@assemblyline-agents/node 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpenEve contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,19 @@
+# @assemblyline-agents/node
+
+The Node.js host for the Assembly Line runtime.
+
+It wires the `@assemblyline-agents/runtime` engine to a Node HTTP server: loading compiled runtime bundles, resolving state/blob/sandbox adapters from provider configuration, routing channel and API requests, enforcing auth and rate-limit policies, streaming run output over HTTP, and managing host lifecycle. Authenticated `GET /usage` exposes filtered records or exact rollups, while `POST /usage/reconcile` imports OpenAI/OpenRouter control totals and retries pending receipts using runtime-held credentials. This is the process that actually serves a deployed Assembly Line agent in Node environments (containers, Fly.io, Railway, bare servers).
+
+## Install
+
+```sh
+npm install @assemblyline-agents/node
+```
+
+## Part of Assembly Line
+
+This package is part of [Assembly Line](https://github.com/jasonbadeaux/openeve), a vendor-neutral, filesystem-first framework for durable AI agents. See the developer documentation in [docs/developers/](https://github.com/jasonbadeaux/openeve/tree/main/docs/developers) for setup, agent authoring, and deployment guides.
+
+## License
+
+MIT

package/dist/adapters.d.ts

@@ -0,0 +1,17 @@
+import { type BlobAdapter, type ConnectionAuthorizationSessionStore, type ConnectionDefinitionStore, type ConnectionGrantStore, type OpenEveRuntime, type RunTimeline, type RuntimeOptions, type SandboxAdapter, type ScheduleStore, type SkillStore, type StateAdapter } from "@assemblyline-agents/runtime";
+import { type ProviderResolution } from "./provider-resolver.js";
+export declare function loadRunTimeline(runtime: OpenEveRuntime, runId: string): Promise<RunTimeline | undefined>;
+export declare function createConnectionStores(_options: RuntimeOptions, artifactRoot: string, env: NodeJS.ProcessEnv, state: StateAdapter, devMode: boolean): {
+    grantStore: ConnectionGrantStore;
+    authorizationSessionStore: ConnectionAuthorizationSessionStore;
+};
+export declare function createSelfImprovementStores(artifactRoot: string, env: NodeJS.ProcessEnv, state: StateAdapter): {
+    skillStore: SkillStore;
+    scheduleStore: ScheduleStore;
+    connectionDefinitionStore: ConnectionDefinitionStore;
+};
+export declare function providerResolution(options: RuntimeOptions, artifactRoot: string, env: NodeJS.ProcessEnv): ProviderResolution;
+export declare function createStateAdapter(options: RuntimeOptions, artifactRoot: string, env: NodeJS.ProcessEnv): Promise<StateAdapter>;
+export declare function createBlobAdapter(options: RuntimeOptions, artifactRoot: string, env: NodeJS.ProcessEnv): Promise<BlobAdapter>;
+export declare function createSandboxAdapter(options: RuntimeOptions, artifactRoot: string, env: NodeJS.ProcessEnv): Promise<SandboxAdapter>;
+//# sourceMappingURL=adapters.d.ts.map

package/dist/adapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,WAAW,EAChB,KAAK,mCAAmC,EACxC,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAmB,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAKlF,wBAAsB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAO9G;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,OAAO,GACf;IACD,UAAU,EAAE,oBAAoB,CAAC;IACjC,yBAAyB,EAAE,mCAAmC,CAAC;CAChE,CAeA;AAkBD,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,KAAK,EAAE,YAAY,GAClB;IACD,UAAU,EAAE,UAAU,CAAC;IACvB,aAAa,EAAE,aAAa,CAAC;IAC7B,yBAAyB,EAAE,yBAAyB,CAAC;CACtD,CAeA;AAUD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,CAQ5H;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAMrI;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAMnI;AAED,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAWzI"}

package/dist/adapters.js

@@ -0,0 +1,122 @@
+import { join } from "node:path";
+import { adapter, isSensitiveSandboxEnvName } from "@assemblyline-agents/core";
+import { FileConnectionDefinitionStore, FileScheduleStore, FileSkillStore, FileStateAdapter, FileConnectionAuthorizationSessionStore, FileConnectionGrantStore, LocalBlobAdapter, LocalSandboxAdapter } from "@assemblyline-agents/runtime";
+import { resolveProvider } from "./provider-resolver.js";
+const LOCAL_DEV_CONNECTION_STORE_SECRET = "openeve-local-dev-connection-secret";
+const MIN_PRODUCTION_CONNECTION_STORE_SECRET_LENGTH = 32;
+export async function loadRunTimeline(runtime, runId) {
+    try {
+        return await runtime.replay(runId);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === `Run not found: ${runId}`)
+            return undefined;
+        throw error;
+    }
+}
+export function createConnectionStores(_options, artifactRoot, env, state, devMode) {
+    if (isConnectionGrantStore(state) && isConnectionAuthorizationSessionStore(state)) {
+        return {
+            grantStore: state,
+            authorizationSessionStore: state
+        };
+    }
+    const secret = resolveConnectionStoreSecret(env, devMode);
+    return {
+        grantStore: new FileConnectionGrantStore(env.OPENEVE_CONNECTION_GRANTS_FILE ?? join(artifactRoot, "connection-grants.enc.json"), secret),
+        authorizationSessionStore: new FileConnectionAuthorizationSessionStore(env.OPENEVE_CONNECTION_AUTH_SESSIONS_FILE ?? join(artifactRoot, "connection-auth-sessions.enc.json"), secret)
+    };
+}
+function resolveConnectionStoreSecret(env, devMode) {
+    const rawSecret = env.OPENEVE_CONNECTION_STORE_SECRET ?? env.OPENEVE_SECRET;
+    const secret = rawSecret?.trim();
+    if (!secret) {
+        if (devMode)
+            return LOCAL_DEV_CONNECTION_STORE_SECRET;
+        throw new Error("File-backed connection credential stores require OPENEVE_CONNECTION_STORE_SECRET or OPENEVE_SECRET outside dev mode. Use Postgres state or configure a secret with at least 32 characters.");
+    }
+    if (!devMode && secret === LOCAL_DEV_CONNECTION_STORE_SECRET) {
+        throw new Error("File-backed connection credential stores cannot use the local development secret outside dev mode.");
+    }
+    if (!devMode && secret.length < MIN_PRODUCTION_CONNECTION_STORE_SECRET_LENGTH) {
+        throw new Error("File-backed connection credential store secrets must be at least 32 characters outside dev mode.");
+    }
+    return secret;
+}
+export function createSelfImprovementStores(artifactRoot, env, state) {
+    // Postgres exposes durable store instances sharing its client; otherwise fall
+    // back to local JSON-file-backed stores under the artifact root.
+    const provider = state;
+    return {
+        skillStore: provider.skillStore ?? new FileSkillStore(env.OPENEVE_SKILLS_FILE ?? join(artifactRoot, "skills-store.json")),
+        scheduleStore: provider.scheduleStore ?? new FileScheduleStore(env.OPENEVE_SCHEDULES_FILE ?? join(artifactRoot, "dynamic-schedules.json")),
+        connectionDefinitionStore: provider.connectionDefinitionStore ??
+            new FileConnectionDefinitionStore(env.OPENEVE_CONNECTION_DEFINITIONS_FILE ?? join(artifactRoot, "connection-definitions.json"))
+    };
+}
+function isConnectionGrantStore(value) {
+    return Boolean(value && typeof value === "object" && "getGrant" in value && "saveGrant" in value && "deleteGrant" in value);
+}
+function isConnectionAuthorizationSessionStore(value) {
+    return Boolean(value && typeof value === "object" && "getSessionByState" in value && "findPendingSession" in value);
+}
+export function providerResolution(options, artifactRoot, env) {
+    return {
+        env,
+        fetch: options.fetch ?? fetch,
+        manifest: options.manifest,
+        artifactRoot,
+        devMode: options.devMode === true
+    };
+}
+export async function createStateAdapter(options, artifactRoot, env) {
+    const definition = options.manifest.gateway.state ?? adapter("local");
+    if (definition.kind === "local") {
+        return new FileStateAdapter(env.OPENEVE_STATE_FILE ?? join(artifactRoot, "runtime-state.json"));
+    }
+    return resolveProvider("state", definition, providerResolution(options, artifactRoot, env));
+}
+export async function createBlobAdapter(options, artifactRoot, env) {
+    const definition = options.manifest.gateway.blob ?? adapter("local");
+    if (definition.kind === "local") {
+        return new LocalBlobAdapter(env.OPENEVE_BLOB_ROOT ?? join(artifactRoot, "blobs"));
+    }
+    return resolveProvider("blob", definition, providerResolution(options, artifactRoot, env));
+}
+export async function createSandboxAdapter(options, artifactRoot, env) {
+    const definition = options.manifest.gateway.sandbox ?? adapter("local");
+    if (definition.kind === "local") {
+        if (options.devMode !== true && env.OPENEVE_ALLOW_LOCAL_SANDBOX_IN_PRODUCTION !== "true") {
+            throw new Error("Production OpenEve Node runtime refuses the local sandbox. Configure a network-confined sandbox adapter or set OPENEVE_ALLOW_LOCAL_SANDBOX_IN_PRODUCTION=true to acknowledge the risk.");
+        }
+        return new LocalSandboxAdapter(env.OPENEVE_SANDBOX_ROOT ?? join(artifactRoot, "sandbox"));
+    }
+    const sandbox = options.manifest.sandboxes.find((candidate) => candidate.adapter === definition.kind) ?? options.manifest.sandboxes[0];
+    const sandboxOptions = sandboxRuntimeOptions(sandbox, env);
+    return resolveProvider("sandbox", definition, providerResolution(options, artifactRoot, env), sandboxOptions);
+}
+function collectEnv(env, names) {
+    const out = {};
+    for (const name of names) {
+        const value = env[name];
+        if (value !== undefined)
+            out[name] = value;
+    }
+    return out;
+}
+function sandboxRuntimeOptions(sandbox, env) {
+    const options = {};
+    if (sandbox?.image)
+        options.image = sandbox.image;
+    if (sandbox?.workingDirectory)
+        options.workingDirectory = sandbox.workingDirectory;
+    const passthroughEnv = collectEnv(env, sandbox?.env ?? []);
+    const sensitive = Object.keys(passthroughEnv).filter(isSensitiveSandboxEnvName);
+    if (sensitive.length > 0) {
+        throw new Error(`Refusing host/control-plane secrets in global sandbox env: ${sensitive.join(", ")}.`);
+    }
+    if (Object.keys(passthroughEnv).length > 0)
+        options.env = passthroughEnv;
+    return options;
+}
+//# sourceMappingURL=adapters.js.map

package/dist/adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAmB,MAAM,2BAA2B,CAAC;AAChG,OAAO,EACL,6BAA6B,EAC7B,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,uCAAuC,EACvC,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EAYpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,eAAe,EAA2B,MAAM,wBAAwB,CAAC;AAElF,MAAM,iCAAiC,GAAG,qCAAqC,CAAC;AAChF,MAAM,6CAA6C,GAAG,EAAE,CAAC;AAEzD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAuB,EAAE,KAAa;IAC1E,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,kBAAkB,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QAC5F,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAwB,EACxB,YAAoB,EACpB,GAAsB,EACtB,KAAmB,EACnB,OAAgB;IAKhB,IAAI,sBAAsB,CAAC,KAAK,CAAC,IAAI,qCAAqC,CAAC,KAAK,CAAC,EAAE,CAAC;QAClF,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,yBAAyB,EAAE,KAAK;SACjC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,4BAA4B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1D,OAAO;QACL,UAAU,EAAE,IAAI,wBAAwB,CAAC,GAAG,CAAC,8BAA8B,IAAI,IAAI,CAAC,YAAY,EAAE,4BAA4B,CAAC,EAAE,MAAM,CAAC;QACxI,yBAAyB,EAAE,IAAI,uCAAuC,CACpE,GAAG,CAAC,qCAAqC,IAAI,IAAI,CAAC,YAAY,EAAE,mCAAmC,CAAC,EACpG,MAAM,CACP;KACF,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAsB,EAAE,OAAgB;IAC5E,MAAM,SAAS,GAAG,GAAG,CAAC,+BAA+B,IAAI,GAAG,CAAC,cAAc,CAAC;IAC5E,MAAM,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO;YAAE,OAAO,iCAAiC,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,4LAA4L,CAAC,CAAC;IAChN,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,iCAAiC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,6CAA6C,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,YAAoB,EACpB,GAAsB,EACtB,KAAmB;IAMnB,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,KAIf,CAAC;IACH,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QACzH,aAAa,EAAE,QAAQ,CAAC,aAAa,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,sBAAsB,IAAI,IAAI,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;QAC1I,yBAAyB,EACvB,QAAQ,CAAC,yBAAyB;YAClC,IAAI,6BAA6B,CAAC,GAAG,CAAC,mCAAmC,IAAI,IAAI,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;KAClI,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,UAAU,IAAI,KAAK,IAAI,WAAW,IAAI,KAAK,IAAI,aAAa,IAAI,KAAK,CAAC,CAAC;AAC9H,CAAC;AAED,SAAS,qCAAqC,CAAC,KAAc;IAC3D,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,mBAAmB,IAAI,KAAK,IAAI,oBAAoB,IAAI,KAAK,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAuB,EAAE,YAAoB,EAAE,GAAsB;IACtG,OAAO;QACL,GAAG;QACH,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;QAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY;QACZ,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAuB,EAAE,YAAoB,EAAE,GAAsB;IAC5G,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,eAAe,CAAe,OAAO,EAAE,UAAU,EAAE,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAuB,EAAE,YAAoB,EAAE,GAAsB;IAC3G,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,eAAe,CAAc,MAAM,EAAE,UAAU,EAAE,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAuB,EAAE,YAAoB,EAAE,GAAsB;IAC9G,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,yCAAyC,KAAK,MAAM,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,wLAAwL,CAAC,CAAC;QAC5M,CAAC;QACD,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACvI,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3D,OAAO,eAAe,CAAiB,SAAS,EAAE,UAAU,EAAE,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE,cAA4B,CAAC,CAAC;AAC9I,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB,EAAE,KAAe;IACzD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAoE,EACpE,GAAsB;IAEtB,MAAM,OAAO,GAAgF,EAAE,CAAC;IAChG,IAAI,OAAO,EAAE,KAAK;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAClD,IAAI,OAAO,EAAE,gBAAgB;QAAE,OAAO,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACnF,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAChF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,8DAA8D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,GAAG,cAAc,CAAC;IACzE,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,45 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import { type JsonValue } from "@assemblyline-agents/core";
+import { type OpenEveRuntime } from "@assemblyline-agents/runtime";
+import type { NodeRuntimeServerOptions } from "./index.js";
+import type { IngressRateLimitClass, ResolvedIngressRateLimit } from "./rate-limit.js";
+export type RuntimeRouteClass = "public-health" | "provider-channel" | "scheduler" | "connection-callback" | "admin-read" | "run-create" | "run-resume" | "run-control" | "agent-control";
+export interface RuntimeAuthRequest {
+    routeClass: RuntimeRouteClass;
+    method: string;
+    path: string;
+    channel?: string;
+    headers: Record<string, string>;
+}
+export type RuntimeAuthDecision = {
+    allowed: true;
+    trusted?: boolean;
+} | {
+    allowed: false;
+    status?: 401 | 403;
+    reason?: string;
+};
+type RuntimeAllowedAuthDecision = Extract<RuntimeAuthDecision, {
+    allowed: true;
+}>;
+export interface RuntimeAuthPolicy {
+    authorize(request: RuntimeAuthRequest): RuntimeAuthDecision | Promise<RuntimeAuthDecision>;
+}
+export declare function logHttpRequest(runtime: OpenEveRuntime, request: IncomingMessage, response: ServerResponse, startedAt: number, channel?: string): void;
+export declare function validateRuntimeHttpSecurity(runtime: OpenEveRuntime, options: NodeRuntimeServerOptions): void;
+/** Applies the resolved ingress rate limit after auth; 429 + Retry-After on deny. */
+export declare function rateLimitOrSend(request: IncomingMessage, response: ServerResponse, rateLimit: ResolvedIngressRateLimit | undefined, routeClass: IngressRateLimitClass, path: string, channel?: string): Promise<boolean>;
+export declare function authorizeOrSend(request: IncomingMessage, response: ServerResponse, runtime: OpenEveRuntime, options: NodeRuntimeServerOptions, routeClass: RuntimeRouteClass, path: string, channel?: string): Promise<RuntimeAllowedAuthDecision | undefined>;
+export declare function apiRunCreationEnabled(runtime: OpenEveRuntime, options: NodeRuntimeServerOptions): boolean;
+/**
+ * Gates the POST /runs `eval` block (tool stubs, approval auto-resolve,
+ * record-only delivery). Separate from apiRunCreationEnabled because
+ * OPENEVE_ENABLE_API_RUNS is a documented production setting; stubbed runs
+ * need their own opt-in. Advertised as the `eval-runs` /healthz capability.
+ */
+export declare function evalRunsEnabled(runtime: OpenEveRuntime, options: NodeRuntimeServerOptions): boolean;
+export declare function stringBodyValue(value: JsonValue | undefined): string | undefined;
+export declare function numberBodyValue(value: JsonValue | undefined): number | undefined;
+export declare function numberQueryValue(value: string | null): number | undefined;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAA4E,KAAK,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACrI,OAAO,EAA8C,KAAK,cAAc,EAAuB,MAAM,8BAA8B,CAAC;AAEpI,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAA2B,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhH,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,kBAAkB,GAClB,WAAW,GACX,qBAAqB,GACrB,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,eAAe,CAAC;AAEpB,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,iBAAiB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACpC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,KAAK,0BAA0B,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC;AAElF,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,OAAO,EAAE,kBAAkB,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC5F;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,IAAI,CAaN;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAO5G;AAYD,qFAAqF;AACrF,wBAAsB,eAAe,CACnC,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,wBAAwB,GAAG,SAAS,EAC/C,UAAU,EAAE,qBAAqB,EACjC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,eAAe,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,wBAAwB,EACjC,UAAU,EAAE,iBAAiB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAMjD;AAmFD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAKzG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAKnG;AAaD,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEhF;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAEhF;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAIzE"}

package/dist/auth.js

@@ -0,0 +1,196 @@
+import { LEGACY_SCHEDULER_SECRET_HEADER, SCHEDULER_SECRET_HEADER } from "@assemblyline-agents/core";
+import { constantTimeSecretEqual, retryAfterSeconds } from "@assemblyline-agents/runtime";
+import { headerValue, normalizeHeaders, send } from "./http-io.js";
+export function logHttpRequest(runtime, request, response, startedAt, channel) {
+    const url = request.url ? new URL(request.url, "http://localhost") : undefined;
+    const entry = {
+        type: "http.request",
+        method: request.method ?? "",
+        path: url?.pathname ?? "",
+        status: response.statusCode,
+        durationMs: Date.now() - startedAt
+    };
+    if (channel)
+        entry.channel = channel;
+    const requestId = headerValue(request.headers["x-railway-request-id"] ?? request.headers["x-request-id"]);
+    if (requestId)
+        entry.requestId = requestId;
+    runtime.logger.info("http request", entry);
+}
+export function validateRuntimeHttpSecurity(runtime, options) {
+    if (options.devMode === true)
+        return;
+    if (options.auth || adminToken(runtime, options)) {
+        logRuntimeHttpSecurity(runtime, options);
+        return;
+    }
+    throw new Error("Production OpenEve Node runtime requires OPENEVE_ADMIN_TOKEN or a host-provided auth policy to protect control-plane routes.");
+}
+function logRuntimeHttpSecurity(runtime, options) {
+    const entry = {
+        type: "openeve.security",
+        controlPlane: "authenticated",
+        apiRuns: apiRunCreationEnabled(runtime, options) ? "enabled" : "disabled",
+        adminAuth: options.auth ? "custom-policy" : "bearer-token"
+    };
+    runtime.logger.info("runtime http security", entry);
+}
+/** Applies the resolved ingress rate limit after auth; 429 + Retry-After on deny. */
+export async function rateLimitOrSend(request, response, rateLimit, routeClass, path, channel) {
+    if (!rateLimit)
+        return true;
+    const limitRequest = {
+        routeClass,
+        method: request.method ?? "",
+        path,
+        headers: normalizeHeaders(request.headers)
+    };
+    if (channel)
+        limitRequest.channel = channel;
+    const remoteAddress = request.socket?.remoteAddress;
+    if (remoteAddress)
+        limitRequest.remoteAddress = remoteAddress;
+    const decision = await rateLimit.check(limitRequest);
+    if (decision.allowed)
+        return true;
+    send(response, 429, { error: "Rate limited." }, {
+        "retry-after": String(retryAfterSeconds(decision.retryAfterMs))
+    });
+    return false;
+}
+export async function authorizeOrSend(request, response, runtime, options, routeClass, path, channel) {
+    const decision = await authorizeRuntimeRoute(request, runtime, options, routeClass, path, channel);
+    if (decision.allowed)
+        return decision;
+    const status = decision.status ?? 403;
+    send(response, status, { error: status === 401 ? "Unauthorized." : "Forbidden." });
+    return undefined;
+}
+async function authorizeRuntimeRoute(request, runtime, options, routeClass, path, channel) {
+    const method = request.method ?? "";
+    const authRequest = {
+        routeClass,
+        method,
+        path,
+        headers: normalizeHeaders(request.headers)
+    };
+    if (channel)
+        authRequest.channel = channel;
+    if (options.auth) {
+        const decision = await options.auth.authorize(authRequest);
+        return decision.allowed ? { ...decision, trusted: true } : decision;
+    }
+    if (routeClass === "public-health" || routeClass === "connection-callback")
+        return { allowed: true };
+    if (routeClass === "provider-channel") {
+        if (options.devMode === true)
+            return { allowed: true, trusted: true };
+        if (isPublicProviderChannel(runtime, channel))
+            return { allowed: true };
+        return authorizeBearerRequest(request, runtime, options);
+    }
+    if (routeClass === "scheduler") {
+        return authorizeSchedulerRequest(request, runtime, options)
+            ? { allowed: true }
+            : { allowed: false, status: 403, reason: "scheduler_unauthorized" };
+    }
+    if (options.devMode === true)
+        return { allowed: true, trusted: true };
+    return authorizeBearerRequest(request, runtime, options);
+}
+function authorizeBearerRequest(request, runtime, options) {
+    const token = adminToken(runtime, options);
+    if (!token)
+        return { allowed: false, status: 401, reason: "admin_auth_required" };
+    const authorization = headerValue(request.headers.authorization);
+    if (!authorization.startsWith("Bearer "))
+        return { allowed: false, status: 401, reason: "admin_auth_required" };
+    const candidate = authorization.slice("Bearer ".length).trim();
+    return constantTimeSecretEqual(candidate, token)
+        ? { allowed: true, trusted: true }
+        : { allowed: false, status: 403, reason: "admin_auth_invalid" };
+}
+function isPublicProviderChannel(runtime, channelName) {
+    if (!channelName)
+        return false;
+    const channel = runtime.manifest.channels.find((candidate) => candidate.name === channelName);
+    const provider = channel ? publicChannelProvider(channel) : "";
+    return provider === "slack" ||
+        provider === "discord" ||
+        provider === "telegram" ||
+        provider === "teams" ||
+        provider === "photon";
+}
+function publicChannelProvider(channel) {
+    const metadataProvider = typeof channel.metadata?.provider === "string" ? channel.metadata.provider : undefined;
+    if (metadataProvider === "photon-spectrum")
+        return "photon";
+    if (metadataProvider === "microsoft-teams")
+        return "teams";
+    if (metadataProvider)
+        return metadataProvider;
+    const env = new Set(channel.requiredEnv);
+    if (env.has("SLACK_SIGNING_SECRET") || env.has("SLACK_BOT_TOKEN"))
+        return "slack";
+    if (env.has("DISCORD_PUBLIC_KEY") || env.has("DISCORD_BOT_TOKEN"))
+        return "discord";
+    if (env.has("TELEGRAM_BOT_TOKEN"))
+        return "telegram";
+    if (env.has("MICROSOFT_APP_ID") && env.has("MICROSOFT_APP_PASSWORD"))
+        return "teams";
+    if (env.has("PHOTON_TRANSPORT_URL") || env.has("PHOTON_BRIDGE_TOKEN"))
+        return "photon";
+    return undefined;
+}
+function adminToken(runtime, options) {
+    const env = options.env ?? runtime.env ?? process.env;
+    const token = env.OPENEVE_ADMIN_TOKEN?.trim();
+    return token ? token : undefined;
+}
+export function apiRunCreationEnabled(runtime, options) {
+    if (options.allowApiRuns !== undefined)
+        return options.allowApiRuns;
+    if (options.devMode === true)
+        return true;
+    const env = options.env ?? runtime.env ?? process.env;
+    return env.OPENEVE_ENABLE_API_RUNS === "true" || env.OPENEVE_ENABLE_API_RUNS === "1";
+}
+/**
+ * Gates the POST /runs `eval` block (tool stubs, approval auto-resolve,
+ * record-only delivery). Separate from apiRunCreationEnabled because
+ * OPENEVE_ENABLE_API_RUNS is a documented production setting; stubbed runs
+ * need their own opt-in. Advertised as the `eval-runs` /healthz capability.
+ */
+export function evalRunsEnabled(runtime, options) {
+    if (options.allowEvalRuns !== undefined)
+        return options.allowEvalRuns;
+    if (options.devMode === true)
+        return true;
+    const env = options.env ?? runtime.env ?? process.env;
+    return env.OPENEVE_ENABLE_EVAL_RUNS === "true" || env.OPENEVE_ENABLE_EVAL_RUNS === "1";
+}
+function authorizeSchedulerRequest(request, runtime, options) {
+    const env = options.env ?? runtime.env ?? process.env;
+    const secret = env.OPENEVE_SCHEDULER_SECRET;
+    if (!secret)
+        return options.devMode === true;
+    const headerSecret = headerValue(request.headers[SCHEDULER_SECRET_HEADER])
+        || headerValue(request.headers[LEGACY_SCHEDULER_SECRET_HEADER]);
+    if (headerSecret && constantTimeSecretEqual(headerSecret, secret))
+        return true;
+    const authorization = headerValue(request.headers.authorization);
+    return Boolean(authorization) && constantTimeSecretEqual(authorization, `Bearer ${secret}`);
+}
+export function stringBodyValue(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+export function numberBodyValue(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+export function numberQueryValue(value) {
+    if (!value)
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAmC,MAAM,2BAA2B,CAAC;AACrI,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAA4C,MAAM,8BAA8B,CAAC;AACpI,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAiCnE,MAAM,UAAU,cAAc,CAC5B,OAAuB,EACvB,OAAwB,EACxB,QAAwB,EACxB,SAAiB,EACjB,OAAgB;IAEhB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,KAAK,GAAe;QACxB,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,IAAI,EAAE,GAAG,EAAE,QAAQ,IAAI,EAAE;QACzB,MAAM,EAAE,QAAQ,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;IACF,IAAI,OAAO;QAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACrC,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1G,IAAI,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;IAC3C,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAuB,EAAE,OAAiC;IACpG,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO;IACrC,IAAI,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACjD,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;AAClJ,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAuB,EAAE,OAAiC;IACxF,MAAM,KAAK,GAAe;QACxB,IAAI,EAAE,kBAAkB;QACxB,YAAY,EAAE,eAAe;QAC7B,OAAO,EAAE,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QACzE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc;KAC3D,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAwB,EACxB,QAAwB,EACxB,SAA+C,EAC/C,UAAiC,EACjC,IAAY,EACZ,OAAgB;IAEhB,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,YAAY,GAA4B;QAC5C,UAAU;QACV,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,IAAI;QACJ,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC;KAC3C,CAAC;IACF,IAAI,OAAO;QAAE,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC;IAC5C,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC;IACpD,IAAI,aAAa;QAAE,YAAY,CAAC,aAAa,GAAG,aAAa,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE;QAC9C,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;KAChE,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAwB,EACxB,QAAwB,EACxB,OAAuB,EACvB,OAAiC,EACjC,UAA6B,EAC7B,IAAY,EACZ,OAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACnG,IAAI,QAAQ,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC;IACtC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,OAAwB,EACxB,OAAuB,EACvB,OAAiC,EACjC,UAA6B,EAC7B,IAAY,EACZ,OAAgB;IAEhB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,MAAM,WAAW,GAAuB;QACtC,UAAU;QACV,MAAM;QACN,IAAI;QACJ,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC;KAC3C,CAAC;IACF,IAAI,OAAO;QAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;IAC3C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,CAAC;IACD,IAAI,UAAU,KAAK,eAAe,IAAI,UAAU,KAAK,qBAAqB;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACrG,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtE,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACxE,OAAO,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,UAAU,KAAK,WAAW,EAAE,CAAC;QAC/B,OAAO,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;YACzD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;YACnB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtE,OAAO,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAwB,EACxB,OAAuB,EACvB,OAAiC;IAEjC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAClF,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChH,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,OAAO,uBAAuB,CAAC,SAAS,EAAE,KAAK,CAAC;QAC9C,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;QAClC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAuB,EAAE,WAA+B;IACvF,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAC9F,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,OAAO,QAAQ,KAAK,OAAO;QACzB,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,UAAU;QACvB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAuD;IACpF,MAAM,gBAAgB,GAAG,OAAO,OAAO,CAAC,QAAQ,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,IAAI,gBAAgB,KAAK,iBAAiB;QAAE,OAAO,QAAQ,CAAC;IAC5D,IAAI,gBAAgB,KAAK,iBAAiB;QAAE,OAAO,OAAO,CAAC;IAC3D,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAAE,OAAO,OAAO,CAAC;IAClF,IAAI,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO,SAAS,CAAC;IACpF,IAAI,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAAE,OAAO,UAAU,CAAC;IACrD,IAAI,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAAE,OAAO,OAAO,CAAC;IACrF,IAAI,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAAE,OAAO,QAAQ,CAAC;IACvF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,OAAuB,EAAE,OAAiC;IAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtD,MAAM,KAAK,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IAC9C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAuB,EAAE,OAAiC;IAC9F,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC;IACpE,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtD,OAAO,GAAG,CAAC,uBAAuB,KAAK,MAAM,IAAI,GAAG,CAAC,uBAAuB,KAAK,GAAG,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAuB,EAAE,OAAiC;IACxF,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,aAAa,CAAC;IACtE,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtD,OAAO,GAAG,CAAC,wBAAwB,KAAK,MAAM,IAAI,GAAG,CAAC,wBAAwB,KAAK,GAAG,CAAC;AACzF,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAwB,EAAE,OAAuB,EAAE,OAAiC;IACrH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACtD,MAAM,MAAM,GAAG,GAAG,CAAC,wBAAwB,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC;IAC7C,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;WACrE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAClE,IAAI,YAAY,IAAI,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACjE,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,uBAAuB,CAAC,aAAa,EAAE,UAAU,MAAM,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA4B;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA4B;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAoB;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC"}

package/dist/direct-conversations-http.d.ts

@@ -0,0 +1,40 @@
+import type { AgentManifest, JsonObject } from "@assemblyline-agents/core";
+import type { ChannelTurn, ConversationCursor, ConversationRecord, MessageCursor } from "@assemblyline-agents/runtime";
+export declare const DIRECT_CHANNEL = "direct";
+export type ConversationHttpRoute = {
+    kind: "collection";
+} | {
+    kind: "record";
+    conversationId: string;
+} | {
+    kind: "messages";
+    conversationId: string;
+} | {
+    kind: "turns";
+    conversationId: string;
+};
+export declare function parseConversationHttpRoute(pathname: string): ConversationHttpRoute | undefined;
+export declare function directAgentScope(manifest: AgentManifest): string;
+export declare function conversationBelongsToAgent(conversation: ConversationRecord, agentScope: string): boolean;
+export declare function encodeConversationCursor(conversation: ConversationRecord): string;
+export declare function decodeConversationCursor(value: string | null): ConversationCursor | undefined;
+export declare function encodeMessageCursor(message: {
+    createdAt: string;
+    id: string;
+}): string;
+export declare function decodeMessageCursor(value: string | null): MessageCursor | undefined;
+export declare function directTurnFromBody(input: {
+    conversationId: string;
+    body: JsonObject;
+    idempotencyKey?: string;
+}): {
+    turn: ChannelTurn;
+    stream: boolean;
+    approve: boolean;
+};
+export declare function directConversationPatch(body: JsonObject): {
+    title?: string | null;
+    archivedAt?: string | null;
+    metadata?: JsonObject;
+};
+//# sourceMappingURL=direct-conversations-http.d.ts.map

package/dist/direct-conversations-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-conversations-http.d.ts","sourceRoot":"","sources":["../src/direct-conversations-http.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,KAAK,EACV,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACd,MAAM,8BAA8B,CAAC;AAEtC,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9C,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAS9F;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAGhE;AAED,wBAAgB,0BAA0B,CAAC,YAAY,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAExG;AAED,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,kBAAkB,GAAG,MAAM,CAEjF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,kBAAkB,GAAG,SAAS,CAI7F;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEtF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,GAAG,SAAS,CAInF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CA4B3D;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG;IACzD,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,UAAU,CAAC;CACvB,CAeA"}

package/dist/direct-conversations-http.js

@@ -0,0 +1,140 @@
+import { randomUUID } from "node:crypto";
+export const DIRECT_CHANNEL = "direct";
+export function parseConversationHttpRoute(pathname) {
+    if (pathname === "/conversations")
+        return { kind: "collection" };
+    const match = pathname.match(/^\/conversations\/([^/]+)(?:\/(messages|turns))?$/u);
+    if (!match)
+        return undefined;
+    const conversationId = decodeURIComponent(match[1] ?? "");
+    if (!conversationId || conversationId.length > 200)
+        return undefined;
+    if (match[2] === "messages")
+        return { kind: "messages", conversationId };
+    if (match[2] === "turns")
+        return { kind: "turns", conversationId };
+    return { kind: "record", conversationId };
+}
+export function directAgentScope(manifest) {
+    const id = typeof manifest.agent.id === "string" ? manifest.agent.id.trim() : "";
+    return id ? `agent:${id}` : manifest.agentRevision;
+}
+export function conversationBelongsToAgent(conversation, agentScope) {
+    return (conversation.agentScope ?? conversation.agentRevision) === agentScope;
+}
+export function encodeConversationCursor(conversation) {
+    return encodeCursor({ updatedAt: conversation.updatedAt, id: conversation.id });
+}
+export function decodeConversationCursor(value) {
+    const decoded = decodeCursor(value);
+    if (!decoded || typeof decoded.updatedAt !== "string" || typeof decoded.id !== "string")
+        return undefined;
+    return { updatedAt: decoded.updatedAt, id: decoded.id };
+}
+export function encodeMessageCursor(message) {
+    return encodeCursor({ createdAt: message.createdAt, id: message.id });
+}
+export function decodeMessageCursor(value) {
+    const decoded = decodeCursor(value);
+    if (!decoded || typeof decoded.createdAt !== "string" || typeof decoded.id !== "string")
+        return undefined;
+    return { createdAt: decoded.createdAt, id: decoded.id };
+}
+export function directTurnFromBody(input) {
+    const metadata = jsonObjectField(input.body.metadata);
+    const title = stringField(input.body.title)?.slice(0, 160);
+    if (title)
+        metadata.conversationTitle = title;
+    metadata.transport = "http";
+    const attachments = arrayField(input.body.attachments);
+    const files = arrayField(input.body.__files);
+    attachments.push(...files);
+    const eventId = stringField(input.body.eventId) ?? input.idempotencyKey ?? randomUUID();
+    const turn = {
+        eventId,
+        channel: DIRECT_CHANNEL,
+        conversationId: input.conversationId,
+        message: stringField(input.body.message) ?? "",
+        attachments,
+        delivery: {},
+        metadata
+    };
+    const userId = stringField(input.body.userId);
+    const model = stringField(input.body.model);
+    if (userId)
+        turn.userId = userId;
+    if (model)
+        turn.model = model;
+    return {
+        turn,
+        stream: booleanField(input.body.stream),
+        approve: booleanField(input.body.approve)
+    };
+}
+export function directConversationPatch(body) {
+    const patch = {};
+    if (body.title === null)
+        patch.title = null;
+    else {
+        const title = stringField(body.title);
+        if (title)
+            patch.title = title.slice(0, 160);
+    }
+    if (typeof body.archived === "boolean")
+        patch.archivedAt = body.archived ? new Date().toISOString() : null;
+    const metadata = jsonObjectField(body.metadata);
+    if (Object.keys(metadata).length > 0)
+        patch.metadata = metadata;
+    return patch;
+}
+function encodeCursor(value) {
+    return Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+}
+function decodeCursor(value) {
+    if (!value)
+        return undefined;
+    try {
+        const parsed = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function stringField(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed || undefined;
+}
+function booleanField(value) {
+    return value === true || value === "true" || value === "1";
+}
+function jsonObjectField(value) {
+    if (value && typeof value === "object" && !Array.isArray(value))
+        return { ...value };
+    if (typeof value !== "string" || !value.trim())
+        return {};
+    try {
+        const parsed = JSON.parse(value);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function arrayField(value) {
+    let candidate = value;
+    if (typeof candidate === "string" && candidate.trim()) {
+        try {
+            candidate = JSON.parse(candidate);
+        }
+        catch {
+            return [];
+        }
+    }
+    if (!Array.isArray(candidate))
+        return [];
+    return candidate.filter((item) => Boolean(item && typeof item === "object" && !Array.isArray(item)));
+}
+//# sourceMappingURL=direct-conversations-http.js.map