOURCE=String.raw`#!/usr/bin/env node
+const GH_SIGNED_COMMIT_VERSION=`3`,GH_SIGNED_COMMIT_SOURCE=String.raw`#!/usr/bin/env node
 const { execFileSync } = require("node:child_process");
 
 const args = process.argv.slice(2);
@@ -120,7 +120,7 @@ async function request(method, path, body) {
 }
 
 function git(...values) {
-  return execFileSync("git", values, { stdio: ["ignore", "pipe", "inherit"] });
+  return execFileSync("git", values, { stdio: ["ignore", "pipe", "inherit"], maxBuffer: Infinity });
 }
 
 function fail(message) {

package/dist/src/extensions/code/tools.d.ts

@@ -1,4 +1,5 @@
 export { default as apply_patch } from "./extension/tools/apply_patch.ts";
-export { default as computer_use } from "./extension/tools/computer_use.ts";
+/** @deprecated Import from `eve/computer-use/tools` and mount `eve/computer-use`. */
+export { computer_use } from "../../computer-use/tools.ts";
 export { default as gh } from "./extension/tools/gh.ts";
 export { default as grep } from "./extension/tools/grep.ts";

package/dist/src/extensions/code/tools.js

@@ -1 +1 @@
-import grep_default from"./extension/tools/grep.js";import apply_patch_default from"./extension/tools/apply_patch.js";import computer_use_default from"./extension/tools/computer_use.js";import gh_default from"./extension/tools/gh.js";export{apply_patch_default as apply_patch,computer_use_default as computer_use,gh_default as gh,grep_default as grep};
+import computer_use_default from"../../computer-use/extension/tools/computer_use.js";import"../../computer-use/tools.js";import grep_default from"./extension/tools/grep.js";import apply_patch_default from"./extension/tools/apply_patch.js";import gh_default from"./extension/tools/gh.js";export{apply_patch_default as apply_patch,computer_use_default as computer_use,gh_default as gh,grep_default as grep};

package/dist/src/framework/sources/modules/agent.d.ts

@@ -1,4 +1,5 @@
 declare const _default: import("#public/definitions/agent.js").DefinedAgent<{
     model: string;
+    reasoning: "high";
 }>;
 export default _default;

package/dist/src/framework/sources/modules/agent.js

@@ -1 +1 @@
-import{DEFAULT_AGENT_MODEL_ID}from"#shared/default-agent-model.js";import{defineAgent}from"#public/definitions/agent.js";var agent_default=defineAgent({model:DEFAULT_AGENT_MODEL_ID});export{agent_default as default};
+import{DEFAULT_AGENT_MODEL_ID,DEFAULT_AGENT_REASONING}from"#shared/default-agent-model.js";import{defineAgent}from"#public/definitions/agent.js";var agent_default=defineAgent({model:DEFAULT_AGENT_MODEL_ID,reasoning:DEFAULT_AGENT_REASONING});export{agent_default as default};

package/dist/src/framework/sources/registry.js

@@ -1 +1 @@
-import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{createAgentSourceRegistry,defineProgrammaticAgentSource,loadProgrammaticModuleNamespace,memoizeModuleNamespaceFactories}from"#compiler/source-graph.js";const revision=`eve@${resolveInstalledPackageInfo().version}:compiled-manifest-v52`,localDefaults=defineProgrammaticAgentSource({id:`eve:defaults`,revision,modules:[{logicalPath:`agent.ts`,loadNamespace:()=>import(`#framework/sources/modules/agent.js`)},{logicalPath:`sandbox.ts`,semanticRevision:`eve:default-sandbox:v1`,loadNamespace:()=>import(`#framework/sources/modules/sandbox.js`)},{logicalPath:`tools/bash.ts`,loadNamespace:()=>import(`#tools/provided/bash.js`)},{logicalPath:`tools/read_file.ts`,loadNamespace:()=>import(`#tools/provided/read-file.js`)},{logicalPath:`tools/write_file.ts`,loadNamespace:()=>import(`#tools/provided/write-file.js`)},{logicalPath:`tools/web_fetch.ts`,loadNamespace:()=>import(`#tools/provided/web-fetch.js`)},{logicalPath:`tools/load_skill.ts`,loadNamespace:()=>import(`#tools/provided/load-skill.js`)},{logicalPath:`tools/connection_search.ts`,loadNamespace:()=>import(`#tools/framework/connection-search.js`)},{logicalPath:`tools/task_cancel.ts`,loadNamespace:()=>import(`#tools/framework/task-cancel.js`)},{logicalPath:`tools/web_search.ts`,loadNamespace:()=>import(`#tools/provided/web-search.js`)}]}),rootDefaults=defineProgrammaticAgentSource({id:`eve:root-defaults`,revision,modules:[{logicalPath:`tools/agent.ts`,loadNamespace:()=>import(`#tools/framework/agent.js`)},{logicalPath:`channels/eve.ts`,loadNamespace:()=>import(`#framework/sources/modules/eve-channel.js`)},{logicalPath:`channels/home.ts`,loadNamespace:()=>import(`#framework/sources/modules/home-channel.js`)}]}),memoryWrapperTemplateSource=defineProgrammaticAgentSource({id:`eve:memory-wrapper`,revision,modules:[{logicalPath:`tools/memory-wrapper.ts`,loadNamespace:async e=>{let{loadMemoryWrapperNamespace:t}=await import(`#framework/sources/modules/memory-wrapper.js`);return await t(e)}}]}),frameworkAgentSourceRegistry=createAgentSourceRegistry([{applyTo:`all-local-nodes`,source:localDefaults},{applyTo:`root`,source:rootDefaults}],{templates:[memoryWrapperTemplateSource]}),memoryWrapperTemplate=frameworkAgentSourceRegistry.templates.get(memoryWrapperTemplateSource.id);async function loadFrameworkProgrammaticModule(e,t){return memoizeModuleNamespaceFactories(await loadProgrammaticModuleNamespace({backing:e,dependencyNamespaces:t,registries:[frameworkAgentSourceRegistry]}))}export{frameworkAgentSourceRegistry,loadFrameworkProgrammaticModule,memoryWrapperTemplate};
+import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{createAgentSourceRegistry,defineProgrammaticAgentSource,loadProgrammaticModuleNamespace,memoizeModuleNamespaceFactories}from"#compiler/source-graph.js";const revision=`eve@${resolveInstalledPackageInfo().version}:compiled-manifest-v52`,localDefaults=defineProgrammaticAgentSource({id:`eve:defaults`,revision,modules:[{logicalPath:`agent.ts`,loadNamespace:()=>import(`#framework/sources/modules/agent.js`)},{logicalPath:`sandbox.ts`,semanticRevision:`eve:default-sandbox:v1`,loadNamespace:()=>import(`#framework/sources/modules/sandbox.js`)},{logicalPath:`tools/bash.ts`,loadNamespace:()=>import(`#tools/provided/bash.js`)},{logicalPath:`tools/read_file.ts`,loadNamespace:()=>import(`#tools/provided/read-file.js`)},{logicalPath:`tools/write_file.ts`,loadNamespace:()=>import(`#tools/provided/write-file.js`)},{logicalPath:`tools/web_fetch.ts`,loadNamespace:()=>import(`#tools/provided/web-fetch.js`)},{logicalPath:`tools/load_skill.ts`,loadNamespace:()=>import(`#tools/provided/load-skill.js`)},{logicalPath:`tools/connection_tools.ts`,loadNamespace:()=>import(`#tools/framework/connection-tools.js`)},{logicalPath:`tools/web_search.ts`,loadNamespace:()=>import(`#tools/provided/web-search.js`)}]}),rootDefaults=defineProgrammaticAgentSource({id:`eve:root-defaults`,revision,modules:[{logicalPath:`tools/agent.ts`,loadNamespace:()=>import(`#tools/framework/agent.js`)},{logicalPath:`channels/eve.ts`,loadNamespace:()=>import(`#framework/sources/modules/eve-channel.js`)},{logicalPath:`channels/home.ts`,loadNamespace:()=>import(`#framework/sources/modules/home-channel.js`)}]}),memoryWrapperTemplateSource=defineProgrammaticAgentSource({id:`eve:memory-wrapper`,revision,modules:[{logicalPath:`tools/memory-wrapper.ts`,loadNamespace:async e=>{let{loadMemoryWrapperNamespace:t}=await import(`#framework/sources/modules/memory-wrapper.js`);return await t(e)}}]}),frameworkAgentSourceRegistry=createAgentSourceRegistry([{applyTo:`all-local-nodes`,source:localDefaults},{applyTo:`root`,source:rootDefaults}],{templates:[memoryWrapperTemplateSource]}),memoryWrapperTemplate=frameworkAgentSourceRegistry.templates.get(memoryWrapperTemplateSource.id);async function loadFrameworkProgrammaticModule(e,t){return memoizeModuleNamespaceFactories(await loadProgrammaticModuleNamespace({backing:e,dependencyNamespaces:t,registries:[frameworkAgentSourceRegistry]}))}export{frameworkAgentSourceRegistry,loadFrameworkProgrammaticModule,memoryWrapperTemplate};

package/dist/src/harness/action-presentation.js

@@ -1 +1 @@
-import{parseJsonObject}from"#shared/json.js";import{normalizePresentationText}from"#shared/presentation-text.js";import{createRuntimeActionRequestFromToolCall}from"#harness/coordination.js";function createPresentedRuntimeActionRequestFromToolCall(e){let t=createRuntimeActionRequestFromToolCall(e),n=projectToolStartLabel(e.tools.get(e.toolCall.toolName),t.input);return n===void 0?{action:t}:{action:t,presentationLabel:n}}function projectToolStartLabel(e,t){let n=e?.label?.start;if(n!==void 0)try{let e=normalizePresentationText(n(parseJsonObject(t)));return e===``?void 0:e}catch{return}}function collectActionPresentation(e){let t=Object.fromEntries(e.flatMap(({action:e,presentationLabel:t})=>t===void 0?[]:[[e.callId,{label:t}]]));return Object.keys(t).length===0?void 0:t}export{collectActionPresentation,createPresentedRuntimeActionRequestFromToolCall,projectToolStartLabel};
+import{normalizePresentationText}from"#shared/presentation-text.js";import{parseJsonObject}from"#shared/json.js";import{createRuntimeActionRequestFromToolCall}from"#harness/coordination.js";function createPresentedRuntimeActionRequestFromToolCall(e){let t=createRuntimeActionRequestFromToolCall(e),n=projectToolStartLabel(e.tools.get(e.toolCall.toolName),t.input);return n===void 0?{action:t}:{action:t,presentationLabel:n}}function projectToolStartLabel(e,t){let n=e?.label?.start;if(n!==void 0)try{let e=normalizePresentationText(n(parseJsonObject(t)));return e===``?void 0:e}catch{return}}function collectActionPresentation(e){let t=Object.fromEntries(e.flatMap(({action:e,presentationLabel:t})=>t===void 0?[]:[[e.callId,{label:t}]]));return Object.keys(t).length===0?void 0:t}export{collectActionPresentation,createPresentedRuntimeActionRequestFromToolCall,projectToolStartLabel};

package/dist/src/harness/action-result-helpers.d.ts

@@ -46,4 +46,5 @@ export declare function createToolResultMessagePartFromToolError(toolError: Type
  * response messages array).
  */
 export declare function createRuntimeToolResultFromMessagePart(part: ToolResultPart): RuntimeToolResultActionResult;
+export declare function isToolResultError(output: ToolResultPart["output"]): boolean;
 export {};

package/dist/src/harness/action-result-helpers.js

@@ -1 +1 @@
-import{toError}from"#shared/errors.js";import{parseJsonValue}from"#shared/json.js";import{authorizationPendingAsJsonObject,isAuthorizationPendingModelOutput,isAuthorizationSignal}from"#harness/authorization.js";import{withToolOutputSerializationError}from"#harness/tool-output-serialization.js";function toJsonValue(e){return isAuthorizationSignal(e)?parseJsonValue(authorizationPendingAsJsonObject({connections:e.challenges.map(e=>e.name)})):isAuthorizationPendingModelOutput(e)?parseJsonValue(authorizationPendingAsJsonObject(e)):parseJsonValue(e===void 0?null:e)}function createRuntimeToolResultFromValue(e){let t={callId:e.callId,kind:`tool-result`,output:toolResultOutputToJsonValue({output:{type:e.isError===!0?`error-json`:`json`,value:e.isError===!0&&e.output instanceof Error?e.output.message:e.output},toolCallId:e.callId,toolName:e.toolName}),toolName:e.toolName};return e.isError===!0?{...t,isError:!0}:t}function createRuntimeToolResultFromStepResult(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,output:e.output,toolName:e.toolName})}function createRuntimeToolResultFromToolError(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,isError:!0,output:toError(e.error),toolName:e.toolName})}function createToolResultMessagePartFromToolError(e){return{type:`tool-result`,toolCallId:e.toolCallId,toolName:e.toolName,output:{type:`error-text`,value:toError(e.error).message}}}function createRuntimeToolResultFromMessagePart(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,output:toolResultOutputToJsonValue({output:e.output,toolCallId:e.toolCallId,toolName:e.toolName}),toolName:e.toolName,isError:isToolResultError(e.output)})}function toolResultOutputToJsonValue(e){return withToolOutputSerializationError({boundary:`action.result`,toolCallId:e.toolCallId,toolName:e.toolName},()=>{switch(e.output.type){case`text`:case`error-text`:return e.output.value;case`json`:case`error-json`:return toJsonValue(e.output.value);case`execution-denied`:return{code:`TOOL_EXECUTION_DENIED`,message:e.output.reason??`Tool execution was denied.`};case`content`:return toJsonValue(e.output.value)}})}function isToolResultError(e){return e.type===`error-json`||e.type===`error-text`||e.type===`execution-denied`}export{createRuntimeToolResultFromMessagePart,createRuntimeToolResultFromStepResult,createRuntimeToolResultFromToolError,createRuntimeToolResultFromValue,createToolResultMessagePartFromToolError};
+import{toError}from"#shared/errors.js";import{parseJsonValue}from"#shared/json.js";import{authorizationPendingAsJsonObject,isAuthorizationPendingModelOutput,isAuthorizationSignal}from"#harness/authorization.js";import{withToolOutputSerializationError}from"#harness/tool-output-serialization.js";function toJsonValue(e){return isAuthorizationSignal(e)?parseJsonValue(authorizationPendingAsJsonObject({connections:e.challenges.map(e=>e.name)})):isAuthorizationPendingModelOutput(e)?parseJsonValue(authorizationPendingAsJsonObject(e)):parseJsonValue(e===void 0?null:e)}function createRuntimeToolResultFromValue(e){let t={callId:e.callId,kind:`tool-result`,output:toolResultOutputToJsonValue({output:{type:e.isError===!0?`error-json`:`json`,value:e.isError===!0&&e.output instanceof Error?e.output.message:e.output},toolCallId:e.callId,toolName:e.toolName}),toolName:e.toolName};return e.isError===!0?{...t,isError:!0}:t}function createRuntimeToolResultFromStepResult(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,output:e.output,toolName:e.toolName})}function createRuntimeToolResultFromToolError(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,isError:!0,output:toError(e.error),toolName:e.toolName})}function createToolResultMessagePartFromToolError(e){return{type:`tool-result`,toolCallId:e.toolCallId,toolName:e.toolName,output:{type:`error-text`,value:toError(e.error).message}}}function createRuntimeToolResultFromMessagePart(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,output:toolResultOutputToJsonValue({output:e.output,toolCallId:e.toolCallId,toolName:e.toolName}),toolName:e.toolName,isError:isToolResultError(e.output)})}function toolResultOutputToJsonValue(e){return withToolOutputSerializationError({boundary:`action.result`,toolCallId:e.toolCallId,toolName:e.toolName},()=>{switch(e.output.type){case`text`:case`error-text`:return e.output.value;case`json`:case`error-json`:return toJsonValue(e.output.value);case`execution-denied`:return{code:`TOOL_EXECUTION_DENIED`,message:e.output.reason??`Tool execution was denied.`};case`content`:return toJsonValue(e.output.value)}})}function isToolResultError(e){return e.type===`error-json`||e.type===`error-text`||e.type===`execution-denied`}export{createRuntimeToolResultFromMessagePart,createRuntimeToolResultFromStepResult,createRuntimeToolResultFromToolError,createRuntimeToolResultFromValue,createToolResultMessagePartFromToolError,isToolResultError};

package/dist/src/harness/advertised-tools.d.ts

@@ -1,7 +1,7 @@
 import type { ToolSet } from "ai";
 import type { HarnessToolDefinition } from "#harness/execute-tool.js";
 import type { HarnessSession, HarnessToolMap } from "#harness/types.js";
-type AdvertisedToolSession = Pick<HarnessSession, "rootSessionId" | "taskId">;
+type AdvertisedToolSession = Pick<HarnessSession, "rootSessionId">;
 type AdvertisedToolMapInput = {
     readonly session: AdvertisedToolSession;
     readonly tools: HarnessToolMap;

package/dist/src/harness/advertised-tools.js

@@ -1 +1 @@
-function getAdvertisedTools(e){return`modelTools`in e?getAdvertisedModelTools(e):isToolDefinitionList(e.tools)?filterUnavailableToolDefinitions(e.tools,e.session):filterUnavailableToolMap(e.tools,e.session)}async function getAdvertisedModelTools(e){return{harnessTools:filterUnavailableToolMap(e.tools,e.session),modelTools:e.modelTools,session:e.session}}function filterUnavailableToolDefinitions(e,t){let n=[];for(let r of e)shouldHideTool(r,t)||n.push(r);return n}function filterUnavailableToolMap(e,t){let n=new Map;for(let[r,i]of e)shouldHideTool(i,t)||n.set(r,i);return n}function shouldHideTool(e,t){let n=t.rootSessionId!==void 0;return e.rootOnly===!0||e.availableInSubagents===!1||e.behavior?.availability.includes(`root-session`)===!0?n:e.behavior?.availability.includes(`delegated-task-child`)===!0&&t.taskId===void 0}function isToolDefinitionList(e){return Array.isArray(e)}export{getAdvertisedTools};
+function getAdvertisedTools(e){return`modelTools`in e?getAdvertisedModelTools(e):isToolDefinitionList(e.tools)?filterUnavailableToolDefinitions(e.tools,e.session):filterUnavailableToolMap(e.tools,e.session)}async function getAdvertisedModelTools(e){return{harnessTools:filterUnavailableToolMap(e.tools,e.session),modelTools:e.modelTools,session:e.session}}function filterUnavailableToolDefinitions(e,t){let n=[];for(let r of e)shouldHideTool(r,t)||n.push(r);return n}function filterUnavailableToolMap(e,t){let n=new Map;for(let[r,i]of e)shouldHideTool(i,t)||n.set(r,i);return n}function shouldHideTool(e,t){let n=t.rootSessionId!==void 0;return e.rootOnly===!0||e.availableInSubagents===!1||e.behavior?.availability.includes(`root-session`)===!0?n:!1}function isToolDefinitionList(e){return Array.isArray(e)}export{getAdvertisedTools};

package/dist/src/harness/announcements.d.ts

@@ -0,0 +1,22 @@
+import type { ContextContainer } from "#context/container.js";
+/**
+ * Framework state announced to the model as an append-only `context.state`
+ * message. The harness appends a message only when `value` differs from the
+ * last value it announced for the same key, so the cached prompt prefix never
+ * changes. Compaction clears the record, which makes the next announcement a
+ * fresh baseline.
+ */
+export interface Announcement {
+    /** Canonical state. Only a changed value produces a message. */
+    readonly value: string;
+    /**
+     * Renders the message for `value`. `previous` is the last announced value,
+     * or `undefined` for a baseline. Returning `undefined` records the value
+     * without adding a message.
+     */
+    render(previous: string | undefined): string | undefined;
+}
+/** Sets or clears the announcement `key` for the current step. */
+export declare function setPendingAnnouncement(ctx: ContextContainer, key: string, announcement: Announcement | undefined): void;
+/** The announcements set for the current step. */
+export declare function getPendingAnnouncements(ctx: Pick<ContextContainer, "get"> | undefined): Readonly<Record<string, Announcement>>;

package/dist/src/harness/announcements.js

@@ -0,0 +1 @@
+import{ContextKey}from"#context/key.js";const PendingAnnouncementsKey=new ContextKey(`eve.pendingAnnouncements`);function setPendingAnnouncement(e,t,n){let{[t]:r,...i}=e.get(PendingAnnouncementsKey)??{};e.setVirtualContext(PendingAnnouncementsKey,n===void 0?i:{...i,[t]:n})}function getPendingAnnouncements(e){return e?.get(PendingAnnouncementsKey)??{}}export{getPendingAnnouncements,setPendingAnnouncement};

package/dist/src/harness/approval-candidates.d.ts

@@ -2,8 +2,11 @@ import type { SessionAuthContext } from "#channel/types.js";
 import type { AuthorizationChallenge } from "#harness/authorization.js";
 import type { SessionStateMap } from "#harness/types.js";
 type ApprovalCandidateStatus = "pending" | "authorization-required" | "allowed" | "rejected" | "failed" | "timed-out" | "stale";
+/** What a responder submitted: a candidate settles its request this way once allowed. */
+export type ApprovalCandidateDecision = "approve" | "cancel";
 interface ApprovalCandidateAuditRecord {
     readonly candidateId: string;
+    readonly decision: ApprovalCandidateDecision;
     readonly requestId: string;
     readonly responder: ApprovalResponderIdentity;
     readonly status: ApprovalCandidateStatus;
@@ -29,6 +32,7 @@ export interface ApprovalSettlementAuditRecord {
 }
 export interface ActiveApprovalCandidate {
     readonly candidateId: string;
+    readonly decision: ApprovalCandidateDecision;
     readonly requestId: string;
     readonly responder: SessionAuthContext;
     readonly status: "pending" | "authorization-required";
@@ -41,10 +45,11 @@ interface ApprovalStateTransition {
     readonly changed: boolean;
     readonly state: SessionStateMap | undefined;
 }
-/** Creates or deduplicates one responder's Allow candidate for a pending request. */
+/** Creates or deduplicates one responder's candidate decision for a pending request. */
 export declare function createApprovalCandidate(input: {
     readonly candidateIdPrefix: string;
     readonly createdAt: number;
+    readonly decision: ApprovalCandidateDecision;
     readonly expiresAt: number;
     readonly requestId: string;
     readonly responder: SessionAuthContext;
@@ -85,7 +90,10 @@ export declare function expireApprovalCandidates(input: {
     readonly now: number;
     readonly state: SessionStateMap | undefined;
 }): SessionStateMap | undefined;
-/** Atomically settles an allowed candidate; every losing candidate becomes stale. */
+/**
+ * Atomically settles a request with an allowed candidate's decision; every
+ * losing candidate becomes stale.
+ */
 export declare function settleAllowedCandidate(input: {
     readonly candidateId: string;
     readonly settledAt: number;

package/dist/src/harness/approval-candidates.js

@@ -1 +1 @@
-const APPROVAL_STATE_KEY=`eve.runtime.hitl.approvalState`;function createApprovalCandidate(e){let t=expireApprovalCandidates({now:e.createdAt,state:e.state}),n=readApprovalState(t);if(n.settlements[e.requestId]!==void 0)return{changed:!1,state:t};let r=e.responder;if(Object.values(n.activeCandidates).find(t=>t.requestId===e.requestId&&sameResponder(t.responder,r))!==void 0)return{changed:!1,state:t};let i=n.activeCandidates[e.candidateIdPrefix]!==void 0||n.candidateHistory.some(t=>t.candidateId===e.candidateIdPrefix)?`${e.candidateIdPrefix}.${n.nextCandidateSequence.toString(36)}`:e.candidateIdPrefix;if(n.activeCandidates[i]!==void 0||n.candidateHistory.some(e=>e.candidateId===i))throw Error(`Approval candidate id collision: "${i}".`);let a={candidateId:i,createdAt:e.createdAt,expiresAt:e.expiresAt,requestId:e.requestId,responder:r,status:`pending`};return{changed:!0,state:writeApprovalState(t,{...n,activeCandidates:{...n.activeCandidates,[a.candidateId]:a},nextCandidateSequence:n.nextCandidateSequence+1})}}function markApprovalCandidatePendingEventEmitted(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];return n===void 0||n.pendingEventEmitted===!0?e.state:writeApprovalState(e.state,{...t,activeCandidates:{...t.activeCandidates,[e.candidateId]:{...n,pendingEventEmitted:!0}}})}function markApprovalCandidateHistoryEventEmitted(e){let t=readApprovalState(e.state),n=!1,r=t.candidateHistory.map(t=>t.candidateId!==e.candidateId||t.eventEmitted===!0?t:(n=!0,{...t,eventEmitted:!0}));return n?writeApprovalState(e.state,{...t,candidateHistory:r}):e.state}function markApprovalSettlementEventEmitted(e){let t=readApprovalState(e.state),n=t.settlements[e.requestId];return n===void 0||n.eventEmitted===!0?e.state:writeApprovalState(e.state,{...t,settlements:{...t.settlements,[e.requestId]:{...n,eventEmitted:!0}}})}function markApprovalCandidateAuthorizationRequired(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];if(n===void 0)return e.state;let r={...n,authorizationChallenges:e.authorizationChallenges,expiresAt:e.expiresAt??n.expiresAt,status:`authorization-required`};return writeApprovalState(e.state,{...t,activeCandidates:{...t.activeCandidates,[e.candidateId]:r}})}function finishApprovalCandidate(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];if(n===void 0)return e.state;let r={...t.activeCandidates};return delete r[e.candidateId],writeApprovalState(e.state,{...t,activeCandidates:r,candidateHistory:[...t.candidateHistory,toCandidateAuditRecord({candidate:n,completedAt:e.completedAt,reason:e.reason,status:e.status})]})}function expireApprovalCandidates(e){let t=e.state,n=Object.values(readApprovalState(t).activeCandidates);for(let r of n)r.expiresAt>e.now||(t=finishApprovalCandidate({candidateId:r.candidateId,completedAt:e.now,state:t,status:`timed-out`}));return t}function settleAllowedCandidate(e){let t=expireApprovalCandidates({now:e.settledAt,state:e.state}),n=readApprovalState(t),r=n.activeCandidates[e.candidateId];if(r===void 0){let r=n.candidateHistory.find(t=>t.candidateId===e.candidateId);if((r&&n.settlements[r.requestId])!==void 0)return{changed:!1,state:t};throw Error(`Unknown approval candidate "${e.candidateId}".`)}return settleRequest({actor:projectResponder(r.responder),candidateId:r.candidateId,outcome:`allowed`,requestId:r.requestId,settledAt:e.settledAt,state:t})}function settleDirectApprovalResponse(e){let t=expireApprovalCandidates({now:e.settledAt,state:e.state});return settleRequest({actor:projectResponder(e.actor),outcome:e.outcome,requestId:e.requestId,settledAt:e.settledAt,state:t})}function getActiveApprovalCandidate(e,t){return readApprovalState(e).activeCandidates[t]}function getApprovalAuditState(e){let t=readApprovalState(e);return{activeCandidates:Object.values(t.activeCandidates),candidateHistory:t.candidateHistory,settlements:Object.values(t.settlements)}}function settleRequest(e){let t=readApprovalState(e.state);if(t.settlements[e.requestId]!==void 0)return{changed:!1,state:e.state};let n={actor:e.actor,candidateId:e.candidateId,outcome:e.outcome,requestId:e.requestId,settledAt:e.settledAt},r={},i=[...t.candidateHistory];for(let n of Object.values(t.activeCandidates)){if(n.requestId!==e.requestId){r[n.candidateId]=n;continue}i.push(toCandidateAuditRecord({candidate:n,completedAt:e.settledAt,status:n.candidateId===e.candidateId?`allowed`:`stale`}))}let a={activeCandidates:r,candidateHistory:i,nextCandidateSequence:t.nextCandidateSequence,settlements:{...t.settlements,[e.requestId]:n}};return{changed:!0,state:writeApprovalState(e.state,a)}}function toCandidateAuditRecord(e){let{authorizationChallenges:t,responder:n,...r}=e.candidate;return{...r,completedAt:e.completedAt,responder:projectResponder(n),reason:e.reason,status:e.status}}function projectResponder(e){return{authenticator:e.authenticator,issuer:e.issuer,principalId:e.principalId,principalType:e.principalType}}function sameResponder(e,t){return e.authenticator===t.authenticator&&e.issuer===t.issuer&&e.principalId===t.principalId&&e.principalType===t.principalType}function readApprovalState(e){let t=e?.[APPROVAL_STATE_KEY];if(typeof t!=`object`||!t)return{activeCandidates:{},candidateHistory:[],nextCandidateSequence:0,settlements:{}};let n=t;return{activeCandidates:typeof n.activeCandidates==`object`&&n.activeCandidates!==null?n.activeCandidates:{},candidateHistory:Array.isArray(n.candidateHistory)?n.candidateHistory:[],nextCandidateSequence:typeof n.nextCandidateSequence==`number`&&Number.isSafeInteger(n.nextCandidateSequence)&&n.nextCandidateSequence>=0?n.nextCandidateSequence:deriveNextCandidateSequence(n),settlements:typeof n.settlements==`object`&&n.settlements!==null?n.settlements:{}}}function deriveNextCandidateSequence(e){return Object.keys(e.activeCandidates??{}).length+(Array.isArray(e.candidateHistory)?e.candidateHistory.length:0)}function writeApprovalState(e,t){return{...e,[APPROVAL_STATE_KEY]:t}}export{createApprovalCandidate,expireApprovalCandidates,finishApprovalCandidate,getActiveApprovalCandidate,getApprovalAuditState,markApprovalCandidateAuthorizationRequired,markApprovalCandidateHistoryEventEmitted,markApprovalCandidatePendingEventEmitted,markApprovalSettlementEventEmitted,settleAllowedCandidate,settleDirectApprovalResponse};
+const APPROVAL_STATE_KEY=`eve.runtime.hitl.approvalState`;function createApprovalCandidate(e){let t=expireApprovalCandidates({now:e.createdAt,state:e.state}),n=readApprovalState(t);if(n.settlements[e.requestId]!==void 0)return{changed:!1,state:t};let r=e.responder;if(Object.values(n.activeCandidates).find(t=>t.requestId===e.requestId&&t.decision===e.decision&&sameResponder(t.responder,r))!==void 0)return{changed:!1,state:t};let i=n.activeCandidates[e.candidateIdPrefix]!==void 0||n.candidateHistory.some(t=>t.candidateId===e.candidateIdPrefix)?`${e.candidateIdPrefix}.${n.nextCandidateSequence.toString(36)}`:e.candidateIdPrefix;if(n.activeCandidates[i]!==void 0||n.candidateHistory.some(e=>e.candidateId===i))throw Error(`Approval candidate id collision: "${i}".`);let a={candidateId:i,createdAt:e.createdAt,decision:e.decision,expiresAt:e.expiresAt,requestId:e.requestId,responder:r,status:`pending`};return{changed:!0,state:writeApprovalState(t,{...n,activeCandidates:{...n.activeCandidates,[a.candidateId]:a},nextCandidateSequence:n.nextCandidateSequence+1})}}function markApprovalCandidatePendingEventEmitted(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];return n===void 0||n.pendingEventEmitted===!0?e.state:writeApprovalState(e.state,{...t,activeCandidates:{...t.activeCandidates,[e.candidateId]:{...n,pendingEventEmitted:!0}}})}function markApprovalCandidateHistoryEventEmitted(e){let t=readApprovalState(e.state),n=!1,r=t.candidateHistory.map(t=>t.candidateId!==e.candidateId||t.eventEmitted===!0?t:(n=!0,{...t,eventEmitted:!0}));return n?writeApprovalState(e.state,{...t,candidateHistory:r}):e.state}function markApprovalSettlementEventEmitted(e){let t=readApprovalState(e.state),n=t.settlements[e.requestId];return n===void 0||n.eventEmitted===!0?e.state:writeApprovalState(e.state,{...t,settlements:{...t.settlements,[e.requestId]:{...n,eventEmitted:!0}}})}function markApprovalCandidateAuthorizationRequired(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];if(n===void 0)return e.state;let r={...n,authorizationChallenges:e.authorizationChallenges,expiresAt:e.expiresAt??n.expiresAt,status:`authorization-required`};return writeApprovalState(e.state,{...t,activeCandidates:{...t.activeCandidates,[e.candidateId]:r}})}function finishApprovalCandidate(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];if(n===void 0)return e.state;let r={...t.activeCandidates};return delete r[e.candidateId],writeApprovalState(e.state,{...t,activeCandidates:r,candidateHistory:[...t.candidateHistory,toCandidateAuditRecord({candidate:n,completedAt:e.completedAt,reason:e.reason,status:e.status})]})}function expireApprovalCandidates(e){let t=e.state,n=Object.values(readApprovalState(t).activeCandidates);for(let r of n)r.expiresAt>e.now||(t=finishApprovalCandidate({candidateId:r.candidateId,completedAt:e.now,state:t,status:`timed-out`}));return t}function settleAllowedCandidate(e){let t=expireApprovalCandidates({now:e.settledAt,state:e.state}),n=readApprovalState(t),r=n.activeCandidates[e.candidateId];if(r===void 0){let r=n.candidateHistory.find(t=>t.candidateId===e.candidateId);if((r&&n.settlements[r.requestId])!==void 0)return{changed:!1,state:t};throw Error(`Unknown approval candidate "${e.candidateId}".`)}return settleRequest({actor:projectResponder(r.responder),candidateId:r.candidateId,outcome:r.decision===`cancel`?`cancelled`:`allowed`,requestId:r.requestId,settledAt:e.settledAt,state:t})}function settleDirectApprovalResponse(e){let t=expireApprovalCandidates({now:e.settledAt,state:e.state});return settleRequest({actor:projectResponder(e.actor),outcome:e.outcome,requestId:e.requestId,settledAt:e.settledAt,state:t})}function getActiveApprovalCandidate(e,t){return readApprovalState(e).activeCandidates[t]}function getApprovalAuditState(e){let t=readApprovalState(e);return{activeCandidates:Object.values(t.activeCandidates),candidateHistory:t.candidateHistory,settlements:Object.values(t.settlements)}}function settleRequest(e){let t=readApprovalState(e.state);if(t.settlements[e.requestId]!==void 0)return{changed:!1,state:e.state};let n={actor:e.actor,candidateId:e.candidateId,outcome:e.outcome,requestId:e.requestId,settledAt:e.settledAt},r={},i=[...t.candidateHistory];for(let n of Object.values(t.activeCandidates)){if(n.requestId!==e.requestId){r[n.candidateId]=n;continue}i.push(toCandidateAuditRecord({candidate:n,completedAt:e.settledAt,status:n.candidateId===e.candidateId?`allowed`:`stale`}))}let a={activeCandidates:r,candidateHistory:i,nextCandidateSequence:t.nextCandidateSequence,settlements:{...t.settlements,[e.requestId]:n}};return{changed:!0,state:writeApprovalState(e.state,a)}}function toCandidateAuditRecord(e){let{authorizationChallenges:t,responder:n,...r}=e.candidate;return{...r,completedAt:e.completedAt,responder:projectResponder(n),reason:e.reason,status:e.status}}function projectResponder(e){return{authenticator:e.authenticator,issuer:e.issuer,principalId:e.principalId,principalType:e.principalType}}function sameResponder(e,t){return e.authenticator===t.authenticator&&e.issuer===t.issuer&&e.principalId===t.principalId&&e.principalType===t.principalType}function readActiveCandidates(e){return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,{...t,decision:t.decision===`cancel`?`cancel`:`approve`}]))}function readApprovalState(e){let t=e?.[APPROVAL_STATE_KEY];if(typeof t!=`object`||!t)return{activeCandidates:{},candidateHistory:[],nextCandidateSequence:0,settlements:{}};let n=t;return{activeCandidates:typeof n.activeCandidates==`object`&&n.activeCandidates!==null?readActiveCandidates(n.activeCandidates):{},candidateHistory:Array.isArray(n.candidateHistory)?n.candidateHistory:[],nextCandidateSequence:typeof n.nextCandidateSequence==`number`&&Number.isSafeInteger(n.nextCandidateSequence)&&n.nextCandidateSequence>=0?n.nextCandidateSequence:deriveNextCandidateSequence(n),settlements:typeof n.settlements==`object`&&n.settlements!==null?n.settlements:{}}}function deriveNextCandidateSequence(e){return Object.keys(e.activeCandidates??{}).length+(Array.isArray(e.candidateHistory)?e.candidateHistory.length:0)}function writeApprovalState(e,t){return{...e,[APPROVAL_STATE_KEY]:t}}export{createApprovalCandidate,expireApprovalCandidates,finishApprovalCandidate,getActiveApprovalCandidate,getApprovalAuditState,markApprovalCandidateAuthorizationRequired,markApprovalCandidateHistoryEventEmitted,markApprovalCandidatePendingEventEmitted,markApprovalSettlementEventEmitted,settleAllowedCandidate,settleDirectApprovalResponse};

package/dist/src/harness/approval-delivery-coordinator.d.ts

@@ -13,17 +13,16 @@ interface ApprovalDeliveryResult {
  *
  * | State | Input | Transition |
  * | --- | --- | --- |
- * | pending request | Approve | create responder-bound candidate |
- * | pending request | Cancel | settle cancelled and stale candidates |
+ * | pending request | Approve or Cancel | create responder-bound candidate |
  * | pending candidate | coordinator pass | run current authorizer |
- * | pending candidate | allowed | settle approved and stale competitors |
+ * | pending candidate | allowed | settle with its decision; competitors go stale |
  * | pending candidate | rejected/error/expiry | append terminal history |
  * | pending candidate | authorization required | persist private challenge |
  * | authorization required | matching callback | re-run current authorizer |
  * | settled request | any later response | no state change |
  *
- * Delivery ingestion returns before authorizer work so Cancel and candidate
- * creation commit before long-running policy execution. Candidate results also
+ * Delivery ingestion returns before authorizer work so candidate creation
+ * commits before long-running policy execution. Candidate results also
  * commit before lifecycle events are projected by the next stack layer.
  */
 export declare function coordinateApprovalDelivery(input: {