theokit 0.30.0 → 0.30.2

package/dist/server/index.js

@@ -1,3 +1,9 @@
+import {
+  StorageManager,
+  getStorageManager,
+  useDatabase,
+  useUnstorage
+} from "../chunk-ESC54TAK.js";
 import {
   BodyTooLargeError,
   DEFAULT_MAX_BODY_BYTES,
@@ -6,6 +12,11 @@ import {
   readRawBody,
   timingSafeEqual
 } from "../chunk-UUFYP2UM.js";
+import {
+  MAX_ERROR_HTML_BYTES,
+  loadCustomErrorPages,
+  serveStaticFile
+} from "../chunk-OPLICDUB.js";
 import {
   DuplicateJobNameError,
   InMemoryJobBackend,
@@ -42,30 +53,60 @@ import {
 } from "../chunk-NM4WF3XD.js";
 import "../chunk-E3JH6YUM.js";
 import "../chunk-JHEAWR3L.js";
-import {
-  StorageManager,
-  getStorageManager,
-  useDatabase,
-  useUnstorage
-} from "../chunk-ESC54TAK.js";
 import {
   _resetEnvCache,
-  buildResourceDescriptors,
-  defineAppResource,
   executeWebRequest,
-  extractAppResources,
-  handleMcpJsonRpc,
   jsonTransformer,
   loadEnv,
-  readAppResource,
   resolveTransformer,
   superjsonTransformer,
   validateRouteInput
-} from "../chunk-UYFZ6DDW.js";
+} from "../chunk-4MTCKE5I.js";
+import {
+  ActionError,
+  ActionInputError,
+  BATCH_PATH,
+  BatchPathConflictError,
+  STRIPPED_HEADERS,
+  TRACE_HEADER,
+  TRACE_PARENT_HEADER,
+  _resetMiddlewareCacheForTests,
+  createCorsHandler,
+  createCorsWebHandler,
+  executeAction,
+  executeRoute,
+  extractTraceId,
+  extractTraceIdFromRequest,
+  extractUniversalIssues,
+  handleBatchRequest,
+  handleRequestError,
+  handleWebRequestError,
+  isActionError,
+  isInputError,
+  matchesOrigin,
+  parseTraceparent,
+  runMiddlewareAndContext,
+  sendError,
+  sendJson
+} from "../chunk-TGTNRUH3.js";
+import {
+  DuplicateContextKeyError,
+  createOutbox,
+  createOutboxDispatcher,
+  createQueueClient
+} from "../chunk-GY5Q27BJ.js";
 import {
   findSuggestion,
   levenshtein
 } from "../chunk-5QW7IQQU.js";
+import {
+  FileTooLargeError,
+  _resetWarnOnceForTests,
+  createLogger,
+  logRequest,
+  parseRequestBody,
+  warnOnce
+} from "../chunk-WFNLNIJX.js";
 import {
   DuplicateDecorationError,
   DuplicatePluginError,
@@ -95,6 +136,9 @@ import {
   writeManifest
 } from "../chunk-RKDH4DWL.js";
 import "../chunk-WSJKACWB.js";
+import {
+  scanMiddlewares
+} from "../chunk-ZEGYW52B.js";
 import {
   CSP_REPORT_PATH,
   CSRF_READINESS_PATH,
@@ -111,6 +155,49 @@ import {
   normalizeLegacy,
   normalizeNew
 } from "../chunk-JBCHWRKF.js";
+import {
+  CSRF_WARN_CODE,
+  CSRF_WARN_DOCS_URL,
+  enforceCsrf,
+  matchDisallowed,
+  validateCsrf,
+  validateCsrfRequest
+} from "../chunk-TSLSIRBR.js";
+import {
+  JsonStdoutSink,
+  createNoOpLogger,
+  safeAudit
+} from "../chunk-UD3LFGDL.js";
+import {
+  envelopeCodeToStatus
+} from "../chunk-X32XEJXR.js";
+import {
+  NotFoundError,
+  TheoError,
+  fromUnknown,
+  serverErrorToEnvelope
+} from "../chunk-UVXB2ER7.js";
+import {
+  CodeModePermissionDeniedError,
+  InProcessApprovalRequiredError,
+  NodeAcpTransport,
+  createACPTool,
+  createCodeMode,
+  createVendorAgentTool,
+  createWorkflowTool,
+  handleChannelWebhook,
+  handleMcpStdioLine,
+  isChannelPath,
+  parseChannelPath,
+  serveMcpStdio,
+  streamAgentTurnInProcess
+} from "../chunk-SPFMJAFW.js";
+import {
+  buildResourceDescriptors,
+  defineAppResource,
+  extractAppResources,
+  readAppResource
+} from "../chunk-HZ6USUHC.js";
 import {
   AuthRequiredError,
   _resetKeyCacheForTests,
@@ -137,6 +224,16 @@ import {
   verifyOAuthState,
   verifyTotp
 } from "../chunk-SJIRP73B.js";
+import {
+  appendCookieToHeaders,
+  appendDeleteCookieToHeaders,
+  deleteCookie,
+  getCookie,
+  getCookieFromRequest,
+  parseCookieHeader,
+  serializeCookie,
+  setCookie
+} from "../chunk-ZJQ4O76G.js";
 import {
   generateNonce
 } from "../chunk-C3ZZ56YZ.js";
@@ -167,8 +264,6 @@ import "../chunk-7MQOHNHE.js";
 import "../chunk-X2VVCJ4V.js";
 import {
   action,
-  applyTransform,
-  defineAgentTool,
   defineChannel,
   defineWebChannel,
   middleware,
@@ -177,7 +272,7 @@ import {
   tool,
   uiMessageStreamResponse,
   websocket
-} from "../chunk-DMGVH3VG.js";
+} from "../chunk-V3X5FWJA.js";
 import {
   HEALTH_PATH,
   READY_PATH,
@@ -186,86 +281,8 @@ import {
   serveReservedRoute
 } from "../chunk-V3LJN2GS.js";
 import {
-  MAX_ERROR_HTML_BYTES,
-  loadCustomErrorPages,
-  serveStaticFile
-} from "../chunk-OPLICDUB.js";
-import {
-  ActionError,
-  ActionInputError,
-  BATCH_PATH,
-  BatchPathConflictError,
-  STRIPPED_HEADERS,
-  TRACE_HEADER,
-  TRACE_PARENT_HEADER,
-  _resetMiddlewareCacheForTests,
-  createCorsHandler,
-  createCorsWebHandler,
-  executeAction,
-  executeRoute,
-  extractTraceId,
-  extractTraceIdFromRequest,
-  extractUniversalIssues,
-  handleBatchRequest,
-  handleRequestError,
-  handleWebRequestError,
-  isActionError,
-  isInputError,
-  matchesOrigin,
-  parseTraceparent,
-  runMiddlewareAndContext,
-  sendError,
-  sendJson
-} from "../chunk-TGTNRUH3.js";
-import {
-  DuplicateContextKeyError,
-  createOutbox,
-  createOutboxDispatcher,
-  createQueueClient
-} from "../chunk-GY5Q27BJ.js";
-import {
-  FileTooLargeError,
-  _resetWarnOnceForTests,
-  createLogger,
-  logRequest,
-  parseRequestBody,
-  warnOnce
-} from "../chunk-WFNLNIJX.js";
-import {
-  scanMiddlewares
-} from "../chunk-ZEGYW52B.js";
-import {
-  CSRF_WARN_CODE,
-  CSRF_WARN_DOCS_URL,
-  enforceCsrf,
-  matchDisallowed,
-  validateCsrf,
-  validateCsrfRequest
-} from "../chunk-TSLSIRBR.js";
-import {
-  JsonStdoutSink,
-  createNoOpLogger,
-  safeAudit
-} from "../chunk-UD3LFGDL.js";
-import {
-  envelopeCodeToStatus
-} from "../chunk-X32XEJXR.js";
-import {
-  NotFoundError,
-  TheoError,
-  fromUnknown,
-  serverErrorToEnvelope
-} from "../chunk-UVXB2ER7.js";
-import {
-  appendCookieToHeaders,
-  appendDeleteCookieToHeaders,
-  deleteCookie,
-  getCookie,
-  getCookieFromRequest,
-  parseCookieHeader,
-  serializeCookie,
-  setCookie
-} from "../chunk-ZJQ4O76G.js";
+  applyTransform
+} from "../chunk-63BUBV5L.js";
 import "../chunk-DGUM43GV.js";
 
 // src/server/openapi/serve-docs.ts
@@ -1100,309 +1117,6 @@ function resolveRouteRule(path, compiled) {
   return void 0;
 }
 
-// src/server/agent/workflow-tool.ts
-import { z } from "zod";
-var FAILURE_STATUSES = /* @__PURE__ */ new Set(["failed", "error", "cancelled", "canceled"]);
-function createWorkflowTool(workflow, config) {
-  const runFn = workflow?.run;
-  if (typeof runFn !== "function") {
-    throw new Error(
-      "createWorkflowTool: the SDK does not expose a Workflow (expected an object with a run() method). Pass a `Workflow.create(...).\u2026build()` instance from @theokit/sdk."
-    );
-  }
-  const inputSchema = config.inputSchema ?? z.looseObject({});
-  return defineAgentTool({
-    name: config.name,
-    description: config.description,
-    inputSchema,
-    handler: async (input) => {
-      const run = await workflow.run(input);
-      if (FAILURE_STATUSES.has(run.status)) {
-        throw new Error(
-          `createWorkflowTool(${JSON.stringify(config.name)}): workflow run ${run.runId ? `'${run.runId}' ` : ""}failed with status '${run.status}'.`
-        );
-      }
-      return typeof run.output === "string" ? run.output : JSON.stringify(run.output);
-    }
-  });
-}
-
-// src/server/agent/acp-tool.ts
-import { spawn } from "child_process";
-import { AcpClient } from "@theokit/agents";
-import { encodeAcpMessage } from "@theokit/agents";
-var NodeAcpTransport = class {
-  // stdin=pipe, stdout=pipe, stderr=inherit → the third stream is null.
-  proc;
-  constructor(command, args = [], cwd) {
-    this.proc = spawn(command, args, { cwd, stdio: ["pipe", "pipe", "inherit"] });
-  }
-  send(line) {
-    this.proc.stdin.write(line);
-  }
-  subscribe(onData) {
-    this.proc.stdout.on("data", (buf) => {
-      onData(buf.toString("utf8"));
-    });
-  }
-  close() {
-    this.proc.kill();
-  }
-};
-function defaultTransport(config) {
-  return new NodeAcpTransport(config.command, config.args, config.cwd);
-}
-function createACPTool(config) {
-  if (typeof config.onPermissionRequest !== "function") {
-    throw new Error("[theokit] createACPTool requires onPermissionRequest (security by default \u2014 no default-allow)");
-  }
-  const makeTransport = config.transportFactory ?? defaultTransport;
-  return {
-    name: config.name,
-    description: config.description,
-    inputSchema: {
-      type: "object",
-      properties: { message: { type: "string", description: "The task/prompt for the coding agent." } },
-      required: ["message"]
-    },
-    handler: async (input) => {
-      const message = typeof input.message === "string" ? input.message : "";
-      const client = new AcpClient(makeTransport(config));
-      client.onRequest("session/request_permission", (params) => config.onPermissionRequest(params));
-      const result = await client.request("session/prompt", { message });
-      return result.text ?? "";
-    }
-  };
-}
-
-// src/server/agent/vendor-agent-tool.ts
-function createVendorAgentTool(config) {
-  if (!config.vendor || config.vendor.length === 0) {
-    throw new Error('createVendorAgentTool: `vendor` is required (e.g. "claude", "openai").');
-  }
-  const queryFn = config.client?.query;
-  if (typeof queryFn !== "function") {
-    throw new Error(
-      `createVendorAgentTool(${JSON.stringify(config.vendor)}): the vendor client does not expose a query() method. Pass the vendor SDK client (or a @theokit/agent-* wrapper).`
-    );
-  }
-  const name = config.name ?? `${config.vendor}_agent`;
-  const description = config.description ?? `Delegate a task to the ${config.vendor} agent and return its answer.`;
-  return {
-    name,
-    description,
-    inputSchema: {
-      type: "object",
-      properties: {
-        prompt: { type: "string", description: "The task/prompt for the vendor agent." },
-        resumeSessionId: {
-          type: "string",
-          description: "Optional vendor session id to resume a prior conversation."
-        }
-      },
-      required: ["prompt"]
-    },
-    handler: async (input) => {
-      const prompt = typeof input.prompt === "string" ? input.prompt : "";
-      const resumeSessionId = typeof input.resumeSessionId === "string" ? input.resumeSessionId : void 0;
-      const result = await config.client.query(
-        prompt,
-        resumeSessionId !== void 0 ? { resumeSessionId } : void 0
-      );
-      if (result.sessionId !== void 0 && config.onSession) config.onSession(result.sessionId);
-      return result.text;
-    }
-  };
-}
-
-// src/server/agent/code-mode.ts
-var CodeModePermissionDeniedError = class extends Error {
-  constructor(tool2, reason) {
-    const suffix = reason ? `: ${reason}` : "";
-    super(`code-mode: tool '${tool2}' denied by permission gate${suffix}`);
-    this.name = "CodeModePermissionDeniedError";
-  }
-};
-function describeToolInput(inputSchema) {
-  const props = inputSchema.properties ?? {};
-  const required = new Set(inputSchema.required ?? []);
-  const entries = Object.entries(props).map(([key, spec]) => {
-    const type = typeof spec.type === "string" ? spec.type : "unknown";
-    return `${key}${required.has(key) ? "" : "?"}: ${type}`;
-  });
-  return entries.length > 0 ? `{ ${entries.join(", ")} }` : "{}";
-}
-function generateCodeModeInstructions(tools, toolName) {
-  const calls = tools.map((t) => `- \`await api.${t.name}(${describeToolInput(t.inputSchema)})\` \u2014 ${t.description}`).join("\n");
-  return [
-    `The \`${toolName}\` tool runs your code in a sandbox. Your code may call ONLY these functions (each bridges to a real, validated tool on the host):`,
-    calls,
-    "Write an async function body that composes these calls and return exactly ONE structured result. Prefer `Promise.all` for independent calls; do arithmetic and aggregation in code, not in prose."
-  ].join("\n\n");
-}
-function createCodeMode(config) {
-  if (typeof config.onPermissionRequest !== "function") {
-    throw new Error(
-      "createCodeMode requires onPermissionRequest (security by default \u2014 no default-allow for any tool)."
-    );
-  }
-  const sandboxRun = config.sandbox?.run;
-  if (typeof sandboxRun !== "function") {
-    throw new Error(
-      "createCodeMode requires an injected `sandbox` with a run() method (a vetted isolation boundary \u2014 never node:vm)."
-    );
-  }
-  if (config.tools.length === 0) {
-    throw new Error(
-      "createCodeMode requires a non-empty tools[] \u2014 the restricted API would be empty."
-    );
-  }
-  const api = {};
-  for (const tool3 of config.tools) {
-    api[tool3.name] = async (args) => {
-      const decision = await config.onPermissionRequest({ tool: tool3.name, args });
-      if (!decision.granted) throw new CodeModePermissionDeniedError(tool3.name, decision.reason);
-      return tool3.handler(args);
-    };
-  }
-  const name = config.name ?? "run_code";
-  const tool2 = {
-    name,
-    description: config.description ?? "Run code that composes the available tools. Only the declared tools are callable.",
-    inputSchema: {
-      type: "object",
-      properties: { code: { type: "string", description: "The code to run in the sandbox." } },
-      required: ["code"]
-    },
-    handler: async (input) => {
-      const code = typeof input.code === "string" ? input.code : "";
-      const result = await config.sandbox.run(code, api);
-      return typeof result === "string" ? result : JSON.stringify(result);
-    }
-  };
-  return { tool: tool2, instructions: generateCodeModeInstructions(config.tools, name) };
-}
-
-// src/server/agent/channel-webhook.ts
-var CHANNEL_PATH = /^\/api\/agents\/([^/]+)\/channels\/([^/]+)\/webhook$/;
-function parseChannelPath(urlPath) {
-  const match = CHANNEL_PATH.exec(urlPath);
-  if (!match) return null;
-  return { agent: decodeURIComponent(match[1]), platform: decodeURIComponent(match[2]) };
-}
-function isChannelPath(urlPath) {
-  return CHANNEL_PATH.test(urlPath);
-}
-function jsonError(status, code, message) {
-  return new Response(JSON.stringify({ error: { code, message } }), {
-    status,
-    headers: { "content-type": "application/json" }
-  });
-}
-async function handleChannelWebhook(request, urlPath, config) {
-  const parsed = parseChannelPath(urlPath);
-  if (parsed === null) {
-    return jsonError(
-      400,
-      "BAD_REQUEST",
-      "Path must be /api/agents/<name>/channels/<platform>/webhook."
-    );
-  }
-  if (!Object.hasOwn(config.validators, parsed.platform)) {
-    return jsonError(
-      404,
-      "UNKNOWN_PLATFORM",
-      `No validator configured for platform '${parsed.platform}'.`
-    );
-  }
-  const verify = config.validators[parsed.platform];
-  const verifyResult = await verify(request.clone());
-  if (!verifyResult.ok) {
-    return jsonError(
-      401,
-      "INVALID_SIGNATURE",
-      `Signature validation failed: ${verifyResult.reason}`
-    );
-  }
-  let payload;
-  try {
-    payload = await request.json();
-  } catch {
-    return jsonError(400, "BAD_REQUEST", "Request body must be JSON.");
-  }
-  await config.onMessage({ agent: parsed.agent, platform: parsed.platform, payload });
-  return new Response(JSON.stringify({ ok: true }), {
-    status: 200,
-    headers: { "content-type": "application/json" }
-  });
-}
-
-// src/server/agent/stream-agent-turn-in-process.ts
-import {
-  compileAgentModule,
-  resolveEnabledSkills,
-  streamAgentUIMessages
-} from "@theokit/agents";
-var InProcessApprovalRequiredError = class extends Error {
-  constructor(toolNames) {
-    super(
-      `Agent has HITL-gated tool(s) [${toolNames.join(", ")}] but no \`awaitApproval\` resolver was supplied to streamAgentTurnInProcess. In-process runs must resolve approvals inline \u2014 pass awaitApproval, or remove the gate. Refused (fail-closed).`
-    );
-    this.name = "InProcessApprovalRequiredError";
-  }
-};
-function streamAgentTurnInProcess(mod, apiKey, input, deps = { stream: streamAgentUIMessages }) {
-  const compiled = compileAgentModule(mod, input.source);
-  const gated = compiled.hitl;
-  if (gated && gated.size > 0 && !input.awaitApproval) {
-    throw new InProcessApprovalRequiredError([...gated.keys()]);
-  }
-  const resolve2 = input.awaitApproval;
-  const hitl = gated && gated.size > 0 && resolve2 ? {
-    gated,
-    awaitApproval: (approvalId, opts, toolName) => resolve2({ approvalId, toolName, opts })
-  } : void 0;
-  const sessionId = input.sessionId ?? crypto.randomUUID();
-  return (async function* () {
-    if (compiled.skillsResolver) {
-      const enabled = await resolveEnabledSkills(compiled.skillsResolver, compiled.runContext ?? {});
-      if (enabled !== void 0) compiled.skills = { enabled, autoInject: true };
-    }
-    yield* deps.stream(compiled, apiKey, {
-      message: input.message,
-      sessionId,
-      hitl,
-      signal: input.signal
-    });
-  })();
-}
-
-// src/server/agent/mcp-stdio.ts
-async function handleMcpStdioLine(line, mod, name, appResources = []) {
-  const trimmed = line.trim();
-  if (trimmed.length === 0) return null;
-  let body;
-  try {
-    body = JSON.parse(trimmed);
-  } catch {
-    return JSON.stringify({
-      jsonrpc: "2.0",
-      id: null,
-      error: { code: -32700, message: "Parse error" }
-    });
-  }
-  const response = await handleMcpJsonRpc(mod, name, body, appResources);
-  const payload = await response.json();
-  return JSON.stringify(payload);
-}
-async function serveMcpStdio(mod, name, appResources, streams) {
-  for await (const line of streams.lines) {
-    const out = await handleMcpStdioLine(line, mod, name, appResources);
-    if (out !== null) streams.write(`${out}
-`);
-  }
-}
-
 // src/server/serialization.ts
 import superjson from "superjson";
 function serializeResponse(data) {