eve 0.68.0 → 0.70.0

package/dist/src/execution/workflow-runtime.js

@@ -1 +1 @@
-import{randomBytes}from"node:crypto";import{createEveActivityRoutePath}from"#protocol/routes.js";import{createLogger,logError}from"#internal/logging.js";import{getChannelActivityPresentation}from"#channel/activity-renderer.js";import{sessionCommandHookToken,sessionInboxHookToken}from"#execution/session-inbox/address.js";import{ActivityObserverKey}from"#context/keys.js";import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{walkCauseChain}from"#shared/errors.js";import{normalizePersistedMessageStreamEvent}from"#protocol/message-version.js";import{cancelRun,getHookByToken,getRun,getWorld,start}from"#internal/workflow/runtime.js";import{serializeContext}from"#context/serialize.js";import{resolveEffectiveAgentRuntime}from"#execution/effective-agent-config.js";import{AcceptedSessionIdentityError,resolveSessionInbox,resumeSessionInbox}from"#execution/session-inbox/resume.js";import{getCompiledRuntimeAgentBundle}from"#runtime/sessions/compiled-agent-cache.js";import{EntityConflictError,HookNotFoundError,RunExpiredError,WorkflowRunNotFoundError}from"#compiled/@workflow/errors/index.js";import{buildSessionAttributes,buildSubagentRootAttributes,readParentLineage}from"#execution/eve-workflow-attributes.js";import{ROOT_RUNTIME_AGENT_NODE_ID}from"#runtime/graph.js";import{initializeSessionInstrumentation}from"#instrumentation/runtime.js";import{createWorkflowCallbackUrl,resolveWorkflowCallbackBaseUrl}from"#execution/workflow-callback-url.js";import{context,trace}from"#compiled/@opentelemetry/api/index.js";import{normalizeEveAttributes}from"#runtime/attributes/normalize.js";import{buildRunContext}from"#execution/runtime-context.js";import{parseNdjsonStream}from"#execution/ndjson-stream.js";import{SESSION_HANDOFF_VERSION}from"#execution/session/entry-input.js";import{buildInvocationAttributes}from"#internal/invocation/metadata.js";import{isAgentTraceContext}from"#tracing/agent-trace-context.js";import{ACTIVITY_COLLECTOR_WORKFLOW_NAME,SESSION_TIMEOUT_WORKFLOW_NAME,WORKFLOW_ENTRY_NAME,WORKFLOW_TOOL_RUN_WORKFLOW_NAME}from"#execution/stable-workflow-names.js";const EVE_PACKAGE_INFO=resolveInstalledPackageInfo(),COMMAND_HOOK_READY_TIMEOUT_MS=3e4,STABLE_ID_BASE=EVE_PACKAGE_INFO.name,log=createLogger(`execution.workflow-runtime`),workflowEntryReference={workflowId:`workflow//${STABLE_ID_BASE}//${WORKFLOW_ENTRY_NAME}`},sessionTimeoutWorkflowReference={workflowId:`workflow//${STABLE_ID_BASE}//${SESSION_TIMEOUT_WORKFLOW_NAME}`},activityCollectorWorkflowReference={workflowId:`workflow//${STABLE_ID_BASE}//${ACTIVITY_COLLECTOR_WORKFLOW_NAME}`},workflowToolRunWorkflowReference={workflowId:`workflow//${STABLE_ID_BASE}//${WORKFLOW_TOOL_RUN_WORKFLOW_NAME}`};function createWorkflowRuntime(e){return{async createSession(t){let n=await getCompiledRuntimeAgentBundle({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:e.nodeId}),r=buildRunContext({bundle:n,dynamicSubagentAgentConfig:e.dynamicSubagentAgentConfig,run:t}),i=resolveEffectiveAgentRuntime(n,r);initializeSessionInstrumentation({agentName:i.turnAgent.id,ctx:r});let a=i.limits?.sessionTimeoutMs,o=n.resolvedAgent.config?.experimental?.workflow?.retention,s,c=t.activityObserver;if(t.parent===void 0&&c===void 0&&(getChannelActivityPresentation(t.adapter)?.renderers.length??0)>0){let e=serializeContext(r),t=randomBytes(32).toString(`base64url`),n={expiresAt:new Date(Date.now()+(typeof a==`number`?a:864e5)).toISOString(),serializedContext:e,token:t};try{s=(await startWorkflowOnCurrentDeployment(activityCollectorWorkflowReference,[n],{experimental_retention:o})).runId;let e=process.env.VERCEL_URL?`https://${process.env.VERCEL_URL}`:`http://localhost:3000`,i=resolveWorkflowCallbackBaseUrl(e);c={sink:{url:createWorkflowCallbackUrl(i,createEveActivityRoutePath(t)),version:1}},r.set(ActivityObserverKey,c)}catch{await cancelActivityCollector(s),s=void 0,log.warn(`failed to start activity collector`)}}let l=serializeContext(r),u=readParentLineage(l),d={kind:`initial`,input:t.input,ownerDeploymentId:await resolveCurrentWorkflowDeploymentId(),serializedContext:l},f=t.taskId??t.callback?.taskId;t.limits!==void 0&&(d.limits=t.limits),f!==void 0&&(d.taskId=f),s!==void 0&&(d.activityCollectorRunId=s),t.continuationConflictCommand!==void 0&&(d.continuationConflictCommand=t.continuationConflictCommand),a!==void 0&&(d.sessionTimeoutMs=a),o!==void 0&&(d.retention=o);let p={...u.sessionId===void 0?buildSessionAttributes({serializedContext:l}):buildSubagentRootAttributes({identity:{nodeId:n.nodeId??ROOT_RUNTIME_AGENT_NODE_ID},parentCallId:u.callId,parentSessionId:u.sessionId,parentTurnId:u.turnId,rootSessionId:u.rootSessionId??u.sessionId,serializedContext:l}),...t.externalInvocation===void 0?{}:buildInvocationAttributes(t.externalInvocation)},m;try{let e={allowReservedAttributes:!0,attributes:normalizeEveAttributes(p)};o!==void 0&&(e.experimental_retention=o),m=await startWorkflowOnDeployment(workflowEntryReference,[d],d.ownerDeploymentId,e)}catch(e){throw await cancelActivityCollector(s),logError(log,`failed to start workflow run`,e,{continuationToken:t.continuationToken}),e}let h,getEvents=()=>(h??=parseNdjsonStream(()=>getRun(m.runId).getReadable(),normalizePersistedEvent),h);return{get events(){return getEvents()},sessionId:m.runId}},async dispatchContinuation(e){return await dispatchWorkflowCommand(e.continuationToken,e.command)},async dispatchSession(e){return await dispatchWorkflowCommand({sessionId:e.sessionId},e.command)},async getEventStream(e,t){return parseNdjsonStream(()=>getRun(e).getReadable({startIndex:t?.startIndex}),normalizePersistedEvent)},async getStreamTailIndex(e){let t=getRun(e).getReadable();try{return await t.getTailIndex()}finally{await t.cancel().catch(()=>{})}},async resolveContinuation(e){try{return await resolveSessionInbox(e)}catch(t){if(HookNotFoundError.is(t))return;throw logError(log,`failed to resolve session by continuation token`,t,{continuationToken:e}),t}}}}async function startSessionOwnerStep(e){"use step";let t={activationToken:e.activationToken,checkpoint:e.checkpoint,delivery:e.delivery,handoffVersion:SESSION_HANDOFF_VERSION,kind:`handoff`,ownerDeploymentId:e.targetDeploymentId,sessionWritable:getRun(e.anchorRunId).getWritable(),sessionId:e.anchorRunId};await startWorkflowOnDeployment(workflowEntryReference,[t],e.targetDeploymentId,e.checkpoint.retention===void 0?void 0:{experimental_retention:e.checkpoint.retention})}function normalizePersistedEvent(e){return normalizePersistedMessageStreamEvent(e)}async function cancelActivityCollector(e){if(e!==void 0)try{await cancelRun(await getWorld(),e,{cancelReason:`Root session creation did not complete`})}catch{log.warn(`failed to cancel unowned activity collector`)}}async function dispatchWorkflowCommand(e,t){let n;try{let r=await resumeSessionInbox(e,t);n={runId:r.ownerRunId,sessionId:await r.sessionId}}catch(n){if(isInactiveCommandTarget(n)){if(t.kind===`send`&&typeof e!=`string`)try{let t=await getRun(e.sessionId).status;if(t===`pending`||t===`running`)return{status:`session_not_active`,retryable:!0}}catch(e){if(!isInactiveCommandTarget(e))throw e}return inactiveCommandResult(t)}throw logError(log,`failed to dispatch session command`,n,{command:t.kind,token:e}),n}if(t.kind===`reset`){let t=typeof e==`string`?e:sessionCommandHookToken(e.sessionId),r=new Set([sessionCommandHookToken(n.sessionId),t]);await Promise.all([...r].map(e=>waitForHookRelease(sessionInboxHookToken(e),n.runId)))}return activeCommandResult(t,n.sessionId)}function activeCommandResult(e,t){return e.kind===`reset`?{previousSessionId:t,status:`reset`}:e.kind===`send`&&e.delivery!==void 0?{sessionId:t,status:`accepted`,deliveryId:e.delivery.deliveryId}:{sessionId:t,status:`accepted`}}function inactiveCommandResult(e){return e.kind===`send`?{status:`session_not_active`}:e.kind===`cancel`?{status:`no_active_turn`}:{status:`no_active_session`}}async function requestWorkflowTurnCancellation(e){let t={kind:`cancel`};return e.taskId!==void 0&&(t.taskId=e.taskId),e.tasks!==void 0&&(t.tasks=e.tasks),e.turnId!==void 0&&(t.turnId=e.turnId),await dispatchWorkflowCommand({sessionId:e.sessionId},t)}function isInactiveCommandTarget(e){if(e instanceof AcceptedSessionIdentityError)return!1;if(HookNotFoundError.is(e))return!0;for(let t of walkCauseChain(e))if(WorkflowRunNotFoundError.is(t)||RunExpiredError.is(t)||EntityConflictError.is(t))return!0;return!1}async function waitForCommandHookOwner(e){let t=Date.now()+COMMAND_HOOK_READY_TIMEOUT_MS;for(;;)try{return normalizeWorkflowHook(await getHookByToken(e))}catch(e){if(!HookNotFoundError.is(e)||Date.now()>=t)throw e;await new Promise(e=>setTimeout(e,20))}}async function waitForHookRelease(e,t){let n=Date.now()+COMMAND_HOOK_READY_TIMEOUT_MS;for(;;){try{if(normalizeWorkflowHook(await getHookByToken(e)).runId!==t)return}catch(e){if(HookNotFoundError.is(e))return;throw e}if(Date.now()>=n)throw Error(`Timed out waiting for session "${t}" to release inbox "${e}".`);await new Promise(e=>setTimeout(e,20))}}async function startWorkflowOnCurrentDeployment(e,t,n){return await startWorkflowOnDeployment(e,t,await resolveCurrentWorkflowDeploymentId(),n)}async function startWorkflowOnDeployment(e,t,n,r){return await withWorkflowStartContext(async()=>{if(n.length===0||n===`latest`)throw Error(`Workflow starts require an exact deployment id.`);return await start(e,t,{...r,deploymentId:n})})}async function resolveCurrentWorkflowDeploymentId(){let e=process.env.VERCEL_DEPLOYMENT_ID?.trim()||await(await getWorld()).getDeploymentId();if(e.length===0||e===`latest`)throw Error(`Workflow runtime could not resolve an exact deployment id.`);return e}async function withWorkflowStartContext(e){let t=context.active(),n=isAgentTraceContext(t)?trace.deleteSpan(t):t;return await context.with(n,e)}function normalizeWorkflowHook(e){if(typeof e!=`object`||!e||!(`runId`in e))throw Error(`Workflow hook did not include a run id.`);let t=e.runId;if(typeof t!=`string`||t.length===0)throw Error(`Workflow hook did not include a run id.`);return{runId:t}}export{activityCollectorWorkflowReference,createWorkflowRuntime,requestWorkflowTurnCancellation,sessionTimeoutWorkflowReference,startSessionOwnerStep,startWorkflowOnCurrentDeployment,waitForCommandHookOwner,workflowEntryReference,workflowToolRunWorkflowReference};
+import{createLogger,logError}from"#internal/logging.js";import{sessionCommandHookToken,sessionInboxHookToken}from"#execution/session-inbox/address.js";import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{walkCauseChain}from"#shared/errors.js";import{getCompiledRuntimeAgentBundle}from"#runtime/sessions/compiled-agent-cache.js";import{ROOT_RUNTIME_AGENT_NODE_ID}from"#runtime/graph.js";import{serializeContext}from"#context/serialize.js";import{AcceptedSessionIdentityError,resolveSessionInbox,resumeSessionInbox}from"#execution/session-inbox/resume.js";import{resolveEffectiveAgentRuntime}from"#execution/effective-agent-config.js";import{EntityConflictError,HookNotFoundError,RunExpiredError,WorkflowRunNotFoundError}from"#compiled/@workflow/errors/index.js";import{getHookByToken,getRun,getWorld,start}from"#internal/workflow/runtime.js";import{initializeSessionInstrumentation}from"#instrumentation/runtime.js";import{buildSessionAttributes,buildSubagentRootAttributes,readParentLineage}from"#execution/eve-workflow-attributes.js";import{context,trace}from"#compiled/@opentelemetry/api/index.js";import{normalizeEveAttributes}from"#runtime/attributes/normalize.js";import{buildRunContext}from"#execution/runtime-context.js";import{readSessionEventStream,readSessionStreamTailIndex}from"#execution/session-event-stream.js";import{SESSION_HANDOFF_VERSION}from"#execution/session/entry-input.js";import{buildInvocationAttributes}from"#internal/invocation/metadata.js";import{isAgentTraceContext}from"#tracing/agent-trace-context.js";import{SESSION_TIMEOUT_WORKFLOW_NAME,WORKFLOW_ENTRY_NAME,WORKFLOW_TOOL_RUN_WORKFLOW_NAME}from"#execution/stable-workflow-names.js";const EVE_PACKAGE_INFO=resolveInstalledPackageInfo(),COMMAND_HOOK_READY_TIMEOUT_MS=3e4,STABLE_ID_BASE=EVE_PACKAGE_INFO.name,log=createLogger(`execution.workflow-runtime`),workflowEntryReference={workflowId:`workflow//${STABLE_ID_BASE}//${WORKFLOW_ENTRY_NAME}`},sessionTimeoutWorkflowReference={workflowId:`workflow//${STABLE_ID_BASE}//${SESSION_TIMEOUT_WORKFLOW_NAME}`},workflowToolRunWorkflowReference={workflowId:`workflow//${STABLE_ID_BASE}//${WORKFLOW_TOOL_RUN_WORKFLOW_NAME}`};function createWorkflowRuntime(e){return{async createSession(t){let n=await getCompiledRuntimeAgentBundle({compiledArtifactsSource:e.compiledArtifactsSource,nodeId:e.nodeId}),r=buildRunContext({bundle:n,dynamicSubagentAgentConfig:e.dynamicSubagentAgentConfig,run:t}),i=resolveEffectiveAgentRuntime(n,r);initializeSessionInstrumentation({agentName:i.turnAgent.id,ctx:r});let a=i.limits?.sessionTimeoutMs,o=n.resolvedAgent.config?.experimental?.workflow?.retention,s=serializeContext(r),c=readParentLineage(s),l={kind:`initial`,input:t.input,ownerDeploymentId:await resolveCurrentWorkflowDeploymentId(),serializedContext:s};t.limits!==void 0&&(l.limits=t.limits),t.continuationConflictCommand!==void 0&&(l.continuationConflictCommand=t.continuationConflictCommand),a!==void 0&&(l.sessionTimeoutMs=a),o!==void 0&&(l.retention=o);let u={...c.sessionId===void 0?buildSessionAttributes({serializedContext:s}):buildSubagentRootAttributes({identity:{nodeId:n.nodeId??ROOT_RUNTIME_AGENT_NODE_ID},parentCallId:c.callId,parentSessionId:c.sessionId,parentTurnId:c.turnId,rootSessionId:c.rootSessionId??c.sessionId,serializedContext:s}),...t.externalInvocation===void 0?{}:buildInvocationAttributes(t.externalInvocation)},d;try{let e={allowReservedAttributes:!0,attributes:normalizeEveAttributes(u)};o!==void 0&&(e.experimental_retention=o),d=await startWorkflowOnDeployment(workflowEntryReference,[l],l.ownerDeploymentId,e)}catch(e){throw logError(log,`failed to start workflow run`,e,{continuationToken:t.continuationToken}),e}let f,getEvents=()=>(f??=readSessionEventStream(d.runId),f);return{get events(){return getEvents()},sessionId:d.runId}},async dispatchContinuation(e){return await dispatchWorkflowCommand(e.continuationToken,e.command)},async dispatchSession(e){return await dispatchWorkflowSessionCommand(e)},async getEventStream(e,t){return readSessionEventStream(e,t?.startIndex)},async getStreamTailIndex(e){return await readSessionStreamTailIndex(e)},async resolveContinuation(e){try{return await resolveSessionInbox(e)}catch(t){if(HookNotFoundError.is(t))return;throw logError(log,`failed to resolve session by continuation token`,t,{continuationToken:e}),t}}}}async function startSessionOwnerStep(e){"use step";let t={activationToken:e.activationToken,checkpoint:e.checkpoint,delivery:e.delivery,handoffVersion:SESSION_HANDOFF_VERSION,kind:`handoff`,ownerDeploymentId:e.targetDeploymentId,sessionWritable:getRun(e.anchorRunId).getWritable(),sessionId:e.anchorRunId};await startWorkflowOnDeployment(workflowEntryReference,[t],e.targetDeploymentId,e.checkpoint.retention===void 0?void 0:{experimental_retention:e.checkpoint.retention})}async function dispatchWorkflowCommand(e,t){let n;try{let r=await resumeSessionInbox(e,t);n={runId:r.ownerRunId,sessionId:await r.sessionId}}catch(n){if(isInactiveCommandTarget(n)){if(t.kind===`send`&&typeof e!=`string`)try{let t=await getRun(e.sessionId).status;if(t===`pending`||t===`running`)return{status:`session_not_active`,retryable:!0}}catch(e){if(!isInactiveCommandTarget(e))throw e}return inactiveCommandResult(t)}throw logError(log,`failed to dispatch session command`,n,{command:t.kind,token:e}),n}if(t.kind===`reset`){let t=typeof e==`string`?e:sessionCommandHookToken(e.sessionId),r=new Set([sessionCommandHookToken(n.sessionId),t]);await Promise.all([...r].map(e=>waitForHookRelease(sessionInboxHookToken(e),n.runId)))}return activeCommandResult(t,n.sessionId)}function activeCommandResult(e,t){return e.kind===`reset`?{previousSessionId:t,status:`reset`}:e.kind===`send`&&e.delivery!==void 0?{sessionId:t,status:`accepted`,deliveryId:e.delivery.deliveryId}:{sessionId:t,status:`accepted`}}function inactiveCommandResult(e){return e.kind===`send`?{status:`session_not_active`}:e.kind===`cancel`?{status:`no_active_turn`}:{status:`no_active_session`}}async function dispatchWorkflowSessionCommand(e){return await dispatchWorkflowCommand({sessionId:e.sessionId},e.command)}async function requestWorkflowTurnCancellation(e){let t={kind:`cancel`};return e.turnId!==void 0&&(t.turnId=e.turnId),await dispatchWorkflowCommand({sessionId:e.sessionId},t)}function isInactiveCommandTarget(e){if(e instanceof AcceptedSessionIdentityError)return!1;if(HookNotFoundError.is(e))return!0;for(let t of walkCauseChain(e))if(WorkflowRunNotFoundError.is(t)||RunExpiredError.is(t)||EntityConflictError.is(t))return!0;return!1}async function waitForCommandHookOwner(e){let t=Date.now()+COMMAND_HOOK_READY_TIMEOUT_MS;for(;;)try{return normalizeWorkflowHook(await getHookByToken(e))}catch(e){if(!HookNotFoundError.is(e)||Date.now()>=t)throw e;await new Promise(e=>setTimeout(e,20))}}async function waitForHookRelease(e,t){let n=Date.now()+COMMAND_HOOK_READY_TIMEOUT_MS;for(;;){try{if(normalizeWorkflowHook(await getHookByToken(e)).runId!==t)return}catch(e){if(HookNotFoundError.is(e))return;throw e}if(Date.now()>=n)throw Error(`Timed out waiting for session "${t}" to release inbox "${e}".`);await new Promise(e=>setTimeout(e,20))}}async function startWorkflowOnCurrentDeployment(e,t,n){return await startWorkflowOnDeployment(e,t,await resolveCurrentWorkflowDeploymentId(),n)}async function startWorkflowOnDeployment(e,t,n,r){return await withWorkflowStartContext(async()=>{if(n.length===0||n===`latest`)throw Error(`Workflow starts require an exact deployment id.`);return await start(e,t,{...r,deploymentId:n})})}async function resolveCurrentWorkflowDeploymentId(){let e=process.env.VERCEL_DEPLOYMENT_ID?.trim()||await(await getWorld()).getDeploymentId();if(e.length===0||e===`latest`)throw Error(`Workflow runtime could not resolve an exact deployment id.`);return e}async function withWorkflowStartContext(e){let t=context.active(),n=isAgentTraceContext(t)?trace.deleteSpan(t):t;return await context.with(n,e)}function normalizeWorkflowHook(e){if(typeof e!=`object`||!e||!(`runId`in e))throw Error(`Workflow hook did not include a run id.`);let t=e.runId;if(typeof t!=`string`||t.length===0)throw Error(`Workflow hook did not include a run id.`);return{runId:t}}export{createWorkflowRuntime,dispatchWorkflowSessionCommand,requestWorkflowTurnCancellation,sessionTimeoutWorkflowReference,startSessionOwnerStep,startWorkflowOnCurrentDeployment,waitForCommandHookOwner,workflowEntryReference,workflowToolRunWorkflowReference};

package/dist/src/execution/workflow-webhook-route.js

@@ -1 +1 @@
-import{walkCauseChain}from"#shared/errors.js";import{resumeWebhook}from"#internal/workflow/runtime.js";import{HookNotFoundError}from"#compiled/@workflow/errors/index.js";const WORKFLOW_WEBHOOK_ROUTE_PATTERN=`/.well-known/workflow/v1/webhook/:token`;async function handleWorkflowWebhookRequest(e,t){let n=t.params.token;if(typeof n!=`string`||n.length===0)return Response.json({error:`Missing webhook token.`,ok:!1},{status:400});try{let t=new Request(e.url,{method:e.method,headers:new Headers(e.headers),body:e.body,signal:e.signal,duplex:`half`});return await resumeWebhook(n,t)}catch(e){for(let t of walkCauseChain(e))if(HookNotFoundError.is(t))return Response.json({error:`Webhook not pending.`,ok:!1},{status:404});throw e}}export{WORKFLOW_WEBHOOK_ROUTE_PATTERN,handleWorkflowWebhookRequest};
+import{walkCauseChain}from"#shared/errors.js";import{HookNotFoundError}from"#compiled/@workflow/errors/index.js";import{resumeWebhook}from"#internal/workflow/runtime.js";const WORKFLOW_WEBHOOK_ROUTE_PATTERN=`/.well-known/workflow/v1/webhook/:token`;async function handleWorkflowWebhookRequest(e,t){let n=t.params.token;if(typeof n!=`string`||n.length===0)return Response.json({error:`Missing webhook token.`,ok:!1},{status:400});try{let t=new Request(e.url,{method:e.method,headers:new Headers(e.headers),body:e.body,signal:e.signal,duplex:`half`});return await resumeWebhook(n,t)}catch(e){for(let t of walkCauseChain(e))if(HookNotFoundError.is(t))return Response.json({error:`Webhook not pending.`,ok:!1},{status:404});throw e}}export{WORKFLOW_WEBHOOK_ROUTE_PATTERN,handleWorkflowWebhookRequest};

package/dist/src/extensions/code/extension/lib/connect-authentication.js

@@ -1 +1 @@
-import"../extension.js";import{ConnectError,ConnectorInstallationRequiredError,getToken}from"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/token.js";import"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/index.js";import{authenticateVercel}from"./credentials.js";async function authenticateTurn(e,t,n=getToken){if(e.vercel===void 0)return;let r=await t(),i=await resolveToken(e.vercel.connector,{subject:{type:`app`}},n);await authenticateVercel(r,{token:i,delivery:e.vercel.delivery,broker:e.broker})}async function resolveToken(e,t,n){try{let r=await n(e,t);if(r.length===0)throw Error(`Connect returned an empty token`);return r}catch(t){let n=t instanceof ConnectorInstallationRequiredError?`connector installation is required`:t instanceof ConnectError?`Connect rejected the token request`:`Connect token request failed`,r=t instanceof Error?t.message:String(t);throw Error(`${n} for ${JSON.stringify(e)}: ${r}`,{cause:t})}}export{authenticateTurn};
+import"../extension.js";import{authenticateVercel}from"./credentials.js";import{ConnectError,ConnectorInstallationRequiredError,getToken}from"#compiled/@vercel/connect/index.js";async function authenticateTurn(e,t,n=getToken){if(e.vercel===void 0)return;let r=await t(),i=await resolveToken(e.vercel.connector,{subject:{type:`app`}},n);await authenticateVercel(r,{token:i,delivery:e.vercel.delivery,broker:e.broker})}async function resolveToken(e,t,n){try{let r=await n(e,t);if(r.length===0)throw Error(`Connect returned an empty token`);return r}catch(t){let n=t instanceof ConnectorInstallationRequiredError?`connector installation is required`:t instanceof ConnectError?`Connect rejected the token request`:`Connect token request failed`,r=t instanceof Error?t.message:String(t);throw Error(`${n} for ${JSON.stringify(e)}: ${r}`,{cause:t})}}export{authenticateTurn};

package/dist/src/extensions/code/extension/lib/github-shell.js

@@ -1 +1 @@
-import{getToken}from"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/token.js";import"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/index.js";import{shellQuote}from"./shell.js";import{toolingPaths}from"./tooling.js";import{validateRepositoryRoot}from"./repository-root.js";import{posix}from"node:path";const MAX_OUTPUT_BYTES=1e5,leaseQueues=new Map,ALLOWED_GIT_REMOTE_COMMANDS=new Set([`fetch`,`ls-remote`,`pull`,`push`]);function githubShellApproval(e){if(!e)return`not-applicable`;try{return validateGitHubShellInput(e),`not-applicable`}catch(e){return{type:`denied`,reason:e instanceof Error?e.message:`Invalid GitHub command.`}}}async function executeGitHubShell(e,t,n){if(!t)throw Error(`GitHub command access is not configured for this agent.`);let r=validateGitHubShellInput(e),i=await n.getSandbox(),a=resolveWorkingDirectory(i,e.workingDirectory);(r[0]===`git`||r[0]===`gh-signed-commit`)&&(a=await validateRepositoryRoot(i,a));let o=e.permissions[0].repositories,s=await assertCommandTargets(r,o,a,i),c=repositoryNames(o,t.org),l={authorizationDetails:[{type:`github_app_installation`,org:t.org,repositories:c}],subject:{type:`app`}},u=await(n.getConnectToken??getToken)(t.connector,l);if(!u)throw Error(`Connect returned an empty token for ${JSON.stringify(t.connector)}.`);let d=executablePath(r[0],i),f=s?[`-c`,`protocol.allow=never`,`-c`,`protocol.https.allow=always`,r[1],`https://github.com/${s}.git`,...r.slice(3)]:r.slice(1),p=`cd ${shellQuote(a)} && exec ${shellQuote(d)} ${f.map(shellQuote).join(` `)}`,m=`Basic ${Buffer.from(`x-access-token:${u}`).toString(`base64`)}`,h=crypto.randomUUID(),g=`eve-github-${h}`,_=`/tmp/eve-code-gh-${h}`,v=`Basic ${Buffer.from(`x-access-token:${g}`).toString(`base64`)}`,y;try{y=await withGitHubCredentialLease(i,n.sessionId,{authorization:m,placeholder:g,placeholderAuthorization:v,token:u},()=>{let e={GH_CONFIG_DIR:_,GH_PROMPT_DISABLED:`1`};return r[0]!==`git`&&(e.GH_TOKEN=g),e.GIT_CONFIG_COUNT=`2`,e.GIT_CONFIG_KEY_0=`http.https://github.com/.extraheader`,e.GIT_CONFIG_VALUE_0=`Authorization: ${v}`,e.GIT_CONFIG_KEY_1=`core.hooksPath`,e.GIT_CONFIG_VALUE_1=`/dev/null`,e.GIT_TERMINAL_PROMPT=`0`,e.PATH=`/usr/local/bin:/usr/bin:/bin`,i.run({command:p,env:e})},t.broker)}finally{await i.removePath({path:_,recursive:!0,force:!0})}let b=sanitizeOutput(y.stdout,u,m),x=sanitizeOutput(y.stderr,u,m);return{exitCode:y.exitCode,stdout:b.value,stderr:x.value,truncated:b.truncated||x.truncated}}async function withGitHubCredentialLease(e,t,n,r,i){let a=leaseQueues.get(t)??Promise.resolve(),o,s=new Promise(e=>{o=e}),c=a.then(()=>s);leaseQueues.set(t,c),await a;try{return await i(e,{"api.github.com":[{match:{headers:[{key:{exact:`authorization`},value:{regex:`^(?:token|Bearer) ${n.placeholder}$`}}]},transform:[{headers:{authorization:`Bearer ${n.token}`}}]}],"github.com":[{match:{headers:[{key:{exact:`authorization`},value:{exact:n.placeholderAuthorization}}]},transform:[{headers:{authorization:n.authorization}}]}]}),await r()}finally{try{await i(e,null)}finally{o(),leaseQueues.get(t)===c&&leaseQueues.delete(t)}}}function parseCommand(e){let t=e.trim();if(!t)throw Error(`GitHub command must not be empty.`);let n=[],r=``,i=null,a=!1,o=!1;for(let e of t){if(a){r+=e,a=!1,o=!0;continue}if(e===`\\`&&i!==`single`){a=!0,o=!0;continue}if(i===`single`){e===`'`?i=null:r+=e;continue}if(i===`double`){if(e===`"`)i=null;else if(e===`$`||e==="`")throw unsupportedSyntax();else r+=e;continue}if(e===`'`)i=`single`,o=!0;else if(e===`"`)i=`double`,o=!0;else if(/\s/u.test(e))o&&=(n.push(r),r=``,!1);else if(";&|<>$`(){}".includes(e))throw unsupportedSyntax();else r+=e,o=!0}if(a||i)throw Error(`GitHub command contains an unfinished quote or escape.`);if(o&&n.push(r),n.length===0)throw Error(`GitHub command must not be empty.`);return n}function validateGitHubShellInput(e){let t=parseCommand(e.command),n=e.permissions[0];if(e.permissions.length!==1||n?.provider!==`github`)throw Error(`Exactly one GitHub permission is required.`);if(n.access!==`write`)throw Error(`GitHub App commands require explicit write-capable access.`);if(!e.description.trim())throw Error(`description must describe the intended result.`);let[r,i]=t;if(r===`gh`){if(!i)throw Error(`A gh subcommand is required.`)}else if(r===`git`){if(!i||!ALLOWED_GIT_REMOTE_COMMANDS.has(i))throw Error(`Authenticated git supports only fetch, ls-remote, pull, and push; clone with gh repo clone.`)}else if(r!==`gh-signed-commit`)throw Error(`GitHub commands must use gh, an authenticated git remote command, or gh-signed-commit.`);return t}async function assertCommandTargets(e,t,n,r){let i=new Set(t.map(e=>e.toLowerCase())),a,o;if(e[0]===`git`){if(e[2]!==`origin`)throw Error(`Authenticated git commands must use the validated origin remote.`);let t=e[1]===`push`,i=await r.run({command:`cd ${shellQuote(n)} && git remote get-url ${t?`--push `:``}origin`,env:{GIT_TERMINAL_PROMPT:`0`,PATH:`/usr/bin:/bin`}});if(i.exitCode!==0)throw Error(`Could not resolve the origin GitHub repository.`);a=repositoryFromRemote(i.stdout.trim()),o=[a]}else if(e[0]===`gh-signed-commit`){if(o=repoFlagTargets(e.slice(1)),o.length===0)throw Error(`gh-signed-commit requires an explicit --repo owner/repository target.`)}else o=repoFlagTargets(e.slice(1)),e[1]===`repo`&&(e[2]===`clone`||e[2]===`view`||e[2]===`fork`)&&e[3]&&!e[3].startsWith(`-`)&&o.push(canonicalRepository(e[3]));for(let e of o)if(!i.has(e.toLowerCase()))throw Error(`Command target ${JSON.stringify(e)} is not in the declared repositories.`);return a}function repoFlagTargets(e){let t=[];for(let n=0;n<e.length;n+=1){let r=e[n];if(r===`--repo`||r===`-R`){let i=e[n+1];if(!i)throw Error(`${r} requires an owner/repository value.`);t.push(canonicalRepository(i)),n+=1}else r?.startsWith(`--repo=`)&&t.push(canonicalRepository(r.slice(7)))}return t}function repositoryFromRemote(e){let t=/^https:\/\/github\.com\/([^/]+\/[^/]+?)(?:\.git)?$/iu.exec(e);if(t?.[1])return canonicalRepository(t[1]);let n=/^git@github\.com:([^/]+\/[^/]+?)(?:\.git)?$/iu.exec(e);if(n?.[1])return canonicalRepository(n[1]);throw Error(`The origin remote is not a canonical GitHub repository URL.`)}function canonicalRepository(e){let t=e.replace(/\.git$/iu,``);if(!/^[A-Za-z0-9-]+\/[A-Za-z0-9._-]+$/u.test(t))throw Error(`Invalid GitHub repository ${JSON.stringify(e)}.`);return t}function repositoryNames(e,t){if(e.length!==1)throw Error(`Exactly one GitHub repository is required.`);let n=new Set;for(let r of e){let e=/^([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+)$/u.exec(r);if(!e)throw Error(`Invalid GitHub repository ${JSON.stringify(r)}.`);if(e[1]?.toLowerCase()!==t.toLowerCase())throw Error(`Repository ${JSON.stringify(r)} is outside ${t}.`);n.add(e[2])}if(n.size!==1)throw Error(`Exactly one GitHub repository is required.`);return[...n]}function executablePath(e,t){return e===`gh`?toolingPaths(t).ghReal:e===`gh-signed-commit`?toolingPaths(t).trustedSignedCommit:`git`}function resolveWorkingDirectory(e,t){let n=posix.resolve(`/`,e.resolvePath(``)),r=posix.resolve(`/`,e.resolvePath(t?.trim()||``));if(r!==n&&!r.startsWith(`${n}/`))throw Error(`GitHub command workingDirectory must stay inside the sandbox workspace.`);return r}function sanitizeOutput(e,t,n){let r=e.replaceAll(t,`[redacted]`).replaceAll(n,`[redacted]`);return Buffer.byteLength(r)<=MAX_OUTPUT_BYTES?{value:r,truncated:!1}:{value:`[output truncated: showing final ${MAX_OUTPUT_BYTES} bytes]\n${Buffer.from(r).subarray(-1e5).toString()}`,truncated:!0}}function unsupportedSyntax(){return Error(`GitHub commands support argv syntax only, not pipes, redirects, substitutions, or shell operators.`)}export{executeGitHubShell,githubShellApproval,parseCommand};
+import{shellQuote}from"./shell.js";import{toolingPaths}from"./tooling.js";import{validateRepositoryRoot}from"./repository-root.js";import{posix}from"node:path";import{getToken}from"#compiled/@vercel/connect/index.js";const MAX_OUTPUT_BYTES=1e5,leaseQueues=new Map,ALLOWED_GIT_REMOTE_COMMANDS=new Set([`fetch`,`ls-remote`,`pull`,`push`]);function githubShellApproval(e){if(!e)return`not-applicable`;try{return validateGitHubShellInput(e),`not-applicable`}catch(e){return{type:`denied`,reason:e instanceof Error?e.message:`Invalid GitHub command.`}}}async function executeGitHubShell(e,t,n){if(!t)throw Error(`GitHub command access is not configured for this agent.`);let r=validateGitHubShellInput(e),i=await n.getSandbox(),a=resolveWorkingDirectory(i,e.workingDirectory);(r[0]===`git`||r[0]===`gh-signed-commit`)&&(a=await validateRepositoryRoot(i,a));let o=e.permissions[0].repositories,s=await assertCommandTargets(r,o,a,i),c=repositoryNames(o,t.org),l={authorizationDetails:[{type:`github_app_installation`,org:t.org,repositories:c}],subject:{type:`app`}},u=await(n.getConnectToken??getToken)(t.connector,l);if(!u)throw Error(`Connect returned an empty token for ${JSON.stringify(t.connector)}.`);let d=executablePath(r[0],i),f=s?[`-c`,`protocol.allow=never`,`-c`,`protocol.https.allow=always`,r[1],`https://github.com/${s}.git`,...r.slice(3)]:r.slice(1),p=`cd ${shellQuote(a)} && exec ${shellQuote(d)} ${f.map(shellQuote).join(` `)}`,m=`Basic ${Buffer.from(`x-access-token:${u}`).toString(`base64`)}`,h=crypto.randomUUID(),g=`eve-github-${h}`,_=`/tmp/eve-code-gh-${h}`,v=`Basic ${Buffer.from(`x-access-token:${g}`).toString(`base64`)}`,y;try{y=await withGitHubCredentialLease(i,n.sessionId,{authorization:m,placeholder:g,placeholderAuthorization:v,token:u},()=>{let e={GH_CONFIG_DIR:_,GH_PROMPT_DISABLED:`1`};return r[0]!==`git`&&(e.GH_TOKEN=g),e.GIT_CONFIG_COUNT=`2`,e.GIT_CONFIG_KEY_0=`http.https://github.com/.extraheader`,e.GIT_CONFIG_VALUE_0=`Authorization: ${v}`,e.GIT_CONFIG_KEY_1=`core.hooksPath`,e.GIT_CONFIG_VALUE_1=`/dev/null`,e.GIT_TERMINAL_PROMPT=`0`,e.PATH=`/usr/local/bin:/usr/bin:/bin`,i.run({command:p,env:e})},t.broker)}finally{await i.removePath({path:_,recursive:!0,force:!0})}let b=sanitizeOutput(y.stdout,u,m),x=sanitizeOutput(y.stderr,u,m);return{exitCode:y.exitCode,stdout:b.value,stderr:x.value,truncated:b.truncated||x.truncated}}async function withGitHubCredentialLease(e,t,n,r,i){let a=leaseQueues.get(t)??Promise.resolve(),o,s=new Promise(e=>{o=e}),c=a.then(()=>s);leaseQueues.set(t,c),await a;try{return await i(e,{"api.github.com":[{match:{headers:[{key:{exact:`authorization`},value:{regex:`^(?:token|Bearer) ${n.placeholder}$`}}]},transform:[{headers:{authorization:`Bearer ${n.token}`}}]}],"github.com":[{match:{headers:[{key:{exact:`authorization`},value:{exact:n.placeholderAuthorization}}]},transform:[{headers:{authorization:n.authorization}}]}]}),await r()}finally{try{await i(e,null)}finally{o(),leaseQueues.get(t)===c&&leaseQueues.delete(t)}}}function parseCommand(e){let t=e.trim();if(!t)throw Error(`GitHub command must not be empty.`);let n=[],r=``,i=null,a=!1,o=!1;for(let e of t){if(a){r+=e,a=!1,o=!0;continue}if(e===`\\`&&i!==`single`){a=!0,o=!0;continue}if(i===`single`){e===`'`?i=null:r+=e;continue}if(i===`double`){if(e===`"`)i=null;else if(e===`$`||e==="`")throw unsupportedSyntax();else r+=e;continue}if(e===`'`)i=`single`,o=!0;else if(e===`"`)i=`double`,o=!0;else if(/\s/u.test(e))o&&=(n.push(r),r=``,!1);else if(";&|<>$`(){}".includes(e))throw unsupportedSyntax();else r+=e,o=!0}if(a||i)throw Error(`GitHub command contains an unfinished quote or escape.`);if(o&&n.push(r),n.length===0)throw Error(`GitHub command must not be empty.`);return n}function validateGitHubShellInput(e){let t=parseCommand(e.command),n=e.permissions[0];if(e.permissions.length!==1||n?.provider!==`github`)throw Error(`Exactly one GitHub permission is required.`);if(n.access!==`write`)throw Error(`GitHub App commands require explicit write-capable access.`);if(!e.description.trim())throw Error(`description must describe the intended result.`);let[r,i]=t;if(r===`gh`){if(!i)throw Error(`A gh subcommand is required.`)}else if(r===`git`){if(!i||!ALLOWED_GIT_REMOTE_COMMANDS.has(i))throw Error(`Authenticated git supports only fetch, ls-remote, pull, and push; clone with gh repo clone.`)}else if(r!==`gh-signed-commit`)throw Error(`GitHub commands must use gh, an authenticated git remote command, or gh-signed-commit.`);return t}async function assertCommandTargets(e,t,n,r){let i=new Set(t.map(e=>e.toLowerCase())),a,o;if(e[0]===`git`){if(e[2]!==`origin`)throw Error(`Authenticated git commands must use the validated origin remote.`);let t=e[1]===`push`,i=await r.run({command:`cd ${shellQuote(n)} && git remote get-url ${t?`--push `:``}origin`,env:{GIT_TERMINAL_PROMPT:`0`,PATH:`/usr/bin:/bin`}});if(i.exitCode!==0)throw Error(`Could not resolve the origin GitHub repository.`);a=repositoryFromRemote(i.stdout.trim()),o=[a]}else if(e[0]===`gh-signed-commit`){if(o=repoFlagTargets(e.slice(1)),o.length===0)throw Error(`gh-signed-commit requires an explicit --repo owner/repository target.`)}else o=repoFlagTargets(e.slice(1)),e[1]===`repo`&&(e[2]===`clone`||e[2]===`view`||e[2]===`fork`)&&e[3]&&!e[3].startsWith(`-`)&&o.push(canonicalRepository(e[3]));for(let e of o)if(!i.has(e.toLowerCase()))throw Error(`Command target ${JSON.stringify(e)} is not in the declared repositories.`);return a}function repoFlagTargets(e){let t=[];for(let n=0;n<e.length;n+=1){let r=e[n];if(r===`--repo`||r===`-R`){let i=e[n+1];if(!i)throw Error(`${r} requires an owner/repository value.`);t.push(canonicalRepository(i)),n+=1}else r?.startsWith(`--repo=`)&&t.push(canonicalRepository(r.slice(7)))}return t}function repositoryFromRemote(e){let t=/^https:\/\/github\.com\/([^/]+\/[^/]+?)(?:\.git)?$/iu.exec(e);if(t?.[1])return canonicalRepository(t[1]);let n=/^git@github\.com:([^/]+\/[^/]+?)(?:\.git)?$/iu.exec(e);if(n?.[1])return canonicalRepository(n[1]);throw Error(`The origin remote is not a canonical GitHub repository URL.`)}function canonicalRepository(e){let t=e.replace(/\.git$/iu,``);if(!/^[A-Za-z0-9-]+\/[A-Za-z0-9._-]+$/u.test(t))throw Error(`Invalid GitHub repository ${JSON.stringify(e)}.`);return t}function repositoryNames(e,t){if(e.length!==1)throw Error(`Exactly one GitHub repository is required.`);let n=new Set;for(let r of e){let e=/^([A-Za-z0-9-]+)\/([A-Za-z0-9._-]+)$/u.exec(r);if(!e)throw Error(`Invalid GitHub repository ${JSON.stringify(r)}.`);if(e[1]?.toLowerCase()!==t.toLowerCase())throw Error(`Repository ${JSON.stringify(r)} is outside ${t}.`);n.add(e[2])}if(n.size!==1)throw Error(`Exactly one GitHub repository is required.`);return[...n]}function executablePath(e,t){return e===`gh`?toolingPaths(t).ghReal:e===`gh-signed-commit`?toolingPaths(t).trustedSignedCommit:`git`}function resolveWorkingDirectory(e,t){let n=posix.resolve(`/`,e.resolvePath(``)),r=posix.resolve(`/`,e.resolvePath(t?.trim()||``));if(r!==n&&!r.startsWith(`${n}/`))throw Error(`GitHub command workingDirectory must stay inside the sandbox workspace.`);return r}function sanitizeOutput(e,t,n){let r=e.replaceAll(t,`[redacted]`).replaceAll(n,`[redacted]`);return Buffer.byteLength(r)<=MAX_OUTPUT_BYTES?{value:r,truncated:!1}:{value:`[output truncated: showing final ${MAX_OUTPUT_BYTES} bytes]\n${Buffer.from(r).subarray(-1e5).toString()}`,truncated:!0}}function unsupportedSyntax(){return Error(`GitHub commands support argv syntax only, not pipes, redirects, substitutions, or shell operators.`)}export{executeGitHubShell,githubShellApproval,parseCommand};

package/dist/src/extensions/code/extension/lib/prwatch-github.js

@@ -1 +1 @@
-import extension_default from"../extension.js";import{deleteTokenCacheEntry,getToken}from"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/token.js";import"../../../../node_modules/.pnpm/@vercel_connect@2.3.3_@ai-sdk_mcp@2.0.52_zod@4.5.4__@auth_core@0.41.2_@chat-adapter_sla_a37674779346d612fa7d2ca9bd316494/node_modules/@vercel/connect/dist/index.js";import{z}from"#compiled/zod/index.js";const RepoSchema=z.string().trim().regex(/^[A-Za-z0-9-]+\/[A-Za-z0-9._-]+$/u).transform(e=>e.toLowerCase()),PullRequestWatchInputSchema=z.object({repo:RepoSchema,pullRequestNumber:z.number().int().positive(),reviewOwner:z.string().trim().min(1),redHeadOid:z.string().regex(/^[0-9a-f]{40}$/iu).transform(e=>e.toLowerCase())}),PrwatchDeleteInputSchema=z.object({repo:RepoSchema,pullRequestNumber:z.number().int().positive()}),PullRequestSchema=z.object({head:z.object({sha:z.string().min(1)}),html_url:z.string().url(),merged:z.boolean().optional().default(!1),state:z.enum([`open`,`closed`])}),ReviewSchema=z.object({commit_id:z.string().nullable(),state:z.string(),submitted_at:z.string().nullable(),user:z.object({login:z.string()}).nullable()});function initialPullRequestWatchNotificationState(){return{previousSnapshot:null,redHeadPolls:0,redHeadWakeSent:!1}}function framePullRequestWatchWake(e){return`${e}\n\nThis is an internal watch wake, not a request for a progress report. Continue any necessary work. Send a user-facing response only when the original request is complete or a new blocker requires human input. Otherwise, finish by replying with exactly <eve-empty-delivery/> and no other text. Do not report that nothing changed or that work is still in progress.`}function reviewFingerprint(e){return e?.ownerReviewState===null||e===null?null:`${e.ownerReviewState}:${e.ownerReviewSubmittedAt??``}`}function advancePullRequestWatchNotification(e){let t=e.state.previousSnapshot,n=e.snapshot.headOid!==(t?.headOid??e.redHeadOid),r=t!==null&&reviewFingerprint(e.snapshot)!==reviewFingerprint(t),i=e.snapshot.headOid===e.redHeadOid,a=i?e.state.redHeadPolls+1:0,o=null;return n?o=`head_changed`:r?o=`owner_review_changed`:i&&!e.state.redHeadWakeSent&&a===e.staleAfterPolls&&(o=`red_head_stalled`),{state:{previousSnapshot:e.snapshot,redHeadPolls:a,redHeadWakeSent:e.state.redHeadWakeSent||o===`red_head_stalled`},wakeReason:o}}var RetryablePullRequestWatchError=class extends Error{},GitHubWatchResponseError=class extends Error{status;constructor(e,t){super(t),this.name=`GitHubWatchResponseError`,this.status=e}};function errorStatus(e){return typeof e!=`object`||!e||!(`status`in e)?null:typeof e.status==`number`?e.status:null}function shouldRefreshPullRequestWatchToken(e){return errorStatus(e)===401}function isRetryablePullRequestWatchError(e){let t=errorStatus(e);return t===429||t!==null&&t>=500||e instanceof RetryablePullRequestWatchError||e instanceof TypeError||e instanceof Error&&(/^GitHub watch (?:request|token request) failed:/u.test(e.message)||/\((?:429|5\d{2})\b/u.test(e.message))}function pullRequestWatchSnapshot(e){let t=e.reviewOwner.toLowerCase(),n=e.pullRequest.head.sha.toLowerCase(),r=e.reviews.filter(e=>e.commit_id?.toLowerCase()===n&&e.user?.login.toLowerCase()===t).at(-1);return{headOid:n,ownerApprovedCurrentHead:r?.state.toUpperCase()===`APPROVED`,ownerReviewState:r?.state.toUpperCase()??null,ownerReviewSubmittedAt:r?.submitted_at??null,state:e.pullRequest.merged?`merged`:e.pullRequest.state,url:e.pullRequest.html_url}}function repoParts(e){let[t,n]=e.split(`/`);if(t===void 0||n===void 0)throw Error(`Invalid GitHub repository: ${e}`);return{owner:t,name:n}}function repoFullName(e){let t=repoParts(e);return`${t.owner}/${t.name}`}function repoApiPath(e){let t=repoParts(e);return`/repos/${encodeURIComponent(t.owner)}/${encodeURIComponent(t.name)}`}function redactGithubToken(e,t){return t.length===0?e:e.split(t).join(`[redacted]`)}function githubHeaders(e){return{Accept:`application/vnd.github+json`,Authorization:`Bearer ${e}`,"X-GitHub-Api-Version":`2022-11-28`}}function githubTokenParams(e,t){return{authorizationDetails:[{org:e,repositories:[t],type:`github_app_installation`}],subject:{type:`app`}}}async function mintWatchToken(e){let t=extension_default.config.github;if(t===void 0)throw Error(`GitHub is not configured for this agent.`);let n=repoParts(e);if(n.owner!==t.org.toLowerCase())throw Error(`Repository ${e} is outside ${t.org}.`);let r=await getToken(t.connector,githubTokenParams(t.org,n.name));if(r.length===0)throw Error(`Connect returned an empty GitHub token for ${e}.`);return r}async function invalidateWatchToken(e){let t=extension_default.config.github;if(t===void 0)return;let n=repoParts(e);deleteTokenCacheEntry(t.connector,githubTokenParams(t.org,n.name))}async function githubJson(e,t){let n;try{n=await fetch(e,{headers:githubHeaders(t)})}catch(e){throw new RetryablePullRequestWatchError(`GitHub watch request failed: ${e instanceof Error?e.message:String(e)}`)}if(n.ok)return n.json();let r=await n.text().catch(()=>``),i=`GitHub request failed (${n.status} ${n.statusText})`+(r.length>0?`: ${redactGithubToken(r,t)}`:``);throw n.status===429||n.status>=500?new RetryablePullRequestWatchError(i):new GitHubWatchResponseError(n.status,i)}async function readPullRequestWatchSnapshotWithToken(e,t){let n=`https://api.github.com${repoApiPath(e.repo)}/pulls/${e.pullRequestNumber}`,r=PullRequestSchema.parse(await githubJson(n,t));if(r.state===`closed`||r.merged)return pullRequestWatchSnapshot({pullRequest:r,reviewOwner:e.reviewOwner,reviews:[]});let i=[];for(let r=1;r<=20;r+=1){let a=z.array(ReviewSchema).parse(await githubJson(`${n}/reviews?per_page=100&page=${r}`,t));if(i.push(...a),a.length<100)break;if(r===20)throw Error(`PR #${e.pullRequestNumber} has too many reviews to verify`)}return pullRequestWatchSnapshot({pullRequest:r,reviewOwner:e.reviewOwner,reviews:i})}async function readPullRequestWatchSnapshot(e){for(let t=0;t<2;t+=1){let n;try{n=await mintWatchToken(e.repo)}catch(e){throw isRetryablePullRequestWatchError(e)?new RetryablePullRequestWatchError(`GitHub watch token request failed: ${e instanceof Error?e.message:String(e)}`):e}try{return await readPullRequestWatchSnapshotWithToken(e,n)}catch(n){if(t>0||!shouldRefreshPullRequestWatchToken(n))throw n;await invalidateWatchToken(e.repo)}}throw Error(`Pull request watch token refresh exhausted unexpectedly.`)}export{PrwatchDeleteInputSchema,PullRequestWatchInputSchema,advancePullRequestWatchNotification,framePullRequestWatchWake,initialPullRequestWatchNotificationState,isRetryablePullRequestWatchError,pullRequestWatchSnapshot,readPullRequestWatchSnapshot,repoFullName,shouldRefreshPullRequestWatchToken};
+import extension_default from"../extension.js";import{z}from"#compiled/zod/index.js";import{deleteTokenCacheEntry,getToken}from"#compiled/@vercel/connect/index.js";const RepoSchema=z.string().trim().regex(/^[A-Za-z0-9-]+\/[A-Za-z0-9._-]+$/u).transform(e=>e.toLowerCase()),PullRequestWatchInputSchema=z.object({repo:RepoSchema,pullRequestNumber:z.number().int().positive(),reviewOwner:z.string().trim().min(1),redHeadOid:z.string().regex(/^[0-9a-f]{40}$/iu).transform(e=>e.toLowerCase())}),PrwatchDeleteInputSchema=z.object({repo:RepoSchema,pullRequestNumber:z.number().int().positive()}),PullRequestSchema=z.object({head:z.object({sha:z.string().min(1)}),html_url:z.string().url(),merged:z.boolean().optional().default(!1),state:z.enum([`open`,`closed`])}),ReviewSchema=z.object({commit_id:z.string().nullable(),state:z.string(),submitted_at:z.string().nullable(),user:z.object({login:z.string()}).nullable()});function initialPullRequestWatchNotificationState(){return{previousSnapshot:null,redHeadPolls:0,redHeadWakeSent:!1}}function framePullRequestWatchWake(e){return`${e}\n\nThis is an internal watch wake, not a request for a progress report. Continue any necessary work. Send a user-facing response only when the original request is complete or a new blocker requires human input. Do not report that nothing changed or that work is still in progress.`}function reviewFingerprint(e){return e?.ownerReviewState===null||e===null?null:`${e.ownerReviewState}:${e.ownerReviewSubmittedAt??``}`}function advancePullRequestWatchNotification(e){let t=e.state.previousSnapshot,n=e.snapshot.headOid!==(t?.headOid??e.redHeadOid),r=t!==null&&reviewFingerprint(e.snapshot)!==reviewFingerprint(t),i=e.snapshot.headOid===e.redHeadOid,a=i?e.state.redHeadPolls+1:0,o=null;return n?o=`head_changed`:r?o=`owner_review_changed`:i&&!e.state.redHeadWakeSent&&a===e.staleAfterPolls&&(o=`red_head_stalled`),{state:{previousSnapshot:e.snapshot,redHeadPolls:a,redHeadWakeSent:e.state.redHeadWakeSent||o===`red_head_stalled`},wakeReason:o}}var RetryablePullRequestWatchError=class extends Error{},GitHubWatchResponseError=class extends Error{status;constructor(e,t){super(t),this.name=`GitHubWatchResponseError`,this.status=e}};function errorStatus(e){return typeof e!=`object`||!e||!(`status`in e)?null:typeof e.status==`number`?e.status:null}function shouldRefreshPullRequestWatchToken(e){return errorStatus(e)===401}function isRetryablePullRequestWatchError(e){let t=errorStatus(e);return t===429||t!==null&&t>=500||e instanceof RetryablePullRequestWatchError||e instanceof TypeError||e instanceof Error&&(/^GitHub watch (?:request|token request) failed:/u.test(e.message)||/\((?:429|5\d{2})\b/u.test(e.message))}function pullRequestWatchSnapshot(e){let t=e.reviewOwner.toLowerCase(),n=e.pullRequest.head.sha.toLowerCase(),r=e.reviews.filter(e=>e.commit_id?.toLowerCase()===n&&e.user?.login.toLowerCase()===t).at(-1);return{headOid:n,ownerApprovedCurrentHead:r?.state.toUpperCase()===`APPROVED`,ownerReviewState:r?.state.toUpperCase()??null,ownerReviewSubmittedAt:r?.submitted_at??null,state:e.pullRequest.merged?`merged`:e.pullRequest.state,url:e.pullRequest.html_url}}function repoParts(e){let[t,n]=e.split(`/`);if(t===void 0||n===void 0)throw Error(`Invalid GitHub repository: ${e}`);return{owner:t,name:n}}function repoFullName(e){let t=repoParts(e);return`${t.owner}/${t.name}`}function repoApiPath(e){let t=repoParts(e);return`/repos/${encodeURIComponent(t.owner)}/${encodeURIComponent(t.name)}`}function redactGithubToken(e,t){return t.length===0?e:e.split(t).join(`[redacted]`)}function githubHeaders(e){return{Accept:`application/vnd.github+json`,Authorization:`Bearer ${e}`,"X-GitHub-Api-Version":`2022-11-28`}}function githubTokenParams(e,t){return{authorizationDetails:[{org:e,repositories:[t],type:`github_app_installation`}],subject:{type:`app`}}}async function mintWatchToken(e){let t=extension_default.config.github;if(t===void 0)throw Error(`GitHub is not configured for this agent.`);let n=repoParts(e);if(n.owner!==t.org.toLowerCase())throw Error(`Repository ${e} is outside ${t.org}.`);let r=await getToken(t.connector,githubTokenParams(t.org,n.name));if(r.length===0)throw Error(`Connect returned an empty GitHub token for ${e}.`);return r}async function invalidateWatchToken(e){let t=extension_default.config.github;if(t===void 0)return;let n=repoParts(e);deleteTokenCacheEntry(t.connector,githubTokenParams(t.org,n.name))}async function githubJson(e,t){let n;try{n=await fetch(e,{headers:githubHeaders(t)})}catch(e){throw new RetryablePullRequestWatchError(`GitHub watch request failed: ${e instanceof Error?e.message:String(e)}`)}if(n.ok)return n.json();let r=await n.text().catch(()=>``),i=`GitHub request failed (${n.status} ${n.statusText})`+(r.length>0?`: ${redactGithubToken(r,t)}`:``);throw n.status===429||n.status>=500?new RetryablePullRequestWatchError(i):new GitHubWatchResponseError(n.status,i)}async function readPullRequestWatchSnapshotWithToken(e,t){let n=`https://api.github.com${repoApiPath(e.repo)}/pulls/${e.pullRequestNumber}`,r=PullRequestSchema.parse(await githubJson(n,t));if(r.state===`closed`||r.merged)return pullRequestWatchSnapshot({pullRequest:r,reviewOwner:e.reviewOwner,reviews:[]});let i=[];for(let r=1;r<=20;r+=1){let a=z.array(ReviewSchema).parse(await githubJson(`${n}/reviews?per_page=100&page=${r}`,t));if(i.push(...a),a.length<100)break;if(r===20)throw Error(`PR #${e.pullRequestNumber} has too many reviews to verify`)}return pullRequestWatchSnapshot({pullRequest:r,reviewOwner:e.reviewOwner,reviews:i})}async function readPullRequestWatchSnapshot(e){for(let t=0;t<2;t+=1){let n;try{n=await mintWatchToken(e.repo)}catch(e){throw isRetryablePullRequestWatchError(e)?new RetryablePullRequestWatchError(`GitHub watch token request failed: ${e instanceof Error?e.message:String(e)}`):e}try{return await readPullRequestWatchSnapshotWithToken(e,n)}catch(n){if(t>0||!shouldRefreshPullRequestWatchToken(n))throw n;await invalidateWatchToken(e.repo)}}throw Error(`Pull request watch token refresh exhausted unexpectedly.`)}export{PrwatchDeleteInputSchema,PullRequestWatchInputSchema,advancePullRequestWatchNotification,framePullRequestWatchWake,initialPullRequestWatchNotificationState,isRetryablePullRequestWatchError,pullRequestWatchSnapshot,readPullRequestWatchSnapshot,repoFullName,shouldRefreshPullRequestWatchToken};

package/dist/src/framework/sources/modules/agent.d.ts

@@ -1,4 +1,5 @@
 declare const _default: import("#public/definitions/agent.js").DefinedAgent<{
     model: string;
+    reasoning: "high";
 }>;
 export default _default;

package/dist/src/framework/sources/modules/agent.js

@@ -1 +1 @@
-import{DEFAULT_AGENT_MODEL_ID}from"#shared/default-agent-model.js";import{defineAgent}from"#public/definitions/agent.js";var agent_default=defineAgent({model:DEFAULT_AGENT_MODEL_ID});export{agent_default as default};
+import{DEFAULT_AGENT_MODEL_ID,DEFAULT_AGENT_REASONING}from"#shared/default-agent-model.js";import{defineAgent}from"#public/definitions/agent.js";var agent_default=defineAgent({model:DEFAULT_AGENT_MODEL_ID,reasoning:DEFAULT_AGENT_REASONING});export{agent_default as default};

package/dist/src/framework/sources/registry.js

@@ -1 +1 @@
-import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{createAgentSourceRegistry,defineProgrammaticAgentSource,loadProgrammaticModuleNamespace,memoizeModuleNamespaceFactories}from"#compiler/source-graph.js";const revision=`eve@${resolveInstalledPackageInfo().version}:compiled-manifest-v52`,localDefaults=defineProgrammaticAgentSource({id:`eve:defaults`,revision,modules:[{logicalPath:`agent.ts`,loadNamespace:()=>import(`#framework/sources/modules/agent.js`)},{logicalPath:`sandbox.ts`,semanticRevision:`eve:default-sandbox:v1`,loadNamespace:()=>import(`#framework/sources/modules/sandbox.js`)},{logicalPath:`tools/bash.ts`,loadNamespace:()=>import(`#tools/provided/bash.js`)},{logicalPath:`tools/read_file.ts`,loadNamespace:()=>import(`#tools/provided/read-file.js`)},{logicalPath:`tools/write_file.ts`,loadNamespace:()=>import(`#tools/provided/write-file.js`)},{logicalPath:`tools/web_fetch.ts`,loadNamespace:()=>import(`#tools/provided/web-fetch.js`)},{logicalPath:`tools/load_skill.ts`,loadNamespace:()=>import(`#tools/provided/load-skill.js`)},{logicalPath:`tools/connection_search.ts`,loadNamespace:()=>import(`#tools/framework/connection-search.js`)},{logicalPath:`tools/task_cancel.ts`,loadNamespace:()=>import(`#tools/framework/task-cancel.js`)},{logicalPath:`tools/web_search.ts`,loadNamespace:()=>import(`#tools/provided/web-search.js`)}]}),rootDefaults=defineProgrammaticAgentSource({id:`eve:root-defaults`,revision,modules:[{logicalPath:`tools/agent.ts`,loadNamespace:()=>import(`#tools/framework/agent.js`)},{logicalPath:`channels/eve.ts`,loadNamespace:()=>import(`#framework/sources/modules/eve-channel.js`)},{logicalPath:`channels/home.ts`,loadNamespace:()=>import(`#framework/sources/modules/home-channel.js`)}]}),memoryWrapperTemplateSource=defineProgrammaticAgentSource({id:`eve:memory-wrapper`,revision,modules:[{logicalPath:`tools/memory-wrapper.ts`,loadNamespace:async e=>{let{loadMemoryWrapperNamespace:t}=await import(`#framework/sources/modules/memory-wrapper.js`);return await t(e)}}]}),frameworkAgentSourceRegistry=createAgentSourceRegistry([{applyTo:`all-local-nodes`,source:localDefaults},{applyTo:`root`,source:rootDefaults}],{templates:[memoryWrapperTemplateSource]}),memoryWrapperTemplate=frameworkAgentSourceRegistry.templates.get(memoryWrapperTemplateSource.id);async function loadFrameworkProgrammaticModule(e,t){return memoizeModuleNamespaceFactories(await loadProgrammaticModuleNamespace({backing:e,dependencyNamespaces:t,registries:[frameworkAgentSourceRegistry]}))}export{frameworkAgentSourceRegistry,loadFrameworkProgrammaticModule,memoryWrapperTemplate};
+import{resolveInstalledPackageInfo}from"#internal/application/package.js";import{createAgentSourceRegistry,defineProgrammaticAgentSource,loadProgrammaticModuleNamespace,memoizeModuleNamespaceFactories}from"#compiler/source-graph.js";const revision=`eve@${resolveInstalledPackageInfo().version}:compiled-manifest-v52`,localDefaults=defineProgrammaticAgentSource({id:`eve:defaults`,revision,modules:[{logicalPath:`agent.ts`,loadNamespace:()=>import(`#framework/sources/modules/agent.js`)},{logicalPath:`sandbox.ts`,semanticRevision:`eve:default-sandbox:v1`,loadNamespace:()=>import(`#framework/sources/modules/sandbox.js`)},{logicalPath:`tools/bash.ts`,loadNamespace:()=>import(`#tools/provided/bash.js`)},{logicalPath:`tools/read_file.ts`,loadNamespace:()=>import(`#tools/provided/read-file.js`)},{logicalPath:`tools/write_file.ts`,loadNamespace:()=>import(`#tools/provided/write-file.js`)},{logicalPath:`tools/web_fetch.ts`,loadNamespace:()=>import(`#tools/provided/web-fetch.js`)},{logicalPath:`tools/load_skill.ts`,loadNamespace:()=>import(`#tools/provided/load-skill.js`)},{logicalPath:`tools/connection_tools.ts`,loadNamespace:()=>import(`#tools/framework/connection-tools.js`)},{logicalPath:`tools/web_search.ts`,loadNamespace:()=>import(`#tools/provided/web-search.js`)}]}),rootDefaults=defineProgrammaticAgentSource({id:`eve:root-defaults`,revision,modules:[{logicalPath:`tools/agent.ts`,loadNamespace:()=>import(`#tools/framework/agent.js`)},{logicalPath:`channels/eve.ts`,loadNamespace:()=>import(`#framework/sources/modules/eve-channel.js`)},{logicalPath:`channels/home.ts`,loadNamespace:()=>import(`#framework/sources/modules/home-channel.js`)}]}),memoryWrapperTemplateSource=defineProgrammaticAgentSource({id:`eve:memory-wrapper`,revision,modules:[{logicalPath:`tools/memory-wrapper.ts`,loadNamespace:async e=>{let{loadMemoryWrapperNamespace:t}=await import(`#framework/sources/modules/memory-wrapper.js`);return await t(e)}}]}),frameworkAgentSourceRegistry=createAgentSourceRegistry([{applyTo:`all-local-nodes`,source:localDefaults},{applyTo:`root`,source:rootDefaults}],{templates:[memoryWrapperTemplateSource]}),memoryWrapperTemplate=frameworkAgentSourceRegistry.templates.get(memoryWrapperTemplateSource.id);async function loadFrameworkProgrammaticModule(e,t){return memoizeModuleNamespaceFactories(await loadProgrammaticModuleNamespace({backing:e,dependencyNamespaces:t,registries:[frameworkAgentSourceRegistry]}))}export{frameworkAgentSourceRegistry,loadFrameworkProgrammaticModule,memoryWrapperTemplate};

package/dist/src/harness/action-presentation.js

@@ -1 +1 @@
-import{parseJsonObject}from"#shared/json.js";import{normalizePresentationText}from"#shared/presentation-text.js";import{createRuntimeActionRequestFromToolCall}from"#harness/coordination.js";function createPresentedRuntimeActionRequestFromToolCall(e){let t=createRuntimeActionRequestFromToolCall(e),n=projectToolStartLabel(e.tools.get(e.toolCall.toolName),t.input);return n===void 0?{action:t}:{action:t,presentationLabel:n}}function projectToolStartLabel(e,t){let n=e?.label?.start;if(n!==void 0)try{let e=normalizePresentationText(n(parseJsonObject(t)));return e===``?void 0:e}catch{return}}function collectActionPresentation(e){let t=Object.fromEntries(e.flatMap(({action:e,presentationLabel:t})=>t===void 0?[]:[[e.callId,{label:t}]]));return Object.keys(t).length===0?void 0:t}export{collectActionPresentation,createPresentedRuntimeActionRequestFromToolCall,projectToolStartLabel};
+import{normalizePresentationText}from"#shared/presentation-text.js";import{parseJsonObject}from"#shared/json.js";import{createRuntimeActionRequestFromToolCall}from"#harness/coordination.js";function createPresentedRuntimeActionRequestFromToolCall(e){let t=createRuntimeActionRequestFromToolCall(e),n=projectToolStartLabel(e.tools.get(e.toolCall.toolName),t.input);return n===void 0?{action:t}:{action:t,presentationLabel:n}}function projectToolStartLabel(e,t){let n=e?.label?.start;if(n!==void 0)try{let e=normalizePresentationText(n(parseJsonObject(t)));return e===``?void 0:e}catch{return}}function collectActionPresentation(e){let t=Object.fromEntries(e.flatMap(({action:e,presentationLabel:t})=>t===void 0?[]:[[e.callId,{label:t}]]));return Object.keys(t).length===0?void 0:t}export{collectActionPresentation,createPresentedRuntimeActionRequestFromToolCall,projectToolStartLabel};

package/dist/src/harness/action-result-helpers.d.ts

@@ -46,4 +46,5 @@ export declare function createToolResultMessagePartFromToolError(toolError: Type
  * response messages array).
  */
 export declare function createRuntimeToolResultFromMessagePart(part: ToolResultPart): RuntimeToolResultActionResult;
+export declare function isToolResultError(output: ToolResultPart["output"]): boolean;
 export {};

package/dist/src/harness/action-result-helpers.js

@@ -1 +1 @@
-import{toError}from"#shared/errors.js";import{parseJsonValue}from"#shared/json.js";import{authorizationPendingAsJsonObject,isAuthorizationPendingModelOutput,isAuthorizationSignal}from"#harness/authorization.js";import{withToolOutputSerializationError}from"#harness/tool-output-serialization.js";function toJsonValue(e){return isAuthorizationSignal(e)?parseJsonValue(authorizationPendingAsJsonObject({connections:e.challenges.map(e=>e.name)})):isAuthorizationPendingModelOutput(e)?parseJsonValue(authorizationPendingAsJsonObject(e)):parseJsonValue(e===void 0?null:e)}function createRuntimeToolResultFromValue(e){let t={callId:e.callId,kind:`tool-result`,output:toolResultOutputToJsonValue({output:{type:e.isError===!0?`error-json`:`json`,value:e.isError===!0&&e.output instanceof Error?e.output.message:e.output},toolCallId:e.callId,toolName:e.toolName}),toolName:e.toolName};return e.isError===!0?{...t,isError:!0}:t}function createRuntimeToolResultFromStepResult(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,output:e.output,toolName:e.toolName})}function createRuntimeToolResultFromToolError(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,isError:!0,output:toError(e.error),toolName:e.toolName})}function createToolResultMessagePartFromToolError(e){return{type:`tool-result`,toolCallId:e.toolCallId,toolName:e.toolName,output:{type:`error-text`,value:toError(e.error).message}}}function createRuntimeToolResultFromMessagePart(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,output:toolResultOutputToJsonValue({output:e.output,toolCallId:e.toolCallId,toolName:e.toolName}),toolName:e.toolName,isError:isToolResultError(e.output)})}function toolResultOutputToJsonValue(e){return withToolOutputSerializationError({boundary:`action.result`,toolCallId:e.toolCallId,toolName:e.toolName},()=>{switch(e.output.type){case`text`:case`error-text`:return e.output.value;case`json`:case`error-json`:return toJsonValue(e.output.value);case`execution-denied`:return{code:`TOOL_EXECUTION_DENIED`,message:e.output.reason??`Tool execution was denied.`};case`content`:return toJsonValue(e.output.value)}})}function isToolResultError(e){return e.type===`error-json`||e.type===`error-text`||e.type===`execution-denied`}export{createRuntimeToolResultFromMessagePart,createRuntimeToolResultFromStepResult,createRuntimeToolResultFromToolError,createRuntimeToolResultFromValue,createToolResultMessagePartFromToolError};
+import{toError}from"#shared/errors.js";import{parseJsonValue}from"#shared/json.js";import{authorizationPendingAsJsonObject,isAuthorizationPendingModelOutput,isAuthorizationSignal}from"#harness/authorization.js";import{withToolOutputSerializationError}from"#harness/tool-output-serialization.js";function toJsonValue(e){return isAuthorizationSignal(e)?parseJsonValue(authorizationPendingAsJsonObject({connections:e.challenges.map(e=>e.name)})):isAuthorizationPendingModelOutput(e)?parseJsonValue(authorizationPendingAsJsonObject(e)):parseJsonValue(e===void 0?null:e)}function createRuntimeToolResultFromValue(e){let t={callId:e.callId,kind:`tool-result`,output:toolResultOutputToJsonValue({output:{type:e.isError===!0?`error-json`:`json`,value:e.isError===!0&&e.output instanceof Error?e.output.message:e.output},toolCallId:e.callId,toolName:e.toolName}),toolName:e.toolName};return e.isError===!0?{...t,isError:!0}:t}function createRuntimeToolResultFromStepResult(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,output:e.output,toolName:e.toolName})}function createRuntimeToolResultFromToolError(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,isError:!0,output:toError(e.error),toolName:e.toolName})}function createToolResultMessagePartFromToolError(e){return{type:`tool-result`,toolCallId:e.toolCallId,toolName:e.toolName,output:{type:`error-text`,value:toError(e.error).message}}}function createRuntimeToolResultFromMessagePart(e){return createRuntimeToolResultFromValue({callId:e.toolCallId,output:toolResultOutputToJsonValue({output:e.output,toolCallId:e.toolCallId,toolName:e.toolName}),toolName:e.toolName,isError:isToolResultError(e.output)})}function toolResultOutputToJsonValue(e){return withToolOutputSerializationError({boundary:`action.result`,toolCallId:e.toolCallId,toolName:e.toolName},()=>{switch(e.output.type){case`text`:case`error-text`:return e.output.value;case`json`:case`error-json`:return toJsonValue(e.output.value);case`execution-denied`:return{code:`TOOL_EXECUTION_DENIED`,message:e.output.reason??`Tool execution was denied.`};case`content`:return toJsonValue(e.output.value)}})}function isToolResultError(e){return e.type===`error-json`||e.type===`error-text`||e.type===`execution-denied`}export{createRuntimeToolResultFromMessagePart,createRuntimeToolResultFromStepResult,createRuntimeToolResultFromToolError,createRuntimeToolResultFromValue,createToolResultMessagePartFromToolError,isToolResultError};

package/dist/src/harness/advertised-tools.d.ts

@@ -1,7 +1,7 @@
 import type { ToolSet } from "ai";
 import type { HarnessToolDefinition } from "#harness/execute-tool.js";
 import type { HarnessSession, HarnessToolMap } from "#harness/types.js";
-type AdvertisedToolSession = Pick<HarnessSession, "rootSessionId" | "taskId">;
+type AdvertisedToolSession = Pick<HarnessSession, "rootSessionId">;
 type AdvertisedToolMapInput = {
     readonly session: AdvertisedToolSession;
     readonly tools: HarnessToolMap;

package/dist/src/harness/advertised-tools.js

@@ -1 +1 @@
-function getAdvertisedTools(e){return`modelTools`in e?getAdvertisedModelTools(e):isToolDefinitionList(e.tools)?filterUnavailableToolDefinitions(e.tools,e.session):filterUnavailableToolMap(e.tools,e.session)}async function getAdvertisedModelTools(e){return{harnessTools:filterUnavailableToolMap(e.tools,e.session),modelTools:e.modelTools,session:e.session}}function filterUnavailableToolDefinitions(e,t){let n=[];for(let r of e)shouldHideTool(r,t)||n.push(r);return n}function filterUnavailableToolMap(e,t){let n=new Map;for(let[r,i]of e)shouldHideTool(i,t)||n.set(r,i);return n}function shouldHideTool(e,t){let n=t.rootSessionId!==void 0;return e.rootOnly===!0||e.availableInSubagents===!1||e.behavior?.availability.includes(`root-session`)===!0?n:e.behavior?.availability.includes(`delegated-task-child`)===!0&&t.taskId===void 0}function isToolDefinitionList(e){return Array.isArray(e)}export{getAdvertisedTools};
+function getAdvertisedTools(e){return`modelTools`in e?getAdvertisedModelTools(e):isToolDefinitionList(e.tools)?filterUnavailableToolDefinitions(e.tools,e.session):filterUnavailableToolMap(e.tools,e.session)}async function getAdvertisedModelTools(e){return{harnessTools:filterUnavailableToolMap(e.tools,e.session),modelTools:e.modelTools,session:e.session}}function filterUnavailableToolDefinitions(e,t){let n=[];for(let r of e)shouldHideTool(r,t)||n.push(r);return n}function filterUnavailableToolMap(e,t){let n=new Map;for(let[r,i]of e)shouldHideTool(i,t)||n.set(r,i);return n}function shouldHideTool(e,t){let n=t.rootSessionId!==void 0;return e.rootOnly===!0||e.availableInSubagents===!1||e.behavior?.availability.includes(`root-session`)===!0?n:!1}function isToolDefinitionList(e){return Array.isArray(e)}export{getAdvertisedTools};

package/dist/src/harness/announcements.d.ts

@@ -0,0 +1,22 @@
+import type { ContextContainer } from "#context/container.js";
+/**
+ * Framework state announced to the model as an append-only `context.state`
+ * message. The harness appends a message only when `value` differs from the
+ * last value it announced for the same key, so the cached prompt prefix never
+ * changes. Compaction clears the record, which makes the next announcement a
+ * fresh baseline.
+ */
+export interface Announcement {
+    /** Canonical state. Only a changed value produces a message. */
+    readonly value: string;
+    /**
+     * Renders the message for `value`. `previous` is the last announced value,
+     * or `undefined` for a baseline. Returning `undefined` records the value
+     * without adding a message.
+     */
+    render(previous: string | undefined): string | undefined;
+}
+/** Sets or clears the announcement `key` for the current step. */
+export declare function setPendingAnnouncement(ctx: ContextContainer, key: string, announcement: Announcement | undefined): void;
+/** The announcements set for the current step. */
+export declare function getPendingAnnouncements(ctx: Pick<ContextContainer, "get"> | undefined): Readonly<Record<string, Announcement>>;

package/dist/src/harness/announcements.js

@@ -0,0 +1 @@
+import{ContextKey}from"#context/key.js";const PendingAnnouncementsKey=new ContextKey(`eve.pendingAnnouncements`);function setPendingAnnouncement(e,t,n){let{[t]:r,...i}=e.get(PendingAnnouncementsKey)??{};e.setVirtualContext(PendingAnnouncementsKey,n===void 0?i:{...i,[t]:n})}function getPendingAnnouncements(e){return e?.get(PendingAnnouncementsKey)??{}}export{getPendingAnnouncements,setPendingAnnouncement};

package/dist/src/harness/approval-candidates.d.ts

@@ -2,8 +2,11 @@ import type { SessionAuthContext } from "#channel/types.js";
 import type { AuthorizationChallenge } from "#harness/authorization.js";
 import type { SessionStateMap } from "#harness/types.js";
 type ApprovalCandidateStatus = "pending" | "authorization-required" | "allowed" | "rejected" | "failed" | "timed-out" | "stale";
+/** What a responder submitted: a candidate settles its request this way once allowed. */
+export type ApprovalCandidateDecision = "approve" | "cancel";
 interface ApprovalCandidateAuditRecord {
     readonly candidateId: string;
+    readonly decision: ApprovalCandidateDecision;
     readonly requestId: string;
     readonly responder: ApprovalResponderIdentity;
     readonly status: ApprovalCandidateStatus;
@@ -29,6 +32,7 @@ export interface ApprovalSettlementAuditRecord {
 }
 export interface ActiveApprovalCandidate {
     readonly candidateId: string;
+    readonly decision: ApprovalCandidateDecision;
     readonly requestId: string;
     readonly responder: SessionAuthContext;
     readonly status: "pending" | "authorization-required";
@@ -41,10 +45,11 @@ interface ApprovalStateTransition {
     readonly changed: boolean;
     readonly state: SessionStateMap | undefined;
 }
-/** Creates or deduplicates one responder's Allow candidate for a pending request. */
+/** Creates or deduplicates one responder's candidate decision for a pending request. */
 export declare function createApprovalCandidate(input: {
     readonly candidateIdPrefix: string;
     readonly createdAt: number;
+    readonly decision: ApprovalCandidateDecision;
     readonly expiresAt: number;
     readonly requestId: string;
     readonly responder: SessionAuthContext;
@@ -85,7 +90,10 @@ export declare function expireApprovalCandidates(input: {
     readonly now: number;
     readonly state: SessionStateMap | undefined;
 }): SessionStateMap | undefined;
-/** Atomically settles an allowed candidate; every losing candidate becomes stale. */
+/**
+ * Atomically settles a request with an allowed candidate's decision; every
+ * losing candidate becomes stale.
+ */
 export declare function settleAllowedCandidate(input: {
     readonly candidateId: string;
     readonly settledAt: number;

package/dist/src/harness/approval-candidates.js

@@ -1 +1 @@
-const APPROVAL_STATE_KEY=`eve.runtime.hitl.approvalState`;function createApprovalCandidate(e){let t=expireApprovalCandidates({now:e.createdAt,state:e.state}),n=readApprovalState(t);if(n.settlements[e.requestId]!==void 0)return{changed:!1,state:t};let r=e.responder;if(Object.values(n.activeCandidates).find(t=>t.requestId===e.requestId&&sameResponder(t.responder,r))!==void 0)return{changed:!1,state:t};let i=n.activeCandidates[e.candidateIdPrefix]!==void 0||n.candidateHistory.some(t=>t.candidateId===e.candidateIdPrefix)?`${e.candidateIdPrefix}.${n.nextCandidateSequence.toString(36)}`:e.candidateIdPrefix;if(n.activeCandidates[i]!==void 0||n.candidateHistory.some(e=>e.candidateId===i))throw Error(`Approval candidate id collision: "${i}".`);let a={candidateId:i,createdAt:e.createdAt,expiresAt:e.expiresAt,requestId:e.requestId,responder:r,status:`pending`};return{changed:!0,state:writeApprovalState(t,{...n,activeCandidates:{...n.activeCandidates,[a.candidateId]:a},nextCandidateSequence:n.nextCandidateSequence+1})}}function markApprovalCandidatePendingEventEmitted(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];return n===void 0||n.pendingEventEmitted===!0?e.state:writeApprovalState(e.state,{...t,activeCandidates:{...t.activeCandidates,[e.candidateId]:{...n,pendingEventEmitted:!0}}})}function markApprovalCandidateHistoryEventEmitted(e){let t=readApprovalState(e.state),n=!1,r=t.candidateHistory.map(t=>t.candidateId!==e.candidateId||t.eventEmitted===!0?t:(n=!0,{...t,eventEmitted:!0}));return n?writeApprovalState(e.state,{...t,candidateHistory:r}):e.state}function markApprovalSettlementEventEmitted(e){let t=readApprovalState(e.state),n=t.settlements[e.requestId];return n===void 0||n.eventEmitted===!0?e.state:writeApprovalState(e.state,{...t,settlements:{...t.settlements,[e.requestId]:{...n,eventEmitted:!0}}})}function markApprovalCandidateAuthorizationRequired(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];if(n===void 0)return e.state;let r={...n,authorizationChallenges:e.authorizationChallenges,expiresAt:e.expiresAt??n.expiresAt,status:`authorization-required`};return writeApprovalState(e.state,{...t,activeCandidates:{...t.activeCandidates,[e.candidateId]:r}})}function finishApprovalCandidate(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];if(n===void 0)return e.state;let r={...t.activeCandidates};return delete r[e.candidateId],writeApprovalState(e.state,{...t,activeCandidates:r,candidateHistory:[...t.candidateHistory,toCandidateAuditRecord({candidate:n,completedAt:e.completedAt,reason:e.reason,status:e.status})]})}function expireApprovalCandidates(e){let t=e.state,n=Object.values(readApprovalState(t).activeCandidates);for(let r of n)r.expiresAt>e.now||(t=finishApprovalCandidate({candidateId:r.candidateId,completedAt:e.now,state:t,status:`timed-out`}));return t}function settleAllowedCandidate(e){let t=expireApprovalCandidates({now:e.settledAt,state:e.state}),n=readApprovalState(t),r=n.activeCandidates[e.candidateId];if(r===void 0){let r=n.candidateHistory.find(t=>t.candidateId===e.candidateId);if((r&&n.settlements[r.requestId])!==void 0)return{changed:!1,state:t};throw Error(`Unknown approval candidate "${e.candidateId}".`)}return settleRequest({actor:projectResponder(r.responder),candidateId:r.candidateId,outcome:`allowed`,requestId:r.requestId,settledAt:e.settledAt,state:t})}function settleDirectApprovalResponse(e){let t=expireApprovalCandidates({now:e.settledAt,state:e.state});return settleRequest({actor:projectResponder(e.actor),outcome:e.outcome,requestId:e.requestId,settledAt:e.settledAt,state:t})}function getActiveApprovalCandidate(e,t){return readApprovalState(e).activeCandidates[t]}function getApprovalAuditState(e){let t=readApprovalState(e);return{activeCandidates:Object.values(t.activeCandidates),candidateHistory:t.candidateHistory,settlements:Object.values(t.settlements)}}function settleRequest(e){let t=readApprovalState(e.state);if(t.settlements[e.requestId]!==void 0)return{changed:!1,state:e.state};let n={actor:e.actor,candidateId:e.candidateId,outcome:e.outcome,requestId:e.requestId,settledAt:e.settledAt},r={},i=[...t.candidateHistory];for(let n of Object.values(t.activeCandidates)){if(n.requestId!==e.requestId){r[n.candidateId]=n;continue}i.push(toCandidateAuditRecord({candidate:n,completedAt:e.settledAt,status:n.candidateId===e.candidateId?`allowed`:`stale`}))}let a={activeCandidates:r,candidateHistory:i,nextCandidateSequence:t.nextCandidateSequence,settlements:{...t.settlements,[e.requestId]:n}};return{changed:!0,state:writeApprovalState(e.state,a)}}function toCandidateAuditRecord(e){let{authorizationChallenges:t,responder:n,...r}=e.candidate;return{...r,completedAt:e.completedAt,responder:projectResponder(n),reason:e.reason,status:e.status}}function projectResponder(e){return{authenticator:e.authenticator,issuer:e.issuer,principalId:e.principalId,principalType:e.principalType}}function sameResponder(e,t){return e.authenticator===t.authenticator&&e.issuer===t.issuer&&e.principalId===t.principalId&&e.principalType===t.principalType}function readApprovalState(e){let t=e?.[APPROVAL_STATE_KEY];if(typeof t!=`object`||!t)return{activeCandidates:{},candidateHistory:[],nextCandidateSequence:0,settlements:{}};let n=t;return{activeCandidates:typeof n.activeCandidates==`object`&&n.activeCandidates!==null?n.activeCandidates:{},candidateHistory:Array.isArray(n.candidateHistory)?n.candidateHistory:[],nextCandidateSequence:typeof n.nextCandidateSequence==`number`&&Number.isSafeInteger(n.nextCandidateSequence)&&n.nextCandidateSequence>=0?n.nextCandidateSequence:deriveNextCandidateSequence(n),settlements:typeof n.settlements==`object`&&n.settlements!==null?n.settlements:{}}}function deriveNextCandidateSequence(e){return Object.keys(e.activeCandidates??{}).length+(Array.isArray(e.candidateHistory)?e.candidateHistory.length:0)}function writeApprovalState(e,t){return{...e,[APPROVAL_STATE_KEY]:t}}export{createApprovalCandidate,expireApprovalCandidates,finishApprovalCandidate,getActiveApprovalCandidate,getApprovalAuditState,markApprovalCandidateAuthorizationRequired,markApprovalCandidateHistoryEventEmitted,markApprovalCandidatePendingEventEmitted,markApprovalSettlementEventEmitted,settleAllowedCandidate,settleDirectApprovalResponse};
+const APPROVAL_STATE_KEY=`eve.runtime.hitl.approvalState`;function createApprovalCandidate(e){let t=expireApprovalCandidates({now:e.createdAt,state:e.state}),n=readApprovalState(t);if(n.settlements[e.requestId]!==void 0)return{changed:!1,state:t};let r=e.responder;if(Object.values(n.activeCandidates).find(t=>t.requestId===e.requestId&&t.decision===e.decision&&sameResponder(t.responder,r))!==void 0)return{changed:!1,state:t};let i=n.activeCandidates[e.candidateIdPrefix]!==void 0||n.candidateHistory.some(t=>t.candidateId===e.candidateIdPrefix)?`${e.candidateIdPrefix}.${n.nextCandidateSequence.toString(36)}`:e.candidateIdPrefix;if(n.activeCandidates[i]!==void 0||n.candidateHistory.some(e=>e.candidateId===i))throw Error(`Approval candidate id collision: "${i}".`);let a={candidateId:i,createdAt:e.createdAt,decision:e.decision,expiresAt:e.expiresAt,requestId:e.requestId,responder:r,status:`pending`};return{changed:!0,state:writeApprovalState(t,{...n,activeCandidates:{...n.activeCandidates,[a.candidateId]:a},nextCandidateSequence:n.nextCandidateSequence+1})}}function markApprovalCandidatePendingEventEmitted(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];return n===void 0||n.pendingEventEmitted===!0?e.state:writeApprovalState(e.state,{...t,activeCandidates:{...t.activeCandidates,[e.candidateId]:{...n,pendingEventEmitted:!0}}})}function markApprovalCandidateHistoryEventEmitted(e){let t=readApprovalState(e.state),n=!1,r=t.candidateHistory.map(t=>t.candidateId!==e.candidateId||t.eventEmitted===!0?t:(n=!0,{...t,eventEmitted:!0}));return n?writeApprovalState(e.state,{...t,candidateHistory:r}):e.state}function markApprovalSettlementEventEmitted(e){let t=readApprovalState(e.state),n=t.settlements[e.requestId];return n===void 0||n.eventEmitted===!0?e.state:writeApprovalState(e.state,{...t,settlements:{...t.settlements,[e.requestId]:{...n,eventEmitted:!0}}})}function markApprovalCandidateAuthorizationRequired(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];if(n===void 0)return e.state;let r={...n,authorizationChallenges:e.authorizationChallenges,expiresAt:e.expiresAt??n.expiresAt,status:`authorization-required`};return writeApprovalState(e.state,{...t,activeCandidates:{...t.activeCandidates,[e.candidateId]:r}})}function finishApprovalCandidate(e){let t=readApprovalState(e.state),n=t.activeCandidates[e.candidateId];if(n===void 0)return e.state;let r={...t.activeCandidates};return delete r[e.candidateId],writeApprovalState(e.state,{...t,activeCandidates:r,candidateHistory:[...t.candidateHistory,toCandidateAuditRecord({candidate:n,completedAt:e.completedAt,reason:e.reason,status:e.status})]})}function expireApprovalCandidates(e){let t=e.state,n=Object.values(readApprovalState(t).activeCandidates);for(let r of n)r.expiresAt>e.now||(t=finishApprovalCandidate({candidateId:r.candidateId,completedAt:e.now,state:t,status:`timed-out`}));return t}function settleAllowedCandidate(e){let t=expireApprovalCandidates({now:e.settledAt,state:e.state}),n=readApprovalState(t),r=n.activeCandidates[e.candidateId];if(r===void 0){let r=n.candidateHistory.find(t=>t.candidateId===e.candidateId);if((r&&n.settlements[r.requestId])!==void 0)return{changed:!1,state:t};throw Error(`Unknown approval candidate "${e.candidateId}".`)}return settleRequest({actor:projectResponder(r.responder),candidateId:r.candidateId,outcome:r.decision===`cancel`?`cancelled`:`allowed`,requestId:r.requestId,settledAt:e.settledAt,state:t})}function settleDirectApprovalResponse(e){let t=expireApprovalCandidates({now:e.settledAt,state:e.state});return settleRequest({actor:projectResponder(e.actor),outcome:e.outcome,requestId:e.requestId,settledAt:e.settledAt,state:t})}function getActiveApprovalCandidate(e,t){return readApprovalState(e).activeCandidates[t]}function getApprovalAuditState(e){let t=readApprovalState(e);return{activeCandidates:Object.values(t.activeCandidates),candidateHistory:t.candidateHistory,settlements:Object.values(t.settlements)}}function settleRequest(e){let t=readApprovalState(e.state);if(t.settlements[e.requestId]!==void 0)return{changed:!1,state:e.state};let n={actor:e.actor,candidateId:e.candidateId,outcome:e.outcome,requestId:e.requestId,settledAt:e.settledAt},r={},i=[...t.candidateHistory];for(let n of Object.values(t.activeCandidates)){if(n.requestId!==e.requestId){r[n.candidateId]=n;continue}i.push(toCandidateAuditRecord({candidate:n,completedAt:e.settledAt,status:n.candidateId===e.candidateId?`allowed`:`stale`}))}let a={activeCandidates:r,candidateHistory:i,nextCandidateSequence:t.nextCandidateSequence,settlements:{...t.settlements,[e.requestId]:n}};return{changed:!0,state:writeApprovalState(e.state,a)}}function toCandidateAuditRecord(e){let{authorizationChallenges:t,responder:n,...r}=e.candidate;return{...r,completedAt:e.completedAt,responder:projectResponder(n),reason:e.reason,status:e.status}}function projectResponder(e){return{authenticator:e.authenticator,issuer:e.issuer,principalId:e.principalId,principalType:e.principalType}}function sameResponder(e,t){return e.authenticator===t.authenticator&&e.issuer===t.issuer&&e.principalId===t.principalId&&e.principalType===t.principalType}function readActiveCandidates(e){return Object.fromEntries(Object.entries(e).map(([e,t])=>[e,{...t,decision:t.decision===`cancel`?`cancel`:`approve`}]))}function readApprovalState(e){let t=e?.[APPROVAL_STATE_KEY];if(typeof t!=`object`||!t)return{activeCandidates:{},candidateHistory:[],nextCandidateSequence:0,settlements:{}};let n=t;return{activeCandidates:typeof n.activeCandidates==`object`&&n.activeCandidates!==null?readActiveCandidates(n.activeCandidates):{},candidateHistory:Array.isArray(n.candidateHistory)?n.candidateHistory:[],nextCandidateSequence:typeof n.nextCandidateSequence==`number`&&Number.isSafeInteger(n.nextCandidateSequence)&&n.nextCandidateSequence>=0?n.nextCandidateSequence:deriveNextCandidateSequence(n),settlements:typeof n.settlements==`object`&&n.settlements!==null?n.settlements:{}}}function deriveNextCandidateSequence(e){return Object.keys(e.activeCandidates??{}).length+(Array.isArray(e.candidateHistory)?e.candidateHistory.length:0)}function writeApprovalState(e,t){return{...e,[APPROVAL_STATE_KEY]:t}}export{createApprovalCandidate,expireApprovalCandidates,finishApprovalCandidate,getActiveApprovalCandidate,getApprovalAuditState,markApprovalCandidateAuthorizationRequired,markApprovalCandidateHistoryEventEmitted,markApprovalCandidatePendingEventEmitted,markApprovalSettlementEventEmitted,settleAllowedCandidate,settleDirectApprovalResponse};

package/dist/src/harness/approval-delivery-coordinator.d.ts

@@ -13,17 +13,16 @@ interface ApprovalDeliveryResult {
  *
  * | State | Input | Transition |
  * | --- | --- | --- |
- * | pending request | Approve | create responder-bound candidate |
- * | pending request | Cancel | settle cancelled and stale candidates |
+ * | pending request | Approve or Cancel | create responder-bound candidate |
  * | pending candidate | coordinator pass | run current authorizer |
- * | pending candidate | allowed | settle approved and stale competitors |
+ * | pending candidate | allowed | settle with its decision; competitors go stale |
  * | pending candidate | rejected/error/expiry | append terminal history |
  * | pending candidate | authorization required | persist private challenge |
  * | authorization required | matching callback | re-run current authorizer |
  * | settled request | any later response | no state change |
  *
- * Delivery ingestion returns before authorizer work so Cancel and candidate
- * creation commit before long-running policy execution. Candidate results also
+ * Delivery ingestion returns before authorizer work so candidate creation
+ * commits before long-running policy execution. Candidate results also
  * commit before lifecycle events are projected by the next stack layer.
  */
 export declare function coordinateApprovalDelivery(input: {

package/dist/src/harness/approval-delivery-coordinator.js

@@ -1 +1 @@
-import{contextStorage}from"#context/container.js";import{AuthKey,SessionKey}from"#context/keys.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{buildApprovalResponseAuth,handleApprovalResponsePolicyError}from"#execution/tool-auth.js";import{getPendingInputBatches}from"#harness/pending-input-batches.js";import{clearPendingAuthorization,getAuthorizationResult,getPendingAuthorization,isAuthorizationSignal}from"#harness/authorization.js";import{createApprovalCandidate,expireApprovalCandidates,finishApprovalCandidate,getActiveApprovalCandidate,getApprovalAuditState,markApprovalCandidateAuthorizationRequired,settleAllowedCandidate,settleDirectApprovalResponse}from"#harness/approval-candidates.js";import{isApprovalRequest}from"#harness/input-request-class.js";const UNAUTHENTICATED_APPROVAL_FEEDBACK=`Authentication is required to respond to this approval.`;async function coordinateApprovalDelivery(e){let t=e.now??Date.now(),n=getApprovalAuditState(e.session.state).activeCandidates.filter(e=>e.expiresAt<=t),r=n.flatMap(e=>e.authorizationChallenges?.map(e=>e.attemptId??e.candidateId??e.name)??[]),i=expireApprovalCandidates({now:t,state:e.session.state}),a={...e.session,state:clearPendingAuthorization(i,r)},o=getApprovalAuditState(a.state),s=getPendingInputBatches(a.state),c=new Set(s.flatMap(e=>e.requests.map(e=>e.requestId))),l=o.settlements.filter(e=>c.has(e.requestId)),u=new Set(o.settlements.map(e=>e.requestId)),d=new Set([...u].filter(e=>!c.has(e))),f=hasResponseForRequest(e.stepInput,d),p=f?removeConsumedResponses(e.stepInput,d):e.stepInput;if(f&&l.length===0&&!hasMeaningfulInput(p))return deliveryResult(a,p,`park`);if(s.length===0)return deliveryResult(a,p);let m=p,h=new Set(s.flatMap(e=>e.responseAuthRequiredRequestIds??[])),g=s.flatMap(e=>e.requests),_=new Map(g.map(e=>[e.requestId,e])),v=[],y=[],b=new Set,x=!1,S=getApprovalAuditState(a.state).activeCandidates,C=[...m?.attributedInputResponses??[],...(m?.inputResponses??[]).map(e=>({auth:void 0,response:e}))];for(let{auth:e,response:n}of C){let r=_.get(n.requestId);if(r===void 0||!isApprovalRequest(r))continue;if(!h.has(n.requestId)){let r=contextStorage.getStore(),i=e===void 0?r?.get(AuthKey)??r?.get(SessionKey)?.auth.current??null:e;if(i!==null&&(n.optionId===`approve`||n.optionId===`cancel`)){let e=settleDirectApprovalResponse({actor:i,outcome:n.optionId===`approve`?`allowed`:`cancelled`,requestId:n.requestId,settledAt:t,state:a.state});a={...a,state:e.state},x||=e.changed}continue}if(b.add(n.requestId),n.optionId===`cancel`){let r=e===void 0?buildCallbackContext().session.auth.current:e;if(r===null){y.push(UNAUTHENTICATED_APPROVAL_FEEDBACK);continue}let i=settleDirectApprovalResponse({actor:r,outcome:`cancelled`,requestId:n.requestId,settledAt:t,state:a.state});a={...a,state:i.state},x||=i.changed;continue}if(n.optionId!==`approve`)continue;let i=e===void 0?buildCallbackContext().session.auth.current:e;if(i===null){y.push(UNAUTHENTICATED_APPROVAL_FEEDBACK);continue}let o=createApprovalCandidate({candidateIdPrefix:approvalCandidateIdPrefix(r.requestId,i),createdAt:t,expiresAt:t+6e5,requestId:r.requestId,responder:i,state:a.state});a={...a,state:o.state},x||=o.changed}let w=removeConsumedResponses(m,b);if(b.size>0)return deliveryResult(a,w,x?`continue-coordination`:`continue`,[],y);if(x)return deliveryResult(a,w,`continue`,[],y);let T=new Set(getPendingAuthorization(a.state)?.challenges.map(e=>e.name)??[]);for(let n of S){if(n.status===`authorization-required`){let e=n.authorizationChallenges??[];if(!e.some(e=>getAuthorizationResult(e.name)!==void 0)){v.push(...e.filter(e=>!T.has(e.name)));continue}}let r=_.get(n.requestId);if(r===void 0||getActiveApprovalCandidate(a.state,n.candidateId)===void 0)continue;let i=await authorizeCandidate({candidateId:n.candidateId,now:t,request:r,responder:n.responder,session:a,tools:await e.prepareTools?.(r)??e.tools});a=i.session,x||=i.didCommit,v.push(...i.challenges);let o=getApprovalAuditState(a.state).settlements.find(e=>e.requestId===n.requestId);o!==void 0&&l.push(o)}let E=appendSettledResponses(w,l);return(x||n.length>0)&&getApprovalAuditState(a.state).activeCandidates.length===0?deliveryResult(a,E,`responses-completed`):l.length>0?deliveryResult(a,E,`continue`):x?deliveryResult(a,E,`continue-coordination`):deliveryResult(a,E,v.length>0?`authorization-required`:`continue`,v)}async function authorizeCandidate(e){let t={...e.session,state:expireApprovalCandidates({now:e.now,state:e.session.state})};if(getActiveApprovalCandidate(t.state,e.candidateId)===void 0)return{challenges:[],didCommit:!1,session:t};let n=e.tools.get(e.request.action.toolName)?.approval,r=n!==void 0&&typeof n!=`function`?n.response:void 0;if(r===void 0)return failCandidate({...e,reason:`Approval authorization is temporarily unavailable. Please try again.`,session:t});try{let n=buildCallbackContext(),i=await withAuthorizerTimeout(r({auth:buildApprovalResponseAuth({responder:e.responder,scope:e.candidateId}),request:{callId:e.request.action.callId,requestId:e.request.requestId,toolInput:e.request.action.input,toolName:e.request.action.toolName},response:{decision:`approve`},responder:e.responder,session:{id:n.session.id,initiator:n.session.auth.initiator,parent:n.session.parent,turn:n.session.turn}}));if(i.status===`rejected`)return t={...t,state:finishApprovalCandidate({candidateId:e.candidateId,completedAt:e.now,reason:i.reason,state:t.state,status:`rejected`})},{challenges:[],didCommit:!0,session:t};if(i.status!==`allowed`)return failCandidate({...e,session:t});let a=settleAllowedCandidate({candidateId:e.candidateId,settledAt:e.now,state:t.state});return{challenges:[],didCommit:a.changed,session:{...t,state:a.state}}}catch(n){let r=await handleApprovalResponsePolicyError(n).catch(()=>void 0);if(isAuthorizationSignal(r)){let n=r.challenges.map(e=>Date.parse(e.challenge.expiresAt??``)).filter(Number.isFinite).sort((e,t)=>e-t)[0];return t={...t,state:markApprovalCandidateAuthorizationRequired({authorizationChallenges:r.challenges.map(t=>({...t,candidateId:e.candidateId})),candidateId:e.candidateId,expiresAt:n,state:t.state})},{challenges:r.challenges.map(t=>({...t,candidateId:e.candidateId})),didCommit:!0,session:t}}return failCandidate({...e,session:t})}}function failCandidate(e){let t=e.reason??`We couldn’t verify your approval. Please try again.`;return{challenges:[],didCommit:!0,session:{...e.session,state:finishApprovalCandidate({candidateId:e.candidateId,completedAt:e.now,reason:t,state:e.session.state,status:`failed`})}}}function hasResponseForRequest(e,t){return e?.attributedInputResponses?.some(({response:e})=>t.has(e.requestId))===!0||e?.inputResponses?.some(e=>t.has(e.requestId))===!0}function hasMeaningfulInput(e){return e?.message!==void 0||(e?.attributedInputResponses?.length??0)>0||(e?.inputResponses?.length??0)>0||(e?.runtimeActionResults?.length??0)>0}function appendSettledResponses(e,t){if(t.length===0)return e;let n=new Set([...(e?.inputResponses??[]).map(e=>e.requestId),...(e?.attributedInputResponses??[]).map(({response:e})=>e.requestId)]),r=t.filter(e=>!n.has(e.requestId));return r.length===0?e:{...e,inputResponses:[...e?.inputResponses??[],...r.map(e=>({optionId:e.outcome===`allowed`?`approve`:`cancel`,requestId:e.requestId}))]}}function removeConsumedResponses(e,t){if(e===void 0)return;let n=(e.attributedInputResponses??[]).filter(({response:e})=>!t.has(e.requestId)),r=[...(e.inputResponses??[]).filter(e=>!t.has(e.requestId)),...n.map(({response:e})=>e)];return{...e,attributedInputResponses:void 0,inputResponses:r}}function deliveryResult(e,t,n=`continue`,r=[],i=[]){return{challenges:r,feedback:i,kind:n,session:e,stepInput:t}}function approvalCandidateIdPrefix(e,t){let n=[t.authenticator,t.issuer??``,t.principalType,t.principalId].join(`:`);return`${encodeCandidateIdPart(e)}.${encodeCandidateIdPart(n)}`}function encodeCandidateIdPart(e){return Array.from(e,e=>e.codePointAt(0).toString(36)).join(`-`)}async function withAuthorizerTimeout(e){let t;try{return await Promise.race([Promise.resolve(e),new Promise((e,n)=>{t=setTimeout(()=>n(Error(`Approval response authorizer timed out.`)),1e4)})])}finally{t!==void 0&&clearTimeout(t)}}export{coordinateApprovalDelivery};
+import{contextStorage}from"#context/container.js";import{AuthKey,SessionKey}from"#context/keys.js";import{buildCallbackContext}from"#context/build-callback-context.js";import{buildApprovalResponseAuth,handleApprovalResponsePolicyError}from"#execution/tool-auth.js";import{clearPendingAuthorization,getAuthorizationResult,getPendingAuthorization,isAuthorizationSignal}from"#harness/authorization.js";import{getPendingInputBatches,pendingInputRequester}from"#harness/pending-input-batches.js";import{createApprovalCandidate,expireApprovalCandidates,finishApprovalCandidate,getActiveApprovalCandidate,getApprovalAuditState,markApprovalCandidateAuthorizationRequired,settleAllowedCandidate,settleDirectApprovalResponse}from"#harness/approval-candidates.js";import{isApprovalRequest}from"#harness/input-request-class.js";async function coordinateApprovalDelivery(e){let t=e.now??Date.now(),n=getApprovalAuditState(e.session.state).activeCandidates.filter(e=>e.expiresAt<=t),r=n.flatMap(e=>e.authorizationChallenges?.map(e=>e.attemptId??e.candidateId??e.name)??[]),i=expireApprovalCandidates({now:t,state:e.session.state}),a={...e.session,state:clearPendingAuthorization(i,r)},o=getApprovalAuditState(a.state),s=getPendingInputBatches(a.state),c=new Set(s.flatMap(e=>e.requests.map(e=>e.requestId))),l=o.settlements.filter(e=>c.has(e.requestId)),u=new Set(o.settlements.map(e=>e.requestId)),d=new Set([...u].filter(e=>!c.has(e))),f=hasResponseForRequest(e.stepInput,d),p=f?removeConsumedResponses(e.stepInput,d):e.stepInput;if(f&&l.length===0&&!hasMeaningfulInput(p))return deliveryResult(a,p,`park`);if(s.length===0)return deliveryResult(a,p);let m=p,h=new Set(s.flatMap(e=>e.responseAuthRequiredRequestIds??[])),g=s.flatMap(e=>e.requests),_=new Map(g.map(e=>[e.requestId,e])),v=[],y=[],b=new Set,x=!1,S=getApprovalAuditState(a.state).activeCandidates,C=[...m?.attributedInputResponses??[],...(m?.inputResponses??[]).map(e=>({auth:void 0,response:e}))];for(let{auth:e,response:n}of C){let r=_.get(n.requestId);if(r===void 0||!isApprovalRequest(r))continue;if(!h.has(n.requestId)){let r=contextStorage.getStore(),i=e===void 0?r?.get(AuthKey)??r?.get(SessionKey)?.auth.current??null:e,o=toCandidateDecision(n.optionId);if(i!==null&&o!==void 0){let e=settleDirectApprovalResponse({actor:i,outcome:o===`approve`?`allowed`:`cancelled`,requestId:n.requestId,settledAt:t,state:a.state});a={...a,state:e.state},x||=e.changed}continue}b.add(n.requestId);let i=toCandidateDecision(n.optionId);if(i===void 0)continue;let o=e===void 0?buildCallbackContext().session.auth.current:e;if(o===null){y.push(`Authentication is required to respond to this approval.`);continue}let s=createApprovalCandidate({candidateIdPrefix:approvalCandidateIdPrefix(r.requestId,o,i),createdAt:t,decision:i,expiresAt:t+6e5,requestId:r.requestId,responder:o,state:a.state});a={...a,state:s.state},x||=s.changed}let w=removeConsumedResponses(m,b);if(b.size>0)return deliveryResult(a,w,x?`continue-coordination`:`continue`,[],y);if(x)return deliveryResult(a,w,`continue`,[],y);let T=new Set(getPendingAuthorization(a.state)?.challenges.map(e=>e.name)??[]);for(let n of S){if(n.status===`authorization-required`){let e=n.authorizationChallenges??[];if(!e.some(e=>getAuthorizationResult(e.name)!==void 0)){v.push(...e.filter(e=>!T.has(e.name)));continue}}let r=_.get(n.requestId);if(r===void 0||getActiveApprovalCandidate(a.state,n.candidateId)===void 0)continue;let i=await authorizeCandidate({candidateId:n.candidateId,decision:n.decision,now:t,request:r,responder:n.responder,session:a,tools:await e.prepareTools?.(r)??e.tools});a=i.session,x||=i.didCommit,v.push(...i.challenges);let o=getApprovalAuditState(a.state).settlements.find(e=>e.requestId===n.requestId);o!==void 0&&l.push(o)}let E=appendSettledResponses(w,l);return(x||n.length>0)&&getApprovalAuditState(a.state).activeCandidates.length===0?deliveryResult(a,E,`responses-completed`):l.length>0?deliveryResult(a,E,`continue`):x?deliveryResult(a,E,`continue-coordination`):deliveryResult(a,E,v.length>0?`authorization-required`:`continue`,v)}async function authorizeCandidate(e){let t={...e.session,state:expireApprovalCandidates({now:e.now,state:e.session.state})};if(getActiveApprovalCandidate(t.state,e.candidateId)===void 0)return{challenges:[],didCommit:!1,session:t};let n=e.tools.get(e.request.action.toolName)?.approval,r=n!==void 0&&typeof n!=`function`?n.response:void 0;if(r===void 0)return failCandidate({...e,reason:`Approval authorization is temporarily unavailable. Please try again.`,session:t});try{let n=buildCallbackContext(),i=await withAuthorizerTimeout(r({auth:buildApprovalResponseAuth({responder:e.responder,scope:e.candidateId}),request:{callId:e.request.action.callId,requestId:e.request.requestId,principal:pendingInputRequester(t.state,e.request.requestId),toolInput:e.request.action.input,toolName:e.request.action.toolName},response:{decision:e.decision,principal:e.responder},session:{id:n.session.id,initiator:n.session.auth.initiator,parent:n.session.parent,turn:n.session.turn}}));if(i.status===`rejected`)return t={...t,state:finishApprovalCandidate({candidateId:e.candidateId,completedAt:e.now,reason:i.reason,state:t.state,status:`rejected`})},{challenges:[],didCommit:!0,session:t};if(i.status!==`allowed`)return failCandidate({...e,session:t});let a=settleAllowedCandidate({candidateId:e.candidateId,settledAt:e.now,state:t.state});return{challenges:[],didCommit:a.changed,session:{...t,state:a.state}}}catch(n){let r=await handleApprovalResponsePolicyError(n).catch(()=>void 0);if(isAuthorizationSignal(r)){let n=r.challenges.map(e=>Date.parse(e.challenge.expiresAt??``)).filter(Number.isFinite).sort((e,t)=>e-t)[0];return t={...t,state:markApprovalCandidateAuthorizationRequired({authorizationChallenges:r.challenges.map(t=>({...t,candidateId:e.candidateId})),candidateId:e.candidateId,expiresAt:n,state:t.state})},{challenges:r.challenges.map(t=>({...t,candidateId:e.candidateId})),didCommit:!0,session:t}}return failCandidate({...e,session:t})}}function failCandidate(e){let t=e.reason??`We couldn’t verify your response. Please try again.`;return{challenges:[],didCommit:!0,session:{...e.session,state:finishApprovalCandidate({candidateId:e.candidateId,completedAt:e.now,reason:t,state:e.session.state,status:`failed`})}}}function hasResponseForRequest(e,t){return e?.attributedInputResponses?.some(({response:e})=>t.has(e.requestId))===!0||e?.inputResponses?.some(e=>t.has(e.requestId))===!0}function hasMeaningfulInput(e){return e?.message!==void 0||(e?.attributedInputResponses?.length??0)>0||(e?.inputResponses?.length??0)>0||(e?.runtimeActionResults?.length??0)>0}function appendSettledResponses(e,t){if(t.length===0)return e;let n=new Set([...(e?.inputResponses??[]).map(e=>e.requestId),...(e?.attributedInputResponses??[]).map(({response:e})=>e.requestId)]),r=t.filter(e=>!n.has(e.requestId));return r.length===0?e:{...e,inputResponses:[...e?.inputResponses??[],...r.map(e=>({optionId:e.outcome===`allowed`?`approve`:`cancel`,requestId:e.requestId}))]}}function removeConsumedResponses(e,t){if(e===void 0)return;let n=(e.attributedInputResponses??[]).filter(({response:e})=>!t.has(e.requestId)),r=[...(e.inputResponses??[]).filter(e=>!t.has(e.requestId)),...n.map(({response:e})=>e)];return{...e,attributedInputResponses:void 0,inputResponses:r}}function deliveryResult(e,t,n=`continue`,r=[],i=[]){return{challenges:r,feedback:i,kind:n,session:e,stepInput:t}}function toCandidateDecision(e){if(e===`approve`)return`approve`;if(e===`cancel`||e===`deny`)return`cancel`}function approvalCandidateIdPrefix(e,t,n){let r=[t.authenticator,t.issuer??``,t.principalType,t.principalId].join(`:`),i=`${encodeCandidateIdPart(e)}.${encodeCandidateIdPart(r)}`;return n===`approve`?i:`${i}.${encodeCandidateIdPart(n)}`}function encodeCandidateIdPart(e){return Array.from(e,e=>e.codePointAt(0).toString(36)).join(`-`)}async function withAuthorizerTimeout(e){let t;try{return await Promise.race([Promise.resolve(e),new Promise((e,n)=>{t=setTimeout(()=>n(Error(`Approval response authorizer timed out.`)),1e4)})])}finally{t!==void 0&&clearTimeout(t)}}export{coordinateApprovalDelivery};

package/dist/src/harness/approval-recheck.d.ts

@@ -0,0 +1,7 @@
+import type { ModelMessage } from "ai";
+import type { ApprovalContext } from "#approval/definition.js";
+/** Whether `messages` hold a person's approval of `toolCallId`. */
+export declare function isApprovedToolCall(messages: readonly ModelMessage[], toolCallId: string): boolean;
+export declare function markApprovalRecheck<T extends ApprovalContext>(context: T): T;
+/** Whether `context` is the re-check of an approved call just before it runs. */
+export declare function isApprovalRecheck(context: ApprovalContext): boolean;

package/dist/src/harness/approval-recheck.js

@@ -0,0 +1 @@
+const rechecks=new WeakSet;function isApprovedToolCall(e,t){let n=new Set;for(let r of e)if(r.role===`assistant`&&typeof r.content!=`string`)for(let e of r.content)e.type===`tool-approval-request`&&e.toolCallId===t&&n.add(e.approvalId);return n.size!==0&&e.some(e=>e.role===`tool`&&e.content.some(e=>e.type===`tool-approval-response`&&e.approved&&n.has(e.approvalId)))}function markApprovalRecheck(e){return rechecks.add(e),e}function isApprovalRecheck(e){return rechecks.has(e)}export{isApprovalRecheck,isApprovedToolCall,markApprovalRecheck};

package/dist/src/harness/authorization-event-fields.d.ts

@@ -0,0 +1,13 @@
+import type { AuthorizationChallenge } from "#harness/authorization.js";
+/**
+ * Fields every `authorization.*` event copies from its challenge. Emitters
+ * spread this and add only event-local fields, so a new challenge-derived
+ * field reaches every event at once.
+ */
+export declare function authorizationEventFields(challenge: AuthorizationChallenge): {
+    attemptId: string | undefined;
+    authorization: import("../connections/errors.ts").ConnectionAuthorizationChallenge;
+    candidateId: string | undefined;
+    name: string;
+    principalId: string | undefined;
+};

package/dist/src/harness/authorization-event-fields.js

@@ -0,0 +1 @@
+function authorizationEventFields(e){return{attemptId:e.attemptId,authorization:e.challenge,candidateId:e.candidateId,name:e.name,principalId:e.principalId}}export{authorizationEventFields};

package/dist/src/harness/authorization.d.ts

@@ -1,4 +1,5 @@
 import { ContextKey } from "#context/key.js";
+import { type SessionAuthContext } from "#context/keys.js";
 import type { ConnectionAuthorizationChallenge } from "#connections/errors.js";
 import type { AuthorizationCallback, ConnectionPrincipal } from "#shared/connection-types.js";
 import type { JsonValue } from "#shared/json.js";
@@ -8,6 +9,12 @@ export interface AuthorizationChallenge {
     /** Opaque identity of this exact authorization attempt. */
     readonly attemptId?: string;
     readonly candidateId?: string;
+    /**
+     * Credential this sign-in grants, shared by every scope that uses it (the
+     * Vercel Connect connector). Attempts for the same grant and principal are
+     * one sign-in, so only one is shown.
+     */
+    readonly grant?: string;
     /** Opaque resolved connection identity; omitted for tool-hosted authorization. */
     readonly instanceId?: string;
     readonly name: string;
@@ -15,6 +22,14 @@ export interface AuthorizationChallenge {
     readonly hookUrl: string;
     /** Principal passed to `startAuthorization`; omitted from model-facing copies. */
     readonly principal?: ConnectionPrincipal;
+    /** Session principal that started this attempt; projected onto authorization events. */
+    readonly principalId?: string;
+    /**
+     * Session identity that started this attempt. The callback carries no
+     * identity, so the resumed turn runs as this caller. Never projected onto
+     * events or model-facing output.
+     */
+    readonly requester?: SessionAuthContext;
     /**
      * Opaque resume value from the strategy's `startAuthorization`,
      * journaled across the park. Absent for provider-owned flows.
@@ -121,13 +136,12 @@ export declare const CallbackBaseUrlKey: ContextKey<string>;
 /** Hook token of a runtime that owns its callback instead of using the session hook. */
 export declare const AuthorizationHookKey: ContextKey<string>;
 export interface PendingAuthorizationState {
-    readonly activityRootTurnIds?: Readonly<Record<string, string>>;
     readonly challenges: readonly AuthorizationChallenge[];
 }
 export declare function setPendingAuthorization(sessionState: Record<string, unknown> | undefined, value: PendingAuthorizationState): Record<string, unknown>;
-/** Keeps the last challenge for each authorization name and principal scope. */
+/** Keeps the last challenge for each sign-in and principal. */
 export declare function resolveActiveAuthorizationChallenges(challenges: readonly AuthorizationChallenge[]): readonly AuthorizationChallenge[];
-/** Existing same-scope attempts replaced by newer attempts for the same principal. */
+/** Existing attempts replaced by newer attempts for the same sign-in and principal. */
 export declare function getSupersededAuthorizationChallenges(sessionState: Record<string, unknown> | undefined, replacements: readonly AuthorizationChallenge[]): readonly AuthorizationChallenge[];
 export declare function clearPendingAuthorization(sessionState: Record<string, unknown> | undefined, attemptIds?: readonly string[]): Record<string, unknown> | undefined;
 export declare function getPendingAuthorization(sessionState: Record<string, unknown> | undefined): PendingAuthorizationState | undefined;

package/dist/src/harness/authorization.js

@@ -1 +1 @@
-import{createEveConnectionCallbackRoutePath}from"#protocol/routes.js";import{sessionCommandHookToken,sessionInboxHookToken}from"#execution/session-inbox/address.js";import{contextStorage,loadContext}from"#context/container.js";import{ActivityRootTurnIdKey,SessionIdKey}from"#context/keys.js";import{ContextKey}from"#context/key.js";import{createWorkflowCallbackUrl}from"#execution/workflow-callback-url.js";import{createUlid}from"#shared/ulid.js";const AUTHORIZATION_BRAND=`__eveAuthorization`,AUTHORIZATION_PENDING_BRAND=`__eveAuthorizationPending`;function requestAuthorization(e){return{[AUTHORIZATION_BRAND]:!0,challenges:e}}function getAuthorizationResult(e){let t=loadContext().get(PendingAuthorizationResultKey);if(t&&t.length!==0)return e===void 0?t[0]:t.find(t=>t.name===e)}function getAuthorizationResults(){return loadContext().get(PendingAuthorizationResultKey)??[]}function consumeAuthorizationResult(e,t){let n=loadContext(),r=n.get(PendingAuthorizationResultKey);if(!r||r.length===0)return;let i=r.findIndex(n=>n.name===e&&n.instanceId===t);if(i===-1&&t!==void 0&&r.some(t=>t.name===e&&t.instanceId!==void 0))throw Error(`Authorization for "${e}" cannot complete because its resolved connection changed while sign-in was pending. Start sign-in again.`);if(i===-1)return;let a=r[i],o=r.filter((e,t)=>t!==i);return n.delete(PendingAuthorizationResultKey),o.length>0&&n.set(PendingAuthorizationResultKey,o),a}function getHookUrl(e,t){let n=loadContext(),r=n.get(SessionIdKey),i=n.get(CallbackBaseUrlKey),a=n.get(AuthorizationHookKey)??(r?authHookToken(r):void 0);if(a&&i)return createWorkflowCallbackUrl(i,createEveConnectionCallbackRoutePath(e,t,a))}function createAuthorizationAttempt(e){let t=createUlid(),n=getHookUrl(e,t);return n===void 0?void 0:{attemptId:t,hookUrl:n}}function isAuthorizationSignal(e){return typeof e!=`object`||!e?!1:e[AUTHORIZATION_BRAND]===!0}function isAuthorizationPendingModelOutput(e){return typeof e!=`object`||!e?!1:e[AUTHORIZATION_PENDING_BRAND]===!0}function authorizationPendingAsJsonObject(e){return{[AUTHORIZATION_PENDING_BRAND]:!0,connections:[...e.connections]}}function modelFacingAuthorizationOutput(e){return authorizationPendingAsJsonObject({connections:e.challenges.map(e=>e.name)})}function authorizationPendingModelText(e){return e.length===0?`Authorization required. Waiting for the user to sign in.`:e.length===1?`Authorization required for ${e[0]}. Waiting for the user to sign in.`:`Authorization required for ${e.join(`, `)}. Waiting for the user to sign in.`}function isPendingAuthorizationToolOutput(e){return isAuthorizationPendingModelOutput(e)||isAuthorizationSignal(e)}function authHookToken(e){return sessionInboxHookToken(sessionCommandHookToken(e))}const PendingAuthorizationResultKey=new ContextKey(`eve.pendingAuthorizationResult`),CallbackBaseUrlKey=new ContextKey(`eve.callbackBaseUrl`),AuthorizationHookKey=new ContextKey(`eve.authorizationHook`),PENDING_AUTHORIZATION_KEY=`eve.runtime.pendingAuthorization`;function setPendingAuthorization(e,t){let n=resolveActiveAuthorizationChallenges(t.challenges),r=getPendingAuthorization(e),i=r?.challenges??[],a=getSupersededAuthorizationChallenges(e,n),o=contextStorage.getStore()?.get(ActivityRootTurnIdKey),s={...r?.activityRootTurnIds};for(let e of a)delete s[authorizationAttemptKey(e)];if(o!==void 0)for(let e of n)s[authorizationAttemptKey(e)]=o;return{...e,[PENDING_AUTHORIZATION_KEY]:{...Object.keys(s).length===0?{}:{activityRootTurnIds:s},challenges:[...i.filter(e=>!a.includes(e)),...n]}}}function resolveActiveAuthorizationChallenges(e){return e.filter((t,n)=>!e.slice(n+1).some(e=>t.name===e.name&&samePrincipal(t.principal,e.principal)))}function getSupersededAuthorizationChallenges(e,t){return(getPendingAuthorization(e)?.challenges??[]).filter(e=>t.some(t=>e.name===t.name&&samePrincipal(e.principal,t.principal)))}function samePrincipal(e,t){return e===void 0||t===void 0?e===t:e.type===`app`||t.type===`app`?e.type===t.type:e.id===t.id&&e.issuer===t.issuer}function clearPendingAuthorization(e,t){if(e===void 0||e[PENDING_AUTHORIZATION_KEY]===void 0)return e;if(t!==void 0){if(t.length===0)return e;let n=getPendingAuthorization(e);if(n!==void 0){let r=new Set(t),i=n.challenges.filter(e=>!r.has(authorizationAttemptKey(e)));if(i.length>0)return{...e,[PENDING_AUTHORIZATION_KEY]:pendingAuthorizationValue(n,i)}}}let n={...e};return delete n[PENDING_AUTHORIZATION_KEY],Object.keys(n).length>0?n:void 0}function pendingAuthorizationValue(e,t){let n=Object.fromEntries(t.flatMap(t=>{let n=authorizationAttemptKey(t),r=e.activityRootTurnIds?.[n];return r===void 0?[]:[[n,r]]}));return{...Object.keys(n).length===0?{}:{activityRootTurnIds:n},challenges:t}}function authorizationAttemptKey(e){return e.attemptId??e.candidateId??e.name}function getPendingAuthorization(e){if(!e)return;let t=e[PENDING_AUTHORIZATION_KEY];if(typeof t==`object`&&t)return t}function hasPendingAuthorization(e){return getPendingAuthorization(e)!==void 0}export{AuthorizationHookKey,CallbackBaseUrlKey,PendingAuthorizationResultKey,authHookToken,authorizationPendingAsJsonObject,authorizationPendingModelText,clearPendingAuthorization,consumeAuthorizationResult,createAuthorizationAttempt,getAuthorizationResult,getAuthorizationResults,getHookUrl,getPendingAuthorization,getSupersededAuthorizationChallenges,hasPendingAuthorization,isAuthorizationPendingModelOutput,isAuthorizationSignal,isPendingAuthorizationToolOutput,modelFacingAuthorizationOutput,requestAuthorization,resolveActiveAuthorizationChallenges,setPendingAuthorization};
+import{sessionCommandHookToken,sessionInboxHookToken}from"#execution/session-inbox/address.js";import{loadContext}from"#context/container.js";import{SessionIdKey}from"#context/keys.js";import{createEveConnectionCallbackRoutePath}from"#protocol/routes.js";import{ContextKey}from"#context/key.js";import{createWorkflowCallbackUrl}from"#execution/workflow-callback-url.js";import{createUlid}from"#shared/ulid.js";const AUTHORIZATION_BRAND=`__eveAuthorization`,AUTHORIZATION_PENDING_BRAND=`__eveAuthorizationPending`;function requestAuthorization(e){return{[AUTHORIZATION_BRAND]:!0,challenges:e}}function getAuthorizationResult(e){let t=loadContext().get(PendingAuthorizationResultKey);if(t&&t.length!==0)return e===void 0?t[0]:t.find(t=>t.name===e)}function getAuthorizationResults(){return loadContext().get(PendingAuthorizationResultKey)??[]}function consumeAuthorizationResult(e,t){let n=loadContext(),r=n.get(PendingAuthorizationResultKey);if(!r||r.length===0)return;let i=r.findIndex(n=>n.name===e&&n.instanceId===t);if(i===-1&&t!==void 0&&r.some(t=>t.name===e&&t.instanceId!==void 0))throw Error(`Authorization for "${e}" cannot complete because its resolved connection changed while sign-in was pending. Start sign-in again.`);if(i===-1)return;let a=r[i],o=r.filter((e,t)=>t!==i);return n.delete(PendingAuthorizationResultKey),o.length>0&&n.set(PendingAuthorizationResultKey,o),a}function getHookUrl(e,t){let n=loadContext(),r=n.get(SessionIdKey),i=n.get(CallbackBaseUrlKey),a=n.get(AuthorizationHookKey)??(r?authHookToken(r):void 0);if(a&&i)return createWorkflowCallbackUrl(i,createEveConnectionCallbackRoutePath(e,t,a))}function createAuthorizationAttempt(e){let t=createUlid(),n=getHookUrl(e,t);return n===void 0?void 0:{attemptId:t,hookUrl:n}}function isAuthorizationSignal(e){return typeof e!=`object`||!e?!1:e[AUTHORIZATION_BRAND]===!0}function isAuthorizationPendingModelOutput(e){return typeof e!=`object`||!e?!1:e[AUTHORIZATION_PENDING_BRAND]===!0}function authorizationPendingAsJsonObject(e){return{[AUTHORIZATION_PENDING_BRAND]:!0,connections:[...e.connections]}}function modelFacingAuthorizationOutput(e){return authorizationPendingAsJsonObject({connections:e.challenges.map(e=>e.name)})}function authorizationPendingModelText(e){return e.length===0?`Authorization required. Waiting for the user to sign in.`:e.length===1?`Authorization required for ${e[0]}. Waiting for the user to sign in.`:`Authorization required for ${e.join(`, `)}. Waiting for the user to sign in.`}function isPendingAuthorizationToolOutput(e){return isAuthorizationPendingModelOutput(e)||isAuthorizationSignal(e)}function authHookToken(e){return sessionInboxHookToken(sessionCommandHookToken(e))}const PendingAuthorizationResultKey=new ContextKey(`eve.pendingAuthorizationResult`),CallbackBaseUrlKey=new ContextKey(`eve.callbackBaseUrl`),AuthorizationHookKey=new ContextKey(`eve.authorizationHook`),PENDING_AUTHORIZATION_KEY=`eve.runtime.pendingAuthorization`;function setPendingAuthorization(e,t){let n=resolveActiveAuthorizationChallenges(t.challenges),r=getPendingAuthorization(e)?.challenges??[],i=getSupersededAuthorizationChallenges(e,n);return{...e,[PENDING_AUTHORIZATION_KEY]:{challenges:[...r.filter(e=>!i.includes(e)),...n]}}}function resolveActiveAuthorizationChallenges(e){return e.filter((t,n)=>!e.slice(n+1).some(e=>sameSignIn(t,e)))}function getSupersededAuthorizationChallenges(e,t){return(getPendingAuthorization(e)?.challenges??[]).filter(e=>t.some(t=>sameSignIn(e,t)))}function sameSignIn(e,t){let n=e.grant!==void 0&&e.grant===t.grant&&e.candidateId===t.candidateId;return(e.name===t.name||n)&&samePrincipal(e.principal,t.principal)}function samePrincipal(e,t){return e===void 0||t===void 0?e===t:e.type===`app`||t.type===`app`?e.type===t.type:e.id===t.id&&e.issuer===t.issuer}function clearPendingAuthorization(e,t){if(e===void 0||e[PENDING_AUTHORIZATION_KEY]===void 0)return e;if(t!==void 0){if(t.length===0)return e;let n=getPendingAuthorization(e);if(n!==void 0){let r=new Set(t),i=n.challenges.filter(e=>!r.has(authorizationAttemptKey(e)));if(i.length>0)return{...e,[PENDING_AUTHORIZATION_KEY]:{challenges:i}}}}let n={...e};return delete n[PENDING_AUTHORIZATION_KEY],Object.keys(n).length>0?n:void 0}function authorizationAttemptKey(e){return e.attemptId??e.candidateId??e.name}function getPendingAuthorization(e){if(!e)return;let t=e[PENDING_AUTHORIZATION_KEY];if(typeof t==`object`&&t)return t}function hasPendingAuthorization(e){return getPendingAuthorization(e)!==void 0}export{AuthorizationHookKey,CallbackBaseUrlKey,PendingAuthorizationResultKey,authHookToken,authorizationPendingAsJsonObject,authorizationPendingModelText,clearPendingAuthorization,consumeAuthorizationResult,createAuthorizationAttempt,getAuthorizationResult,getAuthorizationResults,getHookUrl,getPendingAuthorization,getSupersededAuthorizationChallenges,hasPendingAuthorization,isAuthorizationPendingModelOutput,isAuthorizationSignal,isPendingAuthorizationToolOutput,modelFacingAuthorizationOutput,requestAuthorization,resolveActiveAuthorizationChallenges,setPendingAuthorization};

package/dist/src/harness/cancelled-turn-emission.d.ts

@@ -1,4 +1,5 @@
 import type { HarnessEmitFn } from "#harness/types.js";
+import type { TokenUsage } from "#shared/token-usage.js";
 import type { HarnessEmissionState } from "#harness/emission.js";
 /**
  * Emits the cancelled-turn epilogue: `turn.cancelled` → `session.waiting`
@@ -8,4 +9,4 @@ import type { HarnessEmissionState } from "#harness/emission.js";
  * cancelled turn's preamble — the turn id is reconstructed via
  * {@link activeTurnId} and `sessionStarted` is stamped `true`.
  */
-export declare function emitCancelledTurn(emitFn: HarnessEmitFn, state: HarnessEmissionState): Promise<HarnessEmissionState>;
+export declare function emitCancelledTurn(emitFn: HarnessEmitFn, state: HarnessEmissionState, usage: TokenUsage): Promise<HarnessEmissionState>;

package/dist/src/harness/cancelled-turn-emission.js

@@ -1 +1 @@
-import{createSessionWaitingEvent,createTurnCancelledEvent}from"#protocol/message.js";import{activeTurnId}from"#harness/active-turn-id.js";async function emitCancelledTurn(e,t){return await e(createTurnCancelledEvent({sequence:t.sequence,turnId:activeTurnId(t)})),await e(createSessionWaitingEvent()),{sessionStarted:!0,sequence:t.sequence+1,stepIndex:0,turnId:``}}export{emitCancelledTurn};
+import{createSessionWaitingEvent,createTurnCancelledEvent}from"#protocol/message.js";import{activeTurnId}from"#harness/active-turn-id.js";async function emitCancelledTurn(e,t,n){return await e(createTurnCancelledEvent({sequence:t.sequence,turnId:activeTurnId(t)})),await e(createSessionWaitingEvent(n)),{sessionStarted:!0,sequence:t.sequence+1,stepIndex:0,turnId:``}}export{emitCancelledTurn};