@fitlab-ai/agent-infra 0.7.7 → 0.8.1

package/dist/lib/sandbox/capture.js

@@ -0,0 +1,158 @@
+import { spawn } from 'node:child_process';
+import { loadConfig } from "./config.js";
+import { containerNameCandidates, sandboxBranchLabel, sandboxLabel } from "./constants.js";
+import { detectEngine } from "./engine.js";
+import { hostTimezoneEnvFlags, terminalEnvFlags } from "./commands/enter.js";
+import { fetchSandboxRows, selectSandboxContainer, startSandboxContainer } from "./commands/list-running.js";
+async function spawnCapture(file, args) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(file, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        const rejectOnce = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(error);
+        };
+        const resolveOnce = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(result);
+        };
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk;
+        });
+        child.on('error', rejectOnce);
+        child.on('close', (exitCode, signal) => {
+            resolveOnce({ exitCode, signal, stdout, stderr });
+        });
+    });
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+export function createRunId(date = new Date()) {
+    return `run-${date.toISOString().replace(/\.\d{3}Z$/, 'Z').replace(/[-:]/g, '').replace('T', '-').replace('Z', '')}-${process.pid}`;
+}
+function buildRunScript(params) {
+    const command = params.command.map(shellQuote).join(' ');
+    const runDir = shellQuote(params.runDir);
+    const runId = shellQuote(params.runId);
+    return `#!/bin/sh
+set -u
+cd /workspace
+date "+%Y-%m-%d %H:%M:%S%:z" > ${runDir}/started_at
+printf '%s\\n' running > ${runDir}/status
+${command}
+code=$?
+printf '%s\\n' "$code" > ${runDir}/exit_code
+date "+%Y-%m-%d %H:%M:%S%:z" > ${runDir}/finished_at
+if [ "$code" -eq 0 ]; then
+  printf '%s\\n' completed > ${runDir}/status
+else
+  printf '%s\\n' failed > ${runDir}/status
+fi
+printf '\\n[agent-infra] run %s finished with exit code %s\\n' ${runId} "$code"
+exec bash -l
+`;
+}
+function buildTmuxLauncher(params) {
+    const session = 'work';
+    const window = `ai-${params.runId.replace(/^run-/, '').slice(0, 18)}`;
+    const runRoot = '/tmp/agent-infra-runs';
+    const runDir = `${runRoot}/${params.runId}`;
+    const runScript = buildRunScript({ command: params.request.command, runDir, runId: params.runId });
+    const runScriptBase64 = Buffer.from(runScript, 'utf8').toString('base64');
+    const paneCommand = `cd /workspace && ${shellQuote(`${runDir}/run.sh`)}`;
+    return `set -eu
+session=${shellQuote(session)}
+window=${shellQuote(window)}
+run_id=${shellQuote(params.runId)}
+run_dir=${shellQuote(runDir)}
+task_ref=${shellQuote(params.request.taskRef)}
+branch=${shellQuote(params.request.branch)}
+
+sandbox-dotfiles-link >/dev/null 2>&1 || true
+mkdir -p "$run_dir"
+printf '%s\\n' pending > "$run_dir/status"
+printf '%s\\n' "$task_ref" > "$run_dir/task_ref"
+printf '%s\\n' "$branch" > "$run_dir/branch"
+printf '%s\\n' ${shellQuote(params.request.command.join(' '))} > "$run_dir/command"
+printf '%s' ${shellQuote(runScriptBase64)} | base64 -d > "$run_dir/run.sh"
+chmod +x "$run_dir/run.sh"
+
+if ! command -v tmux >/dev/null 2>&1; then
+  printf '%s\\n' "tmux is not installed in this sandbox" >&2
+  exit 127
+fi
+
+if ! tmux has-session -t "$session" 2>/dev/null; then
+  tmux new-session -d -s "$session" -n shell
+fi
+
+if [ -n "\${TZ:-}" ]; then
+  tmux set-environment -t "$session" TZ "$TZ" 2>/dev/null || true
+fi
+
+pane=$(tmux new-window -d -P -F '#{pane_id}' -t "$session" -n "$window")
+printf '%s\\n' "$session" > "$run_dir/session"
+printf '%s\\n' "$window" > "$run_dir/window"
+printf '%s\\n' "$pane" > "$run_dir/pane"
+tmux pipe-pane -o -t "$pane" "cat > $run_dir/output.log"
+tmux send-keys -t "$pane" ${shellQuote(paneCommand)} Enter
+
+cat <<EOF
+Started sandbox run $run_id in tmux session '$session', window '$window', pane '$pane'.
+Attach with: ai sandbox enter $task_ref
+Status file: $run_dir/status
+Output log: $run_dir/output.log
+EOF
+`;
+}
+export async function runInSandbox(request, options = {}) {
+    const config = options.engine ? null : loadConfig();
+    const engine = options.engine ?? detectEngine(config);
+    const rows = options.rows ??
+        (() => {
+            const fetched = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config));
+            return [...fetched.running, ...fetched.nonRunning];
+        })();
+    const candidates = options.containerCandidates ?? containerNameCandidates(config, request.branch);
+    const found = selectSandboxContainer(rows, candidates);
+    if (!found) {
+        throw new Error(`Sandbox for ${request.branch} not found. Create it first with ai sandbox create ${request.taskRef}.`);
+    }
+    if (!found.running) {
+        (options.startContainer ?? ((name) => startSandboxContainer(engine, name)))(found.name);
+    }
+    const runId = options.runId ?? createRunId();
+    const runDir = `/tmp/agent-infra-runs/${runId}`;
+    const dockerArgs = [
+        'exec',
+        ...terminalEnvFlags(),
+        ...hostTimezoneEnvFlags(),
+        found.name,
+        'bash',
+        '-lc',
+        buildTmuxLauncher({ request, runId })
+    ];
+    const result = await (options.spawn ?? spawnCapture)('docker', dockerArgs);
+    return {
+        ...result,
+        run: {
+            runId,
+            engine,
+            container: found.name,
+            runDir
+        }
+    };
+}
+//# sourceMappingURL=capture.js.map

package/dist/lib/sandbox/commands/create.js

@@ -514,6 +514,58 @@ function readHostJsonSafe(filePath) {
         return null;
     }
 }
+const CLAUDE_SETTINGS_INHERIT_TOP_LEVEL_KEYS = [
+    'model',
+    'fallbackModel',
+    'availableModels',
+    'modelOverrides',
+    'enforceAvailableModels',
+    'advisorModel',
+    'apiKeyHelper',
+    'effortLevel'
+];
+function isJsonObjectRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function mergeMissingStringEnvFields(target, source) {
+    if (!isJsonObjectRecord(source.env)) {
+        return false;
+    }
+    if (Object.hasOwn(target, 'env') && !isJsonObjectRecord(target.env)) {
+        return false;
+    }
+    let targetEnv = target.env;
+    let changed = false;
+    for (const [key, value] of Object.entries(source.env)) {
+        if (typeof value !== 'string' || value === '') {
+            continue;
+        }
+        if (!targetEnv) {
+            targetEnv = {};
+            target.env = targetEnv;
+        }
+        if (!Object.hasOwn(targetEnv, key)) {
+            targetEnv[key] = value;
+            changed = true;
+        }
+    }
+    return changed;
+}
+function mergeMissingTopLevelSettings(target, source) {
+    let changed = false;
+    for (const key of CLAUDE_SETTINGS_INHERIT_TOP_LEVEL_KEYS) {
+        if (!Object.hasOwn(source, key) || Object.hasOwn(target, key)) {
+            continue;
+        }
+        const value = source[key];
+        if (value === null || value === undefined || value === '') {
+            continue;
+        }
+        target[key] = value;
+        changed = true;
+    }
+    return changed;
+}
 export function ensureClaudeOnboarding(toolDir, hostHomeDir) {
     const claudeJsonPath = path.join(toolDir, '.claude.json');
     let data = {};
@@ -592,12 +644,9 @@ export function ensureClaudeSettings(toolDir, hostHomeDir) {
     }
     if (hostHomeDir) {
         const hostSettings = readHostJsonSafe(path.join(hostHomeDir, '.claude', 'settings.json'));
-        if (hostSettings
-            && typeof hostSettings.effortLevel === 'string'
-            && hostSettings.effortLevel !== ''
-            && !Object.hasOwn(data, 'effortLevel')) {
-            data.effortLevel = hostSettings.effortLevel;
-            changed = true;
+        if (hostSettings) {
+            changed = mergeMissingStringEnvFields(data, hostSettings) || changed;
+            changed = mergeMissingTopLevelSettings(data, hostSettings) || changed;
         }
     }
     if (changed) {
@@ -1064,9 +1113,9 @@ export async function create(args) {
                         if (claudeCodeEntry) {
                             ensureClaudeOnboarding(claudeCodeEntry.dir, effectiveConfig.home);
                             ensureClaudeSettings(claudeCodeEntry.dir, effectiveConfig.home);
-                            // prepareClaudeCredentials wrote the shared credentials file
-                            // before this point. If credentials were missing, the
-                            // claude-code entry was removed from effectiveResolvedTools.
+                            // prepareClaudeCredentials wrote OAuth credentials or confirmed
+                            // provider/API settings are enough for Claude Code. If no usable
+                            // auth was present, the claude-code entry was removed above.
                         }
                         const codexEntry = effectiveResolvedTools.find(({ tool }) => tool.id === 'codex');
                         if (codexEntry) {

package/dist/lib/sandbox/commands/enter.js

@@ -1,7 +1,7 @@
 import { loadConfig } from "../config.js";
 import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel } from "../constants.js";
 import { detectEngine } from "../engine.js";
-import { formatCredentialWarnings, formatRemaining, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from "../credentials.js";
+import { formatCredentialWarnings, formatRemaining, hasClaudeProviderAuth, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from "../credentials.js";
 import { runInteractiveEngine } from "../shell.js";
 import { dotfilesCacheDir, materializeDotfiles } from "../dotfiles.js";
 import { runInteractiveWithClipboardBridge } from "../clipboard/bridge.js";
@@ -50,7 +50,10 @@ export function runSandboxInteractive(params) {
     }
     return runBridge({ engine, dockerArgs, container, home });
 }
-export function formatCredentialSyncStatus(result, isTTY = process.stderr.isTTY) {
+export function formatCredentialSyncStatus(result, isTTY = process.stderr.isTTY, providerAuthAvailable = false) {
+    if (providerAuthAvailable && (result.status === 'STALE_ACCESS' || result.status === 'MISSING')) {
+        return null;
+    }
     if (result.status === 'STALE_ACCESS') {
         return 'Warning: Claude Code credentials on host appear stale. Run "ai sandbox refresh" or "claude /login" to renew.\n';
     }
@@ -100,8 +103,9 @@ export async function enter(args) {
     if (config.tools.includes('claude-code')) {
         try {
             // Scan all projects so a refresh from a neighbouring sandbox can still flow back to the host.
+            const providerAuthAvailable = hasClaudeProviderAuth(config.home);
             const result = reconcileClaudeCredentials(config.home);
-            const message = formatCredentialSyncStatus(result);
+            const message = formatCredentialSyncStatus(result, process.stderr.isTTY, providerAuthAvailable);
             if (message) {
                 process.stderr.write(message);
             }

package/dist/lib/sandbox/credentials.js

@@ -11,6 +11,12 @@ const REDACTION_PATTERNS = [
     { pattern: /gh[psoru]_[A-Za-z0-9]{30,}/g, replacement: '[REDACTED github token]' },
     { pattern: /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/gi, replacement: 'Bearer [REDACTED]' }
 ];
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
 function errorMessage(error) {
     return error instanceof Error ? error.message : 'unknown error';
 }
@@ -102,6 +108,28 @@ export function validateClaudeCredentialsEnvOverride(env = process.env) {
         throw new Error('Invalid AGENT_INFRA_CLAUDE_CREDENTIALS_FILE value. Expected an absolute file path.');
     }
 }
+export function hasClaudeProviderAuthInSettings(settings) {
+    if (!isRecord(settings)) {
+        return false;
+    }
+    const env = isRecord(settings.env) ? settings.env : {};
+    return hasNonEmptyString(env.ANTHROPIC_AUTH_TOKEN)
+        || hasNonEmptyString(env.ANTHROPIC_API_KEY)
+        || hasNonEmptyString(settings.apiKeyHelper);
+}
+export function hasClaudeProviderAuth(home, options = {}) {
+    const { readFn = (targetPath) => fs.readFileSync(targetPath, 'utf8'), existsFn = fs.existsSync } = options;
+    const settingsPath = path.join(home, '.claude', 'settings.json');
+    if (!existsFn(settingsPath)) {
+        return false;
+    }
+    try {
+        return hasClaudeProviderAuthInSettings(JSON.parse(readFn(settingsPath)));
+    }
+    catch {
+        return false;
+    }
+}
 // Reconcile treats the freshest valid endpoint as authoritative so sandbox
 // token rotations can flow back to the host credential store.
 function validateClaudeCredentialsBlob(raw, blob = null) {
@@ -395,11 +423,19 @@ export function formatRemaining(expiresAt) {
     const minutes = totalMinutes % 60;
     return hours > 0 ? `${hours}h ${minutes}m` : `${minutes}m`;
 }
-export function prepareClaudeCredentials(home, project, resolvedTools, extractFn = extractClaudeCredentialsBlob, writeFn = writeClaudeCredentialsFile, inspectFn = inspectClaudeKeychainStatus) {
+export function prepareClaudeCredentials(home, project, resolvedTools, extractFn = extractClaudeCredentialsBlob, writeFn = writeClaudeCredentialsFile, inspectFn = inspectClaudeKeychainStatus, providerAuthFn = hasClaudeProviderAuth) {
     const claudeCodeEntry = resolvedTools.find(({ tool }) => tool.id === 'claude-code');
     if (!claudeCodeEntry) {
         return { status: 'NOT_APPLICABLE' };
     }
+    const providerAuthAvailable = () => {
+        try {
+            return providerAuthFn(home);
+        }
+        catch {
+            return false;
+        }
+    };
     let blob = null;
     const hasCustomInspectFn = inspectFn !== inspectClaudeKeychainStatus;
     const hasCustomExtractFn = extractFn !== extractClaudeCredentialsBlob;
@@ -410,7 +446,7 @@ export function prepareClaudeCredentials(home, project, resolvedTools, extractFn
                 blob = inspection.blob;
                 break;
             case 'MISSING':
-                return { status: 'SKIPPED' };
+                return providerAuthAvailable() ? { status: 'OK' } : { status: 'SKIPPED' };
             case 'KEYCHAIN_LOCKED':
                 throw new Error([
                     'Claude Code credentials are stored in the macOS keychain, but the keychain is locked.',
@@ -418,6 +454,9 @@ export function prepareClaudeCredentials(home, project, resolvedTools, extractFn
                     buildLockedGuidance()
                 ].join('\n'));
             case 'STALE_ACCESS':
+                if (providerAuthAvailable()) {
+                    return { status: 'OK' };
+                }
                 throw new Error([
                     'Claude Code credentials on host are invalid or expired.',
                     '',
@@ -447,7 +486,7 @@ export function prepareClaudeCredentials(home, project, resolvedTools, extractFn
     else {
         blob = extractFn(home);
         if (!blob) {
-            return { status: 'SKIPPED' };
+            return providerAuthAvailable() ? { status: 'OK' } : { status: 'SKIPPED' };
         }
     }
     writeFn(home, project, blob);

package/dist/lib/sandbox/runtimes/base.dockerfile

@@ -61,6 +61,19 @@ RUN cat > /usr/local/bin/cc-token-status <<'SCRIPT' && chmod +x /usr/local/bin/c
 #!/bin/sh
 set -eu
 
+SETTINGS_FILE="/home/devuser/.claude/settings.json"
+if [ -r "$SETTINGS_FILE" ] && jq -e '
+  def has_nonempty($v):
+    if ($v | type) == "string" then ($v | gsub("^\\s+|\\s+$"; "") | length) > 0 else false end;
+  (if type == "object" then . else {} end) as $settings
+  | (if ($settings.env | type) == "object" then $settings.env else {} end) as $env
+  | has_nonempty($env.ANTHROPIC_AUTH_TOKEN)
+    or has_nonempty($env.ANTHROPIC_API_KEY)
+    or has_nonempty($settings.apiKeyHelper)
+' "$SETTINGS_FILE" >/dev/null 2>&1; then
+  exit 0
+fi
+
 CRED_FILE="/home/devuser/.claude/.credentials.json"
 [ -r "$CRED_FILE" ] || exit 0
 

package/dist/lib/server/adapters/_contract.js

@@ -0,0 +1,9 @@
+// Adapter contract for agent-infra-server.
+//
+// This is a pure type + constant module: it carries no runtime logic and no
+// third-party imports. Subtask B (the feishu adapter) and subtask C (the
+// command protocol / runner) build against these shapes. Bump
+// ADAPTER_CONTRACT_VERSION on a breaking change so plugin-loader can reject
+// adapters compiled against an older contract.
+export const ADAPTER_CONTRACT_VERSION = 1;
+//# sourceMappingURL=_contract.js.map

package/dist/lib/server/adapters/feishu/index.js

@@ -0,0 +1,40 @@
+import { createFeishuTransport, normalizeMessage } from "./transport.js";
+// Assemble the feishu adapter. The transport is injectable so unit tests can
+// drive start/dispatch/reply/sendMessage against a fake transport without the
+// real SDK; production uses the default SDK-backed transport.
+export function createFeishuAdapter(config, transport = createFeishuTransport(config)) {
+    let ctx = null;
+    return {
+        name: 'feishu',
+        async start(adapterCtx) {
+            ctx = adapterCtx;
+            await transport.start(async (raw) => {
+                try {
+                    const normalized = normalizeMessage(raw);
+                    const message = {
+                        adapter: 'feishu',
+                        userId: normalized.userId,
+                        chatId: normalized.chatId,
+                        text: normalized.text,
+                        messageId: normalized.messageId,
+                        raw: normalized.raw,
+                        reply: (text) => transport.send(normalized.chatId, text)
+                    };
+                    await adapterCtx.dispatch(message);
+                }
+                catch (error) {
+                    ctx?.logger.err(`feishu: dropped message: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            });
+        },
+        async stop() {
+            await transport.stop();
+        },
+        async sendMessage(target, text) {
+            await transport.send(target.chatId, text);
+        }
+    };
+}
+const factory = (adapterConfig) => createFeishuAdapter(adapterConfig);
+export default factory;
+//# sourceMappingURL=index.js.map

package/dist/lib/server/adapters/feishu/transport.js

@@ -0,0 +1,95 @@
+import * as lark from '@larksuiteoapi/node-sdk';
+function asRecord(value) {
+    return typeof value === 'object' && value !== null ? value : {};
+}
+// Strip feishu mention placeholders (e.g. "@_user_1") that the platform injects
+// for @-mentions, then collapse surrounding whitespace. A group message like
+// "@_user_1 /ping" normalizes to "/ping" so the daemon dispatcher matches it.
+function stripMentions(text) {
+    return text.replace(/@_user_\d+/g, ' ').replace(/\s+/g, ' ').trim();
+}
+// Parse an im.message.receive_v1 event into the daemon's shape. Pure: no SDK,
+// no IO. Throws on missing/invalid fields so the adapter can drop a single bad
+// message without crashing the long connection.
+export function normalizeMessage(event) {
+    const message = asRecord(asRecord(event).message);
+    const messageId = message.message_id;
+    const chatId = message.chat_id;
+    const content = message.content;
+    if (typeof messageId !== 'string' || typeof chatId !== 'string' || typeof content !== 'string') {
+        throw new Error('feishu: malformed im.message.receive_v1 event (missing message_id/chat_id/content)');
+    }
+    const senderId = asRecord(asRecord(asRecord(event).sender).sender_id);
+    const userId = (typeof senderId.open_id === 'string' && senderId.open_id) ||
+        (typeof senderId.union_id === 'string' && senderId.union_id) ||
+        (typeof senderId.user_id === 'string' && senderId.user_id) ||
+        '';
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        throw new Error('feishu: message.content is not valid JSON');
+    }
+    const rawText = asRecord(parsed).text;
+    if (typeof rawText !== 'string') {
+        throw new Error('feishu: unsupported message content (no text field)');
+    }
+    return { userId, chatId, text: stripMentions(rawText), messageId, raw: event };
+}
+function resolveDomain(value) {
+    return value === 'lark' || value === 'Lark' ? lark.Domain.Lark : lark.Domain.Feishu;
+}
+// Build the real SDK-backed transport from adapter config. appId/appSecret come
+// from server config (appSecret only via server.local.json / env). The WSClient
+// long connection delivers events; the Client REST call sends replies.
+// Feishu self-built app IDs have this shape; the SDK's WSClient.start() silently
+// rejects anything else, so we validate up front to fail loudly instead.
+const APP_ID_PATTERN = /^cli_[0-9a-fA-F]{16}$/;
+export function createFeishuTransport(config) {
+    const appId = String(config.appId ?? '').trim();
+    const appSecret = String(config.appSecret ?? '').trim();
+    const domain = resolveDomain(config.domain);
+    // Fail fast on missing or malformed credentials. The SDK only logs to its own
+    // logger and resolves WSClient.start() for an empty or malformed appId, so
+    // without these checks an enabled-but-misconfigured feishu adapter would be
+    // counted as loaded while the long connection never opens. Throwing here lets
+    // loadAdapters log `failed to load adapter "feishu": ...` and skip it.
+    if (appId === '' || appSecret === '') {
+        throw new Error('feishu: appId and appSecret are required; put appSecret in .agents/server.local.json or AGENT_INFRA_SERVER_adapters__feishu__appSecret');
+    }
+    if (!APP_ID_PATTERN.test(appId)) {
+        throw new Error('feishu: appId must match cli_[0-9a-fA-F]{16}');
+    }
+    const client = new lark.Client({ appId, appSecret, domain });
+    const wsClient = new lark.WSClient({ appId, appSecret, domain, loggerLevel: lark.LoggerLevel.warn });
+    return {
+        async start(onMessage) {
+            const eventDispatcher = new lark.EventDispatcher({}).register({
+                'im.message.receive_v1': async (data) => {
+                    await onMessage(data);
+                }
+            });
+            wsClient.start({ eventDispatcher });
+        },
+        async stop() {
+            // Best-effort: close the long connection if the SDK exposes it. Never throw
+            // from shutdown — unloadAdapters isolates stop failures, but staying quiet
+            // keeps the daemon shutdown path clean.
+            const closable = wsClient;
+            try {
+                closable.close?.();
+            }
+            catch {
+                // Ignore: the daemon is shutting down regardless.
+            }
+        },
+        async send(chatId, text) {
+            await client.im.message.create({
+                params: { receive_id_type: 'chat_id' },
+                data: { receive_id: chatId, msg_type: 'text', content: JSON.stringify({ text }) }
+            });
+        }
+    };
+}
+//# sourceMappingURL=transport.js.map

package/dist/lib/server/auth.js

@@ -0,0 +1,19 @@
+const ROLE_RANK = { read: 1, write: 2, exec: 3 };
+function userRole(auth, key) {
+    const users = auth.users;
+    if (!users || typeof users !== 'object' || Array.isArray(users))
+        return null;
+    const record = users[key];
+    if (!record || typeof record !== 'object' || Array.isArray(record))
+        return null;
+    const role = record.role;
+    return role === 'read' || role === 'write' || role === 'exec' ? role : null;
+}
+export function authorize(user, required, auth) {
+    const role = userRole(auth ?? {}, `${user.adapter}:${user.userId}`);
+    if (!role || ROLE_RANK[role] < ROLE_RANK[required]) {
+        return { ok: false, message: `requires ${required}` };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=auth.js.map