@bridgekitux/agent 0.1.0

package/dist/src/handlers.js

@@ -0,0 +1,1143 @@
+import { watch } from 'node:fs';
+import { mkdir, open, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { createConnection } from 'node:net';
+import { connect as tlsConnect } from 'node:tls';
+import { spawn } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { URL } from 'node:url';
+import { DatabaseSync } from 'node:sqlite';
+import { WebSocket as NodeWebSocket } from 'ws';
+import { bridgeKitError, isRecord } from '@bridgekitux/protocol';
+import { resolveInside } from './path-scope.js';
+function requireRecord(value) {
+    if (!isRecord(value))
+        throw bridgeKitError('invalid_request', 'Capability args must be an object');
+    return value;
+}
+function requireString(value, name) {
+    if (typeof value !== 'string' || value.length === 0)
+        throw bridgeKitError('invalid_request', `${name} must be a non-empty string`);
+    return value;
+}
+function isWriteSql(sql) {
+    const trimmed = sql.trim().replace(/^\/\*[\s\S]*?\*\//, '').toLowerCase();
+    return !/^(select|show|describe|desc|explain|with)\b/.test(trimmed);
+}
+export function operationForInvoke(payload) {
+    if (payload.operation)
+        return payload.operation;
+    const args = isRecord(payload.args) ? payload.args : {};
+    switch (payload.capability) {
+        case 'db.connect':
+            return 'connect';
+        case 'db.raw':
+            return 'full';
+        case 'db.query': {
+            const sql = typeof args.sql === 'string' ? args.sql : typeof args.text === 'string' ? args.text : '';
+            return sql && isWriteSql(sql) ? 'query:write' : 'query:read';
+        }
+        case 'db.inspectSchema':
+        case 'db.listTables':
+        case 'db.listCollections':
+            return 'schema:read';
+        case 'db.runMigration':
+            return 'migration:run';
+        case 'db.close':
+            return 'close';
+        case 'http.request':
+        case 'network.request':
+            return 'request';
+        case 'http.raw':
+            return 'full';
+        case 'tcp.connect':
+            return 'connect';
+        case 'tcp.stream':
+            return 'stream';
+        case 'websocket.connect':
+            return 'connect';
+        case 'http.stream':
+            return 'stream';
+        case 'fs.watch':
+            return 'watch';
+        case 'logs.subscribe':
+            return 'subscribe';
+        case 'process.logs':
+            return 'logs';
+        default:
+            return undefined;
+    }
+}
+export async function invokeCapability(ctx, payload) {
+    const resourceId = payload.resourceId;
+    if (!resourceId && payload.capability !== 'secret.list') {
+        throw bridgeKitError('invalid_request', 'resourceId is required for this capability');
+    }
+    if (payload.capability.startsWith('db.'))
+        return handleDatabase(ctx, await ctx.registry.get(resourceId), payload);
+    if (payload.capability.startsWith('fs.'))
+        return handleFile(await ctx.registry.get(resourceId), payload);
+    if (payload.capability.startsWith('secret.'))
+        return handleSecret(ctx, payload);
+    if (payload.capability === 'http.request' || payload.capability === 'http.raw' || payload.capability === 'network.request')
+        return handleHttp(await ctx.registry.get(resourceId), payload);
+    if (payload.capability === 'tcp.connect')
+        return handleTcp(await ctx.registry.get(resourceId), payload);
+    if (payload.capability.startsWith('port.'))
+        return handlePort(ctx, await ctx.registry.get(resourceId), payload);
+    if (payload.capability.startsWith('process.'))
+        return handleProcess(ctx, await ctx.registry.get(resourceId), payload);
+    if (payload.capability.startsWith('docker.'))
+        throw bridgeKitError('capability_not_implemented', 'Docker support is documented as post-MVP and is intentionally not enabled by default');
+    throw bridgeKitError('capability_not_supported', `Unsupported capability: ${payload.capability}`);
+}
+export async function subscribeCapability(ctx, payload, emit) {
+    const resource = await ctx.registry.get(payload.resourceId);
+    switch (payload.capability) {
+        case 'fs.watch':
+            return subscribeFileWatch(resource, payload, emit);
+        case 'http.stream':
+            return subscribeHttpStream(resource, payload, emit);
+        case 'tcp.stream':
+            return subscribeTcpStream(resource, payload, emit);
+        case 'websocket.connect':
+            return subscribeWebSocket(resource, payload, emit);
+        case 'logs.subscribe':
+            return subscribeLogs(ctx, resource, payload, emit);
+        case 'process.logs':
+            return subscribeProcessLogs(ctx, resource, emit);
+        default:
+            throw bridgeKitError('capability_not_supported', `Unsupported streaming capability: ${payload.capability}`);
+    }
+}
+function subscribeFileWatch(resource, payload, emit) {
+    if (resource.kind !== 'file')
+        throw bridgeKitError('resource_type_mismatch', `${resource.id} is not a file resource`);
+    const args = requireRecord(payload.args ?? {});
+    const file = resource;
+    const requestedPath = typeof args.path === 'string' ? args.path : '.';
+    const path = resolveInside(file.rootPath, requestedPath);
+    const recursive = Boolean(args.recursive);
+    const includeInitial = Boolean(args.includeInitial);
+    const debounceMs = typeof args.debounceMs === 'number' && Number.isFinite(args.debounceMs) && args.debounceMs > 0 ? Math.min(args.debounceMs, 5_000) : 0;
+    const controller = new AbortController();
+    const pending = new Map();
+    emit({
+        event: 'fs.ready',
+        resourceId: resource.id,
+        capability: 'fs.watch',
+        data: {
+            path: requestedPath,
+            recursive,
+            includeInitial,
+            timestamp: new Date().toISOString()
+        }
+    });
+    if (includeInitial) {
+        void listSnapshot(path, requestedPath, recursive).then((entries) => {
+            emit({
+                event: 'fs.snapshot',
+                resourceId: resource.id,
+                capability: 'fs.watch',
+                data: {
+                    path: requestedPath,
+                    recursive,
+                    entries,
+                    timestamp: new Date().toISOString()
+                }
+            });
+        }).catch((error) => {
+            emit({
+                event: 'fs.error',
+                resourceId: resource.id,
+                capability: 'fs.watch',
+                data: { message: error instanceof Error ? error.message : 'Unknown snapshot error', timestamp: new Date().toISOString() }
+            });
+        });
+    }
+    const emitChange = (eventType, filename) => {
+        const relativePath = filename ? join(requestedPath, filename).replace(/\\/g, '/') : requestedPath;
+        emit({
+            event: 'fs.change',
+            resourceId: resource.id,
+            capability: 'fs.watch',
+            data: {
+                eventType,
+                filename,
+                path: requestedPath,
+                relativePath,
+                recursive,
+                timestamp: new Date().toISOString()
+            }
+        });
+    };
+    const watcher = watch(path, { recursive, signal: controller.signal }, (eventType, filename) => {
+        const normalized = filename?.toString() ?? null;
+        if (debounceMs === 0) {
+            emitChange(eventType, normalized);
+            return;
+        }
+        const key = `${eventType}:${normalized ?? ''}`;
+        const previous = pending.get(key);
+        if (previous)
+            clearTimeout(previous);
+        pending.set(key, setTimeout(() => {
+            pending.delete(key);
+            emitChange(eventType, normalized);
+        }, debounceMs));
+    });
+    watcher.on('error', (error) => {
+        emit({
+            event: 'fs.error',
+            resourceId: resource.id,
+            capability: 'fs.watch',
+            data: { message: error.message, timestamp: new Date().toISOString() }
+        });
+    });
+    watcher.unref?.();
+    return {
+        close: () => {
+            for (const timer of pending.values())
+                clearTimeout(timer);
+            pending.clear();
+            controller.abort();
+            watcher.close();
+        }
+    };
+}
+async function listSnapshot(root, requestedPath, recursive) {
+    const entries = await readdir(root, { withFileTypes: true });
+    const result = [];
+    for (const entry of entries) {
+        const absolute = join(root, entry.name);
+        const entryPath = join(requestedPath, entry.name).replace(/\\/g, '/');
+        const type = entry.isDirectory() ? 'directory' : entry.isFile() ? 'file' : 'other';
+        result.push({ path: entryPath, type });
+        if (recursive && entry.isDirectory()) {
+            result.push(...await listSnapshot(absolute, entryPath, true));
+        }
+    }
+    return result;
+}
+async function handleFile(resource, payload) {
+    if (resource.kind !== 'file')
+        throw bridgeKitError('resource_type_mismatch', `${resource.id} is not a file resource`);
+    const file = resource;
+    const args = requireRecord(payload.args ?? {});
+    const path = resolveInside(file.rootPath, typeof args.path === 'string' ? args.path : '.');
+    switch (payload.capability) {
+        case 'fs.read': {
+            const encoding = typeof args.encoding === 'string' ? args.encoding : 'utf8';
+            return { path: args.path ?? '.', content: await readFile(path, encoding) };
+        }
+        case 'fs.write': {
+            const content = typeof args.content === 'string' ? args.content : undefined;
+            if (content === undefined)
+                throw bridgeKitError('invalid_request', 'fs.write requires string content');
+            await mkdir(dirname(path), { recursive: true });
+            await writeFile(path, content, typeof args.encoding === 'string' ? { encoding: args.encoding } : undefined);
+            return { path: args.path ?? '.', bytes: Buffer.byteLength(content) };
+        }
+        case 'fs.list': {
+            const entries = await readdir(path, { withFileTypes: true });
+            return { path: args.path ?? '.', entries: entries.map((entry) => ({ name: entry.name, type: entry.isDirectory() ? 'directory' : entry.isFile() ? 'file' : 'other' })) };
+        }
+        case 'fs.mkdir':
+            await mkdir(path, { recursive: true });
+            return { path: args.path ?? '.', created: true };
+        case 'fs.delete':
+            await rm(path, { recursive: Boolean(args.recursive), force: Boolean(args.force) });
+            return { path: args.path ?? '.', deleted: true };
+        case 'fs.watch':
+            throw bridgeKitError('invalid_request', 'fs.watch requires the subscribe API instead of invoke');
+        default:
+            throw bridgeKitError('capability_not_supported', `Unsupported file capability: ${payload.capability}`);
+    }
+}
+async function handleDatabase(_ctx, resource, payload) {
+    if (resource.kind !== 'database')
+        throw bridgeKitError('resource_type_mismatch', `${resource.id} is not a database resource`);
+    const database = resource;
+    switch (payload.capability) {
+        case 'db.connect':
+            return { resourceId: database.id, type: database.databaseType, connected: true };
+        case 'db.raw':
+            return rawDatabase(database, payload.args);
+        case 'db.query':
+        case 'db.runMigration':
+            return queryDatabase(database, payload.args);
+        case 'db.inspectSchema':
+        case 'db.listTables':
+        case 'db.listCollections':
+            return inspectDatabase(database);
+        case 'db.close':
+            return { closed: true };
+        default:
+            throw bridgeKitError('capability_not_supported', `Unsupported database capability: ${payload.capability}`);
+    }
+}
+async function queryDatabase(resource, args = {}) {
+    switch (resource.databaseType) {
+        case 'sqlite': {
+            if (!resource.filePath)
+                throw bridgeKitError('invalid_resource', 'SQLite resource requires filePath');
+            const sql = requireString(args.sql ?? args.text, 'sql');
+            const db = new DatabaseSync(resource.filePath);
+            try {
+                const statement = db.prepare(sql);
+                const params = args.params ?? args.values ?? [];
+                if (isWriteSql(sql)) {
+                    const result = statement.run(...params);
+                    return { changes: result.changes, lastInsertRowid: result.lastInsertRowid?.toString() };
+                }
+                return { rows: statement.all(...params) };
+            }
+            finally {
+                db.close();
+            }
+        }
+        case 'postgres': {
+            const { Pool } = await import('pg');
+            const pool = new Pool({ connectionString: resource.connectionString });
+            try {
+                const result = await pool.query(requireString(args.sql ?? args.text, 'sql'), args.params ?? args.values);
+                return { rows: result.rows, rowCount: result.rowCount, fields: result.fields.map((field) => ({ name: field.name, dataTypeID: field.dataTypeID })) };
+            }
+            finally {
+                await pool.end();
+            }
+        }
+        case 'mysql': {
+            const mysql = await import('mysql2/promise');
+            const pool = mysql.createPool(resource.connectionString);
+            try {
+                const [rows, fields] = await pool.query(requireString(args.sql ?? args.text, 'sql'), args.params ?? args.values);
+                return { rows, fields };
+            }
+            finally {
+                await pool.end();
+            }
+        }
+        case 'mongodb': {
+            const { MongoClient } = await import('mongodb');
+            const client = new MongoClient(resource.connectionString);
+            try {
+                await client.connect();
+                const db = client.db(resource.database);
+                const collectionName = requireString(args.collection, 'collection');
+                const collection = db.collection(collectionName);
+                switch (args.action ?? 'find') {
+                    case 'find':
+                        return { documents: await collection.find(args.filter ?? {}, args.options ?? {}).toArray() };
+                    case 'findOne':
+                        return { document: await collection.findOne(args.filter ?? {}, args.options ?? {}) };
+                    case 'countDocuments':
+                        return { count: await collection.countDocuments(args.filter ?? {}, args.options ?? {}) };
+                    case 'distinct':
+                        return { values: await collection.distinct(requireString(args.key, 'key'), args.filter ?? {}, args.options ?? {}) };
+                    case 'aggregate':
+                        return { documents: await collection.aggregate(args.pipeline ?? [], args.options ?? {}).toArray() };
+                    case 'insertOne':
+                        return await collection.insertOne(args.document ?? {}, args.options ?? {});
+                    case 'insertMany':
+                        return await collection.insertMany(args.documents ?? [], args.options ?? {});
+                    case 'updateOne':
+                        return await collection.updateOne(args.filter ?? {}, args.update ?? {}, args.options ?? {});
+                    case 'updateMany':
+                        return await collection.updateMany(args.filter ?? {}, args.update ?? {}, args.options ?? {});
+                    case 'replaceOne':
+                        return await collection.replaceOne(args.filter ?? {}, args.replacement ?? {}, args.options ?? {});
+                    case 'deleteOne':
+                        return await collection.deleteOne(args.filter ?? {}, args.options ?? {});
+                    case 'deleteMany':
+                        return await collection.deleteMany(args.filter ?? {}, args.options ?? {});
+                    default:
+                        throw bridgeKitError('invalid_request', `Unsupported MongoDB action: ${args.action}`);
+                }
+            }
+            finally {
+                await client.close();
+            }
+        }
+        case 'sqlserver': {
+            const mssql = await import('mssql');
+            const pool = await mssql.connect(resource.connectionString);
+            try {
+                const result = await pool.request().query(requireString(args.sql ?? args.text, 'sql'));
+                return { rows: result.recordset, rowsAffected: result.rowsAffected };
+            }
+            finally {
+                await pool.close();
+            }
+        }
+        default:
+            throw bridgeKitError('capability_not_supported', `Unsupported database type: ${resource.databaseType}`);
+    }
+}
+async function rawDatabase(resource, args = {}) {
+    if (resource.databaseType !== 'mongodb') {
+        return queryDatabase(resource, args);
+    }
+    const { MongoClient } = await import('mongodb');
+    const client = new MongoClient(resource.connectionString);
+    try {
+        await client.connect();
+        const db = client.db(resource.database);
+        if (isRecord(args.command)) {
+            return await db.command(args.command);
+        }
+        const collectionName = requireString(args.collection, 'collection');
+        const action = requireString(args.action, 'action');
+        const collection = db.collection(collectionName);
+        if (typeof collection[action] !== 'function')
+            throw bridgeKitError('invalid_request', `Unsupported MongoDB raw collection method: ${action}`);
+        const rawArgs = Array.isArray(args.args) ? args.args : [];
+        const result = await collection[action](...rawArgs);
+        if (result && typeof result.toArray === 'function')
+            return { documents: await result.toArray() };
+        return result;
+    }
+    finally {
+        await client.close();
+    }
+}
+async function inspectDatabase(resource) {
+    switch (resource.databaseType) {
+        case 'sqlite': {
+            const db = new DatabaseSync(resource.filePath);
+            try {
+                const tables = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name").all();
+                return { tables: tables.map((table) => table.name) };
+            }
+            finally {
+                db.close();
+            }
+        }
+        case 'postgres':
+            return queryDatabase(resource, { sql: "SELECT table_schema, table_name FROM information_schema.tables WHERE table_schema NOT IN ('pg_catalog', 'information_schema') ORDER BY table_schema, table_name" });
+        case 'mysql':
+            return queryDatabase(resource, { sql: 'SHOW TABLES' });
+        case 'mongodb': {
+            const { MongoClient } = await import('mongodb');
+            const client = new MongoClient(resource.connectionString);
+            try {
+                await client.connect();
+                const collections = await client.db(resource.database).listCollections().toArray();
+                return { collections: collections.map((collection) => collection.name) };
+            }
+            finally {
+                await client.close();
+            }
+        }
+        case 'sqlserver':
+            return queryDatabase(resource, { sql: "SELECT TABLE_SCHEMA, TABLE_NAME FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_TYPE='BASE TABLE' ORDER BY TABLE_SCHEMA, TABLE_NAME" });
+        default:
+            throw bridgeKitError('capability_not_supported', `Unsupported database type: ${resource.databaseType}`);
+    }
+}
+async function handleSecret(ctx, payload) {
+    const args = requireRecord(payload.args ?? {});
+    const id = payload.resourceId ?? (typeof args.id === 'string' ? args.id : undefined);
+    switch (payload.capability) {
+        case 'secret.create':
+            return ctx.vault.create(requireString(id, 'resourceId'), requireString(args.value, 'value'));
+        case 'secret.resolve':
+            return { id: requireString(id, 'resourceId'), value: await ctx.vault.resolve(requireString(id, 'resourceId')) };
+        case 'secret.list':
+            return { secrets: await ctx.vault.list() };
+        case 'secret.revoke':
+            return ctx.vault.revoke(requireString(id, 'resourceId'));
+        default:
+            throw bridgeKitError('capability_not_supported', `Unsupported secret capability: ${payload.capability}`);
+    }
+}
+async function handleHttp(resource, payload) {
+    const { url, method, headers, body } = approvedHttpRequest(resource, payload.args, payload.capability === 'http.raw');
+    const response = await fetch(url, { method, headers, body });
+    const text = await response.text();
+    return { status: response.status, statusText: response.statusText, headers: Object.fromEntries(response.headers.entries()), body: text };
+}
+function approvedHttpRequest(resource, argsInput, raw = false) {
+    if (resource.kind !== 'http' && resource.kind !== 'network' && resource.kind !== 'service') {
+        throw bridgeKitError('resource_type_mismatch', `${resource.id} is not an HTTP/network resource`);
+    }
+    const http = resource;
+    const args = requireRecord(argsInput ?? {});
+    const method = (typeof args.method === 'string' ? args.method : 'GET').toUpperCase();
+    if (!raw && !(http.allowedMethods ?? ['GET']).map((entry) => entry.toUpperCase()).includes(method)) {
+        throw bridgeKitError('permission_denied', `Method ${method} is not allowed for ${http.id}`);
+    }
+    const base = new URL(http.baseUrl);
+    const url = typeof args.path === 'string' ? new URL(args.path, base) : new URL(base.toString());
+    const scopedBasePath = base.pathname.endsWith('/') ? base.pathname : `${base.pathname.replace(/\/$/, '')}/`;
+    if (url.origin !== base.origin || (base.pathname !== '/' && !url.pathname.startsWith(scopedBasePath))) {
+        throw bridgeKitError('scope_violation', `HTTP path escapes approved base URL for ${http.id}`);
+    }
+    return {
+        http,
+        url,
+        method,
+        headers: { ...(http.defaultHeaders ?? {}), ...(isRecord(args.headers) ? args.headers : {}) },
+        body: typeof args.body === 'string' ? args.body : undefined
+    };
+}
+function subscribeHttpStream(resource, payload, emit) {
+    const args = requireRecord(payload.args ?? {});
+    const { url, method, headers, body } = approvedHttpRequest(resource, payload.args, payload.operation === 'full' || args.raw === true);
+    const eventMode = args.eventMode === 'lines' || args.eventMode === 'sse' ? args.eventMode : 'chunks';
+    const idleTimeoutMs = typeof args.idleTimeoutMs === 'number' && Number.isFinite(args.idleTimeoutMs) && args.idleTimeoutMs > 0 ? args.idleTimeoutMs : 0;
+    const controller = new AbortController();
+    let idleTimer;
+    const resetIdleTimer = () => {
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        if (idleTimeoutMs > 0) {
+            idleTimer = setTimeout(() => {
+                emit({
+                    event: 'http.error',
+                    resourceId: resource.id,
+                    capability: 'http.stream',
+                    data: { message: `HTTP stream idle timeout after ${idleTimeoutMs}ms`, timestamp: new Date().toISOString() }
+                });
+                controller.abort();
+            }, idleTimeoutMs);
+        }
+    };
+    void (async () => {
+        try {
+            resetIdleTimer();
+            const response = await fetch(url, { method, headers, body, signal: controller.signal });
+            emit({
+                event: 'http.response',
+                resourceId: resource.id,
+                capability: 'http.stream',
+                data: {
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: Object.fromEntries(response.headers.entries()),
+                    timestamp: new Date().toISOString()
+                }
+            });
+            if (!response.body) {
+                emit({
+                    event: 'http.complete',
+                    resourceId: resource.id,
+                    capability: 'http.stream',
+                    data: { bytes: 0, timestamp: new Date().toISOString() }
+                });
+                return;
+            }
+            const reader = response.body.getReader();
+            const decoder = new TextDecoder();
+            let bytes = 0;
+            let bufferedText = '';
+            while (!controller.signal.aborted) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                resetIdleTimer();
+                bytes += value.byteLength;
+                const text = decoder.decode(value, { stream: true });
+                emit({
+                    event: 'http.chunk',
+                    resourceId: resource.id,
+                    capability: 'http.stream',
+                    data: {
+                        chunk: text,
+                        bytes: value.byteLength,
+                        totalBytes: bytes,
+                        timestamp: new Date().toISOString()
+                    }
+                });
+                if (eventMode === 'lines' || eventMode === 'sse') {
+                    bufferedText += text;
+                    const lines = bufferedText.split(/\r?\n/);
+                    bufferedText = lines.pop() ?? '';
+                    for (const line of lines) {
+                        if (eventMode === 'sse' && line.length === 0)
+                            continue;
+                        emit({
+                            event: eventMode === 'sse' ? 'http.sse' : 'http.line',
+                            resourceId: resource.id,
+                            capability: 'http.stream',
+                            data: {
+                                line,
+                                data: eventMode === 'sse' && line.startsWith('data:') ? line.slice(5).trimStart() : undefined,
+                                totalBytes: bytes,
+                                timestamp: new Date().toISOString()
+                            }
+                        });
+                    }
+                }
+            }
+            const finalText = decoder.decode();
+            if (finalText.length > 0) {
+                bufferedText += finalText;
+            }
+            if ((eventMode === 'lines' || eventMode === 'sse') && bufferedText.length > 0) {
+                emit({
+                    event: eventMode === 'sse' ? 'http.sse' : 'http.line',
+                    resourceId: resource.id,
+                    capability: 'http.stream',
+                    data: {
+                        line: bufferedText,
+                        data: eventMode === 'sse' && bufferedText.startsWith('data:') ? bufferedText.slice(5).trimStart() : undefined,
+                        totalBytes: bytes,
+                        timestamp: new Date().toISOString()
+                    }
+                });
+            }
+            if (idleTimer)
+                clearTimeout(idleTimer);
+            emit({
+                event: 'http.complete',
+                resourceId: resource.id,
+                capability: 'http.stream',
+                data: { bytes, timestamp: new Date().toISOString() }
+            });
+        }
+        catch (error) {
+            if (idleTimer)
+                clearTimeout(idleTimer);
+            if (controller.signal.aborted)
+                return;
+            emit({
+                event: 'http.error',
+                resourceId: resource.id,
+                capability: 'http.stream',
+                data: { message: error instanceof Error ? error.message : 'Unknown HTTP stream error', timestamp: new Date().toISOString() }
+            });
+        }
+    })();
+    return {
+        close: () => {
+            if (idleTimer)
+                clearTimeout(idleTimer);
+            controller.abort();
+        }
+    };
+}
+async function handleTcp(resource, payload) {
+    if (resource.kind !== 'tcp')
+        throw bridgeKitError('resource_type_mismatch', `${resource.id} is not a TCP resource`);
+    const tcp = resource;
+    const args = requireRecord(payload.args ?? {});
+    const encoding = typeof args.encoding === 'string' ? args.encoding : 'utf8';
+    const timeoutMs = Number(args.timeoutMs ?? tcp.timeoutMs ?? 5_000);
+    return await new Promise((resolve, reject) => {
+        const chunks = [];
+        let settled = false;
+        const socket = tcp.tls
+            ? tlsConnect({ host: tcp.host, port: tcp.port, servername: tcp.host })
+            : createConnection({ host: tcp.host, port: tcp.port });
+        const settleResolve = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(value);
+        };
+        const settleReject = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(error);
+        };
+        const timer = setTimeout(() => {
+            socket.destroy();
+            settleReject(bridgeKitError('tcp_timeout', `TCP connection timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        let wroteOnConnect = false;
+        const writeAfterConnect = () => {
+            if (wroteOnConnect)
+                return;
+            wroteOnConnect = true;
+            if (args.data !== undefined)
+                socket.write(args.data, encoding);
+            if (args.end !== false)
+                socket.end();
+            if (args.data === undefined && args.readUntilClose !== true) {
+                clearTimeout(timer);
+                socket.end();
+                settleResolve({ resourceId: tcp.id, connected: true, tls: Boolean(tcp.tls) });
+            }
+        };
+        socket.on('connect', () => {
+            if (!tcp.tls)
+                writeAfterConnect();
+        });
+        socket.on('secureConnect', writeAfterConnect);
+        socket.on('data', (chunk) => chunks.push(Buffer.from(chunk)));
+        socket.on('error', (error) => {
+            clearTimeout(timer);
+            settleReject(error);
+        });
+        socket.on('close', () => {
+            clearTimeout(timer);
+            settleResolve({
+                resourceId: tcp.id,
+                connected: true,
+                tls: Boolean(tcp.tls),
+                bytes: chunks.reduce((total, chunk) => total + chunk.length, 0),
+                data: Buffer.concat(chunks).toString(encoding)
+            });
+        });
+    });
+}
+function subscribeTcpStream(resource, payload, emit) {
+    if (resource.kind !== 'tcp')
+        throw bridgeKitError('resource_type_mismatch', `${resource.id} is not a TCP resource`);
+    const tcp = resource;
+    const args = requireRecord(payload.args ?? {});
+    const encoding = typeof args.encoding === 'string' ? args.encoding : 'utf8';
+    const timeoutMs = Number(args.timeoutMs ?? tcp.timeoutMs ?? 10_000);
+    const idleTimeoutMs = typeof args.idleTimeoutMs === 'number' && Number.isFinite(args.idleTimeoutMs) && args.idleTimeoutMs > 0 ? args.idleTimeoutMs : 0;
+    const socket = tcp.tls
+        ? tlsConnect({ host: tcp.host, port: tcp.port, servername: tcp.host })
+        : createConnection({ host: tcp.host, port: tcp.port });
+    let open = false;
+    const connectTimer = setTimeout(() => {
+        emit({
+            event: 'tcp.error',
+            resourceId: resource.id,
+            capability: 'tcp.stream',
+            data: { message: `TCP stream connection timed out after ${timeoutMs}ms`, timestamp: new Date().toISOString() }
+        });
+        socket.destroy();
+    }, timeoutMs);
+    function markOpen() {
+        if (open)
+            return;
+        open = true;
+        clearTimeout(connectTimer);
+        if (args.noDelay !== false)
+            socket.setNoDelay(true);
+        if (args.keepAlive === true)
+            socket.setKeepAlive(true);
+        if (idleTimeoutMs > 0) {
+            socket.setTimeout(idleTimeoutMs, () => {
+                emit({
+                    event: 'tcp.timeout',
+                    resourceId: resource.id,
+                    capability: 'tcp.stream',
+                    data: { idleTimeoutMs, timestamp: new Date().toISOString() }
+                });
+                socket.destroy();
+            });
+        }
+        emit({
+            event: 'tcp.open',
+            resourceId: resource.id,
+            capability: 'tcp.stream',
+            data: { host: tcp.host, port: tcp.port, tls: Boolean(tcp.tls), timestamp: new Date().toISOString() }
+        });
+        if (args.data !== undefined)
+            socket.write(args.data, encoding);
+    }
+    socket.on('connect', () => {
+        if (!tcp.tls)
+            markOpen();
+    });
+    socket.on('secureConnect', markOpen);
+    socket.on('data', (chunk) => {
+        emit({
+            event: 'tcp.data',
+            resourceId: resource.id,
+            capability: 'tcp.stream',
+            data: {
+                chunk: chunk.toString(encoding),
+                bytes: chunk.length,
+                timestamp: new Date().toISOString()
+            }
+        });
+    });
+    socket.on('end', () => {
+        emit({
+            event: 'tcp.end',
+            resourceId: resource.id,
+            capability: 'tcp.stream',
+            data: { timestamp: new Date().toISOString() }
+        });
+    });
+    socket.on('close', (hadError) => {
+        clearTimeout(connectTimer);
+        emit({
+            event: 'tcp.close',
+            resourceId: resource.id,
+            capability: 'tcp.stream',
+            data: { hadError, timestamp: new Date().toISOString() }
+        });
+    });
+    socket.on('error', (error) => {
+        clearTimeout(connectTimer);
+        emit({
+            event: 'tcp.error',
+            resourceId: resource.id,
+            capability: 'tcp.stream',
+            data: { message: error.message, timestamp: new Date().toISOString() }
+        });
+    });
+    socket.unref?.();
+    return {
+        close: () => socket.destroy(),
+        send: async (sendPayload) => {
+            const data = streamSendPayloadToBuffer(sendPayload);
+            if (data.length > 0) {
+                const flushed = socket.write(data);
+                if (!flushed)
+                    await new Promise((resolve) => socket.once('drain', resolve));
+            }
+            if (sendPayload.end)
+                socket.end();
+            return { sent: true, bytes: data.length, queued: socket.writableNeedDrain, ended: Boolean(sendPayload.end) };
+        }
+    };
+}
+function subscribeWebSocket(resource, payload, emit) {
+    const { url, protocols, headers, timeoutMs, initialPayload } = approvedWebSocketRequest(resource, payload.args);
+    const socket = new NodeWebSocket(url, protocols.length > 0 ? protocols : undefined, { headers, handshakeTimeout: timeoutMs });
+    socket.on('open', () => {
+        emit({
+            event: 'websocket.open',
+            resourceId: resource.id,
+            capability: 'websocket.connect',
+            data: { url: redactUrl(url), protocol: socket.protocol, timestamp: new Date().toISOString() }
+        });
+        if (initialPayload)
+            socket.send(initialPayload);
+    });
+    socket.on('message', (data, isBinary) => {
+        const buffer = rawWebSocketDataToBuffer(data);
+        emit({
+            event: 'websocket.message',
+            resourceId: resource.id,
+            capability: 'websocket.connect',
+            data: {
+                data: isBinary ? undefined : buffer.toString('utf8'),
+                binaryBase64: isBinary ? buffer.toString('base64') : undefined,
+                bytes: buffer.length,
+                binary: isBinary,
+                timestamp: new Date().toISOString()
+            }
+        });
+    });
+    socket.on('close', (code, reason) => {
+        emit({
+            event: 'websocket.close',
+            resourceId: resource.id,
+            capability: 'websocket.connect',
+            data: { code, reason: reason.toString('utf8'), timestamp: new Date().toISOString() }
+        });
+    });
+    socket.on('error', (error) => {
+        emit({
+            event: 'websocket.error',
+            resourceId: resource.id,
+            capability: 'websocket.connect',
+            data: { message: error.message, timestamp: new Date().toISOString() }
+        });
+    });
+    return {
+        close: () => socket.close(),
+        send: async (sendPayload) => {
+            if (socket.readyState !== NodeWebSocket.OPEN) {
+                throw bridgeKitError('stream_not_open', `WebSocket resource ${resource.id} is not open`);
+            }
+            const data = streamSendPayloadToWire(sendPayload);
+            await new Promise((resolve, reject) => {
+                socket.send(data, (error) => error ? reject(error) : resolve());
+            });
+            if (sendPayload.end)
+                socket.close();
+            return { sent: true, bytes: Buffer.isBuffer(data) ? data.length : Buffer.byteLength(data), ended: Boolean(sendPayload.end) };
+        }
+    };
+}
+function approvedWebSocketRequest(resource, argsInput) {
+    if (resource.kind !== 'websocket')
+        throw bridgeKitError('resource_type_mismatch', `${resource.id} is not a WebSocket resource`);
+    const wsResource = resource;
+    const args = requireRecord(argsInput ?? {});
+    const base = new URL(wsResource.url);
+    const url = typeof args.path === 'string' ? new URL(args.path, base) : new URL(base.toString());
+    const scopedBasePath = base.pathname.endsWith('/') ? base.pathname : `${base.pathname.replace(/\/$/, '')}/`;
+    if (url.origin !== base.origin || (base.pathname !== '/' && !url.pathname.startsWith(scopedBasePath))) {
+        throw bridgeKitError('scope_violation', `WebSocket path escapes approved URL for ${wsResource.id}`);
+    }
+    const protocols = Array.isArray(args.protocols) && args.protocols.every((entry) => typeof entry === 'string')
+        ? args.protocols
+        : wsResource.protocols ?? [];
+    const headers = { ...(wsResource.defaultHeaders ?? {}), ...(isRecord(args.headers) ? args.headers : {}) };
+    const timeoutMs = Number(args.timeoutMs ?? wsResource.timeoutMs ?? 10_000);
+    const initialPayload = args.binaryBase64
+        ? Buffer.from(args.binaryBase64, 'base64')
+        : args.data !== undefined
+            ? args.data
+            : args.json !== undefined
+                ? JSON.stringify(args.json)
+                : undefined;
+    return { url: url.toString(), protocols, headers, timeoutMs, initialPayload };
+}
+function streamSendPayloadToBuffer(payload) {
+    const wire = streamSendPayloadToWire(payload);
+    return Buffer.isBuffer(wire) ? wire : Buffer.from(wire, typeof payload.encoding === 'string' ? payload.encoding : 'utf8');
+}
+function streamSendPayloadToWire(payload) {
+    if (payload.binaryBase64 !== undefined)
+        return Buffer.from(payload.binaryBase64, 'base64');
+    if (payload.data !== undefined)
+        return payload.data;
+    if (payload.json !== undefined)
+        return JSON.stringify(payload.json);
+    return '';
+}
+function rawWebSocketDataToBuffer(data) {
+    if (Buffer.isBuffer(data))
+        return data;
+    if (Array.isArray(data))
+        return Buffer.concat(data.map((entry) => rawWebSocketDataToBuffer(entry)));
+    if (data instanceof ArrayBuffer)
+        return Buffer.from(data);
+    if (ArrayBuffer.isView(data))
+        return Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+    return Buffer.from(String(data));
+}
+function redactUrl(url) {
+    const parsed = new URL(url);
+    parsed.username = '';
+    parsed.password = '';
+    return parsed.toString();
+}
+function pipeProxy(upstreamUrl, incoming, outgoing) {
+    const transport = upstreamUrl.protocol === 'https:' ? httpsRequest : httpRequest;
+    const request = transport(upstreamUrl, { method: incoming.method, headers: incoming.headers }, (response) => {
+        outgoing.writeHead(response.statusCode ?? 502, response.headers);
+        response.pipe(outgoing);
+    });
+    request.on('error', (error) => {
+        outgoing.writeHead(502, { 'content-type': 'application/json' });
+        outgoing.end(JSON.stringify({ error: error.message }));
+    });
+    incoming.pipe(request);
+}
+export async function createAgentHttpServer(ctxFactory) {
+    return createServer(async (req, res) => {
+        try {
+            const ctx = ctxFactory();
+            const url = new URL(req.url ?? '/', `http://${req.headers.host ?? `${ctx.agentHost}:${ctx.agentPort}`}`);
+            if (url.pathname === '/health') {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ ok: true, service: 'bridgekit-agent' }));
+                return;
+            }
+            if (url.pathname === '/resources') {
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ resources: await ctx.registry.describe() }));
+                return;
+            }
+            const match = url.pathname.match(/^\/_bridgekit\/ports\/([^/]+)(\/.*)?$/);
+            if (match) {
+                const resource = await ctx.registry.get(decodeURIComponent(match[1]));
+                if (resource.kind !== 'port')
+                    throw bridgeKitError('resource_type_mismatch', `${resource.id} is not a port resource`);
+                const port = resource;
+                const upstream = new URL(`${port.protocol ?? 'http'}://${port.host}:${port.port}${match[2] ?? '/'}${url.search}`);
+                pipeProxy(upstream, req, res);
+                return;
+            }
+            res.writeHead(404, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({ error: 'not_found' }));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : 'Unknown error';
+            res.writeHead(500, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({ error: message }));
+        }
+    });
+}
+async function handlePort(ctx, resource, payload) {
+    if (resource.kind !== 'port')
+        throw bridgeKitError('resource_type_mismatch', `${resource.id} is not a port resource`);
+    const port = resource;
+    switch (payload.capability) {
+        case 'port.forward':
+            return { resourceId: port.id, localTarget: `${port.protocol ?? 'http'}://${port.host}:${port.port}`, proxyUrl: `http://${ctx.agentHost}:${ctx.agentPort}/_bridgekit/ports/${encodeURIComponent(port.id)}/` };
+        case 'port.status': {
+            try {
+                await stat(`/proc/${process.pid}`);
+            }
+            catch {
+                // Non-Linux hosts can still report configured status.
+            }
+            return { resourceId: port.id, host: port.host, port: port.port, configured: true };
+        }
+        case 'port.close':
+            return { resourceId: port.id, closed: true, note: 'Static MVP proxy has no persistent tunnel to close.' };
+        default:
+            throw bridgeKitError('capability_not_supported', `Unsupported port capability: ${payload.capability}`);
+    }
+}
+export class ProcessManager {
+    processes = new Map();
+    logs = new Map();
+    subscribers = new Map();
+    start(id, resource, extraArgs = []) {
+        if (this.processes.has(id))
+            throw bridgeKitError('process_running', `Process ${id} is already running`);
+        const args = [...(resource.args ?? []), ...(resource.allowExtraArgs ? extraArgs : [])];
+        const child = spawn(resource.command, args, { cwd: resource.cwd, env: { ...process.env, ...(resource.env ?? {}) }, shell: false });
+        this.processes.set(id, child);
+        this.logs.set(id, []);
+        child.stdout.on('data', (chunk) => this.capture(id, chunk.toString(), 'stdout'));
+        child.stderr.on('data', (chunk) => this.capture(id, chunk.toString(), 'stderr'));
+        child.on('exit', (code, signal) => {
+            this.capture(id, `process exited code=${code ?? 'null'} signal=${signal ?? 'null'}`, 'system');
+            this.processes.delete(id);
+        });
+        return { processId: child.pid, resourceId: id };
+    }
+    stop(id) {
+        const child = this.processes.get(id);
+        if (!child)
+            return { stopped: false };
+        child.kill('SIGTERM');
+        this.processes.delete(id);
+        return { stopped: true };
+    }
+    status(id) {
+        const child = this.processes.get(id);
+        return { running: Boolean(child), processId: child?.pid };
+    }
+    getLogs(id) {
+        return { lines: this.logs.get(id) ?? [] };
+    }
+    subscribe(id, listener, replay = true) {
+        const listeners = this.subscribers.get(id) ?? new Set();
+        listeners.add(listener);
+        this.subscribers.set(id, listeners);
+        if (replay) {
+            const lines = this.logs.get(id) ?? [];
+            if (lines.length > 0) {
+                queueMicrotask(() => listener({ stream: 'system', text: lines.join('\n'), lines, timestamp: new Date().toISOString() }));
+            }
+        }
+        return () => {
+            const current = this.subscribers.get(id);
+            current?.delete(listener);
+            if (current?.size === 0)
+                this.subscribers.delete(id);
+        };
+    }
+    capture(id, text, stream) {
+        const lines = this.logs.get(id) ?? [];
+        const nextLines = text.split('\n').filter(Boolean);
+        lines.push(...nextLines);
+        this.logs.set(id, lines.slice(-500));
+        const event = { stream, text, lines: nextLines, timestamp: new Date().toISOString() };
+        for (const listener of this.subscribers.get(id) ?? [])
+            listener(event);
+    }
+}
+function subscribeProcessLogs(ctx, resource, emit) {
+    if (resource.kind !== 'process')
+        throw bridgeKitError('resource_type_mismatch', `${resource.id} is not a process resource`);
+    const unsubscribe = ctx.processManager.subscribe(resource.id, (event) => {
+        emit({
+            event: 'process.log',
+            resourceId: resource.id,
+            capability: 'logs.subscribe',
+            data: event
+        });
+    });
+    return { close: unsubscribe };
+}
+function subscribeLogs(ctx, resource, payload, emit) {
+    if (resource.kind === 'process')
+        return subscribeProcessLogs(ctx, resource, emit);
+    if (resource.kind !== 'log')
+        throw bridgeKitError('resource_type_mismatch', `${resource.id} is not a log or process resource`);
+    const log = resource;
+    const args = requireRecord(payload.args ?? {});
+    const controller = new AbortController();
+    let offset = 0;
+    async function readNewContent() {
+        try {
+            const info = await stat(log.filePath);
+            if (info.size < offset)
+                offset = 0;
+            if (info.size === offset)
+                return;
+            const length = info.size - offset;
+            const buffer = Buffer.alloc(length);
+            const file = await open(log.filePath, 'r');
+            try {
+                await file.read(buffer, 0, length, offset);
+            }
+            finally {
+                await file.close();
+            }
+            offset = info.size;
+            emit({
+                event: 'log.chunk',
+                resourceId: resource.id,
+                capability: 'logs.subscribe',
+                data: { text: buffer.toString('utf8'), bytes: length, timestamp: new Date().toISOString() }
+            });
+        }
+        catch (error) {
+            emit({
+                event: 'log.error',
+                resourceId: resource.id,
+                capability: 'logs.subscribe',
+                data: { message: error instanceof Error ? error.message : 'Unknown log read error', timestamp: new Date().toISOString() }
+            });
+        }
+    }
+    void (async () => {
+        try {
+            const info = await stat(log.filePath);
+            offset = args.fromStart === true ? 0 : info.size;
+            if (args.fromStart === true)
+                await readNewContent();
+        }
+        catch {
+            offset = 0;
+        }
+    })();
+    const watcher = watch(log.filePath, { signal: controller.signal }, () => {
+        void readNewContent();
+    });
+    watcher.on('error', (error) => {
+        emit({
+            event: 'log.error',
+            resourceId: resource.id,
+            capability: 'logs.subscribe',
+            data: { message: error.message, timestamp: new Date().toISOString() }
+        });
+    });
+    watcher.unref?.();
+    return { close: () => controller.abort() };
+}
+async function handleProcess(ctx, resource, payload) {
+    if (resource.kind !== 'process')
+        throw bridgeKitError('resource_type_mismatch', `${resource.id} is not a process resource`);
+    const proc = resource;
+    const args = requireRecord(payload.args ?? {});
+    switch (payload.capability) {
+        case 'process.start':
+            return ctx.processManager.start(proc.id, proc, Array.isArray(args.args) ? args.args.filter((entry) => typeof entry === 'string') : []);
+        case 'process.stop':
+            return ctx.processManager.stop(proc.id);
+        case 'process.restart':
+            ctx.processManager.stop(proc.id);
+            return ctx.processManager.start(proc.id, proc);
+        case 'process.status':
+            return ctx.processManager.status(proc.id);
+        case 'process.logs':
+            return ctx.processManager.getLogs(proc.id);
+        default:
+            throw bridgeKitError('capability_not_supported', `Unsupported process capability: ${payload.capability}`);
+    }
+}
+//# sourceMappingURL=handlers.js.map